How to reverse engineer an analog chip: the TDA7000 FM radio receiver (opens in new tab)

Hey Ken, great read as always. I wonder if in future you would consider doing an overview of the various early radio chips and their evolution. I recall recently reading some HAM projects and understanding that a lot of the later radio chips were clones of earlier designs. Given your suggestion that this earlier period of integrated radio innovation is 'low hanging fruit' in terms of RE-friendliness, it should be an interesting read and I'm sure a very large number of radio enthusiasts would love to see your insights.

The separate noise source is a bit of surprise here. Why is it necessary? Wouldn't RF noise produce same results?

The application note gives more details [1], but I find it a bit confusing. The idea is that as long as you are within about +/- 100 kHz of the station (a wide range), the radio will lock onto the right frequency (because of the frequency-locked loop), giving the nominally 70 kHz IF. Since the 70 kHz signal doesn't vary much over a half-wavelength (as you said), the correlator will be happy. The correlator will still stay locked as the IF varies +/- 15 kHz with the audio signal. (The correlator doesn't require a perfect match, just mostly matching.)

The problem is that if you mis-tune the radio by 100 kHz or so, the FM detector will give you an output, but it will be distorted. The issue is that the FM detector is linear over a small range, but outside that range, you get non-linear side lobes. So if you tune to a side-lobe frequency, the radio will lock onto the frequency, but the output will have harmonic distortion. In this case, the IF frequency is way off from 70 kHz, enough that the delayed signal and the inverted signal don't match at all, so the correlation fails and mutes the audio. Then you'd re-tune and find the right frequency.

[1] See Figures 8-12. Link: https://www.tel.uva.es/personales/tri/radio_TDA7000.pdf