Reverse-engineering a few 70's military digital logic boards

[D Straney]

I love finding old boards full of flatpack ICs, partly because they're unusual and varied by modern standards, and partly because of the how it looks like a group of insects decided to have a party on a PCB.

Part 1: IBM FSD Oscillator/Audio Module
Here's an interesting little module made by IBM Federal Systems Division (the same people responsible for the Space Shuttle's main computer).

The whole assembly is labeled "Oscillator Module, Audio Module", and seems to have a date code of 1981.


There's two boards with standoffs between them: here's what it looks like after I remove all the screws and separate the two boards.  You can see that one of the boards has the connector, while all the signals are carried to and from the other board with the yellow wires.  Both are covered with flatpack ICs, glued down to a metal frame for heatsinking.


Counter board
The board with the connector has 3 white ICs in the corner with custom part numbers.


These turn out to be 4-bit counters, when looking up the part at aerospace supplier websites.  From looking at the pinouts and features, these seem to be 74x161 or 74x163 equivalents.


The rest of the flatpack ICs have non-standard part numbers as well, but by again looking up these numbers at aerospace parts suppliers, the equivalent parts list shows which 5400-series parts they are.  All are "plain" TTL: no 74LSxx low-power Schottky here.  Date codes are from 1979-1980, and it looks like the low-power "L" and faster-but-higher-power Schottky "S" were finally combined into the overall-superior "LS" type in 1971, so there was plenty of time in between.  It's possible this was from later in the production run, though, or IBM just didn't consider the LS parts sufficiently proven where not absolutely needed.

ROM board
The other board's main feature is a gold insect in the middle.



The "UC6525" part number turned up in the normal information sources as a ROM chip, but there was nothing else to go on, and the information there conflicted both with itself, and with the connections I could see.  Ken Shirriff though was quick to answer my call on Mastodon and find a reference to it in an old issue of Electronics Design, complete with pinout (page 86).
This is a 128 x 8 ROM, which is used as waveform memory: Direct Digital Synthesis (DDS) in 1980!
It's a slightly strange part which needs not only the normal +5V, but also -5V and -12V, which is what the two tantalum capacitors on this board are for.



The rest of the chips on this board, like the other board, are standard 5400-series digital logic.


Schematic
The connections were often hard to follow here, as the traces on the component sides get hidden by both the ICs themselves and the metal stiffener/heatsink plates.  However, with some educated guesses and targeted continuity checks with sewing needles to pierce the conformal coating, I was able to get a pretty accurate schematic in the end.

The short story is that this module generates a digital waveform at variable frequencies.  I'm guessing it's an audio-frequency tone, maybe used for different alert or notification sounds in an aircraft, for example.  The output is digital (8 bits), so there must be a DAC elsewhere in the system: this could be as simple as 8 resistors.

The full schematic is attached as a PDF, but let's walk through the circuit sections one by one, starting with the programmable frequency divider:

This is what those white ceramic counter ICs are used for.  The 3x 4-bit counters are chained together into a 12-bit counter, which works as a frequency divider by resetting itself to a pre-set number on overflow from 0xFFF (the "overflow" pulse is the frequency-divided output).  The frequency ratio is set by the counters' "pre-set" inputs.  These inputs are driven by 12 external connector pins, but through a complex set of logic that mostly consists of AND gates.  I don't know the exact purpose of this logic (12 bits inputs -> 12 bits output?) but I'm guessing that it's used to provide some kind of transfer function for the frequency ratios.  Nothing more I can figure out without knowing more about the application.

Next, the output from the frequency divider travels over a yellow wire onto the ROM board, and enters a 9-bit counter built out of individual D-flip-flops:

The bottom 7 bits (bits 0-6) of this counter drive the address input of the ROM chip.  The 5451 AND-OR gates (U20, U21, etc.) are used here as 2:1 muxes that select between each counter bit and its complement.  They're essentially controllable inverters, where bit 7 of the counter selects whether the address bits are inverted or not.

This makes sense when you remember that inverting all the bits of a binary number is similar to applying a negative sign (see two's complement math). With 7 bits, when inverting all the bits a 0 becomes 127, 1 becomes 126, 2 becomes 125, etc.  So if all the address bits to the ROM are inverted, that means that instead of accessing memory locations "forward" from the first address to the last address, it instead accesses memory locations "backward" from the last address to the first address, as clock pulses come in and the counter counts up.

Because the address inversion is driven by bit 7 (toggled after every 256 cycles), the counter will access all the ROM locations in order first forwards, then backwards, then forwards, then backwards...
It gets even more interesting when we see that bit 8 of the counter (toggled every 512 cycles) drives another set of "controlled inversions" on the output of the ROM:

This means that the ROM contents will be dumped in a repeating 4-part cycle:

• Counting forward, positive output
• Counting backward, positive output
• Counting forward, negative output
• Counting backward, negative output

Take a look at a sinewave, or any symmetrical waveform, and notice how this corresponds directly:

This is really just a clever way to save memory space when generating a waveform.  It relies on the 2-fold symmetry of the waveform to only have to store 1/4 of the full waveform, and then invert it in time and/or in voltage as necessary.

I tried powering up this module to make it generate waveforms for me, and see what waveform shape was stored in the ROM, but sadly had no luck.  It drew a healthy 440 mA on the +5V and a combined 50 mA on the -5V and -12V, but no matter what I did the outputs never changed.  Something might be dead after all this time due to ESD, for example, or maybe there's some subtle connections or logic I'm missing.


Analysis
One thing that struck me about the circuit design was its inefficiency.  To generate a "controllable inverter", it uses a mux made from an AND-OR gate (2 per IC), which also requires a complementary input.  As a result, the complementary inputs for the ROM address counter need to come from a set of D flip-flops (2 bits per IC) rather than a dedicated counter IC (4+ bits per counter).  If they had used XOR gates instead for the "controllable inverter", then this would've (1) fit 4 bits per IC instead of 2 bits per IC, and (2) not needed complementary outputs from the counter, allowing it to use 2x of the 4-bit counter ICs + 1x D-FF IC, instead of 5x of the D-FF ICs.  It doesn't allow everything to fit on one board, but this change removes about half the ICs on the ROM board (less parts, less solder joints, better reliability).

I'm also not sure what system this was used in.  The NSN record for the counter IC links it to the AN/APR-38 radar warning system, but according to that website IBM didn't make the UI/display set, so that's probably just something else that happened to use the same IC.  Let me know if you have any thoughts.

[UnijunctionTransistor]

Are those wet slug tantalum caps?

[D Straney]

It sure looks like it.  I powered it up very slowly (with a very low current limit too) specifically to avoid blowing up the tantalums if they'd failed short over time, but luckily they were intact.

[KE5FX]

I tried powering up this module to make it generate waveforms for me, and see what waveform shape was stored in the ROM, but sadly had no luck.  It drew a healthy 440 mA on the +5V and a combined 50 mA on the -5V and -12V, but no matter what I did the outputs never changed.

Interesting stuff.  What did you use for the clock?

[D Straney]

Just a function generator (0-5V square output).  Even put it in close, gave it a coax connection with its own star ground directly to the (single) ground pin on the connector, and scoped it just in case there was excessive ringing from the cabling.  Nothing crazy for frequency, just tried 1 / 10 / 100 kHz.

Here's the 2nd board:
Part 2: UK Mystery Logic/Load Driver Board
This board is a bit of a mystery - it has a (UK) National Stock Number on it, but looking it up didn't turn up any information for me.



The board looks very nice when back-lit, as it has no ground plane, which allows for easy trace-following:


Along the bottom edge are some larger metal-can transistors, which seem to be driving open-collector power outputs:


There's a lot of digital logic with unusual part numbers, and 1975 date codes:


Because I couldn't find anything on the part numbers, I opened up one of each IC to identify under the microscope.  This was easy since there's only 3 different part numbers on the whole board.  You can see one of the opened chips here:


PLW6331



This turns out to be a triple 3-input NAND gate, implemented in TTL:


You can see from the die that there are unused transistors not connected in the metal layer.  I'm guessing this is because the same die is used (minus the metal masks) for 4x 2-input NAND gates as for the 3x 3-input NAND gates.  For what it's worth, the "PLW" in the part number might stand for Plessey Semiconductors.

SN6360



This one is made by Texas Instruments, but doesn't match any of their standard part numbers.  It's a quad 2-input NAND gate, though, again TTL:


PLW6302


This was the most complicated, and therefore most difficult, to figure out.  The die is clearly divided into 2 identical sections.
At a transistor level, arranged to be as un-confusing as possible, this is still what it looks like:


Turning it into logic gates makes it a little easier to understand:

...and simplifying some things (omitting the global reset, for example):


The function is still not obvious, and doesn't match any "standard" flip-flop architectures I could find, but at jwet's suggestion I tried out the logic simulated Logisim and played around with the inputs.  Just messing around with the inputs quickly revealed that it's a J-K flip-flop!  (And therefore, the PLW6302 is a dual J-K flip-flop)

Schematic
Now that we know what all the ICs do, the connections on the board will make sense, so let's look at the schematic.

First, there's a global enable signal entering on the connector.  This global enable gates two other enable signals from outside, to create "Global_Enable2" and "Global_Enable_Clk" (we'll see their purpose soon).  There's also a separate global enable "Global_Enable1" from outside.


The output load drivers (open-collector) are controlled by 8 identical channels, controlled indirectly by 8 separate inputs (In1-In8).

It's a strange arrangement, but if I'm interpreting correctly, I think this is how it works:

• Each channel has an individual "Enable" input.  Unless Global_Enable1, Global_Enable2, and the individual Enable are all high, both flip-flops will be held in reset, and the output forced low.
• Both J-K flip-flops are set into "toggle" mode: J & K both high, which means the output toggles on every clock input's rising edge.  They're both connected in series, which means that for the output to be turned on, two clock pulses have to be applied to the left-hand J-K flip-flop.
• Clock pulses are generated by a NAND gate (U6B for Channel 1), which takes both one of the control inputs (In1-8, as the individual "Enable_Clk" input), and Global_Enable_Clk.  This means that to turn the output on, it needs either (A) In* to stay high, and Global_Enable_Clk to pulse twice, or (B) Global_Enable_Clk to stay high, and In* to pulse twice.
• It gets more complicated, because the two individual inputs for each channel are shared with the adjacent channels, as the opposite type of input!

I really can't wrap my head around exactly what this logic is supposed to do: enforce some kind of sequencing?

Finally, there's an "all disabled" output, which is one big NAND of all the control inputs (In1-8).

There's a separate pin for each of the 8 control inputs, which gets combined with it.  It seems like this separate pin is some sort of "test" or "suppress input" function?  I'm also not sure the global enable signal is combined with every single input, when it could've been used once at the end of the logic chain.

So overall, I have absolutely no idea what the convoluted logic here is supposed to do.  Let me know if you have any ideas.

[Gyro]

Are those wet slug tantalum caps?

No, they're dry ones (still a lot more reliable than bead ones due to the hermetic sealing). Wet tants can be identified by a welded butt joint on the anode lead and slightly yellower / duller colour - Silver rather than Aluminium. Also by being significantly heavier.

[Edit: I forgot to mention the case shape, but I'm not sure that's universal]


Wet Tant at the top (welded butt joint easier to see on the shadow)...

[D Straney]

Changed the name of the topic, as now there's some more semi-mysterious digital logic boards to look at.

Part 3: Hughes Aircraft digital-inputs board
Moved to its own thread, for the future follow-up work such as decapping & powered testing.