Reverse Engineering: PC1031-0B Part 3

In Part 2, we confirmed the PCB connections but now we need to confirm the connections going out from the shift registers IC1, IC2 and IC3. Figure 1 illustrates the scratched out notes from tracings between each of the shift register's outputs and their destination.

Figure 1. Scratched out mapping of shift register bits.

Basically these are three columns of 8 bits (in rows). The first bits traced were the /WR signals to each LED module. These clock data into each module.  Then I traced from the DLG module sockets to the shift registers for D0 through to D5. D6 proved to be a bit of a mystery at the time. More about this later.

Then all that remained were the push button LEDs, which were simply marked in groups (the push buttons and corresponding LEDs were least important to me at the time).

This permitted the mapping of bits in C/C++ using the bitfield feature:

 struct  {

     uint32_t   wr03 : 4;    // /WR0..3 (LSB)

     uint32_t   led03 : 4;   // /LED0..3

     uint32_t   d3 : 1;      // D3

     uint32_t   d2 : 1;      // D2

     uint32_t   d1 : 1;

     uint32_t   d0 : 1;

     uint32_t   led47 : 4;   // /LED4..7

     uint32_t   d5 : 1;      // D5

     uint32_t   d4 : 1;      // D4

     uint32_t   a1 : 1;      // A1

     uint32_t   a0 : 1;      // A0

     uint32_t   wr47 : 4;    // /WR4..7

     uint32_t   d6 : 1;      // D6

     uint32_t   fill : 7;    // MSB

};

The bit assignments are from least significant bit to most significant bit. On the AVR platform this is is little endian sequence (I will be using the ATmega328P for my testing). The bit field d6 was added as bit 25, which will be discussed shortly. The field marked fill just rounds it up to 32 bits and is not used.

Figure 2 shows the traced D6 back to pin 3

Figure 2. D6 traced back to IC4 (CD4001)

Later on, when I did find a schematic for this, that particular schematic simply had input pin 2 of IC4 grounded, effectively sending an inverted D5 to D6. With the voltage divider in my version of the PCB, there looked like there was some trick involved (which I never got to work). With both CP and STR high, D6 would by high. If D5 was low, and either CP or STR were low, then D6 would be high. Either way, with D5 influencing D6, it was impossible to get the whole character set from the display.

Full Character Set

The remainder of IC4 is unused. So to obtain the full character set control, I simply removed IC4 from its socket (it is otherwise unused).  Then I figured out that I could wire D6 directly up to IC3 (CD4094), pin 10, which is that chip's QS2 output.

Figure 3 illustrates the logic diagram view of the CD4094. There is one additional latch after QP7, which holds an extra bit until CP goes low. Since each bit clocks in on the low to high transition, QS2 will hold a QP8 so to speak, until the CP signal goes low again. On the falling edge of CP, QS2 will reflect the same logic level as QP7. 

Figure 3. NXP's logic diagram for CD4094 (IC3)

The important part of QS2 here though, is that while the CP signal remains high, it holds an extra bit. Given that IC3 provides the last 8 bits (of 24), QS2 provides the 25th bit.

The AVR code then sends the 25th bit first, so that it shows up at QS2 after the other 24 "command word" bits are shifted out.

LED Driver Bits

It was later traced for the struct presented earlier, members led03 and led47 drive the LEDs for the push buttons in the following way-- least significant bit in led03 drove the left most button LED. Starting with the least significant bit of led47, drove the 5th through 8th LEDs. Using the AVR code to test, it was discovered that the LEDs are lit when these bits are zeros (the LED anodes were wired to +5V).

Reverse Engineering: PC1031-0B Part 2

In Part 1, we determined the power connections on the PCB and successfully performed a "smoke test". The next step is to determine some of the input signals for this board. 

Since we have three CD4094 shift registers on board, it seems likely that we'd have the following input signals to drive them:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

Figure 1 shows the functional view of the CD4094 chip. From this we see that we have a data input (D), clock pulse (CP), strobe (STR) and output enable (OE). The outputs QP0 through QP7 are going out to the DLG-1414 and the LEDs for each push button. Both of these facts remain to be confirmed.

Figure 1. Functional View of NXP HEF4094 (CD4094)

It is also very likely, that these shift registers are chained together so that a few serial signals can fan out to many parallel outputs (again to be confirmed). Since the data (D) and clock pulse (CP) are most important here, let's begin by tracing them back to the connector.

Figure 2 illustrates the PCB with the DLG-1414 modules removed from the bottom row of sockets and the push button daughter card removed from the top. From left to right you can see three CD4094s (IC1, 2 and 3), a CD4001 (IC4) and a CD4021 (IC5) on the right hand side. The removed DLG-1414 modules are shown at the bottom of the photo.

Figure 2. CMOS ICs revealed

The connector is at the top left of the PCB in Figure 2 (topside view). A good first guess is to test pin 3 of IC1 with the remaining mystery pins 2 to 5 on the PCB connector. Our strategy is that if no zero ohm connections can be found, we move onto pin 3 of IC2 and then IC3.

Figure 3 is a photo of me measuring the PCB connection 5 to pin 3 of IC1. You can see that the meter is reading 0.00 ohms. This confirms that pin 5 is the clock input to the PCB.

Figure 3. Measuring connector pin 5 to IC1 pin 3

Another likely candidate is the data input. It is likely to go with the clock, so let's trace the IC1 D input (pin 2) back to the PCB connector. The ohm meter confirms that the connector pin 3 is the data (D) input for the board. We only have pins 2 and 5 of the board's connector left to trace.

Figure 4 is NXP's illustration of three shift registers chained together to provide 24 bits of parallel output.

Figure 4. CD4094 connected in a serial chain

We now know that the D input at left goes to the connector pin 3, and the clock input (CP) is wired to connector pin 5. Since CP is connected to all three shift registers, we could have determined that connection from any of IC1, IC2 or IC3. But the data input (D) only connects to IC1.  The strobe input STR is likely to connect to all three chips as shown in Figure 4, and this is confirmed. STR was discovered to be wired to pin 4 of the PCB connector. We have all connections save one, figured out!

The known connections are now:

1. +5 VDC
2. Unknown (likely to be push button input data)
3. Data (D)
4. Strobe (STR)
5. Clock pulse (CP)
6. Ground

At this point, we could trace out which chip chains to next chip. Measuring between IC1's pin 10 (QS2) to IC2's pin 2 (D), we confirm that IC1 shifts into IC2, and IC2 into IC3. The three shift registers gives us a way to send 24 bits of data to the DLG-1414 displays.

It was at this point that I was speculating about some of the other details to be worked out still. Let's do some preliminary math:

• All DLG-1414 displays must have individual /WR strobe signals, one for each module (8 modules, require 8 bits)
• All DLG-1414 display modules require an A1 and A0 data input, to select which one of four characters to be addressed.
• Each of the displays require 7 bits of character data (but all modules can share these 7 bits)
• Each push button has an embedded LED that can be lit, requiring 8 more bits of data.

This data requirement adds up to 25 bits. But our shift registers produce 24 parallel outputs!  Hmmmm..... more about this next time.

Reverse Engineering: PC1031-0B Part 1

On of the best satisfactions you can have from the hobby of electronics is to reverse engineer something in a way that permits you to reuse it. By this process you take an otherwise piece of junk and make it useful. A side benefit is that you learn how other people have designed things.

When picking your victim for reverse engineering, there must some compelling reason for investing your time. After all, time is a precious commodity and reverse engineering requires an investment. In this series of blog posts, I am going to look at a display unit that was salvaged by a friend from bunch of discarded television intercom panels.

The Victim

Figure 1 illustrates the front and back sides of the PCB, hosting the DLG-1414 LED modules. The modules each provide 4 ASCII characters in a dot matrix format.

Figure 1. The PC1031-0B PCB assembly with DLG-1414 display modules

The datasheet for the display modules can be found here www.osram-os.com 00034174_0.pdf

Power

The first step is usually to determine what the power connections are and where they go into the PCB. Before tracing the power, let's itemize some of the components present on the PCB:

• DLG-1414 modules x 8
• CD4094 shift register x 3
• CD4001 NOR gate x 1
• CD4021 shift register x 1

The DLG-1414 requires a +5V supply. Chances are then, that the entire PCB is 5V as well. But let's confirm that. First we look at the pinout of the LED modules in Figure 2.

Figure 2. DLG-1414 Pinout

The pins are assigned as follows:

1. D5 Data Input
2. D4 Data Input
3. /WR Write Strobe
4. A1 Digit Select
5. A0 Digit Select
6. VCC
7. Ground
8. D0 Data Input (LSB)
9. D1 Data Input
10. D2 Data Input
11. D3 Data Input
12. D6 Data Input (MSB)

The CD4094 chip has its VCC on pin 16, so if the CMOS and the DLG-1414 modules both operate on +5V, we should measure zero ohms resistance between the them. When the module is removed and it is measured, this is confirmed.  Good! We probably only have one power supply to worry about.

In Figure 1, seen earlier, the bottom side shows that there is a 6 pin connector. For reverse engineering purposes, I simply scratched out a starting framework on paper to fill in like shown in Figure 3.

Figure 3. Unknown connections

Tracing out where +5V comes was easy. We know that +5V powers the DLG-1414 at its pin 6. Performing a resistance check between that pin and those in Figure 3, it was quickly determined that only connection 1 is the +5 Volts in.  We could also test between the CD4094's pin 16 to confirm the same thing. This is the datasheet I used for the CD4094.

Likewise, you can trace the ground side. Pin 7 of the DLG-1414 or pin 8 of the CD4094 should connect to one of the remaining pins of that connector. It turned out to be pin 6. Often the power connections are as far apart as possible, or immediately beside each other. Figure 4 illustrates what we now know.

Figure 4. Power connections known

Smoke Test

With the power connections known, we should be able to "light this candle". If you have a fancy bench power supply, you could set it up for +5V and limit the current to about 1 Amp. The CMOS chips require next to nothing in terms of current, and the eight DLG-1414's will consume a maximum of about 95 mA maximum each, in worst case datasheet conditions. You could dial your limit to about 800 mA, or simply as 1 Amp. I don't have a fancy bench supply, so I just "went for it". 

All we want to see, is that the modules light up with something. They won't be initialized with any data. We just want to confirm that the power is good and that modules are still alive. Don't be alarmed if some digits show a blank. A space character is just as likely as any other uninitialized character data.

Figure 5 illustrates a simple power on test. Not all digits showed characters, but many of them did. This is confirmation that we passed the "smoke test".

Figure 5. Power on test.

What's Next?

With the smoke test out of the way, we are ready to determine the other connections. Given that the PCB holds three CD4094 shift registers, we can guess that the following connections must be provided for data:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

We also have push buttons on the small daughter card, so the data for those must be available through the remaining connection. We'll trace those out in Part 2.

Beware Cheap eBay Ceramic Capacitors

Electronics hobbyists are often interested in stocking parts on the cheap, from places like ebay. Of course, we all know the maxim that "you get what you pay for". 

Recently I stocked up on various ceramic caps that I was needing from ebay, and decided to check them with the LCR meter when they arrived. Here is what I found:

• Almost all 0.033 uF caps read around 0.023 uF (i.e. -30%)
• Almost all 0.02 uF caps read around 0.015 uF (i.e. -25%)
• Almost all 0.01 uF caps read around 0.0075 uF (i.e. -25%)

Doubting the LCR meter, I checked with other parts that I had ordered from reputable places like Mouser or DigiKey. They read nominally and in some cases they read over the rated capacitance within the tolerance. It is instructive to note that none of the ebay caps were over. All were under by about the maximum tolerance (25 to 30% under).

After reading the book "Poorly Made in China" by Paul Midler, I came to realize why. Paul explains that the Chinese factories will take on orders at near cost, in order to get the business relationship started and to learn how to produce the products. Once things are going, they resort to one or more of the following practices:

1. Substitute or skimp on ingredients to increase profit
2. Come back to the importer with "price go up!"
3. Sell product on the side to bootleg markets.

I suspect that many of these cheap capacitors are being made under a strict tolerance, but on the low side with the idea that smaller capacitors are cheaper to manufacture than larger caps. Less capacitance requires less input material.

What to do About it?

A hobbyist can choose to:

1. Ignore the problem (at their project's own peril)
2. Get your money back (good luck)
3. Throw the parts away and reorder somewhere else
4. Order higher capacitor values (+30%) to arrive at the capacitance you require.

It's hard to ignore the deals like 100 for $1.31 (Cdn), or 30 for similar from the higher priced buy-it-now deals. The deals vary, but are attractively priced for the hobbyist.

One option is to try #4. Say you want to buy 0.033 uF ceramic caps. Add 30% for the actual capacitance you want and order near 0.043 uF (0.047 uF being the next value up). In this way, when you receive the 0.047 uF minus 30%, you'll have caps around 0.033 uF instead! Even if you got 0.047 uF minus 25%, you'd wind up with 0.03525 uF, which represents 0.033 uF + 6.8 %.

Voltage Rating

The capacitor's voltage rating is likely to be affected by the manufacturer tinkering with the product. While your ceramic caps may be listed at 50 Volts, it is possible that they are good for about 30% less! In other words, your caps may only be good to 35 Volts.  If this doesn't work for your design then you are best advised to spend what you need for quality components!