Philips PM2528 - Page 1
Forum section: electronics / repair

author: Shimonu
author_rank: Regular Contributor
timestamp: May 13, 2025, 07:08:06 pm
content: I just received a PM2528 bench multimeter that isn't feeling too good. I got it to start learning to do repairs and troubleshooting so I'm a bit fresh at this.Powers up but the display just seems to light up random segments on the 7-segment digits.I've started taking it apart and already noticed some oddities inside and I'd like to exclude these as expected for any reason. There are a number of small capacitors and wires that have been cut, I'll supply pictures.Could these for any reason be bodges but as in removing components instead of adding? The values seems quite small, I see values between ~3p to 47p.There are plugin boards marked as AC AMPL and RMS CONV that have jumper wires that are cut. I'll add a picture in the next post, it didn't fit here.I figured I would start with taking care of these obvious things and then start checking voltages and logic.The addon boards are pretty stuck in their connectors and also have some springy but rigid plastic retaining arms which makes it a bit annoying trying to get the boards out. I'm thinking they might be a bit corroded and need some contact cleaner to come loose. Any other ideas, I really don't feel like damaging the connectors or the edge connectors on the boards.EDIT: With a lot of help in the thread I've managed to get the instrument mostly working again. dkupers provided a very useful package of material and we've determined what version of firmware that is working. I've gathered everything in a 7-Zip that will fit the forums upload limit. I've had to take out some large pdfs but I don't think they're essential in troubleshooting, at least not from my experience. dkupers is working on a more permanent storage solution but in the meantime I figured I should share it here if someone comes across the thread in the future and when there's a better solution I'll update this with a link.Link to dkupers github:https://github.com/deqit/PhilipsPM2528The compressed file containsKiCad schematics of the common plugin boards, not the options.Documentation, including schematics and part layout for the main board and power supply.dkupers KiCad design of a riser card to ease with troubleshooting and working on the plugin boards, allowing you to raise them for easier access to the board test points among other things.FirmwareDatasheets for some components

author: Shimonu
author_rank: Regular Contributor
timestamp: May 13, 2025, 07:08:38 pm
content: This is a picture of one of the addon boards with the jumper wires cut

author: Shimonu
author_rank: Regular Contributor
timestamp: May 14, 2025, 07:49:19 pm
content: I've taken out the two addon boards where I saw cut cables to work on them and I've removed the cut capacitors. Looking at one of the boards it looks like the jumper wires connect a trim pot to a resistor network. Both of the cables are jumpers for the same signal though so If you just wanted to disable the pot for some reason you'd just have to cut one of them. Could be a mistake of course but I'll solder back new jumpers, shouldn't do any harm at least. I'll likely replace the cut capacitors once I can order the values.I found a NPN transistor that looked a bit nasty, the top of it looked a bit melted and after I removed it I noticed a crack in it as well. My component tester didn't have any trouble identifying it and the values seemed to match the datasheet so I don't think it's a main culprit. I'm not sure what kind of load the component tester provides, maybe a failure mode shows itself in a real use case. It got replaced.I was quite suprised I had a compatible part. I always feel so surprised when I watch people repair stuff and they happen to have replacement parts at home because I always feel like I never do. Happily surprised this time.It uses-5 V as logic low and 0 V as logic high, I haven't looked at a lot of equipment but this was a new one to me. Quite interesting.

author: Haenk
author_rank: Super Contributor
timestamp: May 15, 2025, 04:09:18 am
content: The cut caps look like being cut as course adjustment, as the trimmer itself does not cover a huge range. I assume, that's perfectly fine.The cut jumpers may also be part of the factory adjustment.Checkhttps://josvandijken.nl/elektronica_philips_PM2528.phpIt clearly shows the cut jumpers, too. So: leave them alone.But: All of the blue Philips electrolytic caps are IMHO very suspect - check those first.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 15, 2025, 03:33:40 pm
content: Quote from: Haenk on May 15, 2025, 04:09:18 amAlright, that makes sense then. I had time to put new jumper wires but I'll just cut them the same way then.I have checked a couple of the blue caps but they measure fine and I don't see any signs of leakage. I'll check the rest as well but from the voltages I have measured I don't see any problem.When I've checked the pins on the microprocessor they seem active, that's about all I can determine. Not the prettiest waveforms but looks functional. I'm more suspicious about the connection to the display. The only issue I've really seen so far is that the display isn't displaying anything correctly, just random segments or all of them at one point. There's a ribbon cable going to the display and the connectors are not very impressive and starting to come apart. Each side has a tab that won't click into place so I'm not sure how well it's connecting. I will have to check that.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 15, 2025, 04:39:49 pm
content: Yeah, I would definitely like to replace that ribbon cable. I measured continuity and resistance and there are some questionable readings. On one pin the resistance would jump around pretty sporadically. You can see in the picture how one side of the connector has come loose. I think the tab is just too worn, no amount of pushing on it gets it to click into place again. It's the same on the other end of the cable.Are there replacements for these DIL socket connectors? Otherwise, since it seems like a problematic design, I was thinking I would make some adapter boards and put a more robust connector.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 21, 2025, 09:56:42 pm
content: I've replaced the cable today after getting some new connectors. That was unfortunately not the issue even though it was needed.I'm starting to worry if the EPROMs might have gone bad and needs reprogramming. I see activity from the microprocessor but I can't really determine if it's correct and so far I haven't found much else to explain why it doesn't work.I've been trying to debug why the display wasn't showing anything and I found that the enable signals for the binary-to-decimal converter on the display weren't active. After trying to follow the signals they suddenly went active but the display only lights up some random segments which also makes me think the processor isn't doing anything correctly.The voltages are all fine, the reset to the processor is stable, traces all seem okay, no breaks or damage that I can find and continuity beeps as expected for the traces I've tested. Nothing is getting hot. I know the display works because I've one time seen it light up all the segments and sometimes see random segments light up.What are the odds of me getting a hold of the firmware for this? I'm not sure how many of these are still around and if anyone would have saved the firmware.The microprocessor appears to be available on eBay and changing it out could also be worth a try.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 22, 2025, 07:52:59 am
content: Quote from: Shimonu on May 21, 2025, 09:56:42 pmI have a working one and could read the firmware assuming it's in eprom?

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 07:58:42 am
content: Quote from: PA0PBZ on May 22, 2025, 07:52:59 amWow, that would be fantastic! Yes, there are two EPROM next to the microprocessor.I don't actually have any programmer(or a way to erase them) but that's a delightful problem to solve if I know I can get the firmware. I was a bit discouraged but this really made me excited again. Let me know if I can be of any help

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 22, 2025, 08:41:48 am
content: Breaking down and rebuilding the stack of instruments took longer than the actual reading of the EPROMsAttached are the 2 and the location where they should be going.Edit: I see you have the same numbers, oh well, better safe than sorry.Edit2: Removed the attachment because one of the files was bad. See first post for all there is.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 09:00:02 am
content: Quote from: PA0PBZ on May 22, 2025, 08:41:48 amThat was fast, I can't thank you enough! I have no excuse for not getting this multimeter working now.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 22, 2025, 09:30:08 am
content: A few tips when the EPROM change doesn't work or to keep you busy until you can try.Make sure the processor clock (pin 3) and RESET (C1605?) are okMake sure all voltages make sense and that there is not too much rippleCheck all data and address lines, the ROM chip select and the address latches

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 10:42:07 am
content: Quote from: PA0PBZ on May 22, 2025, 09:30:08 amI've just had a quick look at some of those, the clock for instance I've seen activity but not looked too close at the waveform. I'll see if I can capture some images from the oscilloscope and share. I'm not quite sure what sort of edges these old chips produce because some have looked a bit odd. I'll try to get some pictures tonight.I'll probably order the microprocessor as well, it's not that expensive.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 07:44:17 pm
content: I've checked the reset with my oscilloscope and it's stable at 0V(logic high), measured resistance over C1605 and it measures open as expected. The clock signal looks sinusoidal but I noticed now the amplitude is only a bit over 4 V which I'm not sure how much that affectsThere is one signal that I've looked at a bit closer now that looks odd to me. It's the PROG signal from the microprocessor, from what I can tell it's used to clock data into the P8243. The PROG signal looks like there's either crosstalk or something else driving the line. But I'm not sure it would actually cause any trouble at the levels I'm seeing.Another thing really bugging me are the PS1 and PS2 active low signals. They essentially activate the display but the schematic doesn't show where they come from, or at least I haven't found it yet. In the worst case I'll have to follow them on the boards but I'd have to remove some of the daughter boards which are really annoying to remove and I'm worried I'll damage something if I fiddle too much.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 22, 2025, 07:56:44 pm
content: Both look ok to me, I've seen worse. The clock goes to a divider which has something to do with the 50/60Hz if I remember correctly, if the output of that divider is ok the clock is fine.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 08:22:16 pm
content: After removing a board I could beep out the enable signals for the display which also helped me find them in the schematic. I'll see if I can find out more about what's happening with them, but they are also coming from the microprocessor, just that they are multiplexed.For reference:The PS1 and PS2 come in from the bottom right on page 12 to the HEF 4556 chip on pin 5 and 6.I'll check the divided clock, thanks!

author: Shimonu
author_rank: Regular Contributor
timestamp: May 22, 2025, 08:48:58 pm
content: Pin 37 and 38 on the mikroprocessor should control the enable signals and as far as I can tell those just go high when I turn on the power and then nothing happens. I'm not sure what kind of intelligence the software has, if there is any self-test or condition for enabling these.Could you tell me how the display behaves when you boot it, is there any boot information or does it just go directly to showing measurements? Although, from the service manual there isn't any mention of it and any health check appears to be manual.I'm still feeling like this could be corrupt firmware or the micro being broken.I've ordered both an EPROM programmer and a new microprocessor. Still need to find a way to erase the memory but that shouldn't be too hard, I've seen some cheap erasers on ebay.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 23, 2025, 07:56:31 am
content: After switching on the AUTO, INT and VDC leds turn on, the display stays blank until about 0.5-1 seconds where it starts to show a count.It probably shows garbage in the first milliseconds but it's undetectable. Do any of the front panel leds show anything on your 2528?A correction: the PS1 and PS2 are comingfromthe 4556, they are connected to the outputs!It would be nice if there was a real service manual but you got to do with what you have...

author: Shimonu
author_rank: Regular Contributor
timestamp: May 23, 2025, 08:10:00 am
content: Quote from: PA0PBZ on May 23, 2025, 07:56:31 amNo, nothing is happening on the display or the keys. It used to show some random segments after start that stayed on but now it's just dark and sometimes when I've been debugging it has lit some segments.Yeah, I was unclear, PS1 and 2 come out of the demultiplexer which has its enable signal fixed to -5 V(always enabled) and the A0 and A1 come from the micro. If the A0 and A1 are driven low then PS1 and 2 will be high if I remember correctly. I don't have the schematic right now but I think it was pin 37 and 38 on the micro that drives A0 and A1 and those had no activity.Good to know about the AUTO, INT and VDC. I'll see if those are driven without the enable signals, maybe that could also give me a hint or if it also points to the micro.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 27, 2025, 04:39:55 pm
content: Alright, I got my hands on an EPROM-programmer and I've been able to read out my EPROM and compare it to the binaries I got from PA0PBZ.I started with 25145 and that didn't show any difference but 25156 shows significant difference! Thanks again for sharing the firmware, I think it's going to be crucial.Now I don't have any UV-eraser yet but it's on the way and should hopefully arrive any day!I've shared a screenshot of the comparison and it looks to me like bits are going from 0->1 for one or multiple bits. Which could not be explained just by there being different firmware versions, I think the differences would be more sporadic then.Now I'm also wondering how stable these EPROMs are and if I should look for replacements. I'm not sure how long it will retain it's content if I'm able to reprogram it.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 27, 2025, 08:06:48 pm
content: Erasing an EPROM is setting all bits to 1, so a number of bits changing from 0 to 1 looks like it's slowly losing the programming. I don't think that you have to replace them, a fresh programming should again stick for a couple of decades.

author: Shimonu
author_rank: Regular Contributor
timestamp: May 27, 2025, 08:09:05 pm
content: Quote from: PA0PBZ on May 27, 2025, 08:06:48 pmCould that mean that I could try to program it without performing an erase first, as it should only zero the bits that have returned to 1?

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 27, 2025, 08:44:14 pm
content: I guess you could yes, but depending on the algorithm used by the programmer I'm not sure that all the correct bits will be refreshed too. It's a quick way to test but eventually I'd just erase and reprogram. Also, not sure if the programmer will accept a not erased EPROM, time to find out

author: Shimonu
author_rank: Regular Contributor
timestamp: May 27, 2025, 08:50:07 pm
content: I'm using a Batronix programmer and their software actually allows you to skip the check for an erased chip. So I couldn't help myself and tried refreshing it after quickly googling if it could be harmful but after a quick check now it doesn't seem to have revived the meter yet. I'm going to check some signals to see if there's any activity and take it from there.

author: PA0PBZ
author_rank: Super Contributor
timestamp: May 27, 2025, 08:56:05 pm
content: Ah bummer! Did it correct the EPROM though?

author: Shimonu
author_rank: Regular Contributor
timestamp: May 27, 2025, 10:03:13 pm
content: I'll double check, it read back and verified successfully so I would assume so.I had another look at the address lines now as I noticed less activity. The A8 - A10 pins don't seem to be driven correctly, unfortunately I don't remember what they looked like before refreshing the memory. They don't seem to be floating but have values around -3.7 V and -4.2 V which is right in no-mans-land in terms of logic levels so the EPROMs won't be giving any reliable output. The lower address lines, A0 - A7 are all nicely at -5 VThose address lines(A8 - A10) are not handled by any address latch, they're driven directly by the micro and there's nothing else on the bus. I think I will remove the memory and watch how those lines look with only the micro on the bus to see if there's any contention or if the micro is having trouble driving those pins.Boy, this repair stuff is really a roller coaster. One moment I feel excited and sure I have a solution and the next you're distraught and have to look for the next issue, feeling like it's never going to get solved. But I shall power through and solve this. I definitely have every possibility to, I have a replacement micro coming if I feel that it could be faulty.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 04, 2025, 09:43:29 pm
content: Small update. I got a new Intel P8035 microcontroller from ebay today and plugged it in. The original was damaged, I'm getting more activity from the MCU now, I can see it's counting up the program memory address and making some jumps. But it's only accessing one of the EPROMs, the CS for one of them is never asserted. There's still nothing showing on the display but the "OFFSET" and "HIGH RES" buttons light up. I know that's not what's suppose to happen but it's something at least. There's no reaction if I press any buttons but I haven't checked if the MCU gets any interrupt when I do that.I've been using the Analog Discovery to do some logic probing for the address and data. But I don't have enough grabber hooks so I've ordered some which should help me probe more.I'm going to keep probing and I have to keep studying the schematic. I haven't quite figured out how the ADC is triggered and I want to make sure that is happening. I think I've understood what the BCD counter is for so I'll check if that is getting clocked as well. But I'm guessing the display isn't going to be updated unless there's data coming from the ADC.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 05, 2025, 09:17:34 pm
content: I think I might be repairing my own mistakes now. Before when I was probing I had the oscilloscope probe ground connected to -5 V so the scope would show logic low as 0 V, but what happened was the probe ground managed to touch a piece of a shield which was connected to 0 V which lead to a short circuit for a moment. A similar thing happened another time when I wanted to use the Analog Discovery and the oscilloscope at the same time but connected their ground to different points before realising my mistake. It's obvious because all the relays activate.Nothing is permanently shorted but I'm starting to see some logic ICs that are behaving strangely, or at least a hex inverter at the moment. Hopefully there isn't too much damage now but I've got some sockets coming and I'm going to look for some equivalent logic ICs just so I'm ready to replace any suspect parts I encounter. So I'm wondering if the original problem was just the corrupt EPROMs. Well I guess on the bright side I get to practice my troubleshooting and repair skillsI'll be getting a desoldering station too. Just trying to remove the DIL socket for the display connector almost ruined the PCB pads. Sucking or wicking never worked so eventually had to use hot air but that wasn't great even if it did work.I'd appreciate any tips on desoldering stations!I'll just share a picture because they're always fun. I'll sometimes get random stuff on the front panel after a boot which was a bit exciting in its own way. But I think this just shows how the logic and maybe the IO expanders are a bit messed up at the moment.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 13, 2025, 04:11:48 pm
content: This thing is kicking my butt.It doesn't help that the manual just shows parts of the instrument.I'll list what I've done and exluded.Powers on fine and has stable power on -5, -15 and +15 VReset line rises nicely and stays highMCU was changedEPROMs were refreshed after finding memory corruption. I've also programmed some new EPROM with no changeSome of the bigger electrolytics have been changed. One big 6800 uF and two 680 uF which all tested fine outside circuit and no change after replacingI've changed a HEF40097B tri-state hex inverting buffer - no change, was likely fineI've changed a HEF4013B Dual D-type flip flop - no change, was likely also fineThe address latches behave correctly, the memory is addressed correctly. I have not verified the output from them but there's no reason to believe they're wrong as they read fine in the programmerI'll try to describe what I'm seeing. As seen in the previous picture it turns on but is basically showing junk. There's very little or no updating when it turns on. It can show nothing or a few segments and then after about a second change to the junk you see in the picture with different buttons and mode lights lit up. It can also start up and show nothing with no lights. The most interesting I've seen is I can very rarely get just dashes(segment G) across the display and when looking at the pins I see more expected activity with interrupts and reading from memory.In the less interesting cases the MCU appears to be running in a bit of a loop. The ENI(enable interrupt I believe) signal is stuck high, the RD(read) signal is also stuck high but the WDOG(watchdog) for example is pulsing. With the ENI stuck high the interrupt controller will be locked from detecting any button presses or any other interrupt signal.I've tried to perform some warm resets by pulling the reset to -5V with a jumper to see if it could be a power-on issue but that doesn't give any reaction. The display doesn't update or react in any way.One fun distraction was the voltage regulator on the display. It's on the backside of the display and at a right angle with a screw that is supposed to attach it to a shield/heatsink. But the screw head is put between the regulator and the display PCB, so when it's not attached to the heatsink the screw head is rattling around between the regulator and the PCB. Of course there's a via right under the screw which I think messed with the grounding and made the interrupt look funny when I was probing and pushing buttons. Some electrical tape and screwing on the heatsink temporarily fixed that.I'm starting to wonder now if some IO expanders could be bad but that might just be because I got some in the mail today, unfortunately just 3 and there are 5 in the instrument. But those are what interfaces the MCU with the rest of the instrument, the display as well as the plugins. It's easy enough to swap them around a bit.I think I can exclude any power issue or startup behaviour, I'll show some pictures of the 5V and reset line at start. There is a little dip in the 5V at startup and it can have a plateu at a lower voltage before going up to 5V but it can also be a nice linear rise, that hasn't been consistent with any change in behaviour. I think the MCU is running as it should but might be getting some unexpected input perhaps, I doubt the firmware has a lot of handling of unexpected states and modes as it's so limited in memory. I don't think it could be as simple as the ADC giving bad readings or not functioning. I think that would still give a functional display. Without more knowledge about the interaction there's a lot of fumbling in the dark.I'd appreciate any thoughts, otherwise this rubberduck troubleshooting works great too

author: Shimonu
author_rank: Regular Contributor
timestamp: June 15, 2025, 10:50:43 am
content: Quick question. There's a signal with a diode connected to it and I'm wondering what the purpose of it is. The schematic doesn't exactly show it, just mentions the signal is connected to the cathode of a diode.I've measured the diode and the anode is connected to 0V which is the high potential, -5V is the low potential.Is it just a protection diode?So the signal sits between an IO expander and the input of 2 logic gates. I noticed it goes to about 1.5 V and I'm thinking maybe the diode is bad. I'm going to double check, I just want to know what it's for before I remove it.EDIT: I measured the diode and it has a 0.7 V drop and is open in the reverse direction so that seems fine unfortunately. I'd still like to know how the signal gets to 1.5 V. It's a part of the ROM SELECT so I think it could explain the issue I'm having.

author: Astralix
author_rank: Regular Contributor
timestamp: June 16, 2025, 10:59:32 am
content: Have you checked the introduction section of the service manual about the Test-ROM?The mentioned Test-ROM has never been seen out in the wild. Also Philips never mentioned which signature analyzer they opted for these tests. Finding a working signature analyzer isn't too easy anyways.However, the first test requests you to remove both EPROMs and everything else to enter the free-run mode. In that mode the CPU should receive an open data bus that reads like a NOP instruction, thus the CPU just addresses its complete address range. That is the easiest thing to test with a scope crawling over all address lines. Also you have to know that the 8035 is a 8 bit machine, it addresses the two EPROMs sequentially not in parallel. With the free-running test ongoing in one address space the first and in the other the second EPROM must be /CS low.Also to keep in mind is, that there are two service manuals. And the one we have is only for the fault finding with signatures by using the Test-EPROM. The other is not available. Also at ko4bb sites there is a document called Service Manual, but for real it is only a really nice scan of the original user manual in multiple languages.Finally we could try to check, which other Philips instruments used the exact same main board. Because the description and the schematics show elements that are not present in the PM2528. That is a hint, that this board was used in other instruments too. If the owner of one of the other instruments based on that platform has saved the Test-ROM under the name od that instrument, we may get lucky...

author: Shimonu
author_rank: Regular Contributor
timestamp: June 16, 2025, 11:31:55 am
content: I had actually missed that you could test it without the program memory. I read about the test ROM but knew I wouldn't get my hands on it so I ignored the test descriptions. Now I'm fairly sure there's a problem with adressing the memory as I've seen one of the CS stuck high or sometimes toggling, this changes between power on.But in troubleshooting the ROM select logic I've only now noticed the CHSUM being strange and that's why I'm following that trail. I'll try the free-running when I have a chance. Meanwhile I'd love some brainstorming on the CHSUM signal and how it works together with the diode. There appears to be some transistor logic connected to it but I haven't had time to reverse engineer it yet. I don't know if the CHSUM could be input to some other logic via the diode or if the CHSUM is controlled via the diode. I've read about OR-ing with diodes but I'm not sure if that's the case here.I've tried searching for some other multimeters that could share hardware but I haven't had any luck finding any list of the multimeters that Philips made and the ones I've found haven't had manuals or the hardware was different unfortunately.

author: Astralix
author_rank: Regular Contributor
timestamp: June 17, 2025, 09:25:13 am
content: Okay, have to correct myself a bit.There is a thing called free-run simulator from Philips. But that is actually only a bunch of resistors (8x330R or so) tying all Data-Lines to logic 0. (-5V)If you look at the manualhttps://bitsavers.trailing-edge.com/components/intel/8048/9800270D_MCS-48_Family_Users_Manual_Jul78.pdfto the MCS-48 series, NOP is 0x00.Please test the free-running mode as soon as you can! Cause that may give you an idea of how the logic works. It should also trigger the additional address logic and should enable you to test the corresponding logic gates without even understanding their individual purpose.I.e. If a logic gates has signals at its input if must have a certain result at its output. Without understanding where the input is coming from and what the output does, if the logic result is not correct, the gate is defective.I am using some compiler wait time to decode the logic in the service manual, but it is hard to read the correct signal names.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 17, 2025, 09:30:34 am
content: Yeah, I was going to try yesterday but realised it didn't make sense to just remove the memory without driving the data low.Should be easy enough to create something that gives all 0 (-5 V)

author: PA0PBZ
author_rank: Super Contributor
timestamp: June 17, 2025, 09:57:24 am
content: You could even program some spare eproms with all 0x00.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 17, 2025, 08:01:52 pm
content: Quote from: PA0PBZ on June 17, 2025, 09:57:24 amThat was a great tip, really simple and clean solution since I have the extra eproms.Filled them with zeroes and monitored the address signals, the chip select signals and the A11 which is input to the logic and not directly adressing the memory.Obviously I haven't checked that the whole address space is enumerated correctly but just looking at the signals it looks like binary counting on the address and the A11 signal is also active. However only one of the chip select signals is active, the other is always high and I beeped it with the multimeter to pin 6 on the 74LS32.A few hours later...I've been going through the logic with my logic analyser. I don't see anything to indicate that the logic gates are broken. They behave as expected. One thing to note is that since the MCU will just read NOP I'm assuming nothing will assert the RD signal which is part of the chip select logic. The PSEN is however toggling and exercising the logic gates but it appears to happen in perfect sync with the A11 so the CS is never asserted due to that.I'm still coming back to the CHSUM signal which appears glitchy in the logic domain. There are short pulses of varying length on the logic analyser which doesn't look correct to me and since I'm measuring 1.5 V there constantly it makes sense to me that the logic gate would sometime read it as a logic high since it's an invalid logic voltage.I've been trying to reverse engineer some transistor logic and the purpose of the zener diode. I haven't quite mapped everything and from what I'm making I'm not sure if I got it right. Maybe someone could have a look and see if it makes sense.EDIT: I think I can disregard the diode and that section. I removed the diode and still saw the same 1.5 V which confuses me a bit now. Is it just floating? I removed the IO expander before and saw the same and I've also bent the legs of the 74LS32 outside the socket and saw the same thing. That just leaves the 74LS04 that I haven't disconnected. That will be an exercise for tomorrow though

author: Astralix
author_rank: Regular Contributor
timestamp: June 18, 2025, 05:54:54 am
content: EEPROM with 0x00 content ist helpful as wellYou also could then later write your own basic tests for the unit.But until we know that the basic address system is working, let's check the logic a bit..Signal *6PCP addresses the lower EPROM D1810 and 6PCP selects D1813. The * looks like the "not" sign for signals like 6PCP.A11 generates *0000 that is high on the upper EPROM address range 0x0800. To get a /CS it is inverted by D1808. Looks like 4kB of EPROM in two segments.Your finding that A11 toggles but the upper EERPROM is not addressed, makes me wonder, but cannot be caused by CHSUM/SDH.CHSUM/SDH selects between EPROM logic and ADC as the signal passes directly to D1815-9. In parallel it gets inverted by D1809-9 and enters D1815-13 together with /RD.Back to a bunch of my thoughts...The signals 0000 and *0000 are both inhibited to a logic 1 by D1812 that uses *6PCP to select EPROMs only on /PSEN.If you wonder why PSEN is active high and *6PCP is active low, that is because of a typo in that manual, PSEN is /PSEN, it is active low too. /PSEN = *6PCP makes sense.With that in mind it makes sense that the OR gate only is active low on any of the /CS if not A11 and not PSEN are low too. (Same but A11 high for the second EPROM)Now there is an additional signal coming in, /RD and CHSUM/SDH. Both have to be low, to release D1815 pin 8 to low and enable EPROM access./RD is clear as it should enable the outputs of the EPROMs.What is CSUM/SDH. It is buggy...The Service Manual says that P70 of D1702 is /CHSUM /SDH, what either means that CHSUM and SDH are the same thing and both are active on a low signal.On the CPU page of the manual it is written as CHSUM/SDH what reads as HIGH = CHSUM; LOW = SDH selected. Is that Sample Data Hold?It would be interesting to know, in what state the signal is on power-on. The 8243 PIO chip initializeses this pin as tri-state what reads to me like electrically undefined, i.e. left open.Schematics tell the signal is routet to D1808-9, D1815-9 and V1807 (CATHODE).D1808-9 and D1815-9 are discussed above, they inhibit access to EPROM-HI. Instead it switches the logic around D1814 into the range of the upper EPROM.However, I cannot find the diode V1807 in the schematics.And 1.5V (positive?) does not look good on CHSUM/SDH as that constantly disables the access to EPROM-HI. It should be -5V.Also 1.5V with the diode removed looks like a bad P8243 PIO chip D1702. Can you exchange it for D1701, which is the same type or check if you can buy some off eBay?I have seen a lot PIO chips going bad over time regardless if they are from the Intel or Motorola world.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 18, 2025, 05:55:04 pm
content: Oh, are those signal "names"? I haven't understood what the "0000" and "6PCP" are supposed to mean. There's a notation about Logic 0 = "0000" and Logic 1 = "6PCP" but there are other values as well so I'm not sure what to make of it.I'll try to not get too stuck on CHSUM/SHD, I was hoping it would lead to something but the more I thought about it I realised it's mostly low which should mean any time RD is low the logic should behave as expected. Without understanding the purpose behind it more I'm not sure I can draw any conclusion, it just seems odd that it would be left in an undefined state and there's no hardware to pull it high or low. The best I could determine about the diode was the little sketch I showed but it doesn't look like it's driving the signal, just controlling something else. So the P8243 should be the only thing driving it as far as I can tell. As long as RD is high CHSUM doesn't have any effect so maybe it's set before RD is active and what I'm seeing isn't any indication that it's buggy at all.The question then becomes what should activate RD and is there any activity there? I'll double check with the oscilloscope.I should be more clear when I write voltages. When I say 1.5 V I mean relative VSS, it's -3.5 V relative GND but it's easier in my head to think of it as 1.5 V. I'll write voltages relative GND in the future. So the P8243 is fine. I've also swapped them around and put a new one from ebay in to exclude it.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 18, 2025, 08:00:04 pm
content: I think I need to get some basics cleared up or maybe this is a clue. I've mostly been measuring with my ground clip on a -5V test point to get signals that look like I'm used to, high signals are a positive voltage and low are 0 V. But now I put the ground clip at 0V so all the voltages would be more representative and show their true negative nature. But when I'm measuring the RD signal it looks like I'm measuring with poor grounding, it looks like there's crosstalk and it's sensitive to my hand getting close and gets noisy. My two first pictures show what I mean.Because of this I switched the ground clip back to -5V and got a more stable signal but the level looks low now, the RD signal only rises by about 2V and when it goes low it doesn't drop all the way. Third pictureI should also clarify that this was a rare startup where it goes into some other failure mode and there's activity on signals like RD that normally doesn't change much. Typically I would see RD change a bit while reset is still rising and maybe toggle once aboiut a second later.I'd really like to know if I'm doing something wrong by changing the ground clip around to different references. Should I only use one of 0V or -5V? Or could this indicate some grounding/connection issue?

author: Astralix
author_rank: Regular Contributor
timestamp: June 20, 2025, 07:48:44 am
content: Do you measure free of earth? So, either your PM2528 needs to be floating or your scope needs to be behind a transformer. Otherwise a lot of side-effects will happen by currents flowing from the -5V through your scopes ground.Let's assume -5V physical ist 0V logical and 0V physical is 0V logical. Then 1.35V logical is an illegal value. /RD is spread around 74LS logic and if I am remembering correctly, logic 0 is allowed to be 0..0.8V and logic 1 is from 2.00V to 5.5V. Your signal is clearly in the gray zone, not 1 but also not 0. But if the ground isolation of the scope is not correct, you might pull the signal by parasitic effects.Secondly, only probing the /RD signal without reference doesn't really help. Yes, it has to toggle, but we need to see when it toggles related to the corresponding signals.Basic stuff:The MCS42 series is a 8 bit architecture with 16 bit address range. To save some pins, the data pins on the chip also carry the lower address bits. To access a 16 bit address bus, the lower address bits are put on the data bus and an external 8 bit latch saves these address bits when ALE is set high. The PM2528 uses HEF40175 latches that require a high to low pulse on their CP input and therefore the D1808 creates an inverted signal for that.After latching the lower 8 address bits and putting the higher 8 address bits on dedicated pins, the MCS42 CPU needs to tell the system, that any now freshly addressed chip may put its output onto the bus. And that is done by setting /RD low.This is very importantbecause any signal other than the CPU own data/address bits will not only contaminate the data but also the lower address bus. No chip is allowed to write anything unless /RD is low. If your unit shows /RD in the grey zone, any other chip may do whatever it wants.To simply verify the signal without grounding effects, you could put in the reset jumper at CPU pin 4 near C1605. That nails down the CPU in reset and steady signals on all pins.Then you can take measurements of /RD /PSEN ALE and also measure all the supply voltages with a battery drive hand held multimeter. If that /RD signal is still 1.35V in steady state conditions, something is wrong.Whoops... I haven't noticed one thing:Can you please measure R1815 that decouples CPU VCC from main VCC. And maybe you just replace C1808 in 33uF / 10V. The reason behind that step is, that these caps fail by going dry. But when dry they may proceed to get a short and even burn up internally. Such an event may drive a high current through that decoupling resistor and make it go high in resistance. I think it reads 2E05 which could be 2.05Ohm? (I am not sure about that, but may be the rings could still be read). To keep on testing, you can simply bridge that resistor and check /RD voltages again.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 20, 2025, 01:38:54 pm
content: Both instruments are earthed so that's probably the issue. Maybe that's why I've had some trouble with the logic analyser(Analog Discovery 3) as well. I realised I can actually use my laptop with just the battery and use the logic analyser, that would make it floating.I followed your advice and pulled the reset low through a 5k6 resistor and measured with a handheld multimeter and the voltages look fine on RD and other signals. CHSUM/SDH measured -3.5V as noted previously but it's likely not driven.I desoldered the C1808 33uF tantalum and it measured at about 34-35 uF with a very low ESR of 0.03 Ohm, I don't feel like I can trust that ESR measurement, if I remember correctly these tantalums should have a couple of ohm ESR.The R1815 resistor measured around 2.15 Ohm and should be 2.05 Ohm as you suspected according to the bands.I checked some other resistors and tantalums in the area and nothing stood out to me.I'll look more into when RD is pulsed low and if it makes sense.I've been also been looking at if there are any clues about where the firmware is getting stuck. I've been probing D1803 which is a dual 2-to-4 demux that is used to drive the CS of the three PIO on the main board and the PS1/2-signals for the display that I've mentioned before.Often when the instrument appears locked up I find that pin 10 of D1803 is low, meaning it is accessing D1703. This CS signal remains low. I haven't been able to draw any conclusions from that. From what I've been able to determine the K-numbered components are relays but from the schematic I can't really tell what their purpose is. Otherwise the only input to the PIO are the DH and CFI signals that are marked as "CANNOT BE MEASURED", I'm not sure if that means they should not be measured.I know this could just be a wild goose chase since there could be something going wrong much earlier but doesn't hurt to gather more information.

author: Shimonu
author_rank: Regular Contributor
timestamp: June 23, 2025, 04:22:13 pm
content: I felt like I was going in circles a bit with the memory addressing. So at the moment I'm working on reverse engineering a schematic for the ADC CONTROL board. It has 10 ICs so there is a bit of work to do there but hopefully it can give me a bit more insight into how the instrument works. I want to find out what the test points on the board are.

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 09:49:35 am
content: Hello op/all, I've aquired a broken PM2528 more than a year ago. It's my project since then;)I've learned a lot about this device, mostly about the analog part, and about analog stuff in general (I'm more a digital guy). I've also created a riser-card to make life easy.I've upload my 'working folder' of this instrument. Note that everything is work in progress, so not complete/100% correct. They also contain a few 'fixes', my instrument differs slightly from the service manual.The files included:- The original documentation (the ones everyone has and a hard-to-find scan of part of the service manual with schematics/PCB, unfortunately no calibration-instructions)- KiCad-files with schematics/PCBs of the PM2528, the RiserCard and some specific components (like the resistor-arrays)- Matrix of functions/relais- The EPROM-files from this threadThe files:https://deqit.com/Philips PM2528 DMM.zipI've got a scope/LA, so if you need some measurements I can provide them.Please also post your updates/findings, I'm more than happy with any feedback.Greetings,Dethmer.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 24, 2025, 11:40:11 am
content: Quote from: dkupers on July 24, 2025, 09:49:35 amWow, amazing work! What issue do you have with your instrument? I'm assuming it's behaving better than mine.That riser board looks nice. After pulling these cards a few times I'm definitely tempted to order a few.I'd really appreciate if you can measure how CHSUM/SDH behaves right around/after reset. Speaking of reset, It's something I'm sure is correct but I'd really like to see the rise time of your reset. Mine was measured by the oscilloscope to ~200 ms and it always feels odd to see the reset still rising when looking at some other signals.It should be easiest to measure CHSUM/SDH on the gates in the picture I provided.D1815 pin 9 - 74LS32D1808 pin 9 - 74LS04I'm also curious if you've been able to decode the named pins on 27 - 34. I've reverse engineered the ADC control board but I'm not sure about what the pins areAZ - Automatic Zero?SAZ? - Start Automatic Zero?SRUP? - Sample rate microcontroller?HSM?INTO - This I'm not sure if it's really INTO or INT with a zero.These are pretty straight forwardPOL - PolarityWDOG - WatchdogENI - Enable Interrupt

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 12:44:37 pm
content: Thanks! The main issue was shorted tantalums, bad connections (expansion boards) and a dozen broken reed-relays. Also, one of the previous owners liked turning potsMine is almost completely working. The only thing left, for now, is checking Resistance-measurent (and thus checking/calibrating N23), the Temperature measurement and the DIN-plug. Mine does not have the peak-detector (N27), HF-unit (N26) nor the GPIB/Galvanic options.The ADC is a dual-slope integrating ADC (see section 4.2 in the usermanual and Wikipedia). N21 is the actual ADC, N20 provides the control signals to N21: so when to start the slope, when to zero, etc.The overall view: All measurements (V, R, A, temp, DC/AC) are scaled down/up to a voltage between 0V and (a little more than) 2V. The ADC (N20/N21) converts that to a series of pulses. The CPU counts these pulses, does some magic and shows the result on the display.I'll attach some captures to this post. The naming of the files shows what is captured (eg: N20_AAC = N20, Current AC measurement). Note that they are made some time ago, before reparing/calibrating. Als note the inverse logic (0V/-5V).Most of the abreviations you mention are explained in one of the manuals and in the KiCad schematics of N20, there's a textbox there with the names of the signals.Regarding the 'named pins': I presume you're refering to the Signature Analyzer document? No, I've not looked further into that document as without the Testroms it's of no use and I got hold of the full schematics. Seefor a Signature Analyzer.I'll look into your request later today.Greetings,Dethmer.

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 12:46:09 pm
content: Image-limit of 10. Here's number 11.

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 01:38:42 pm
content: Here you go. -5V = GND.I also spotted the testpins mentioned in the Signature Analysis document (TP RUP etc). They are situated around the processor. See page 35, figure 7.2 in the service manual.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 24, 2025, 01:49:25 pm
content: Okay, very interesting. Then I'll assume the kind of floating state I find CHSUM in during start is correct. You seem to have the same at the beginning. My instrument just never starts up after that.Wow you've done an amazing job with the schematics! It's great to have the ADC boards, my gut feeling is that my issue is related to them or between.I can see the enable signal to the HEF40098 being triggered once so I'm assuming it's attempting to start the ADC but then either it isn't started or something goes wrong with the conversion. Having the information about CHSUM makes me feel more confident in that since that was the only signal otherwise that could mess with the adressing of the memory. And the reset looks the same as I suspected.It could be good to know which tantalums you found that were shorted, just to double check that I don't have the same issue if it happens to be a frequent problem. But maybe they would be obviously burned then? I haven't seen that.I'll be studying your conversion pictures and see if I can replicate that on the test points. This is fantastic!

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 02:29:54 pm
content: IIRC there were some on the DC-amplifier and one on the motherboard.The broken reed-relais were all over the place, but most of them on the motherboard. I tested them by putting 0V/5V on the coil and measuring conductivity on the reed-part itself. Power off, of course.Be carefull with the soldering iron when repairing, the white plastic (where the coil is wounded around) melts very quickly. I ended up replacing just the reed-part. Tongue at the right angle helpsI pulled N20/N21 from the instrument, without them the display shows +000.00 mV and is normally responsive.I'm glad the documentation is helping you!

author: Shimonu
author_rank: Regular Contributor
timestamp: July 24, 2025, 03:41:29 pm
content: Hmm, that sounds like it points away from my idea then.. But I could pull them and see if it changes anything. Otherwise it points back to the microprocessor and the related circuitry in my mind.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 24, 2025, 07:35:33 pm
content: Hmm, you commented that a lot of the reed relays were bad. I'd like to understand what these are used for, do you know? It's not clear to me from the schematic.What I think I'm seeing is that the MCU is reading one of the IO expanders, D1703, and expecting to read something and it won't continue unless it gets an expected value. Now there are a few things connected like the peak detector, rms converter and a number of relays. I don't have the peak detector in mine and there's only an output going to the rms converter so that leaves either the signals DH and CFI or the relays.Going by your comment that many relays were broken for you I would like to think that is a risk for me too. But I'd like to understand what the MCU could be doing here, what are the relays for and what could it be waiting for?I'll start testing them though to see if that could explain it.

author: dkupers
author_rank: Contributor
timestamp: July 24, 2025, 08:32:16 pm
content: The relays are being used for routing the measurement-signal and for selecting the scaling-resistors/paths, both on the motherboard and on the cards. Check for example the overall-schematic in the service manual on page 41 (figure 7.4). The lower left part of the picture is infested with relaysThe current-source card (N23) has relays for selecting specific resistors for testcurrents (for measuring resistance in different ranges). See page 69, figure 7.22.You did find the servicemanual in the ZIP?As far as I've experienced the code does not check for results of its actions: it justs sets some relais or other stuff and hopes for the best.There's no user-feedback in the device (like errorcodes on the display), so there's no reason for checking functional or technical error-conditions. I think that (and the limited size of the EPROMs) is why the Testroms are created seperately, and even they don't have any userfeedback (apart from a bit-pattern via the testpins).The code apparently does some detection for the presence of the Peak and Vhf cards, as without these cards it's not possible to select the two buttons on the frontpanel. I don't have these cards and have not yet investigated how this is detected.Tomorrow I'll remove all the cards from the device, and see what it will do.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 24, 2025, 10:11:42 pm
content: I'm not sure what else to think of it. The firmware is correct and I haven't found anything to indicate it can't access the memory correctly so the firmware should execute correctly. I can't think of why it would be stuck with CS low for that chip and PROG cycling continuously unless it was trying to wait for something.If you don't mind I would be curious to see what your instrument shows on CS, PROG and the port 2 data pins during startup. From my measurements this is around the 80-90 ms period after reset and just before CHSUM becomes active. Perhaps this is just before it starts with the first readings which makes sense if it's settings relays.Gosh, your stuff is just full of gold. I assumed you had the same schematics I have been working with but you seem to have a more complete version!You don't happen to have the firmware disassembled with comments?I've started looking at a few relays and I think I've found one bad so far. I'll have a closer look tomorrow and see which ones could be relevant for this IO expander.

author: dkupers
author_rank: Contributor
timestamp: July 25, 2025, 12:51:52 pm
content: True, mine are also assumptions. I've not actually looked into the digital part of the device till now, nor the sourcecode.Attached a LA-capture with results from the first second after /RESET. You can open it with DSView (https://www.dreamsourcelab.com/download/) without needing the actual LA.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 25, 2025, 01:10:58 pm
content: Thanks for the file! Hopefully this will tell me something. It's also great to compare with my startup since that will also show if my firmware is behaving the same i.e correctly until it stops.

author: dkupers
author_rank: Contributor
timestamp: July 25, 2025, 05:48:54 pm
content: No problem. It also gives me more insights. Have fun analyzing!Please keep us updated!

author: dkupers
author_rank: Contributor
timestamp: July 28, 2025, 07:01:03 pm
content: If anyone needs a risercard for the PM2528: I've got 2 prints left, without components. You can have 'm for p&p.

author: Shimonu
author_rank: Regular Contributor
timestamp: July 31, 2025, 08:17:01 pm
content: I feel like venting after some troubleshooting. I've been trying to convince myself some more that the MCU is getting the right stuff from the memory. In the future I plan to single step the program if I don't find anything else.For maybe the third or fourth time I took out the EEPROMs just to check that they still have the correct content and they do.I've measured the datalines on the MCU and the memory to see if there is any mismatch. I also checked what was getting clocked through the address latches. This was to see if there was any bad connection, broken parts or interference but I couldn't see anything.Still took the MCU and the memory out and used some contact cleaner, no differenceI still replaced the latches just for peace of mind which of course made no differenceI'm feeling pretty confident the memory access is working as it should. I've gone through the logic part before and all those chips have also been replaced with new ones so I'm not very concerned there either.Since the buttons will sometimes light up but won't respond I've been looking at the interrupt controller which receives an interrupt when you press any button. It does receive the button presses but the D flip flop that signals the MCU is either being set or reset, it's one of the two and it changes between boots. This won't explain the whole issue but it feels to me like it points to the MCU because the reset signal comes from the ENI off the MCU and the set signal is part of the watchdog function which means the MCU hasn't reset the watchdog indicating it's gotten stuck. Unfortunately this just triggers an interrupt where today it would most likely trigger a reset or even a power cycle.I'm doubtful the MCU is broken because I have already replaced it but if it has somehow broken I still ordered a new one to replace it with and I'll be extra ESD safe when unpacking that one.Now assuming the MCU is fine I'm only left with the thought that the MCU is getting put into some unexpected state somehow by some input that isn't behaving as the programmers assumed. I don't have the slightest idea what that could be but this is where I'll have to dig a bit more into dkupers startup recording and compare. I need to learn a bit more about the analog discovery 3 and the associated software to see if I can make a similar recording to make it easy to compare.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 01, 2025, 04:08:00 pm
content: I might ask you to do another measurement @dkupers if you don't mind. The same as before except change Port 2 to Port 1. I'd like to follow the output from your memory. I have the code disassembled so I want to see if I can follow your output in the disassembled code. I'm having trouble with my output.The first activation of PROG matches between your measurement and mine and we write the same data. A few cycles later you have another activation which is missing in my measurement and from there it doesn't look like anything really acts the same.

author: dkupers
author_rank: Contributor
timestamp: August 01, 2025, 04:32:06 pm
content: Sure. That will have to wait till Monday, busy weekend.Good news the first part seems to work. That confirms at least a working processor, memory and the expanders.Edit: i meant the decoding for the io-expander-selection and the display/keyboard , not the io-expanders themselves.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 01, 2025, 05:03:42 pm
content: Thanks, I really appreciate it!

author: Shimonu
author_rank: Regular Contributor
timestamp: August 03, 2025, 08:46:37 pm
content: I just realized it might be good to have the CS signals for the memory. If you could swap out CHSUM and VCC for the CS signals of the memory actually I think it would make things a lot easier.Thanks again!

author: dkupers
author_rank: Contributor
timestamp: August 04, 2025, 12:07:58 pm
content: Simon,here you go (500msecs).Greetings,Dethmer.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 12:42:39 pm
content: Crap, I might have said the wrong port. I meant the data output from the memory, I thought that was port 1.It might still be helpful to see the CS signals so if you don't have time to do another recording I could still get use of this.Thanks!

author: dkupers
author_rank: Contributor
timestamp: August 04, 2025, 01:53:54 pm
content: Here it is.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 03:45:56 pm
content: Wow, that's instantly interesting. I haven't gotten far but already the second instruction that executes is different. You have E4 6B but I have 24 6B. These are both jump instructions but yours results in a jump to 0x76B while I jump to 0x16B.I wanted to get this out because it raises the question on if there could be different firmware versions and secondly you probably shouldn't rely on the firmware that has been posted here as it definitely isn't the same as you have and your instrument is clearly working. It could be good to perform a backup of yours if you haven't.The interesting thing though is that 25145 didn't show any difference when I compared it to what I got from PA0PBZ. So it feels like there are either different versions or your have started to get some bit rot that hasn't had any significant effect yet.I won't draw any conclusions yet about what's wrong and right. I'll have to keep investigating..

author: dkupers
author_rank: Contributor
timestamp: August 04, 2025, 04:33:48 pm
content: You've made me mighty curious for the digital part, so I've also started analyzing the firmwareThe 8035 starts execution on address 0000 of memorybank 0, after the reset is 'stable' for a certain period. For the PM2528, that's around 100ms.Address 0000 is located in in MB0, that is D1813 (25145):CODE:0000 F5 SEL MB1CODE:0001 24 6B JMP 096bThe jump goes to 0x096B. That's >2K (size of the EPROMs), so located in D1810 (25156):CODE:096b 99 D3 ANL P1,#11010011bCODE:096d B8 20 MOV R0,#0x20This is consistent with the LA-output (see attachment).- The first green rectangle shows fetching the very first instructions (F5, 24, 6B). Fetched from D1813, see the /CS D1813 trace.- The second green rectangle fetching the instructions after the jump from address 0x001 has been executed. Fetched from D1810, see the /CS D1810 trace.The 'extra' databytes between '99 D3' and 'B8 B20' are no memoryfetches, but something from other ICs on the databus.edited: make it more readable.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 05:39:40 pm
content: Hmm, This might be me trusting DSView a bit too much, or rather using it incorrectly. I may have jumped the gun.. I'll include a picture from the capture you gave me. There you can see that DB6 and DB7 are high for a short moment causing the output from address 0x01 to read as 0xE4.Yeah that's probably nothing.I've marked the start with the green marker

author: dkupers
author_rank: Contributor
timestamp: August 04, 2025, 06:30:21 pm
content: I've downloaded the file, added the protocol-decoders and got the (from my pov) correct results:- Decoder 1 (low memory, so for the F5 24 6B): Clock=/CS D1813, rising edge, D0..D7 = DB0..DB7, little endian- Decoder 2 (high memory, so for the 99 D3 B8 20): Clock=/CS D1810, rising edge, D0..D7 = DB0..DB7, little endianIn this file, I didn't get the 'bytes between' as in the previous screenshot.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 06:37:30 pm
content: Yeah, I configured the decoding wrong. I just used the other flank of ALE which at first glance looked correct so I didn't question it. Thanks for the correction!I saw DSView also has an option do decode MCS-48. So I'm wondering if it will actually tell you the instructions directly. But you also need PSEN and the higher address bits.

author: dkupers
author_rank: Contributor
timestamp: August 04, 2025, 06:53:12 pm
content: No problem! If all problems were that easy to solveThe tool you choose depends on what you want to archieve. For understanding the code, a disassembler/reverse engineer tool is probably a better choice, mainly because you can add comments, use labels, etc.For debugging the system (and not the code itself) a LA is a good choice.And for debugging the code itself: a combination of the two, as the PM2528 does not have JTAG;)As the 8035 has a 8 bit databus and a 12 bit shared addressbus, 16 signals should probably be just enough. (quickly checking) Indeed, the decoder needs 15 signals.The 8035 has a single-step-mode, so alltogether, if you really want, it should be possible. But the output only shows the order of commands executed, it would be difficult to identity subroutines, loops, etc.

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 04, 2025, 07:05:38 pm
content: Just to let you know that I'm still hereI just had nothing to comment on but if I can be of any help let me know!

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 07:42:49 pm
content: I'm not going to give any details now until I've verified it for sure, but I think I found one issue. But I can't quite explain it yet..

author: Shimonu
author_rank: Regular Contributor
timestamp: August 04, 2025, 08:05:07 pm
content: Okay, so with the background that I performed a fix and the instrument is now behaving a little bit better I think I can have some confidence and say there are issues with the firmware I have on my memory.I mentioned before that I noticed there was a difference in the number of activations of PROG. With the correct decoder configuration I found that the execution still differed. On address 0x185 in 25156 the capture from dkupers shows 0x3E while I was getting 0x36. The confusing thing is that 0x36 matches the firmware that was shared but that obviously works for PA0PBZ, unless there was some corruption somewhere along the way but I doubt that. So I still think it would be prudent for dkupers to backup your firmware if you're able. I would of course also appreciate if you're able to share the firmware to compare.I changed the value in the hex-editor and replaced the memory. I'm still not getting any values shown but the keypad is now responsive which it would only rarely be before and for a moment until the instrument froze. The little testing I've done the display will at most show a decimal or the display will fill with dashes. But the bulbs will change when I enter different modes, the buttons light up correctly etc.This is the first real improvement I've seen on the instrument. It's difficult to describe how excited this makes me. Finally after months of troubleshooting I'm seeing progress and I feel more confident about the hardware.I'll have to do new captures to see what the state is now but at the moment that's a nice thing.Thanks a bunch to both of you!

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 05, 2025, 07:56:00 am
content: Do you still have the original content of your firmware? You showed the first part of the compare with my firmware but unfortunately it stops at 0x17E, what are the odds.. Just wondering what your original 0x185 is?(Edit:) Shouldn't address 0x185 be in the first EPROM? I only see the value you mentioned in the 2nd one (25156).

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 08:35:32 am
content: I don't know if it was clear from my previous post but the instrument is now runningYou might laugh at the solution..Yes I still have my original firmware, the way I got it running was to put the original back and I'm glad I saved it.After doing another capture I found a second value which didn't match and that made me suspicious. Comparing to my original I saw that it had the correct content and just decided to load it to see what it would do and suddenly I got a working instrument.To summarize what I think must have happened is that maybe the firmware from PA0PBZ was read incorrectly, I'm not sure, but since they have a working instrument and the firmware didn't match my firmware I assumed theirs was correct and loaded it. Later I realized the MCU was broken, which was likely the original issue, but then I had the bad firmware so I still had a non-working instrument.But I did a quick test last night and the instrument mostly seems to be working with some minor issues. It needs adjustment, current measurement doesn't work and a segment on the first digit doesn't seem to work. So there's some work left but I'm really happy to have it working!

author: dkupers
author_rank: Contributor
timestamp: August 05, 2025, 08:36:40 am
content: Nice work, congrats!Attached you'll find my EPROMS.The contents of my 25145 are the same as the 25145 from PA0PBZ. The contents of 25156 are the same as your original, but differ from the 25156 from PA0PBZ.In the image below you'll see a part of the disassembly of the routine which is called after a Reset. This routine is called by the JMP on address 0x0001. Note the addressing: the code of 25156 is (from the 8035 point of view) mapped from address 0x0800 upwards, so address 0x0185 in 25156 is 0x0985 in the disassembly.The disassembler has some problems disassembling the code on the left side from 0x0992 upwards. The MCS48 documention also doesn't mention these opcodes. There is a possible code-path to 0x0992, so it seems the processor will crash right after a reset? @PA0PBZ, probably a bad dump?@Shimonu, can you compare your 25156 to mine and to your original? And try to use mine in your machine?

author: dkupers
author_rank: Contributor
timestamp: August 05, 2025, 08:42:23 am
content: gmta

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 08:53:12 am
content: I'll check tonight!

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 05, 2025, 09:07:36 am
content: Congrats! Very strange that my dump from one of the EPROMs was incorrect, I did both in the same session and did a verify too.If I can bring myself to it I'll take down the stack of instruments again and reread the EPROMs.Anyway, glad that it's (almost) solved, enjoy your meter!

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 09:29:39 am
content: Yeah, it makes me curious if there could be another explanation. I was thinking about variants of firmware but I doubt it. It seems very unlikely that your EPROM reader would have an issue that reads 25145 perfectly but gives an issue for 25156.It would be interesting to see if you get the same result if you do another read.Very odd indeed.

author: dkupers
author_rank: Contributor
timestamp: August 05, 2025, 01:13:51 pm
content: PA0PBZ:We got these facts:- 25145 reads fine (technically)- 25145 results in a proper imagefile, the same as mine and (probably) Shimonu's.- 25156 reads fine (technically), validating gives the same results.- 25156 resulted in an imagefile with bad opcodes (not being data-blocks)- 25156 works fine in your PM2528First things which comes to my mind is that the EPROM may be out of 'official' spec. Not for the PM2528, but it does maybe for the settings of your EPROM-reader. Maybe voltage, maybe timing?I'm using 28C16's in my PM2528. They are pin-compatible, don't need a UV-eraser for programming and have a lower access-time (150ns) than the 2716's (450ns), so a worthy replacement.The PM2528 seems to take around 1us for reading the memory, by the way.Maybe try reading the 25156 with a longer access-time or somewhat higher voltage?Time to switch the EPROM(s)?

author: PA0PBZ
author_rank: Super Contributor
timestamp: August 05, 2025, 01:45:39 pm
content: Yes, it must be the way I read the EPROM. The programmer is the well-known TL866 but I did spot something suspicious. If you look at the picture I posted in reply #9 you can see that there is one AMD and one INTEL EPROM. I can't remember what setting I used but I bet that's what went wrong! Not really wanting to compare the datasheets at the moment, and not enough time to do the reading again. If we don't agree about the different EPROMs I can still do that later. Odd that there are 2 different ones in the instrument, it doesn't look like it was ever opened before

author: dkupers
author_rank: Contributor
timestamp: August 05, 2025, 02:34:45 pm
content: Indeed, not worth tearing down the stack for now;)Both original ICs from my PM2528 are AM2716DC from 1979, with the text 'Malaysia' at the underside.

author: m k
author_rank: Super Contributor
timestamp: August 05, 2025, 03:16:12 pm
content: Reading weak data can be misleading.One reader is fine, like a machine itself, and other, like a dedicated reader, just can't do it.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 04:48:19 pm
content: dkupers, compared your files with my originals and they're identical. Would you still like me to try to use your files? Since there's no difference in content I can't see what difference it would make but if it gives you peace of mind it doesn't take very long.Interesting thought about weak content. Could certainly explain it and it's probably good then that we now have the firmware aspect cleared up. Should PA0PBZ have trouble with his instrument the firmware is now available in the thread.I was thinking to put the package that dkupers shared together with the correct firmware in the thread start for anyone finding this in the future. The resources in there are fantastic for anyone troubleshooting.

author: dkupers
author_rank: Contributor
timestamp: August 05, 2025, 06:32:41 pm
content: Good to see the two firmware's are the same. As you are already working with the 'old' firmware, there's no need to test my version. All our posts this morning crossed eachother, that's why I askedI'm already in the process of thinking how/where to put all resources online, while still being able to easily update parts of it (Github and/or Hackaday.io). Short-term GitHub, long-term Hackaday maybe. But I'm open for any suggestions.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 06:43:30 pm
content: I'm not familiar with hackaday, I've heard of it but don't know what it's like for file sharing. Github would probably work.I've investigated the segment on the first digit that isn't working and looks like the digit is just broken. I've ordered some new digits, important to note that even though they look like they have 2 decimal points there's just one of them connected. So you buy them as left or right versions. I was also pleasantly surprised to see that they're socketed, don't know how I didn't see that before.I moved on to checking why the current measurement isn't working and it didn't take long to find the likely culprit. See the attached picture of the fuse holder.Once those issues are resolved I should be able to start putting it back together again and perform some calibration. I thought I had found a bad relay before but from my test measurements so far I haven't seen any issue. Maybe I'll notice it with the current measurement. So worst case I might have to fix some relay(s).Hope I remember how everything goes back together, it's been a while and I remember it was a bit tricky to take apart

author: Shimonu
author_rank: Regular Contributor
timestamp: August 05, 2025, 09:29:24 pm
content: Had time to fix the connections to the fuse holder and try out the current measurement. Sure enough it's not working perfectly, the autoranging is not ranging correctly but adjusting the range manually seems to give a value close to the expected.I have seen autoranging work for voltage and resistance so I'm assuming it's specific to current measurement. It's going to take some time until my new digit arrives so I'll have some time to figure this out.

author: dkupers
author_rank: Contributor
timestamp: August 06, 2025, 06:07:37 am
content: Good work and a great relief, I can understand.The instrument works bij converting every measurement-type (voltage, resistance, current) into a voltage. That voltage will be converted by the ADC. The processor then decides when/how to autorange. It's done by the DC-amplifier (times 10 for small voltages) and/or by adding resistors into the signalpath by using relays. See the relay-matrix in the Excel-sheet provided in 'the package', that could be a good start. Although, manually ranging also switches the relays. Hmm...Have fun!

author: Shimonu
author_rank: Regular Contributor
timestamp: August 06, 2025, 08:09:06 am
content: I need to do more testing, I just used the DMMCheckPlus and that only gives a 1mA current and I'm not sure what compliance voltage it uses. I put another meter in series and when it's in the wrong range it actually changes the current. A lower range would mean a higher resistance in series so maybe it just becomes too high for the DMMCheckPlus.It uses 500 mV which should be fine for loads up to 500 Ohm and the PM2528 uses 10 Ohms max. The search continues

author: Shimonu
author_rank: Regular Contributor
timestamp: August 06, 2025, 04:54:17 pm
content: I made some tests and it looks like there's a large resistance introduced in the current path which does load down the DMMCheckPlus. I can measure it to around 2.5-3k ohms by putting it in DC current mode and measuring the resistance across the A and 0 jacks. For the mA ranges I see 10 ohms or less but for the uA I see kOhms.I'm having a first glance at the info sheet with the relays. If I'm understanding this correctly, for the 2000 uA DC range for example it will use relays 1605 and 1606. I'm not able to follow which shunts are used but maybe there's some more complex mechanism being used. For the higher ranges it seems very easy conceptually just going across varius parts of R1604 and the shunt voltage goes to the DC Amplifier. Although they(K1601, K1602, K1603) don't appear to be marked in the matrix for the DC Current columns, is it incomplete?EDIT: From playing around I don't think there's any issue at all with the autoranging or measurements, I just think there's increased resistance for some or maybe all ranges. I can put some voltage over a resistor and change the current, the measurement will follow pretty well and change ranges. The values are just very off and bad connections seem likely, I'm thinking maybe some potentiometers or the relays, dkupers, you said you had some relays that were bad. At a second glance it looks like there are no potentiometers in the current path, maybe in the DC Amplifier at 1x

author: Shimonu
author_rank: Regular Contributor
timestamp: August 07, 2025, 06:10:23 pm
content: I've been looking around for calibration instructions and other than the owners manual saying "yeah you should" I haven't found anything. I have the plate showing what the different adjustments are but it would be great with some instructions.

author: dkupers
author_rank: Contributor
timestamp: August 08, 2025, 08:54:11 am
content: Quote from: Shimonu on August 06, 2025, 04:54:17 pmThe sheet with the relays-matrix has been created 'along the way', it's possible that (after some repairs or gained insights) there is something incorrect. Also, the 'blank' cells means untested.As with all the documentation I sent you, it's work in progress and not neccessary correct/complete.Indeed, there are no adjustments for the current-path, I guess Philips trusts the resistors. Note that the DC-amp is used for all measurement-types.

author: dkupers
author_rank: Contributor
timestamp: August 08, 2025, 09:09:53 am
content: Quote from: Shimonu on August 07, 2025, 06:10:23 pmJoin the queue;) Afaik there are no calibration-instructions available. Guess they would be part of the servicemanual, as the manual starts at chapter 6.I would suggest the following order of calibrating:- ADCI did this with the riser-card, by injecting my own signals (pin 9 and 10 of N21) and making educated guesses how it should work. Part of my learning-process and the fun of reverse-engineering.You can probably use the instruments ADC testmode by enabling the 'TEST ADC' (DIP-switch next to the uP (S1801)) and injecting the signal into the Test ADC testpoint (next to relay K1609). I haven't tried this, let me know if this works.Be carefull with the GNDs (supply GND / measuring GND / Earth).- DC Amp- AC Amp- RMS ConverterGood luck!

author: dkupers
author_rank: Contributor
timestamp: August 08, 2025, 09:40:44 am
content: I've created a GitHub Repo with all resources I have. Seehttps://github.com/deqit/PhilipsPM2528@Shimonu: can you add this link to your first post?

author: Shimonu
author_rank: Regular Contributor
timestamp: August 08, 2025, 09:46:24 am
content: Done, first post is updated with the link.I might get some use out of the riser cards then. I'm not sure when I'll start going through the calibration, hopefully soon.I want to prepare for fixing any relays that are bad, could you link the reed switches you used, dkupers? I'm not quite sure what specs I should be looking for.

author: dkupers
author_rank: Contributor
timestamp: August 08, 2025, 10:40:51 am
content: Quote from: Shimonu on August 08, 2025, 09:46:24 amThanks!I couldn't find the complete reed assembly (the combination of coil, housing and reed switch), so I just replaced the reed switch itself (the glass body and the leads).When trying to unsolder the complete assembly, I noticed the body of the assembly (eg, the white part) melts very quickly. So I ended up replacing just the reed switch: snipping off the old reed-switch, carefully removing it from the assembly, replacing the new reed switch and soldering it in.When selecting a new reed-switch, take care of the diameter and the length of the glass body. For the small relays (see above), the powerrating is not that important.I used these with success:https://www.conrad.nl/nl/p/hamlin-flex-14-reedcontact-1x-no-200-v-dc-0-5-a-10-w-lengte-glazen-buis-14-mm-503638.html

author: Shimonu
author_rank: Regular Contributor
timestamp: August 08, 2025, 10:59:51 am
content: Quote from: dkupers on August 08, 2025, 10:40:51 amHaha, As a Swedish person I was a bit offended when visiting the Dutch Conrad website. The word klant in Swedish means a clumsy person so reading this as a choice was hilarious: "Ik ben een particuliere klant"It sounds to me like "I'm especially clumsy"I think I'll go for leaded solder to reduce the amount of heat needed.

author: dkupers
author_rank: Contributor
timestamp: August 09, 2025, 08:05:05 am
content: Quote from: Shimonu on August 08, 2025, 10:59:51 amSorry, didn't mean to offend anyoneIt's a bodge-job, not neat, but it works. I was thinking of creating a total replacement-print with the footprint of the current assembly if there were more than 10 broken relays, currently I've replaced 6.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 09, 2025, 01:49:33 pm
content: Which filament would you use for that. Aren't a lot of filament close to the same melting point as the solder?

author: dkupers
author_rank: Contributor
timestamp: August 10, 2025, 11:07:47 am
content: Quote from: Shimonu on August 09, 2025, 01:49:33 pmNo, not 3D printed, I meant a PCB with a reed-relay on it (likehttps://www.conrad.nl/nl/p/tru-components-sip1a12-reedrelais-1x-no-12-v-dc-0-5-a-10-w-sip-4-2273680.html) with the same footprint as the Philips-reed-assemblies.

author: Shimonu
author_rank: Regular Contributor
timestamp: August 10, 2025, 03:16:09 pm
content: That makes a lot more sense! That's worth considering, I think it's nice to put in a new component when it's a high risk that you start damaging the existing components.