Kontron 8201 not Booting

[TonyBe]

Hi guys,

i'm currently working on a Kontron Messtechnik Modell 8201 Function/ Pulse Generator.
When it came to me the fault was very simple: when turning it on, the fan started spinning and a buzzer on the mainboard screams to me continously. Besides that, nothing really happens. No smoke, no heat, no LED or display artifacts.

After all voltages have been measured ok, i've started to randomly resocketing every IC around (and inlcuding) the main MCU (an Intel 8031). After that, at least the buzzer was quiet for some seconds after turnin on the device. This leads me to check for the data lines and voltages with the scope and so in found out, that the datalines (8 Bit parallel interface) all looks like being tight to Vcc with a small digital looking ripple of about 300mV. Since this was far away from a clean digital signal, i've started to unplug and unsocket several ICs and Connectors, which connects to the data lines. And well first shot was succesful. After unsocketing the RAM (U7), the Generator was turning on with a short beep and a display which shows all characters. After that a promising " -8201-" in the display followed by "SoFt1.4" which is also written on the UV-EPROM on the Mainboard.
Sadly, this was the point where every stucks. No Relais, no signal, no LEDs which indicates the normale function of the generator. So i've checked what the U7 RAM is used for. The manual clearly stated, that U7 is only for user data like GPIB adress aso.
U7 is a MK4-8Z02 SRAM with included Lithium cell which dates back to 86. Of course, the Lithium cell is dead. But after trying to put it back in circuit, it definetly stops the MCU from booting. So something seems to be wrong with this IC. Powering it externally shows me, that every single pin of it (address lines, data lines and all controll lines) are at +5V - no matter if it is enabled or in write/ read mode. So i thought that this was the reason why it "blocks" a propper data communication between MCU and EPROM.

Looking through my stock i've found an Atmel AT28C256 EEPROM which has the a larger address interface. Since this shouldn't be a problem, i've botched it in the socket of the original SRAM just to check, if the MCU maybe needs this sram to continue booting.

This indeed brought me a little further (and to te point where i need your help and suggestions):
powering on the generator now shows the display ini, then the "8201" followed by "SoFt1.4" followed by 3 beeps with "nO BAttery". And that is where it is stuck again. The manual states, that this error is only for information that the lithium cell on the SRAM is low and that there will be no data stored anymore. After 2 sec, this error should disappear and normal operation should start. In my case: nothing happens.

So i've continued with data line inspections and now, the data line looks like the attached bmp... clearly a digital signal, but as you can see, there is this weird part, which seems to be corrupted. In my understanding, it looks like two chips trying to send at the same time... so i've again unplugged all modules (J4, J3 and J1) and unsocketed U7 and U11. U6 is also not populated in my modell. This leads to only the MCU, the EPROM and the D-Latch Chip (U3) are connected. But sadly, the signal on the data line still looks completly the same.

Now my questions: How does the 8031 works? Does it read the whole firmware program once at the beginning from the EPROM or does it read sequential regarding the current state of operation? May the Firmware be corrupted due to aging on the EPROM? And if that's possible, would the generator boot to the point it does now?
What could be wrong here? I've starting to run out of ideas...

See also attached the corresponding schematic of the MCU Part.
I'm looking forward to your suggestions.

If i missed out any information or failed with the explanation, let me know!

Thank you all in adavance and have a good day

Regards

[fzabkar]

I would think that the EPROMs would be checksummed. Can you dump them and upload their contents?

What happens if you replace U7 with a regular, volatile, 2K x 8 SRAM such as the HM2116? There are plenty of equivalents. The AT28C256 is programmed by pages, so it would be unsuitable .

https://docs.rs-online.com/3beb/0900766b8009e2bc.pdf (M48Z02 / M48Z12)
http://ww1.microchip.com/downloads/en/DeviceDoc/doc0006.pdf (AT28C256)


Edit:

What about using a DS1220AD 16k Nonvolatile SRAM?

http://www.farnell.com/datasheets/766161.pdf

https://www.newark.com/c/semiconductors-ics/memory/nonvolatile-ram?nvram-memory-configuration=2k-x-8bit

"Each DS1220 device is shipped from Dallas Semiconductor with its lithium energy source disconnected, guaranteeing full energy capacity. When VCC is first applied at a level of greater than VTP, the lithium energy source is enabled for battery backup operation. "

[TonyBe]

Hi fzabkar,

thank you for those suggestions,... especially the tip with the page programming. I think that's the problem with my botch here. Since i don't have any regular SRAMs laying around i cannot test it. But i think i'll order some of the DS1220AD.. they're looking perfect for the job.

I'm still wondering why the MCU does not boot any further. In the meantime i've found this http://what-when-how.com/8051-microcontroller/803151-interfacing-with-external-rom/..
It describes very nicely how the 8031 is interfacing the external EPROM. Since it loads every program instruction from the eprom, it could still be possible that the data is corrupted.

Another approach could be due to the weird digital signal that i've attached in my first post. Looking at the schematic shows, that addresslines A8..A13 are directly connected to the MCU and are also used for some other signals like CS generation. If somthing went wrong here, the MCU cannot connect to the right address line in the EPROM and therefore could get stuck in the last succesfull program instruction.

Sadly i don't know how to test this further.

I've also want to dump the EPROM content. But i don't have a reader and those things are quiet expensive. So maybe i'll write some code for an mega16 which'll have anough IOs to directly address the EPROM.

Thank you again,
regards

Tony

[fzabkar]

Your circuit diagram shows a standard 2K x 8 SRAM with an external lithium battery. Perhaps there are optional unpopulated components on your PCB, or is your PCB different from the one in the diagram?

The circuit around U10 disables the /CS to the SRAM if the +5V rail falls below +4.7V. That might be worth checking.

[TonyBe]

Hi,

yes thats right. THe whole external Battery circtui together with the U10 logic is not populated. I've already checked the CS and there is no hint of failure there.
Yesterday i've put together a simple AVR Programm and a AtMega16 to read out the PROM Chip.. Since the Checksum is labeled on the PROM i want to check if everthing is alright there.

After reading it out 3 times, and getting 3 different images from it, i've checked the voltage lines on the Mega16...
Nearly every dataline has a very strange behaviour. Please see attached image from Data4 (for example).

The 5V Rail of the PROM is clean. But as you can see, the Voltage levels are at about 3V and sometimes even lower.. Is this a known failure mode of an aged PROM?

I think of building a little buffer stage with a comparator to clean up the output signal. Hopefully i can safe the Firmware before the chip dies completely.

I've used like 10cm long dupont wires to hook the chip up and choose my clock to be very slow (about 10ms delay between each signal changed).

What do you think about this?

Regards
Tony

[fzabkar]

It doesn't look healthy, but then I can't understand how the boot process gets as far as it does.

I do have experience with EPROMs going bad, particularly those made by Texas Instruments (2716, 2516), but I never scoped them.

I also have experience using comparators to revive ICs with weak TTL levels, so that could be a viable approach. You might want to unload the data bus to see whether the signal levels rise to 5V.

[TonyBe]

Hi,

i finally made a circuit that brings the level up high enough to that i can Backup the Firmware. In the meantime i found another owner of a 8201 which was so kind to send me the image of his EPROM.
I've flashed it onto a new one and the boot still stops there...

The signals look much cleaner, but now it kind of overshoots at some point. The last thing that isn't fixed now is the missing SRAM.

To be true, i've botched the Atmel one in with like 3cm long dupont wires,... Maybe these artifacts that are still visibile now are due to bad cabling? Reflections and Crosstalk? Is this an issue with 10Mhz? I have no experience at which frequency this effects kick in...

I'll order a replacement SRAM and hope for the best.

Regards
Tony