Thales e-Security - Programmers are strange..

This one can probably be filed under 'do they ever give up?' or 'Can I ever win?'

In my day-job I am working with this Thales cryptographic security module - the nCipher netHSM.

The application normally runs as a daemon on Linux so I didn't notice this message until I started it under the debugger.

Basically it constantly issues this message

2014-11-09 22:59:06 [16458] t00c71fc6ff7f0000: pkcs11-sam: 000008d2 Warning: key is considered weak; set CKNFAST_OVERRIDE_SECURITY_ASSURANCES=weak_des to allow

Now I completely agree with this warning in the sense that I wouldn't use DES for anything security critical either. The thing is we are just using the HSM as a fast asymmetric (RSA) key generator and the quickest way to get the private key off the device (and avoid the key policing woe) is to encrypt it and then decrypt it again. For whatever reason the guy who wrote this chose DES as the algorithm so I get this message.

So I set the environment variable and ran it again. It still keeps spitting out a message but this time it says:

t00c71fc6ff7f0000: pkcs11-sam: 000008d1 Warning: key considered adequate because CKNFAST_OVERRIDE_SECURITY_ASSURANCES=weak_des set

Is there any way to make it actually STFU?

Constant Current Dummy Load

What is it?

The internet (and places like the EEVBlog forum) are full of implementations of some variant of this basic MOSFET based constant current dummy load.

It's pretty simple - The positive input terminal of the op amp is connected to a voltage reference and the negative input is connected to a sense resistor. The opamp turns on the MOSFET until enough current flows in the resistor so the voltage matches the reference voltage.

In the example above I am putting a 1kHz, 200mV square wave as the reference which should generate 200mA current at peak.

The current should be constant regardless of the load voltage. MOSFETs can handle large amounts of power and have a very low resistance when saturated (less than an ohm). The circuit looks pretty simple over all. What could go wrong? We'll see below!

Why Do it?

People use these types of dummy load circuit to test the performance of power supplies. For example the 1kHz signal could be used to check how long a power supply takes to recover when the load is varied sharply.

I wonder about the value of this since this is essentially a closed-loop control circuit trying to keep the current constant while connected to another closed-loop control circuit trying to keep the voltage constant. Will you get any meaningful results from this or just some weird interactions between to control loops? I don't know and I'm not sure I would risk it. Certainly it would be a handy way of checking the voltage doesn't drift under load or to check the thermal design etc.

I do want to build a linear bench power supply at some point though and I thought this was an interesting stepping stone towards that goal. Not so much as a test tool but because ultimately regulating the output of the supply is going to be done with a closed look control circuit something like this.

Real vs Simulated

I think the first one of these I saw was put together by Dave Jones on EEVBlog here. Lots of people tried to replicate his design (which is identical to the circuit above) and found it didn't work. The circuit would oscillate at even relatively low current loads.

When I simulated the circuit above, the output was exactly what I expected which is that the voltage on the resistor would switch from zero to 200mV and back to zero.

So then I went ahead and built this up on a breadboard and connected in a 1kHz 200mV signal to the inverting input and guess what? It oscillates! A lot!

So why is it so different to what I simulated? One explanation is that the leads between the power supply and the circuit have some inductance. Lets try adding 1.5uH of inductance and say 0.1 ohms of resistance and see what happens to the simulation. Here is the circuit:

And here is the waveform at R1. The signal on the scope is a tiny bit worse (the oscillations have a slightly higher magnitude) but it is close.

Modeling the Problem

To make this work better we first have to understand what is going on. The problem is the control loop is causing the output to oscillate so we have to fix the control loop. But how do we model the control loop?

One way of figuring out how to stabilise the control loop is to model the open-loop gain of the circuit and then ensure it has at least a significant amount of phase margin. See here. What this means is that where the gain crosses 0dB (which corresponds to a gain of 1) you don't want the phase to be negative. If it is then this means the output is going to be the opposite phase to the input which causes the circuit to oscillate.

The tricky part is the open loop gain needs to be modeled which means you have to break the control loop and model the transfer function. The problem with this is that when you break the control loop you break the DC conditions also and then the results aren't valid.

The way you do this in LTspice is you:

1. Zero out the inputs - we don't want the inputs to perturb our result.
2. Cut the control loop somewhere and place a voltage source in the loop. Set the voltage source to have an AC value of 1.
3. Label the nodes either side of the AC source as 'fb' and 'input'
4. Run an AC analysis and plot the value of v(fb)/v(input).

In my case I changed the voltage source going to the positive terminal to be a fixed 100mV and added the AC source to the loop. if I change the 100mV it effectively will show me the stability at different output loads.

Here is the AC analysis of v(fb)/v(input). As you can see the phase margin is -15 degrees so it makes sense that the circuit oscillates.

Fixing it

So we can see the weirdness at around 1MHz - 10MHz caused by the MOSFET capacitance and the inductance on the output. If we roll off the gain a bit faster maybe the 0dB point will occur while we still have some positive phase margin. So I add a 10n capacitor between the output terminal of the op amp and the negative input and now it looks like this.

That certainly brought the gain down but we still only have 5 degrees of phase margin. If I switch back to my transient response model the output when a 1kHz square wave is applied looks like this

Some pretty serious overshoot but otherwise it looks a lot better. If I make the same change to the real circuit it looks like this:

Still a fare bit of ringing but it looks better.

Now because the MOSFET is effectively a capacitive load for the opamp, I tried adding a resistors between the opamp output and the MOSFET gate. I fiddled with different values but no matter what I couldn't increase the phase margin. Then I tried also adding a feedback resistor between the negative terminal and the 1ohm sense resistor and this cleaned it up a lot. The final circuit looks like this:

The AC analysis looks like this - much better!

And finally it looks like this on the scope when I breadboarded it

Ok so the corners are not as square as my simulation but that doesn't look bad!

Adding components not Supported by LTspice IV

I've been messing around with LTspice IV which is a free circuit simulator from Linear Technology. It is essentially the SPICE circuit simulator (which has been around forever) with a basic GUI including a graph display tool and a means of drawing circuits.

It comes with a broad selection of Linear Technology components as well as a selection of other common components.

Annoyingly it doesn't include some common op amps from other manufacturers (such as a 741 or a LM324 etc). If you want to use cheap components like these it makes simulating harder.

I figured out you can do it however.

I downloaded a SPICE simulation of the LM324 from the Texas Instruments web site. The process for adding a component is

1. Copy the component into the same directory as your circuit files (in my case this was a file called LM32.lib)
2. Hit the .op button to add a spice directive and say
   .include LM324.lib
3. Choose a generic component from the library - in my case this was opamp2 
4. Right click the component, modify the 'value' parameter to have the same name as the name of the model in the file you included. In my case this was LM324. Make sure the prefix is X (not sure why this matters).

Now when you simulate your circuit it will use the model you included.

There is another way to do this where you can add your component to the library but I found that then you have to draw your own circuit symbol. It seems easier to me if you just use a generic component and specify the model.

Keithley 2701 - New Project!

Keithley 2701 Digital Multimeter.

I had so much fun with the Tektronix oscilloscope I bought a broken Keithly 2701 off ebay! Here is how it looked in the advert. They removed the sticker on top before they sent it to me,

As you can see the top looks like it took a knock and the plastic front panel ripped off.

The 2701 is intended for system testing. It has two card slots where you can plug in cards capable of measuring from up to 30 channels, can do a variety of mathematical functions and triggering. It has ethernet capability as well as GPIB and serial. The unit is also not too shabby as a bench DMM as it has 6 1/2 digits accuracy with very low drift.(specs and user manual including mechanical drawings is available here)

To be honest I think this isn't a great unit for home (even though it was pretty cheap). Having a VFD display is attractive as it is easy to read and the accuracy and ethernet logging is nice but I don't really need the card interface. Also it lacks a diode function which would be useful. My thinking was that I would fix it and sell it (hopefully for some profit but really just for the fun of fixing it). I did want to sell it for what I paid for it plus the cost of repairs and I chose this unit as it was much cheaper than the price of similar units in working condition.

Inspection

I pulled the unit apart and carefully checked over the board in case it had been damaged but it looked ok. It did smell a bit suspicious but there were no burn marks, damaged insulation etc and the fuse was ok.

The main board is quite easy to remove. I removed all the connectors and then there are a series of screws around the side, a set of pins screw the DB9 etc connectors to the back. Then the whole board slides across and lifts out.

I decided it all looked Ok, re-inserted the board and re-connected all the connectors.I removed the voltage selector from the rear and configured it for 240V (the local supply voltage) and with the front panel sitting there I powered it on.

It came up and went through it's boot sequence with no errors. The wires going to the front panel probe sockets had all been pulled out. The current wire seemed to go to some sort of metal fitting inside the part where the current plug goes. I turned it off, figured out which wire went where, re-connected them and powered it on. I connected it to my bench power supply (with the current limit set low!), I connected my other bench DMM so I could compare and turned on the supply.

Amusingly it not only worked but appeared to be very close to dead on. My other bench DMM is a HP3478A but while it has lots of digits it is out of calibration. The first 4 or so digits on the HP match my calibrated U1242B. The first four or five digits on the Keithley matched the HP meter so that's great! I swept the voltage through the range of my PSU and it all worked fine. I found some resistors, checked the ohms range, 4 wire ohms range and then connected it to the PSU again with another meter in series and (again being careful with the current limited) checked the current ranges.

It all works! Well on the bright side this means it was a cheap buy but on the down side - where is the fun in that!

Front panel PCB

Ok not so fast - All of a sudden the lights went out! I nudged the screen a bit and then it all came back. I turned it off, turned the front panel over and the ribbon cable came off entirely! Turns out it was soldered into the front panel board and had fatigued off (probably from hanging off the front of the unit for a while).

I have to say I'm pretty unimpressed that the ribbon was soldered to the PCB rather than being attached with some sort of connector but anyway...

Front Panel Ribbon was a bit special in that each wire was a single (non stranded) core. I dug around on the internet and the Element 14 catalog but this is pretty hard to search for (not stranded, single core etc didn't produce any results).

By luck I found an old floppy drive cable and attacked it with side-cutters to find it too contained a single strand per wire.

Before I could solder it in, I first needed to remove the remains of the original ribbon. I snipped the pins off close, added a little solder to each and then used my Rhino ZD-985 to suck out each remaining lead. This went pretty well and left me with a set of clean holes ready for a new ribbon.

The next part was not so easy and that was the task of stripping the ribbon. The length of the stripped wires had to be very even and the wires are thin so its easy to break them as you pull the insulation off. I couldn't use my wire stripped as it would just break the wires. I found the way to do it is you cut the insulation with a scalpel first on both sides (using a ruler you cut a line), Then you use the scalper to cut between the wires in the bit you are stripping. Finally you use pliers to carefully pull the insulation off. This video explains it better than I can https://www.youtube.com/watch?v=rDF6ur9FIhM

Stuffing the conductors into the board was like picking a lock. You gently push down and nudge the one with the most pressure on it into place first and then the one with the next most pressure and so on. I soldered one in place and then the rest was easy!

I put a new connector on the ribbon but to run the new cable back under the transformer I had to remove the main board, and undo the bolts on the transformer. I put it all back together and tested it again and it all worked.

Parts

For the last couple of months I've been getting parts for my 40 year old Tektronix 475 so I figured getting parts for this would be easy.

The Keithley user manual specified part numbers for the front panel and the website said to contact a service centre for repairs and spare parts. I contacted the Singapore service centre which was the closest one for me. They said I had to contact Scientific Devices Australia as they are the local distributor. I emailed them and specified what I was after. Some time passed and I emailed again but no response.

Actually there is a bit of background here worth mentioning - before I bought the 2701 I contacted Keithley about spares for a damaged 2000. The 2000 had a bent and damaged chassis and was in far worse condition. Before the auction for the 2000 finished I contacted Keithley who directed me to Scientific Devices Australia. SDA said it was not economical to repair the 2000 as the cost of the parts would exceed the cost of a new unit ($AUD1895 !!)

I didn't hold out a lot of hope but this time I only needed a single plastic part. I contacted SDA again (using the contact from before).

In addition to the front plastic panel I needed a new front foot. It turns out there is an accessory called a 2000-BENCHKIT that is used to replace the feet and handle if you want to turn a rack mounted unit back into a bench unit. I found one of these for sale at various places in the US for around $30USD

Some time passed and I got no response from SDA so I emailed again and then more time and once again. I then emailed the 'sales' email address at SDA and the general manager responded and said he'd look into it.

Again some time passed and I emailed again. The manager replied saying he was still looking into it but that the cost of the parts would be in the hundreds of dollars. I said I only needed the plastic part not the electronics and checked he understood this. Here is the email:

Not as Yet.

By the way what are you expecting to Pay for the parts ?.                                                                                                                                    

I do now want to disappoint you but I am guessing it will be in the  hundred’s of dollars  due to minimum order charges & freight  etc.

Best Regards

Hamish Clark
General Manager (XXX)

I didn't get any response to this. So now I can't get any response out of the local distributor at all so I emailed the Singaporean service centre again explaining the situation. A couple of days pass and no response. This time I email the info@keithley.com address, explain the situation.

Keithley responds, confirms the part I wanted and then in the final email said:

Hi Tom,

Now the part comes as a front panel assembly and the part number to order is RPT-FP2701. This part include front panel (2701-310-front panel, 2700-313A-overlay and 2701-311A-Display lens) You can order this through Scientific Devices. If I am not wrong the price is around USD200 you can confirm this with our distributor. Let me know if you need any more details.

Ok $200 is a bit steep but not insane. This is a precision instrument and they probably don't sell many and probably don't stock many parts.

Amusingly the local distributor comes back the next day with a quote (what a coincidence!) and said

Tom,

Our apologies for the delay.  The parts just meet the minimum order requirement from that Keithley Department.

This part include front panel (2701-310-front panel, 2700-313A-overlay and 2701-311A-Display lens), unfortunately they do not sell the individual parts.  Also we cannot match the US Price list as we use the ASEAN (International) Price list.

Model 2000-benchkit $49.00 + GST

Model RPT-FP2701 $396.00 + GST

Freight is $130.00 + GST/order.

If you require any further assistance please do not hesitate to contact us.

Best regards

Chris Dawes

State Manager

Scientific Devices Aust

Ph: XXX

www.scientific-devices.com.au

Seriously! $400 for the plastic front panel! They pretty much doubled the retail price on the benchkit too. And then $130 shipping! The parts would be lucky to weigh 200g! The whole unit cost me $80 to ship from the Philippines.

So they want over $500 for two plastic parts!

Ok So I'll Fix it then

So unless I can find a part some other way the only option left was to try and fix it Essentially the front plastic panel is attached with four tabs to the outside of the metal chassis. These tabs have holes in them that snap over round metal protrusions from the chassis.

In my case when the unit was hit the front panel was ripped off and the tabs broke off. One tab was still intact but was bent out of shape.  A bit of heat from my surface mount solder blower sorted it out.

I thought if I could glue on some replacement tabs this might hold. After all they are just there to hold the front panel on. I asked on EEVBlog Forum about the best plastic to use and frankly I was overwhelmed with the response! One guy offered to give me a front panel from another model!

Another guy suggested a product called Devcon Plastic Welder. This isn't a normal hardware store item here in Australia so I had to order it but it was here in a few days.

I found an old drive bay cover from a PC case that had a similar feeling plastic. The plastic was the right thickness too at around 2mm.

I used a hacksaw to cut tabs out of this material that were 15mm wide. I cut off the broken tabs so they were flush with the adjacent plastic. My thinking was that they are thicker at the bottom and I would get a better glue bond with the thicker cross section.

I use the plastic welder to glue on the tabs I cut and I glued some small off-cuts to the outside for support.

 I let this all dry overnight and carefully measure the unbroken tab and the pins they lock onto. The pin diameter I measure to be 6.5mm but in the end I used 7mm to get a good fit. The tabs are 15mm wide and 30mm apart, The holes are dead centre and 28mm up from the ledge in the plastic.

The front foot support bolts over the top of these so you won't seem them when they are done. Unfortunately there wasn't enough clearance to leave the support material in place so I carefully dremeled it off.

I measured and marked up the hole locations, drilled a 1mm pilot hole as accurately as I could and then drilled the 7mm hole.  I test fitted a couple of times and had to ream a fraction here and there. I did mark the current probe tower with the drill bit but didn't cut through it.

After some monkeying around the front panel went on quite well and holds quite firmly.

I'd call that a success!

I carefully re-attached all the wires, straightened out the bent power push rod with a little heat and re-assembled it all. It's tricky to pass get the switch rods, wires and everything all back in at once but with a little patience it all snaps together. I put the lid back on and the back cover.

I powered it on and ran through some tests and it works! And looks Ok!

More Photos

Before I put it all back together I snapped a few more photos of the board. I haven't had much of a chance to really look at it much but it seems pretty nicely made. Some fancy precision resistors plus a gas discharge tube in the background. Not sure about the big pile of high wattage surface mount resistors in the foreground. 

Precision voltage reference plus some bridge rectifiers that are likely part of the RMS converter.

Xilinx Spartan FPGA plus associated RAM. Is that a programming header? Main processor is just above and it is a Coldfire MCF5407 Is that a programming header?

Net+ARM handles the Ethernet interface. Note the routing between the digital and analog parts of the board.

Part of the board is under that Aluminium shield. Note the big resistors with their own bit of exposed copper for (presumably) heat sinking.

Lots of PSU circuit on the digital side. Only a small amount on the analog side. The front end analog switching relays are *really* loud.

The End

So now I am left waiting for the benchkit so I can replace the broken front foot. At that point it is ready to go.

I really should sell it. No really. Ok maybe I can play with it while I am waiting for the bench kit.

Tektronix 475 - Ok I am calling it fixed!

Mixed sweep rates problem

Well to be honest I still am not sure of the cause however this one has kind-of gone away. The problem was that for some B sweep rates the B sweep wouldn't start.

The really weird part is that the same sweep generator is used when in A mode and works fine for all sweep rates.

I looked at the gate signal coming in and found there is a B gate even when the B sweep doesn't start. I thought maybe the sweep disconnect amp Q974 was marginal and not passing the signal through or that something was going wrong on the timing board and the disconnect amp was being turned off.

Initially I thought the signal was not there after Q974 when in the broken B sweep rate but later I realized this was just a triggering problem on my test scope.

I had the thought to compare the signal at the output of Q974 with the output when in A mode and actually the B mode start signal was much smaller. I followed this back and it is much lower after the B gate amplifier (Q996) also.

Unfortunately Q996 is an old transistor that is not easy to replace. I decided to swap Q992 and Q996 to see what would happen (assuming the problem would just move) but actually the problem just went away! Weirdly it now works fine on all B sweep rates. 

For now I think this is near enough and I'll look at it again later if it is a problem.

A Start Problem

The next problem is that for the 0.1ms/div  and 0.2ms/div A sweep rates (when in MIX, A INTEN etc) mode is on the signal starts about half way along the screen and jitters a lot.

Looking at the sweep signal at CR985 and while also looking at the B gate signal you can see what is happening. Basically the sweep signal is not making it back to its initial state before the sweep start is going off. The B gate goes low (into hold-off) at the end of sweep but then goes high again before it has returned where it should.

The slope of the sweep as it returns looks low although not lower than the other slower sweep rates. The other slower sweep rates however wait longer before hold-off ends. At the faster sweep rates the slope of the sweep signal is high enough that the sweep makes it back to the initial level with enough time for some hold-off before the sweep start signal occurs.

If I adjust the sweep hold-off the signal looks fine on the display.

I give up

Given I have just one problem left and I can work around this easily enough I am giving up for now. The scope is very useable at this point. I might come back to this later and have another go but for now I've installed the unit into my test bench and it is up and running and actually pretty useful!

Tektronix 475 - Doh!!

Short Trace

In the last post I was still trying to figure out why the trace got short when the scope was running in the fastest two or three sweep rates.

In the end I asked again on the Tektronix forum and once they got their head around what the problem was the answer was quite interesting. Essentially what I was seeing was normal!

I thought it was a bit of an ask to swing 100V or more within a few nanoseconds to unblank the display and sure enough it *is* too much of an ask! Apparently this is normal for fast scopes at high sweep rates - there was in fact (is in fact) nothing wrong with the blanking circuit. Someone commented on the fact that the delay line is 75ns which is intended to move the start of a fast pulse far enough into the display so you can see it after the scope has unblanked!

Well I'm learning! It would have been useful to know this however.

B Trigger

In the mean time the tunnel diode turned up so I turned my attention back to the B Trigger. I installed the new diode but because of the damage I did to the differential amplifier when trying to calibrate the scope, the only way I can tell it is working is by looking at the waveform on the diode.

Unfortunately the diode didn't seem to change things that much. The signal on the TD was pretty much a flat line no matter what I did with the trigger slope or level control. The signal still seemed to get lost somewhere around the second pair of amplifiers.

I assumed there was a capacitor gone or a resistor gone high-impedance but nothing I tried was conclusive. Out of desperation I tested the two TD driver amplifier transistors (Q776 and Q786). Weirdly it turned out Q776 was bad! How did I miss that! Turns out it is the same as the one used in the unity gain amp so I had spares. Changing this transistor now meant I do get a small signal on the tunnel diode when I adjust the trigger level but still nothing like the change you see on the A trigger diode.

The more I thought about it, the more I thought that this is not going to work without the hold-off signal coming back from the end of sweep. The trouble is I broke the B sweep before when trying to calibrate the scope and am still waiting on parts.

B Sweep

A couple of days later the JFET transistor pair I ordered turned up. I carefully organised the six leads on the thing and replaced the broken part. I turned the scope on but.. well nothing - no B sweep but now no A sweep either. If I remove the dual FET A sweep works again.

I tried fiddling with the time delay knob and measuring the voltage on the output of the delay pick-off but this looked Ok. I plugged the FET back in, turned it on and noticed that the graticule illumination was dim and when I moved the delay knob it changed. Hmm

There is a transistor configured as a current source for the differential amplifier formed by the dual FET and the dual bipolar transistors above it (Q928). I pulled this out and sure enough it was broken - a dead short in fact. I replaced it and now I have B sweep!

I switch the B trigger mode from 'starts after delay' to trigger on Ch 1 and hey this works! If I fiddle with the trigger level, the B trace moves!

Combinations of Sweep Rates

So the final problem is that some sweep rates don't seem to work. For example, in MIX mode setting the B sweep rate to 50,20,10,5 or 2 us per div doesn't work - the A sweep rate just continues through to the other of the delay point. If you select B Delayed while in these speeds you get no sweep at all.

The odd thing about this is that the B sweep rate is what is used to generate the A sweep in A mode and *all* the sweep rates work correctly in A mode.

Some A sweep rates (in MIX or A INTEN mode) don't work either, The trace will start really late or you get multiple traces over each other. Adjusting the trigger delay cleans this up however which makes me think the circuit for cutting off the B sweep at the end of the A sweep isn't working but I haven't found any fault in that yet.

It doesn't make sense in terms of the switches in the B timing circuit.

This one has me stumped again...  Back to the bench...

Tektronix 475 - Still Stuck

Short Trace

So I am still waiting on parts to fix the B Sweep and to make progress with the B Trigger. Last time I was working on this odd problem where the start of the trace is lost when running at the three fastest sweep rates.

I'm pretty stuck. The problem is it sort-of works so there is no component that is clearly broken. Something in there is marginal but I'm not sure what.

Things I got wrong

I got a couple of things wrong when I was looking at this last time. First of all I was looking at the Z BNC on the back for output but this is in fact an INPUT <forehead smack>.

The second thing is that the signal coming out of J1333 is a current signal not a voltage signal. This is why the waveform looks really messy (depending on where you look). This is also why it looks quite different at Q688 if I disconnect the coax.

Theories

Here is the circuit diagram again as this will be useful here

Unfortunately I have a few theories but none of them seem to be leading anywhere. What it worse is that I tend to cycle between them as one theory becomes less likely! The theories I have examined (and none look good so far) are:

1. There is a delay introduced somewhere (bad connection, open circuit resistor, bad capacitor). Looking at the signal before Q1338, after Q1344 and even at the output makes me think this is not the case.
2. The gain on Q1338 is somehow too low so the output is not climbing fast enough. I haven't totally discounted this one and someone on the Tek forum suggested this also. They suggested I check C1330 in case this was broken as it could lower the gain of this amplifier but unfortunately it checks out. I also checked all the resistors, diodes and inductor in that area and they check out. I checked the voltage across R1342 is zero when beam finder is not pressed so the diode doesn't appear to be leaking. The voltage drops across the CR1343 and CR1341 make sense.
3. Q1354 and Q1358 are not turning on fast enough. They both have baker clamps across them to improve their turn-off performance (to prevent them saturating) but this won't help their turn-on time. I thought perhaps if the diodes were leaking this could slow down the turn on but both checked out fine. I even pulled CR1354 as it looked suspect but it checked out Ok when out of circuit.
4. The charge 'boost' isn't functioning. Ok I'm not sure I understand this circuit but essentially the capacitor C1358 gets discharged through Q1358 and Q1354 when the push-pull drives the output high. Q1362 will charge the capacitor up again when the output if the Z amplifier goes low. I presume the capacitor is there to provide a sharper rise curve which is why I looked at this. I can see the voltage on C1358 fluctuate but it seems to drop fast and then bounce back up again (getting charged via R1348). If I look at the voltage on the emitter of Q1362 it drops and then rises like a capacitor charge curve so I have to presume this is working. I even replaced C1366 as I couldn't test it (1pF) but it made no difference. Interestingly if I remove Q1362 from the circuit entirely it makes no difference to what is displayed on the screen! I don't understand the voltage trace on C1358 at all really - I would have thought that it would go low and stay low until recharged by Q1362.
5. The 6,2V Zener diode (VR1362) reads about 6.0V. Interestingly there is a small chunk of the glass missing and the soldering on one of its legs looked dodgy. I touched up the soldering but given it is a 5% tolerance component 6.0V is still within spec.

So overall I am pretty stumped! Help!

Tektronix 475 - A step backwards

Ok it's been some time since I posted anything. I'm still pretty busy with work so I'm a bit limited on time to work on this. I have been working on it but only in small snatches of time and hence I've not had time to update the blog. So here it is a - a big update.

B Trigger

I looked at the B Trigger some more and compared the signals with the A trigger circuit. I tried to trace the signal through the amplifiers following the paraphase amplifier chips to see where it disappears and it does some to around Q776/Q786 but it isn't apparent why. The transistors look Ok so then I thought maybe the hold-off signal wasn't getting through to reset the tunnel diodes.

After lots of head scratching and looking I got desperate and simply swapped the tunnel diodes (I did this before but only one diode). This time I swapped both diodes from the A trigger to the B trigger and when I did the A trigger stopped working! Interestingly B trigger still didn't work but this is still progress.

I'm pretty sure the firing TD is damaged. I went to order a replacement and found they are not so easy to come by. I found this ebay vendor called Tucker that had some but the shipping was a bit over the top. Their website had the same part for a bit less shipping and not having much choice I ordered the part. I didn't see an order confirmation so I checked my emails and found the paypal notification. I noticed the part number was wrong! The part I accidentally ordered was a 152-0368-00 which is a diode for a different kind of scope (not a tunnel diode at all) - the one I wanted was 152-0386-00. Unfortunately they had already shipped it so I had to order *another* one. They said they would accept the wrong part back at least.

Calibration and Oops

Now apart from the B trigger the scope is pretty useable now. I thought if I calibrated it so the timing and voltage measurements were roughly accurate it would be fine until the part arrives. I started going through the calibration procedure and found I could do lots of it but there were a few steps I couldn't as they needed a signal insertion unit or a 200MHz signal generator (I have an accurate 20MHz Siglent unit but that's all).

This went really well - the waveforms look cleaner and now that it all lines up correctly it just works so much better.

At one point in the procedure I was adjusting a pot on the vertical output board which is inside the cavity next to the tube and (stupidly) I was using a metal screw driver (as I don't have a proper low capacitance one) and I bumped the leg of another capacitor! The screen fuzzed for a second but returned and it looked ok so I didn't worry. The next day I was looking at it and I realized the B sweep wasn't working at *all*. In Mix mode you only see the A sweep and in B Delayed you see nothing at all. Damn! I broke it!

B Sweep

I figured out I must have touched the leg of C1072 with 50V on the pot :(

My guess was this affected Q920 or Q984 in the sweep circuit. I quickly put a scope probe on these transistors to see if the sweep sawtooth was there and quickly figured out Q922 was toast. (See below)

Thankfully this was a 2N2369 which I already had from a separate repair. I replaced it and while the MIX, B DLY etc modes still didn't work, when I put the scope on this transistor I could see the sweep was running. In fact all the sweeps were running so why no B sweep? 

I thought maybe Q1086 could be bad but it is deep on the timing board which you can't get to without removing the sweep logic and trigger board. After some faffing about I went for it and removed the board. This went smoothly and I checked all the transistors I could see and all were Ok. I couldn't run it like this unfortunately.

So then I read the circuit descriptions again and realized that the delay after magic depends on this differential amp formed by Q938, Q940, etc. So I had a look at the levels on the output of the delay amp and they looked fine. I already checked the sweep sawtooth was present on Q926B's base so then what? Q940 looked ok as did Q944 an Q946 and even then these are to do with blanking.

I looked at the output of Q938 and there wasn't a signal there.The diodes looked fine. I pulled Q938 and tested both sides and they looked ok (normal bipolar transistor). I pulled Q926 and it didn't look right at all - this makes some sense. It looks like I killed it :( Again this is a special part and thankfully QService has one so I ordered it.

Fast Sweep

At this point I can't work on the B trigger, problem as I need parts. Also, I can't work on the problem where certain combinations of A and B sweep rates behave oddly as ... well I have no B sweep visible. So then what? I could park it for now but I remembered that when I was calibrating the scope the faster sweep rates seemed to 'fade in' from the left.

Slower sweep rates start at the very left but the faster one progressively start later. The photo above shows a 20MHz signal on the fastest (0.01us/div) rate.

Clearly this is a blanking problem. If I turn up the intensity I can see the start of the waveform (as well as the retrace unfortunately).

I looked at the waveform at the collector of Q698. This is the blank signal that goes out to the Z amplifier. The signal looks like a ringing mess!

If I remove the coax the signal looks Ok.

I looked at the signal that drives this on TP588 and it looks fine!

So then I attached channel 1 to the Z axis output on the back of the scope and the signal is practically not there. Even at the 20mV/div setting of the scope it is barely a bump.

So then I dug into the Z amplifier a bit more and even though the input signal and the Z axis output looks broken, the output of the amp seems to be Ok. 

Here the yellow waveform is the collector of Q1352 and the blue waveform is TP588. The signal is pretty clean and the delay between them seems minimal (20ns or so).

So I have no idea why there is a delay :(

Hmm...

Tek 475 Triggering

It was the paraphase amplifiers!

Unfortunately I've not had much time to work on the old scope lately. I've been flat out with work every day and evening as well as the weekends.

So anyway - I placed an order with QService for a pair of the Tektronix custom paraphase amplifier chips and a pair of 2N4258s (NOS Tektronix parts) to replace the 2N2907 I temporarily put in the input source followers of the trigger circuits. Then I waited... and waited... and eventually my parcel turns up.

Overwhelmed with the excitement of possibly making some progress I whipped out the A trigger amplifier, stuck in the new chip (which was tricky as the pins were not as straight as I would like and the metal is very soft!) and... It worked! I have A trigger!

I replaced the B trigger chip too but still no B trigger. Oh well.

I replaced the 2N2907s and while this didn't have a huge effect I did notice it triggers off the centre of the waveform now when the trigger is in the centre.

B Trigger

So then I looked at the B Trigger in more detail. Initially I thought I might have mixed up the replacement chips but I carefully swapped the chip in the A trigger circuit and found I had exactly two (of four) that worked. So both the the paraphase amplifiers were stuffed allright.

The nice thing is that as the two trigger circuits are nearly identical so I can compare voltages and waveforms.

First off I compared the output of the amplifier (pin 8 and 9 of the chip) and noticed this seemed distorted. I figured out if I twiddled the trigger level knob far off centre I could nearly get it to look normal. I looked at the input (pin 3 and the testpoint) and it looked correct. I remembered that the source follower has to have unity gain and has a DC bias of about 0.6V and so I checked this. The gain was quite close to unity but the offset was more like 1.4V.

I spent ages looking at what could be causing the bias. The base of Q746 already had a bias so it had t be before that. It wasn't any of the resistors or capacitors around the two JFETs. There was no bias on the input to the source follower. That at least narrows it down! The voltage drop over R739 was zero so the diode wasn't leaking (it's only there to prevent big negative going signals damaging things).

The JFETs are a matched pair and have the aluminium bracket around them so they are thermally bonded (see photo below). I undid this and swapped the JFETs around and noted that then the offset changed! This shouldn't happen as the JFETs should be identical. I put each into my trusty transistor tested and both tested Ok but with a very marginal difference in characteristics. So they are no longer matched? I had some other JFETs of equivalent type from the sweep circuit work but none of these were close to a matched pair.

Back to QService again... I ordered a matched pair of these JFETs. A week and a bit later they came, I put them in and now the input source follower is working correctly - the gain is right, offset is right etc but still no B trigger!

Starting to wonder if this thing will every fully work!

Vexing C++ template issue

This is a pretty well know difference between the Visual Studio C++ compiler and GCC.

I wanted something that can clone a vector of pointers so I created

    template< class ContainerType, class ElementType >
    ContainerType *copySTLContainerPtr(
        const ContainerType *rhs )
    {
        ContainerType *returnValue = new ContainerType;

        ContainerType::const_iterator i;
        for(i=rhs->begin();i!=rhs->end();i++)
        {
            returnValue->push_back( new ElementType(*i));
        }

        return returnValue;
    }

Now this compiled just fine in Devstudio but GCC complained that const_iterator effectively didn't exist - it said it expected a ; before 'i'

Turns out that to make this work you have to say this instead

     typename ContainerType::const_iterator i;

This is pretty well documented on stack overflow here  

In honesty I've had this problem before but it took a while to dredge my memory. While searching for this I also found a really neat page describing some quite obscure C++ features includes templated template parameters, pointer to members and other cool stuff you may not have seen. Check it out here if this is of interest.

Google Mock - Dammit gets me every time

Actually this isn't Google Mock's fault but it does catch a code error.

I have a class

class MyServiceInterface
{
public:
   virtual void provideAService()=0;
   ...
};

Then I have a mock for this

class MockMyService : public MyServiceInterface
{
public:
    MOCK_METHOD0(provideAService, void());
};

In my test I expect it to be called

EXPECT_CALL( *mockService, provideAService());

When the test finishes I get this error. It's weird as I used a smart pointer to hold the pointer to the mock.

c:\work\XXX\test\src\MyServiceTest.cpp(132): ERROR: this mock object should be deleted but never is. Its address is @04334590.
ERROR: 1 leaked mock object found at program exit.

Yes the solution is obvious - the MyServiceInterface has no virtual destructor. The following to the service interface definition and we are all good.

virtual ~MyServiceInterface() { };

It just catches me out often enough that I thought if I write this out I might remember...

Tektronix Scope Probes

So now that the work on the scope looks like it is going somewhere I went looking for a set of probes.

I found a guy on ebay selling Tektronix P6063B passive probes. These are quite nice I think as they are like 12pF in x10 mode and have 200MHz of bandwidth.

Also, as they are proper Tektronix ones they have this feature where the scope can tell if they are in x1 or x10 mode and the scope will change the volts/div reading accordingly. Essentially the scope has two lights that glow through the skirt to show you what volts/div setting you are on. If it is in x1 mode it lights the left light and if you are in x10 mode the right hand one. It figures this out based on a 3rd connection on the skirt of the BNC connector.

Another thing I liked is they have a feature where they from the probe tip you can flick a switch and it grounds the signal so you can see the background noise level.

The age of them is a hoot too. They were sealed in plastic bags when I got them - never been used. Checkout the date on the instructions! 1986! Wow!