Important Maintenance on a Kenwood CS-5130 40MHzOscilloscope with Read-out
Preventing having faulty equipment is a very important part of a good engineer’s life, as is the final repair of any device. So maintenance plays an important role. This article is about a very important eprom in the Kenwood CS-5130 40MHz oscilloscope with READ-OUT function.
In my other Tektronix 2465A oscilloscope there is a 28 pins 44C64 SRAM that will immediately lose its calibration data when the lithium battery voltage is lost. The result is a very expensive oscilloscope that is hardly usable until a difficult calibration procedure has taken place afterwards. It is therefore important to back up this ‘Firmware’ to secure the very important calibration. And in the later scope versions it was a special SRAM chip with built-in lithium battery. These NV RAMS were more expensive. Although they could have been placed on a socket and so easily could have been taken out for copying, these were strangely enough only soldered into the mainboard without sockets. In my equally older Tektronix 2440 these are just regular SRams that like in my 2465A are kept ‘alive’ on-board with a special back-up lithium battery. In my 2440 they are HM62256 SRams. 1 Sram at position U664 provides the calibration data and a 2nd SRam of the same type is for storing the measured waveforms and therefore does not really matter. A similar story is backing up devices that do have UV erasable eproms. As in my Kenwood CS-5130 40MHz 2 channel scope with READ-OUT function, in which a 28 pins Fujitsu MBM27C64 eprom is soldered. Because I wanted to know if I could read the MBM 27C64 eprom U7 on the R/O controller board in-circuit with the TL866 programmer, I produced a specially made 28 pole test clip with socket. (See picture)
Unfortunately, reading with this special IC adapter socket with Testclip was not possible in-circuit. My TL866 constantly gave an error message that the power consumption was too high. Because a short circuit was detected or the IC was possibly connected incorrectly.
Because both of them were not the case, I soldered out the eprom with great care and placed a quality socket on the Read-Out (R/O) board in my Kenwood CS-5130. And finally, the eprom chip was directly plugged into the TL866 programmer and successfully read. (The 8K bin file serves as a backup in case the original eprom from 1988 or thereabouts gets defect. My scope would be worthless without, see picture below with the MBM27C64 / U7).
In-circuit reading of the uPD 44C64 chip, position control board A5 / U2460 in the Tektronix 2465A will therefore not work. But there the SRAM must be connected to the VCC voltage (and GND) at all times while it is being soldered to prevent loss of the calibration data. While this chip also has to be read with the TL 866 and immediately afterwards soldered in again, all-then-not on socket.
I have secured my Kenwood for the future again and the following pictures show the internal structure of the Kenwood CS-5130. The safely read eprom U7 is the bottom 28-pole chip with UV window and text label * T E126.
The 8k x 8 bit chip has 8192 x 8 cells = 65536 memory cells. This is a capacity of 2000 hex = 0000 to 1FFF = 0 to 8191 decimal. In other words, 8192 addresses with an 8-bit value. In case of a 0x8000hex = 32768 bytes chip that is 32768 x 8 bits = 262144 cells. The aforementioned Test clip was offered for a reasonable $ 29.95 US dollar but that was suddenly increased to more than $ 33 dollars when paid, and on top of that came the Shipping and Handling costs plus an Import charge, so the small clip weighing only 100 grams in the end did cost me a scandalous unexpected $ 58.21 US dollar !
I also scanned the Kenwood Service manual I bought in 1990 and converted it to PDF and searchable PDF. The aforementioned eprom U7 is circled in yellow in the next Schematic Diagram of the R / O unit. And as mentioned could not be read with the TL866 in-circuit.
Copying the SRam in our 2465A is no more difficult than copying the eprom in the above method provided that the backup voltage on the Static Ram remains very securely connected. Most Forums speak only about duplicating the much simpler backup NV SRams with built-in backup battery. The reading of our Tektronix SRam chips I have nowhere found. The fact that the simple incircuit reading is not possible makes it much more difficult.
However, a simple solution is maybe to use the 28-pole Test clip to supply the backup SRam supply voltage while the chip is being soldered out. As long as the soldering tin on the chip legs does not cool down too much as a result of which soldering becomes impossible again. And it must also be prevented that the soldering tin is damaged when the copper clamps are inadvertently tinned. And in this case, unsoldering can turn out to be a problem because copper is a very good heat conductor.
Anyway, the message here for all expensive measuring device owners is to check all devices for the presence of internally hidden Firmware in eproms or other chips. Like in my expensive Kenwood oscilloscope that I was not aware of. However, if these are Gals or Pals, they are often protected against reading with a protection bit, unlike the unprotected eprom and SRams. Only the larger PALs can be easily read out with the right universal programmers (usually with programs that are now outdated, such as the older MS-DOS / Windows 95,Windows 98 OS types such as the Xeltek SP / L).
Because the larger 24 pin PALs had no protection bit capability built in at all, so manufacturers couldn’t prevent plagiarism on their firmware if those were used. But with a brute force method and the Paldumper from Charles MacDonald ( http://technojunk.org/readpal.php and www.dreamjam.co.uk/emuviews/readpal.php ) and a TL866 universal programmer used as eprom 27c020 reader it is often possible to copy a protected PAL. After reading a 16L8 PAL as 27c020 eprom, you can use the special PA.exe program to extract the PAL equations (the internal comparison structure) from the data read out with the TL866. But that only applies to the ordinary less complex NOT Registered PAL structures. So NOT the complex 20X10 or R types and similar PAL chips! Only PALs with only logic equations so purely combinatorial logic.
Following screen shot shows the result of a short but complete 1 page equation dump. The .bin file was converted into understandable logic equations in a CMD screen of Windows 7 with the small but great working PA.exe program (1.245 kB) after been read on my Xeltek SP/L universal programmer if they were not protected. Or if they were protected only the mentioned PAL16L8 types can be read with the PALdumper and saved with a TL866 universal programmer on a computer.
The PA.exe program significantly accumulates very long listings when PALs are very complex and further compression is needed before they become the understandable compact .jed file. The .jed file they once originally were programmed with into the PAL.
Following PA.exe listing was only page 1 and 5 of about 33 of those very complex pages with almost never ending equations extracted from a protected PAL16L8 dumped with the PAL dumper:
Owners and repair engineers of old arcade game machines often use very expensive PAL dump devices (complex state machine test devices that record all outputs at all possible input combinations) to get their arcade machines working again when the original firmware lets them down.
My Kenwood CS-5130, still working well after about 28 years, is in any case safe for the future again after this preventive ‘maintenance’. Because after all these years obtaining a programmed U7 / MBM27C64 Read-Out eprom could have been difficult and expensive. Such an eprom can already lose its data in a flash simply by taking a photo of the eprom and its special quartz glass window. Such quartz glass, unlike ordinary glass, was the only glass that could transmit UV light in order to be able to erase the eprom chip inside again if necessary. And given the age of the eprom, the programmed load could have shrunk considerably after 28 years. The retention of the programmed eprom is approximately 20 years. A Vpp of 12.5V or higher was used by the manufacturer to program the chip. (With USB memory sticks one says the retention time is about 10 years on average? And with many burned DVDs and CDs this is often considerably lower, but I already have a fairly new USB 3.0 128GB stick from the brand PNY that only can be used on a few PCs, if it is usable. And I already have had to format it several times because it became invisible when plugged in).
So do not take any risks and make backups of everything that may be of interest. Also document everything well just in case you need it later! After all, there probably only has to be one error bit somewhere and your device stops. Or you will have to invest a lot of time to correct the failure. And then trying to find out what bit that was will be very hard if no data was saved at all!
And hereby also a great New Year to you all!
Albert van Bemmelen, Weert, The Netherlands.
Please give a support by clicking on the social buttons below. Your feedback on the post is welcome. Please leave it in the comments.
P.S- If you enjoyed reading this, click here to subscribe to my blog (free subscription). That way, you’ll never miss a post. You can also forward this website link to your friends and colleagues-thanks!
Note: You can read his previous repair article in the below link: