Comprehensive debugging of Internet of Things modules

Author : Guido Schulze, Rohde & Schwarz

05 September 2016

Figure 1 - Measurements on the “Cinterion BGS2” GSM module from Gemalto.

The Internet of Things (IoT) is becoming an important driver of innovations in the electronics industry.

(Click here to view article in digi-issue)

Intelligent IoT modules communicate between industrial facilities, machines, Hi-Fi devices as well as between household appliances and mobile phones. They bring together multiple technologies into the smallest of spaces and typically include a radio module. The complexity can become a real challenge for developers of integrated circuitry. During optimisation and commissioning of these components, a highly sensitive oscilloscope with multi-domain capability is extremely helpful. 

When debugging IoT modules, all module functions must be tested, as well as the interaction between the individual functions and components. A multi-domain oscilloscope is needed in order to perform comprehensive measurements using only one test instrument. 

One example is the new R&S RTO2000 lab oscilloscope from Rohde & Schwarz. It can be used to test all of the module's sensor and control signals, the integrated data processing, the power supply and the integrated radio module. The oscilloscope with multi-domain capability performs time, frequency, protocol and logic analyses and establishes all time references. Via the oscilloscope's analogue input channels, the user simultaneously sees the signal in the time and frequency domain, and if desired, the spectrogram. This makes it possible to perform debugging on the functional system level. 

The zone trigger gives the R&S RTO2000 user the option to graphically separate events in the time and frequency domain, something no other comparable oscilloscope can do. It is the first in its class to provide a storage capacity of up to 2 Gsample. This is useful for the history function, which provides access to previously acquired waveforms at any time. With the high definition mode, the user increases the vertical resolution of a waveform to 16 bits, making it possible to see details that otherwise would not be visible. All of these are important tools for commissioning and characterising the function blocks in IoT applications. 

Figure 2 - Minimum current drain in sleep mode.

Measurements on a GSM IoT module 

The example of the "Cinterion BGS2" GSM module from Gemalto illustrates how the user can test the key functions of an IoT module using the R&S RTO2000. The Gemalto module is designed for machine-to-machine (M2M) applications. The manufacturer offers modules for various industries, ranging from health care and the retail sector to energy and transportation to logistics and the automotive industry. In this case, the “Cinterion BGS2” connects a GSM radio module to a baseband processor, to the power supply management, to various serial interfaces for modems, inter-integrated circuits (I2C) and multipurpose (GPIO), as well as to the clock source, the flash memory, a converter and an audio interface. This module is therefore a good example of a complex embedded wireless design. 

Maximising battery runtime – sleep mode

Like many IoT modules, the one from Gemalto is designed for remote operation and can thus include a long-life battery for its power supply. At a minimal current drain, the module will provide data via the radio interface for years. The characterisation of the module with respect to power consumption is therefore an important part of commissioning and optimisation. It is important to analyse the dynamic response of the power supply during data transmission and when there is a change in the operating state.

The Gemalto module offers various sleep mode configurations. This will ensure a minimal current drain in the inactive state with no radio traffic. In a sleep mode configuration where the minimum current is reduced to a low 2 mA, the sleep sequence is regularly interrupted by paging sequences from the base station. This increases the current drain briefly to over 100 mA. This mode is analysed in detail by means of time, frequency, protocol and logic measurements.

Figure 3 - Minimum current drain when not in sleep mode.

The current of the IoT module is measured using the R&S RT-ZC30 along with the most sensitive current probe offered by Rohde & Schwarz. It can resolve currents of less than 1 mA at a bandwidth of 120 MHz and permits a maximum current of 5 A. These precise current measurements are possible in conjunction with the unusually low-noise input stages of the R&S RTO2000. To ensure that the measurement results are not falsified, the user must demagnetise the current probe before measuring the current and also "auto-zero" the current probe and measurement channel. This is the only way to ensure that the lowest currents are determined with the required accuracy. 

The radio antenna's signals are captured via a near-field probe connected to the analogue input channel on the oscilloscope. As a result, the radio signals from the module are visible as an analogue signal in both the time domain and the frequency domain via a fast Fourier transform (FFT). An additional oscilloscope channel is connected to the power supply via an active probe. Digital channels (MSO) then capture the communications at the modem interface. The individual serial bus signals use the universal asynchronous receiver transmitter (UART) protocol and are decoded with the R&S RTO-K1 option.  

Figure 2 shows an example measurement. The current (channel 3 – orange) during the sleep sequence is determined within a gate (grey area), and is 1.8 mA. During the paging sequence, a significantly higher current of about 100 mA is detected because the module briefly wakes up and transmits a pulse on the clear to send (CTS) line via the communications interface. Channel 1 (yellow) shows that the radio module remains inactive during the sleep sequence and does not transmit any signals.

Figure 3 shows sleep mode being exited. The minimum current drain increases to 8 mA. This has a noticeable effect on the battery life. To acquire the exact time that the program switches over, a protocol trigger was applied to the transmitter (Tx) signal at the communications interface. Data item 0Dh corresponds to the position where the programming input ends the sleep mode. In the figure, the Tx signal and the MSO logic signal (D0: Tx) are visible, along with the decoded UART signal (for improved visibility even in zoom).

Dynamic transitions as shown here from sleep mode with very low current of 1 mA to 2 mA to an operational state with currents of greater than 1 A are critical measurement points. In this case, it makes sense to take a close look at the current drain with an appropriate level of resolution. With the R&S RTO2000, the user can switch to 16-bit high definition mode in these situations. Adjustable lowpass filters that are applied to the signal after the A/D converter make this exceptionally high resolution possible. As a result, even signal details in the mA range can be analysed over a large vertical measurement range. The oscilloscope is even able to trigger here as necessary. 

Figure 4 - Characterisation of voltage and current during a GSM transmit pulse.

Current and voltage in transmit mode

The current and voltage waveforms can be analysed during radio operation in order to uncover additional sources of interference and power-reduction opportunities. For example, how high is the current drain during the initialisation of calls or during the transmission of SMS data? The voltage dip during the high current draw from transmit sequences is especially critical. As an example, falling below the lower voltage limit can cause the IoT module to be switched off automatically.

The design of the power supply system is a demanding task that touches upon a variety of functionalities. DC-DC switched-mode power supplies or low-drop-out voltage regulators (LDOs) generate the appropriate voltages for the various function blocks from the central supply voltage. The Gemalto IoT module has an internal power management controller along with LDOs and DC-DC downconverters in order to ensure a stable power supply for the GSM module and the SIM card. The power management controller also controls the on/off switching operations in the module.

Parameters that are critical for optimal functioning of the IoT module include the maximum current drain during the transmit burst as well as the maintenance of a minimum voltage despite voltage dips, ripples and peaks (Figure 4). The quality of the radio signal is also strongly dependent on the noise characteristics and any spectral interference in the power supply.

The Gemalto module monitors the voltage via an integrated A/D converter. The solution can determine voltage values down to a minimum interval of 0.5s. This is sufficient for operation but not for debugging and optimisation of the power supply during commissioning of the IoT application.

Figure 5 - Functional test of the entire system during a call.

The voltage is therefore measured using the oscilloscope and a single-ended active probe, e.g. the 1 GHz R&S RT-ZS10 from Rohde & Schwarz. This has a separate offset setting that can be set to quiescent potential during the measurement. The user can then use a fine vertical scaling to focus in on the power supply details, in particular the noise characteristics. Spectral interferers are easy to detect with the user-friendly FFT function on the R&S RTO2000. The spectrogram even makes analysis of the frequency components possible over a longer time period. Faults are quickly detected in the graphical spectrogram display. 

The example measurement in Figure 4 shows a function for the new oscilloscope that is both useful and unique: the zone trigger. Within the radio signal spectrum, a mask is defined in the 890 MHz to 910 MHz range for trigger decisions. In the example measurement, the trigger is initiated only if a transmit pulse is detected in this mask. The current and voltage waveforms can be later correlated with the transmit pulses using the history player.

Debugging at system level – from radio signal to modem signal

The embedded design approach is typically employed to minimise the costs of an IoT module. All functions, including the radio unit, are integrated into an extremely small footprint. As a result, interference can easily occur between the various function blocks. To test how robust a design is, or to perform debugging, a test tool is needed that acquires data at the various interfaces with a time correlation and then performs an analysis. This is where the user can benefit from the multi-domain functionality offered by R&S RTO oscilloscopes from Rohde & Schwarz. Figure 5 shows how the IoT module is contacted via a GSM connection. The RF signal as well as the voltage and current supply are measured via the analogue channels. The digital channels record the subsequent communications between the IoT module and the UART interfaces. The protocol decoding makes it possible to read the " 'R' 'I' 'N' 'G' " in ASCII code on the ring line. Thanks to the fixed time correlation between the signals, the temporal sequence for data acquisition, processing and communications can be analysed. Faults passing through the system can easily be detected by the R&S RTO2000. And the battery optimisation is supported by correlating all activities with the corresponding current drain.


IoT modules are typically complex embedded designs with integrated radio modules. The new R&S RTO2000 oscilloscope offers a variety of multi-domain functions that support system-level debugging of all interfaces. Its low-noise inputs combined with the sensitive R&S RT-ZC30 current probe allow measurement of quiescent currents in the range of 1 mA. Dynamic current waveforms can be correlated with the individual functions of the IoT module. The spectrum analysis functionality of the R&S RTO also allows the radio modules of IoT applications to be tested. Rohde & Schwarz additionally offers a broad product portfolio of signal and spectrum analysers as well as mobile radio testers for handling special RF measurements.

Contact Details and Archive...

Print this page | E-mail this page