front panel locked up on Gossen SSP Konstanter power supply - Page 1
Forum section: electronics / repair

author: Swake
author_rank: Frequent Contributor
timestamp: December 16, 2022, 08:08:01 pm
content: Hi all,Picked up a very nice Gossen Metrawat SSP KONSTANTER 62 N 40 power supply able to deliver 40V/50A/1000W. Unfortunately the front panel controls are disabled and the 'Local Locked' LED is on. All tips to be able to unlock this thing are welcome.Some more information:This front-panel locking thing is a feature and can be set 3 ways:A/ It can be activated using the front buttons (and then also unlocked)B/ A control signal can be applied to the TRIGGER input if the trigger input was previously set to this function either trough the front panel or over an optional bus interface (that is not present)Tried enabling the front-panel using both methods several times with different combinations but to no avail.The startup sequence including the self test is as described in the manual. Everything lights up in the expected sequence. The manual indicates the self test can be bypassed partially by pressing a button on power-up and this works too. Also checked all buttons and their PCB lines. I believe all these buttons are fine.There is A 8279 programmable keyboard & display interface chip on the front panel PCB. I believe it works as the displays and LEDs are coherent and at least one button is confirmed to do what it should (skipping self-test on power-up).The trigger input is an opto-coupler. While the input measures fine relative to the operators instructions that indicate a LED with anti-parallel diode + 1.5k resistor) I could not measure the output yet (because I don't know yet which chip it is, there are plenty op opto-couplers on the board.)The settings seem to be stored in a KM62256 memory (CPU is a 80C32). By removing a jumper near a lithium battery I could cut the power to that chip and I believe this should have reset the programmable settings. This reset didn't change anything. (Did I wait long enough? The datasheet indicates only 5ms recovery time)If anyone could share a schematic or service manual for this power supply or a similar one I would be very grateful as I couldn't find one so far.Added a catalog sample picture of the power supply.Thanks in advance for the help/brainstorm as to how to find the issue.

author: coromonadalix
author_rank: Super Contributor
timestamp: December 17, 2022, 03:40:40 pm
content: For an service manual Gossen are very secretive or no leaked schematics as to be foundDid you send them some request about the command sent to put it back to local use ??the manual say thishttps://www.sglabs.it/public/GOSSEN_SSP_62&64N_datasheet_gb.pdfLocking of Front Panel OperationThe control elements can be secured against unauthorized use bypressing a key, with a computer command, or by applying asignal to the trigger inputyou have a manual wikihttps://usermanual.wiki/m/ef4fbdfd87586f0abea99b2998d9479aad0c75c521382023068ef0756d2e3f1f.pdfthere is a lot of commands sections, maybe there is something about the local or remote commandsThe page 84:LLO(input enables or disables front panel controls (LOCAL LOCKED)) seems interesting

author: alm
author_rank: Super Contributor
timestamp: December 17, 2022, 08:19:26 pm
content: LLO is a standard IEEE 488.2 (GPIB) command that is usually reset on power off, and otherwise can be reversed using the GTL (Go To Local) command. But according to the manual the local lockout indicator only indicates disabling the front panel was locked using either the key combination or the trigger mode that Swake discussed. So sounds to me that if neither way of unlocking the front panel work, this could be a defect.SRAM can retain information for suprisingly long, so I'd try removing the battery overnight and see if that makes any difference.My next step might be tracing some lines on the digital board. If the lockout is a dedicated line to the front panel controller, then cutting this trace could be a workaround with minimal loss of function. If the CPU has an external memory bus and external ROM, you would be able to trace execution like old logic analyzers used to do, but that's quite the project.

author: Swake
author_rank: Frequent Contributor
timestamp: December 17, 2022, 09:52:20 pm
content: Thanks both for the research and the though-process.Indeed I tried unlocking it with both the front keys and the trigger input. Tried many combinations as I might have interpreted the manual wrongly but no success so far.Same conclusion here: this thing is defective. Next analysis vectors are:- Removing power from the memory chip for a day or so (because that is an easy move).- Locating the trigger input opto coupler as it might have shorted to Vcc or something (unlikely but another easy move).- Will study the P8279 workings to identify if there is a possibility for a dedicated line for the lockout or something like that. That is actually a good idea.- I can look at some data lines between keyboard controller and CPU to see if there is activity when a button is pressed and if that makes sense somehow.- There is an EPROM on board, might recover its data. But diving into that is.... mmm.... no no I don't want to. On the other hand all this would be the perfect excuse to shop for some new logic analyser stuff

author: alm
author_rank: Super Contributor
timestamp: December 17, 2022, 10:43:56 pm
content: I'd also look at how the lockout LED is driven. If there is a dedicated line from the CPU to signal lockout, there's a small chance the LED is driven from the same signal using a logic gate.

author: Swake
author_rank: Frequent Contributor
timestamp: December 18, 2022, 03:59:14 pm
content: The P8279 has a IRQ out line. Monitoring that pin with a scope it triggers on each of the button presses. All buttons trigger it, my assumption is this works as intended. The two knobs to set voltage and current are not triggering the IRQ, but that might be because of the locked situation.The 80C32 has 2 incoming IRQ lines. One of them is very busy but in the middle of that data stream I can detect a state change when a button is pressed. I'm fairly confident the IRQ from the P8279 is going thru as the state change was repeatably synchronized with me pressing buttons. Unsure if that other data is normal or not, If not then I have to find out what causes it, if yes I wonder how the CPU makes the difference between the sources of the IRQ.Well... have now removed the jumper from the battery.So todo for today:- Wait a couple hours and check if it is still locked after that.- If yes then follow the suggestion to trace the locked LED signal somehow.- Trace the trigger input opto-coupler.- Remove the battery power again and wait 24 hours because a couple of hours might not be enough.- That SRAM chip is in a socket, what if I remove it... mmm... tempting. Likely the CPU is not going to be happy- I'm also tempted to turn the 'Uset 0' pot to see if the display is changing. But of course that is somewhat messing with the calibration...btw: My board 'PCB G' has a different design from the one in the manual and the picture I found on Ebay from a similar board. Likely mine is a older iteration.

author: Swake
author_rank: Frequent Contributor
timestamp: December 19, 2022, 05:15:34 pm
content: Nothing of the above helped.didn't flip that memory yet-> still temptingOn closer inspection I noticed:- A couple of buttons have had some unsoldering/soldering ongoing already, maybe to swap these around or something.- Some corrosion from a humid environment or less than optimal storage.

author: Swake
author_rank: Frequent Contributor
timestamp: December 21, 2022, 09:42:51 am
content: Some update.- Removed power and battery from the SRAM for a long time, no change.- Removed the SRAM itself and the thing isn't making it beyond self test anymore. Replacing SRAM and everything is back to how it worked before. Supposedly that SRAM is ok.- Confirmed the power supply is going through normal POST without apparent errors. What the manual describes in detail is happening.- POST can be abbreviated by holding a key on power on. That works but the power supply still goes into locked mode.- Power supply can be reset by holding down the CE/local key at power on. Not certain if this works but behavior and measures are as expected. It is still in locked mode after this procedure.- Traced all buttons/keys and couldn't find anything abnormal, no shorts, no permanent contacts, keys themselves toggle fine, PCB traces measure fine and traced these up to a chip (generally a flip-flop) and that chip does something when the key is pressed.- Traced all data lines from the button controller over buffers (74HC244) and flip-flops (74HC273) to the CPU and this all seems fine. I have no schematic but according to the routing and the chip specs it all makes sense. Anyhow everything behaves as I would expect it to do.- Everything indicates that the locked-local mode is a decision of the CPU and not something governed by the button controller. Makes sense of course. But nothing seems to tell the CPU to behave like that- I have found a slight anomaly in the opto-coupler of the trigger input and that is that, in circuit, its output transistor measures (diode test) slightly differently from all other opto-couplers. All of them are same CXY17 type. Might come from a resistor or something on its output. De-solder and confirm out of circuit I will. Now... even if this opto is bad, this _should_ not influence the local-locked status as it is expected to be disabled or reset.Sooo..... why does that local locked light remains on?.... What makes the CPU think I want it?... On start-up it has no means to be instructed that local-locked should be activated....Someone experience with tweaking code in EPROM for a 80C32 (8051)? I'd like to JMP over the local-locked routine...

author: DC1MC
author_rank: Super Contributor
timestamp: December 21, 2022, 09:48:58 am
content: I'll give it a try, post the EPROM dump.Cheers,DC1MC

author: PA0PBZ
author_rank: Super Contributor
timestamp: December 21, 2022, 10:06:12 am
content: Quote from: Swake on December 21, 2022, 09:42:51 amIf you want to go that route it would be very helpful to know how the lock led is driven.

author: Swake
author_rank: Frequent Contributor
timestamp: December 21, 2022, 10:29:44 am
content: Thank you for this kind offerI haven't played with vintage EPROM's since ages meaning my programmer is somewhere deep in an unidentified box right now. I have a shovel, can't be that far away anymore.,

author: Swake
author_rank: Frequent Contributor
timestamp: December 22, 2022, 06:36:13 pm
content: No EPROM reader yet but progress has been made. Found a dead small signal FET and what I thought was a misbehaving zener diode in an analog control section. This section is on the same board but separated from the Digital stuff with opto-couplers.The FET is a BSS88 in TO2 package and now that it is removed from the PCB it should read like 2 diode junctions but does not and there is a near short between 2 pins. Unfortunately I have nothing similar in stock and will have to order some.The zener is something else. In circuit it measured 1.3V in forward voltage and infinite in the other. Sounds like a dead diode, right? Nope it wasn't.... And at that time I didn't know it was not a simple diode, as it looked like a 1N4148. Ones de-soldered I could read the 1V4 mark and went looking into my spares and found 2 new-old-stock 1V4 'zeners'. And these too measured 1.3V forward voltage.... broken too??? Or I don't know how to check a diode anymore.... I'm rational, well sometimes, and grab the datasheet and tadaaaa: this is not a zener but a diode type I didn't know existed: a "stabistor". I works like a zener but kinda in reverse. In this case a BZV86 1.4V (see pictures). Well I learned something

author: Swake
author_rank: Frequent Contributor
timestamp: December 25, 2022, 09:34:46 pm
content: BSS88 FET is replaced. Still no joy.27C512 EPROM dump attached. Sticker on the EPROM has 3 lines:5959005SSPBoot sequence:- POWER LED lights- FAN started (I believe it is not controller by the CPU, would have to check)- Power-up test (duration 8 seconds) with:* Reset all functional units (except battery-backed configurations memory)* ROM test* RAM test* Initialize computer interfaces if installed (I don't have any)* Ascertain device type (many jumper son the board)* Check the ADC timer* Recall last settings if required- ALL LED and display segments are on while POST is running, READY LED is blinking.- After test READY LED is ON.- And in our case also the CE/LOCAL LED is on.Thanks in advance for your time looking into this.

author: Swake
author_rank: Frequent Contributor
timestamp: December 26, 2022, 08:56:54 pm
content: The digital control with CPU and display + keys is now isolated from the other parts of the power supply in that sens that it can be turned on separately.Not finding a fault I started to become suspicions of the 5V power supply for the digital part. It is based on a LM317, reads 5.2V and seemed to have a lot of noise/ripple. I removed the regulator and instead inject 5V from a bench power supply. This way I can power only this digital part.The fault situation is unchanged as the keyboard is still locked. OVP and OTP LED's are on now too. Likely because no more signal about this comes in. I wonder why the 3rd LED about Over Current is not on as I would expect it to function in a similar way to the 2 other.

author: DC1MC
author_rank: Super Contributor
timestamp: December 27, 2022, 03:08:09 am
content: Hello,disassembled the EPROM dump, the external 32KB RAM seem to mapped at 0x8000.Do you have the Serial/GPIB option, that would make our life easier, or at least where exactly the "Local Locked" LED is connected, then I should be able to trace it in the code. After a bit of cleaning I'll archive the IDA Pro database and add an assembly dump of it to help other looking into it.Cheers,DC1MC

author: DC1MC
author_rank: Super Contributor
timestamp: December 27, 2022, 04:00:50 am
content: Notes:EDIT: It seems that the serial port is always active(*) and the interface board adds only the level shifters (maybe it has some presence pin as well ?), so IMO the best thing now that you have the digital board out is to trace the serial port pins and see if you can put a TTL USB to serial port there and discuss directly with the beast.LOCAL LOCKEDThe front panel controls are disabled, and are thus protected against unauthorized or inadvertent adjustment.This display only applies to disabling of the front panel controls by means of manual adjustment or a control signalapplied to the TRIGGER input (for T_MODE TRG). It does not indicate disabling of manual switching to local control bymeans of the IEC bus LOCAL LOCKOUT command.So I will dig around the trigger circuit.Disabling front panel controlsBy pressing and holding the <CE/LOCAL> key and simultaneously activating the <RCL> key, all control panel elements are disabled except for the mains switch and the <CE/LOCAL> key, and the LOCAL LOCKED LED lights up.Disabling front panel controls prevents unauthorized or inadvertent adjustment of device settings.In order to reactivate the controls, the <CE/LOCAL> key must be pressed and held for at least 4 seconds (→ LOCAL LOCKED LED off).The <CE/LOCAL> key can also be disabled by applying a signal to the TRIGGER input at the analog interface and selecting the appropriate setting for the T_MODE function,thus preventing manual reactivation of the front panel controls.Look MORE onto the trigger area !!!4.12 Disabling Front Panel ControlsThe front panel controls can be disabled against inadvertent changes to selected values and settings.The behaviour during power on is also determined by the selected power-on status parameter Pon (page 27).Disabling☞ Simultaneously press the <CE/LOCAL> and <RCL> keys.! The front panel controls are now disabled.! The yellow LOCAL LOCKED LED lights up.Enabling☞ Press and hold the <CE/LOCAL> key for at least 4 seconds, or until the LOCAL LOCKED LED goes out.Disabling and Enabling via the Analog Interface☞ The <CE/LOCAL> key can also be disabled by applying a signal to the trigger input at the analog interface and selecting theappropriate setting for the T_MODE function, thus preventing manual reactivation of the front panel controls.EDIT Archive with the ASM file and IDA databases attached,Cheers,DC1MC

author: Swake
author_rank: Frequent Contributor
timestamp: December 27, 2022, 10:00:21 am
content: Thank you very much DC1MC.Great that you could confirm the serial port should be active. There is a UART on pins 10 and 11 of the 80C32. Talking over this port will be my next search vector.Many fingers point towards the trigger input but I don't think it is the issue because- T_MODE must be set to LLO and that is stored in SRAM memory. I emptied it by removing the battery and the SRAM chip itself. It must be 'default' now and that is OFF.- Low signal = All front panel controls are functional. Low is when nothing is applied or tied to GND. Tried this but didn't change anything.- Also tried different signals from 0V to 15V and some pulses. Unfortunately no change at all.- Associated opto-coupler output measures fine.There are still some possibilities for this trigger thing to be related to the issue:- I will trace the signal between the trigger opto and the CPU as there might be something wrong on that path.- This thing has a custom firmware with a forced local locked mode....- Another 'fault' signal exists that would cause the lock to protect something, but then I would not expect to see the READY led come on.

author: Swake
author_rank: Frequent Contributor
timestamp: December 27, 2022, 10:43:33 am
content: No I don't have a serial of GPIB interface.To drive the displays:The 80C32 CPU sends data to a 8279-5 interface over some flip-flop magic. There is more flip-flop magic on the output of the 8279-5 because counting the 7-digit displays there are in total 88 LEDs to drive.Attached a diagram.EDIT: the IRQ line of the 8279-5 is routed to the CPU and a scope put on that line shows it is triggered when any button is pressed.

author: DC1MC
author_rank: Super Contributor
timestamp: December 27, 2022, 11:46:20 am
content: Only the Local Locked LED is missing from this nice diagam

author: PA0PBZ
author_rank: Super Contributor
timestamp: December 27, 2022, 11:53:39 am
content: Quote from: DC1MC on December 27, 2022, 11:46:20 amThat would be the best attack vector yes, that's why I already asked for it a week ago

author: PA0PBZ
author_rank: Super Contributor
timestamp: December 27, 2022, 04:50:48 pm
content: There are a few commands not in the manual, like CONFIGURE and how about JANUS?Code:*CLS*DDT*ESE*ESR*IDN*IST*LRN*OPC*PRE*PSC*RCL*RST*SAV*SRE*STB*TRG*TST*WAICONFIGURECRADCLDELAYDISPLAYERAERAEERBERBEFNRSETHID_TSTIFCILIMIMAXIMINIOUTISETJANUSMINMAXMODEOCPOUTPUTOVSETOV_CALPOUTPOWER_ONREPETITIONSDCSEQUENCESTART_STOPSWITCHTDEFTSETT_MODEULIMUMAXUMINUNROUNDEDUOUTUSET

author: Swake
author_rank: Frequent Contributor
timestamp: December 28, 2022, 08:24:08 pm
content: It took me a couple hours but here is a partial schematic. Designed in... Powerpoint.Addressing of the Local Locked LED is on there but not the data source. Can't find what is talking to that 74HCT244 in the middle. Have traced and traced and traced, but found nothing, can't believe it myself. Still have to search for some output enablers sources too.EDIT: corrected name of LED

author: DC1MC
author_rank: Super Contributor
timestamp: December 28, 2022, 08:57:33 pm
content: The Local/CE is the "Local Locked" LED that we are talking, or something else ?

author: Swake
author_rank: Frequent Contributor
timestamp: December 29, 2022, 08:24:21 am
content: Yes it is the local locked led.

author: Swake
author_rank: Frequent Contributor
timestamp: December 29, 2022, 02:26:03 pm
content: Is that a GPIB Arduino interface you're planning? Nice project, I should make one too.The Gossen power supply is not collaborative over a serial connection.The RX and TX pins of the CPU are exposed on the interface connector. So I'm pretty sure these are the correct pins. I tried connecting with a CP2101 USB/Serial converter and used several baud settings but received no response at all. Will connect the scope later today on that interface as it seems not a single bit is coming back.What command would you send over to make it answer?The firmware contains this string: SIEMENS,D2425Googling it comes up with Siemens 7KD2425 and some product descriptions that are exactly the same as the Gosset series. an example:SIEMENS STABIZET D2425 (K345B), SINGLE OUTPUT SYSTEM POWER SUPPLY, WITH INSTALLATION SET FOR 19" RACK, 1000W, OUTPUT VOLTAGE 0-52V, OUTPUT CURRENT 0-50A; DESKTOP MODEL.No further information to be found.

author: Swake
author_rank: Frequent Contributor
timestamp: December 29, 2022, 03:23:32 pm
content: There are 2 open jumpers on the board near the CPU.Jumper 1 is to pull CPU pin 7 (P1.6) to groundJumper 2 is to pull CPU pin 8 (P1.7) to groundAny idea what that might do if it tried putting one of those jumpers in? Would that activate some voodoo service mode or break something?

author: Swake
author_rank: Frequent Contributor
timestamp: December 29, 2022, 04:29:18 pm
content: Tried with those jumpers. Also tried some of the jumpers on the display board. Still same locked issue.

author: inse
author_rank: Super Contributor
timestamp: January 04, 2023, 07:38:25 am
content: No progress on this problem?

author: Swake
author_rank: Frequent Contributor
timestamp: January 04, 2023, 10:51:42 am
content: I decided to let it sit for a few days. Hopefully the new year will bring new ideas.Something is still putting the power supply in "local locked" mode and it does not seem to be linked to a documented reason.I'm not capable myself in reading the code in the EPROM to identify what might be an un-documented reason...If you got an idea how to proceed please talk!Let me write-up where we areLast things tried on the digital part of the main board and on the display board:- Tested the SRAM chip in an external tester. its fine.- Couldn't make the UART on the CPU talk back to me, not a single bit.- Tested all the analog inputs (injected a signal in Uset, Iset, high trigger, low trigger and some other things) no reaction. I conclude the power supply is not in that mode- The device reset feature has no effect on the lock (Press and hold the <CE/LOCAL> key, and then press the <ENTER> key.) But over the scope one can see an IRQ entering the CPU.- Tried many button combinations, during and after power-on, long press, short press, simultaneous, in sequence,.... The only thing that works, and that is as described in the manual, is to skip part of the power on self test.- Traced all buttons and their PCB tracks to respective chips. All seems fine. Each button press also triggers an IRQ to the CPU.- GND & Vcc are ok on all chips (and feeding it from an external lab power supply now so I can isolate it from the rest).- Traced as many PCB tracks as I could without finding any issue (the board is an auto-routed nightmare).- Verified resistances; diodes, caps and all have coherent behavior (without unsoldering them).- Opto couplers are ok as far as I can test them.- When the analog part of the board is not powered the digital part detects an over voltage and over temperature situation (LEDs come on). This makes sense. It does not show an over current situation but that is measured in a different way.Thought process:- The SRAM was cleaned many times now and it reads empty. So power supply should be in 'factory default without any settings' mode.- If the local locked mode was linked to some error detection the 'ready' LED would not be lit (it blinks during POST as described in the manual).- It might be a custom EPROM, but then the power supply should listen to an external signal somehow, and it does not.- There is no communication board (GPIB or serial), and I believe there has never been one since original covers are in place. This makes me think that it cannot be in 'remote' mode.- It might be a corrupt EPROM, but then only a few bits as other things seem to work. No other dump available to me, can't check that.- Have no means to validate the 80C32 CPU out of the board, but I have no reason to believe it is bad as the startup sequence is visible on the display board and is exactly as described in the manual.Potential next steps:- Further reverse engineer the trigger circuit and poke more around that thing. Even though I do not believe in this route anymore as the power supply was reset (memory cleared) and for this trigger mode to work it must be explicitly configured in this mode. Also I applied several signals on the trigger input without this making any change.- Re-check traces and signal for each individual bit on the data bus from P8279 to 80C32 (the other way is fine).- Inject a couple volts on the output terminals from a different power supply to verify the displays are reading that voltage or the current is sunken.- Retry the serial interface with a different UART adapter. Scope the signal to verify there is indeed nothing on Tx. Because even locked it should talk to me and then I can change settings. I have traced Tx and Rx of the CPU on the connector to the communication board so no buffers in between. Maybe some other pin needs to be set somewhere to enable the talk.- Double check the auto-reversible fuse on AnalogGND.- Move more jumpers to different settings. Can't break it much more anyhow. Unlikely to solve something as I have a picture of another mainboard and jumprs are in exactly the same place.- Continue poking around the analog board.- Double check the 5V reference chip (Maxim REF-02)- Review in and output signals of optocouplers on a scope to see these make sense.

author: DC1MC
author_rank: Super Contributor
timestamp: January 04, 2023, 12:56:47 pm
content: Stupidest of the stupid reasons: could it be that it needs a load at startup ?Also, have you managed to fully trace the "Local Locked" LED ?VG,DC1MC

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 04, 2023, 01:27:00 pm
content: Quote from: DC1MC on January 04, 2023, 12:56:47 pmThis! The firmware is a gigantic mess of jump tables to jump tables mixed with lots unnamed storage locations. If we had the port where the led is controlled it would be a lot easier to find the piece of code controlling the lock.

author: Swake
author_rank: Frequent Contributor
timestamp: January 04, 2023, 08:53:22 pm
content: QuoteWould be very weird indeed, but easy enough to try out. Will do. Likely on Friday.QuoteNot fully yet. It is not that it is connected on some CPU port directly unfortunately. Many many IC's in between those and it is getting somewhat complicated.End of week I'll finally have access to my computer with Kicad, that will make things much easier.

author: Swake
author_rank: Frequent Contributor
timestamp: January 07, 2023, 02:46:35 pm
content: Attached the schematic as reverse engineered so far. Mind this is about 1/4 of the digital part of the circuit. This part has 47 chips and a bunch of other stuff. The display board has 21 chips. So a lot is still missing.- Notice the CE/LOCAL LED is the topmost.- Signal comes from the data-bus bit 0 over UC1.- UC1 is enabled from bit 2 on a 74138 (not numbered yet)- That bit 2 on the 74138 is pulled low when A0=Low; A1=High; A2=Low ( and GSA=LOW; G2B=LOW; G1=HIGH )- These A0 to A2 pins are latched from a 74373 to the 80C32 CPU pins P0.1 + P0.2 + P0.3 (and the latch pin 30 on the CPU)So, what is putting the bit 0 signal on the bus for the CE/LOCAL LED ? Well, I don't know and cannot find out without knowing what the CPU is doing as there are multiple sources for data on bit 0.- The 2 optos on the schematic (U38 and U39) are two participants in this bit 0 if U9 is enabled.- Another possible source is U2 with the quad NAND port U35. That signal must come from somewhere, but not been able to trace it yet.Further findings:- Putting a load on it doesn't change anything.- Injecting a couple volts from another bench power supply shows up that voltage on the display of the Gossen SSP and it is spot on. This confirms again it works and only the keys are locked.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 09, 2023, 11:44:26 am
content: Is it easy for you to see where P1.2 (pin 3) goes to? It is toggled a lot like it's clocking something ---_---

author: Swake
author_rank: Frequent Contributor
timestamp: January 09, 2023, 12:26:31 pm
content: P1.2 (pin3) goes to WDI (pin11) of a Maxim MAX691CPE Microprocessor Supervisory Circuit. That pin is the watchdog input.The datasheet info:Watchdog Input (WDI). WDI is a three level input. If WDI remains either high or low for longer than the watchdog timeout period, RESET pulses low and WDO goes low. The Watchdog Timer is disabled when WDI is left floating or is driven to mid-supply. The timer resets with each transition at the Watchdog Timer input.Seems correct to trigger that thing regularly.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 09, 2023, 01:36:33 pm
content: Yes, that makes perfect sense! Too bad it wasn't anything more exciting, it's called from 46 different places so I was hoping it would be used to latch something. Anyway, it's documented nowCode:code:00000046 TOGGLE_WD: ; CODE XREF: code_121E↓pcode:00000046 ; code_121E:code_12B8↓p ...code:00000046 C2 92 clr P1.2 ; Port 1code:00000048 D2 92 setb P1.2 ; Port 1code:0000004A 22 retcode:0000004B

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 13, 2023, 11:33:40 am
content: Some info of what I have found so far, maybe others are also working on this:The 3 ICs driving the leds are memory mapped on location 0x1C0, 0x1C2 and 0x1C4, and since the processor can't read the output of these the values are mirrored in the external RAM on locations 0x9F08, 0x9F09 and 0x9F0A. Changing a led then involves reading the value from RAM, doing an AND or OR changing the bit and then writing the value back to the memory mapped location and the mirror in RAM.So far it makes sense, but there is onlyonelocation where the LOCAL LOCK led is turned on andnothingI could find where it is turned off, except in a routine where all leds are turned off.Code:code:0000BF2F 90 9F C3 mov DPTR, #EXTRAM_9FC3code:0000BF32 E0 movx A, @DPTRcode:0000BF33 FE mov R6, Acode:0000BF34 90 9F C4 mov DPTR, #EXTRAM_9FC4code:0000BF37 E0 movx A, @DPTRcode:0000BF38 4E orl A, R6code:0000BF39 60 0A jz code_BF45code:0000BF3B 90 9F 0A mov DPTR, #LEDS3_MEMcode:0000BF3E E0 movx A, @DPTRcode:0000BF3F 44 01 orl A, #1 ; LOCAL LOCKED oncode:0000BF41 90 9F 0A mov DPTR, #LEDS3_MEMcode:0000BF44 F0 movx @DPTR, AIt looks like the LOCAL LOCK led will be turned on when either 0x9FC3 and/or 0x9FC4 has any bit set, but what these registers do is not known yet.So I can turn off the led but it will not enable the controlsBy the way, are you sure that the schematic is correct? What I call the LOCAL LOCK led you labelled as "CE/LOCAL"? Maybe there is a mix up here and I'm looking at the wrong led (one can always hope).

author: Swake
author_rank: Frequent Contributor
timestamp: January 13, 2023, 09:34:36 pm
content: Thank you for your continued effort on this.Unfortunately you're looking at the correct LED. Sorry I created confusion several times already by naming it alternatively CE/LOCAL (which is in fact a key) and LOCAL-LOCKED. Updated it in the schematic.That routine turning off all led's is likely called right after the power-on self test as during the first seconds all LED's and displays are turned on. My human eye thinks the LOCAL-LOCKED LED remains on after POST, something must turn on the led very quickly after the POST. Do you think it might be possible to identify what it is in the code?To switch the locked mode off one has to push the <CE/LOCAL> key for 4 seconds:Code:By pressing and holding the <CE/LOCAL> key and simultaneously activating the <RCL> key, all control panel elements are disabled except for the mains switch and the <CE/LOCAL> key, and the LOCAL LOCKED LED lights up.In order to reactivate the controls, the <CE/LOCAL> key must be pressed and held for at least 4 seconds (-> LOCAL LOCKED LED off).That key is connected on the 8279, I'll trace the exact positions.The other possibility to switch on or off is with the Trigger feature (see U47 bottom right in the schematic). It is connected on pin5 (P1.4) of the CPU. Trigger has several functions, it should specifically be configured for the lock function to behave like that.Attached new version of the schematic with opto-couplers to and from the analog board.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 14, 2023, 01:14:03 pm
content: A few remarks about your 0.2 schematic:- We talked about P1.2 of the processor and you said it was connected to the watchdog which makes sense but in the schematic it's P1.1, which is correct?- You connected the scanlines of the 8279 (SL0-SL4) to the address decoder but in the previous version they were connected to the processors address lines, which is correct?

author: Swake
author_rank: Frequent Contributor
timestamp: January 14, 2023, 04:15:36 pm
content: Watchdog is indeed on P1.2(pin3) - schematic is wrong. Good catch!V0.2 is correct for the scan lines. I cannot explain how the 74373 ended in the v0.1, there is no 74373 on that display board....Have mapped the keys. Checking those lines with the scope now for anomalies. Will upload v0.3 soon.

author: Swake
author_rank: Frequent Contributor
timestamp: January 14, 2023, 04:34:56 pm
content: Herewith v0.3 with the keys.All keys are functional and when pressed a pulsed signal is incoming into the 8279 on the correct pin and on that pin only.Scan lines look good too with continuous pulse train.There are 2 x 4 PNP and 2 x 4 NPN transistors to drive the segments of the 2 x 4 digit LED displays. I don't know why half + and half - driven. Keep it simple was not the slogan of the design team for sure.Will now try to find out how the CPU talks with the 8279 because that path is still not clear for me. Still many chips on the boards that are not on the schematic.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 14, 2023, 07:12:23 pm
content: Seeing the scan lines involved with the LEDs means that I have to start over finding them, it made a lot of sense but not so much anymore...Meanwhile there is some weird stuff going on driving the displays, I found the numbers to segments translation table:Code:code:00000080 F3 .byte 0xF3 ; 0 1111 0011code:00000081 60 .byte 0x60 ; 1 0110 0000code:00000082 B5 .byte 0xB5 ; 2 1011 1001code:00000083 F4 .byte 0xF4 ; 3 1111 0100code:00000084 66 .byte 0x66 ; 4 0110 0110code:00000085 D6 .byte 0xD6 ; 5 1101 0110code:00000086 D7 .byte 0xD7 ; 6 1101 0111code:00000087 70 .byte 0x70 ; 7 0111 0000code:00000088 F7 .byte 0xF7 ; 8 1111 0111code:00000089 F6 .byte 0xF6 ; 9 1111 0110Code:_ 102 |_| 20 _ 41 |_| 40 _ 80. 8But how they display text on the same displays remains a mystery for now:Code:code:00000D3E 90 9F 00 mov DPTR, #DISP1code:00000D41 74 4C mov A, #0x4C ; 'L'code:00000D43 F0 movx @DPTR, Acode:00000D44 A3 inc DPTRcode:00000D45 74 69 mov A, #0x69 ; 'i'code:00000D47 F0 movx @DPTR, Acode:00000D48 A3 inc DPTRcode:00000D49 74 6E mov A, #0x6E ; 'n'code:00000D4B F0 movx @DPTR, Acode:00000D4C A3 inc DPTRcode:00000D4D 74 45 mov A, #0x45 ; 'E'code:00000D4F F0 movx @DPTR, Acode:00000D50 A3 inc DPTRcode:00000D51 74 46 mov A, #0x46 ; 'F'code:00000D53 F0 movx @DPTR, Acode:00000D54 A3 inc DPTRcode:00000D55 74 41 mov A, #0x41 ; 'A'code:00000D57 F0 movx @DPTR, Acode:00000D58 A3 inc DPTRcode:00000D59 74 69 mov A, #0x69 ; 'i'code:00000D5B F0 movx @DPTR, Acode:00000D5C A3 inc DPTRcode:00000D5D 74 4C mov A, #0x4C ; 'L'code:00000D5F F0 movx @DPTR, AOh well, it's like reading a detective

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 14, 2023, 08:03:37 pm
content: Excel to the rescue: the table is longer than I expected:

author: Swake
author_rank: Frequent Contributor
timestamp: January 14, 2023, 08:22:27 pm
content: Searched the manual for messages and could find these letters and signs are used:AbcdEFG I L noPqrStUY _ -Also the top horizontal digit, opposite of the underscore.And I believe I did not see these:HJKMVWXZ

author: inse
author_rank: Super Contributor
timestamp: January 14, 2023, 08:27:46 pm
content: You guys are amazing, I wonder how this is going to turn out…

author: Swake
author_rank: Frequent Contributor
timestamp: January 14, 2023, 09:22:54 pm
content: PA0PBZ is doing the real digging. All I'm doing is pushing the 'beeper' mode on the multimeters a bit and challenging the findings with some datasheets. And I'll be very honest, without the help of PA0PBZ I would have turned away and stopped the massacre since long.I didn't document everything that was done yet:- Did desolder some potentially suspicious cap's and other components but everything measures totally fine.- Checked power profile with a scope on almost every chip to make sure it is fine.- All transistors, diodes, zeners are checked in circuit.- Have been feeding the digital part of the board from another HP power supply. I started doing this because the LM317 output was reading a little high (5.6V). This now helps with being able to quickly power cycle the thing without always starting the scary high power side.- I have been trying all possible button combinations, one and two buttons, also during power-on.- The PCB's are of very good quality but the solder job was not that good. Scrutinized the boards for bad connections, bad solder joints and so on. Unfortunately my microscope is not operational for the moment so did it with the magnifying glass function of a phone. I have been tempted to reflow using hot air, but I back tracked on that one.- Cleaned everything thoroughly with a toothbrush. I'm still convinced this machine was stored/used in some very humid place because of corrosion around the connections on the back and the white dust that was in there.- Checked many places for shorts.- Something heavy and sharp must have fallen on top of the machine because it made 2 serious sheared dents in the cover. So I checked and rechecked everything with that in mind but nothing found so far.It is a 1000VA SMPS and the size of the components are actually a bit scary. I'm veeeeery careful because if it bites its gonna hurt.As usual it will end up as some small thing somewhere hidden in a corner that we all will find very evident afterwards.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 14, 2023, 09:44:12 pm
content: Quote from: Swake on January 14, 2023, 09:22:54 pmIt always is, isn't it? More code staring tomorrow, still trying to make sense of the 8279 but zooming in slowly.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 17, 2023, 02:26:54 pm
content: Can you tell me what is connected to pin 10 of U4? It looks like there is another button (or something like that) on RL7 that connects to that pin.

author: Swake
author_rank: Frequent Contributor
timestamp: January 17, 2023, 03:34:06 pm
content: No button on U4/pin10, but it drives a transistor that is going to the 7-segment LED Displays.All output pins of U4 drive a transistor for the 4 digit 7 segment LED displays. In the schematic you can use Pin 7 as example.So this U4 chip has 3 functions:- Activate the individual LED 'drivers' UC1; UC2; UC3.- Drive the transistors for the 2x4 digit LED displays (have not checked if it is driving a segment or a digit yet as it's another weird setup).- Scan the keys.RL7 (UC6/pin8): No other button there. There are 2 unpopulated keys on the board, one is going to RL6, the other one I don't remember.ps: I'll rename U4 to UC4 to avoid confusion because it is on the display board 'C' and there is another U4 on the main board.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 17, 2023, 04:05:56 pm
content: Thanks, I guess it must be for one of the other models then, there's quite a list in the ROM.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 19, 2023, 03:54:38 pm
content: Signing in again, had another few hours staring at the firmware and it's slowly beginning to make more sense. Had a look at the power up (reset) routine and found the ENTER (skip part of the self test), CE/LOCAL (reset to factory settings) and UP and DOWN keys, unknown what they do for now. Did you try to hold the CE/LOCAL during power on? Somewhere you mentioned that you did, but somewhere else you mention CE/LOCAL and ENTER, which I think is not the correct procedure.Also looking at the 8279 and following the key entries I was wondering if the display modes in the LOCK status are Iout and Uout? Tried to find it in the manual and then found this:Pon – Output Switching Status, Response After Power On:Functions• Automatically determines KONSTANTER configuration afterpower on.Setting Parameters:☞ rSt (RESET): Factory default settings are utilized.☞ SbY (STANDBY): Same settings as prior to shutdown, poweroutput remains inactive (OUTPUT OFF).Disabled front panel controls are re-enabled after power on.As from firmware version 3.006:Disabled front panel controls remain disabled after power on.☞ rcl (RECALL): Same settings as prior to shutdown.Disabledfront panel controls remain disabled after power on.Judging the label your version is likely 5.xxx It still makes no sense that even after wiping the battery backed RAM it is still locked. Are you sure there isn't an EEPROM somewhere?

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 10:19:00 am
content: Hello,No worries and no hurries, anyhow it al of a sudden got very hectic on my side and can't give this the attention it should receive at the moment. Coming here to relax a bitGreat you could find the startup code. When the PS starts the displays contents changes very very quickly. It's doing this too quickly for my human eyes but I could try filming it in high speed mode to then analyze it image by image and maybe identify the sequence. Would that be of any help?On startup I tried pressing all single key and 2-keys combinations. Only the skip self test clearly skips the self test. I'll retry the up and down keys again, maybe...After boot also tried to long press (>4 seconds) all keys one by one and in combinations but cannot detect anything happening.Uout is shown for sure as. Confirmed this by connecting another power supply and the display updates and shows the injected voltage. Cannot confirm Iout, but it is likely the same.No other ROM-like thing in that device.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 11:02:47 am
content: Sticker on the EPROM is yellow and handwritten. The picture I found from another board shows a white sticker printed with a dot-matrix printer. It is very difficult to read.5959014031740/80VSSPLetters in purple are relatively certain.Letters in black are more of a guess

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 20, 2023, 11:23:05 am
content: Quote from: Swake on January 20, 2023, 10:19:00 amSorry, I was not clear on that, I mean the LEDsEdit: EEPROM can be as small as a DIP8I think all the processing is on the display board? Maybe a quality picture of that or both boards would help.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 12:03:47 pm
content: Want to approach from a different angle but have difficulties finding one.Assume for a moment you have to create this power supply. Other than for the cases known from the manual that all need a specific configuration that can be factory reset (so we think) why would you lock all the keys?Would there be a jumper combination that locks the keys?This would be an undocumented feature. btw the picture of that other board I found has exactly the same jumper settings, and there are quite some.When I received the PS there was a wire connected between Uset GND and A GND. This might indicate the PS was used so that some external device controls the U setting. Might have been set as slave too. Of course I tried this but could not make it work. And this makes sense because the PS has to be configured prior for it to function like that.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 12:25:33 pm
content: No EEPROM, while these existed in that period the design is too old for that I think.Pics of main board.- In the red box is the digital part.- Top of the board is analog section, with some 7400 but mostly opamps and DAC/ADC's.- On the left of the aluminium block is the power supply for the analog part.- The power supply for the digital part is not on the pics, and is even more to the left.- #38 to #47 are all the opto's- The connector on the right is for the extra communications board (GPIB / Serial).- Orange chip numbers are on the schematic, yellow not yet.- top right the green external connector for tigger input Uset and so on.- The ribbon cable on the right top contains measured stuff from the power section.Board 'G'- The raised board in top of the picture is called board 'G' and contains PWM stuff and pilots the power section through the black connector on the left top.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 12:32:13 pm
content: Close-up of the external connector circuitry on the main board.Main board from the other side because there is some stuff hidden. Can hardly access that to measure it. This is a pic of another board I found for sale.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 12:35:12 pm
content: Display board 'C'.On the right connector to the main board

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 12:58:20 pm
content: Power section.Fun fact: that potted coil with the R written on it has a diameter of 91mmSee that small bolt on the left near the black and blue cap? I think that piece of wire used to be connected to the screw just above it which is actually the ' - ' of the output because 3mm of wire and is visible not coming from the caps.The last one is the mains filter and 'fuse savior' delay. 6 black caps are 220µF/400V.

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 01:06:59 pm
content: Quote from: PA0PBZ on January 20, 2023, 11:23:05 amYes, after POST the LED's Uout, Iout and READY are lit. As far as I know this is standard. See attached pic of another PS (not mine).On mine the LOCAL LOCKED is lit too. And it has exactly the same -0.01Volts and 0.00Amps shown.Also by only powering the digital section and not the analog and power section the LED's OVP and OTP come on too.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 20, 2023, 01:32:04 pm
content: Thanks, that confirms that my initial idea of how the LEDs are controlled/arranged still holds. While they are controlled by the 8279 there is also an I/O instruction (the LEDS1 part below), maybe that's for another model, I have no idea.This is part of the reset procedure:Code:code:0000BDE5 code_BDE5: ; CODE XREF: code_BD8E+52↑jcode:0000BDE5 90 9F 08 mov DPTR, #LEDS1_MEMcode:0000BDE8 E0 movx A, @DPTRcode:0000BDE9 54 F0 anl A, #11110000b ; All Us offcode:0000BDEB 44 01 orl A, #1 ; Uout oncode:0000BDED 90 01 C0 mov DPTR, #LEDS1code:0000BDF0 F0 movx @DPTR, Acode:0000BDF1 90 9F 08 mov DPTR, #LEDS1_MEMcode:0000BDF4 F0 movx @DPTR, Acode:0000BDF5 75 6B 01 mov RAM_6B, #1code:0000BDF8code:0000BDF8 code_BDF8: ; CODE XREF: code_BD8E:code_BDE3↑jcode:0000BDF8 E5 6C mov A, RAM_6Ccode:0000BDFA 64 01 xrl A, #1code:0000BDFC 60 05 jz code_BE03code:0000BDFE E5 6C mov A, RAM_6Ccode:0000BE00 B4 05 02 cjne A, #5, code_BE05code:0000BE03code:0000BE03 code_BE03: ; CODE XREF: code_BD8E+6E↑jcode:0000BE03 80 13 sjmp code_BE18code:0000BE05 ; ---------------------------------------------------------------------------code:0000BE05code:0000BE05 code_BE05: ; CODE XREF: code_BD8E+72↑jcode:0000BE05 90 9F 08 mov DPTR, #LEDS1_MEMcode:0000BE08 E0 movx A, @DPTRcode:0000BE09 54 0F anl A, #1111b ; All Is offcode:0000BE0B 44 10 orl A, #10000b ; Iout oncode:0000BE0D 90 01 C0 mov DPTR, #LEDS1code:0000BE10 F0 movx @DPTR, Acode:0000BE11 90 9F 08 mov DPTR, #LEDS1_MEMcode:0000BE14 F0 movx @DPTR, Acode:0000BE15 75 6C 01 mov RAM_6C, #1

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 01:47:55 pm
content: Would you be able to confirm that the serial port is active all the time?Or that it is active when a certain pin is set low/high?My idea:Gossen has a software to control the PS over the serial port. Of course I don't have the serial port option but as the UART pins (RxD=P3.0/pin10 and TxD=P3.1/pin11 on the 80C32) are directly wired to the option connector I think I have a chance to make it work.Previously I could not make the PS talk to me over the serial port but that can be because of wrong settings as I don't know what speed/parity/stop bit it is set to by default. I hope the software knows.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 20, 2023, 02:08:26 pm
content: One of the many things I still want to doI know another user said it's always active but I did not check yet myself. I'm not sure there is a default baudrate - I'm still struggling with the fact that the LOCK seems persistent even when you wipe the RAM. What you could try is hook up a scope on the TxD ping, set trigger to normal at about 2 volt and see if anything happens when you turn the PSU on. Not sure if it sends anything on power up though...I just found the part that decodes the trigger input function and looking at what registers are set on LLO, another attack vector

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 20, 2023, 03:19:22 pm
content: Do you have a spare EPROM?

author: Swake
author_rank: Frequent Contributor
timestamp: January 20, 2023, 03:34:49 pm
content: Yes, I have a coupleUsed of course. Where is that eraser.....

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 20, 2023, 04:54:38 pm
content: Try to change some bytes around FF00. Looking at the ROM check I think the checksum is at FFF8, FFF9 and FFFA but they are all FF, so it looks like it doesn't do anything. Before we are going to patch it would be nice to know if that's the case.There are 2 places where the 2 memory locations that have something to do with the lock led are checked: 1 is where the actual led is turned on and the other one is in the timer interrupt where the keyboard buffer is checked. In that same location it also checks for remote mode so that makes sense. I can patch out the check for the 2 memory locations but let's first find out if there is a checksum.You can erase the EPROM by putting it in the sun of course - oh wait, too late for that, dinner time!

author: Swake
author_rank: Frequent Contributor
timestamp: January 21, 2023, 02:52:43 pm
content: In the awaiting the sun does the erasing job on the EPROMs (I don't believe it will succeed, certainly not in this winter period) I played with the serial a bit.Both pins RxD and TxD remain high all the time. I believe it jumps high just after the POST but I'll have to confirm. If the UART is not defect then it is not taking any initiative to initiate the communication. Probably some other line is signaling presence of a communication board and maybe also the type of board (serial only or serial + GPIB).De-soldered some more caps from the analog power supplies and the ESR is fine for all of them but some read a little low in capacity. For example a 2200µF cap reads about 2000µF. I think it is a sign these are drying out. So recap I will. Anyhow they're 30+ years old so probably won't last that long anymore. I've got only some cheap stuff laying around, but it will have to do during repair phase.ps: These +-15V and 5V power lines are on the analog side, measured fine and look stable on the scope.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 21, 2023, 03:12:32 pm
content: Oh it will erase them but if it's going to take a day or a month? It's probably faster if you send them to me so I can erase them and send them back! No other UV source like something to cure UV glue or nailpolish? Sun studio?In the mean time I will try to figure out if I can find how it's detecting the interface, but there's a lot of I/O going on so finding the right port could be challenging.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 21, 2023, 08:06:51 pm
content: Right, I found the spot where it is decided that the RS232 interface is available, so it's now up to you to do some EPROM action!

author: Swake
author_rank: Frequent Contributor
timestamp: January 21, 2023, 09:32:40 pm
content: NiceNothing in the house that could emit even the faintest UV-C light. Only a T8 lamp, but that didn't erase a single bit after a couple hours. So now a 25W UV-C light bulb is on order. That will zap it in a minute

author: Swake
author_rank: Frequent Contributor
timestamp: January 24, 2023, 07:51:09 pm
content: UV-C lamp and socket arrived and erased a couple 27C512 EPROMs.Have also written one with the original BIN file to verify the workflow is good. Will check that EPROM tomorrow in the power supply itself and then we can start playing

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 24, 2023, 09:15:08 pm
content: I'm ready

author: Swake
author_rank: Frequent Contributor
timestamp: January 25, 2023, 09:59:26 am
content: Almost there !!!!Documenting the sequence of events below. Remind that currently only the digital part and the display are powered with 5V from an external PS. Some components are missing and the boards are not fixed in the chassis.A) Boot with copied BIN on a second EPROM to confirm I'm able to write an EPROM correctly -> PS works and is still locked. I'd say this is as expected.B) To validate no checksum is used, added the text "Swake was here" at FF00, so nothing fundamental, and booted with that 3rd EPROM. And surprise: it works!!! the PS is NOT locked anymore, I can change settings. I did not push that further as only the digital board is powered and some components are still removed mainly from the analog board (primarily cap's I'm testing).C) Second boot with modded EPROM: Err 5 on the display. From the manual -> "An unspecified self-test subfunction has failed". Yeah right.D) Third time: lockedE) Fourth time: lockedF) Fifth time: Err 5G) Sixth time: Err 5So... veeeery exiting, but I have to admit I have currently no clue as to what caused itIs the Original EPROM bad or tired? Did I move/touch/damage/repair something while replacing that EPROM? Many new questions... more fun ahead!

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 25, 2023, 10:31:56 am
content: I told you, the thing is haunted! I spotted error 5 in the self-test routine but I can't tell for sure what it is. It looks like it's trying to initialize some unknown stuff and it's not happy. Could it be because it is missing the analog part? It wouldn't surprise me if it's trying to test something there (ADC?), so the best thing would be to put it together again and see what's happening. I can't explain the locked/unlocked states but that is not new, I already didn't understand why it was locked after clearing the RAM. Did you try to boot it while holding down the CE/LOCAL key?There is an error message for the ADC and ADC timer but it looks like that is only used when there is a serial interface so it can spit out extended error messages. If it continues to behave like that after you assembled it we can try to force it into thinking there is an interface and see what we get.

author: Swake
author_rank: Frequent Contributor
timestamp: January 25, 2023, 03:27:20 pm
content: Feeding 4.96V or less -> Boots in Error 5 + SRQ LED BlinkingFeeding 4.97V or more -> Happy (but still locked)That ERR5 situation is cleared for now as it now receives 5.2V. Was feeding 5V previously and the loss in the cables was probably borderline. The voltage is clearly a delicate element. The LM317 in the SSP that originally feeds the digital parts is configured at 5,2V. I thought that this extra 0.2V was an imprecision of the conceptors, but it might as well have been intentional.Of course I tried booting with from 4.5V to 5.5V supplied. No change.As per your suggestion I also tried holding down the CE/LOCAL key (and others) on boot but nothing. Only the skip of the POST as usual. Also went through the same sequence as this morning installing the different EPROM's. Stays locked all the time now. What did I interfere with by installing those new EPROMs that made it start ones without the lock... spooky indeed.Powering the analog section: From what is known now, not having the analog part available should only generate errors and not lock the keys. The CPU effectively detects it as the over voltage and temperature LEDs are on when the analog part is of and there is an Over Load message on the displays.Previously I tried many times with everything else powered, including the analog board but no success. The only time the PS was unlocked was without that analog part. So on the one hand I'm tempted to continue like that on other other hand, as it cannot be excluded this possibility, I'll have to perform some tests with the analog part powered too. I'll remove some remaining caps to measure them and replace if ok and put all pieces back together.In reality the keys are not physically locked, it is just that the CPU ignores the key presses. There is an interrupt request with each press. At the moment that IRQ comes in the CPU cannot distinguish between a key press or something else. So the CPU does the interrupt handling to find out and that is probably the same routine every time. Something makes it ignore the keys and keep the local locked LED on. And that must be an signal external to the CPU/EPROM/SRAM, what do you think? If it is on what pin of the CPU would that signal come in?

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 25, 2023, 03:37:37 pm
content: My suggestion to put back the analog part was because of the random Err 5 occurrence but it looks like you already discovered that it had to do with the voltage, so ignore that suggestion for now. Why it was not locked once still remains a mystery though... The 8279 has a dedicated IRQ line to the processor but it looks like the key detection is timer based. I will patch out the 'ignore keyboard' and the turning on of the lock LED and attach it to this post, stay tuned.Edit: Try attached but don't expect wonders immediately

author: Swake
author_rank: Frequent Contributor
timestamp: January 25, 2023, 04:08:03 pm
content: Locked Local LED is off nowUnfortunately no other changes, keys are not responsive.Bypassing POST still works.The impossible will be done by tomorrow, miracles take a little longer. 4 more empty EPROMs available.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 25, 2023, 04:22:39 pm
content: Quote from: Swake on January 25, 2023, 04:08:03 pmStart erasing the obsolete ones!Strange that the keys still don't work, I'm quite sure I found what they are doing. More code-staring needed I guess...

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 26, 2023, 08:39:37 pm
content: I found another interesting point where the KB processing is skipped. not sure why it would do that but try this version.Still looking to enable the RS232 but there's just too many stuff going on to make an educated guess - yet.

author: Swake
author_rank: Frequent Contributor
timestamp: January 27, 2023, 10:50:51 am
content: Keys are still locked with patch2 but something changed:Using the original firmware when only the digital part of the main board is powered both displays show an '-OL' message.With this patch2 release the displays both show a 0.00 pattern. And my believe is these are the Uset and Iset values or maybe the Ulim and Ilim values.This is remarkable because when all boards are powered the 4-digit displays show the output voltage Uout (-0.01) and output current Iout (0.00). Pictures from another power supply where the output is switched off also show that same -0.01V. This is why I think what is shown now with patch2 are not the Uout and I out values.

author: Swake
author_rank: Frequent Contributor
timestamp: January 27, 2023, 11:03:22 am
content: Filmed the LED's sequence at startup in slow motion:- Power on- Seemingly random number of LED's come on for about 1/4 of a second, usually different LEDs on every power on.- Within a fraction of a second:- 4-digit displays show all segments and dots- Then all LED's come on too.- Everything stays lit for about 3 seconds. I believe CPU is running the POST now as this can be skipped.- Then within a fraction of a second between them:- 4-digit displays off- All LED's off- LED's Iout + Pout + LOCAL LOCKED are on again- Then displays show '-OL' + LED Pout is off + LED OVP and OTP are on (This is due to unpowered analog board, Iout and LOCAL LOCKED LEDs stay on)

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 27, 2023, 12:58:19 pm
content: Right, this is getting real annoying. A lot of decisions in the reset procedure are made based on reading I/O ports where I have no idea what devices may be connected to that ports. Even with the full schematics and datasheets it would still be a lot of work, and without these it is a lot of guessing. It's also possible that by trial and error patching sooner or later we will override safety features and/or set things to fire...Then there is still the mystery of why is it locked while the RAM was cleared? Is something wrong and is it a safety feature? We certainly don't want to work around that. Is it custom firmware? I don't think so, the keyboard processing is there in the firmware, but if they made a quick patch good luck finding it amongst 100 memory locations that are all involved in the decision to lock or not.So a few suggestion:- Replace the RAM. Since the ROM checksum is disabled I'm not sure the RAM check is even working, who knows it's faulty after all.- Try to find an interface, as far as I could see they are obsolete but there must be something out there.- Try to find other firmware, based on the model numbers in the ROM there's a few choices. Maybe the ROM is faulty, no way to tell since the checksum is not working.62N040RU025P62N040RU050P64N040RU100P64N040RU150P62N080RU012P62N080RU025P64N080RU050P64N080RU075PSiemens stabizet D2425Maybe this guy is willing to read the EPROM, he has like 5 boards on offer:https://www.ebay.de/itm/274598338156I will stop chasing ghosts for the moment, revert to the original firmware and see if I can get the RS232 working, maybe the lock can be cancelled that way.

author: Swake
author_rank: Frequent Contributor
timestamp: January 27, 2023, 03:02:44 pm
content: Yes I understand and support your concern about that patching vs safety.The RAM was confirmed good in a tester. Without RAM it hangs on the POST at boot. I reconfirmed that today.No option boards found so farnot even seen one installed in the real world yet.Will try finding a copy of the firmware. Have to say I have not much hope on this one as I do not believe in corruption or custom version anymore. 2 reasons:If it is locked because of remote control than also the REMOTE LED should be on.It started ones unlocked, meaning we have everything to make it work again.I have tried many many times to reproduce the unlocked event.I'll now focus on this because I want it out of our way:- Finish replacing the electrolytic caps on the main board. Not on the power board, because these are a bit too expensive in this stage of uncertainty and I don't have those values at hand.- Carefully reflow the main board from the underside with a hot air gun.

author: PA0PBZ
author_rank: Super Contributor
timestamp: January 27, 2023, 08:54:33 pm
content: Some thoughts:Yes, the RAM was tested in a tester, but does it use the same speed? Does it write the same data to the memory locations? Hanging on the POST without the memory doesn't say that the memory is ok.Copy of the firmware - did you see the eBay link?I know it once started unlocked, but for me that is an indication that something is wrong, why would it do that? Assuming that there is no voodoo involved it must be some component that's on the edge of reliability and the first candidate for me is the RAM, then the EPROM. Of course you are free to disagree

author: Swake
author_rank: Frequent Contributor
timestamp: January 30, 2023, 12:27:52 pm
content: Difficult to continue on this one for the moment as I'm in the middle of a somewhat unplanned move to a different room. But this made me review/think/question what was done so far and now I have some questions and this is one about the power supply for the digital part of the board:What should the trace for Vcc (+5V) look like on the scope in a digital circuit similar to this one knowing it is running at 11MHz and consumes about 350mA. How much ripple is considered acceptable/normal? Are there spikes visible and what would/should these spikes look like or have as maximum level/frequency?