Deze website maakt gebruik van zogeheten cookies. Klik op [OK] om deze melding te verbergen.
Klik hier om meer informatie te lezen over de gebruikte cookies.
My interest was caught by a video on Youtube about the Racal 80794 CDU. I did already a tear down on some simpler avionics and the CDU (Control Display Unit) looks great as a more complex tear down. Since the DSKY (Display Keyboard module) CDU of the Apollo space program is way too expensive, this is the next best thing for me. ;-) It seems it's hard to get some usable information out of the device, so I have no high hopes. But I'm stubborn enough to give it a try if something more can be discovered.
The project is started recently, so there's no much information yet. But all there is is mentioned here as raw data for now...
purchase
I bought the CDU as shoen below. It's built by Racal Avionics Ltd. in England and nowadays the Racal is a piece of Thales' Avionics division.
The device is a control/display unit (CDU) type 80794 VS302. It's known that the basic device is type 80794 and that the VS302 is some variation on the basic device. It's also equipped with a NATO stock number (N.S.N) 7025-99-027-0798. Based on the markings inside the device was built in august of the year 1994 and had a 'gps mod' in the year 1995.
first tests
After applying 28 VDC, the device starts. By pushing the [BRT] (brightness) button, it's possible to increase and decrease the display intensity. All the other buttons seems to do nothing. Well, the display doesn't change by button pushes...
After applying power, the screen displays: CDU PROG: S302 Self test OK
tear down/reverse engineering
I thought I might have a try in finding out what the device can do. The device looks nice and there has to be something that can be learned from it.
data bus There's an UART chip inside, so possibly the device uses some RS442 or RS232 data protocol. Since my CDU mentioned 'GPS CDU' I thought (hoped) the data bus would accept NMEA data input, but this is wrong. The second CDU mentions 'No data from NCU'. After a little bit of Google 'research' I found that NCU means Navigation Computer Unit. The NCU is the 'heart' of the 'R-NAV' navigation system. The navigation 'intelligence' is in the computer and the CDU is 'just a terminal'. So the key data is sent to the NCU and the display data is sent to the CDU. So the navigation data isn't just gps data, but can be based on more sensors like a gyroscope, accelerometer and so on. Since I don't have a NCU nor data from this device, the needed 'handshake' is unfortunately unknown. I expect the NCU has to sent some initialisation command to the CDU to remove the self test message and activating the CDU for displaying received NCU data. This means that it's unlikely to get the CDU functional in it's original state. Reverse engineering the 'to be displayed' data lines is maybe an idea to bypass the cpu board and 'printing' other desired data on the display...
original use
My CDU is marked with a label mentioning "SEA KING MK 3A". After browsing on the inteernet I learned that a Sea King is a type of helicopter produced in 1969...1995. It's used as a medium-lift transport and utility helicopter made by Westland Helicopters. There's a cockpit photo of a Sea King helicopter showing two Racal CDU's are used.
versions
The Racal 80794 seems to be a modular device. There are several different hardware and software versions. Looking at two devices I noticed that the keypads can be different. Depending on the desired use, the keypad can be changed at the factory including the software of course... The button functions are unfortunately not always clear to me...
It's likely that [WARN] is for warning information, [NAV] for navigation, [FPLN] is probably used for flight plan information. The purpose of the [VNAV] button and the 'arrowed D button' is unknown to me...
inside view
By unscrewing four bolts from the front, the front panel can be pulled off the main housing. The inside view of the main housing can be seen below.
Inside view from the front after removing the front panel.
At the right hand side is the post supply board visible. The top board is the crt control board with beam deflection circuitry for example. The middle board is the digital control board with cpu logic. The lowest board is the video board for video processing.
The cpu processor logic board.
The video processor board.
After removing the side cover, the cover with the power supply module attached can be removed. On the image below is an inside look of the device shown. There are several blue trimmers visible for the crt adjustments. The high voltage generator is clearly visible. The high voltage generator is isolated in silicone and is attached to the top side with four bolts.
Inside view behind the side cover.
After removing the high voltage generator, the rear end of the crt picture tube becomes visible as shown below.
Inside view behind the high voltage generator.
display reconstruction
After removing the front panel of the device, there's a better view on the display tube. It's clear that the display is used for showing ASCII text in a eight rown and 19 column configuration. The display is burned in since the beam wears the phosphor in the same places of the characters.
Visible wear of the display tube phosphor.
I made a display reconstruction of the worn display. The display as reconstructed shows 'just' gps information. It shows the following information: The gps and navigation status; Current coordintates in latitude and longitude; The altitude in feet; The speed in feet per minut; The 'zulu' time (UTC); Bearings in degrees and speed in knots; FOM status (Figure Of Merit) to determine the gps accuracy; Number of sattelites found? Mode [NAV]?
The last five digits of the location are fuzzy, so the numbers changed probably a lot. The degrees however are rather clear showing 51 degrees North and 4 degrees West. Combining the information with the imperial settings (feet instead of meters) it's clear that the device was used in the Southwest part of United Kingdom. In that area are several RAF (Royal Air Force) bases, so that would make sense.
It looks like the CDU is 'just a fancy gps receiver'. Since there's a navigation [NAV] button, it's likely it's possible to enter a target coordinate and navigate on the bearings and not navigate on a displayed map like the modern navigation systems. I expect that the [NAV] button is used to set the destination information. There's also a [WARN] button that implies that a warning can be set, probably a warning of the desired coordinates are approached. the [MODE] key is probably used to set the device mode, like switching between feet and meters... This information makes it more likely that the data port is intended for connecting a gps receiver. The waypoints [WPT] and flight plan [FPLN] options are in my CDU not available. It's likely these 'luxury' things are options that can be different per version.
power supply
The Racal 80794 needs 28 VDC of electrical power. Behind the side panel is a power supply board located. The board is fed with 28 VDC from the rear panel connector. The 'basic voltages' are generated by an Ericsson EriPower DC/DC converter module (hidden below the psu board). The blue KPA2231 module generates +12, -12 and 5 VDC with a maximum of 25 Watt's. The power module needs 19...35 VDC, but 28 VDC needs to be applied to the board to generate an 'odd' voltage for the crt. The power module can be switched on and off by pulling pin 1 of the power module low. A 'floating' pin one activates the outputs and by 'pulling pin one low', the outputs are turned off. The generated voltages are connected via a connector the back panel of the device.
Power supply module.
Power supply module.
After opening the device I folowed the input voltages of the power module to the board edges. I applied 28 VDC and the device turned on. Yey! There's a current consumption of 764 mA so the power consumption is about 21,4 Watts (without panel illumination). This is much easier than a three phase 115 VAC 400 Hz signal which is rather common for avionics... Pin [T] is used for 28 VDC input and pin [S] is used for the 28 VDC return. Since most of the avionics is 'floating' it's officially not a ground, but a voltage return. Practically I connected ground to pin [S] and +28 VDC to pin [T].
[T] = +28 VDC (764 mA) [S] = 28 VDC return
keypad
By removing four bolts from the front panel, the front panel can be pulled front the device. There are several connecting pins at the rear of the front panel. The pins are connected to the logic board as shown below. Pins 1...18 are used for the buttons and pins 19...22 are used for button illumination. I measured on the pins while the buttons are pushed and based on the information I made a keypad matrix as shown below. I expected some (shift register) logic in the front panel, but the keypad is 'just' a button matrix. Pins 4, 5, 7, 12, 15 and 18 are +5 VDC in default position. Pins 6, 8, 14, 16 and 17 are in default state 'low'. By pushing one button, one 5 VDC pin is 'pulled' low and the corresponding other matrix wire is 'pulled up' a little bit above ground. The logic can therefore 'know' which button is pushed. Is for example pin 18 is pulled low and pin 16 is a little bit elevated above ground, button [BRT] is pushed. In theory one matrix pin could be reduced, but probably optimising the keypad wiring was more complex than adding one sensing pin. 6 * 5 = 30 posibilities there 'only' 24 combinations are used. 5 * 5 = 25, so by using one pin less there would be even one button position spare.
The rear view of the front panel.
Keypad connections.
Keypad matrix.
button illumination
connections Usually buttons are illuminated, so I expected some electronics here. Pin one didn't seem to be connected, so the only pins left were 19...22. Pins 19/21 and 20/22 are 'linked' with a white line on the panel markings. So I was set on the wrong track assuming these pin sets are linked. By applying power to pins 19 and 20, no illumination (nor current draw) was noticed. After fiddling around I concluded that the white lines represent the bulbs. So by applying power to pins 19 and 21 the half of the bulbs were lit. The other half of the bulbs are fed with pins 20 and 22. There are two separate circuitries for button illumination. This has probably to do with a fail safe design . Pin 19 is connected to pin 'K' of the rear panel connector. Pin 20 is connected to pin 'L' of the rear panel connector. Pin 21 is connected to pin 'a' of the rear panel connector. Pin 22 is connected to pin 'b' of the rear panel connector.
By applying electrical power to pins 'K' and 'a' one set of bulbs are powered. By applying power to pins 'L' and 'b' the other set of bulbs are powered.
voltages and current Based on my visual interpretation, the required voltage is determined. I have two Racal CDU's and in turned out that the illumination voltages are different! One requires 28 V (337 mA in total) and the other requires 5 V (1,5 A in total) So beware to increase the voltage slowly to prevent damage to the lightbulbs. 5 volt lightbulbs won't like 28 volts... 5 volts is rather common for panel illumination and 28 VDC is rather common for DC powered avionics, so it's rather safe to conclude that the voltages are 5 V and 28VDC.
One set of 28 VDC bulbs draws approximately 174 mA of current and both sets of lights draws approximately 333 mA of current in total. The CDU version with 5 V panel illumination draws 757 mA per set. This makes a power consumption of 9,2 Watts for the 28 V version and 7,6 W for the 5 V version! So almost one third of the devices power goes to button illumination alone. A led replacement for reducing power consumption would be wise here I guess.
amount of light The amount of light is also rather low. (Altough the white illumination one us much brighter than the green illumination one.) The (green) button illumination can hardly be seen in daylight condition. The button illumination is therefore only useful in very dark circumstances which makes sense for an aircraft not to compromise the pilots' view in the night. To obtain a greenish colour, each lightbulb is fitted with a filter. The cylindrical shaped caps are placed over the lightbulbs. The caps tend to get stuck in the housing, so not every lightbulb has the cap on them as shown below.
Buttons and lightbulbs.
To guide the light to the buttons, the panel is made of translucent material. The light goes trough the material trough the buttons to the milled out markings on each button. The translucent material is painted black to prevent light 'leaks'.
Light guide.
Button illumination at work.
video signals
When the brightness is maximised, it van clearly bee seen that the display is a 'scanning' display. As seen on the image below. In other words, for each screen refresh the crt beam 'scans' the full display area. Usually a horizontal line is 'drawn' from left to right across the screen. After finishing the previous line, the next line is 'drawn' a little bit below the line 'draw' before. This is repeat until the screen is fully covered. Usually are first the odd lines 'drawn' and after that the even lines are 'drawn'. Therefore it takes two full display coverages for one image. This is due to reduction of the screen flickering. This system is known as interlacing. A 15,625 kHz frequency signal can be found on the device. This is is a very nice clue! PAL B is a European video format that used a 15,626 kHz frequency. At first I thought the desired data was converted to a video signal, but this turned out toe be a wrong assumption. The cpu data bits are sent to the video board and there are separated vertical and horizontal deflection signals and a beam control signal from the video board to the crt control board. So there's no ' classic video signal' that can be used to use as a video input or output... PAL B video signals use 625 horizontal lines for one frame. The PAL image is 'refreshed' 50 times every second; 50 fields. 25 * 625 = 15.625. The Racal uses a refresh rate of approximately 60 Hz... Every PAL frame has two fields due to the interlacing so 50 fields are divided by to for the even and odd fields. The result is 15,625 kHz. Since the display is rather small I don't think the display information is interlaced and is 'just' a 'single sweep'.
test setup
For reverse engineering purposes I wanted to measure 'live' signals. Therefore I removed the contents of the case and connected all the modules/boards together. The result is that the device is working, onle the case is 'missing'. Now it's possible to take measurements on the connector of each board. The test setup is shown below.
video generation Since the availability of the 15,625 kHz signal, it's logical that the display is the scanning type display as mentioned before. I'm not a video expert, so I wondered how the cpu data is displayed on the screen. The digital information has to be 'converted' from digital bits to x- and y-axis deflection of the tube and a bean control (on/off) signal. I expected some graphics chip, but there is no graphics chip so I started thinking of an experiment.
- There is a digital cpu board that interfaces the keypad. - There is a video processing board. - There is a crt control board without logic, only a heater power supply and the deflection control circuitry. - I can't find a 'usual' video signal with synchronisation pulses. - There are deflection ramp signals at the mainboard.
Therefore I removed the cpu board and restarted the circuitry. The display showed the information below.
The characters 'all over the screen' is very valuable information! The brightness is set by a button on the keypad and the brightness is at it's maximum when the logic board is removed. It's likely some analog signal is sent from the digital board to the crt control board. The other interesting thing is that there are characters on the display shown. This means that the video board converts digital data into video signals. There are two EPROM's and one PAL chip. I expect that one EPROM contains the characters (and cpu program?!) and the other EPROM contains some warning information. Since PAL's are used in other avionic crt display units, I expect that the PAL has 'something to do' with video signal generation. So there is no dedicated graphics chip, but the chips combined are responsible for the beam control and deflection ramp signals. Now it's time to retrace the beam control, deflection control and try to reverse engineer the data signals from the cpu board to the video board. The displayed test information is known, so there has to be some data signals from the logic board to the video board that should be reverse engineered. If there is no test data from the cpu logic board, the video signal board is so 'smart' that the test display information is generated at the video board when display data is absent. Well, enough to check!
cathode ray tube/picture tube [raw data]
crt board [raw data]
mainboard [raw data]
a second one (and repair)
Since I'm intrigued by high quality engineering products, I'm fond of this CDU. And therefore I bought a second one. Well, technically this is the fist one but the second one bought arrived earlier. ;-) The first bought and second one I received is in less good cosmetic condition so ideal for reverse engineering preserving the 'nice one' in optimal condition. after receiving I connected the device to 28 VDC and it didn't turn on and a buzzing sound was heard so the power was turned off rather quickly. Usually the hardest working components fail, so the power supply is (except for 'checking the obvious') suspect. For a quick test I swapped the power supply boards and the device powered up, so this confirms that the power supply had gone bad. I fed 28 VDC the power supply to see/smell/measure what's wrong. By turning up the voltage there was a very distinct 'electronics smell' so something is overheating. I placed a camera to record what's wrong. It became very clear that a 47 uF 16 VDC tantalum capacitor had gone bad. These caps are notorious for failure. Tantalum capacitors tend to get short circuited when getting old and/or when they're subjected to voltage peaks. The result is a short circuit and a tantalum capacitor getting very hot! It's always wise to replace these tantalum caps with MLCC (SMD) capacitors of the same capacitance. MLCC's are much more reliable and a good replacement for bad tantalum capacitors. After replacing the capacitor the +12 VDC voltage output works fine again. I made rather short video of the experience. Since the power supply is partially dismantled for the repair, I planned to do a reverse engineering job for the power supply...
The gps and navigation status;
