Repairing the HackRF

I broke my HackRF One. I have no idea how, but I did it.

While testing a power amplifier I realized that there was not transmission at all. After checking the software, the connections and the power amplifier, I confirmed that my HackRF was broken. It was able receive but not to transmit. More precisely, I was not able to transmit when configuring the HackRF with medium-high TX power. However it worked when configuring the HackRF to transmit with low power.

A fast check in the schematics confirmed my fears: the power amplifier stage was blown.

HOW TO DETECT IF YOU BLOWN YOUR PA OR LNA STAGE

The HackRF One uses two Avago MGA-81563 amplifiers. This chip amplifies the input signal by 14dB. In the HackRF this chip is used as a power amplifier (PA) for transmitting and as a Low Noise Amplifier (LNA) for receiving. In the PCB they are marked as U25 and U13 respectively.

hackRF_sch

HackRF One – LNA and PA schematic

Two RF switches Skyworks Sky13317 – U12 and U14 in the schematic – connect the antenna to the LNA, the PA or they just bypass the amplifiers. When working the with HackRF in GNU Radio, the RF parameter enables the amplifiers (RF=14)  or disables/bypass them (RF=0)

Is very easy to find if the LNA – the amplifier for the RX signal – is broken. You just have to launch the osmocom_fft program (you can find it in the  gr-osmosdr package of Pybombs) and sintonize a frequency where you can see transmissions (eg: the FM band). Configure the IF and BB gain to something in the middle of the scale (around 16 and 26dB respectively) and set the RF gain to 0. Measure signals you receive, set the RF gain to 14 and measure them again. You should have approximately a 14db gain. If switching the RF to 14 attenuates the signals instead of increasing, the LNA (U25 in the schematics) is broken and you have to change it.
The following image shows a working LNA. When the RF is set to 14, the signal is amplified by almost 14dB.

Osmocom_fft. LNA OFF vs LNA ON

Osmocom_fft. LNA OFF vs LNA ON

Finding if the PA is broken can be trickier because you need to use a external tool to measure the output power. This tool can be another HackRF or a cheap SDR like the RTL-SDR, but I will use a spectrum analyzer.
Use GNU Radio Companion to transmit a carrier. Set the IF gain to 47 and the RF gain to 0. Measure the output power, set the RF gain to 14 and measure again. If you don’t see an increase of approximately 14 dBs but you see that the signal is attenuated instead, your PA (U13 in the schematic) is broken and it needs to be substituted.

GNU Radio Companion flow used for testing the HackRF

GNU Radio Companion flow used for testing the HackRF

The following image shows the output of my HackRF with PA off and on. As you can see, the signal with the PA off is stronger. This clearly indicates that the PA is blown.

Broken HackRF. Left: PA off - Right: PA on.

Broken HackRF. Left: PA off – Right: PA on.

The main reason why people kill the LNA is because they put too much power in the input. The HackRF is designed for a maximum RX signal of -5dBm. I read in Internet about people that connected their 5Watts (37dBm) directly to the HackRF input, without any attenuator. Magic smoke guaranteed!

The PA can be destroyed because a antenna impedance mismatch. Transmitting without antenna or an incorrect antenna produces a high reflected power that can destroy the PA. In my case, I did not know that the HackRF continues transmitting even if you stop the application. In order to stop HackRF to transmit, you need to press the reset button. I probably killed my HackRF when inserting and removing the external power amplifier I was testing.

REPAIRING THE HACKRF

You will need to substitute the blown amplifier. You can buy a replacement in Farnell, Digikey, Mouser, etc for less that 3€. The following image shows the location of the LNA and PA (U25 and U13) in the PCB. Blue arrow points to the LNA (U25) and the red arrow points to the PA (U13):

HackRF PCB. Blue arrow: LNA. Red arrow: PA

HackRF PCB. Blue arrow: LNA. Red arrow: PA

I recommend you to use a hot air soldering station and a lot of flux. If you dont have it, you can still use a regular iron solderer if you have a fine tip and you are skilled enough.

Once you substitute the broken amplifier, repeat the tests to check that the LNA or PA works. This is how my HackRF performs after fixing the PA:

Fixed HackRF. Left: PA off - Right: PA on.

Fixed HackRF. Left: PA off – Right: PA on.

If you changed the MGA-81563 and your HackRF still does not work, I would try to change the Sky13317 RF switches (U12 and U14).