Retro Fix: Packard Bell Platinum Pro 755 (1996-1997)

The first Windows-based PC I was introduced to in the early-1990s was a Packard Bell Legend 660 or comparable. It had the Microsoft Entertainment Pack 2 bundle featuring Rodent's Revenge and Rattler Race, two games I grew very fond of and would later develop a few games and variants heavily inspired by that. In that era I'd often ride my bike to the local Radio Shack to top the scores on their demonstration computers.

Decades later, I still appreciate that creative age of desktop computing even if these systems are collectively referred to as "Packard Hell" by select groups. At some point in time I found a Packard Bell Platinum Pro 750/755 tower on the curb to giveaway. I brought it back and eventually set it up in another retro corner. Since I planned to use it as an intermediary machine for creating and archiving old floppy media, I swapped out the Iomega zip drive with a 5.25" drive instead, knowing I also have some external ZIP drives if ever needed (although zip disks were short-lived and notoriously prone to click-of-death failure). Read Full Article

Retro Exploration: MDT-870 Mobile Data Terminal (1986-1996)

I recently impulse bought an ElectroCom Communication Systems MDT-870 radio car terminal for $5 at a surplus sale. Never knew much about these sort of computers but learned a lot since, and yet remain largely in the dark about this particular model given the complete absence of any documentation or schematics online.

This model in particular was common in squad cars in the 1980s-1990s. Some metadata extracted from a ROM that I dumped when troubleshooting indicated "COPYRIGHT 1986-1996 ELECTROCOM AUTOMATION INC." and the particular ROM in this unit had a generation date of March 25, 1996. Based on this, the department may well have used it for the better part of a decade before phasing it out in favor of more contemporary solutions.

This exact model appears in an early scene of Terminator 2: Judgment Day, where T-1000 uses it within a police car to query the details of John Connor. Having now used the real device the movie depicts, other than the simulated sound effects in the film the actual on-screen display appears to have been produced and filmed on the actual MDT-870. Of course the one on the set was not wired to actual police databases, but the text on it was typed within one of its free-type interfaces.

Initial Power-up and Short Glimmer of Life

When these were actively used, they had a variety of hookups to police radios, databases and similar. The one I received was barebones aside from some of the wiring that itself appeared cut and severed at various points. It runs on 2A 12V DC power, typically wired to the vehicle's battery/alternator. After a little bit of review I traced the original positive/negative wires and reworked them into a simple AC-DC power converter adapter and spliced a new cord to go along with it, from a typical computer adapter.

I was able to power up the unit and heard some remarkably 80s-sounding beeps as it booted up. It initially read "SIGNOFF ACCEPTED" and then took me to some integrated applications. This included a MEMO WRITER, QUERY DRIVER STATUS, and some others that I can't recall.

Alas, this was a short-lived effort as after typing some keystrokes and photographing the images above, something fizzled out and I lost all display and signs of activity.

Hardware Analysis

Unfortunately, not a single trace of documentation, schematics or ROM dumps for this system exist online. I found very few references to it at all. There were sporadic mentions of it appearing in movies, a fan-made STL model of the device citing Robocop 1, and other users looking for any documentation in hopes of setting one up in their own personal vehicles for nostalgia or show. I found one post from more than 15 years ago where someone did have the full gauntlet of schematics, programming guides, service manuals and even hardware-based interface adapters for PC communication. Alas I wasn't sure how to even approach contacting that user at this point in time.

Disassembly was not too difficult. In fact there exists plastic doors on the back of the unit for direct access and swapping of the CDVR and ROAM ROMs. The entire unit promotes itself as "Proudly Made in the U.S.A." Several of the ICs including all ROMs, CPU (OKI M80C85A-2 x2) and Graphics Controller (Intel P8725) were pre-socketed using machine pin sockets. I know many advocate for such sockets, but when wanting to quickly remove and replace ICs when troubleshooting and testing, I still find the flat leaf-type DIP sockets much easier to work with and less prone to bent and broken pins. That said, I did eventually swap the three machine pin sockets for the ROMs with leaf style to make my own life easier as I was burning and testing all of those ROMs continuously.

To actually get at the core ICs, you have to unscrew the back (and any brackets that may be attached) and carefully separate the two halves. The back half houses the small amber-lit Clinton Electronics 798P1NGLP picture tube and a simple speaker. Underneath this is the video sub-board and on the other side the main logic board. A ribbon cable transmits data from the logic board to the CRT board and ultimately into the display. The front half houses the membrane-based keyboard, LEDs, variable controls for adjusting Sound Volume, Light (Front LEDs) and Display Brightness. A side control also allows you to adjust the keyboard-based light brightness.

The system has two 80C85A CPUs (8085-based, the minor successor to 8080 and comparable to Z80 except with syntax I find to be much more cumbersome to decipher). The CRT is driven by the Intel 8275 (P8275) video controller. It has two banks of Sharp LH5168 CMOS SRAM and oneM81C55-5 CMOS SRAM a variety of other controllers and ICs. It also has a TMP82C55AP CMOS Programmable Peripheral InterfaceI noticed pin one of the uppermost CPU was bent underneath itself when inspecting the chips, but that didn't seem to have any impact.

ROM Summary and Dumps

There are three ROMs installed in the logic board, with only one of them providing a checksum value to compare clean ROM dumps. They are all programmed onto common 27CXX EPROM chips. Through trial and error, I made the following educated conclusions:

  • 502.87003.51 MDT870 CKSMC7B3 MDX-ROAM V2.2 (27C256) - This is the core ROM / OS. It is designed to interface with special frequencies/radios and other input/output devices for querying data, recording memos and otherwise communicating in a pre-mobile, pre-WWW era.
  • 501.64519.51 641.07910.00 V1.1 U4 CHRGEN (27C64)- This is the character generator. Mine wound up corrupt before I was even able to get a proper dump, so I am unaware of the precise layout of the original. However, after experimenting I was able to reconstruct a usable CGROM derived from the HD44780 controller after reversing and reordering them. If this chip is corrupt or removed from the set, the screen displays solid blocks as typical when no character generator exists.
  • 501.64520.51 641.07900.00 U16 V1.1 CDVR (27C64) - Originally I was unclear what CDVR stood for in this context. But it became clear as soon as I removed it from circuit that it is the CRT Driver. With it removed, the CRT cannot render anything but a high-pitch raster or several as if suffering vertical collapse.

I made ROM dumps of all three of these on my vintage EP-1 programmer. I verified the checksum of the ROAM firmware matched, but had no basis to compare the other two in the event they were corrupt. I later concluded the CHRGEN ROM had indeed corrupted for reasons unknown, whereby once I had fixed the display issues itself that chip would show mostly solid blocks and EPROMS I burned from the dump did the same. Trying the original in my more modern TL866-II programmer detected faulty pin(s), and comparing a dump made from it to any on either programmer always yielded errors. However, I'm confident the ROAM and CDVR dumps are functional and precise.

Below is a ZIP file containing the complete collection of ROM dumps I made in various formats (BIN, Intel Hex, Mitsubishi Hex and another format or two). It also includes my usable 2022-created character generator ROM, one variant with underlines and one without.

  • MDT-870 ROM Dumps .zip file (MDX-ROAM, CHRGEN [Corrupted], CDVR, CUSTOM CHRGEN 2022)

Character Generator Woes

After a lot of testing, trial and error I eventually wound up with a semi-bootable MDT-870 again. I believe there was one bad CPU, a few dry solder joints, at least one shorted/dislodged socket, and something astray in an SRAM chip (and am still not convinced the two SHARP chips are not damaged, this will take more testing).

The beep codes were back and the display was, well, showing something or other but basically all corruption.

I recognized even when typing that the glitches correlated to the keys typed, which is usually a sign of bad video RAM or a failed character generator. More testing of the original EPROM proved it to be a problem. I tried a fresh 2764 EPROM with the prior dump and experienced the same symptoms. Peaking into the ROM dump itself and I found almost entirely FFs or 00s, which definitely seemed peculiar compared to other ones I'm familiar with.

Typically character generators define the character sets using 8x8 (or 5x8 or 5x7 or some variant) where each single HEX value depicts one byte-row of character data. So FF would mean "fill in the entire row solid" and 00 would be "keep the entire row blank" but usually you'd see intermediary hex values, such as 3C to indicate "fill only the inner four bits) and this is how basic characters can be defined. Row-by-row. With this in mind, I created a dummy character generator filled with FFs but also randomly changed some values, as an experiment. This yielded the following:

That confirmed to me that the display problem was indeed just a wonky character generator. And, after some additional experimenting with patterns and characters I concluded the CGROM for this set is a pure data dump of constructed characters, it contained no additional logic or coding. This was fortunate as if it intermixed coding and byte data as some do it'd be vastly more difficult to guess the structure going forward.

I then went on a roundabout manner of creating some new character generator that'd at least satisfy the need to see what text is showing up on the screen. As a foundation I used the binary data constructs of the HD44780 and pasted them into a new binary file, repeating the entire set multiple times until padded at 01FF to match the original ROM size. When I tested this new ROM in the machine, I could tell we were headed down the right path.

Seen above was the initial run of a new character dump. I was in some input screen that allowed me to free type. The characters in the middle were me starting with ABC...890. You can see firstly how they are all inverted. This is because the CRT itself is mounted upside down then reflected off a tilted mirror to project through the front of the terminal. The other problem is that one letter gets skipped with each one I press. So A=B, B=D, C=F and so on. This was an immediate clue that the layout of the original CGROM repeated each character twice, AABBCC...889900. Eventually I realized that the most-significant bit (leftmost in a row of 8) determined whether the character would have an underline or not. If padded with "FF" there'd be an underline, otherwise there wouldn't be. This likely explains the need for replicated lines/characters. To my knowledge, lowercase characters were never displayable or included.

To resolve the reflected issue, I passed the binary format into a reverse line script. I then pass that into a binary-to-hex script. This could then be sit out into another binary file to appear the correct orientation when viewed through the terminal's mirrored screen. It was then a matter of comparing keystrokes with what the screen depicted, and swapping around the ordering to ultimately end up with a version depicting all characters successfully. You can see below how the mirror affects the display, both on the raw CRT and when viewed from the front with the redone character set.

It Lives Again, But How To Initialize?

Through the various iterations of it working, not-working then working again, any and all previously preserved data seems to have been wiped clean. Some of that likely happened while I was making contact with various pin-outs of the numerous memory-related ICs.

Before I had a proper character display again, I actually wound up with a different start screen. It would throw the error "NO HOME CHANNEL IN LIST" and then enter an empty typing screen. Periodically it would then interrupt with the error: "CHECK CONNECTIONS TO RADIO" Still, being able to type was interesting itself, at least it was something!

But after the final cleaning of the keyboard and another loss of power, then some more IC tinkering, the new screen is different once more. I'm not stuck at the "INITIALIZE MDT" screen and no characters have any affect.

It is evident based on the text data extracted from the ROM dump (see below) that the ROM has some internal way to define channels and so on. Somewhere in the code lies the string: PRESS "C" TO ENTER RAD. CHANNELS and related ones as well including ENTER RADIO CHANNELS and PRESS "X" TO EXIT. What I'm not sure of is how to achieve this, or if that by itself also requires interfacing with an external system.

If I make any further progress on this, I'll update this post. One interesting discovery worth checking into more thoroughly is the Open Hardware Driver for CRTs. This seems like a promising approach to easily hacking this or similar sets to display typical video output on its crisp amber display. "The driver circuit takes a 0-3.3V analog signal for deflecting the beam along the X and Y axis. The amplifier has enough bandwidth to handle NTSC video, so displaying video along with vector letters and shapes is also a possibility with this circuit."

Extracted Strings from ROM Dump Metadata

As part of the main ROM dump (502.87003.51 MDT870 CKSMC7B3 MDX-ROAM V2.2) I parsed through identified strings. They are included below, as well as their relative memory location at least as laid out in a decompiled Z80-derived version of the 8085 source. The fact that I was unable to find any references to the applications I had initially observed, may indicate that those along with the radio codes and data were still cached in some form of non-volatile memory but ultimately wiped out.

  • 0005: Generated 3/25/96
  • 04D5: WARM
  • 156F: MD:4
  • 1699: <FORM>
  • 24BD: @ZXCVBNM,.
  • 24CD: 1234567890
  • 2EF7: 99RESET
  • 2F2F: SET ?
  • 2F99: TX LEVEL ADJUST (R49) TEST 2
  • 3249: (FOR CHANNELS 1-9)
  • 3267: (FOR CHANNELS 10-16)
  • 327E: XMIT TIME IS MINUTES (03-25)
  • 32A4: PRESS "X" TO EXIT
  • 333C: MDT-870
  • 334E: FIRMWARE SERIES 20 V1.2
  • 336E: REV. DATE 3/25/96
  • 5405: <ERROR>
  • 5415: <PASS>
  • 5420: <TEST>
  • 64F8: LED TABLE

Can Cheap UV Phone Sanitizers Erase EPROMs?

One of the outputs from the pandemic has been a surge in cut-rate priced UV cleaners and sanitizers for phones and small devices. You can find them everywhere, often for under $10 new and $5 used. I do a lot of EPROM programming, especially with vintage chips, such as programming new ROMs for my recently restored TRS-80 Model I. To program ROMs requires that they first be erased, which is achieved using UV lighting that, in decades past, involved pricey specialized equipment.

While there are now plenty of dedicated EPROM erasers on the market, I have found the most popular budget ones run from $25 to $40 or more, with questionable build quality and effectiveness. The one I ordered online was made out of a crude plastic molding devoid of any UL certifications or safety precautions. It didn't even come with a drawer handle and had other defects. I found that the integrated light (a 4W F4T5 GL) was also faulty, due to poor solder connections that I had to manually remedy before it would erase chips at all. The timer was also entirely inaccurate and unpredictable.

That got me thinking. If these new devices operate using similar UV-C ultraviolet technology, will they be powerful enough to erase EPROMs as well? In short, yes. Well, some of them at least! I accumulated half a dozen or so devices all for under $8 each, both used and new. I even added in a toothbrush's UV cleaner for good measure. I then tried each of them out, and here were my general findings.

You'll want to find ones that have a minimum of a 10-minute power cycles, or that allow you manual control how long they run. Several of the cleaners I had would only run for five minutes at a crack, which was not intense enough to erase the chips I tried. Even with dedicated EPROM erasers, 10 minutes is a reasonable expectation of threshold of time needed for proper erasure of common chips.

For maximum reliability, you'll want to find cleaners that allow you to prop the UV window of the chip up as close as possible to the bulb itself. On the Phonesoap L500-1 that I got for $3 at a thrift store, the top half of the case allows direct contact with the bulb. So, you can turn it upside down and load a row of chips with their windows touching the bulb, close it up and it'll run automatically for 10 minutes, which I found fully erased every chip I tried. Since the device has two UV bulbs — one at the top and one at the bottom — you could in theory cut out the plastic floor and then double-stack the chips leg-to-leg for twice the capacity with the windows facing each bulb directly. But, I found that chips placed outside the direct vicinity of the bulbs in these cleaners, even half an inch away or so, did not get enough UV intensity to guarantee erasure after 10 minutes.

The PhoneSpa portable UV wand was another effective and cheap solution. This one does not have an automatic shutoff and is USB-rechargeable, so I was able to rest the wand on a row of EPROMS for 10 minutes or so and then manually shut it off, while confirming the chips had been erased. For stubborn chips, this device is convenient because you can run it as long as needed.

Avoid the cleaners that do not use full-length fluorescent-style tube bulbs. I found that the ones with small LED-sized lights do not have enough surface emission to cleanly erase chips, or require extreme precision placement to do so. And while many of these devices don't divulge the specifics of their lights they use on the packaging, you should try your best to find ones that assure it is UV-C with at least 3 watts of power.

As a final experiment I dug out an old Philips Sonicare HX6160 toothbrush sanitizer. This uses a 4W concentrated UV bulb meant for brush heads, and has a 10 minute timer. I found that this to be very effective for erasing chips as well, as long as the chips are placed with their windows directly facing the bulb tip itself. This gave me an idea for a 3D-printed adapter of sources that could mount several EPROMs on the base to always be aligned with the bulb, but I haven't had time to pursue that just yet.

In conclusion, I did find that many of the $5-10 UV cleaning stations can easily double as makeshift EPROM erasers at a fraction of the price. They also tend to be structurally higher quality, at least compared to the self-described EPROM eraser and budget I purchased for more money online.

Goodbye Radioshack, My Old Friend

Today I stepped foot into my regional RadioShack as it approached the final few hours of existence, being one of 1,784 stores to close as a result of the bankruptcy. Growing up, RadioShack was the only tech outlet in my hometown. Many fond memories were made as I'd bike to the store repeatedly to play on their showcase computers or explore any number of other technical toys and gadgets in the 1990s. I recall spending hours playing one of the preloaded games their machines to claim the high score, the name of which escapes me now [it was similar to Snake but you simply kept growing and didn't need to collect any items].

One of my earliest computers was a (Radioshack) Tandy TRS-80 Color Computer 2, which contributed significantly to my initial programming developments.  I had the Logo Programming Language cartridge and with it was able to create many goofy designs by programming the on-screen turtle to move in specific patterns. The included BASIC manuals proved to be an endless source of inspiration and knowledge in my youngest days of application development.  My first MIDI-capable electronic keyboard also came from RadioShack and remains in active use today.  In fact, I accumulated quite a number of RadioShack merchandise over the course of two decades including scanners and radios, RC cars, joysticks and peripherals, handheld games and many miscellaneous items.

Alas, the world evolved and RadioShack ultimately found it impossible to stand out in a sea of retail shops and online alternatives offering the same like-minded products.  I watched as RadioShack morphed from a technical epicenter of awesome gadgets to a run-of-the-mill cellphone reseller with generally overpriced cables and accessories. All of the specialized electronic parts that used to line the walls were condensed down to a single filing cabinet, with only a lingering RC car or two ever on display to remind us of days gone by.  With cellphone carriers on every block and large retailers like Walmart and Best Buy offering much of the same for cheaper, not to mention Amazon, I had little interest returning to RadioShack these past several years.  I often wonder if RadioShack could have succeeded by specializing in more niche and exclusive product lines, such as Internet of Thing Gadgets and other consumer novelties seen at trade-shows each year. Too late now.

I walked away from RadioShack's final day $40 poorer, but with a mountain of cables and accessories that I may not ever have a need for. All of their remaining inventory was marked down 90-95% from the normal asking price so I grabbed up several heaping armfuls of what little inventory remained.  Cables that were normally $11.99 were now $0.60.  6' component cables went for $1.00 each. Almost everything I bought was $2 or less. That is impossible to beat no matter where you buy it from! According to the excessively long receipt I saved $506.75 based on the normal RadioShack prices, however high they may have been. I guess as a consumer that is one morbidly positive aspect of stores going bankrupt; you can get great deals if you hold out until the very last day. (The associate told me he was actually relieved it was finally closing after such a long time of being without profit and tethering on bankruptcy.)

Thrift Store Gold: Sony ICF-2010 Radio for $3

ICF-2010 Shortwave Radio

The Discovery

When searching for a cheap AM/FM radio this past week, my mom stumbled across one at Goodwill amidst a shelf of electronic rubble. It carried a price tag of $5.99, but all pink tags were half-off, bringing the grand total to $2.99—that's $3.16 with tax. To put this into perspective, she paid a dollar less for this radio than the cost of a Quarter Pounder with Cheese from McDonalds. Not bad. However, there was no way to test the radio at the store and, until getting home and conducting a little research, she was oblivious to what type of radio she had purchased.

The radio she acquired was, in fact, the highly sought after Sony ICF-2010 shortwave radio introduced in 1985 for $319 [that's $702 with today's inflation].  Sony manufactured the radio for nearly two decades before discontinuing it in 2004.  As a portable shortwave radio, it boasted impressive capabilities for DXing hobbyists and accrued a large fanbase over the years. As a testament to the ICF-2010's longevity and impact, an active Yahoo Group of over 2,600 members still exists, with more members joining daily. Since being discontinued, the radio has thrived on eBay with most selling for $200-$400 depending on their condition.

Interesting Tidbit: The Sony ICF-2010 was used by Ana Montes to secretly communicate with, and pass intelligence to, Cuba's Intelligence Directorate via shortwave frequencies before being caught in 2001.

Getting back to the meat of this story, after putting in the required batteries (2 AA and 3 D) it became apparent that the radio had a serious power malfunction.  Usually it had no power at all, and other times it had just enough juice from the AA batteries to display an 'Error 3' message on the LED screen—a relatively common occurrence with this line of radios resulting from age and general use.  The radio would not come on no matter what was attempted.

Fixing the ICF-2010 Shortwave Radio

The first task for fixing the radio was to diagnose the existing electrical current. Seven screws hold the radio together, including one in the battery compartment.  I observed one screw was missing along the case, suggesting a repair may have been attempted once before by the previous owner.  With the back off, I used a digital multimeter to verify proper current was being received at the battery terminals.  It proved touchy to get proper connectivity as a result of natural age, whereby the springs and related terminals had lost some of their oomph.  So, I took a small tweezers and subtly stretched the spring coils to provide a more secure conduit for the batteries, being careful not to pull too much at the risk of breaking anything (it is a good idea to hold the base of each spring tight with your finger before stretching the coil).

Even with the coils now relatively firm against the batteries with steady current at each end, the bigger design flaw with this model soon became apparent.  The D battery compartment is physically part of the back casing with no physical wires connecting them to the circuit board.  As such, carrying voltage from the D batteries to the main circuit board relies strictly on pressure-based contact between the metal ends  and two small solder pads on the main circuit board.

Over time, the relatively scant solder from the manufacturer wears down and contact gets lost. To remedy this, I made a few final adjustments to the metal clamp on the other end of the D battery compartment with a needle-nose pliers and then added new solder to the pertinent pad locations on the circuit board to provide a more cohesive contact area.

Rather than building up the solder pads and adjusting the battery terminals to help with contact as I did, a more permanent solution would have been to connect dedicated leads from the battery terminals to the solder points. Alas, the method I took should suffice for quite some time and also allowed me to more efficiently verify the cause and solution.

With all of the tweaks and adjustments in check, the only thing left to do was to close up the radio and screw the two halves back together.  Due to the physical pressure required to achieve contact between the battery terminals and the circuit board, tightly screwing the back of the radio into the front is a mandatory step to ensure adequate contact can be made.

Having reassembled the radio, I put in all of the batteries and switched the main power switch to 'On'.  The ICF-2010 includes a main power switch on the side along with a secondary power switch on the front; the side power must be set to 'On' or an error message will result. Having the extra power switch on the side helped ensure the radio didn't accidentally power on when traveling with luggage, but is also an easy feature to overlook.  Finally, I slid the front switch to 'On' and heard the titillating sound of static. When tuned to a proper frequency, the sound came in loud and clear. Success! A quick search on eBay revealed that even 'non-working' models with the same problem as this one regularly sell for $130 or more.

From the Manual

The official ICF-2010 manual describes some other possible causes for the four built-in error codes. "Error.3" is the most troublesome of the errors and also the most common these days; the real solution is likely more aligned to what I described here than what is explained in the manual. None-the-less, the specific causes from the manual are reprinted below and should be checked. In addition, you should make sure to have at least the two AA batteries installed even when using a power adapter to ensure proper functionality, as these batteries preserve the date/time and memory bank data and the radio may not operate without them.

  • ERROR.1 (Appears during direct tuning.)
    • A frequency beyond the receivable range has been input.
    • The band of the input frequency (AIR, FM or AM) is selected incorrectly.

    ERROR.2 (Appears during programmable timer operation.)

    • The programmable timer is operating and the key or the control you have touched cannot be activated.

    ERROR.3 (Appears when the POWER switch is set to ON or when the SLEEP key is pressed.)

    • The MAIN POWER switch is set to OFF.
    • Weak radio batteries.
    • Incorrect polarity of radio batteries.
    • The AC power adapter or the car battery cord is not connected securely.
    • Battery operation is attempted while an AC power adapter or a car battery cord is connected to the DC IN 4.5 V jack, but not to a wall outlet or a cigarette lighter socket.

    ERROR.4 (Appears during memory scanning.)

    • All the memorized stations are skipped. Erase the ◀ mark.