Poor Man's Digital PGA - Part 2 of 2

No testing is complete until you try the final configuration. In the earlier post, I had simply grounded the extra resistor R7 to switch in the higher gain. Figure 1 below shows a capture of the signal at its base gain of 2.

In this capture, all extra AVR resistors R4, R6 and R7 are in the tri-state condition. It can be seen in Figure 1 that some noise exists on the output. Counting the bumps, there appears to be 20 per cycle amounting to about 100 kHz. The AVR device here is operating at about 1 MHz, using its built-in RC oscillator.

Figure 1. Noise on PGA Output

For use with the MSGEQ7, this should present no difficulty since the switched capacitance filters will eliminate this. This may present a difficulty when used in other audio work, however.

The good news is that this noise is reduced as the AVR resistors get switched in for higher gains.

You can watch an AVR switch between four gains here:

  https://youtu.be/iqPBaHtLFI0

Thanks for reading!

Poor Man's Digital PGA

Playing around with the MSGEQ7 chips it was readily apparent that the audio input level was critical to its graphic equalizer display. There have been many analog AGC (Automatic Gain Control) designs used over the years. Some designs using an opamp and a FET can be constructed but can be difficult to get right for students without an oscilloscope.

With an eye to reproducible circuits for readers, I was looking for a single-ended opamp design that was digitally controlled. Digital circuits tend to be easier to manage with the minimum of equipment. So I got to wondering if I could manage this with the use of the LM358 (or the LV rail-to-rail part MC33202).

I wondered if a Digital PGA (Programmable Gain Amplifier) could be constructed with a minimum of parts. Figure 1 shows a typical AC coupled non-inverting amplifier design. Because it is single ended, it needs the voltage divider consisting of R1 and R2. If VCC is 5 V, then the junction between them will be VCC/2 or 2.5 V.  C1 AC couples the signal into the non-inverting input of IC1. The feedback circuit is however a bit unusual because the gain for DC and AC signals differ.

Figure 1. AC Coupled Non-Inverting Amplifier

Those who know/remember their opamp theory, know that a non-inverting amplifier's gain is set by the ratio:

Av = (R5/R3) + 1

But in this circuit the capacitor C2 blocks DC current. The feedback current through R5 is so small, it behaves as if the output was wired directly to the inverting input. The net effect is that the Vout = V- = V+ for DC. The resistor R3 has no DC path to ground and as a result, can have no DC effect on the output.

Yet, the AC gain is however, still affected by R3. So the AC gain of the Figure 1 circuit is indeed:

Av = (500k/500k) + 1 = 2

It is well known that either R5 or R3 has to change to affect a change in this gain calculation. The good thing about this circuit is that the DC gain is not affected by resistance changes as long as R5 remains reasonable.

To change the AC gain, we could change out R5 using some FET switches but this proves inconvenient. Likewise R3 is inconvenient for switching resistors in and out. But if you stare at Figure 1 long enough, you have to start asking yourself "wouldn't it be nice if we could move R3 to ground?" Then you could easily add or subtract resistances to change gain. It turns out that we can!

Figure 2 shows the circuit modified so that R3 has one grounded leg and the capacitor C2 is moved above it. In this case R3 and C2 are simply in series and can be moved around.

Figure 2. AVR Controlled PGA

With R3 grounded, we can easily add resistances in parallel with it. R4 if placed in parallel with R3, is equivalent to:

R3 || R4 ~= 83k

This change alters the gain:

Av = (500k/83k)+1 ~= 7

So with the simple act of adding in R4 in parallel with R3, we've digitally changed the AC gain from 2 to 7. R4, R6 and R7 were chosen to be 10% tolerance resistances giving the following selection of gains:

Value	R3	Gain	dBV
0	500,000	2.0	6.0
1	83,333	7.0	16.9
2	42,962	12.6	22.0
3	30,051	17.6	24.9
4	21,073	24.7	27.9
5	17,405	29.7	29.5
6	14,549	35.4	31.0
7	12,701	40.4	32.1

With all resistors enabled by the AVR device, the maximum AC gain is about 32 dBV (40). With none of the added resistors connected in, the gain reduces to a minimum of 2 (6 dBV).

AVR Digital Control

The digital controls coming from the ATmega328P (Figure 2) must set the outputs of PD5, PB6 and PB7 along these lines:

1. To enable a resistor, the port must be configured as an output port and have the level set to zero (low).
2. To disable a resistor, the port must be configured as an input port and have the pull-up resistor disabled (thus achieving a tri-state condition).

Note that a tri-stated AVR input here is never left floating. It will assume the potential of the high side of R3, which will be ground effectively. R3 never switches out of the circuit.

The 'mega ports in Figure 2 were chosen to avoid some otherwise usable ports. You can of course change the ports to meet your own needs.

Function Generator Test

Figure 3 shows the scope traces of the 5 kHz function generator (channel 2) and the IC1A output in channel 1. Here it can be seen that the gain is 2.

Figure 3. R4, R6 and R7 disconnected (off), gain of 2

Figure 4 shows R4 grounded to enable it in parallel with R3. The gain is nearly 7 (422mV/64.3mV=6.56).

Figure 4. R4 || R3, gain near 7

Watch the gain change between four settings, driven by an ATmega328P:

  https://youtu.be/iqPBaHtLFI0

Thanks for reading!

MSGEQ7 7 Band Graphic Equalizer Chip

I had bought a couple of MSGEQ7 chips in 2014 from eBay with plans to do something with them. So recently I found myself a bit of idle time and mounted one on the breadboard to try it out. I used the circuit straight out of the MSI datasheet (Figure 1):

Figure 1. MSGEQ7 Circuit

I had a little trouble getting this to work correctly, so I scoped pin 8, knowing this is not going to be accurate but should indicate if the RC oscillator was running at all or not (Figure 2). The trace indicated about 102 kHz, which is probably higher with the 10x scope probe removed. 

Figure 2. Trace of pin 8 (Oscillator)

The problem was that I was getting an output (pin 3), like that of Figure 3. This was with no signal applied.

Figure 3. Incorrect outputs (pin 3)

After trying several things including gain and frequency adjustments of the function generator, I decided to try the other chip (I always buy two for this reason!) This chip swap yielded the type of results I was looking for (Figure 4):

Figure 4. MSGEQ7 finally works (near 60 Hz)

The tallest signal represents the first frequency bucket which represents about 63 Hz (from the documentation). This will vary somewhat depending upon the internal RC oscillator.  I used a AVR generated oscillator to strobe this thing and used the scope's sync to drive the reset. You can see two complete traces in the middle with partials at the ends. Unfortunately the Rigol internal hardware frequency counter didn't like the low signal levels. The software frequency measurement likewise didn't grok the low function generator signal levels either.

Figure 5 shows the result of the function generator at 160 Hz. I found that the signal generator (B&K Precision Model 3050) needed to be on the 0 dB output range at about 10%. The chip was fussy about the input level going from no output to all high when the signal went out of range.

Figure 5. 160 Hz

 The next bucket is 400 Hz, shown in figure 6.

Figure 6. 400 Hz

 Figure 7 shows the 1 kHz bucket activated.

Figure 7. 1 kHz

 Setting the function generator to 2.5 kHz for the next bucket (Figure 8).

Figure 8. 2.5 kHz

 Figure 9 shows 6.25 kHz.

Figure 9. 6.25 kHz

 Finally figure 10 shows the last of the seven buckets activated with 16 kHz.

Figure 10. 16 kHz

The idea behind the chip seemed cool. I had planned to drive it from an ATmega328P, hooked up to a Raspberry Pi. But having tested it out I quickly realized that this circuit is much too finicky for a "simple project". What it needs is a circuit ahead of the MSGEQ7 with AGC to keep the signal within acceptable limits. Otherwise the MSGEQ7 will simply disappoint.

The MSGEQ7 is a CMOS chip. I was aware of this and took my usual care handling it. But the first chip may have been static damaged on the breadboard. If you choose to breadboard it, I recommend that you make all the connections without the chip and plug it into the breadboard last. This is the first damaged CMOS chip I've had in quite a long time (it might even have been damaged as part of the shipping process).

You can read more about the MSGEQ7 chip from this PDF file:

  https://www.sparkfun.com/datasheets/Components/General/MSGEQ7.pdf

Thanks for reading.

No iMac? Build a iRasp3

I've wanted to try this for a long time with the Raspberry Pi 3. The Pi 3 has built-in WiFi, making it a natural for an iMac-like terminal unit. I've held off because of work on my new book, which is will be out early next year (shameless plug here: http://www.apress.com/us/book/9781484224052).

Now that the Pi 3 is free, I just had to repurpose an old Viewsonic VG2230wm monitor with a Pi on the back (Figure 1).

Figure 1. iRasp front view.

I received the monitor some time ago from a friend without a stand. I eventually junked another monitor which had a stand that could be adapted to the Viewsonic. You can see it crudely attached in Figure 2.

Figure 2. Note the adapted stand for the monitor. Raspberry Pi 3 is mounted on the back with plastic spacers, using wood screws in the plastic casing.

The Pi is mounted on top of four plastic spacers, made from a pen cut with a small pipe cutter. The screw holes were carefully drilled over an area known to have some breathing space underneath. The monitor internals are covered in a metal shield, so I wasn't too worried about hurting anything (I had also been inside before).

The Pi 3 also has four USB ports. So even though I need two for keyboard and mouse, I still have two available. If needed, there is also a wired ethernet port.

I made sure to orient the GPIO header strip towards the bottom. This will allow me to use a longer ribbon cable down to the Cobbler-T for breadboard work.

Someday I hope to replace keyboard and mouse with wireless peripherals, since the Pi 3 also sports Bluetooth. In the meantime, I'll be looking for a shorter HDMI and audio cable.

Thanks for reading.

ESR Project Build - Part 6 of 6

This build is not done until the unit is assembled in its cabinet. I thought this last step would be a slam dunk. But I was terribly mistaken!

The W2AEW design called for a 5 volt regulator. Since the parts used didn't require 5V specifically, I tested it using a 6.5V switching supply that I had handy. After all the wiring was done, I merrily built this 7805 circuit on a tiny proto PCB assuming all would be well. Of course, once it was all nicely soldered into place the unit didn't function!  I could not get the meter to deflect with the leads shorted.  Wah, wah, wha... epic fail!

I soon discovered that if I raised the voltage, things returned to normal. So I tested it on a variable supply and found that it returned to normal over 6V. Being too lazy to rework the PCB much, I simply put a pair of diodes in the ground circuit to raise the output to 6.2V (Figure 1). If I was less lazy, I would have run a filter cap over the diodes also, but found that I could get away without.

Figure 1. 7805 regulator circuit used (for 6.2V)

My BNC test connector cannot be grounded, so I found a piece of saved orange crate plywood, painted it black and drilled a hole for it. I eventually got the unit pretty much done without the external case but ran into another problem (more about this later).

Figure 2 shows the internals of the unit -- large enough for an electrical outlet for the wall wart which delivers about 10 VDC without a load. 10V incidentally, is too much voltage for low ESR readings. So a regulator was needed.

Figure 2. Internals of the ESR unit. The PCB hanging down has the 7805 regulator.

The problem was the Fine/Coarse switch that I added to the front panel. When that switch was on Fine, a 47 ohm resistor was placed in parallel with the 10 ohm, to reduce the resistance ever so slightly from 10 ohms to 10||47=8.25 ohms. This provides wider spaced low resistance readings on the meter.

The problem turned out to be that the old switch I had used had an on resistance of several ohms! This drove me batty until I finally took the meter and read the switch resistance. So even with the 47 ohm resistor switched in, it ended up having no effect. After rummaging through the junk box again and measuring the on resistance this time, the issue was resolved with a better switch.

Figure 3 shows the unit re-assembled in the Sencore transistor tester case.

Figure 3. Assembled ESR meter. Zero pot at left, BNC for test leads in middle, power switch at upper right and Coarse/Fine switch below the power switch. BNCs at bottom are NC.

I suppose the lessons of the day includes:

• Don't assume the last part of the build will be trivial
• Don't assume switches will all measure 0 ohms, especially old ones!
• Test with the intended supply voltage up front.

Thanks for reading.

ESR Project Build - Part 5 - Test Readings

With the opamp section soldered up and tested, I found that the range was a bit wider than I wanted. The designed range was good if you want to test down to 1 uF. However, to see more meter movement down near the 1 ohm range, I found that I could put a 47 ohm resistor in parallel with the 10 ohm resistor at the DUT terminal. This expands the scale near 1 ohms slightly, so that the readings vary between about 1 and 4 ohms. I plan to make this a "fine" switch setting on the finished meter assembly.

With the setting on "fine" you can measure about 100 uF and higher. Any caps below that, will read off scale (to the left). Turning the switch off (coarse), the unit does measure 1 uF and up.

Figure 1 below shows the Sencore transistor testor 100 uA meter that I used in the zeroed position (right).

Figure 1. ESR meter in zeroed position.

The remaining figures are readings while the switch is on "fine" at various resistances.

Figure 2. 1 ohm

Figure 3. 2 ohms

Figure 4. 3 ohms

Figure 5. 4 ohms

From these readings, you can see that on "fine" that the resistances spread out rapidly. With the switch set to coarse, 10 ohms reads about where figure 5's 4 ohm reading is. Then anything higher bunches to the left of that.

For switching power supplies where the capacitors are expected to have milliohm values of ESR, the "fine" setting should be suitable for identifying failed caps. It is still not the best arrangement for cherry picking caps because of its inability to read milliohm differences.

Later when the hardware build of the cabinet is done, I'll add some photos to the last part in this series. Thanks for reading!

ESR Project Build - Part 4 - Precision Rectifier + Meter

We've so far looked at the ~100 kHz oscillator, driver and gain stages. After the gain stage comes a precision rectifier and driver, which looks like this (Figure 1):

Figure 1. The Precision Rectifier and meter driver

I decided to breadboard this portion since I am substituting the LM358 for the AD8032, which the W2AEW design called for. The AD8032 is a bit pricey and harder to obtain (Mouser price for DIP was $8.11 US in single quantities). The AD8032 is a rail-to-rail opamp but this circuit only requires the bottom rail to function correctly.

The LM358 is a jelly bean part and operates at the V- rail (ground in this case). This part is targeted as a single supply solution. As a bonus, it uses the same pinout as the AD8032. The one other deviation from the W2AEW design is that my selected meter has a 100 uA movement instead of 200 uA. So instead of the 4.7k + 2.2k with 10k adjustment pot, I simply ran the output signal into a 100k trimpot (for this breadboard test), with the other leg of the pot going to ground. Then the meter went to the wiper arm of the pot with its negative lead going to ground. The full deflection is adjusted with the DUT leads shorted. In the final soldered up build, I'll arrange a protective limiting resistor for the meter in case the pot gets cranked.

The signal coming out of the LM358 precision rectifier and going into the driver (pin 5) appears as shown in Figure 2:

Figure 2. Input signal at LM385 pin 5

It is interesting to see that the signal actually does dip below ground by -590 mV. The positive swing of the signal goes up to 650 mV. This signal is generated when the DUT leads are shorted (zero ohms).

With the 1N4148 diode and the 0.1 uF filter cap connected, a DC voltage is established, which is then delivered to the meter. To calibrate, short the DUT leads and adjust the pot to give the meter full deflection like the old fashioned ohm meters.

Early testing has shown that low ESR values show very close to the shorted leads point on my meter. Any resistance over an ohm shows as a reading near the 10% deflection point. So presently, I found this meter to be extremely ESR sensitive.

Once you have a hammer, everything looks like a nail. So I went around the lab looking for caps to measure. All but one measured 100%. This failed cap was pulled out of an '80s power supply along with three others just like it. I had been debating whether or not to use these or to replace them in a power supply project. One of the four showed no deflection at all, while the remaining three all showed 100% good.

I also in-circuit tested this circuit on Intel Atom motherboards with caps and measured a few other boards. All indications look very good so far. Now I just need to find some time to solder this up in its final form.

In the next part, I'll present some pictures of my build into an old Sencore transistor tester case.

ESR Project Build - Part 3 - Amp

In the amplifier input chain, we first encounter the DUT filter cap (0.1uF) and load resistor (100 ohms). This test signal conducted through the test capacitor is then AC coupled to the amplifier stage.

Figure. Device Under Test input

Amplifier

The amplifier Q1, is suggested as any general purpose signal transistor like the 2N2222 or 2N3904 etc. I chose the latter, though I had ready access to both. Figure 2 shows the basic common emitter amplifier configuration used.

Figure 2. 2N3904 Amplifier stage

The 100 ohm resistor in the emitter leg adds negative feedback and reduces the overall gain of the circuit. The input signal is coupled in with the 0.01 uF cap and then coupled out of the collector circuit with another 0.01 uF circuit.

This circuit should have been painless to add to the existing prototyped circuit, but try as I might to get the orientation of Q1 right, I got it backwards! Doh! After snipping out the failed part and replacing it with another with the correct orientation, the gain came up to what it should be (a transistor with emitter and collector reversed will still function but with low gain). Figure 3 illustrates the pinout for this device.

Figure 3. 2N3904 Pinout

The output of the amplifier stage taken from the collector's coupling capacitor is shown in Figure 4.

Figure 4. Amplifier stage output (at collector)

Here we can see that the output is 640 mVpp, with the DUT probes shorted (for zero ohms). Going out of the oscillator driver, I measured about 355 mVpp. With DUT probes shorted and the signal appearing across the 0.1 uF filter cap and 100 ohm resistor the signal coming in is about 157 mVpp (Figure 5).

Figure 5. Input signal arriving from DUT.

So if the input signal is 157 mVpp and the output voltage from Q1 is 640 mVpp, then this would represent an overall voltage gain of about 4. But don't forget that the stage also adds power gain.

Next up, we'll review the precision rectifier stage.

ESR Project Build - Part 2 - Oscillator

The basis of the tester starts with a 100 kHz oscillator circuit. The two designs are similar, but I'm building based upon the W2AEW circuit:

The oscillator consists of a pair of CD4049 inverters biased to oscillate. The remaining four hex inverters are used to drive the signal into a 10 ohm resistor. This produces the signal sent to the Device Under Test (DUT) with enough power, but low enough in voltage to avoid silicon diode conduction.

The scope trace in Figure 1, shows the oscillator signal when the circuit was powered from about 6 Volts. The rise and fall times are 80 ns and the duty cycle was about 55%.

Figure 1. Oscillator output (before drivers)

Figure 2 illustrates the output signal out of the driver stages into the 10 ohm resistor. The voltage drops to about 355 mVpp and the frequency rose to about 119 kHz. With the driver attached, there was less load upon the oscillator stage. At these lower voltage levels, you can see more of an influence from the inductance side of things in the trace output.

Figure 2. Driver stage output into 10 ohms.

Getting the oscillator to work was fairly painless. Because I am prototyping this, I always run the risk of solder blob shorts and this time was no exception. After elimination of a supply side short and then another solder blob affecting the oscillator circuit, the circuit took off with no trouble.

In the next part, we'll look at the receiving side of the DUT probes.

ESR Project Build - Part 1 - Designs

I wasn't planning to blog this project, but it has turned into quite a bit fun, even though at the time, it seemed to be small project. As is so often the case, even the small projects provide challenges.

Why?

Many things today stop working due to switching power supply problems. Let's face it, switching supplies work hard at converting power and the capacitors involved usually fail at some point. Monitors and TVs etc. can often be fixed by just replacing the faulty caps.

But identifying the failed caps is not always easy. Many times you have a bulged or other obviously marked cap. But at other times, you may have parts that are border line, which are difficult to identify. 

No one wants to remove caps to test them on an ESR meter. So when I went hunting for a design, I wanted the following:

1. Must work in-circuit
2. Be relatively simple to build

So in my research, I came across the following two designs:

• VE7IT ESR Capacitor Tester
• W2AEW ESR Meter

I believe the W2AEW design is based upon the VE7IT design. 

Designs

The VE7IT tester produces a small 156 kHz signal of about 250 mVpp, to stay under the silicon diode conduction voltage of about 0.6V. While a Schottky diode conducts between 150 to 450 mV, am hoping that this doesn't apply often or interfere too much when it does. The VE7IT design says the cap being tested must be greater than 1 uF. Fair enough.

The signal returned from the DUT pair of probes in the VE7IT design, is then AC amplified by a 2N2222 stage and rectified by a bridge rectifier.

After the rectification, the circuit drives a 50 uA meter with a potentiometer for zero adjustment.

A note on the VE7IT schematic indicates that:

"There is no DC output until approx 75-100 ohms of ESR is seen at the test terminals (like a bad cap). Mid scale is approx 10 ohms. Full scale is 0 ohms."

As a rough measurement this is ok I guess, but I wanted to be able to measure down to the ohm if possible.

The W2AEW circuit substitutes a precision rectifier instead, so that greater precision can be had:

This should permit a finer resolution of readings from zero to 75 ohms that the VE7IT design is unable to read.

The other aspect of this design that I liked is that due to the opamps, it is no longer confined to using a 50 uA meter movement.

In the next part, I'll describe my own experiences with the build of the W2AEW circuit starting with the 10 kHz oscillator.

Reverse Engineering: PC1031-0B Part 4

In the last post, I walked through the tracing of the serial data that loads into the shift registers IC1 through IC3, as well as described how IC4 was used (NOR gate). But there is one more shift register IC5 CD4021, which hasn't been analyzed.

CD4021

The functional NXP diagram is shown in figure 1.  There is a DS (serial data in), CP (clock pulse), outputs Q5, Q6 and Q7. And then there are parallel load inputs D0 through D7, with a parallel load signal PL.  This screams parallel load of push button data and then shifted out.

The first hunch here is that the CP signal (clock) is shared with the other shift registers. A resistance reading confirms this, so no mystery there. The parallel load (PL) is probably wired up to the strobe signal, since there is only one remaining signal left for the PCB and it has to be for the shifted out data. A meter reading confirms that PL is connected to the strobe input on the board.

The D0 through D7 inputs connect to the pushbuttons and are loaded when the board Strobe goes high. After the Strobe returns low, successive clock pulses (CP) shift out the data (PCB pin 2, green wire).

The only remaining question, which is fairly obvious actually, is where does the shifted out data come from?  It has to be be Q7 or else one or more bits would never be seen at the PCB pin 2 output. A simple resistance reading confirms this, if there was any doubt.

So now we have decoded the PCB connections:

1. +5 Volts (purple wire)
2. Push button data out (green wire)
3. Data in (yellow wire)
4. Strobe in (red wire)
5. Clock pulse in (orange wire)
6. Ground (brown wire)

After programming the AVR device (ATmega328P), I was eventually able to drive this board with a few mis-steps. Essentially, with the PCB mod (more about this later), I shift out 25 bits of data and then strobe it. The DLG modules that have the low /WR signal going high, then receive their data. At the same time, the Strobe signal enables any push button LEDs, when in the low state (these are active low). Finally, after the Strobe returns low, a few more clock pulses (CP) return the push button data (the button data is loaded at the high of Strobe). The AVR code can be found here:

  Repository:  https://github.com/ve3wwg/avr

  Direct link: https://github.com/ve3wwg/avr/tree/master/atmega328p/dlg1414

CD4001 Hack

One major irritation with the PCB was that it limited access to the DLG-1414 character set. The PCB would play games with data bit D6 via IC4a.  I tried to find ways to use the PCB unmodified and gave up on that. Since only the first gate is used in IC4, we can just pull the chip out entirely (the board functions without it).  By soldering a wire from pin 3 of IC4a to pin 10 (QS2) of IC3 as described in part 3, we arrive at full control of D0 through D6 of the DLG-1414.

The Schematic

I was later reminded that I did in fact have a schematic for this PCB. So let's look at it now (Figure 2), to see how we did.

Figure 2. The PCB Schematic

The first thing I noticed was that they numbered their connections opposite to the way I did mine. Their pin 6 was my pin 1 for +5 Volts. Otherwise, things were fairly accurate.

Their wiring of IC4a was different than mine. As discussed in Part 3, I had a resistor divider, while the schematic shows pin 2 grounded and pin 1 connected to pin 1 of the DLG-1414. With IC4 removed and the mod added, this is all academic now.

My particular PCB also disagreed about the push button wiring. I was required to map the buttons as follows:

    struct {            // Input order

        unsigned pb4 : 1;

        unsigned pb3 : 1;

        unsigned pb2 : 1;

        unsigned pb1 : 1;

        unsigned pb7 : 1;

        unsigned pb6 : 1;

        unsigned pb5 : 1;

        unsigned pb0 : 1;

        unsigned fill : 8;

    } sr;    

So there you have it. I hope you enjoyed this little journey down reverse engineering row!

Reverse Engineering: PC1031-0B Part 3

In Part 2, we confirmed the PCB connections but now we need to confirm the connections going out from the shift registers IC1, IC2 and IC3. Figure 1 illustrates the scratched out notes from tracings between each of the shift register's outputs and their destination.

Figure 1. Scratched out mapping of shift register bits.

Basically these are three columns of 8 bits (in rows). The first bits traced were the /WR signals to each LED module. These clock data into each module.  Then I traced from the DLG module sockets to the shift registers for D0 through to D5. D6 proved to be a bit of a mystery at the time. More about this later.

Then all that remained were the push button LEDs, which were simply marked in groups (the push buttons and corresponding LEDs were least important to me at the time).

This permitted the mapping of bits in C/C++ using the bitfield feature:

 struct  {

     uint32_t   wr03 : 4;    // /WR0..3 (LSB)

     uint32_t   led03 : 4;   // /LED0..3

     uint32_t   d3 : 1;      // D3

     uint32_t   d2 : 1;      // D2

     uint32_t   d1 : 1;

     uint32_t   d0 : 1;

     uint32_t   led47 : 4;   // /LED4..7

     uint32_t   d5 : 1;      // D5

     uint32_t   d4 : 1;      // D4

     uint32_t   a1 : 1;      // A1

     uint32_t   a0 : 1;      // A0

     uint32_t   wr47 : 4;    // /WR4..7

     uint32_t   d6 : 1;      // D6

     uint32_t   fill : 7;    // MSB

};

The bit assignments are from least significant bit to most significant bit. On the AVR platform this is is little endian sequence (I will be using the ATmega328P for my testing). The bit field d6 was added as bit 25, which will be discussed shortly. The field marked fill just rounds it up to 32 bits and is not used.

Figure 2 shows the traced D6 back to pin 3

Figure 2. D6 traced back to IC4 (CD4001)

Later on, when I did find a schematic for this, that particular schematic simply had input pin 2 of IC4 grounded, effectively sending an inverted D5 to D6. With the voltage divider in my version of the PCB, there looked like there was some trick involved (which I never got to work). With both CP and STR high, D6 would by high. If D5 was low, and either CP or STR were low, then D6 would be high. Either way, with D5 influencing D6, it was impossible to get the whole character set from the display.

Full Character Set

The remainder of IC4 is unused. So to obtain the full character set control, I simply removed IC4 from its socket (it is otherwise unused).  Then I figured out that I could wire D6 directly up to IC3 (CD4094), pin 10, which is that chip's QS2 output.

Figure 3 illustrates the logic diagram view of the CD4094. There is one additional latch after QP7, which holds an extra bit until CP goes low. Since each bit clocks in on the low to high transition, QS2 will hold a QP8 so to speak, until the CP signal goes low again. On the falling edge of CP, QS2 will reflect the same logic level as QP7. 

Figure 3. NXP's logic diagram for CD4094 (IC3)

The important part of QS2 here though, is that while the CP signal remains high, it holds an extra bit. Given that IC3 provides the last 8 bits (of 24), QS2 provides the 25th bit.

The AVR code then sends the 25th bit first, so that it shows up at QS2 after the other 24 "command word" bits are shifted out.

LED Driver Bits

It was later traced for the struct presented earlier, members led03 and led47 drive the LEDs for the push buttons in the following way-- least significant bit in led03 drove the left most button LED. Starting with the least significant bit of led47, drove the 5th through 8th LEDs. Using the AVR code to test, it was discovered that the LEDs are lit when these bits are zeros (the LED anodes were wired to +5V).

Reverse Engineering: PC1031-0B Part 2

In Part 1, we determined the power connections on the PCB and successfully performed a "smoke test". The next step is to determine some of the input signals for this board. 

Since we have three CD4094 shift registers on board, it seems likely that we'd have the following input signals to drive them:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

Figure 1 shows the functional view of the CD4094 chip. From this we see that we have a data input (D), clock pulse (CP), strobe (STR) and output enable (OE). The outputs QP0 through QP7 are going out to the DLG-1414 and the LEDs for each push button. Both of these facts remain to be confirmed.

Figure 1. Functional View of NXP HEF4094 (CD4094)

It is also very likely, that these shift registers are chained together so that a few serial signals can fan out to many parallel outputs (again to be confirmed). Since the data (D) and clock pulse (CP) are most important here, let's begin by tracing them back to the connector.

Figure 2 illustrates the PCB with the DLG-1414 modules removed from the bottom row of sockets and the push button daughter card removed from the top. From left to right you can see three CD4094s (IC1, 2 and 3), a CD4001 (IC4) and a CD4021 (IC5) on the right hand side. The removed DLG-1414 modules are shown at the bottom of the photo.

Figure 2. CMOS ICs revealed

The connector is at the top left of the PCB in Figure 2 (topside view). A good first guess is to test pin 3 of IC1 with the remaining mystery pins 2 to 5 on the PCB connector. Our strategy is that if no zero ohm connections can be found, we move onto pin 3 of IC2 and then IC3.

Figure 3 is a photo of me measuring the PCB connection 5 to pin 3 of IC1. You can see that the meter is reading 0.00 ohms. This confirms that pin 5 is the clock input to the PCB.

Figure 3. Measuring connector pin 5 to IC1 pin 3

Another likely candidate is the data input. It is likely to go with the clock, so let's trace the IC1 D input (pin 2) back to the PCB connector. The ohm meter confirms that the connector pin 3 is the data (D) input for the board. We only have pins 2 and 5 of the board's connector left to trace.

Figure 4 is NXP's illustration of three shift registers chained together to provide 24 bits of parallel output.

Figure 4. CD4094 connected in a serial chain

We now know that the D input at left goes to the connector pin 3, and the clock input (CP) is wired to connector pin 5. Since CP is connected to all three shift registers, we could have determined that connection from any of IC1, IC2 or IC3. But the data input (D) only connects to IC1.  The strobe input STR is likely to connect to all three chips as shown in Figure 4, and this is confirmed. STR was discovered to be wired to pin 4 of the PCB connector. We have all connections save one, figured out!

The known connections are now:

1. +5 VDC
2. Unknown (likely to be push button input data)
3. Data (D)
4. Strobe (STR)
5. Clock pulse (CP)
6. Ground

At this point, we could trace out which chip chains to next chip. Measuring between IC1's pin 10 (QS2) to IC2's pin 2 (D), we confirm that IC1 shifts into IC2, and IC2 into IC3. The three shift registers gives us a way to send 24 bits of data to the DLG-1414 displays.

It was at this point that I was speculating about some of the other details to be worked out still. Let's do some preliminary math:

• All DLG-1414 displays must have individual /WR strobe signals, one for each module (8 modules, require 8 bits)
• All DLG-1414 display modules require an A1 and A0 data input, to select which one of four characters to be addressed.
• Each of the displays require 7 bits of character data (but all modules can share these 7 bits)
• Each push button has an embedded LED that can be lit, requiring 8 more bits of data.

This data requirement adds up to 25 bits. But our shift registers produce 24 parallel outputs!  Hmmmm..... more about this next time.

Reverse Engineering: PC1031-0B Part 1

On of the best satisfactions you can have from the hobby of electronics is to reverse engineer something in a way that permits you to reuse it. By this process you take an otherwise piece of junk and make it useful. A side benefit is that you learn how other people have designed things.

When picking your victim for reverse engineering, there must some compelling reason for investing your time. After all, time is a precious commodity and reverse engineering requires an investment. In this series of blog posts, I am going to look at a display unit that was salvaged by a friend from bunch of discarded television intercom panels.

The Victim

Figure 1 illustrates the front and back sides of the PCB, hosting the DLG-1414 LED modules. The modules each provide 4 ASCII characters in a dot matrix format.

Figure 1. The PC1031-0B PCB assembly with DLG-1414 display modules

The datasheet for the display modules can be found here www.osram-os.com 00034174_0.pdf

Power

The first step is usually to determine what the power connections are and where they go into the PCB. Before tracing the power, let's itemize some of the components present on the PCB:

• DLG-1414 modules x 8
• CD4094 shift register x 3
• CD4001 NOR gate x 1
• CD4021 shift register x 1

The DLG-1414 requires a +5V supply. Chances are then, that the entire PCB is 5V as well. But let's confirm that. First we look at the pinout of the LED modules in Figure 2.

Figure 2. DLG-1414 Pinout

The pins are assigned as follows:

1. D5 Data Input
2. D4 Data Input
3. /WR Write Strobe
4. A1 Digit Select
5. A0 Digit Select
6. VCC
7. Ground
8. D0 Data Input (LSB)
9. D1 Data Input
10. D2 Data Input
11. D3 Data Input
12. D6 Data Input (MSB)

The CD4094 chip has its VCC on pin 16, so if the CMOS and the DLG-1414 modules both operate on +5V, we should measure zero ohms resistance between the them. When the module is removed and it is measured, this is confirmed.  Good! We probably only have one power supply to worry about.

In Figure 1, seen earlier, the bottom side shows that there is a 6 pin connector. For reverse engineering purposes, I simply scratched out a starting framework on paper to fill in like shown in Figure 3.

Figure 3. Unknown connections

Tracing out where +5V comes was easy. We know that +5V powers the DLG-1414 at its pin 6. Performing a resistance check between that pin and those in Figure 3, it was quickly determined that only connection 1 is the +5 Volts in.  We could also test between the CD4094's pin 16 to confirm the same thing. This is the datasheet I used for the CD4094.

Likewise, you can trace the ground side. Pin 7 of the DLG-1414 or pin 8 of the CD4094 should connect to one of the remaining pins of that connector. It turned out to be pin 6. Often the power connections are as far apart as possible, or immediately beside each other. Figure 4 illustrates what we now know.

Figure 4. Power connections known

Smoke Test

With the power connections known, we should be able to "light this candle". If you have a fancy bench power supply, you could set it up for +5V and limit the current to about 1 Amp. The CMOS chips require next to nothing in terms of current, and the eight DLG-1414's will consume a maximum of about 95 mA maximum each, in worst case datasheet conditions. You could dial your limit to about 800 mA, or simply as 1 Amp. I don't have a fancy bench supply, so I just "went for it". 

All we want to see, is that the modules light up with something. They won't be initialized with any data. We just want to confirm that the power is good and that modules are still alive. Don't be alarmed if some digits show a blank. A space character is just as likely as any other uninitialized character data.

Figure 5 illustrates a simple power on test. Not all digits showed characters, but many of them did. This is confirmation that we passed the "smoke test".

Figure 5. Power on test.

What's Next?

With the smoke test out of the way, we are ready to determine the other connections. Given that the PCB holds three CD4094 shift registers, we can guess that the following connections must be provided for data:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

We also have push buttons on the small daughter card, so the data for those must be available through the remaining connection. We'll trace those out in Part 2.