ESR Project Build - Part 3 - Amp

In the amplifier input chain, we first encounter the DUT filter cap (0.1uF) and load resistor (100 ohms). This test signal conducted through the test capacitor is then AC coupled to the amplifier stage.

Figure. Device Under Test input

Amplifier

The amplifier Q1, is suggested as any general purpose signal transistor like the 2N2222 or 2N3904 etc. I chose the latter, though I had ready access to both. Figure 2 shows the basic common emitter amplifier configuration used.

Figure 2. 2N3904 Amplifier stage

The 100 ohm resistor in the emitter leg adds negative feedback and reduces the overall gain of the circuit. The input signal is coupled in with the 0.01 uF cap and then coupled out of the collector circuit with another 0.01 uF circuit.

This circuit should have been painless to add to the existing prototyped circuit, but try as I might to get the orientation of Q1 right, I got it backwards! Doh! After snipping out the failed part and replacing it with another with the correct orientation, the gain came up to what it should be (a transistor with emitter and collector reversed will still function but with low gain). Figure 3 illustrates the pinout for this device.

Figure 3. 2N3904 Pinout

The output of the amplifier stage taken from the collector's coupling capacitor is shown in Figure 4.

Figure 4. Amplifier stage output (at collector)

Here we can see that the output is 640 mVpp, with the DUT probes shorted (for zero ohms). Going out of the oscillator driver, I measured about 355 mVpp. With DUT probes shorted and the signal appearing across the 0.1 uF filter cap and 100 ohm resistor the signal coming in is about 157 mVpp (Figure 5).

Figure 5. Input signal arriving from DUT.

So if the input signal is 157 mVpp and the output voltage from Q1 is 640 mVpp, then this would represent an overall voltage gain of about 4. But don't forget that the stage also adds power gain.

Next up, we'll review the precision rectifier stage.

ESR Project Build - Part 2 - Oscillator

The basis of the tester starts with a 100 kHz oscillator circuit. The two designs are similar, but I'm building based upon the W2AEW circuit:

The oscillator consists of a pair of CD4049 inverters biased to oscillate. The remaining four hex inverters are used to drive the signal into a 10 ohm resistor. This produces the signal sent to the Device Under Test (DUT) with enough power, but low enough in voltage to avoid silicon diode conduction.

The scope trace in Figure 1, shows the oscillator signal when the circuit was powered from about 6 Volts. The rise and fall times are 80 ns and the duty cycle was about 55%.

Figure 1. Oscillator output (before drivers)

Figure 2 illustrates the output signal out of the driver stages into the 10 ohm resistor. The voltage drops to about 355 mVpp and the frequency rose to about 119 kHz. With the driver attached, there was less load upon the oscillator stage. At these lower voltage levels, you can see more of an influence from the inductance side of things in the trace output.

Figure 2. Driver stage output into 10 ohms.

Getting the oscillator to work was fairly painless. Because I am prototyping this, I always run the risk of solder blob shorts and this time was no exception. After elimination of a supply side short and then another solder blob affecting the oscillator circuit, the circuit took off with no trouble.

In the next part, we'll look at the receiving side of the DUT probes.

ESR Project Build - Part 1 - Designs

I wasn't planning to blog this project, but it has turned into quite a bit fun, even though at the time, it seemed to be small project. As is so often the case, even the small projects provide challenges.

Why?

Many things today stop working due to switching power supply problems. Let's face it, switching supplies work hard at converting power and the capacitors involved usually fail at some point. Monitors and TVs etc. can often be fixed by just replacing the faulty caps.

But identifying the failed caps is not always easy. Many times you have a bulged or other obviously marked cap. But at other times, you may have parts that are border line, which are difficult to identify. 

No one wants to remove caps to test them on an ESR meter. So when I went hunting for a design, I wanted the following:

1. Must work in-circuit
2. Be relatively simple to build

So in my research, I came across the following two designs:

• VE7IT ESR Capacitor Tester
• W2AEW ESR Meter

I believe the W2AEW design is based upon the VE7IT design. 

Designs

The VE7IT tester produces a small 156 kHz signal of about 250 mVpp, to stay under the silicon diode conduction voltage of about 0.6V. While a Schottky diode conducts between 150 to 450 mV, am hoping that this doesn't apply often or interfere too much when it does. The VE7IT design says the cap being tested must be greater than 1 uF. Fair enough.

The signal returned from the DUT pair of probes in the VE7IT design, is then AC amplified by a 2N2222 stage and rectified by a bridge rectifier.

After the rectification, the circuit drives a 50 uA meter with a potentiometer for zero adjustment.

A note on the VE7IT schematic indicates that:

"There is no DC output until approx 75-100 ohms of ESR is seen at the test terminals (like a bad cap). Mid scale is approx 10 ohms. Full scale is 0 ohms."

As a rough measurement this is ok I guess, but I wanted to be able to measure down to the ohm if possible.

The W2AEW circuit substitutes a precision rectifier instead, so that greater precision can be had:

This should permit a finer resolution of readings from zero to 75 ohms that the VE7IT design is unable to read.

The other aspect of this design that I liked is that due to the opamps, it is no longer confined to using a 50 uA meter movement.

In the next part, I'll describe my own experiences with the build of the W2AEW circuit starting with the 10 kHz oscillator.

Reverse Engineering: PC1031-0B Part 4

In the last post, I walked through the tracing of the serial data that loads into the shift registers IC1 through IC3, as well as described how IC4 was used (NOR gate). But there is one more shift register IC5 CD4021, which hasn't been analyzed.

CD4021

The functional NXP diagram is shown in figure 1.  There is a DS (serial data in), CP (clock pulse), outputs Q5, Q6 and Q7. And then there are parallel load inputs D0 through D7, with a parallel load signal PL.  This screams parallel load of push button data and then shifted out.

The first hunch here is that the CP signal (clock) is shared with the other shift registers. A resistance reading confirms this, so no mystery there. The parallel load (PL) is probably wired up to the strobe signal, since there is only one remaining signal left for the PCB and it has to be for the shifted out data. A meter reading confirms that PL is connected to the strobe input on the board.

The D0 through D7 inputs connect to the pushbuttons and are loaded when the board Strobe goes high. After the Strobe returns low, successive clock pulses (CP) shift out the data (PCB pin 2, green wire).

The only remaining question, which is fairly obvious actually, is where does the shifted out data come from?  It has to be be Q7 or else one or more bits would never be seen at the PCB pin 2 output. A simple resistance reading confirms this, if there was any doubt.

So now we have decoded the PCB connections:

1. +5 Volts (purple wire)
2. Push button data out (green wire)
3. Data in (yellow wire)
4. Strobe in (red wire)
5. Clock pulse in (orange wire)
6. Ground (brown wire)

After programming the AVR device (ATmega328P), I was eventually able to drive this board with a few mis-steps. Essentially, with the PCB mod (more about this later), I shift out 25 bits of data and then strobe it. The DLG modules that have the low /WR signal going high, then receive their data. At the same time, the Strobe signal enables any push button LEDs, when in the low state (these are active low). Finally, after the Strobe returns low, a few more clock pulses (CP) return the push button data (the button data is loaded at the high of Strobe). The AVR code can be found here:

  Repository:  https://github.com/ve3wwg/avr

  Direct link: https://github.com/ve3wwg/avr/tree/master/atmega328p/dlg1414

CD4001 Hack

One major irritation with the PCB was that it limited access to the DLG-1414 character set. The PCB would play games with data bit D6 via IC4a.  I tried to find ways to use the PCB unmodified and gave up on that. Since only the first gate is used in IC4, we can just pull the chip out entirely (the board functions without it).  By soldering a wire from pin 3 of IC4a to pin 10 (QS2) of IC3 as described in part 3, we arrive at full control of D0 through D6 of the DLG-1414.

The Schematic

I was later reminded that I did in fact have a schematic for this PCB. So let's look at it now (Figure 2), to see how we did.

Figure 2. The PCB Schematic

The first thing I noticed was that they numbered their connections opposite to the way I did mine. Their pin 6 was my pin 1 for +5 Volts. Otherwise, things were fairly accurate.

Their wiring of IC4a was different than mine. As discussed in Part 3, I had a resistor divider, while the schematic shows pin 2 grounded and pin 1 connected to pin 1 of the DLG-1414. With IC4 removed and the mod added, this is all academic now.

My particular PCB also disagreed about the push button wiring. I was required to map the buttons as follows:

    struct {            // Input order

        unsigned pb4 : 1;

        unsigned pb3 : 1;

        unsigned pb2 : 1;

        unsigned pb1 : 1;

        unsigned pb7 : 1;

        unsigned pb6 : 1;

        unsigned pb5 : 1;

        unsigned pb0 : 1;

        unsigned fill : 8;

    } sr;    

So there you have it. I hope you enjoyed this little journey down reverse engineering row!

Reverse Engineering: PC1031-0B Part 3

In Part 2, we confirmed the PCB connections but now we need to confirm the connections going out from the shift registers IC1, IC2 and IC3. Figure 1 illustrates the scratched out notes from tracings between each of the shift register's outputs and their destination.

Figure 1. Scratched out mapping of shift register bits.

Basically these are three columns of 8 bits (in rows). The first bits traced were the /WR signals to each LED module. These clock data into each module.  Then I traced from the DLG module sockets to the shift registers for D0 through to D5. D6 proved to be a bit of a mystery at the time. More about this later.

Then all that remained were the push button LEDs, which were simply marked in groups (the push buttons and corresponding LEDs were least important to me at the time).

This permitted the mapping of bits in C/C++ using the bitfield feature:

 struct  {

     uint32_t   wr03 : 4;    // /WR0..3 (LSB)

     uint32_t   led03 : 4;   // /LED0..3

     uint32_t   d3 : 1;      // D3

     uint32_t   d2 : 1;      // D2

     uint32_t   d1 : 1;

     uint32_t   d0 : 1;

     uint32_t   led47 : 4;   // /LED4..7

     uint32_t   d5 : 1;      // D5

     uint32_t   d4 : 1;      // D4

     uint32_t   a1 : 1;      // A1

     uint32_t   a0 : 1;      // A0

     uint32_t   wr47 : 4;    // /WR4..7

     uint32_t   d6 : 1;      // D6

     uint32_t   fill : 7;    // MSB

};

The bit assignments are from least significant bit to most significant bit. On the AVR platform this is is little endian sequence (I will be using the ATmega328P for my testing). The bit field d6 was added as bit 25, which will be discussed shortly. The field marked fill just rounds it up to 32 bits and is not used.

Figure 2 shows the traced D6 back to pin 3

Figure 2. D6 traced back to IC4 (CD4001)

Later on, when I did find a schematic for this, that particular schematic simply had input pin 2 of IC4 grounded, effectively sending an inverted D5 to D6. With the voltage divider in my version of the PCB, there looked like there was some trick involved (which I never got to work). With both CP and STR high, D6 would by high. If D5 was low, and either CP or STR were low, then D6 would be high. Either way, with D5 influencing D6, it was impossible to get the whole character set from the display.

Full Character Set

The remainder of IC4 is unused. So to obtain the full character set control, I simply removed IC4 from its socket (it is otherwise unused).  Then I figured out that I could wire D6 directly up to IC3 (CD4094), pin 10, which is that chip's QS2 output.

Figure 3 illustrates the logic diagram view of the CD4094. There is one additional latch after QP7, which holds an extra bit until CP goes low. Since each bit clocks in on the low to high transition, QS2 will hold a QP8 so to speak, until the CP signal goes low again. On the falling edge of CP, QS2 will reflect the same logic level as QP7. 

Figure 3. NXP's logic diagram for CD4094 (IC3)

The important part of QS2 here though, is that while the CP signal remains high, it holds an extra bit. Given that IC3 provides the last 8 bits (of 24), QS2 provides the 25th bit.

The AVR code then sends the 25th bit first, so that it shows up at QS2 after the other 24 "command word" bits are shifted out.

LED Driver Bits

It was later traced for the struct presented earlier, members led03 and led47 drive the LEDs for the push buttons in the following way-- least significant bit in led03 drove the left most button LED. Starting with the least significant bit of led47, drove the 5th through 8th LEDs. Using the AVR code to test, it was discovered that the LEDs are lit when these bits are zeros (the LED anodes were wired to +5V).

Reverse Engineering: PC1031-0B Part 2

In Part 1, we determined the power connections on the PCB and successfully performed a "smoke test". The next step is to determine some of the input signals for this board. 

Since we have three CD4094 shift registers on board, it seems likely that we'd have the following input signals to drive them:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

Figure 1 shows the functional view of the CD4094 chip. From this we see that we have a data input (D), clock pulse (CP), strobe (STR) and output enable (OE). The outputs QP0 through QP7 are going out to the DLG-1414 and the LEDs for each push button. Both of these facts remain to be confirmed.

Figure 1. Functional View of NXP HEF4094 (CD4094)

It is also very likely, that these shift registers are chained together so that a few serial signals can fan out to many parallel outputs (again to be confirmed). Since the data (D) and clock pulse (CP) are most important here, let's begin by tracing them back to the connector.

Figure 2 illustrates the PCB with the DLG-1414 modules removed from the bottom row of sockets and the push button daughter card removed from the top. From left to right you can see three CD4094s (IC1, 2 and 3), a CD4001 (IC4) and a CD4021 (IC5) on the right hand side. The removed DLG-1414 modules are shown at the bottom of the photo.

Figure 2. CMOS ICs revealed

The connector is at the top left of the PCB in Figure 2 (topside view). A good first guess is to test pin 3 of IC1 with the remaining mystery pins 2 to 5 on the PCB connector. Our strategy is that if no zero ohm connections can be found, we move onto pin 3 of IC2 and then IC3.

Figure 3 is a photo of me measuring the PCB connection 5 to pin 3 of IC1. You can see that the meter is reading 0.00 ohms. This confirms that pin 5 is the clock input to the PCB.

Figure 3. Measuring connector pin 5 to IC1 pin 3

Another likely candidate is the data input. It is likely to go with the clock, so let's trace the IC1 D input (pin 2) back to the PCB connector. The ohm meter confirms that the connector pin 3 is the data (D) input for the board. We only have pins 2 and 5 of the board's connector left to trace.

Figure 4 is NXP's illustration of three shift registers chained together to provide 24 bits of parallel output.

Figure 4. CD4094 connected in a serial chain

We now know that the D input at left goes to the connector pin 3, and the clock input (CP) is wired to connector pin 5. Since CP is connected to all three shift registers, we could have determined that connection from any of IC1, IC2 or IC3. But the data input (D) only connects to IC1.  The strobe input STR is likely to connect to all three chips as shown in Figure 4, and this is confirmed. STR was discovered to be wired to pin 4 of the PCB connector. We have all connections save one, figured out!

The known connections are now:

1. +5 VDC
2. Unknown (likely to be push button input data)
3. Data (D)
4. Strobe (STR)
5. Clock pulse (CP)
6. Ground

At this point, we could trace out which chip chains to next chip. Measuring between IC1's pin 10 (QS2) to IC2's pin 2 (D), we confirm that IC1 shifts into IC2, and IC2 into IC3. The three shift registers gives us a way to send 24 bits of data to the DLG-1414 displays.

It was at this point that I was speculating about some of the other details to be worked out still. Let's do some preliminary math:

• All DLG-1414 displays must have individual /WR strobe signals, one for each module (8 modules, require 8 bits)
• All DLG-1414 display modules require an A1 and A0 data input, to select which one of four characters to be addressed.
• Each of the displays require 7 bits of character data (but all modules can share these 7 bits)
• Each push button has an embedded LED that can be lit, requiring 8 more bits of data.

This data requirement adds up to 25 bits. But our shift registers produce 24 parallel outputs!  Hmmmm..... more about this next time.

Reverse Engineering: PC1031-0B Part 1

On of the best satisfactions you can have from the hobby of electronics is to reverse engineer something in a way that permits you to reuse it. By this process you take an otherwise piece of junk and make it useful. A side benefit is that you learn how other people have designed things.

When picking your victim for reverse engineering, there must some compelling reason for investing your time. After all, time is a precious commodity and reverse engineering requires an investment. In this series of blog posts, I am going to look at a display unit that was salvaged by a friend from bunch of discarded television intercom panels.

The Victim

Figure 1 illustrates the front and back sides of the PCB, hosting the DLG-1414 LED modules. The modules each provide 4 ASCII characters in a dot matrix format.

Figure 1. The PC1031-0B PCB assembly with DLG-1414 display modules

The datasheet for the display modules can be found here www.osram-os.com 00034174_0.pdf

Power

The first step is usually to determine what the power connections are and where they go into the PCB. Before tracing the power, let's itemize some of the components present on the PCB:

• DLG-1414 modules x 8
• CD4094 shift register x 3
• CD4001 NOR gate x 1
• CD4021 shift register x 1

The DLG-1414 requires a +5V supply. Chances are then, that the entire PCB is 5V as well. But let's confirm that. First we look at the pinout of the LED modules in Figure 2.

Figure 2. DLG-1414 Pinout

The pins are assigned as follows:

1. D5 Data Input
2. D4 Data Input
3. /WR Write Strobe
4. A1 Digit Select
5. A0 Digit Select
6. VCC
7. Ground
8. D0 Data Input (LSB)
9. D1 Data Input
10. D2 Data Input
11. D3 Data Input
12. D6 Data Input (MSB)

The CD4094 chip has its VCC on pin 16, so if the CMOS and the DLG-1414 modules both operate on +5V, we should measure zero ohms resistance between the them. When the module is removed and it is measured, this is confirmed.  Good! We probably only have one power supply to worry about.

In Figure 1, seen earlier, the bottom side shows that there is a 6 pin connector. For reverse engineering purposes, I simply scratched out a starting framework on paper to fill in like shown in Figure 3.

Figure 3. Unknown connections

Tracing out where +5V comes was easy. We know that +5V powers the DLG-1414 at its pin 6. Performing a resistance check between that pin and those in Figure 3, it was quickly determined that only connection 1 is the +5 Volts in.  We could also test between the CD4094's pin 16 to confirm the same thing. This is the datasheet I used for the CD4094.

Likewise, you can trace the ground side. Pin 7 of the DLG-1414 or pin 8 of the CD4094 should connect to one of the remaining pins of that connector. It turned out to be pin 6. Often the power connections are as far apart as possible, or immediately beside each other. Figure 4 illustrates what we now know.

Figure 4. Power connections known

Smoke Test

With the power connections known, we should be able to "light this candle". If you have a fancy bench power supply, you could set it up for +5V and limit the current to about 1 Amp. The CMOS chips require next to nothing in terms of current, and the eight DLG-1414's will consume a maximum of about 95 mA maximum each, in worst case datasheet conditions. You could dial your limit to about 800 mA, or simply as 1 Amp. I don't have a fancy bench supply, so I just "went for it". 

All we want to see, is that the modules light up with something. They won't be initialized with any data. We just want to confirm that the power is good and that modules are still alive. Don't be alarmed if some digits show a blank. A space character is just as likely as any other uninitialized character data.

Figure 5 illustrates a simple power on test. Not all digits showed characters, but many of them did. This is confirmation that we passed the "smoke test".

Figure 5. Power on test.

What's Next?

With the smoke test out of the way, we are ready to determine the other connections. Given that the PCB holds three CD4094 shift registers, we can guess that the following connections must be provided for data:

1. Clock pulse (CP)
2. Strobe (STR)
3. and data (D)

We also have push buttons on the small daughter card, so the data for those must be available through the remaining connection. We'll trace those out in Part 2.