Calling on Motronic experts: IC information

[hardtailer]

I updated my last post but decided to put the picture in this separate/new post.
This is what the signal op pin 33 currently looks like...

[ischmitz]

I hate to sound like a broken record but you are not supplying any new information. The watchdog keeps triggering and pulls the RST line high for 12 msec and then pulls it low for 24 msec. Refer to the second portion of the SPICE simulation Gilles posted. This results in the a 36 msec or 28 Hz pattern most pins of the 8051.

When the RST line is pulled high the 8051 halts all activities on the bus and that lasts for 12 msec. Once the RST line goes low for 24 msec there appears to be activity that your current scope settings are not resolving.

If the code doesn't produce a proper ICV signal on pin 5 of the 8051 this keeps repeating. Put the oscilloscope on pin 5 of the 8051. If you see the same 30 Hz pattern your DME is brain-dead. If you see an 80Hz ICV signal you can go to the next step of troubleshooting.

[hardtailer]

Thanks for hanging in there with me.
I checked the 3 EPROMs I have, to identify those which work in the OK DME and found that the one that was in the NOK DME during the short circuit is damaged.

Putting the known good EPROM in the NOK DME I still get the reset signal on pin 9 of the uC...
Jumpers to make the DME work with 256kB EPROM are identical in both DME's: B700, B701, B705, B706

To summarize:
-All IC's replaced apart from S703 ADC
-known working EPROM
-5V DC supply to the digital board after replacement of 5V regulator and track on analog PCB.
.All diodes tested ok
-All capacitors tested ok
-ALE signal of 8051 replacement correct at 1MHz

But 8051 replacement keeps resetting.

Where do I look next?

[ischmitz]

The digital part of the DME is extremely simple and you already have clock. That leaves the address and data bus realized by a transparent latch and a couple of pull-up resistors on the higher address lines. The only other item is a NOR gate to generate the OE! for the EPROM.

Remove the ADC, power up the DME and then disable the watchdog by grounding the RST pin of the 8051. Look at the pin 5 for the 80Hz ICV signal. If present the watchdog circuit is damaged. If not present its an issues on the PCB (shorts, opens, etc.) or one of the components (8051, EPROM, 74LS373, 74LS02).

[hardtailer]

Thanks for your reply, I'll give that a go.
Can I pull pin 9 to ground directly, without a resistor inline (as R892/1kOhms is there)?

[hardtailer]

Thanks for your reply, I'll give that a go.
Can I pull pin 9 to ground directly, without a resistor inline (as R892/1kOhms is there)?

[wazzz]

Originally Posted by hardtailer

Thanks for your reply, I'll give that a go.
Can I pull pin 9 to ground directly, without a resistor inline (as R892/1kOhms is there)?

Yes you can. The LM139 output will be shorted, but it doesn't matter, as it is an open collector output. Only a 5mA current will be drawn through the R892 resistor, which is nothing. Just short pin 9 to ground and see what happens.

You should also check and maybe replace the 74LS373 as well as the ADC. And maybe set all packages on sockets so they can easily be replaced without being soldered.

On a side note, how did you manage to remove the 40-pin MCU? Did you unsolder it as a whole with a heat gun or did you use cutting pliers to cut each pin first then unsolder and clean each pad separately?

[mysocal911]

Originally Posted by wazzz

Yes you can. The LM139 output will be shorted, but it doesn't matter, as it is an open collector output. Only a 5mA current will be drawn through the R892 resistor, which is nothing. Just short pin 9 to ground and see what happens.

You should also check and maybe replace the 74LS373 as well as the ADC. And maybe set all packages on sockets so they can easily be replaced without being soldered.

On a side note, how did you manage to remove the 40-pin MCU? Did you unsolder it as a whole with a heat gun or did you use cutting pliers to cut each pin first then unsolder and clean each pad separately?

Another less aggressive approach is to use heat & a solder-sucker on each pin. It better preserves the chip & the circuit board.

[hardtailer]

Thanks for chiming in, Gilles.

Knowing me, I used sockets on all IC's I have replaced in the meantime and bought 2 of each IC ��
The ADC is not readily available anymore in DIP-package, so have not bought that (yet). Apart from this one and S100 I've replaced all IC's on the digital board.

I desoldered the uC using flux, solder sucker and de-solder wick 'soaked' in flux.
Worked well, all pads stayed on the pcb.

[mysocal911]

Originally Posted by hardtailer

Unfortunately I cannot remember exactly were/what I shorted as it was about 2 years ago but it was on the PCB to which the 35 pin socket is attached.






The pads and tracks for the dc/dc convertor Unfortunately didn't survive the replacement and were substituted by the grey wires.
New spring clamp rivets will be fitted or I'll replace therm with screws and nuts.

I've seen this Mickey Mouse approach to replacing the one/three devices attached to heat sink by cutting the three rivets attaching the spring.
A simple approach is to just cut the two rivets at the PCB and remove complete heat sink assembly, after desoldering the devices attached to the assembly.

[wazzz]

Originally Posted by hardtailer

Thanks for chiming in, Gilles.

Knowing me, I used sockets on all IC's I have replaced in the meantime and bought 2 of each IC ��
The ADC is not readily available anymore in DIP-package, so have not bought that (yet). Apart from this one and S100 I've replaced all IC's on the digital board.

I desoldered the uC using flux, solder sucker and de-solder wick 'soaked' in flux.
Worked well, all pads stayed on the pcb.

The ADC seems to be still available in DIP-28 here: https://www.futurlec.com/ADConv/ADC0809pr.shtml

Only $2.90 plus $4.00 for shipping.

[hardtailer]

Thanks for the link. After contacting futurlec to check if they had it in stock, I ordered the last ADC they had.

Having removed the ADC I checked the signal on pin 5 of the 8051 replacement but rit didn't show the ~80Hz signal., unfortunately.

I also bought a logic analyzer https://www.embeddedartists.com/products/labtool/ but installing the drivers is a royal pain and I've not managed to get it to work. Contacted their product support and am awaiting their reply.
I hope to identify with it why the uC keeps receiving the reset signal.
Till I get it working progress has halted, unfortunately.

[hardtailer]

Originally Posted by ischmitz

The digital part of the DME is extremely simple and you already have clock. That leaves the address and data bus realized by a transparent latch and a couple of pull-up resistors on the higher address lines. The only other item is a NOR gate to generate the OE! for the EPROM.

Remove the ADC, power up the DME and then disable the watchdog by grounding the RST pin of the 8051. Look at the pin 5 for the 80Hz ICV signal. If present the watchdog circuit is damaged. If not present its an issues on the PCB (shorts, opens, etc.) or one of the components (8051, EPROM, 74LS373, 74LS02).

Parts from Futurelec are still underway but I got the logic analyzer working.
Picture below shows the (un)grounding of the reset pin 9 on 8051 with ADC removed @20kHz sampling rate.



I then observed the following, sporadic behaviour (not pulling pin 9 to ground), again at 20kHz



Looks to me that the few times when pin 5 goes from high to low, the appearing signal form at pin 6 of LM373 starts to look like it does in wazzz's simulation between +20 and +31.1 ms.

Analyzing LM373 more closely:


Can the experts deduct anything from these graphs regarding cause of uC resetting continuously?

For completeness sake the 4th OPAMP connected to uC pin 10 RXD:




Other signals on the uC 8051:
@20kHz, pins 2 to 9 RST, 18 XTAL2, 19 XTAL1 and 30


pins 21-24 and 32-40


pins 21-24 and 32-40, some moments later


the above are repetitive (no surprise there).

@30MHz (f_ALE=1MHz, f_XTAL2=6MHz)


@30 MHz


Next EEPROM 27C256 pins 2 to 13 (13= analogue channel just to use all available channels), @20MHz



ADC removed in all graphs. I found no short and open circuits (used a magnifying glass) and all IC's have been replaced in the process. That is not to say that they have become damaged again in the process but still.

I don't know how to check the transparent latch or "the only other item is a NOR gate to generate the OE! for the EPROM".

[ischmitz]

Sample A0-A13 with 1Mhz using the external clock input of the logic analyzer connected to ALE and trigger to RST. Sample on the falling edge of ALE. You should be able to decode the long jump from 0x0000 to the reset vector.

[mysocal911]

At this point in time, you most likely have a logic PCB problem, e.g. an open circuit trace, a poor top/bottom jumper, or a damaged solder connection.
Also, the PCBs are the early non-fiberglass types which are less reliable.

[wazzz]

This one is fiber glass, I think. hardtailer posted pics of it a few weeks ago. Remember, it comes from a BMW M3 E30.

[ischmitz]

Here is an example of a healthy startup. Shortly after the reset goes low the 8051 starts reading the first instruction at address 0x0000. The first three bytes in the EPROM are 02 02 0f and this decodes to LJMP 0x020f where the reset routine below starts. The code on your DME is in all likelihood identical:



In the logic analyzer trace you can see the processor reading the first three bytes and then executing the LJMP to 0x020f where it continues to read external code memory.



Zooming out in the logic analyzer capture you can see where the ICV signal begins cycling by going low 17.84ms after reset and then high 23.38ms after reset. Signal period is 11.68ms or 85.6Hz.



So in summary 17ms after powerup the DME is ready and waiting for flywheel inputs. Sorry for the picture quality. I don't know if there is a way where the BBS software doesn't down sample them.

[mysocal911]

Originally Posted by wazzz

This one is fiber glass, I think. hardtailer posted pics of it a few weeks ago. Remember, it comes from a BMW M3 E30.

Post #33

The key is the side view of the PCB. All have green tops/bottoms, but the early ones are beige in the middle.

[hardtailer]

Thanks for re-visiting and your inputs, gentlemen!
Unfortunately, my logic analyzer does not have a provision/input to use an external clock. It has 11 channels + 2 channel oscilloscope, so hooking up A0-A12 (didnt see A13 on the schematics, was that a typo?) already forces me to use the oscilloscope to scope digital signals and leaves no means of connecting ALE and RST to the analyzer for sample and trigger.
What pin is the channel designated 'parallel' im your graph, Ingo? Tbh I don't understand how I get the hex code.

I connected A0-A7, RST, ALE, RXD (UART decode to HEX, @9600 baud), TXD (same decode) and PSNE but the decode didnt yield any sensible results.

PCB is fibreglass.

[ischmitz]

The channel “Parallel” is a protocol decoder that uses the address lines to calculates a hexadecimal number. It makes the data more readable.

You don’t need clock or other inputs. Just sample the address signals A0 - A9 on the EPROM. If your init LJMP uses the same argument (check your EPROM content first three bytes) you only need A0 - A9 to confirm the LJMP takes place. That leaves one more digital line you may use for trigger on RST or something else.

I used 10Mhz sampling and no clock. If you don’t have a way to trigger off the RST line just sample for a coupe of seconds start the data collection, and power on. Then find when RST goes low in the data.


Check the EPROM content for the first three bytes and confirm the 8051 reads the first three bytes and jumps to the correct address.