General reverse engineering thread

Discussion in 'General Off-Topic Chat' started by FAST6191, Jan 15, 2016.

  1. FAST6191
    OP

    FAST6191 Techromancer

    pip Reporter
    23,522
    9,360
    Nov 21, 2005
    We seem to do a lot of pulling apart code around here and though some of my best friends are programs it is occasionally nice to stick with what you were born into. This thread will then be for those wishing to document a bit of pulling things apart.

    Anyway I am generally a collector of cool stuff that I want to know the inner workings of. In this case I was at a car boot sale and a guy had a radar screen for sale, as it was basically a heavy lump of scrap the fact I showed an interest got him to pay less attention to the nice old function generator and insulation tester that I actually really wanted and he let them all go cheap.
    I was then the proud owner of Koden MD303 radar screen. There is an old joke of an exchange between a ship after a radar spotting that ends with "This is a lighthouse. Your call.". I would be the lighthouse as I do horribly on water craft and my workbench tends not to move (give or take larger scales) or have things heavier than my bag risk crashing into it. My knowledge of radar systems leaves a tiny bit to be desired and my knowledge of marine electronics amounts to "well I guess they would want to use 12/24V DC batteries rather than run a generator all the time" plus whatever carries over from the automotive and general electronics world. I have hardened a few things but that usually involved stopping things (salt water mainly) from getting into sensitive gear rather than analysing the electronics.

    Folder and gallery of all images taken for this, much more on there than will be embedded or linked here
    http://filetrip.net/folder?F9K5AsnbA4
    http://filetrip.net/gallery?F9K5AsnbA4

    I did a search for the model and though Koden are still in business their basic site did not list anything about it. I found a mention of it on http://fa-consulting.dk/rell/Koden.html which mentioned it uses a MSF1422B magnetron. It also listed a bunch of similar model names but not a lot came back there. I have no idea what Voltage it would have taken in and the label from the point the power presently seems to be coming in is long since gone (it could be 12, could be 24, could be 120, could be 220-240 and what I am seeing could have been some kind of retrofit) and indeed AC frequency if it is AC... Long experience has said that putting 240V-50Hz (about the most potent* domestic power you will get outside three phase systems) on random devices is not a good plan so no powering just yet. For an added bonus then note that the solastic goop used to stick various things down has been known to age into conductivity for some formulations. Some testing and scraping may then be required.

    *surprising to some is 60Hz is actually less troubling for transformers to handle as the duty cycle is lower ( http://sound.westhost.com/xfmr2.htm#intro ).

    Or in other words an awesome spot to be in if you are me.

    Pulled the case off, saw a genuine bug on the board (a rather toasted and dessicated wasp), got rid of it and here you join me in picture form.
    [​IMG]
    front panel
    front with some top
    and having lifted the skirt
    the CRT assembly, HV supply and mains input
    the logic board
    power board
    underside with the trace motor

    For the jumped up sperms in the audience that huge lump of glass is a cathode ray tube, in this case pretty custom one but more on that later. The two brown "wires" attached to the side are actually mechanical linkages to those small black puck type things you can see, presumably they are magnets which change the beam adjustment.

    We have some very crusty control electronics, and that was after a quick go over with a brush.
    picture

    And a power board. The power board mentions 12V and comes directly off the power pack that has the external wire on it. If that is supposed to be the main reference voltage and power supply for everything else then I could chop the wires, feed in a voltage of my choosing and see what comes out.
    picture

    All the boards are very nicely covered in all sorts of good writing. Very few things that might be date codes on the chips but 82-83 is a reasonable bet. Not sure what one would have cost back when it was new so I went looking. https://books.google.co.uk/books?id...=marine electronics catalogue vintage&f=false is a 1982 vintage motor boat industry book/sales catalogue thing. I do not know if there were any relaxations of laws concerning such toys or breakthroughs at or around this time either. Anyway page 143 has a Raytheon 2600 24 mile range radar for $2850 list ($7000 in today's money), 2275 actual. Such a drop tends to mean old gear being sold off or as this is relatively specialist then huge markups otherwise seen in things like jewellery and diamonds that people can discount to make people think they are getting a good deal. That does also include the radar/magnetron parts too by the looks of things. All that said price is no guarantee of quality. Indeed most of the capacitors are only 85 degrees C rated and most of the chips are not the high temperature range varieties I am seeing also available in the datasheets (assuming they existed at that point in time of course). These days the automotive (which the marine sort of piggybacks off at times, and if not that the high reliability or even all but military in name) commands whole sections of the electronics industry.

    There is an unpopulated connector, beyond the option and test points, on the main board called P302 (ANT) so presumably airial aeirial aeri.. antenna presumably this goes to the radar transmitter, receiver and motor. Good practice would have it be powered by the device but external/separate power might be a thing. How this plays out I have no idea -- http://www.radartutorial.eu/08.transmitters/Magnetron.en.html and http://www.radartutorial.eu/08.transmitters/Radar Transmitter.en.html would have average magnetron power somewhere around 500W with considerably higher peak. None of those wires I would want to stuff that kind of power through.
    Speaking of test points there are several eyelet type ones at choice places on the board and a test point connector. For all the cynicism above a lot of this sort of gear is built to be repaired.

    A 16Mhz crystal is on there. It does not sound like much now (the GBA had one the same speed) but in the early 1980's that was something appreciable -- the Commodore 64 also from 1982 was about 1MHz. On the other hand this is just a bunch of fairly simple 5V logic by the looks of things rather than a general purpose processor so that is not that valid a thing to compare against.
    The silkscreening is also quite a help in the case of the chip markings being worn. In this case the 62004 next to the motor cable means it could be a TD62004 http://www.digchip.com/datasheets/parts/datasheet/487/TD62004-pdf.php
    Other general notes from inspecting the main board
    C38 below the main test point looks a bit toasty, whether it still works will have to be determined later but speak to the right person and you will be told that 80's disc capacitors were worse than the capxon ones that caused the 1999-2007 capacitor plague we are still seeing the fallout from.
    The blue wires next to the fuse (with microsw) go to the switch in the CRT motor assembly.

    Anyway time for chips
    picture

    IC1 LS04 SN74LS04N
    R125. Actually a resistor package. Heading away from the controls it appears to have all legs in the same trace as the IC1's and IC2's (both SN74LS04N) VCC pin so possibly some kind of pull up resistor.
    IC2 LS04 SN74LS04N
    IC3 TL710CP
    IC4 next to lamp. NEC C1555C
    IC5 LS54 SN74LS54N
    IC6 LS51 SN74LS51N
    IC7 LS54 SN74LS54N
    IC8 SN74LS221N
    IC9 00 SN7400N
    IC10 LS163 HD74LS163P
    IC11 LS54
    IC12 LS163 HD74LS163P
    IC13 LS132 Gunk (possibly the 00 sticker on P302?). If the other naming patterns are anything to go by then SN74LS132?? or HD74LS132??. After scraping it off and under the right light LS132N is visible.
    IC14 LS290 SN74LS290N
    IC15 LS107 M74LS107AP
    IC16 AM27LS00 AM27LS00PC
    IC17 AM27LS00 AM27LS00PC
    IC18 LS290 SN74LS290N
    IC19 LS00 SN74LS00N
    IC20 LS163 SN74LS161AN
    IC21 LS163 SN74LS161AN (different markings/batch to IC20)
    IC22 LS33 SN73LS33N
    IC23 LS163 SN74LS161AN (same markings as IC20)
    IC24 LS163 SN74LS161AN (same markings as IC20)
    IC25 LS00 SN74LS00N
    IC26 LS221 SN74LS221N
    IC27 LS107 M74LS107AP
    IC28 LS74 SN74LS74AN
    IC29 LS107 M74LS107AP
    IC30 LS74 SN74LS74AN
    IC31 LS02 HD74LS02P
    IC32 LS04 SN74LS04N
    IC33 LS107 M74LS107AP
    IC34 LS51 SN74LS51N
    IC35 LS14 SN74LS14N
    IC36 4013 Blank Nothing on http://www.alldatasheet.com/ . Its pin5 goes to pin5 of IC37 which is just another diode entry. What looks like NEC is visible. Alternatively if it is TI then it is a kind of flip flop.
    IC37 62004 TD62004? 62004P is visible on the chip.
    IC38 where?
    IC39 LS09 HD74LS08P Next to IC29. http://www.renesas.com/products/standard_ic/logic/hd74ls/device/HD74LS08P.jsp 4, 2 input NAND gates.

    List of unique chip types
    SN74LS04N
    AM27LS00PC
    HD74LS02P
    HD74LS08P
    HD74LS163P
    M74LS107AP
    SN73LS33N
    SN7400N
    SN74LS00N
    SN74LS04N
    SN74LS04N
    SN74LS14N
    SN74LS161AN
    SN74LS221N
    SN74LS290N
    SN74LS51N
    SN74LS54N
    SN74LS74AN
    TD62004?
    NEC C1555C

    NEC C1555C
    http://www.datasheet.hk/view_online.php?id=1108315&file=0055\upc1555_413553.pdf
    The lamp next to it was tested. It has a sensible resistance so 5V and then 12V was sent down it. In cars the little ring light around headlights is known as angel eyes, the lesser knockoff ones then got christened devil horns and this was so dim around the outside to illuminate the rotary indicator that this would probably count as the nubs of a new born deer. That said it performed the task it needed to do and illuminated the relevant numbers and would probably not lose your night vision.


    Searching for the gunk covered chip with what was presumed to be SN74LS132?? or HD74LS132?? brings back a "Quad2-Input Schmitt Trigger NAND Gate" for ON Semiconductor (Motorola way back) and Renesas (these days part of NEC). N is the suffix for through hole/DIL parts in this and in general so N it is.

    http://www.ti.com/lit/ds/symlink/sn74ls00.pdf for the SN74LS00N
    http://documentation.renesas.com/doc/products/logic/rej03d0389_hd74ls02.pdf says the hd74ls02 chips are Quadruple 2-Input Positive NOR Gates.

    http://www.digchip.com/datasheets/parts/datasheet/487/TD62004-pdf.php

    http://www.digchip.com/datasheets/parts/datasheet/739/M74LS107AP-pdf.php M74LS107AP, some "dual J-K Negative edge triggered flip flops with reset"
    http://pdf1.alldatasheet.com/datasheet-pdf/view/27423/TI/SN74LS51N.html are some "AND-OR-INVERT gates", or if you prefer they have two sets of AND inputs (in this case there are two such assemblies, one with two sets of 3 and another with two sets of 2) which then gets NORed together.
    http://www.ti.com/lit/ds/symlink/sn74ls04.pdf for SN74LS04N

    Most of these have a suggested voltage of 5V and 5V logic was pretty common at this point in life.

    Today logic gates are typically used in a more elementary fashion, at least as far as most people consider them, but back when it was a viable means of computing for various things. Here is a basic addition machine using logic gates http://www.electronics-tutorials.ws/combination/comb_7.html and once you know that and realise computing is just adding all the way down (subtraction is adding, multiplication shorthand for adding, logarithms are just ways to make things easier for adding) then you can start to see how you can do computing tasks.

    With basically everything there and known then you could figure out the function of the circuit. Such a thing would be quite tedious for just a fun exercise though so it will only be done if necessary. Most likely if the unit tries to detect the presence of the sensor part and shut down either wholly in parts I care about if it does not detect it.

    Fuses, the silkscreen writing next to them
    Motor
    TX
    Presumably the motor spinning the radar transmitter/receiver and the transmission fuse.

    P304 says H.V next to it and does indeed go to the high voltage pack and onto the CRT from there.

    The two red, yellow, orange, black wire sporting connector goes down into the CRT section of the device and then goes to something in the sweeper section. But a few passives above that there is also "VR8 (presumably variable resistor 8) SWEEP".

    Power board.
    picture of the power board again
    A bit more variable here, also a bit more logic than I am used to seeing on older power boards, however if it is generating pulses and such then that is OK.
    IC1 4011 D4011BC NEC Quad 2-Input NAND Buffered B Series Gate
    http://pdf1.alldatasheet.com/datasheet-pdf/view/8167/NSC/CD4011BCN.html
    IC2 4027 D4027BC Dual J-K Master/Slave Flip-Flop with Set and Reset
    http://www.datasheet.hk/view_download.php?id=1077389&file=0050\cd4027bc_369102.pdf
    IC3 4017 D4017BC Decade counter/divder with 10 divided outputs
    http://www.datasheetarchive.com/dl/Scans-051/DSAIH00037223.pdf
    http://www.datasheetarchive.com/dl/Scans-056/DSAIH000135769.pdf
    IC4 UPC339 a quad comparator
    http://pdf.datasheetcatalog.com/datasheet/nec/UPC339G2.pdf


    Back to the CRT then.
    CRT and sweep section
    glowing section and high voltage transformer

    [​IMG]

    This is not your average CRT. There is what is either a stepper motor or BLDC/brushless DC motor (presumably supposed to be synced to the radar beam), a switch which feeds back to the board and some wipers doing an unknown function, though presumably the.. I guess it would radial sweep rather than vertical or horizontal sweep like in a conventional CRT. The switch will have to be considered later -- the two main possibilities are some kind of hard reset/counter or a soft limit switch. You might see something like it on a 3d printer or CNC machine where although the thing should know where it is by counting pulses you still see a switch that is pressed to reset things to stop it crashing into the outside. Regardless of what it is now it should be a nice sync pulse for whatever I end up doing with it. Before that it might also be worth shorting it or unplugging it to see what happens. The case has NC and NO on it with the wire coming from NO (normally open).
    There are six wires going to the motor, though as the two green ones are going together it is probably aimed at some kind of increased current handling but saving a bit of money on loom wiring. In other similar motors I have pulled apart, in this case from old printers, you might have a drive voltage, a logic, possibly something that is not connected and a means to select direction.


    The front controls ( picture ). I have no earthly idea what those symbols mean, consulting the personal library is an option.
    picture
    However it seems the silkscreen may come to the rescue here.
    example of the silkscreen markings
    http://filetrip.net/folder?F9K5AsnbA4 has more.

    Time to figure out how to power it then. The 12V feed into the board from earlier connects directly to the box attached behind the tube. The parts on top say 0.22 250V NEC, possibly then a small filter capacitor. 250V is fine but peak voltage of 230V RMS is actually north of 300V, as 120 RMS V is more like 170V peak it might be that I need 120V. There is also a complete lack of earthing on this.
    The screws on the back of the power input box were nicely rounded but this is why we have our good friend the vice grips, however that might have to wait for another day.

    Looking at the board itself it says 12V-40V DC
    12V 8.0A or 96W.
    At higher voltages, considerably fewer amps.
    That is within the realms of possibility for a PC power supply, and quite possibly a laptop one if I get the right one. Or even a good old car battery. Let us skip the mains supply for now and wire directly.
    Stuffing a PC power supply onto it, no joy, not even a peep on the ring light that worked when it directly fed. Fuses appear fine, 12V appears to be going in and going where it needs to go. Regulators/converters of other forms seem to be getting in the way and we do not have the varied other voltages (7V. 17V, negative Voltages and more) to try to bypass the lot, however some things seem to be AC wave forms and there may be further signal generation involved. Alternatively I only want the CRT working really so maybe taking it right back and losing both the logic and the power board. However that will have to be round 2. Also now to think of something cool to do with it. Technically it is not a vector screen (there is no way I am overdriving that motor to make it one) so that is out. I could make a practice/training radar or radar based game but I have very little use for the former and the latter does not appeal so much. With old CRT TVs you can turn them into limited use oscilloscopes... a rotary scope would be a pointless tool indeed but there is a certain appeal there. I could make some piece of art but that is not me... In game radar for something it is. Alternatively


    Also if someone has a repair manual for this or a similar vintage device from the same make I would very much appreciate a look.
    If for whatever reason this happens to be the screen on your boat or you otherwise want more detailed photos or measurements (electrical or mechanical) of some aspect then do ask.
     
    Flame, VinsCool and Tomato Hentai like this.
  2. Attacker3

    Attacker3 GBAtemp Regular

    Member
    211
    297
    Mar 24, 2015
    Canada
    Underground, in my mother's basement.
    Oh.
     
    zoogie likes this.
  3. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,199
    5,925
    Jun 27, 2015
    United Kingdom
    England, UK
    :wtf:
     
    zoogie likes this.
  4. FAST6191
    OP

    FAST6191 Techromancer

    pip Reporter
    23,522
    9,360
    Nov 21, 2005
    What is causing you problems, Voxel Studios? I have not figured out much beyond what I have there but I can expand on something if you want.
     
  5. Voxel

    Voxel Fable Junkie

    Member
    GBAtemp Patron
    Voxel is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    5,199
    5,925
    Jun 27, 2015
    United Kingdom
    England, UK
    Nah, it's fine. It just seems to look like a looooooooot of work!
     
  6. FAST6191
    OP

    FAST6191 Techromancer

    pip Reporter
    23,522
    9,360
    Nov 21, 2005
    Not really. The first set that were not as well lit and on the rug on the wooden floor was me having a couple of spare hours I had one morning and the second set on the black carpet with better lighting was from about 2 in the afternoon until 5 one day according to timestamps on the photos. Writing it up probably took a bit longer but I made sure I had the photos I needed to help that rather than having to reference things, though it seems I am going to have to build a ring light for it.

    All in all it was more effort dragging it back up the hill from the car boot. Fortunately I found a skip on the way back and made a little harness to hold it better.
    I have still got to get it running and doing something "useful" though. Depending upon what I have to do to allow that to happen will change what goes.
     
    Voxel likes this.
  7. FAST6191
    OP

    FAST6191 Techromancer

    pip Reporter
    23,522
    9,360
    Nov 21, 2005
    I did have a nice clothes iron, sorry "steam generator" I pulled apart but I was lazy and have not written it up yet and has been sitting on the floor waiting for the parts harvest for months now. For an expensive piece of kit was certainly badly made, but enough of that and I will write it up when I do.

    However I had a broken rice cooker cross my bench (bench is where the tools are so this is the dining room table) a few days back. Seeing how much of a deathtrap it was, and that someone had deemed it suitable for 240V despite several components clearly being rated for 110V AC max, I did not even try to fix it. Sadly I also neglected to get a picture of the wonderful sticker which said something like "to lessen risk of electric shock only use the included bowl" and the photo I have was more of a "so I don't have to figure out where the wires go" job.

    deathtrap.JPG

    The floating black box is the power in. Two wires so no earth, this despite the case being metal and all those nice exposed and quite probably live posts being about 7mm from a nice round metal plate you can see the edge of in the background of the image and that you could dent quite easily (said plate was isolated from the rest of the shell with a plastic ring giving you the chance to maybe complete the circuit with both hands as you pick it up). No fuse, though one of the things that had fused was a diode (apparently heater units like half wave rectification) inside the bigger black box which the wires are going into, said black box having a nice switch and timer unit.

    The most safe part of it all was the classic "deathdapter" to convert things to UK sockets actually had a shield inside it which was a first, said shield was not sorted by the earth pin like it should and a screwdriver would still give you a little shock (RCD not withstanding) but at least you couldn't poke your fingers in there.

    Fortunately it was an ebay importer job rather than someone with a real shop (I am not one for dobbing people in but this would be the exception, that or they would have had their stock destroyed and a headbutt from me), and the seller actually agreed to a refund which was nice.
     
  8. Engert

    Engert I love me

    Member
    887
    481
    Jan 21, 2012
    United States
    Taxachusetts
  9. FAST6191
    OP

    FAST6191 Techromancer

    pip Reporter
    23,522
    9,360
    Nov 21, 2005
    What questions? I pulled some stuff apart and tried to figure out how it worked before sharing it with the forum. I will admit I was not expecting a repair manual or anything really for the old radar screen from people floating by GBAtemp.
     
  10. DinohScene

    DinohScene Capture the Dino

    Member
    GBAtemp Patron
    DinohScene is a Patron of GBAtemp and is helping us stay independent!

    Our Patreon
    16,079
    12,601
    Oct 11, 2011
    Antarctica
    В небо
    I like to take things apart when they break, try and fix them.
    I guess it's reverse engineering hardware... in a way.