Reverse Engineering: PC1031-0B Part 2

In Part 1, we determined the power connections on the PCB and successfully performed a "smoke test". The next step is to determine some of the input signals for this board. 

Since we have three CD4094 shift registers on board, it seems likely that we'd have the following input signals to drive them:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

Figure 1 shows the functional view of the CD4094 chip. From this we see that we have a data input (D), clock pulse (CP), strobe (STR) and output enable (OE). The outputs QP0 through QP7 are going out to the DLG-1414 and the LEDs for each push button. Both of these facts remain to be confirmed.

Figure 1. Functional View of NXP HEF4094 (CD4094)

It is also very likely, that these shift registers are chained together so that a few serial signals can fan out to many parallel outputs (again to be confirmed). Since the data (D) and clock pulse (CP) are most important here, let's begin by tracing them back to the connector.

Figure 2 illustrates the PCB with the DLG-1414 modules removed from the bottom row of sockets and the push button daughter card removed from the top. From left to right you can see three CD4094s (IC1, 2 and 3), a CD4001 (IC4) and a CD4021 (IC5) on the right hand side. The removed DLG-1414 modules are shown at the bottom of the photo.

Figure 2. CMOS ICs revealed

The connector is at the top left of the PCB in Figure 2 (topside view). A good first guess is to test pin 3 of IC1 with the remaining mystery pins 2 to 5 on the PCB connector. Our strategy is that if no zero ohm connections can be found, we move onto pin 3 of IC2 and then IC3.

Figure 3 is a photo of me measuring the PCB connection 5 to pin 3 of IC1. You can see that the meter is reading 0.00 ohms. This confirms that pin 5 is the clock input to the PCB.

Figure 3. Measuring connector pin 5 to IC1 pin 3

Another likely candidate is the data input. It is likely to go with the clock, so let's trace the IC1 D input (pin 2) back to the PCB connector. The ohm meter confirms that the connector pin 3 is the data (D) input for the board. We only have pins 2 and 5 of the board's connector left to trace.

Figure 4 is NXP's illustration of three shift registers chained together to provide 24 bits of parallel output.

Figure 4. CD4094 connected in a serial chain

We now know that the D input at left goes to the connector pin 3, and the clock input (CP) is wired to connector pin 5. Since CP is connected to all three shift registers, we could have determined that connection from any of IC1, IC2 or IC3. But the data input (D) only connects to IC1.  The strobe input STR is likely to connect to all three chips as shown in Figure 4, and this is confirmed. STR was discovered to be wired to pin 4 of the PCB connector. We have all connections save one, figured out!

The known connections are now:

1. +5 VDC
2. Unknown (likely to be push button input data)
3. Data (D)
4. Strobe (STR)
5. Clock pulse (CP)
6. Ground

At this point, we could trace out which chip chains to next chip. Measuring between IC1's pin 10 (QS2) to IC2's pin 2 (D), we confirm that IC1 shifts into IC2, and IC2 into IC3. The three shift registers gives us a way to send 24 bits of data to the DLG-1414 displays.

It was at this point that I was speculating about some of the other details to be worked out still. Let's do some preliminary math:

• All DLG-1414 displays must have individual /WR strobe signals, one for each module (8 modules, require 8 bits)
• All DLG-1414 display modules require an A1 and A0 data input, to select which one of four characters to be addressed.
• Each of the displays require 7 bits of character data (but all modules can share these 7 bits)
• Each push button has an embedded LED that can be lit, requiring 8 more bits of data.

This data requirement adds up to 25 bits. But our shift registers produce 24 parallel outputs!  Hmmmm..... more about this next time.