Pages: [1]   Go Down

Author Topic: Yaesu FP-301D CW ID'er PROM: Reverse Engineering  (Read 55 times)

NQ4T

  • Member
  • Posts: 142
    • HomeURL
Yaesu FP-301D CW ID'er PROM: Reverse Engineering
« on: October 12, 2020, 11:39:36 AM »

Hi,

I recently came across an FP-301D (along with the FT-301D and FV-301D to go with it) and while I wasn't sure what exactly I was going to do with them, it was during my initial research that I quickly figured out what I could do with it; try my hand at reverse engineering the PROM used for the CW ID'er. For those who are unaware; the FP-301D is a power supply, speaker, clock, and CW ID unit. It seems like an odd combination of things to put in a single box...but, that's what it is. The IDer required use of a PROM which had to be programmed by Yaesu (or an authorized dealer or something); and if anyone at any point in time had reverse-engineered it, the information was long gone.

The PROM in this case is a SN74188. A massive 256-bits of storage arranged in to the usual 32 8-bit words. In IC terms this thing is ancient; it dates back to the mid 70's and was redesigned in the early 80s. Unlike later or modern parallel EPROMS, the 74188 has open-collector data outputs. I knew at this point if I was going to adapt a later EPROM (like a 2716 or a modern parallel EEPROM), there would be some conversion circuitry. It also meant my data output could be "inverted" from what was written on the thing. But I was getting a little bit ahead of myself because I needed to know what data to write to start with. Since this was optional, I wasn't sure if the FP-301D in my possession had one installed. IF it did, then I could just pull it out, build a circuit to read it, and go from there. I still would have had to reverse engineer the data format.

I loaded up the user manual and was greeted with both a schematic and a circuit description. After reading circuit descriptions I wouldn't actually need to figure out what most of it was doing; very little of it was actually related to the readout circuit for the PROM. The description of the memory readout circuit didn't really give any details aside from an "END" command resets the ID circuit; it did reference the code in a PROM as a "time code".



Here's the "core" of the memory readout circuit; two 7493s, the 74188, a 74151, a 7425, and the NAND gate on another chip. Seeing the 74151 gave just about everything away. This chip is an 8-bit multiplexer; meaning it will flip it's output to the state of any of it's 8 inputs, based on the selection on three address lines. The 7493s are 4-bit counters, and the 7425 is a quad-input NOR gate.

Much as I suspected for something of this age; this is all just pure "hardcoded" logic with no processor of any kind. When the "other logic" triggers the start of the ID'er, it uses a generated clock signal (based on the CW Speed setting) to start making the first 7493 count. The start-up is for everything to be low, so the PROM is at address 0 and the 74151 is at 0. Every time the CW clock triggers, the counter advances through all eight outputs of the 74151 before it triggers the second counter to increment. This then increments the address on the PROM, putting a new set of 8-bits on the '151's input. You scroll through all 8 of these, increment, repeat. The stop command would be programmed in to the chip as hex 0xFF; it would be "seen" on it's output in this circuit as 0x0 on the "bus". Since they're not using the strobe pin on the 7425, each NOR gate only goes high when all inputs are low. NANDing them together means both NOR gates have to trigger before it fires the reset. The output of the 74151 runs back to "essentially" the same thing as the CW Key input on the radio. I'm sure it's more complicated than that...but I just needed to have a general idea of where that line went.

So when they say time-code, they literally mean timecode. Each bit will consume a specific chunk of time based on the speed of the keyer. You can key the rig, or not key the rig; so maybe 1 bit could represent a dit, 2 bits would equal a dah, and just leave a number of empty bits for spacing between everything.



Since I'm waiting to get and install a new set of capacitors before I even bother to turn it on, I decided to see if my assumptions were right about the addressing being sequential; or if Yaesu maybe did some "jumping around" by flipping bits to throw off anyone attempting to reverse engineer them. This is a simulation of the counter circuit, wired up to some hex displays instead of an eprom. I also use a basic 555 timer for the "clock" and haven't worried about the reset circuit. Sure enough, the addressing is 100% sequential.

So...there ya have it. If you've ever wanted to get the CW ID'er in your FP-301D going but stuck on the PROM...I've at least figured out the data format. If you find some 74188s NOS (there out there)...then you can build a burner and have a drop-in replacement. But it really shouldn't be too difficult to add some extra components and adapt for a modern chip. Since I've read things about the clock chips failing; I might wind up replacing all of the logic (clock and ID'er) with an Arduino.

73,
Jay/NQ4T
Logged

N8YX

  • Member
  • Posts: 2449
Re: Yaesu FP-301D CW ID'er PROM: Reverse Engineering
« Reply #1 on: October 12, 2020, 11:54:47 AM »

Join the "Yaesu 301" group on Groups.io and look for the writeup by Randy, W7CPA. He got ahold of a Japanese user manual for the FP-301D and in it was the programming code for the OEM PROMs. Randy sourced PROMs and had someone program them.

You can use a modern EEPROM in the 74188 socket by means of a "FLEP", obtainable here: http://www.callanbrown.com/index.php/flep-prom-replacement-adapters
Logged

NQ4T

  • Member
  • Posts: 142
    • HomeURL
Re: Yaesu FP-301D CW ID'er PROM: Reverse Engineering
« Reply #2 on: October 12, 2020, 12:03:17 PM »

Oh.

Well...at least it only took me about a half-hour to figure all that out.
Logged
Pages: [1]   Go Up