Reverse engineer Dallas DS1742W?

[perdrix]

Did anyone ever strip one of these down completely to determine exactly what's inside them?

Naturally there's a 2kx8 SRAM, a supervisory IC (what is it?) and a crystal ... The question is what else?   Surely these can't be "rocket science" to reverse engineer with a replaceable battery?

David

[james_s]

We know exactly what's inside these, the PowerCap version is not potted. There is an off the shelf SRAM, a battery, a 32kHz crystal, and a Dallas ASIC which is a RTC and battery backup controller. Due to the custom chip it doesn't really help you to know what's in there although you can cut the old battery out and solder in a new one.

While the DS1742W is discontinued, the DS1744WP is in active production and I made an adapter using those to replace the DS1742W in Tek TDS3000 scopes. You can build one yourself if you like, aside from mechanical fitment constraints it will work in any application designed for the DS1742W, and the PowerCap package it uses has a replaceable battery.
https://github.com/james10952001/DS1744WP-to-DS1742W-adapter

[james_s]

The DS1386 is the big brother to the DS1742 and is very similar inside. I do not currently have images of the DS1742W but I do have an intact dead one here kindly donated by another member so I will get that done eventually.

[perdrix]

Are you *sure* that it's a non-standard ASIC acting as the RTC and controller.   I was hoping it might be a DS1315 Phantom Time Chip which is an off the shelf part (assuming they are still available) which is what was used in the DS1244.  Are you sure it doesn't use one of those?

Yes I was aware of the DS1744WP but by the time you've bought that and the PowerCap it's quite a bit of cash!

Does anyone have a dead DS1742 I can rip apart?

David

[james_s]

Yes I'm sure it's not a DS1315 or any other kind of phantom time chip, the RTC functions are not "phantom", they're fixed addresses overlapping the top handful of bytes of the RAM. You don't have to use any fancy tricks to access them like you do with the phantom RTCs, the enable to the RAM is passed through the RTC chip and when you access the RTC addresses it enables those and doesn't assert the chip enable to the SRAM. You don't need to rip one apart to see this, just look at one of the PowerCap versions as they're a bare PCB with the chips right out in the open, or compare the datasheets and it's obvious the RTC registers are different. Dallas makes or made a whole handful of RTC chips, some of the ones they offer integrated into potted modules are available separately, others are not.

Yes the DS1744WP is not trivially cheap, however when it's the part needed to get a $500-$1500+ scope or other valuable instrument back up and running it seems pretty cheap to me. Also once you've installed that you can easily replace the battery the next time it goes dead without having to do any surgery. The low budget alternative is to cut out the old battery and solder in a new one, it's right under the top of the potted module, if you cut the plastic lid off one side you can often see the battery peeking through a thin layer of epoxy. It's a standard BR1632 lithium button cell.

[David Hess]

I do not know about the DS1742W specifically but the Dallas NVSRAMs I have checked used SRAM supervisors which were available as separate ICs, mostly or all from Maxim, so it was possible to design and build an exact duplicate.

https://para.maximintegrated.com/en/search.mvp?fam=batteryback

[james_s]

The plain NVRAMs are easy, the RTC NVRAMs are not, not all of them anyway.

[voltsandjolts]

Does anyone have a dead DS1742 I can rip apart?
David

You have one already, its in your scope and its nearly dead anyway. No guts, no glory.

[voltsandjolts]

https://www.eevblog.com/forum/testgear/reverse-engineering-tektronix-tds3gv-module-for-tds3000-series-oscilloscopes/msg2784562/#msg2784562

[zebity]

Hi Tektronics Scope Users,

the Dallas DS1742W-120 is also a critical component is a number of SGI (Silicon Graphics Incorporated) Computers and there s a small group of us actively working on opening these up and coming up with a way of either cleanly attaching a replaceable battery on top or getting enough details on the internals to build an alternate replacement.

The posting are in the IRIX Network on DS1742W-120 and related are in this thread: https://forums.irixnet.org/thread-2488.html

So far I have done destructive investigation on the DS1742W-120+ and am going to open up a DS1742W-120 next. The -120+ has an upside down layout with the battery on the bottom, which means it is not a good candidate for battery on top replacement.

As I am a software person not a electronics person, any guidance from you electronics guys would be helpful.

Let's keep these old Tektronics and SGI devices humming.

Cheers from Oz,

zebity/jwhat/John/

[Stray Electron]

Zebity,

   Is that what is used in the SGI Indigo?  I still have one and one of these days i intend to fire it up again (hoping that I can remember the PW!)

[zebity]

Hi Stray Electron,

no Indigo uses DS1286 , see here for details on how to drill and replace battery: https://forums.irixnet.org/thread-1370-post-8924.html
Glitchworks also have a very nicely build replacement:  https://www.tindie.com/products/glitchwrks/gw-1286-1-dallas-ds1286-maintainable-repair-board/

So you are well served for Indigo.

The DS1742W is in the "big iron": Orign/Onyx 350, Tezro and Fuel.

These machines actually have 2 RTC chips with the Dallas and Snaphat, both of which now have end of life batteries and so it is important that replacement / quality repair solution is found.

Cheers from Oz,


zebity/jwhat/John.

[amyk]

Various PC motherboards had the same problem, and the solution is the same: cut into the chip to disable the battery and connect a new external one.

[james_s]

I recently worked on an older dental xray digital sensor and a DS1742W was about the perfect size to use as a test subject. At some point I'd still like to shoot this on film which results in a much higher resolution shot but my friend's business is in the process of moving so I don't currently have access to that machine. Anyway this gives a reasonable idea of what's inside this part.

[helius]

It appears the DS1742W and other Timekeeper modules have been cloned already, for use in Tektronix DSOs.
http://www.ebay.com/itm/293776182478

[sicco]

For the tds3000 scopes, I have an alternative in the making, partly inspired on james_s DS1744 patch piggy back board. My board has same DS1744W but plugs into the scope rear expansion connector for RS232, VGA, GPIB, Ethernet. My board will get you not just the RTC, but also isolated RS232 DB9, isolated micro USB serial port, Ethernet RJ-45, and allows an ESP32 DevKit4 to be added for those that want the WiFi web server from Russia discussed in other thread on tds3k elsewhere on eevblog. No VGA or GPIB though.

For this dead DS1742W workaround, the old DS1742W on the main board needs to be disabled - as in cut its pin 24 VDD or have its /CS input pin forced always high.

I’ll make a few more quite likely.

Expecting the JLCPCB delivered in a week or so - so fingers crossed.

[james_s]

I wonder what IC that ebay replacement is using? My solution is cheaper if you build it yourself, but I'd have to charge at least as much if I were building them for other people for it to be worth it, the parts cost around $50 IIRC.

[helius]

If the equivalent battery-less Dallas clock-memory chips are not available, I think you would need to use something that can be programmed somehow (to match register functions and access time). Low-power CPLD or Silego glue, maybe even PSOC?

[zebity]

Hi EEVbloggers,

I have pulled apart the DS1742W-120+, here is summary:

Draft Pin Details:

Pin 1 - Notched - Straight Through (A7)
Pin 2 - Notched - Straight Through (A6)
Pin 3 - Notched - Straight Through (A5)
Pin 4 - Notched - Straight Through (A4)
Pin 5 - Notched - Straight Through (A3)
Pin 6 - Notched - Straight Through (A2)
Pin 7 - Notched - Straight Through (A1)
Pin 8 - Notched - Straight Through (A0)
Pin 9 - Top Side R1, Under Side T1 (DQ)
Pin 10 - Top Side R5, Under Side T2 (DQ)
Pin 11 - Top Side R6, Under Side T3 (DQ)
Pin 12 - Notched - Ground Layer (Battery -Neg)
Pin 13 - Top Side R7, Under Side T6 (DQ)
Pin 14 - Top Side R8, Under Side T5 (DQ)
Pin 15 - Top Side R9, Under Side T5 (DQ)
Pin 16 - Top Side R10, Under Side T9 (DQ)
Pin 17 - Top Side R11, Under Side T8 (DQ)
Pin 18 - Notched - Straight Through (^CE)
Pin 19 - Notched - Straight Through (A10)
Pin 20 - Notched - Straight Through (^OE)
Pin 21 - Notched - Straight Through (^WE)
Pin 22 - Notched - Straight Through (A9)
Pin 23 - Notched - Straight Through (A8)
Pin 24 - Top Side C2 (VCC), Under Side C3 (10A45)

Draft Components

Capacitors x 3 (10A45)
Resistor x 8 (102) - 1 per Data Line
Voltage Regulator IC 6 PIN 10A45
Oscillator Crystal (Pin 1/24 Notch)
Battery Cell  - 3V CR1225 (+Pos Pin 12/13 Notch, -Neg Pin 12)

Here are pictures of PCB board that is encased in epoxy and sits underneath the main IC:





And here is carefully cut chip with battery extracted:





Full details of drilling/heating and cutting: https://tips.graphica.com.au/sgi-nvram.

If someone else has nice pre-built replacement then I think I would just use that ... ;-)

Cheers from Oz,


zebity/jwhat/John

[james_s]

That's not a genuine DS1742W, at least it's not like any genuine DSxxxx part I've seen. Where did you get it from? It looks like one of the Chinese clones (that don't work properly) that are all over ebay. Look at my xray a few posts above, the genuine part has a completely different layout.

[zebity]

Hi James_s,

thanks for feedback.

Yes I am aware that this might be a "fake" or the other alternative is that it is faulty.

It was a DS1742W-120+ variation which appear to be the ones which are the potential "fakes".

These have the battery and PCB on the bottom and not the top.

Is your X-ray of DS1742W-120 or DS1742W-120+ and is there any known difference in these variations ?

The spec sheet just indicate that the -120+ is lead free.

I have known good DS1742W-120 variations which are from my SGI machines, but have deliberately held back from opening these up until I complete some further testing and validation with EEPROM programmer I have been using.

I currently have two known good spares.
In playing with the "fakes" I am now pretty comfortable that I will be able to open up "real" variation with confidence that I will not damage it.


Cheers from Oz,


zebity/jwhat/John.

[Rasz]

Full details of drilling/heating and cutting: https://tips.graphica.com.au/sgi-nvram.

>Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure image '<URL>'. This request has been blocked; the content must be served over HTTPS.

[james_s]

Hi James_s,

thanks for feedback.

Yes I am aware that this might be a "fake" or the other alternative is that it is faulty.

It was a DS1742W-120+ variation which appear to be the ones which are the potential "fakes".

These have the battery and PCB on the bottom and not the top.

Is your X-ray of DS1742W-120 or DS1742W-120+ and is there any known difference in these variations ?

The spec sheet just indicate that the -120+ is lead free.

I have known good DS1742W-120 variations which are from my SGI machines, but have deliberately held back from opening these up until I complete some further testing and validation with EEPROM programmer I have been using.

I currently have two known good spares.
In playing with the "fakes" I am now pretty comfortable that I will be able to open up "real" variation with confidence that I will not damage it.


Cheers from Oz,


zebity/jwhat/John.

Looking again, your chip is 100% a fake. It has the same weird texture and faint blurry printing as the fakes I got a few years ago, and the internal layout is completely different. Mine is a DS1742W-150 out of a Tek TDS3000 scope but there is no visible difference inside parts of different speeds. I have xrayed 5 or 6 genuine DSxxxx parts and a handful of fakes and all of the genuine parts have a similar style. Fine traces, small vias, surface mount packages, very tidy assembly. The fakes are different, look at the PCB you extracted, big fat traces, huge vias, sloppy soldering, DIP package inside. Measure the external dimensions, the fakes are larger than the genuine parts.

The DS1742 went out of production several years ago so if you buy one with a current date code it is fake. If you buy one from China it is either fake or an old used part. Ebay is full of fake Dallas chips, you can tell immediately by the prices. Don't be scammed, the fake parts don't work.

[Rasz]

Don't be scammed, the fake parts don't work.

dont work in what specific way? they sure keep stuff in SRAM and return time

[james_s]

dont work in what specific way? they sure keep stuff in SRAM and return time

I bought about 10 different ones before I knew better. Out of all those I had two that worked, both were genuine parts that had clearly been sanded, blacktopped and printed with new date codes, they even came pre-loaded with data.

The others were all defective in various ways, most had different problems. Going from memory:
- Chip was readable but writes had no effect, could not store data on it or set the time.
- Completely dead, reads resulted in garbage.
- Seemed to work ok on programmer but did not function properly in scope.
- Read and write worked, but conents lost when power removed (defective battery)

Seems like there was some other symptom but I don't recall what it was. Incidentally I cut open most of the defective ones some time later and all of the batteries were below 1V by then, none lasted more than a year or so.

Then there is the fact that they are counterfeit parts created as a deliberate attempt to scam buyers. I would be willing to buy a Won Hung Lo branded "WHL1742" or whatever sold as a compatible replacement for a DS1742 provided that it works, there is clearly a market for these so it surprises me that no Chinese companies are doing it. But don't try to sell me a counterfeit Dallas branded part, that is cheating.