Wallwart Musicbox “Nanophone” teardown, reverse engineering and repair
One day I got my hands on a obscure device for repair. It looks is like a old power wall wart adapter with a 230V 50Hz euro plug but instead of delivering power it delivered music.Therefore it has a 3.5 mm audio jack, volume control for a screw driver and a four position slide switch which selects between a classical music track, a samba track and two tracks i describe a 90ys cheesyness. The person I got it from used it from uses it for on-hold music on his telephone system.
The device markings are “NANOPHONE Music” on the outside and “NANOPHONE” and “Made in Germany”, “reichert telemedia” and some regulatory symbols on the euro plug side. There is no copyright mark/year and the reichert telemedia is missing an identifier what company form it is like “GmbH” or “AG”. I suspect the device beeing from the middle to late 90’s. Googling of Nanophone and Nanophone Music gave no usable results (as of writing this) and “reichert telemedia” had two results, one of a voice actors reference and one that a domain “rechert-telemedia.de” had existed at one point but the “Wayback Machine” has nothing archived.
The defect the device had was rather interesting. The music was reconizable but very distorted. You can hear it in the video down below at <comment if I forgot to put in the timemark>. You can also hear the undistorted Music in the video but I will not put the raw data online since I dont have the premission to do so.
The electronics are digital and solid state an the tracks are recorded audio (not a tracker or midi player). The Internal power supply was a straight forward design with a transformer with two secodary windings two full bridge rectifiers smoothing capacitors and zener diode regukators creating +5V, GND and -5V. Really interesting is that this device has no CPU or microcontroller in it. On fist look I found:
- HEF4060BT (14-stage binary ripple counter and oscillator, schmitt trigger inputs) and a 2.024 MHz quarz
- TP3057wm (Serial Interface CODEC/Filter COMBO Family, a-law) Datasheet
- M27C801 (1MByte EPROM) Datasheet
Looking these parts up i could not see how this is going to work. 1Mx8 require 20 Bits of Adress or 18 Bits if you consider track segmentattion, so 14 bits are not enough. Also the EPROM is has 8 bit parallel, but the codec requires serial data and various clocks. Then after removing the EPROM i found four more ICs. I have seen components hidden under bigger DIPs before but then the DIPs where socketed and only smaller components where under it, but this time it was quite a surprise. These four ICs where:
- two CD4040BCM (12-stage binary ripple counter) I missread them first so expect typos furter on
- HEF4014BT (8-stage parallel in shift register)
- HEF4001BT (Quad 2-input NOR gate) only used for two not gates, what a waste 😉
Now things start to make sense. with the two additional counters ther are now plenty bits to generate the address and clocks and the parallel in shift register handles the parallel to serial conversion.
I dumped the contents of the EPROM and thought to properly to decode them I have to reverse engineer the schematics and do some bits and bytes reordering later on.
To reverse engineer the schematics I removed all ICs with a hot air station to be able to see the traces underneath them. A previous attempt to reverse engineer without beeing able to see these traces preoved to be to hard. Afterremoving the chips the solder was cleaned up with flux and a soldering iron and the the flux was cleaned with isopropanol. Then I took photos of the two sides of the PCB with some backlight so the contrast between the glowing board and dark traces was very visible.
At this point it was very late and decided to pause the reverse engineering. I already had the photos from the PCB, chip markings/positions from the ICs and the resistors and diodes as I had the EPROM contents. So I reassembled the the PCB except for two parts I knew where the cause of the defect. By the way I socketed the EPROM, because I had contact problems dumping the EPROM (note to myself: clean the contacts of desoldered chips before putting them in ZIF-sockets) and thougt I might have to retry to dump it.
Now to the repair. 90’s device 24/7 in service for more than 20 years in service. Thats the first hint. Inefficient Zener Diode regulation generating more heat than even 7805/7905 – second hint. Crystal deposits on the inner side of the case? Since there is no battery theres only one possible cause of it:
The two electrolytic smoothing capacitors are dryed out.
White Crystal deposits on the inner side of the case
Just for fun I tested the capacitors in my chinese component tester. The ESR of the two capacitors was shown at 150 Ohms and i thing it only hit the limit of the tester.
Without working capacitors the +5V and -5V rails where not able to hold their level and colapse 100 times a second causing a repeating brown out state in the digital part (glitches, counting missing clock cycles etc.) and distortion on the analog part. The effect of the distortion had a nice character, maybe it can serve as an effect for analog synthesyser music or as an guitar pedal 😉
After replacing the two capacitors with new ones the device was now again in working condition and went back in service the next day.
The following weekend I went to back to the reverse engineering. I imported the two photos of the PCB into GIMP. After mirroring the bottom side I made them align as good as possible. At different layers I put the component names and values and traced the copper traces in different colors as with a PCB software. Then I used “TARGET 3001! V18 discover” to document the schematic. this took a few hours but i got the schematic reconstructed. It is not complete, like +5V/-5V, decoupling capacitors and other stuff I didn’t care about are not included.
Here it is:
You can download the GIMP and Target files here: Nanophone_RE.zip (25MB)
There are a few typos in the component names because tired me missread the tiny laser marks.
Now to understand how the device works I start with the HEF4060BT(14-stage binary ripple counter and oscillator) wich together with the 2.048MHz quarz forms an 2.048MHz oscillator with multiple divided different output clocks.
One undivided 2.048MHz clock goes into the TP3057 just because it can’t live without one.
On pin 14 of the 4060 there is a 8kHz (2.048MHz / 2^8) clock comming out. This is the sampling clock at which the audio samples play back. Therefore this clock goes into the TP3057(codec), the CD4040(counter, cascaded) and the HEF4014(parallel to serial)
On pin 7 of the 4060 there is an 128kHz (2.048MHz / 2^4) clock generated. This clock is used to cklock the serial data from the HEF4014 to the TP3057 so these two IC receive that clock.
The two CD4040(12-stage binary ripple counter) are cascaded to form an 24 bit counter however only 18 bits are used. This counter is driven by the 8kHz clock to generate the next address for one audio sample at the rate the audio is played back.
The 4 position slide switch sets two bits for music track selection. These two bits are concatinated on top of the 18 bits from the two CD4040 to form an 20bit address.
So depending on the switch position the 20 bit address will count repeating from
- 0x00000 to 0x3FFFF for track 0
- 0x40000 to 0x7FFFF for track 1
- 0x80000 to 0xBFFFF for track 2
- 0xC0000 to 0xFFFFF for track 3
So each track has 2^18 (=262144) samples wich equals 32.768 seconds of audio track when played with 8kHz sampling rate. Now imagine sitting in a dark room playing the same 32 seconds track of hold-on music for more than 20 years 24/7 non stop, no wonder the device went crazy.
Btw. If you hack the upper two bits onto the CD4040 counter instead of the switch you would get one track with 2^20 samples or 131.072 seconds.
The address is fed into the M27C801(Mx8bit EPROM) which just put out the 8bit data it has stored at that adress. The data is an a-law encoded audio sample. a-law encoding basically is a crude non linear amplitude compression to improve audio quality. Fear not, the TP3057 takes fully care of it, but you can look up the subject at wikipedia.org if you want.
The 8-Bit audio sample from the EPROM is fed into the HEF4014 (8-stage parallel in shift register). The 8kHz clock is used to trigger the parallel load of the data into the shift register. Then the 128kHz clock is used to clock the data out serially.
Now to theTP3057(codec). This is a chip that converts analog signals to a-law encoded digital data and vice versa. Its a DAC and ADC. The chip is intended to connect analog telephone system to digital PCM data streams. However in this device only the DAC part of the IC is used. The IC has three digital inputs we need to take a look at. First the framesync will tell the TP3057 that the next 8 bits are an actual audio sample. Following bits are ignored. Then there are a data and data_clock pin wich work like a SPI interface.
Again the 8kHz clock deliveres the audio sampling rate and therefore marks a new audio sample, and so this clock is fed (inverted) into the framsync input. Since the 8 kHz also trigger the parallel load of the HEF4014 this will syncronizes the first bit between the two chips. Then the 128 kHz clock is fed into the clock input of the HEF4014 and the TP3057. this will clock 16 bits of serial data per audio sample from the HEF4014 into the TP3057, where the first 8 are the audio sample and the later 8 bits are ignored. The TP3057 converts this data into the analog audio signal wich goes throug the volume control potentiometer, ac coupling, resistions and the audio jack to the outside world.
Now the working of the device is known and I can see how the dumped EPROM contents can be encoded.
First look at the addresslines. the LSB of the CD4040 counter-cascade is connected to the LSB of the EPROM address and the following lines are sequentially connected witout any swaps or so. This means the EPROM dump is in the correct order and no byteswaps are required. Since the track segmentation is done with the upper two bits i can seperate the tracks by cutting the BIN file in four equal size parts.
Now look at the data lines. The LSB of the EPROM data is connected to the LSB parallel to serial IC and the rest of the data lines are sequentially connected without swaps. This means that all data bits of one byte belog to one audio sample. The 4014 puts out the MSB first and the TP3057 accepts MSB first so all bits are in the right order and no bitswaps are required. So the EPROM dump is already a valid a-law audio stream just waiting to be played, and the hour long reverseengineering of the PCB was a waste of time.
A program that can read a-law encoded audio is Audacity. All that is required to do is to open audacity, start the raw data import, select a-law and off you go. You can now listen to 8bit 8kHz far from HiFi quality hold-on music, hurray! And you can convert it to MP3 and whatsapp it to coworkers who then question your mental health but apart from that it was a nice reverse engineering session.
You could also use Audacity to generate a new EPROM file and rickroll your customsers in an endles loop 😉