Tuesday 18 October 2016

Reverse Engineering: PC1031-0B Part 1

On of the best satisfactions you can have from the hobby of electronics is to reverse engineer something in a way that permits you to reuse it. By this process you take an otherwise piece of junk and make it useful. A side benefit is that you learn how other people have designed things.

When picking your victim for reverse engineering, there must some compelling reason for investing your time. After all, time is a precious commodity and reverse engineering requires an investment. In this series of blog posts, I am going to look at a display unit that was salvaged by a friend from bunch of discarded television intercom panels.

The Victim

Figure 1 illustrates the front and back sides of the PCB, hosting the DLG-1414 LED modules. The modules each provide 4 ASCII characters in a dot matrix format.
Figure 1. The PC1031-0B PCB assembly with DLG-1414 display modules
The datasheet for the display modules can be found here www.osram-os.com 00034174_0.pdf

Power

The first step is usually to determine what the power connections are and where they go into the PCB. Before tracing the power, let's itemize some of the components present on the PCB:

  • DLG-1414 modules x 8
  • CD4094 shift register x 3
  • CD4001 NOR gate x 1
  • CD4021 shift register x 1
The DLG-1414 requires a +5V supply. Chances are then, that the entire PCB is 5V as well. But let's confirm that. First we look at the pinout of the LED modules in Figure 2.

Figure 2. DLG-1414 Pinout
The pins are assigned as follows:
  1. D5 Data Input
  2. D4 Data Input
  3. /WR Write Strobe
  4. A1 Digit Select
  5. A0 Digit Select
  6. VCC
  7. Ground
  8. D0 Data Input (LSB)
  9. D1 Data Input
  10. D2 Data Input
  11. D3 Data Input
  12. D6 Data Input (MSB)
The CD4094 chip has its VCC on pin 16, so if the CMOS and the DLG-1414 modules both operate on +5V, we should measure zero ohms resistance between the them. When the module is removed and it is measured, this is confirmed.  Good! We probably only have one power supply to worry about.

In Figure 1, seen earlier, the bottom side shows that there is a 6 pin connector. For reverse engineering purposes, I simply scratched out a starting framework on paper to fill in like shown in Figure 3.

Figure 3. Unknown connections

Tracing out where +5V comes was easy. We know that +5V powers the DLG-1414 at its pin 6. Performing a resistance check between that pin and those in Figure 3, it was quickly determined that only connection 1 is the +5 Volts in.  We could also test between the CD4094's pin 16 to confirm the same thing. This is the datasheet I used for the CD4094.

Likewise, you can trace the ground side. Pin 7 of the DLG-1414 or pin 8 of the CD4094 should connect to one of the remaining pins of that connector. It turned out to be pin 6. Often the power connections are as far apart as possible, or immediately beside each other. Figure 4 illustrates what we now know.

Figure 4. Power connections known

Smoke Test

With the power connections known, we should be able to "light this candle". If you have a fancy bench power supply, you could set it up for +5V and limit the current to about 1 Amp. The CMOS chips require next to nothing in terms of current, and the eight DLG-1414's will consume a maximum of about 95 mA maximum each, in worst case datasheet conditions. You could dial your limit to about 800 mA, or simply as 1 Amp. I don't have a fancy bench supply, so I just "went for it". 

All we want to see, is that the modules light up with something. They won't be initialized with any data. We just want to confirm that the power is good and that modules are still alive. Don't be alarmed if some digits show a blank. A space character is just as likely as any other uninitialized character data.

Figure 5 illustrates a simple power on test. Not all digits showed characters, but many of them did. This is confirmation that we passed the "smoke test".

Figure 5. Power on test.

What's Next?

With the smoke test out of the way, we are ready to determine the other connections. Given that the PCB holds three CD4094 shift registers, we can guess that the following connections must be provided for data:
  1. Clock pulse (CP)
  2. Strobe (STR)
  3. and data (D)
We also have push buttons on the small daughter card, so the data for those must be available through the remaining connection. We'll trace those out in Part 2.


1 comment: