Important Maintenance on a Kenwood CS-5130 40MHzOscilloscope with Read-out
Preventing having faulty equipment is a very important part of a good engineer’s life, as is the final repair of any device. So maintenance plays an important role. This article is about a very important eprom in the Kenwood CS-5130 40MHz oscilloscope with READ-OUT function.
In my other Tektronix 2465A oscilloscope there is a 28 pins 44C64 SRAM that will immediately lose its calibration data when the lithium battery voltage is lost. The result is a very expensive oscilloscope that is hardly usable until a difficult calibration procedure has taken place afterwards. It is therefore important to back up this ‘Firmware’ to secure the very important calibration. And in the later scope versions it was a special SRAM chip with built-in lithium battery. These NV RAMS were more expensive. Although they could have been placed on a socket and so easily could have been taken out for copying, these were strangely enough only soldered into the mainboard without sockets. In my equally older Tektronix 2440 these are just regular SRams that like in my 2465A are kept ‘alive’ on-board with a special back-up lithium battery. In my 2440 they are HM62256 SRams. 1 Sram at position U664 provides the calibration data and a 2nd SRam of the same type is for storing the measured waveforms and therefore does not really matter. A similar story is backing up devices that do have UV erasable eproms. As in my Kenwood CS-5130 40MHz 2 channel scope with READ-OUT function, in which a 28 pins Fujitsu MBM27C64 eprom is soldered. Because I wanted to know if I could read the MBM 27C64 eprom U7 on the R/O controller board in-circuit with the TL866 programmer, I produced a specially made 28 pole test clip with socket. (See picture)
Unfortunately, reading with this special IC adapter socket with Testclip was not possible in-circuit. My TL866 constantly gave an error message that the power consumption was too high. Because a short circuit was detected or the IC was possibly connected incorrectly.
Because both of them were not the case, I soldered out the eprom with great care and placed a quality socket on the Read-Out (R/O) board in my Kenwood CS-5130. And finally, the eprom chip was directly plugged into the TL866 programmer and successfully read. (The 8K bin file serves as a backup in case the original eprom from 1988 or thereabouts gets defect. My scope would be worthless without, see picture below with the MBM27C64 / U7).
In-circuit reading of the uPD 44C64 chip, position control board A5 / U2460 in the Tektronix 2465A will therefore not work. But there the SRAM must be connected to the VCC voltage (and GND) at all times while it is being soldered to prevent loss of the calibration data. While this chip also has to be read with the TL 866 and immediately afterwards soldered in again, all-then-not on socket.
I have secured my Kenwood for the future again and the following pictures show the internal structure of the Kenwood CS-5130. The safely read eprom U7 is the bottom 28-pole chip with UV window and text label * T E126.
The 8k x 8 bit chip has 8192 x 8 cells = 65536 memory cells. This is a capacity of 2000 hex = 0000 to 1FFF = 0 to 8191 decimal. In other words, 8192 addresses with an 8-bit value. In case of a 0x8000hex = 32768 bytes chip that is 32768 x 8 bits = 262144 cells. The aforementioned Test clip was offered for a reasonable $ 29.95 US dollar but that was suddenly increased to more than $ 33 dollars when paid, and on top of that came the Shipping and Handling costs plus an Import charge, so the small clip weighing only 100 grams in the end did cost me a scandalous unexpected $ 58.21 US dollar !
I also scanned the Kenwood Service manual I bought in 1990 and converted it to PDF and searchable PDF. The aforementioned eprom U7 is circled in yellow in the next Schematic Diagram of the R / O unit. And as mentioned could not be read with the TL866 in-circuit.
Copying the SRam in our 2465A is no more difficult than copying the eprom in the above method provided that the backup voltage on the Static Ram remains very securely connected. Most Forums speak only about duplicating the much simpler backup NV SRams with built-in backup battery. The reading of our Tektronix SRam chips I have nowhere found. The fact that the simple incircuit reading is not possible makes it much more difficult.
However, a simple solution is maybe to use the 28-pole Test clip to supply the backup SRam supply voltage while the chip is being soldered out. As long as the soldering tin on the chip legs does not cool down too much as a result of which soldering becomes impossible again. And it must also be prevented that the soldering tin is damaged when the copper clamps are inadvertently tinned. And in this case, unsoldering can turn out to be a problem because copper is a very good heat conductor.
Anyway, the message here for all expensive measuring device owners is to check all devices for the presence of internally hidden Firmware in eproms or other chips. Like in my expensive Kenwood oscilloscope that I was not aware of. However, if these are Gals or Pals, they are often protected against reading with a protection bit, unlike the unprotected eprom and SRams. Only the larger PALs can be easily read out with the right universal programmers (usually with programs that are now outdated, such as the older MS-DOS / Windows 95,Windows 98 OS types such as the Xeltek SP / L).
Because the larger 24 pin PALs had no protection bit capability built in at all, so manufacturers couldn’t prevent plagiarism on their firmware if those were used. But with a brute force method and the Paldumper from Charles MacDonald ( http://technojunk.org/readpal.php and www.dreamjam.co.uk/emuviews/readpal.php ) and a TL866 universal programmer used as eprom 27c020 reader it is often possible to copy a protected PAL. After reading a 16L8 PAL as 27c020 eprom, you can use the special PA.exe program to extract the PAL equations (the internal comparison structure) from the data read out with the TL866. But that only applies to the ordinary less complex NOT Registered PAL structures. So NOT the complex 20X10 or R types and similar PAL chips! Only PALs with only logic equations so purely combinatorial logic.
Following screen shot shows the result of a short but complete 1 page equation dump. The .bin file was converted into understandable logic equations in a CMD screen of Windows 7 with the small but great working PA.exe program (1.245 kB) after been read on my Xeltek SP/L universal programmer if they were not protected. Or if they were protected only the mentioned PAL16L8 types can be read with the PALdumper and saved with a TL866 universal programmer on a computer.
The PA.exe program significantly accumulates very long listings when PALs are very complex and further compression is needed before they become the understandable compact .jed file. The .jed file they once originally were programmed with into the PAL.
Following PA.exe listing was only page 1 and 5 of about 33 of those very complex pages with almost never ending equations extracted from a protected PAL16L8 dumped with the PAL dumper:
Owners and repair engineers of old arcade game machines often use very expensive PAL dump devices (complex state machine test devices that record all outputs at all possible input combinations) to get their arcade machines working again when the original firmware lets them down.
My Kenwood CS-5130, still working well after about 28 years, is in any case safe for the future again after this preventive ‘maintenance’. Because after all these years obtaining a programmed U7 / MBM27C64 Read-Out eprom could have been difficult and expensive. Such an eprom can already lose its data in a flash simply by taking a photo of the eprom and its special quartz glass window. Such quartz glass, unlike ordinary glass, was the only glass that could transmit UV light in order to be able to erase the eprom chip inside again if necessary. And given the age of the eprom, the programmed load could have shrunk considerably after 28 years. The retention of the programmed eprom is approximately 20 years. A Vpp of 12.5V or higher was used by the manufacturer to program the chip. (With USB memory sticks one says the retention time is about 10 years on average? And with many burned DVDs and CDs this is often considerably lower, but I already have a fairly new USB 3.0 128GB stick from the brand PNY that only can be used on a few PCs, if it is usable. And I already have had to format it several times because it became invisible when plugged in).
So do not take any risks and make backups of everything that may be of interest. Also document everything well just in case you need it later! After all, there probably only has to be one error bit somewhere and your device stops. Or you will have to invest a lot of time to correct the failure. And then trying to find out what bit that was will be very hard if no data was saved at all!
And hereby also a great New Year to you all!
Albert van Bemmelen, Weert, The Netherlands.
Please give a support by clicking on the social buttons below. Your feedback on the post is welcome. Please leave it in the comments.
P.S- If you enjoyed reading this, click here to subscribe to my blog (free subscription). That way, you’ll never miss a post. You can also forward this website link to your friends and colleagues-thanks!
Note: You can read his previous repair article in the below link:
https://jestineyong.com/new-battery-after-2-cycles-already-defect/
(64)Dislikes
(1)
14 Comments
Leave a Reply
skwong
January 9, 2019 at 12:01 pm
Very good information, thanks for sharing.
Albert van Bemmelen
January 9, 2019 at 4:40 pm
Thank you Mr.Sk.Wong. I've seen your very impressive (Plasma) television repair articles that were very profound and must have took you quite a lot of time to solve each of them. As they were not only repair but also involved doing some recalibration afterwards if I remember it well.
Parasuraman S
January 9, 2019 at 12:35 pm
My head is reeling! Amazing expertise there! Hats'off (I think my hat has already gone off because of the reeling - LOL)
Albert van Bemmelen
January 9, 2019 at 4:23 pm
Thank you Parasuraman. Appreciative compliments coming from a highly trained and respected professional repair expert give them extra meaning! (And could make me lose my head of all excitement - LOL).
Robert Calk Jr.
January 9, 2019 at 6:25 pm
Thanks Albert. Nice work! I know that you spent a lot of time and energy on that article! I hope that I never have to mess with the SRAM IC's in my scope.
Albert van Bemmelen
January 9, 2019 at 9:12 pm
I know exactly what you mean Robert. That is why I did the experiments with the Testclip cable connected to my TL866 (and my Genius 540) programmers. I hope that backing up both the U664 SRAM in my 2440 and the SRAM U2460 in my 2465A Tektronix scopes will be also possible. But I could fail when trying and lose those important values. If not I've at least managed to read the Calibration data of my 2465A scope manually by using the delta T and delta V front buttons together with the SLOPE button, by using the UP and DOWN buttons to select all address lines 00 to FF. Sadly the question that then remains is how to put those variables back in the SRAMs if needed. Because that option is not implemented and requires a complete re-calibration of our scopes if a 1 on 1 bit copy of the SRAM is not made available.
Justice
January 9, 2019 at 7:54 pm
Highly technical article, big thanks for your excellent shared article.
Albert van Bemmelen
January 9, 2019 at 9:20 pm
My pleasure Justice! I hope the article did offer you some valued help if you also need to secure the 'old' firmware in your expensive electronic equipment.
beh
January 9, 2019 at 10:21 pm
Hi Albert
thanks for your efforts to rescue this valuable machine. But just one question . I know you have programmer RTH809H but you did not used that one you used TL866. Is not RTH programmer more advance than other one?
beh
Albert van Bemmelen
January 10, 2019 at 9:35 am
Good question Beh. The manufacturer of the RT809H only just recently added a few older 28xxx eproms to its devices list. So the TL866 supported those and more already. And because the device list of the RT809H and its tasks are different to the other universal programmers you would need both for different tasks. (it mostly supports reading Nands and other memory chips from Laptops and CTV's, and is able to read the POST bootup of computer boards to check the tasks that are logged real-time to check where the hardware and firmware halts at failures. And the RT809 also is able to do quite a few more complex tasks that sadly are still very badly documented in mostly Chinese instructions that no English speaking RT809H owner understands. As also most of the special menu icons in its program are). Besides the fact that the TL866 protects chips for over-current in case they are inserted wrong or otherways they could be read wrong if pins make bad contacts and the TL866 will warn the user what pins are badly connected and halts. As also the Genius G540 universal programmer will do in such cases.
Waleed Rishmawi
January 10, 2019 at 2:36 pm
very deep and very important information. thanks for sharing.
Albert van Bemmelen
January 10, 2019 at 4:21 pm
For the very deep part of this article concerning the PALdumper board and the PA.exe program that credit of course goes to Charles MacDonald the creator of the 27c20-PAL16L8 Reader/dumper. If in future larger eproms come available and are added to the device list of supported components of the RT809H, maybe the larger PAL20L8 and the PAL20L10 chips with more address- and datalines will be possible to be dumped in an improved PALdumper circuit. But that obviously creates even longer and complexer terms of data output streams if the program then still works.
Humberto
January 15, 2019 at 4:00 am
Great explanations Albert, and good images too. It's been a very didactical articles. Congratulations.
Albert van Bemmelen
January 15, 2019 at 1:40 pm
Thanks Humberto. I am very glad that my Kenwood CS-5130 is still working perfectly fine and is safe for the future Firmware wise. At the time in 1991 it was a very expensive oscilloscope (HFl.3300 guldens!).