[time-nuts] FE-5680A ("New" version) fine frequency adjust

Peter Bell bell.peter at gmail.com
Fri Nov 18 20:01:17 EST 2011


HI. Magnus

This device is basically 4 "PAL54V18"s with a switch matrix - I'm sure
you could get something out of the JEDEC files if you could read them,
but from my experience of the Xilinx fitting tools they seem to
randomly spray product terms all over the place and it's often easier
to reverse engineer the device based on it's observed behavior -
especially in a case like this where pretty much all the logic just
seems to be counters.

I have been making some notes while looking at these things - my plan
is to clean them up and put them into a CAD package once they are a
little more coherent - I was also thinking that dumping the firmware
would help a lot with sanity checking on the digital side of things.

Right now, the big remaining grey box is the servo - the front end
after the photocell looks a lot like a lock-in amplifier, and some of
the other stuff (like the ramp generator to sweep the VCXO when
looking for lock) makes lots of sense - but the rest of it doesn't -
which probably means I've missed some connections and components out.
I was looking a lot harder at this, but when it became obvious that it
was the actual Rb absorption cell that was dead trying to figure out
how the electronics worked seemed less important...

Regards,

Pete

On Sat, Nov 19, 2011 at 8:37 AM, Magnus Danielson
<magnus at rubidium.dyndns.org> wrote:
> On 11/18/2011 08:45 PM, Peter Bell wrote:
>>
>> The Xilinx chip (which is strictly speaking a CPLD) is programed via
>> JTAG - all the required pins are on the test connector on the edge of
>> the board.  In theory, you can also read back the fuse maps using the
>> JTAG port if the chip hasn't been secured. I haven't actually tried
>> it, because I expect the chip IS secured - and a raw fuse dump is not
>> that useful anyway for anything except copying the device.
>
> With CPLDs you still have a fair chance. I have reverse engineered PALs from
> the JEDEC dump. In the process I also concluded that they where PAL
> beginners, since they didn't use the internal feedback path but did it
> externally.
>
> However, most of the CPLD logic should be easy to clone without the source
> just by monitoring what it does. Frequency dividers eats the flip-flops
> quickly, so with known ratios it becomes easy to estimate remaining terms.
>
> Reverse-engineering is fun and you learn things. Somebody drawing a
> schematics in the process? Even partial schematics can be of help.
>
> Cheers,
> Magnus
>
> _______________________________________________
> time-nuts mailing list -- time-nuts at febo.com
> To unsubscribe, go to
> https://www.febo.com/cgi-bin/mailman/listinfo/time-nuts
> and follow the instructions there.
>




More information about the time-nuts mailing list