front panel locked up on Gossen SSP Konstanter power supply

[Swake]

Hi all,

Picked up a very nice Gossen Metrawat SSP KONSTANTER 62 N 40 power supply able to deliver 40V/50A/1000W. Unfortunately the front panel controls are disabled and the 'Local Locked' LED is on. All tips to be able to unlock this thing are welcome.

Some more information:
This front-panel locking thing is a feature and can be set 3 ways:
A/ It can be activated using the front buttons (and then also unlocked)
B/ A control signal can be applied to the TRIGGER input if the trigger input was previously set to this function either trough the front panel or over an optional bus interface (that is not present)

Tried enabling the front-panel using both methods several times with different combinations but to no avail.

The startup sequence including the self test is as described in the manual. Everything lights up in the expected sequence. The manual indicates the self test can be bypassed partially by pressing a button on power-up and this works too. Also checked all buttons and their PCB lines. I believe all these buttons are fine.

There is A 8279 programmable keyboard & display interface chip on the front panel PCB. I believe it works as the displays and LEDs are coherent and at least one button is confirmed to do what it should (skipping self-test on power-up).

The trigger input is an opto-coupler. While the input measures fine relative to the operators instructions that indicate a LED with anti-parallel diode + 1.5k resistor) I could not measure the output yet (because I don't know yet which chip it is, there are plenty op opto-couplers on the board.)

The settings seem to be stored in a KM62256 memory (CPU is a 80C32). By removing a jumper near a lithium battery I could cut the power to that chip and I believe this should have reset the programmable settings. This reset didn't change anything. (Did I wait long enough? The datasheet indicates only 5ms recovery time)

If anyone could share a schematic or service manual for this power supply or a similar one I would be very grateful as I couldn't find one so far .

Added a catalog sample picture of the power supply.

Thanks in advance for the help/brainstorm as to how to find the issue.

[coromonadalix]

For an service manual    Gossen are very secretive or no leaked schematics as to be found

Did you send them some request about the command sent to put it back to local use ??


the manual say this
https://www.sglabs.it/public/GOSSEN_SSP_62&64N_datasheet_gb.pdf

Locking of Front Panel Operation
The control elements can be secured against unauthorized use by
pressing a key, with a computer command, or by applying a
signal to the trigger input


you have a manual  wiki

https://usermanual.wiki/m/ef4fbdfd87586f0abea99b2998d9479aad0c75c521382023068ef0756d2e3f1f.pdf

there is a lot of commands sections,  maybe there is something about the local or remote commands

The page 84:   LLO (input enables or disables front panel controls (LOCAL LOCKED))     seems interesting

[alm]

LLO is a standard IEEE 488.2 (GPIB) command that is usually reset on power off, and otherwise can be reversed using the GTL (Go To Local) command. But according to the manual the local lockout indicator only indicates disabling the front panel was locked using either the key combination or the trigger mode that Swake discussed. So sounds to me that if neither way of unlocking the front panel work, this could be a defect.

SRAM can retain information for suprisingly long, so I'd try removing the battery overnight and see if that makes any difference.

My next step might be tracing some lines on the digital board. If the lockout is a dedicated line to the front panel controller, then cutting this trace could be a workaround with minimal loss of function. If the CPU has an external memory bus and external ROM, you would be able to trace execution like old logic analyzers used to do, but that's quite the project.

[Swake]

Thanks both for the research and the though-process.

Indeed I tried unlocking it with both the front keys and the trigger input. Tried many combinations as I might have interpreted the manual wrongly but no success so far.

Same conclusion here: this thing is defective. Next analysis vectors are:

- Removing power from the memory chip for a day or so (because that is an easy move).
- Locating the trigger input opto coupler as it might have shorted to Vcc or something (unlikely but another easy move).
- Will study the P8279 workings to identify if there is a possibility for a dedicated line for the lockout or something like that. That is actually a good idea.
- I can look at some data lines between keyboard controller and CPU to see if there is activity when a button is pressed and if that makes sense somehow.
- There is an EPROM on board, might recover its data. But diving into that is.... mmm.... no no I don't want to. On the other hand all this would be the perfect excuse to shop for some new logic analyser stuff 

[alm]

I'd also look at how the lockout LED is driven. If there is a dedicated line from the CPU to signal lockout, there's a small chance the LED is driven from the same signal using a logic gate.

[Swake]

The P8279 has a IRQ out line. Monitoring that pin with a scope it triggers on each of the button presses. All buttons trigger it, my assumption is this works as intended. The two knobs to set voltage and current are not triggering the IRQ, but that might be because of the locked situation.

The 80C32 has 2 incoming IRQ lines. One of them is very busy but in the middle of that data stream I can detect a state change when a button is pressed. I'm fairly confident the IRQ from the P8279 is going thru as the state change was repeatably synchronized with me pressing buttons. Unsure if that other data is normal or not, If not then I have to find out what causes it, if yes I wonder how the CPU makes the difference between the sources of the IRQ.

Well... have now removed the jumper from the battery.

So todo for today:
- Wait a couple hours and check if it is still locked after that.
- If yes then follow the suggestion to trace the locked LED signal somehow.
- Trace the trigger input opto-coupler.
- Remove the battery power again and wait 24 hours because a couple of hours might not be enough.
- That SRAM chip is in a socket, what if I remove it... mmm... tempting. Likely the CPU is not going to be happy
- I'm also tempted to turn the 'Uset 0' pot to see if the display is changing. But of course that is somewhat messing with the calibration...

btw: My board 'PCB G' has a different design from the one in the manual and the picture I found on Ebay from a similar board. Likely mine is a older iteration.

[Swake]

Nothing of the above helped.

didn't flip that memory yet -> still tempting 

On closer inspection I noticed:
- A couple of buttons have had some unsoldering/soldering ongoing already, maybe to swap these around or something.
- Some corrosion from a humid environment or less than optimal storage.

[Swake]

Some update.

- Removed power and battery from the SRAM for a long time, no change.
- Removed the SRAM itself and the thing isn't making it beyond self test anymore. Replacing SRAM and everything is back to how it worked before. Supposedly that SRAM is ok.
- Confirmed the power supply is going through normal POST without apparent errors. What the manual describes in detail is happening.
- POST can be abbreviated by holding a key on power on. That works but the power supply still goes into locked mode.
- Power supply can be reset by holding down the CE/local key at power on. Not certain if this works but behavior and measures are as expected. It is still in locked mode after this procedure.
- Traced all buttons/keys and couldn't find anything abnormal, no shorts, no permanent contacts, keys themselves toggle fine, PCB traces measure fine and traced these up to a chip (generally a flip-flop) and that chip does something when the key is pressed.
- Traced all data lines from the button controller over buffers (74HC244) and flip-flops (74HC273) to the CPU and this all seems fine. I have no schematic but according to the routing and the chip specs it all makes sense. Anyhow everything behaves as I would expect it to do.
- Everything indicates that the locked-local mode is a decision of the CPU and not something governed by the button controller. Makes sense of course. But nothing seems to tell the CPU to behave like that

- I have found a slight anomaly in the opto-coupler of the trigger input and that is that, in circuit, its output transistor measures (diode test) slightly differently from all other opto-couplers. All of them are same CXY17 type. Might come from a resistor or something on its output. De-solder and confirm out of circuit I will. Now... even if this opto is bad, this _should_ not influence the local-locked status as it is expected to be disabled or reset.

Sooo..... why does that local locked light remains on?.... What makes the CPU think I want it?... On start-up it has no means to be instructed that local-locked should be activated....

Someone experience with tweaking code in EPROM for a 80C32 (8051)? I'd like to JMP over the local-locked routine...

[DC1MC]

I'll give it a try, post the EPROM dump.
 
 Cheers,
 DC1MC

[PA0PBZ]

Someone experience with tweaking code in EPROM for a 80C32 (8051)? I'd like to JMP over the local-locked routine...

If you want to go that route it would be very helpful to know how the lock led is driven.

[Swake]

Thank you for this kind offer
I haven't played with vintage EPROM's since ages meaning my programmer is somewhere deep in an unidentified box right now  . I have a shovel, can't be that far away anymore.,

[Swake]

No EPROM reader yet but progress has been made. Found a dead small signal FET and what I thought was a misbehaving zener diode in an analog control section. This section is on the same board but separated from the Digital stuff with opto-couplers.

The FET is a BSS88 in TO2 package and now that it is removed from the PCB it should read like 2 diode junctions but does not and there is a near short between 2 pins. Unfortunately I have nothing similar in stock and will have to order some.

The zener is something else. In circuit it measured 1.3V in forward voltage and infinite in the other. Sounds like a dead diode, right? Nope it wasn't.... And at that time I didn't know it was not a simple diode, as it looked like a 1N4148. Ones de-soldered I could read the 1V4 mark and went looking into my spares and found 2 new-old-stock 1V4 'zeners'. And these too measured 1.3V forward voltage.... broken too??? Or I don't know how to check a diode anymore....   I'm rational, well sometimes, and grab the datasheet and tadaaaa: this is not a zener but a diode type I didn't know existed: a "stabistor". I works like a zener but kinda in reverse. In this case a BZV86 1.4V (see pictures). Well I learned something 

[Swake]

BSS88 FET is replaced. Still no joy.

27C512 EPROM dump attached. Sticker on the EPROM has 3 lines:

5959
005
SSP

Boot sequence:
- POWER LED lights
- FAN started (I believe it is not controller by the CPU, would have to check)
- Power-up test (duration 8 seconds) with:
  * Reset all functional units (except battery-backed configurations memory)
  * ROM test
  * RAM test
  * Initialize computer interfaces if installed (I don't have any)
  * Ascertain device type (many jumper son the board)
  * Check the ADC timer
  * Recall last settings if required

- ALL LED and display segments are on while POST is running, READY LED is blinking.
- After test READY LED is ON.
- And in our case also the CE/LOCAL LED is on.

Thanks in advance for your time looking into this.

[Swake]

The digital control with CPU and display + keys is now isolated from the other parts of the power supply in that sens that it can be turned on separately.

Not finding a fault I started to become suspicions of the 5V power supply for the digital part. It is based on a LM317, reads 5.2V and seemed to have a lot of noise/ripple. I removed the regulator and instead inject 5V from a bench power supply. This way I can power only this digital part.

The fault situation is unchanged as the keyboard is still locked. OVP and OTP LED's are on now too. Likely because no more signal about this comes in. I wonder why the 3rd LED about Over Current is not on as I would expect it to function in a similar way to the 2 other.

[DC1MC]

Hello,
disassembled the EPROM dump, the external 32KB RAM seem to mapped at 0x8000.

Do you have the Serial/GPIB option, that would make our life easier, or at least where exactly the "Local Locked" LED is connected, then I should be able to trace it in the code. After a bit of cleaning I'll archive the IDA Pro database and add an assembly dump of it to help other looking into it.

Cheers,
DC1MC

[DC1MC]

Notes:
EDIT: It seems that the serial port is always active(*) and the interface board adds only the level shifters (maybe it has some presence pin as well ?), so IMO the best thing now that you have the digital board out is to trace the serial port pins and see if you can put a TTL USB to serial port there and discuss directly with the beast .


LOCAL LOCKED
The front panel controls are disabled, and are thus protected against unauthorized or inadvertent adjustment.
This display only applies to disabling of the front panel controls by means of manual adjustment or a control signal
applied to the TRIGGER input (for T_MODE TRG). It does not indicate disabling of manual switching to local control by
means of the IEC bus LOCAL LOCKOUT command.

So I will dig around the trigger circuit.


Disabling front panel controls
By pressing and holding the <CE/LOCAL> key and simultaneously activating the <RCL> key, all control panel elements are disabled except for the mains switch and the <CE/LOCAL> key, and the LOCAL LOCKED LED lights up.
Disabling front panel controls prevents unauthorized or inadvertent adjustment of device settings.
In order to reactivate the controls, the <CE/LOCAL> key must be pressed and held for at least 4 seconds (→ LOCAL LOCKED LED off).
The <CE/LOCAL> key can also be disabled by applying a signal to the TRIGGER input at the analog interface and selecting the appropriate setting for the T_MODE function,
thus preventing manual reactivation of the front panel controls.

Look MORE onto the trigger area !!! 

4.12 Disabling Front Panel Controls
The front panel controls can be disabled against inadvertent changes to selected values and settings.
The behaviour during power on is also determined by the selected power-on status parameter Pon (page 27).

Disabling
☞ Simultaneously press the <CE/LOCAL> and <RCL> keys.
! The front panel controls are now disabled.
! The yellow LOCAL LOCKED LED lights up.

Enabling
☞ Press and hold the <CE/LOCAL> key for at least 4 seconds, or until the LOCAL LOCKED LED goes out.

Disabling and Enabling via the Analog Interface
☞ The <CE/LOCAL> key can also be disabled by applying a signal to the trigger input at the analog interface and selecting the
appropriate setting for the T_MODE function, thus preventing manual reactivation of the front panel controls.

EDIT Archive with the ASM file and IDA databases attached,

Cheers,
DC1MC

[Swake]

Thank you very much DC1MC.
Great that you could confirm the serial port should be active. There is a UART on pins 10 and 11 of the 80C32. Talking over this port will be my next search vector.

Many fingers point towards the trigger input but I don't think it is the issue because
- T_MODE must be set to LLO and that is stored in SRAM memory. I emptied it by removing the battery and the SRAM chip itself. It must be 'default' now and that is OFF.
- Low signal = All front panel controls are functional. Low is when nothing is applied or tied to GND. Tried this but didn't change anything.
- Also tried different signals from 0V to 15V and some pulses. Unfortunately no change at all.
- Associated opto-coupler output measures fine.

There are still some possibilities for this trigger thing to be related to the issue:
- I will trace the signal between the trigger opto and the CPU as there might be something wrong on that path.
- This thing has a custom firmware with a forced local locked mode....
- Another 'fault' signal exists that would cause the lock to protect something, but then I would not expect to see the READY led come on.

[Swake]

No I don't have a serial of GPIB interface.

To drive the displays:
The 80C32 CPU sends data to a 8279-5 interface over some flip-flop magic. There is more flip-flop magic on the output of the 8279-5 because counting the 7-digit displays there are in total 88 LEDs to drive.

Attached a diagram.

EDIT: the IRQ line of the 8279-5 is routed to the CPU and a scope put on that line shows it is triggered when any button is pressed.

[DC1MC]

Only the Local Locked LED is missing from this nice diagam

[PA0PBZ]

Only the Local Locked LED is missing from this nice diagam

That would be the best attack vector yes, that's why I already asked for it a week ago

[PA0PBZ]

There are a few commands not in the manual, like CONFIGURE and how about JANUS? 

Code: [Select]

*CLS
*DDT
*ESE
*ESR
*IDN
*IST
*LRN
*OPC
*PRE
*PSC
*RCL
*RST
*SAV
*SRE
*STB
*TRG
*TST
*WAI
CONFIGURE
CRA
DCL
DELAY
DISPLAY
ERA
ERAE
ERB
ERBE
FNRSET
HID_TST
IFC
ILIM
IMAX
IMIN
IOUT
ISET
JANUS
MINMAX
MODE
OCP
OUTPUT
OVSET
OV_CAL
POUT
POWER_ON
REPETITION
SDC
SEQUENCE
START_STOP
SWITCH
TDEF
TSET
T_MODE
ULIM
UMAX
UMIN
UNROUNDED
UOUT
USET

[Swake]

It took me a couple hours but here is a partial schematic. Designed in... Powerpoint. 
Addressing of the Local Locked LED is on there but not the data source. Can't find what is talking to that 74HCT244 in the middle. Have traced and traced and traced, but found nothing, can't believe it myself. Still have to search for some output enablers sources too.

EDIT: corrected name of LED

[DC1MC]

The Local/CE is the "Local Locked" LED that we are talking, or something else ?

[Swake]

Yes it is the local locked led.

[Swake]

Is that a GPIB Arduino interface you're planning? Nice project, I should make one too.

The Gossen power supply is not collaborative over a serial connection.
The RX and TX pins of the CPU are exposed on the interface connector. So I'm pretty sure these are the correct pins. I tried connecting with a CP2101 USB/Serial converter and used several baud settings but received no response at all. Will connect the scope later today on that interface as it seems not a single bit is coming back.

What command would you send over to make it answer?


The firmware contains this string: SIEMENS,D2425
Googling it comes up with Siemens 7KD2425 and some product descriptions that are exactly the same as the Gosset series. an example:

• SIEMENS STABIZET D2425 (K345B), SINGLE OUTPUT SYSTEM POWER SUPPLY, WITH INSTALLATION SET FOR 19" RACK, 1000W, OUTPUT VOLTAGE 0-52V, OUTPUT CURRENT 0-50A; DESKTOP MODEL.

No further information to be found.