Quick Repair: Standford Research PS350 5KV 5mA(Fixed but working on calibration)

[alm]

here's an update.   I did a WORD 0,0 and wow what a change
at 0v actual volt was ~2400V
at 3000V it ran to 5600V  (this is interested)

Seems definitely an offset.

I then tried word 0,2477 and at 50V i got 48.4 which means the higher value actually lowered the output

Which matches my observation that it is subtracted from vset.

next I tried setting word 1 to 0 with word 0 back to normal
with the word 00 at 0v I had ~650V on the DMM
everything below 3000V was scewed. above 3000V things where basicaly normal

This matches my observation that word1 is used if vset < word0. We established that word0 corresponded to something like 2.5 kV, so it makes sense that word1 is used for values below 2.5 kV. If you were to change word2, I would expect the values above 2.5 kV to be messed up.

I'l do more checking and will actually need to try to find at which values does each word have effect.
short of tring to figure out the code now that we know where cal values are

I disagree. I think analyzing the code is the easier route, but obviously we should double check with the real equipment. For example, do you see any effect in any mode/polarity if you set word 12 to 0? The value of word 12 is identical to word 0 (suggesting a vset offset to me), but according to my analysis it should never be used.

Especially if I am right that there are two non-linear parameters that affect vset, I think that black box reverse-engineering will require a large number of points to establish the response (although I imagine you could brute-force it with a voltage PS350 and a voltmeter both under computer control). I believe we have narrowed down the code that it is responsible (see my previous), and it is just a matter of studying that code in more detail.

My current theory is that for v_set, the dac value is:
\[
   dac(v_{set}) = \left\{
     \begin{array}{ll}
       f(word_0-v_{set}, word_1) & : v_{set} < word_0\\
       f(word_0-v_{set}, word_2) & : v_{set} >= word_0
     \end{array}
   \right.
\]
Where f(x,y) might be a multiply or something similar.

[Dexter2]

I have been playing around on my PS350 and I can confirm they use  three point calibration for all parameters and positive and negative polarity separate what comes out from what alm has identified in the code and smgvbest tested.

This way they can compensate for some degree of system nonlinearity. In theory you could run the DAC from 0 to full scale and see where the ideal mid-point would be and then compensate with W1,W2 factors but what it seems from all calibrations available to me they just set the midscale first with W0 offset and then compensate for the values below and above.

I have made a small graphic to illustrate after confirming on the instrument itself what they do. It’s just an illustration of alms equations:



One additional thing I did find out is what that W12...17 are. They calibrate the read back voltage value that is shown on display and read back over GPIB with VOUT, IOUT:
W12  +pol voltage readback display offset
W13  +pol voltage readback display scale if vset < W12
W14  +pol voltage readback display scale if vset >= W12
W15  +pol current readback display offset
W16  +pol current readback display scale if vset < W15
W17  +pol current readback display scale if vset >= W15

I have also been able to calibrate my PS350 voltage set and read back in this way quite successfully up to now, for current I have to build some custom high voltage resistors to make the calibration.

The procedure i used so far:

• Set Vset to 2500V
• Modify W0 until reference DMM reads 2500V
• Set Vset to 100V
• Modify W1 until reference DMM reads 100V
• Set Vset to 4500V
• Modify W2 until reference DMM reads 4500V
• Set Vset to 2500V
• Modify W12 until PS350 display reads 2500V
• Set Vset to 100V
• Modify W13 until PS350 display reads 100V
• Set Vset to 4500V
• Modify W14 until PS350 display reads 4500V

One thing to watch out the last digit of the scale values is strange it seems as it determines the sign of the multiplayer or something as if changing it from 49560 to 49561 screws up the display completely but in steps of +/-10 its ok (Tested on W13). Probably it’s the same for all other factors I have not checked.

[smgvbest]

Wow,  I get up and what wonderful posts to wake up too.
I'd still love to match this with the actual code as @alm mentions.  if he is willing to continue to assist (your disassembly skills exceed mine) that would be great.
@Dexter2  thank you so much for your checks.

tasks as I see them are
1.  Continue looking at code to verify all calibration options.
2.  Verify calibration options (testing at DUT)
3.  Develop and test manual calibration procedure (for VSET looks like this may be done)
4.  Develop and test automated calibration procedure (python or perl code preferred as not everyone has other tools)

is anyone interested in #4?

there is a possibility of extending the range of the unit beyond 5Kv but to do safely we'd have to hack not only the firmware but the HV section.   some components are not rated more than 6Kv (C5 & C8) while components in the cockcroft multiplier are rated at 4Kv (C1-C4)
any one interested in pursing that or call it quits with the calibration?

[Dexter2]

I managed to fully calibrate my unit (except the ITRIP and VLIM). Only need to burn the new EPROM now (hope there are no CRC checks)

I also made a small crude program with it you can quicklly change parameters and get the calibration for Voltage/Current done. So it does not calculate anything it it just a quick tool to do it by hand and to modify the Firmware at the end. Program is in LabView. To keep it simple the GPIB interface is initialized trough niMAX.



And for the end the new memory map. Still a few locations are unknown. Any Ideas?

[alm]

I have been playing around on my PS350 and I can confirm they use  three point calibration for all parameters and positive and negative polarity separate what comes out from what alm has identified in the code and smgvbest tested.

Thanks for doing these tests!

This way they can compensate for some degree of system nonlinearity. In theory you could run the DAC from 0 to full scale and see where the ideal mid-point would be and then compensate with W1,W2 factors but what it seems from all calibrations available to me they just set the midscale first with W0 offset and then compensate for the values below and above.

That is obviously the fastest way, and may be sufficient depending on the INL of the system and the specifications. It could be that they do a linearity test as part of the performance verification, but we'll never know without a calibration procedure (beyond 'no user serviceable components inside'). Obviously offset and gain is also the extent of the adjustment in purely analog power supplies with trimmers, but I could see a high-voltage having a more sophisticated scheme because of possible voltage coefficients. Too bad they do not even publish an incoming test or procedure to verify the performance against published specifications like some other manufacturers.

One additional thing I did find out is what that W12...17 are. They calibrate the read back voltage value that is shown on display and read back over GPIB with VOUT, IOUT:

Thanks! That makes sense. I have not looked at the readout display at all. Now that you mention it, I should search for the address of word 12 and will likely find the readout code.

I have also been able to calibrate my PS350 voltage set and read back in this way quite successfully up to now, for current I have to build some custom high voltage resistors to make the calibration.

Nice! I wonder about doing VLIM. There are software checks that limit VSET < VLIM which may prove an obstacle to testing the analog (crowbar?) circuit. Maybe deliberately programming W0-2 or W21-23 to be x% high?

One thing to watch out the last digit of the scale values is strange it seems as it determines the sign of the multiplayer or something as if changing it from 49560 to 49561 screws up the display completely but in steps of +/-10 its ok (Tested on W13). Probably it’s the same for all other factors I have not checked.

Interesting, I will see if I can find out anything in the code.

I'd still love to match this with the actual code as @alm mentions.  if he is willing to continue to assist (your disassembly skills exceed mine) that would be great.

Sure, I will do some digging in some of the points Dexter2 raised. Let me know if you have additional questions that could be answered from the code.

is anyone interested in #4?

I am interested, but given my lack of access to the equipment (or plans to acquire one), I think my help would be limited to suggesting algorithms.

there is a possibility of extending the range of the unit beyond 5Kv but to do safely we'd have to hack not only the firmware but the HV section.   some components are not rated more than 6Kv (C5 & C8) while components in the cockcroft multiplier are rated at 4Kv (C1-C4)
any one interested in pursing that or call it quits with the calibration?

There appears to be support for a multiplier for VSET (for lower voltage ranges) through 0x099f (I plan to check the PS310 firmware from the other thread to see if it has non-zero values as I would expect). Not a divider, though it would not be difficult to add to the set and the readout circuits. For the set circuits, it might be as easy as shifting right in the multiplier loop instead of left.

And for the end the new memory map. Still a few locations are unknown. Any Ideas?

I will find the readout code and see if I can find a third readout calibration factor.

[Dexter2]

Just re-burned my EPROM. Works without problems no CRC checks  .

Only one thing to watch out. To calibrate voltage you need a high voltage probe I used a HAMEG 50kV high voltage probe connected to a calibrated 10Meg input resistance DMM. The problem is as it seems these probes are not to precise, so before doing calibration determine the exact factor for the high voltage probe dont take the 1:1000 for granted it could be quite some % off.

[alm]

Some DMMs have some variation in their input resistance (some even go to 10 GOhm). Also, I imagine a 50 kV probe might be adjusted for the end of its range (like the SR calibration, apparently ). Due to voltage coefficients, the division ratio may not be all that flat across its voltage range. I can see how that would make checking linearity of the power supply tricky without another HV source.

[Dexter2]

1.  Continue looking at code to verify all calibration options.
2.  Verify calibration options (testing at DUT)
3.  Develop and test manual calibration procedure (for VSET looks like this may be done)
4.  Develop and test automated calibration procedure (python or perl code preferred as not everyone has other tools)

For me getting the calibration done is enaugh im happy. But would be interested in the unknown locations that we have not jet uncovered.

I know my calibration assist program is not in a free lauguage but it was the quickest i could make one as i use LabView all the time. I think National Instrument also has a LabView 45day free full working trial if you want to play with it. If required i can make an executable you would then only need to download a free runtime engine to get it working. To automate the software more it would be possible to read in the offset and the two factors, read values from a external DMM in all three calibration points for all parameters and then calculate the new factors but it probablly does not make sense for a home calibration.

[Dexter2]

Just a quick note as i did not write any instructions for the calibration program. First you calibrate all the wanted factors then you read out the calibration memory with "Read calibration memory". Next open your original BIN of the whole EPROM content and than just press write new EPROM. The software generates the new BIN ready to be written into the EPROM.

[Dexter2]

Updated the table alm created with locations for readback calibration below.

WORD?   #           VALUE ROMHEX
0       2476        AC09 ; +pol vset offset
1       21988       E455 ; +pol vset exponent/multiplier/non-linear parameter if vset < word0
2       21003       0B52 ; +pol vset exponent/multiplier/non-linear parameter if vset >= word0
3       2500        C409 ; +pol vlim offset
4       21076       5452 ; +pol vlim exponent/multiplier/non-linear parameter if vlim < word3
5       21076       5452 ; +pol vlim exponent/multiplier/non-linear parameter if vlim >= word3
6       2492        BC09 ; +pol ilim offset
7       21017       1952 ; +pol ilim exponent/multiplier/non-linear parameter if ilim < word6
8       20051       534E ; +pol ilim exponent/multiplier/non-linear parameter if ilim >= word6
9       2491        BB09 ; +pol itrp offset
10      21032       2852 ; +pol itrp exponent/multiplier/non-linear parameter if itrp < word9
11      20053       554E ; +pol itrp exponent/multiplier/non-linear parameter if itrp >= word9

12      2476        AC09 ; +pol voltage readback display offset0
13      49126       E6BF ; +pol voltage readback display scale if VOUT < Word12
14      49634       E2C1 ; +pol voltage readback display scale if VOUT >= Word12
15      2493        BD09 ; +pol current readback display offset
16      49632       E0C1 ; +pol current readback display scale if IOUT < Word15
17      50148       E4C3 ; +pol current readback display scale if IOUT >= Word15
18      0           0000
19      17299       9343 ; **unknown**
20      17299       9343 ; **unknown**

21      2470        A609 ; -pol vset offset
22      21910       9655 ; -pol vset exponent/multiplier/non-linear parameter if vset < word21
23      20982       F651 ; -pol vset exponent/multiplier/non-linear parameter if vset >= word21
24      2500        C409 ; -pol vlim offset
25      21076       5452 ; -pol vlim exponent/multiplier/non-linear parameter if vlim < word24
26      21076       5452 ; -pol vlim exponent/multiplier/non-linear parameter if vlim >= word24
27      2513        D109 ; -pol ilim offset
28      20785       3151 ; -pol ilim exponent/multiplier/non-linear parameter if ilim < word27
29      19760       304D ; -pol ilim exponent/multiplier/non-linear parameter if ilim >= word27
30      2512        D009 ; -pol itrp offset
31      20818       5251 ; -pol itrp exponent/multiplier/non-linear parameter if itrp < word30
32      19746       224D ; -pol itrp exponent/multiplier/non-linear parameter if itrp >= word30

33      2470        A609 ; -pol voltage readback display offset
34      49170       12C0 ; -pol voltage readback display scale if |VOUT| < Word33
35      49634       E2C1 ; -pol voltage readback display scale if |VOUT| >= Word33
36      2514        D209 ; -pol current readback display offset
37      49784       78C2 ; -pol current readback display scale if |IOUT| < Word36
38      50308       84C4 ; -pol current readback display scale if |IOUT| >= Word36
39      0           0000
40      17299       9343 ; **unknown**
41      17299       9343 ; **unknown**
42      0           0000
43      51830       76CA ; **unknown**
44      0           0000
45      51830       76CA ; **unknown**

EPROM values are based on Sandra's EPROM and are helpfull for orientation.

The locations first thought to be model specific that turned out to be calibration factors for VLIM are probablly even not calibrated in factory and are just preset with default values as they are all the same for all EPROMs. So if you want to have the unit preset to default initial values to calculate the calibration factors for voltage/current set/readback afterwards this probablly are the initial ones. Offset:2500 Scale:21076.

[alm]

The VLIM / ITRP values obviously do not need to be very accurate, it may very well be that they are the same within a certain model (although this does not seem to be the case for ITRP). This is the calibration data from a PS310 1.4 rom from the older thread:

Code: [Select]

0. 6C 02
1. 1D 54
2. 56 53

3. 71 02
4. 54 52
5. 54 52
Note the different offset (W3). The slope appears to be the same.

[alm]

Thanks! That makes sense. I have not looked at the readout display at all. Now that you mention it, I should search for the address of word 12 and will likely find the readout code.

I found the code. The function that does this starts at 0x0a39. I am still investigating the details, but similar to the settings I see three sets three words. Calculation with the three words looks fairly similar to the setting. I am not sure yet what the third set of three words refers to yet, I will have to look at the ADC code in more detail.

It involves a checksum (bytewise XOR) over a bunch of bitfields that are modified at various places. By toggling bits in the bitfields, it turns off bits in the checksum. The program relies on the checksum to tell which value to update. I need to identify all variables and trace where they are being updated and what they mean.

There appears to be support for a multiplier for VSET (for lower voltage ranges) through 0x099f (I plan to check the PS310 firmware from the other thread to see if it has non-zero values as I would expect). [...]

I checked the PS310 1.4 (without GPIB) firmware from the previous thread Sandra linked to, and indeed the block of four bytes (located at a slightly different address) is non zero:

Code: [Select]

ROM:095C unk_95C:        db    2                 ; DATA XREF: sub_898+53o
ROM:095D                 db 2
ROM:095E                 db    1
ROM:095F                 db    1
This would scale the values sent to the DAC so the smaller voltage range would still correspond to full scale on the DAC. Though it appears that current values are also scaled up. I wonder if there is a separate block for readout, or that they just change the readout calibration constants to match? I am not sure if figuring this out is really a priority, but it at least it confirms my theory that the parameters at 0x99F (0x95C in the PS310 firmware) are model-specific.

And for the end the new memory map. Still a few locations are unknown. Any Ideas?

I will find the readout code and see if I can find a third readout calibration factor.

See above. Working on it.

Other thing I noticed. Sandra (and the schematic) has U507 Q4 as NC, but this code (that appears to shutdown the supply in case of I_FAULT, PRI_FAULT or V_FAULT), sets it:

Code: [Select]

ROM:0D42 shutdown:                               ; CODE XREF: sub_D94+15p
ROM:0D42                                         ; sub_D94+57p ...
ROM:0D42                 ld      hl, port_78h_value
ROM:0D45                 set     4, (hl)         ; spare???
ROM:0D47                 res     0, (hl)         ; set -shutdown low
ROM:0D49                 ld      a, (port_78h_value)
ROM:0D4C                 out     (78h), a        ; set misc switches (u507)
Old code? different model? Error in schematic?

Does anyone know what J504 (status1 bit 6) connects to? My copy of the schematics is not searchable, and a quick scan through the schematic pages did not reveal anything. There is a function at 0x108c that checks it and shuts down the power and sets the voltage to zero if it is high. Could be another fault or interlock indicator?

Does anyone know what port 0x3a is connected to? It is reading from it in a function that also writes to the display (for now named something_display ):

Code: [Select]

ROM:01C9 loc_1C9:                                ; CODE XREF: sub_15D+66j
ROM:01C9                 in      a, (3Ah)
ROM:01CB                 bit     7, a
ROM:01CD                 jp      z, loc_227
ROM:01D0                 set     1, c
ROM:01D2                 jp      loc_227
Appears to be related to editing values on the display, so could be keyboard or display.

[smgvbest]

here's the details on port 3Ah and the 20h bit 6 which is the rear panel switch to select between monitor mode or set mode for the V_MON/I_MON connectors on the back

this is my most current port and address map

Code: [Select]


MEMORY ADDRESS OF EPROM: 0000~1FFF (PROGRAM SPACE:8KB,ST M2764A)

SRAM: 4000~47FF (DATA SPACE:2KB,HITACHI HM6116)

IRQ_ROUTIINE:  0038h
SOURCE:  SHEET 6
CLK->(U610)->TIMER @ 976.56hz/0.001024ms   (4Mhz/4096(U610)74HC4020)
GPIB


SRAM ADDRESSES:
SRAM_MISC = 413AH
SRAM_STATUS1 = NA
SRAM_STATUS2 = 401CH

EPROM ADDRESSES:
*IDN? STRING 000019fah: 53 74 61 6E 66 6F 72 64 52 65 73 65 61 72 63 68 ; StanfordResearch
00001a0ah: 53 79 73 74 65 6D 73 2C 50 53                   ; Systems,PS

191CH GPIB OFFSETS TABLE 0000191ch: 24 35 19 2A 3B 19 48 6E 19 49 79 19 53 89 19 54 ; $5.*;.Hn.Iy.S‰.T
CMD CHAR+OFFSET 0000192ch: 8F 19 56 9A 19 57 AA 19 00                      ; .Vš.Wª..

193BH GPIB COMMAND 00001935h: 44 41 43 BE 1C 00 43 4C 53 6A 1A 45 53 45 3C 1E ; DAC¾..CLSj.ESE<.
CMD+OFFSET+00H 00001945h: 45 53 52 AE 1E 49 44 4E B0 19 50 53 43 72 1E 52 ; ESR®.IDN°.PSCr.R
00001955h: 43 4C 5A 1D 52 53 54 4E 1A 53 41 56 35 1D 53 52 ; CLZ.RSTN.SAV5.SR
00001965h: 45 06 1E 53 54 42 08 1F 00 56 4F 46 14 1A 56 4F ; E..STB...VOF..VO
00001975h: 4E 24 1A 00 4C 49 4D 7F 1B 4F 55 54 7E 1C 54 52 ; N$..LIM.OUT~.TR
00001985h: 50 EE 1B 00 4D 4F 44 9E 1C 00 43 4C 52 3B 1A 4D ; Pî..MODž..CLR;.M
00001995h: 4F 44 FF 1C 00 4C 49 4D 06 1B 4F 55 54 5D 1C 53 ; ODÿ..LIM..OUT].S
000019a5h: 45 54 87 1A 00 4F 52 44                         ; ET‡..ORD


19FAH 000019fah: F3 CD D5 11 FB 0E 00 C3 D4 15 CD 9D 17 C2 FD 17 ; óÍÕ.û..ÃÔ.͝.Âý.
                                                                        00001a0ah: 21 8D 1F 11 3C 41 01 09 00 ED B0                ; !..<A...í°     

1F7BH 00001f7bh: 5A 31 33 34                                     ; Z134
1F7FH EPROM_VERSION_NUMBER 00001f7fh: 31 2E 33 34                                     ; 1.34

1F83H                                                               00001f83h: 88 13 88 13 82 14 82 14 64 00                   ; ˆ.ˆ.‚.‚.d.
1F8DH 00001f8dh: 00 00 88 13 82 14 82 14 00 00 00 00 00 00 00 00 ; ..ˆ.‚.‚.........
00001f9dh: 0E 48 0D                                        ; .H.

1FA0H EPROM_CAL_DATA 00001fa0h: AC 09 E4 55 0B 52 C4 09 54 52 54 52 BC 09 19 52 ; ¬.äU.RÄ.TRTR¼..R
00001fb0h: 53 4E BB 09 28 52 55 4E AC 09 E6 BF E2 C1 BD 09 ; SN».(RUN¬.æ¿âÁ½.
00001fc0h: E0 C1 E4 C3 00 00 93 43 93 43 A6 09 96 55 F6 51 ; àÁäÃ..“C“C¦.–UöQ
00001fd0h: C4 09 54 52 54 52 D1 09 31 51 30 4D D0 09 52 51 ; Ä.TRTRÑ.1Q0MÐ.RQ
00001fe0h: 22 4D A6 09 12 C0 E2 C1 D2 09 78 C2 84 C4 00 00 ; "M¦..ÀâÁÒ.x„Ä..
00001ff0h: 93 43 93 43 00 00 76 CA 00 00 76 CA             ; “C“C..vÊ..vÊ

1FFCH EPROM_SERIAL_NUMBER       00001ffch: 31 31 33 37                                     ; 1137


GPIB
DAC/$DAC CLS/*CLS ESE/*ESE  ESR/*ESR
IDN/*IDN  PSC/*PSC RCLZ/*RCL RSTN/*RST
SAV/*SAV  SRE/*SRE STB/*STB  VOF/HVOF
VON/HVON  LIM/ILIM OUT/IOUT  TRP/ITRP
MOD/SMOD  CLR/TCLR MOD/TMOD  LIM/VLIM
OUT/VOUT  SET/VSET ORD/WORD


I/O ADDRESSES:

U504  (A3-A5 -> A-C, A6-G1, WR->!G2A, IORQ->!G2B )
40H: SPARE
48H:-SETS -> U407/U408
------------------------------
BIT0: U407A / GND->U405.3
BIT1: U407B / U410.RF -> U405.3
BIT2: U408A / ANALOG_VOLTAGE
BIT3: U408B / I_OUT_MONITOR
BIT4: U408C / CV_SET
BIT5: U408D / DV_LIM
BIT6: U407C / I_LIM
BIT7: U407D / I_TRIP
------------------------------

50H:-DAC U410 12BIT DAC AD7542
50H  DAC_LOW_NIBBLE
51H  DAC_MID_NIBBLE
52H  DAC_HIGH_NIBBLE
53H  DAC_LOAD

58H:-LED U611 74HC374
------------------------------
BIT0: L0
BIT1: L1
BIT2: L2
BIT3: -AD1/V_MON 
BIT4: -AD2/I_MON
BIT5: -AD3/ANALOG_VOLTAGE_IN
BIT6: -IO
BIT7: UNUSED
------------------------------

60H:-SEGB U606 74HC374
------------------------------
BIT0: EDP
BIT1: EG
BIT2: EF
BIT3: EE
BIT4: ED
BIT5: EC
BIT6: EB
BIT7: EA
------------------------------

68H:-SEGA U609 74HC374
------------------------------
BIT0: ODP
BIT1: OG
BIT2: OF
BIT3: OE
BIT4: OD
BIT5: OC
BIT6: OB
BIT7: OA
------------------------------

70H:-STROBE     (STROB0-STROB5 LED)  (STROB2-4 KEYBOARD SCAN OUT)
------------------------------
BIT0: STROB0  (LED)
BIT1: STROB1 (LED)
BIT2: STROB2  (LED,KBD)
BIT3: STROB3  (LED,KBD)
BIT4: STROB4  (LED,KBD)
BIT5: STROB5  (LED)
BIT6: STROB6  ()
BIT7: STROB7  ()
------------------------------

78H: MISC -> (U507,74HC374 OCTAL D-TYPE FLIP-FLOP) >CLK
------------------------------
BIT0: -SHUTDOWN
BIT1: UPOK
BIT2: -FLAG_RESET
BIT3: -TIMER_RESET
BIT4: (SPARE)
BIT5: -POS
BIT6: -NEG
BIT7: FILTER
------------------------------

U505 (A3-A5 -> A-C, !M1->G1, A6->!G2A, IORQ->!G2B )
00H: SPARE
08H: SPARE
10H: SPARE
18H: SPARE

[b]20H: STATUS1 U506->74HC244
------------------------------
BIT0: COMPARE
BIT1: I_FAULT
BIT2: CUR_LIM
BIT3: PRI_FAULT
BIT4: V_FAULT
BIT5: TIMER
BIT6: -J504/SET_MONITOR_SW
BIT7: GND[/b]
------------------------------

28H: STATUS2 U512->74HC244
------------------------------
BIT0: HV_ON
BIT1: HV_OFF
BIT2: J501/-HV_SW_POS
BIT3: J502/-HV_SW_NEG
BIT4: GND
BIT5: GND
BIT6: GND
BIT7: GND
------------------------------

30H: -KBD
------------------------------
BIT0: KBD0
BIT1: KBD1
BIT2: KBD2
BIT3: KBD3
BIT4: KBD4
BIT5: KBD5
BIT6: KBD6
BIT7: KBD7

key press display
01 Man         
02 GPIB       
03 left-arrow 
04 Right arrow
05 up-arrow   
06 down-arrow 
07 Enter       
08 Select     
09 STO         
10 RCL         
11 CLR         
12 .           
13 0           
14 7           
15 4           
16 1           
17 8           
18 5           
19 2           
20 9           
21 6           
22 3           
------------------------------

38H: -GPIB
------------------------------
READ
38H GPIB_INT_STATUS_0
BIT0: INT0 (1 WHEN STATUS 1 BIT SET)
BIT1: INT1 (1 WHEN BITS 2-7 OF STATUS 0 SET)
BIT2: BI    (BYTE IN)
BIT3: BO    (BYTE OUT)
BIT4: END  (LAST BYTE RECEIVED)
BIT5: SPAS (RSV1/2 SERVICE REQUEST)
BIT6: RCL  (REMOTE/LOCAL CHANGE)
BIT7: MAC  (ADDRESS CHANGE)
39H GPIB_INT_STATUS_1
BIT0: GET (GROUP EXECUTE TRIGGER)
BIT1: ERR (ERROR)
BIT2: UNC   (UNRECOGNIZED COMMAND)
BIT3: APT  (ADDRESS PASS THROUGH)
BIT4: DCAS  (DEVICE CLEAR ACTIVE STATE)
BIT5: MA    (MY ADDRESS)
BIT6: SRQ   (SERVICE REQUEST)
BIT7: IFC (INTERFACE CLEAR)
[b]3AH GPIB_ADDRESS_STATUS
BIT0: REM
BIT1: LLO
BIT2: ATN
BIT3: LPAS
BIT4: TPAS
BIT5: LADS
BIT6: TADS
BIT7: ULPA[/b]
3BH GPIB_BUS_STATUS
3EH GPIB_CMD_PASS_THRU
3FH GPIB_DATA_IN

WRITE
38H GPIB_INT_MASK_0
39H GPIB_INT_MASK_1
3BH GPIB_AUXILIARY_CMD
3CH GPIB_ADDRESS
3DH GPIB_SERIAL_POLL
3EH GPIB_PARALLEL_POLL
3FH GPIB_DATA_OUT
------------------------------


[Zucca]

Just want to say thank you, I am enjoying the show here.

I am impressed how the eevblog sometime sets up a wonderful skilled team to solve the EE problems.

 

[smgvbest]

I know my calibration assist program is not in a free language but it was the quickest i could make one as i use LabView all the time. I think National Instrument also has a LabView 45day free full working trial if you want to play with it. If required i can make an executable you would then only need to download a free runtime engine to get it working. To automate the software more it would be possible to read in the offset and the two factors, read values from a external DMM in all three calibration points for all parameters and then calculate the new factors but it probably does not make sense for a home calibration.

No problem and thank you for doing this so quick.
The trial is 7 days but it says you can extend 45 day inside the product. (yes I downloaded it )

I did play with the 1st three offsets and now my unit is  <1V of target value full scale. 
will play with rest as I have time.

[alm]

I think you might want to add 0x99F (in your PS350 firmware) as four bytes that define a multiplier for the current/voltage scales, since I verified them to be different between the PS310 and PS350. This is how I described it in my listing:

; Four byte array that defines exponents for scale adjustment for vset/vlim/ilim/itrp: input values are multiplied by 2^n after subtracting the offset but before applying the other calibration parameter.

This would mean the voltages were multiplied by four and the current by two to map to the DAC values according to the PS310 dump I looked at. This exactly matches the 1.25 kV vs 5 kV voltage range. I am guessing they use an 8x lower value shunt resistor to compensate for the increased current (20 mA / 8 * 2 = 5 mA).

Any idea what the relevance of ulpa (last LSB of address recognized by TMS9914, 0x3a bit 7) is? There is one function (at 0x674) that checks it (and some other variables) to decide to execute RTL through gpib_rtl (aux command 0x7):

Code: [Select]

ROM:06C6                 in      a, (3Ah)
ROM:06C8                 bit     7, a
ROM:06CA                 jr      z, loc_6DA
ROM:06CC                 bit     6, a
ROM:06CE                 jr      z, loc_6D1
ROM:06D0                 ret
ROM:06D1 ; ---------------------------------------------------------------------------
ROM:06D1
ROM:06D1 loc_6D1:                                ; CODE XREF: gpib_something_rtl+5Aj
ROM:06D1                 ld      a, 3
ROM:06D3                 cp      b
ROM:06D4                 jr      nz, locret_6D9
ROM:06D6                 call    gpib_rtl
The only thing I can come up with is a special GPIB address to configure it as talk-only, but I could find no mention of it in the manual. What other significance could the LSB have, since the address could be both odd and even? Or am I missing something about GPIB? I am reasonably familiar with using GPIB, but have never implemented a GPIB device.

I have now pretty much figured out the main loop. The IRQ handler at 0x38 will update the DACs, handle some GPIB and eventually jump back to it unless it encounters a (presumably fatal) error:

Code: [Select]

ROM:00E3 main_loop:                              ; CODE XREF: sub_C3+1Bj
ROM:00E3                                         ; irq_service+C1j ...
ROM:00E3                 ei
ROM:00E4                 call    parse_gpib_commands
ROM:00E7                 call    gpib_something_rtl
ROM:00EA                 call    check_j504
ROM:00ED                 call    update_displays
ROM:00F0                 call    upd_settings_checksum
ROM:00F3                 call    do_readouts
ROM:00F6                 call    display_readout
ROM:00F9                 jp      main_loop
Obviously the gpib_something_rtl is still unclear, which is where the snippet posted above came from.

[smgvbest]

This is the definition of the ULPA bit

This bit shows the LSB of the last address recognized by the TMS9914A

this is a bit further explaination of it

The' edpa' bit is used to enable the dual addressing mode of the TMS9914A. It causes the LSB of the address to be
ignored by the address comparator giving two consecutive primary addresses for the device. The address by which
the TMS9914A was selected is indicated by the 'ulpa' bit of the Address Status Register.

ah,  I just noticed by the schematic they attached the D0-D7 to the TMS9914A in reverse   ie.  D0->D7, D7->D0 (see attached)
so if that is true then bit 7 is not ULPA but is REM
and REM is

The device is in the remote state

[alm]

Ah, that explains it! Checking REM before GTL makes complete sense. I guess they reversed the connection because the TMS9914A seems backward itself (D7 is the LSB). So now the MSB on the Z80 is also the MSB on the TMS9914A. I had actually already assumed that was the case (D0 connected to the LSB) without checking the schematic when decoding the command (GTL = 0x7).

[smgvbest]

I need to update my portmap to flip these bits around to match.

[smgvbest]

Here's my updated port/memory map with the GPIB BIT Order fliped

and just because I'm still looking at things.
And the switching frequency of the 555 timer driving the HV transformer is ~39.925Khz
this is fed into a flipflop then out to 2 3-Input NAND gates to drive the GATE of the 2 IFR532's
level is set via the VDRIVE signal to the COMMON of the transformer. The HVOFF signal disables the output of the 2 NAND gates thus disabling the HV output. 

Code: [Select]

MEMORY ADDRESS OF EPROM: 0000~1FFF (PROGRAM SPACE:8KB,ST M2764A)

SRAM: 4000~47FF (DATA SPACE:2KB,HITACHI HM6116)

IRQ_ROUTIINE:  0038h
SOURCE:  SHEET 6
CLK->(U610)->TIMER @ 976.56hz/0.001024ms   (4Mhz/4096(U610)74HC4020)
GPIB

U201 -> 555 TIMER -> PIN 3
SWITCHING FREQ = 39.925Khz FOR HV TRANSFORMER


SRAM ADDRESSES:
SRAM_MISC = 413AH
SRAM_STATUS1 = NA
SRAM_STATUS2 = 401CH

EPROM ADDRESSES:
*IDN? STRING                 000019fah: 53 74 61 6E 66 6F 72 64 52 65 73 65 61 72 63 68 ; StanfordResearch
00001a0ah: 53 79 73 74 65 6D 73 2C 50 53                   ; Systems,PS

191CH GPIB OFFSETS TABLE 0000191ch: 24 35 19 2A 3B 19 48 6E 19 49 79 19 53 89 19 54 ; $5.*;.Hn.Iy.S‰.T
CMD CHAR+OFFSET 0000192ch: 8F 19 56 9A 19 57 AA 19 00                      ; .Vš.Wª..

193BH GPIB COMMAND 00001935h: 44 41 43 BE 1C 00 43 4C 53 6A 1A 45 53 45 3C 1E ; DAC¾..CLSj.ESE<.
CMD+OFFSET+00H 00001945h: 45 53 52 AE 1E 49 44 4E B0 19 50 53 43 72 1E 52 ; ESR®.IDN°.PSCr.R
00001955h: 43 4C 5A 1D 52 53 54 4E 1A 53 41 56 35 1D 53 52 ; CLZ.RSTN.SAV5.SR
00001965h: 45 06 1E 53 54 42 08 1F 00 56 4F 46 14 1A 56 4F ; E..STB...VOF..VO
00001975h: 4E 24 1A 00 4C 49 4D 7F 1B 4F 55 54 7E 1C 54 52 ; N$..LIM.OUT~.TR
00001985h: 50 EE 1B 00 4D 4F 44 9E 1C 00 43 4C 52 3B 1A 4D ; Pî..MODž..CLR;.M
00001995h: 4F 44 FF 1C 00 4C 49 4D 06 1B 4F 55 54 5D 1C 53 ; ODÿ..LIM..OUT].S
000019a5h: 45 54 87 1A 00 4F 52 44                         ; ET‡..ORD


19FAH 000019fah: F3 CD D5 11 FB 0E 00 C3 D4 15 CD 9D 17 C2 FD 17 ; óÍÕ.û..ÃÔ.͝.Âý.
                                                        00001a0ah: 21 8D 1F 11 3C 41 01 09 00 ED B0                ; !..<A...í°     

1F7BH 00001f7bh: 5A 31 33 34                                     ; Z134
1F7FH EPROM_VERSION_NUMBER 00001f7fh: 31 2E 33 34                                     ; 1.34

1F83H                                               00001f83h: 88 13 88 13 82 14 82 14 64 00                   ; ˆ.ˆ.‚.‚.d.
1F8DH 00001f8dh: 00 00 88 13 82 14 82 14 00 00 00 00 00 00 00 00 ; ..ˆ.‚.‚.........
00001f9dh: 0E 48 0D                                        ; .H.

1FA0H EPROM_CAL_DATA 00001fa0h: AC 09 E4 55 0B 52 C4 09 54 52 54 52 BC 09 19 52 ; ¬.äU.RÄ.TRTR¼..R
00001fb0h: 53 4E BB 09 28 52 55 4E AC 09 E6 BF E2 C1 BD 09 ; SN».(RUN¬.æ¿âÁ½.
00001fc0h: E0 C1 E4 C3 00 00 93 43 93 43 A6 09 96 55 F6 51 ; àÁäÃ..“C“C¦.–UöQ
00001fd0h: C4 09 54 52 54 52 D1 09 31 51 30 4D D0 09 52 51 ; Ä.TRTRÑ.1Q0MÐ.RQ
00001fe0h: 22 4D A6 09 12 C0 E2 C1 D2 09 78 C2 84 C4 00 00 ; "M¦..ÀâÁÒ.x„Ä..
00001ff0h: 93 43 93 43 00 00 76 CA 00 00 76 CA             ; “C“C..vÊ..vÊ

1FFCH EPROM_SERIAL_NUMBER    00001ffch: 31 31 33 37                                     ; 1137


GPIB
DAC  CLS/*CLS ESE/*ESE  ESR/*ESR
IDN/*IDN  PSC/*PSC RCLZ/*RCL RSTN/*RST
SAV/*SAV  SRE/*SRE STB/*STB  VOF/HVOF
VON/HVON  LIM/ILIM OUT/IOUT  TRP/ITRP
MOD/SMOD  CLR/TCLR MOD/TMOD  LIM/VLIM
OUT/VOUT  SET/VSET ORD


I/O ADDRESSES:

U504  (A3-A5 -> A-C, A6-G1, WR->!G2A, IORQ->!G2B )
40H: SPARE
48H:-SETS -> U407/U408
------------------------------
BIT0: U407A / GND->U405.3
BIT1: U407B / U410.RF -> U405.3
BIT2: U408A / ANALOG_VOLTAGE
BIT3: U408B / I_OUT_MONITOR
BIT4: U408C / CV_SET
BIT5: U408D / DV_LIM
BIT6: U407C / I_LIM
BIT7: U407D / I_TRIP
------------------------------

50H:-DAC U410 12BIT DAC AD7542
50H  DAC_LOW_NIBBLE
51H  DAC_MID_NIBBLE
52H  DAC_HIGH_NIBBLE
53H  DAC_LOAD

58H:-LED U611 74HC374
------------------------------
BIT0: L0
BIT1: L1
BIT2: L2
BIT3: -AD1/V_MON 
BIT4: -AD2/I_MON
BIT5: -AD3/ANALOG_VOLTAGE_IN
BIT6: -IO
BIT7: UNUSED
------------------------------

60H:-SEGB U606 74HC374
------------------------------
BIT0: EDP
BIT1: EG
BIT2: EF
BIT3: EE
BIT4: ED
BIT5: EC
BIT6: EB
BIT7: EA
------------------------------

68H:-SEGA U609 74HC374
------------------------------
BIT0: ODP
BIT1: OG
BIT2: OF
BIT3: OE
BIT4: OD
BIT5: OC
BIT6: OB
BIT7: OA
------------------------------

70H:-STROBE     (STROB0-STROB5 LED)  (STROB2-4 KEYBOARD SCAN OUT)
------------------------------
BIT0: STROB0  (LED)
BIT1: STROB1 (LED)
BIT2: STROB2  (LED,KBD)
BIT3: STROB3  (LED,KBD)
BIT4: STROB4  (LED,KBD)
BIT5: STROB5  (LED)
BIT6: STROB6  ()
BIT7: STROB7  ()
------------------------------

78H: MISC -> (U507,74HC374 OCTAL D-TYPE FLIP-FLOP) >CLK
------------------------------
BIT0: -SHUTDOWN
BIT1: UPOK
BIT2: -FLAG_RESET
BIT3: -TIMER_RESET
BIT4: (SPARE)
BIT5: -POS
BIT6: -NEG
BIT7: FILTER
------------------------------

U505 (A3-A5 -> A-C, !M1->G1, A6->!G2A, IORQ->!G2B )
00H: SPARE
08H: SPARE
10H: SPARE
18H: SPARE

20H: STATUS1 U506->74HC244
------------------------------
BIT0: COMPARE
BIT1: I_FAULT
BIT2: CUR_LIM
BIT3: PRI_FAULT
BIT4: V_FAULT
BIT5: TIMER
BIT6: -J504/SET_MONITOR_SW
BIT7: GND
------------------------------

28H: STATUS2 U512->74HC244
------------------------------
BIT0: HV_ON
BIT1: HV_OFF
BIT2: J501/-HV_SW_POS
BIT3: J502/-HV_SW_NEG
BIT4: GND
BIT5: GND
BIT6: GND
BIT7: GND
------------------------------

30H: -KBD
------------------------------
BIT0: KBD0
BIT1: KBD1
BIT2: KBD2
BIT3: KBD3
BIT4: KBD4
BIT5: KBD5
BIT6: KBD6
BIT7: KBD7

key press display
01 Man         
02 GPIB       
03 left-arrow 
04 Right arrow
05 up-arrow   
06 down-arrow 
07 Enter       
08 Select     
09 STO         
10 RCL         
11 CLR         
12 .           
13 0           
14 7           
15 4           
16 1           
17 8           
18 5           
19 2           
20 9           
21 6           
22 3           
------------------------------

38H: -GPIB
------------------------------
READ
38H GPIB_INT_STATUS_0
BIT0: MAC  (ADDRESS CHANGE)
BIT1: RCL  (REMOTE/LOCAL CHANGE)
BIT2: SPAS (RSV1/2 SERVICE REQUEST)
BIT3: END  (LAST BYTE RECEIVED)
BIT4: BO    (BYTE OUT)
BIT5: BI    (BYTE IN)
BIT6: INT1 (1 WHEN BITS 2-7 OF STATUS 0 SET)
BIT7: INT0 (1 WHEN STATUS 1 BIT SET)
39H GPIB_INT_STATUS_1
BIT0: IFC (INTERFACE CLEAR)
BIT1: SRQ   (SERVICE REQUEST)
BIT2: MA    (MY ADDRESS)
BIT3: DCAS  (DEVICE CLEAR ACTIVE STATE)
BIT4: APT  (ADDRESS PASS THROUGH)
BIT5: UNC   (UNRECOGNIZED COMMAND)
BIT6: ERR (ERROR)
BIT7: GET (GROUP EXECUTE TRIGGER)
3AH GPIB_ADDRESS_STATUS
BIT0: ULPA
BIT1: TADS
BIT2: LADS
BIT3: TPAS
BIT4: LPAS
BIT5: ATN
BIT6: LLO
BIT7: REM
3BH GPIB_BUS_STATUS
3EH GPIB_CMD_PASS_THRU
3FH GPIB_DATA_IN

WRITE
38H GPIB_INT_MASK_0
39H GPIB_INT_MASK_1
3BH GPIB_AUXILIARY_CMD
3CH GPIB_ADDRESS
3DH GPIB_SERIAL_POLL
3EH GPIB_PARALLEL_POLL
3FH GPIB_DATA_OUT
------------------------------


[smgvbest]

Other thing I noticed. Sandra (and the schematic) has U507 Q4 as NC, but this code (that appears to shutdown the supply in case of I_FAULT, PRI_FAULT or V_FAULT), sets it:

Code: [Select]

Code: [Select]
ROM:0D42 shutdown:                               ; CODE XREF: sub_D94+15p
ROM:0D42                                         ; sub_D94+57p ...
ROM:0D42                 ld      hl, port_78h_value
ROM:0D45                 set     4, (hl)         ; spare???
ROM:0D47                 res     0, (hl)         ; set -shutdown low
ROM:0D49                 ld      a, (port_78h_value)
ROM:0D4C                 out     (78h), a        ; set misc switches (u507)Old code? different model? Error in schematic?

Going to research this one and see if anything is going on Q4.    Will update.
Looked on the scope and Q4 goes Low when the HV switch is flipped to on.  it goes high when the HV switch is off. 
I set the VLIM to 100V and tried going past it.  got the ERR on the display but no activity on Q4
Some tracing done.   Q4 goes over to U613D which is a MPQ2222 on Pin 13 which is the Base thru a 10K resistor.
schematic shows the emitter and base tied together however they are not,  Pin 12 is tied to gnd.  Pin 14 I need to trace now
Going to double check this as pin 14 appears to go to U404 Pin 8 which is +15v
yep. it goes to U404->8
but also thru D103 then I so far am loosing it under N601 (resistor network)

Added work in progress schematic below.

[alm]

So clearly the schematic is wrong. I am not sure if this is anything important, it just struck me as odd that the firmware was toggling outputs that were supposedly NC. The diode looks like an OR construction to me, e.g. pulling base current away from somewhere in case of a fault. A shutdown signal of sorts. That would also explain why I saw the line being turned on in relation to fault signals together with /shutdown.

Do you have any idea what the point of U407A (controlled from U411 Q0) is? It looks like to me like it would short the inputs of U405 through R414. I guess the dot that connects U407A.2 to U402B.7 and R414 should not be there?

[alm]

Updated table based on Dexter2's table:

Code: [Select]

WORD?   #           VALUE ROMHEX
0       2476        AC09 ; +pol vset offset
1       21988       E455 ; +pol vset exponent/multiplier/non-linear parameter if vset < word0
2       21003       0B52 ; +pol vset exponent/multiplier/non-linear parameter if vset >= word0
3       2500        C409 ; +pol vlim offset
4       21076       5452 ; +pol vlim exponent/multiplier/non-linear parameter if vlim < word3
5       21076       5452 ; +pol vlim exponent/multiplier/non-linear parameter if vlim >= word3
6       2492        BC09 ; +pol ilim offset
7       21017       1952 ; +pol ilim exponent/multiplier/non-linear parameter if ilim < word6
8       20051       534E ; +pol ilim exponent/multiplier/non-linear parameter if ilim >= word6
9       2491        BB09 ; +pol itrp offset
10      21032       2852 ; +pol itrp exponent/multiplier/non-linear parameter if itrp < word9
11      20053       554E ; +pol itrp exponent/multiplier/non-linear parameter if itrp >= word9

12      2476        AC09 ; +pol voltage readback display offset0
13      49126       E6BF ; +pol voltage readback display scale if VOUT < Word12
14      49634       E2C1 ; +pol voltage readback display scale if VOUT >= Word12
15      2493        BD09 ; +pol current readback display offset
16      49632       E0C1 ; +pol current readback display scale if IOUT < Word15
17      50148       E4C3 ; +pol current readback display scale if IOUT >= Word15
18      0           0000 ; +pol external analog_voltage_in display offset
19      17299       9343 ; +pol external_analog_voltage_in scale (possibly never used)
20      17299       9343 ; +pol external_analog_voltage_in scale

21      2470        A609 ; -pol vset offset
22      21910       9655 ; -pol vset exponent/multiplier/non-linear parameter if vset < word21
23      20982       F651 ; -pol vset exponent/multiplier/non-linear parameter if vset >= word21
24      2500        C409 ; -pol vlim offset
25      21076       5452 ; -pol vlim exponent/multiplier/non-linear parameter if vlim < word24
26      21076       5452 ; -pol vlim exponent/multiplier/non-linear parameter if vlim >= word24
27      2513        D109 ; -pol ilim offset
28      20785       3151 ; -pol ilim exponent/multiplier/non-linear parameter if ilim < word27
29      19760       304D ; -pol ilim exponent/multiplier/non-linear parameter if ilim >= word27
30      2512        D009 ; -pol itrp offset
31      20818       5251 ; -pol itrp exponent/multiplier/non-linear parameter if itrp < word30
32      19746       224D ; -pol itrp exponent/multiplier/non-linear parameter if itrp >= word30

33      2470        A609 ; -pol voltage readback display offset
34      49170       12C0 ; -pol voltage readback display scale if |VOUT| < Word33
35      49634       E2C1 ; -pol voltage readback display scale if |VOUT| >= Word33
36      2514        D209 ; -pol current readback display offset
37      49784       78C2 ; -pol current readback display scale if |IOUT| < Word36
38      50308       84C4 ; -pol current readback display scale if |IOUT| >= Word36
39      0           0000 ; -pol external analog_voltage_in offset
40      17299       9343 ; -pol external_analog_voltage_in scale (possibly never used)
41      17299       9343 ; -pol external_analog_voltage_in scale
42      0           0000 ; related to var_strange_scaled
43      51830       76CA ; related to var_strange_scaled
44      0           0000 ; related to var_strange_scaled
45      51830       76CA ; related to var_strange_scaled
I am fairly sure the unassigned three words for readout are about scaling the external analog input voltage on J401 to the true set voltage (i.e. 10 V = 2.5 kV). Not sure about the exact math. Since the offset is 0, I imagine the second word (if V_in < 0) is never used, but I could be wrong. I would like confirmation that changing W18/19/20 and W39/40/41 affects the analog remote voltage programming (possibly not all are effective across the entire range).

Now the last four words that are still unassigned. I have found the code that references them. In the function that I call do readouts at 0x9a3 (does the successive approximation and applies calibration factors to the results) there are two blocks like this:

Code: [Select]

ROM:09D0                 call    read_adcs       ; in: hl = output word
ROM:09D0                                         ; out: (hl) = adc result
ROM:09D3                 ld      a, 1
ROM:09D5                 call    convert_readouts ; a = { 0: vmon, 1: imon, 2: analog v_in }
ROM:09D5                                         ;
ROM:09D8                 ld      c, 2
ROM:09DA                 call    convert_readouts_strange ; c = { 0, 2 }

Analog switches were set in an earlier subroutine (to allow for settling time). read_adcs does the successive approximation through the DAC and returns the result. convert_readouts using the display calibration factors identified by Dexter2 and stores them in memory where the display routines can find them (around 0x40df).

Now for the aptly named (by me ) convert_readouts_strange (0xb43-0xbab). It takes It does something fairly similar to convert_readouts, but it uses the last four calibration words (I have not looked into the exact math) and does further math with the result of convert_readouts (i.e. the value displayed on the display/ sent for GPIB queries). Then it stores the result in the four byte block at 0x409c (var_strange_scaled):

Code: [Select]

ROM:0B9E                 pop     bc
ROM:0B9F                 ld      b, 0
ROM:0BA1                 ld      de,  var_strange_scaled+2
ROM:0BA4                 ex      de, hl
ROM:0BA5                 or      a
ROM:0BA6                 sbc     hl, bc          ; bc = { 0, 2 }
ROM:0BA8                 ld      (hl), e
ROM:0BA9                 inc     hl
ROM:0BAA                 ld      (hl), d
ROM:0BAB                 ret
Looks like 0x409c is derived from i_monitor and 0x409e from v_monitor. The strange part is that this appears to be the only place that references the value. I did not find use of the neigbouring addresses as intermediate value (e.g. ld hl, 409a) either. I imagine there might be some ldi(r) instruction or other pointer arithmetic that covers it. I appreciate any reference to other code outside 0xb43-0xbab that references it or speculation what the point of this might be.

[smgvbest]

So clearly the schematic is wrong. I am not sure if this is anything important, it just struck me as odd that the firmware was toggling outputs that were supposedly NC. The diode looks like an OR construction to me, e.g. pulling base current away from somewhere in case of a fault. A shutdown signal of sorts. That would also explain why I saw the line being turned on in relation to fault signals together with /shutdown.

I would assume the schematic is from and older/newer (though probably older) version than the firmware was written for and so doesn't show this feature.
I will continue to try to trace it down.   been distracted by needed household duties and basement water.   yuk

Do you have any idea what the point of U407A (controlled from U411 Q0) is? It looks like to me like it would short the inputs of U405 through R414. I guess the dot that connects U407A.2 to U402B.7 and R414 should not be there?

Lets see how well I understand op-amps (and i'm no pro)
U410 is a unipolar DAC so to get the +/-10.24v rails needed we have
R420-R422 set the mid point at U402B so a value of 1000 0000 0000 is Zero Volts which is a current to voltage circuit since the DAC is current output.
U407A/B & U405 forming a voltage inverter to get the +/-10.24v rail and a gain of 1 with the 1000 0000 0000 being the mid point for zero
Turning on Q0 of U411 connections pin 3 of U405 to virtual gnd of the ADC which should invert the output of U405 for the -10.24v
Turning on Q1 of U411 connected pins 3 of U405 to same input as Pin 2 which should make it a voltage follower for the 10.24v?
R413-R414 set it up as a 1x gain amp so R414 is needed

I believe U402D is acting as a non-inverting buffer with a gain of ~1x which feeds the U408 and following SHA circuits which are refreshed every ~28mS
the datasheet for the AD7542 shows a feedback path from the frist opamp to the RFB of U410.16 with a cap between U410.16 and U410.1 as in the schematic.
so from that POV the only different in the AD7542 sample and the SRS implementation is a Resistor missing in the feed back loop

added AD7542 Datasheet, see pg 5 under BiPolar Operation for the example circuit.  it is very simulair that what SRS did though not exact.

[artelse]

Hi, just repaired my PS350 unit by replacing the completely dead caps C702 and C705 . In photo's and video's here and on YT I see different brand caps used in the low voltage supply. In my unit it they were -unknow to me- Xicon brand caps and replaced these with Rubycons, you might check yours.
Then in the high voltage supply, the -5V in different revisions have swapped the D206 10V zener by a 79L05. That might have been done because of problems or perhaps accuracy? Anyhow, my unit works fine now and is completely in spec

Question: the front bezel came with no screws and seems to be imperial thread. Anyone know what type I should look for?

Thanks, also to Sandra for the help!