Pete Thank you, I will look at its some time in the future, right now I let it cook for a couple of weeks undisturbed and than I may cut the trace that seems not to do any thing. If you have a 100 MHz scope it will trigger on any pulse in this unit unless your scope is defective. I think there are features hardware wise in this unit that can be activated at manufacturing depending on price and demand. I am sure you are aware of instruments that a hardware wise the same and cost any where from $15 000 to $40 000 the only difference is the software imbedded and many times you can buy an upgrade. Bert message dated 11/18/2011 10:26:02 A.M. Eastern Standard Time, bell.peter@gmail.com writes: All the pins have things connected to them - but pin 6 seems a little strange - it's connected to the 'ACT240 (in fact, it goes through 3 sections of the chip in series!) and finally to the xilinx chip - but none of these signals ever appear to do anything and the output is just constant high. It's possible that this the pulse is just extremely short - the fastest scope I have at home is only 100Mhz - but I would have expected to be able to tirgger on it at least. Regards, Pete On Fri, Nov 18, 2011 at 9:09 PM, <EWKehren@aol.com> wrote: > Pete > Thank you for doing all the work. This is great info and will help all of > us that want to discipline the beast. One more question, since you have done > so much testing is there one pin on the connector that has nothing > connected to it? > Thanks again Bert Kehren > > > In a message dated 11/17/2011 9:59:14 P.M. Eastern Standard Time, > bell.peter@gmail.com writes: > > OK, I just managed to get some spare time to have a look at this, and > here are some conclusions: > > 1) The fine frequency adjust pot is not connected to the c-field > circuit. All the connections to it go across the board to the MAX1246 > ADC chip. The track is wired between ground and the vref output on > this chip and the wiper goes to a little pi filter (ceramic cap, 100K, > 1uF tant) that feeds channel 1 (pin 3) on the ADC. As far as I can > see, it goes nowhere else. > 2) The c-field current is fixed. The circuit is very simple - there > is a 5.1V reference generated using a zener and a 681R resistor to the > 8.8V and this is fed into a potential divider consisting of a pair of > 120K resistors. The centerpoint of this divider is connected to pin 5 > (+ve input) of a TLC27M4BI - the output of this amp (pin 7) is > connected via a 270R resistor to pin 2 of the FPC connector and hence > to the c-field coil. The return side of the coil (pin 1 on the FPC > connector) connects to pin 6 (-ve) of the opamp and via a 620R > resistor to the 5.1V reference. > > If there is any other input to this circuit, I have not been able to > find it, despite probing all over the board. > > Conclusion: > > This version carried out the fine frequency adjust digitally by > changing the reload values on the DDS chip - the reason the pot does > does nothing in this specific model is that the DDS trim is now being > carried out over the RS-232 port and as a result the pot value (if > it's being read at all) is not being used for anything. > > Adjusting the c-field still works, though - if you connect a DC supply > set at about 2.55V via a high value resistor (I used 100K) to pin 5 on > the TLC27M4BI next to the flex cable connector then you can trim the > frequency by adjusting it. > > Regards, > > Pete > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > _______________________________________________ time-nuts mailing list -- time-nuts@febo.com To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts and follow the instructions there.

Let me add my thanks. My knowledge of FPGA's is about the same as my knowledge of the female of our species. Is it possible to read the program that's been entered into the chip? I'm not clear as to the data flow in this beast. If the control loop is indeed digital, then there's a PID controller in software? It's possible then to control the frequency as some want to do with the beast as it is, using an Arduino or Picaxe or some such to adjust the frequency with an external loop and digital corrections via the rs232 rather than all this crude analog resistor stuff :-) Don EWKehren@aol.com > Pete > Thank you, I will look at its some time in the future, right now I let > it > cook for a couple of weeks undisturbed and than I may cut the trace that > seems not to do any thing. If you have a 100 MHz scope it will trigger > on any > pulse in this unit unless your scope is defective. I think there are > features hardware wise in this unit that can be activated at > manufacturing > depending on price and demand. I am sure you are aware of instruments > that a > hardware wise the same and cost any where from $15 000 to $40 000 the > only > difference is the software imbedded and many times you can buy an > upgrade. > Bert > > message dated 11/18/2011 10:26:02 A.M. Eastern Standard Time, > bell.peter@gmail.com writes: > > All the pins have things connected to them - but pin 6 seems a little > strange - it's connected to the 'ACT240 (in fact, it goes through 3 > sections of the chip in series!) and finally to the xilinx chip - but > none of these signals ever appear to do anything and the output is > just constant high. It's possible that this the pulse is just > extremely short - the fastest scope I have at home is only 100Mhz - > but I would have expected to be able to tirgger on it at least. > > Regards, > > Pete > > > On Fri, Nov 18, 2011 at 9:09 PM, <EWKehren@aol.com> wrote: >> Pete >> Thank you for doing all the work. This is great info and will help >> all > of >> us that want to discipline the beast. One more question, since you >> have > done >> so much testing is there one pin on the connector that has nothing >> connected to it? >> Thanks again Bert Kehren >> >> >> In a message dated 11/17/2011 9:59:14 P.M. Eastern Standard Time, >> bell.peter@gmail.com writes: >> >> OK, I just managed to get some spare time to have a look at this, >> and >> here are some conclusions: >> >> 1) The fine frequency adjust pot is not connected to the c-field >> circuit. All the connections to it go across the board to the >> MAX1246 >> ADC chip. The track is wired between ground and the vref output on >> this chip and the wiper goes to a little pi filter (ceramic cap, >> 100K, >> 1uF tant) that feeds channel 1 (pin 3) on the ADC. As far as I can >> see, it goes nowhere else. >> 2) The c-field current is fixed. The circuit is very simple - there >> is a 5.1V reference generated using a zener and a 681R resistor to >> the >> 8.8V and this is fed into a potential divider consisting of a pair >> of >> 120K resistors. The centerpoint of this divider is connected to pin >> 5 >> (+ve input) of a TLC27M4BI - the output of this amp (pin 7) is >> connected via a 270R resistor to pin 2 of the FPC connector and hence >> to the c-field coil. The return side of the coil (pin 1 on the FPC >> connector) connects to pin 6 (-ve) of the opamp and via a 620R >> resistor to the 5.1V reference. >> >> If there is any other input to this circuit, I have not been able to >> find it, despite probing all over the board. >> >> Conclusion: >> >> This version carried out the fine frequency adjust digitally by >> changing the reload values on the DDS chip - the reason the pot does >> does nothing in this specific model is that the DDS trim is now >> being >> carried out over the RS-232 port and as a result the pot value (if >> it's being read at all) is not being used for anything. >> >> Adjusting the c-field still works, though - if you connect a DC >> supply >> set at about 2.55V via a high value resistor (I used 100K) to pin 5 >> on >> the TLC27M4BI next to the flex cable connector then you can trim the >> frequency by adjusting it. >> >> Regards, >> >> Pete >> >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to >> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the instructions there. >> >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the instructions there. >> > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > -- "Neither the voice of authority nor the weight of reason and argument are as significant as experiment, for thence comes quiet to the mind." R. Bacon "If you don't know what it is, don't poke it." Ghost in the Shell Dr. Don Latham AJ7LL Six Mile Systems LLP 17850 Six Mile Road POB 134 Huson, MT, 59846 VOX 406-626-4304 www.lightningforensics.com www.sixmilesystems.com

Hi 1) The full resolution of the DDS is available via the RS-232 port. There is nothing "better" available in the FPGA. 2) Yes with enough work you can intercept the FPGA programming string. You then need to convert it to something you can understand. Tracing out a 24 layer PCB with a DVM is a *lot* easier ... Bob -----Original Message----- From: time-nuts-bounces@febo.com [mailto:time-nuts-bounces@febo.com] On Behalf Of Don Latham Sent: Friday, November 18, 2011 12:04 PM To: Discussion of precise time and frequency measurement Subject: Re: [time-nuts] FE-5680A ("New" version) fine frequency adjust Let me add my thanks. My knowledge of FPGA's is about the same as my knowledge of the female of our species. Is it possible to read the program that's been entered into the chip? I'm not clear as to the data flow in this beast. If the control loop is indeed digital, then there's a PID controller in software? It's possible then to control the frequency as some want to do with the beast as it is, using an Arduino or Picaxe or some such to adjust the frequency with an external loop and digital corrections via the rs232 rather than all this crude analog resistor stuff :-) Don EWKehren@aol.com > Pete > Thank you, I will look at its some time in the future, right now I let > it > cook for a couple of weeks undisturbed and than I may cut the trace that > seems not to do any thing. If you have a 100 MHz scope it will trigger > on any > pulse in this unit unless your scope is defective. I think there are > features hardware wise in this unit that can be activated at > manufacturing > depending on price and demand. I am sure you are aware of instruments > that a > hardware wise the same and cost any where from $15 000 to $40 000 the > only > difference is the software imbedded and many times you can buy an > upgrade. > Bert > > message dated 11/18/2011 10:26:02 A.M. Eastern Standard Time, > bell.peter@gmail.com writes: > > All the pins have things connected to them - but pin 6 seems a little > strange - it's connected to the 'ACT240 (in fact, it goes through 3 > sections of the chip in series!) and finally to the xilinx chip - but > none of these signals ever appear to do anything and the output is > just constant high. It's possible that this the pulse is just > extremely short - the fastest scope I have at home is only 100Mhz - > but I would have expected to be able to tirgger on it at least. > > Regards, > > Pete > > > On Fri, Nov 18, 2011 at 9:09 PM, <EWKehren@aol.com> wrote: >> Pete >> Thank you for doing all the work. This is great info and will help >> all > of >> us that want to discipline the beast. One more question, since you >> have > done >> so much testing is there one pin on the connector that has nothing >> connected to it? >> Thanks again Bert Kehren >> >> >> In a message dated 11/17/2011 9:59:14 P.M. Eastern Standard Time, >> bell.peter@gmail.com writes: >> >> OK, I just managed to get some spare time to have a look at this, >> and >> here are some conclusions: >> >> 1) The fine frequency adjust pot is not connected to the c-field >> circuit. All the connections to it go across the board to the >> MAX1246 >> ADC chip. The track is wired between ground and the vref output on >> this chip and the wiper goes to a little pi filter (ceramic cap, >> 100K, >> 1uF tant) that feeds channel 1 (pin 3) on the ADC. As far as I can >> see, it goes nowhere else. >> 2) The c-field current is fixed. The circuit is very simple - there >> is a 5.1V reference generated using a zener and a 681R resistor to >> the >> 8.8V and this is fed into a potential divider consisting of a pair >> of >> 120K resistors. The centerpoint of this divider is connected to pin >> 5 >> (+ve input) of a TLC27M4BI - the output of this amp (pin 7) is >> connected via a 270R resistor to pin 2 of the FPC connector and hence >> to the c-field coil. The return side of the coil (pin 1 on the FPC >> connector) connects to pin 6 (-ve) of the opamp and via a 620R >> resistor to the 5.1V reference. >> >> If there is any other input to this circuit, I have not been able to >> find it, despite probing all over the board. >> >> Conclusion: >> >> This version carried out the fine frequency adjust digitally by >> changing the reload values on the DDS chip - the reason the pot does >> does nothing in this specific model is that the DDS trim is now >> being >> carried out over the RS-232 port and as a result the pot value (if >> it's being read at all) is not being used for anything. >> >> Adjusting the c-field still works, though - if you connect a DC >> supply >> set at about 2.55V via a high value resistor (I used 100K) to pin 5 >> on >> the TLC27M4BI next to the flex cable connector then you can trim the >> frequency by adjusting it. >> >> Regards, >> >> Pete >> >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to >> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the instructions there. >> >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the instructions there. >> > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. > -- "Neither the voice of authority nor the weight of reason and argument are as significant as experiment, for thence comes quiet to the mind." R. Bacon "If you don't know what it is, don't poke it." Ghost in the Shell Dr. Don Latham AJ7LL Six Mile Systems LLP 17850 Six Mile Road POB 134 Huson, MT, 59846 VOX 406-626-4304 www.lightningforensics.com www.sixmilesystems.com _______________________________________________ time-nuts mailing list -- time-nuts@febo.com To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts and follow the instructions there.

Hi, I think it is a EEPROM PLD, not a FPGA, so there is no programming string - and probably has security enabled :) Regards, Javier El 18/11/2011 19:17, Bob Camp escribió: > Hi > > 1) The full resolution of the DDS is available via the RS-232 port. There is > nothing "better" available in the FPGA. > > 2) Yes with enough work you can intercept the FPGA programming string. You > then need to convert it to something you can understand. Tracing out a 24 > layer PCB with a DVM is a *lot* easier ... > >

The Xilinx chip (which is strictly speaking a CPLD) is programed via JTAG - all the required pins are on the test connector on the edge of the board. In theory, you can also read back the fuse maps using the JTAG port if the chip hasn't been secured. I haven't actually tried it, because I expect the chip IS secured - and a raw fuse dump is not that useful anyway for anything except copying the device. In any case, I'm pretty sure the servo loop in this unit is analog - once the board initializes, the CPU spends most of it's time in halt and only wakes up on a 1Hz interrupt to do some sort of housekeeping functions then halts again, while the servo is operating continuously The serial data lines that program the DDS are also connected directly to the CPU rather than the XIlinx chip - and are only active when the board is starting up (and, I presume, when you send it the trim commands - but I haven't actually verified this). The code that the CPU runs (which is held in that Waferscale/ST PSD chip) should be accessible, since it's just addressed like a flash chip by the CPU - the only possible difficulty would be figuring out how the bank mapping and decode PLD are set up - these are also programmable via a (different) JTAG port, bit are also presumably secured - there has to be some mapping going on because the PSD has 1mbit (128KB) of flash and the MCU only has a 64KB address space - having said this, it's likely that just blindly dumping the first 64K of the address space would turn up at least something interesting - this is actually on my list of "things I will try when I have some spare time" :) Regards, Pete On Sat, Nov 19, 2011 at 1:03 AM, Don Latham <djl@montana.com> wrote: > Let me add my thanks. My knowledge of FPGA's is about the same as my > knowledge of the female of our species. Is it possible to read the > program that's been entered into the chip? I'm not clear as to the data > flow in this beast. If the control loop is indeed digital, then there's > a PID controller in software? It's possible then to control the > frequency as some want to do with the beast as it is, using an Arduino > or Picaxe or some such to adjust the frequency with an external loop and > digital corrections via the rs232 rather than all this crude analog > resistor stuff :-) > Don > > > EWKehren@aol.com >> Pete >> Thank you, I will look at its some time in the future, right now I let >> it >> cook for a couple of weeks undisturbed and than I may cut the trace that >> seems  not to do any thing. If you have a 100 MHz scope it will trigger >> on any >> pulse in  this unit unless your scope is defective. I think there are >> features hardware  wise in this unit that can be activated at >> manufacturing >> depending on price and  demand. I am sure you are aware of instruments >> that a >> hardware wise the same and  cost any where from $15 000 to $40 000 the >> only >> difference is the software  imbedded and many times you can buy an >> upgrade. >> Bert >> >>  message dated 11/18/2011 10:26:02 A.M. Eastern Standard Time, >> bell.peter@gmail.com writes: >> >> All the  pins have things connected to them - but pin 6 seems a little >> strange -  it's connected to the 'ACT240 (in fact, it goes through 3 >> sections of the  chip in series!) and finally to the xilinx chip - but >> none of these signals  ever appear to do anything and the output is >> just constant high.  It's  possible that this the pulse is just >> extremely short - the fastest scope I  have at home is only 100Mhz - >> but I would have expected to be able to  tirgger on it at least. >> >> Regards, >> >> Pete >> >> >> On Fri, Nov 18,  2011 at 9:09 PM,  <EWKehren@aol.com> wrote: >>> Pete >>>  Thank you for doing all the work. This is great info and will help >>> all >> of >>> us that want to discipline the beast. One more question, since you >>> have >> done >>> so  much testing is there one pin on the connector that  has nothing >>> connected to  it? >>> Thanks again   Bert  Kehren >>> >>> >>> In a message dated 11/17/2011 9:59:14 P.M.  Eastern Standard Time, >>> bell.peter@gmail.com writes: >>> >>>  OK, I  just managed to get some spare time to have a look at this, >>> and >>> here are  some conclusions: >>> >>> 1) The fine  frequency adjust pot is not connected to  the c-field >>> circuit.  All the connections to it go across the board to the >>> MAX1246 >>> ADC  chip.  The track is wired between ground and the vref  output  on >>> this chip and the wiper goes to a little pi filter (ceramic cap, >>> 100K, >>> 1uF tant) that feeds channel 1 (pin 3) on the ADC.  As far as I  can >>> see, it goes nowhere else. >>> 2) The  c-field current is fixed.   The circuit is very simple - there >>> is  a 5.1V reference generated using a  zener and a 681R resistor to >>> the >>> 8.8V and this is fed into a potential  divider consisting of  a pair >>> of >>> 120K resistors.  The centerpoint of  this divider  is connected to pin >>> 5 >>> (+ve input) of a TLC27M4BI - the output  of  this amp (pin 7) is >>> connected via a 270R resistor to pin 2 of the FPC  connector and hence >>> to the c-field coil.  The return side  of the coil  (pin 1 on the FPC >>> connector) connects to pin 6 (-ve)  of the opamp and via a  620R >>> resistor to the 5.1V  reference. >>> >>> If there is any other input to  this circuit,  I have not been able to >>> find it, despite probing all over the  board. >>> >>> Conclusion: >>> >>> This version carried  out the fine frequency  adjust digitally by >>> changing the reload  values on the DDS chip - the reason  the pot does >>> does nothing in  this specific model is that the DDS trim is  now >>> being >>> carried  out over the RS-232 port and as a result the pot value  (if >>> it's  being read at all) is not being used for  anything. >>> >>>  Adjusting the c-field still works, though - if you connect a  DC >>> supply >>> set at about 2.55V via a high value resistor (I used 100K) to  pin  5 >>> on >>> the TLC27M4BI next to the flex cable connector then you  can trim  the >>> frequency by adjusting  it. >>> >>>  Regards, >>> >>> Pete >>> >>>  _______________________________________________ >>> time-nuts  mailing list -- time-nuts@febo.com >>> To unsubscribe, go to >>>  https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >>> and follow the  instructions there. >>> >>>  _______________________________________________ >>> time-nuts mailing list  -- time-nuts@febo.com >>> To unsubscribe, go to >> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >>> and follow the  instructions  there. >>> >> >> _______________________________________________ >> time-nuts  mailing list -- time-nuts@febo.com >> To unsubscribe, go to >> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the  instructions there. >> _______________________________________________ >> time-nuts mailing list -- time-nuts@febo.com >> To unsubscribe, go to >> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts >> and follow the instructions there. >> > > > -- > "Neither the voice of authority nor the weight of reason and argument > are as significant as experiment, for thence comes quiet to the mind." > R. Bacon > "If you don't know what it is, don't poke it." > Ghost in the Shell > > > Dr. Don Latham AJ7LL > Six Mile Systems LLP > 17850 Six Mile Road > POB 134 > Huson, MT, 59846 > VOX 406-626-4304 > www.lightningforensics.com > www.sixmilesystems.com > > > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. >

On 11/18/2011 08:45 PM, Peter Bell wrote: > The Xilinx chip (which is strictly speaking a CPLD) is programed via > JTAG - all the required pins are on the test connector on the edge of > the board. In theory, you can also read back the fuse maps using the > JTAG port if the chip hasn't been secured. I haven't actually tried > it, because I expect the chip IS secured - and a raw fuse dump is not > that useful anyway for anything except copying the device. With CPLDs you still have a fair chance. I have reverse engineered PALs from the JEDEC dump. In the process I also concluded that they where PAL beginners, since they didn't use the internal feedback path but did it externally. However, most of the CPLD logic should be easy to clone without the source just by monitoring what it does. Frequency dividers eats the flip-flops quickly, so with known ratios it becomes easy to estimate remaining terms. Reverse-engineering is fun and you learn things. Somebody drawing a schematics in the process? Even partial schematics can be of help. Cheers, Magnus

HI. Magnus This device is basically 4 "PAL54V18"s with a switch matrix - I'm sure you could get something out of the JEDEC files if you could read them, but from my experience of the Xilinx fitting tools they seem to randomly spray product terms all over the place and it's often easier to reverse engineer the device based on it's observed behavior - especially in a case like this where pretty much all the logic just seems to be counters. I have been making some notes while looking at these things - my plan is to clean them up and put them into a CAD package once they are a little more coherent - I was also thinking that dumping the firmware would help a lot with sanity checking on the digital side of things. Right now, the big remaining grey box is the servo - the front end after the photocell looks a lot like a lock-in amplifier, and some of the other stuff (like the ramp generator to sweep the VCXO when looking for lock) makes lots of sense - but the rest of it doesn't - which probably means I've missed some connections and components out. I was looking a lot harder at this, but when it became obvious that it was the actual Rb absorption cell that was dead trying to figure out how the electronics worked seemed less important... Regards, Pete On Sat, Nov 19, 2011 at 8:37 AM, Magnus Danielson <magnus@rubidium.dyndns.org> wrote: > On 11/18/2011 08:45 PM, Peter Bell wrote: >> >> The Xilinx chip (which is strictly speaking a CPLD) is programed via >> JTAG - all the required pins are on the test connector on the edge of >> the board.  In theory, you can also read back the fuse maps using the >> JTAG port if the chip hasn't been secured. I haven't actually tried >> it, because I expect the chip IS secured - and a raw fuse dump is not >> that useful anyway for anything except copying the device. > > With CPLDs you still have a fair chance. I have reverse engineered PALs from > the JEDEC dump. In the process I also concluded that they where PAL > beginners, since they didn't use the internal feedback path but did it > externally. > > However, most of the CPLD logic should be easy to clone without the source > just by monitoring what it does. Frequency dividers eats the flip-flops > quickly, so with known ratios it becomes easy to estimate remaining terms. > > Reverse-engineering is fun and you learn things. Somebody drawing a > schematics in the process? Even partial schematics can be of help. > > Cheers, > Magnus > > _______________________________________________ > time-nuts mailing list -- time-nuts@febo.com > To unsubscribe, go to > https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts > and follow the instructions there. >