Electronics Repair (sci.electronics.repair) Discussion of repairing electronic equipment. Topics include requests for assistance, where to obtain servicing information and parts, techniques for diagnosis and repair, and annecdotes about success, failures and problems.

Reply
 
LinkBack Thread Tools Search this Thread Display Modes
  #1   Report Post  
Old November 1st 03, 03:57 AM
Tim H.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have NO
display whatsoever. So, if the chip was inadvertently written to, would this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim




  #2   Report Post  
Old November 1st 03, 08:59 AM
Jack
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

You probably corrupted the EEPROM when you read it. I just learned about
this when I was reading an article about security chips. If you try to read
them with normal reader/writers, they get corrupted due to the fact that
during the read process, the reader tries to write something on the chip, to
test it out and this corrupts the chip.
Probably the only way out of it is a new head unit, since you probably
cannot get just a replacement chip.

"Tim H." wrote in message
news[email protected]_s53...
Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which

I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was

also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have

NO
display whatsoever. So, if the chip was inadvertently written to, would

this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is

probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back

to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim





  #3   Report Post  
Old November 1st 03, 09:43 AM
Tim H.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909


"Jack" wrote in message
...
You probably corrupted the EEPROM when you read it. I just learned about
this when I was reading an article about security chips. If you try to

read
them with normal reader/writers, they get corrupted due to the fact that
during the read process, the reader tries to write something on the chip,

to
test it out and this corrupts the chip.
Probably the only way out of it is a new head unit, since you probably
cannot get just a replacement chip.


What's weird is I can scope the EEPROM lines (CS, SCLK, etc) and I'm not
seeing the micro making any kind of queries.

FWIW, the programmer is of my own design. It's been thoroughly tested and I
don't have it set up to write to EEPROMs to "test" them. I realize asking
for repair help is a bit like asking, "...my engine is making this
noise...what is it?"

But if anyone has a dump of the EEPROM, I'd appreciate it!

-Tim


"Tim H." wrote in message
news[email protected]_s53...
Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code

(which
I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up,

it
would output roughly -8VDC but soon drop off. Odd, I thought. There was

also
a ground PCB track on the solder side that was toast. It's in the

vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes

that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have

NO
display whatsoever. So, if the chip was inadvertently written to, would

this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is

probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come

back
to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from

even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim







  #4   Report Post  
Old November 1st 03, 02:07 PM
Jerry G.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...

--

Greetings,

Jerry Greenberg GLG Technologies GLG
=========================================
WebPage http://www.zoom-one.com
Electronics http://www.zoom-one.com/electron.htm
=========================================


"Tim H." wrote in message
news[email protected]_s53...
Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have NO
display whatsoever. So, if the chip was inadvertently written to, would this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim




  #5   Report Post  
Old November 1st 03, 04:23 PM
Uns Lider
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

On 2003-11-01, Tim H. wrote:
What's weird is I can scope the EEPROM lines (CS, SCLK, etc) and I'm not
seeing the micro making any kind of queries.


Check your solder work on the EEPROM and adjacent to it. Also check to be
sure it's not in backwards!

-- uns


  #6   Report Post  
Old November 1st 03, 09:26 PM
Roy J. Tellason
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

Jerry G. wrote:

The system is infact designed this way to avoid being tampered with. You
can only have this re-programmed by the authorized service rep for Kenwood
radios. They infact do not support outside service or any outside parts
sales for their products. They will tell you to send them the radio for
service only. Otherwise, no parts...


Woo! Another one for my list...

Definitely want to stay away from this brand!


  #7   Report Post  
Old November 1st 03, 09:56 PM
Tim H.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909


"Jerry G." wrote in message
...
Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...


Well, as I said in another reply, I'm not even seeing the CPU event attempt
to read the EEPROM. I did save the contents when I first read; the contents
were consistent. So, I'll work on trying to get that back into the EEPROM.
Maybe it sets a "do-not-work" bit somewhere....

The serial data from the buttons on the face is interesting...


Thanks for the reply,

Tim



--

Greetings,

Jerry Greenberg GLG Technologies GLG
=========================================
WebPage http://www.zoom-one.com
Electronics http://www.zoom-one.com/electron.htm
=========================================


"Tim H." wrote in message
news[email protected]_s53...
Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which

I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was

also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have

NO
display whatsoever. So, if the chip was inadvertently written to, would

this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is

probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back

to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim






  #8   Report Post  
Old November 2nd 03, 01:20 AM
Bruce Esquibel
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

Jack ) wrote:
: You probably corrupted the EEPROM when you read it. I just learned about
: this when I was reading an article about security chips. If you try to read
: them with normal reader/writers, they get corrupted due to the fact that
: during the read process, the reader tries to write something on the chip, to
: test it out and this corrupts the chip.

I really don't think this is true of that family for the 93C46.

We used to used those things for something (think it was for alarm panels)
and although some in the family had the "protect bit", this "blowing of it"
to enable security only disabled reading the rom. Pretty sure you could sit
there all day and try reading it, nothing would happen.

It's a rather old device.

More likely the OP put it in wrong back into the socket, the socket itself
is bad or the socket into the circuit board. Maybe static discharge. I
really think it's a safe guess (although the datasheets have to be online
somewhere to prove it) that it has no "self destruct mode".

Pretty sure blowing the protect bit just internally disconnected the rom
address space from being accessed and sent out to the serial i/o.

-bruce

  #9   Report Post  
Old November 2nd 03, 03:01 AM
Tim H.
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909


"Bruce Esquibel" wrote in message
...
Jack ) wrote:
: You probably corrupted the EEPROM when you read it. I just learned about
: this when I was reading an article about security chips. If you try to

read
: them with normal reader/writers, they get corrupted due to the fact that
: during the read process, the reader tries to write something on the

chip, to
: test it out and this corrupts the chip.

I really don't think this is true of that family for the 93C46.

We used to used those things for something (think it was for alarm panels)
and although some in the family had the "protect bit", this "blowing of

it"
to enable security only disabled reading the rom. Pretty sure you could

sit
there all day and try reading it, nothing would happen.


I tend to agree. If I did just a normal read on a protected chip, it would
most likely be all 0s/1s. I don't think Kenwood spent THAT much $$ on R&D to
protect this stereo.


It's a rather old device.

More likely the OP put it in wrong back into the socket, the socket itself
is bad or the socket into the circuit board. Maybe static discharge. I
really think it's a safe guess (although the datasheets have to be online
somewhere to prove it) that it has no "self destruct mode".


No, it wasn't put in backwards. The PCB has markings for pin 1, so I got
that right. I managed to get a datasheet for the EEPROM from a different
manufacturer; and I made sure it matched the pinout (pins 1 and 8 are N.C.).

ESD is possibility. I did take the bare board to my friend to show him which
chip was burnt up.

This head unit has an NEC microcontroller (uPD178018) which interfaces to
the EEPROM. If I reset the micro and scope the EEPROM pins, I just see the
data/clock lines go high and that's it. And yes, I have the trigger set up
right to capture it.

I would like to get ahold of a service manual for this unit in case it
mentions anything I've yet to find out.


Pretty sure blowing the protect bit just internally disconnected the rom
address space from being accessed and sent out to the serial i/o.


I made no attempt to blow the protect bit. As you say, if that security
feature had been implemented, I would've seen it when I initially dumped the
EEPROM.

Thanks,

Tim


-bruce



  #10   Report Post  
Old November 5th 03, 08:12 PM
david nash
 
Posts: n/a
Default Reading EEPROM kills head unit? KDC-PS909

you guys are doing it all wrong....
it is stored in a small e-prom....
and there is a way to program....but not the way you are doing it....
and the fave problem has to do with power supply....



"Tim H." wrote in message news:[email protected]_s03...
"Jerry G." wrote in message
...
Your reader corrupted the chip. The system is infact designed this way to
avoid being tampered with. You can only have this re-programmed by the
authorized service rep for Kenwood radios. They infact do not support
outside service or any outside parts sales for their products. They will
tell you to send them the radio for service only. Otherwise, no parts...


Well, as I said in another reply, I'm not even seeing the CPU event attempt
to read the EEPROM. I did save the contents when I first read; the contents
were consistent. So, I'll work on trying to get that back into the EEPROM.
Maybe it sets a "do-not-work" bit somewhere....

The serial data from the buttons on the face is interesting...


Thanks for the reply,

Tim



--

Greetings,

Jerry Greenberg GLG Technologies GLG
=========================================
WebPage http://www.zoom-one.com
Electronics http://www.zoom-one.com/electron.htm
=========================================


"Tim H." wrote in message
news[email protected]_s53...
Hello,

I took on a friend's Kenwood head unit (KDC-PS909) with the intention of
reparing it. It would power up correctly, ask for the security code (which

I
have) and turn on but no audio. I cracked it open and noticed a chip,
TC7662, pretty hot Turns out, this is a DC-DC converter. Upon power-up, it
would output roughly -8VDC but soon drop off. Odd, I thought. There was

also
a ground PCB track on the solder side that was toast. It's in the vicinity
of the DC-DC converter chip. I have a new chip coming to me in hopes that
that will fix it.

However, I've created a new problem. While waiting on this chip, I asked
myself, "where is the security code stored? Internal EEPROM, external?"
Then, I noticed an 8-pin chip sitting next to the NEC MCU marked KKZ01.
After a little research, it turns out that this is a 93C46 EEPROM.

Long story short, I removed the eeprom, put it in my programmer and
proceeded to dump the contents. I solder the chip back in and now I have

NO
display whatsoever. So, if the chip was inadvertently written to, would

this
cause the MCU to not display anything in an attempt to fool a would-be
thief?

I've also noticed that there's a transistor used as the +8VDC supply
(2SD2396). If I put my meter on it, power up the unit, it'll show about
+7.5VDC for maybe 11 seconds and bam, it dies out. I'm thinking is

probably
related to the DC-DC chip not doing its thing. Although, it seems to be
under microprocessor control because if I reset the chip, it'll come back

to
+7V and zero out after 11 seconds.

So, the only thing I'm after is a copy of the EEPROM's contents so I can
re-burn it. However, if a corrupt EEPROM won't prevent the unit from even
turning on, I'll pursue other avenues.

Thank You and Good Night,

-Tim






Reply
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules

Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
BP Round Ram J Head Adapter? dka Metalworking 1 March 17th 04 05:40 AM
Printer Reestit Mutton UK diy 16 October 31st 03 11:06 AM
Fisher cassette heads bg Electronics Repair 5 July 30th 03 06:04 AM


All times are GMT +1. The time now is 01:57 AM.

Powered by vBulletin® Copyright ©2000 - 2023, Jelsoft Enterprises Ltd.
Copyright 2004-2023 DIYbanter.
The comments are property of their posters.
 

About Us

"It's about DIY & home improvement"

 

Copyright © 2017