Dallas Nonvolatile Ram Chips - Battery Surgery

[edpalmer42]

I'm trying to repair a 13 year old piece of equipment that has a total of 10 Dallas Nonvolatile Ram chips.  Since they're 3 years past the guaranteed life, I'd like to check them.  Nine of them are soldered in so I can't just pull them and read them.  I've searched the net and found info on battery surgery for some of these chips, but not the ones I need.  What I want to do is drill a hole to get access to the battery's positive connection so that I can measure the voltage. 

Has anyone opened up either of these chips:  DS1230AB or DS1245AB?

As a test, I drilled into a DS12887 RTC/Cmos chip near pin 20 and was able to measure the voltage with no trouble.  I just need to know where to drill.

Thanks,
Ed

[digsys]

I have 1287, 3287, 1235, 1225, 1213, 1216 in stock, but not yours. bummer.
Rather than drilling, why not attach wires (> DMM) to heated pins and gently push them into the plastic. No mess no fuss.
Or are yours solid resin?

[AndyC_772]

I think you'll find that the battery voltage remains fairly constant throughout the battery's working life, so measuring it doesn't really give a good indication of how much capacity remains. I fear you may end up having to desolder the module, then read and replace it to be sure.

[edpalmer42]

I have 1287, 3287, 1235, 1225, 1213, 1216 in stock, but not yours. bummer.
Rather than drilling, why not attach wires (> DMM) to heated pins and gently push them into the plastic. No mess no fuss.
Or are yours solid resin?

The heated pin might work, but I still don't know where to stick the pin.  I don't want to start blindly poking at the thing.

Ed

[edpalmer42]

I think you'll find that the battery voltage remains fairly constant throughout the battery's working life, so measuring it doesn't really give a good indication of how much capacity remains. I fear you may end up having to desolder the module, then read and replace it to be sure.

I agree that the voltage stays constant.  I'm wondering is if one of these ram chips has failed and that's what's causing the fault.  No service info is available so I'm fumbling around in the dark.

I'm really dreading the idea of unsoldering 9 chips without damaging either the chips or the boards.  I don't know whether a dead chip will brick the unit or whether it just holds configuration and/or calibration data that can be easily replaced.

Ed

[poorchava]

The problem is, that factory calibration data is usually impossible to replace. Only option is to send the equipment to Tek factory, and for a 13 y.o. stuff the calibration service may not be available anymore. Anyway, contents of those nvram chips are priceless

[BravoV]

Anyway, contents of those nvram chips are priceless

+1 , its the data that is matter, back up 1st before finding the solution either modding with battery or full replacement.

Just fyi, the cheap MiniPro TL866 Universal Programmer officially supports the DS1230AB or DS1245AB chips.

[nctnico]

I know it is possible to get to the battery using a grinding tool. I have seen pictures on internet from people who succesfully replaced the battery. The more daring did that with the equipment powered on so they wouldn't lose the data. Others desolder NVRAMs and back them up.

In my equipment with NVRAMs I desolderd the chips made a backup and put them in sockets. I soldered the chip into an extra socket with turned pins because leads with solder on them in a socket is asking for trouble.

@poorchava: if you pay then Tektronix will calibrate it. I recently asked to calibrate my approx. 18 year old scope and they had no problem. BTW this scope also has an NVRAM but it is still working.

[mikeselectricstuff]

If the data is critical and not readily replaceable, the safest way would be to either unsolder them and read in a device programmer, or make a device that passively reads the data in-system - fairly likely the equipment will do a checksum at startup so should scan through all the addresses. May be able to use a decent logic analyser to do this.

[amyk]

If you want to know where the battery is, you could try to get an xray of it.

There are some nonvolatile SRAMs out there that don't need a battery, and could be considered for replacement.

[edpalmer42]

Thanks for your thoughts.  All good ideas, but I'll hold off for now on any drastic moves.

To summarize my situation:
- 9 soldered-in chips that are 13 years old with a 10 year data retention spec
- dead unit so no backup or diagnostics are possible (did one of the chips fail?)
- no service information so I don't know if the info is vital or nice to have

I have some other avenues to persue, but if it comes to it, I think I'll buy one of each chip and destroy it to find the point to drill to access the battery.  The battery voltage should tell me if one of the chips has failed and caused the dead system.

FYI, the DS12887 that I experimented on showed a voltage of 2V9.  Astonishing considering the fact that it includes an oscillator and has a 1994 date code!

Thanks,
Ed

[BravoV]

Fyi, my DS1225Y from Tek 2465B dated back in 1989 (24 years) still working fine ! 

After backing up the data, deliberately put it in again to see how long it will last, btw, bought it's replacement few months ago from Digikey and its dated 2012, quiet fresh imo.

[digsys]

FYI, the DS12887 that I experimented on showed a voltage of 2V9.  Astonishing considering the fact that it includes an oscillator and has a 1994 date code!

Generally, the system goes to deep sleep and is only woken up on each timer tick interrupt. You can EASILY get shelf-life, even with a MPU
running in this fashion ! Some of those purpose made cells have well over 10yrs shelf life.
In the past, when these things were expensive and rare, I sometimes quick charged them ! You can push ~50%++ life back into them in many
cases. I've also swapped them out, using a capacitor to hold the memory during changeover. Ideas to think about.

[PA0PBZ]

So, if you find that one or more of these chips have a dead battery, then what? Replacing them will not bring back the missing data, so if it is dead now because of data corruption it will stay dead and you will not even be able to tell if the chip was the problem. Can you tell a bit more about what equipment we are talking about and what else is in there, like what processor, is there program memory like flash or eprom? Are there any interfaces or programming headers? If the data is vital there must be a way for the manufacturer to reach it without desoldering the chips i'd think.

[edpalmer42]

So, if you find that one or more of these chips have a dead battery, then what? Replacing them will not bring back the missing data, so if it is dead now because of data corruption it will stay dead and you will not even be able to tell if the chip was the problem. Can you tell a bit more about what equipment we are talking about and what else is in there, like what processor, is there program memory like flash or eprom? Are there any interfaces or programming headers? If the data is vital there must be a way for the manufacturer to reach it without desoldering the chips i'd think.

Good point - I haven't mentioned what I'm working on.  It's a Wavecrest DTS-2077 Digital Time Scope.  It's an amazing piece of equipment (when it's working!).  It can measure time intervals with a resolution of 800 fs - yes, that's femtoseconds.

It consists of a front panel with it's own processor, eprom, and NVRAM - which is socketed.  I've checked that chip and it seems okay.  That makes me hopeful that the rest are okay.  The front panel appears to be working fine.  It accepts input and tries to send it to the main processor via a 19K2 bps optical link which connects to a serial input port on the main processor board.

The main processor board is a 486/DX2-66 Multibus 1 board with eprom and ram - no NVRAM.  The next board has 8 NVRAM chips, all soldered.  There are two RF boards that also look like they're on the bus.  One of them has a soldered NVRAM chip.  On bootup, the processor board hangs with a diagnostic light that signifies a Multibus timeout.  I'm currently working through the Intel manual for the processor board to see what info I can come up with.  One thought I had is to change the processor board memory address strapping to stop it from looking at the bus.  Obviously, the unit won't work, but if it starts complaining about something - anything! - I will take that as confirmation that the processor board is working and move on to the other boards.

The fact that the socketed NVRAM is still good makes me reluctant to take any drastic action at this point.  If I can't come up with any other explanation for the system hang, I want to at least check the batteries to see if they're still good.  Drilling a small hole to probe the battery seems less dangerous than unsoldering the chip so that would be my first choice.  If it turns out that one or more is dead, then it's likely that I've lost program or crucial data and I have to talk to the manufacturer.  I haven't approached them yet because they don't release service info and only do depot repair.  I suspect that their prices are going to be way out of my league but this is such an amazing piece of equipment that I might suck it up and go for it.

Ed

[free_electron]

oh crap. one of those... big black box huge 2x40 lcd display ? i tore one apart a couple of years ago.

afaik the nvrams hold the firmware for the multibus processor. The eprom is a base bootloader.

[PA0PBZ]

I browsed the manual and it looks like a nice piece of equipment but for a niche market, I would not use it a lot.
If the firmware is in the nvrams the problem gets a bit bigger even, so what is the eprom size? It looks like the nvram board either does 256KB or 1MB depending on what chips are on that board, seems a bit too much for just calibration data.
Did you try to take out the nvram card and the 2 rf cards to see what happens then? Could be that there is a faulty buffer on the bus corrupting the data and/or address lines, so you could hook up a scope and see if you can find any suspicious levels on the bus.

[edpalmer42]

oh crap. one of those... big black box huge 2x40 lcd display ? i tore one apart a couple of years ago.

afaik the nvrams hold the firmware for the multibus processor. The eprom is a base bootloader.

Yes, that's the beast.  I haven't pulled the eproms yet, but I wouldn't be surprised to find that you're right about the nvrams.  Just another reason to check the batteries.

Ed

[edpalmer42]

I browsed the manual and it looks like a nice piece of equipment but for a niche market, I would not use it a lot.
If the firmware is in the nvrams the problem gets a bit bigger even, so what is the eprom size? It looks like the nvram board either does 256KB or 1MB depending on what chips are on that board, seems a bit too much for just calibration data.
Did you try to take out the nvram card and the 2 rf cards to see what happens then? Could be that there is a faulty buffer on the bus corrupting the data and/or address lines, so you could hook up a scope and see if you can find any suspicious levels on the bus.

The eproms are 27C1024 in an odd/even split for a total of 256KB.  But instead of a generic bootloader they're labelled as "R010116 207x V2.06" so they've been customized.  The NVRAM board is eight DS1245AB for a total of 1 MB.  It does seem like it's too big for anything but program code.

Yes, I've removed the other boards and the processor diagnostic lights change a bit, but the result is the same.  Any attempt to access the bus will obviously cause a bus timeout since there's nothing there.  I haven't got to the point of probing with a scope.  Accessing the bus while the unit is running is going to be a problem due to the way it's constructed.

There's one other thing that I haven't mentioned that, oddly enough, gives me some hope that this beast might be repairable.  At some time in it's history, possibly recently, it was dropped on it's back panel.  This resulted in some damage to a couple of the boards and to the backplane.  I've inspected everything and made a couple of minor repairs, but I think I'm going to have to do some continuity checking on the backplane to look for cracked traces.  This will be a little complicated because there are three different types of connectors used for three boards.

This stuff either keeps you out of the bar or drives you to it.    

Good thing I'm stubborn........or maybe not.

Ed

[PA0PBZ]

This stuff either keeps you out of the bar or drives you to it.    

Good thing I'm stubborn........or maybe not.

Ed

I know the feeling and I tend to do the same thing, spending hours and hours on something that's broken and in the end I mostly mostly manage to fix it and it then suddenly becomes a lot less interesting. I've taken apart or gave away stuff that I fixed just because the fun was in the fixing. But the things you learn by doing that are the gain, and priceless.

[G0HZU]

I have some experience of using the Greenwich GR3281 NVRAM chips and with these chips it is possible to subtly corrupt the contents just by plugging them in and out of a socket even when the power is off

They are supposed to have various measures to prevent spurious writes  but I have corrupted loads of them in this way. Luckily I can simply reprogram them because I know what is meant to be in them.

If I wanted to know the contents of NVRAM in an embedded system then I'd probably leave them in situ and then dump the system ROM and then produce a custom version of ROM that reads all the memory addresses and sends the contents out via a serial port or some spare I/O pins.

[edpalmer42]

If I wanted to know the contents of NVRAM in an embedded system then I'd probably leave them in situ and then dump the system ROM and then produce a custom version of ROM that reads all the memory addresses and sends the contents out via a serial port or some spare I/O pins.

That would be great, but it's far beyond my programming skills.  I did wonder if I could find a generic eprom image that might have some of those capabilities built in, but I haven't been able to find any images at all.  That surprised me a little for some reason.

Ed

[edpalmer42]

Occasionally the planets align, fate smiles on me, and everything works out.  Boy, that happened in this case.

To summarize, I bought a Wavecrest DTS-2077 Communications Signal Analyzer.  It's an amazing piece of equipment that can measure time intervals with a hardware resolution of 800 fs.  Yes, that's femtoseconds.  Of course, it has to be working - mine wasn't.  I thought the nonvolatile ram chips might be at fault which is what started this thread.  But I decided that before I performed surgery on the chips, I'd try everything else I could think of.

One of the things I thought of was to pull the processor and inspect it and the socket.  This is an old 486DX2/66 in a non-ZIF socket.  When I pulled it, this is what I found:



That pin has probably been bent since the board left the factory.  Look closely and you can see a spot of green corrosion between the metal plate and the bent pin.  Nothing helps a processor more than occasionally shorting one of the data leads to ground.  The pin touched the socket as long as the processor was pushed down tightly but any vibration or jarring could shift the processor and break the contact.  I carefully straightened the pin, reinstalled the processor and put everything back together.  It worked!!      

Here's a picture of the unit measuring a signal derived from it's own clock.  Not very useful, but it shows the internal noise and jitter of the unit.



No lottery tickets for me - I've used up all my luck for this year. 

Ed

[nctnico]

  Awesome!

[Fraser]

Excellent result. Well done 

I am currently doing a high level reverse engineering job on a very high chip density embedded computer. It goes into HALT mode soon after boot start  I have discovered that it is basically like an ATARI 520ST computer with some additional I/O and all squeezed onto a very compact PCB. The first item replaced was the Dallas RTC battery. Sadly it is not a bent pin in my case....how I wish it was ! It keeps my mind active though and I love the challenge.

With regard to your NVRAM chips, the life of the battery is very much dependant upon the use that the equipment has had. Dallas state 10 years minimum. That would be storage conditions, no power applied. If a piece of equipment is powered and running, the NVRAM battery is not providing power and so its capacity is preserved except for natural discharge due to chemistry. More good news is that the lithium cell is actually charged at a very low current via the diode that connects it to the supply rail. Reverse current leakage of the diode is the cause of this and it is an aid to battery life in 24/7 powered equipment as it counters the natural discharge rate of the cells chemistry. I have tested 25 year old kit that was used 24/7 and the original lithium battery was still over 3.0V 

The very worst experience I have had with a particular DALLAS NVRAM chip type was where it contained a management circuit that effectively killed the chip when the battery voltage dropped below a set threshold. This was apparently to prevent unreliable operation ! I had to buy a NOS part that has been on the shelf for almost 10 years  It is not possible to predict how long its battery will last but I intend to hack a spare chip that has yet to be activated (most Dallas NVRAM are in a storage mode until first powered they then connect the battery to the load for the rest of the chips life. I will fit a new battery and then activate it.