How to figure out a keyboard protocol

[kelvinhall05]

Hi guys. I recently bought and cleaned up a "KB25506" from Korea with FLS3. There isn't any brand name, or logos, or anything, although I have found out that it seems to be the keyboard to a Mai 4313 "Basic 4 Terminal". The only other info is N860-2867-T010 (indicating the key assembly was probably made by Fujitsu) printed on the plate as well as a serial number right below that (C712431t). There is one little sticker on the PCB but all it says is 400646-031F which I think is a part number since a sticker on the bottom of the case says 400646-011 (this is mentioned in the document linked below proving that this is the part number).

There is a little info here: http://chiclassiccomp.org/docs/content/ ... s/4313.txt

It also appears that there was not only an FLS3 one (like mine) but also a membrane one that has been documented here viewtopic.php?t=2700 as well as in the document linked above.

There are four chips on the board, a MB74LS14, 74LS07N, M5L8049-673P, and a MC74HC151.

My end goal is to convert this thing to USB. I have wired up a Pro Micro with Soarer's firmware on it to the cable and cannot get it to output anything so I am assuming that the keyboard either speaks some weird protocl or is totally dead. I have mapped the pinout (VCC and GND are both easy to find, and I originally had to guess on clock and data, but in the document linked above I found which pin is data; still doesn't work). Does anyone know how I can figure out what protocol it speaks? I don't have any fancy equipment, just a couple Pro Micros, a PC (obv), and a Raspberry Pi which all might be able to somehow figure out the protocol (right?).

Any ideas? Thanks!

[kps]

Use the Pro Micro (or PC parallel port) to log the state of the data & clock lines when you press keys. If you get nothing, then probably the host needs to supply the clock, so try that (maybe start around 1kHz) and see if you get data.

[kelvinhall05]

Use the Pro Micro (or PC parallel port) to log the state of the data & clock lines when you press keys. If you get nothing, then probably the host needs to supply the clock, so try that (maybe start around 1kHz) and see if you get data.

Is there software I can flash on the Pro Micro to make it do that automatically? I do not know anything about programming lol

[kps]

I have not used them, but maybe one of these? https://www.instructables.com/id/Arduin ... ogic-Anal/ or https://www.element14.com/community/peo ... rduino-uno

[MMcM]

To start, I would bet that the protocol is going to turn out to be ASCII with the special keys sending funny codes. So making this into a working modern keyboard would mean scanning yourself. Of course, I could be dead wrong.

There are a couple of other Mai terminals in Bitsavers.

• The 4398, which has a UART (8251A), so probably the keyboard would have one, too.
• The 4309, which might be closer.

Figure 6-1 is the 4309 keyboard PCBA. It doesn't have the same components as you listed, but it as a 6 pin connector.

• +5V on 1,2
• GND on 4,6
• DO on 5
• SI on 3

Does that match what you worked out for power? Is data on pin 5?

Either way, where do the non-power signals go?

• 74HC151 is a mux; it's gonna be part of the matrix decoding.
• 74LS07N is a driver; is it going to the output?
• 74LS14 is an inverter.
• 8049 is the microntroller (obvs).

Do either of the non-power signals go to the controller straight or just through an inverter or buffer? In particular, does one of them go to the pin 6 -INT, the external interrupt? If so, that's gonna be a clock input signal, like kps hypothesized.

[kelvinhall05]

To start, I would bet that the protocol is going to turn out to be ASCII with the special keys sending funny codes. So making this into a working modern keyboard would mean scanning yourself. Of course, I could be dead wrong.

There are a couple of other Mai terminals in Bitsavers.

• The 4398, which has a UART (8251A), so probably the keyboard would have one, too.
• The 4309, which might be closer.

Figure 6-1 is the 4309 keyboard PCBA. It doesn't have the same components as you listed, but it as a 6 pin connector.

• +5V on 1,2
• GND on 4,6
• DO on 5
• SI on 3

Does that match what you worked out for power? Is data on pin 5?

Either way, where do the non-power signals go?

• 74HC151 is a mux; it's gonna be part of the matrix decoding.
• 74LS07N is a driver; is it going to the output?
• 74LS14 is an inverter.
• 8049 is the microntroller (obvs).

Do either of the non-power signals go to the controller straight or just through an inverter or buffer? In particular, does one of them go to the pin 6 -INT, the external interrupt? If so, that's gonna be a clock input signal, like kps hypothesized.

Alright I am going to do this one at a time since I know nothing about electronics and will have to figure it all out slowly xD

I do agree with what you said about the pinout, that is exactly what I concluded. I will check on the other stuff and report back.

[kelvinhall05]

Ok, so I checked quickly

What I believe is data (pin 5) goes directly to an input line (3A/pin 5) on the 74LS07N.
The other pin (pin 3) goes through a resistor (which according to Digikey's colour band "calculator" is a "230 Ohms 5%", whatever that means; no idea if that is correct). I can't find a datasheet for the MB74LOS14 but it goes into the pin with the little dot above it (not the semi-circle cutout, I actually mean a little dot above a pin). I know that doesn't say much but until I can find a datasheet (which I can't) I have no idea what that pin is.

[MMcM]

MB74LS14 or MB74LOS14?

MB is the manufacturer, specifically Fujitsu. Have a look at https://en.wikipedia.org/wiki/7400-seri ... _numbering. In short, stuff at the beginning and stuff at the end doesn't matter for figuring out what it does. A 74LS14 is a 6-way (hex) inverter (with certain triggering characteristics).

In the same way 5% is the resistor's tolerance. You'd care when designing / cost estimating a circuit, but for reverse engineering it, it's nothing much more important than some but not very high resistance.

A dot will be next to pin 1.

Do you have the means to post some photos of what you're looking at?

[kelvinhall05]

MB74LS14 or MB74LOS14?

MB is the manufacturer, specifically Fujitsu. Have a look at https://en.wikipedia.org/wiki/7400-seri ... _numbering. In short, stuff at the beginning and stuff at the end doesn't matter for figuring out what it does. A 74LS14 is a 6-way (hex) inverter (with certain triggering characteristics).

In the same way 5% is the resistor's tolerance. You'd care when designing / cost estimating a circuit, but for reverse engineering it, it's nothing much more important than some but not very high resistance.

A dot will be next to pin 1.

Do you have the means to post some photos of what you're looking at?

https://www.google.com/url?sa=i&url=htt ... AdAAAAABAI

Here is a pinout i found for that chip. The "dot" is visible in the upper left near pin 1, and yeah, that is an input.


So both pins that I believe are data and clock go directly to input lines on some chips.

[MMcM]

Okay, yeah, two inputs and no outputs doesn't sound right. There aren't any other unaccounted for signals on the connector, right?

I've made mistakes like that before. The thing to do is gather more evidence, analyze the contradictions and figure out where it went wrong.

It's possible that the data line is bi-directional, like in the XT protocol. Let's try to rule that out from design first principles. Are there any LEDs or a buzzer on this keyboard? If not, there's no reason for data to go from the terminal to the keyboard. Is the shift lock a physically locking key or does it have an indicator? If it has a light, does it work when the keyboard has power alone? In which case, it's all internal to the keyboard and still no need for input.

Sounds like pin 3 went to an input to the 74LS14 inverter. That would be consistent with a clock input, because that kind of inverter gives a cleaner edge trigger (detection of a change in state of the signal). Where does the corresponding inverted signal go? That's pin 2 on that same 74LS14, the one immediately below it on the same side. My earlier bet was pin 6 (-INT) on the MCU. Because that'd be the simplest way to wake up from an external clock.

(Pin 3 on the 4309, which may or may not have anything at all to do with the 4313, goes through a couple inverters -- stabilizing the signal -- and then to a pair of one-shots, which turn edges into pulses; one of those drives a shift register that handles a pair of muxes that are wired to the matrix. Then a counter and a couple of proprietary chips -- maybe ASCII decoding -- and out via a flip-flop. So that's some kind of externally clocked serial protocol.)

If pin 5 went to pin 5 (3A) on the driver, where does pin 6 (3Y), the corresponding output, go?

Are the traces on the PCB obscured by the keys or is it possible to take photos and post them here? Someone might be able to spot something.

Alternatively, you could just press on and assume 3 is clock and 5 is data out. Like kps says, toggle the clock and see how the output changes depending on whether or not a key was pressed. You can do that with your Pro Micro and the Arduino IDE, but it is a tiny bit of programming.

[kelvinhall05]

Okay, yeah, two inputs and no outputs doesn't sound right. There aren't any other unaccounted for signals on the connector, right?

I've made mistakes like that before. The thing to do is gather more evidence, analyze the contradictions and figure out where it went wrong.

It's possible that the data line is bi-directional, like in the XT protocol. Let's try to rule that out from design first principles. Are there any LEDs or a buzzer on this keyboard? If not, there's no reason for data to go from the terminal to the keyboard. Is the shift lock a physically locking key or does it have an indicator? If it has a light, does it work when the keyboard has power alone? In which case, it's all internal to the keyboard and still no need for input.

Sounds like pin 3 went to an input to the 74LS14 inverter. That would be consistent with a clock input, because that kind of inverter gives a cleaner edge trigger (detection of a change in state of the signal). Where does the corresponding inverted signal go? That's pin 2 on that same 74LS14, the one immediately below it on the same side. My earlier bet was pin 6 (-INT) on the MCU. Because that'd be the simplest way to wake up from an external clock.

(Pin 3 on the 4309, which may or may not have anything at all to do with the 4313, goes through a couple inverters -- stabilizing the signal -- and then to a pair of one-shots, which turn edges into pulses; one of those drives a shift register that handles a pair of muxes that are wired to the matrix. Then a counter and a couple of proprietary chips -- maybe ASCII decoding -- and out via a flip-flop. So that's some kind of externally clocked serial protocol.)

If pin 5 went to pin 5 (3A) on the driver, where does pin 6 (3Y), the corresponding output, go?

Are the traces on the PCB obscured by the keys or is it possible to take photos and post them here? Someone might be able to spot something.

Alternatively, you could just press on and assume 3 is clock and 5 is data out. Like kps says, toggle the clock and see how the output changes depending on whether or not a key was pressed. You can do that with your Pro Micro and the Arduino IDE, but it is a tiny bit of programming.

There are no lights, locking switches, or buzzers on the keyboard. I have compiled an album with pictures of all the chips and the PCB:
https://photos.app.goo.gl/NjKDd6ituEVHPwNp7
Hopefully this suffices.

You are right, pin 3 goes into the 74LS14 but then comes out of pin four on that same chip which then goes direcly into pin 6 on the microcontroller.

Pin 5 goes into the 74LS07 and then comes out and goes into pin 7 of the microcontroller.

Currently there is zero output if I wire it up to a Soarer's and try and type on it regardless of what I do.

[MMcM]

Yeah, that photo is fine. Some of the earlier analysis was upside down.

mai-4313.jpg (605.77 KiB) Viewed 4805 times

Pin 3 of the connector goes to a pull-up resistor (R6) and then to pin 1 of the inverter. Pins 2 and 3 are shorted -- you can just make out the trace in the photo. This is the same trick as in the 4309. Then pin 4 goes to INT (note the jumper) and P1<6> on the MCU.

Pin 5 of the connector comes from pin 12 on the driver (again note the jumper). Pin 13 comes from P1<7> on the MCU.

So that pretty much confirms which is which and is again pretty similar to the 4309: some shift registers, counters, and custom ICs are all replaced by a microcontroller. The two external signals correspond to a couple bits in its primary I/O port.

As for helping you get it working, all that does is suggest that if someone had gotten that other keyboard to work, the firmware might turn out to be similar.

Otherwise, we're back to how you can get a program running that shows you how data changes when clocked depending on which key, if any, has been pressed.

[kelvinhall05]

Alright, thanks a ton man. This has at the very least been very interesting to read but will likely be very helpful in converting this thing.


I will do some research myself and see if I can figure out what protocol it uses.

[MMcM]

I do not know what progress has been made on this in the last year. But I got a hold of one for a while and did some experiments.

There wasn't much question about the pinout, since the photos were clear enough. But to confirm, it is indeed the same as the older models. So, for convenience, I will continue to call the two data signals SI and DO.

But it isn't the same protocol. For one thing, based on the fairly thorough description of that in the 4309 Service Manual, the keyboard needs to be able to distinguish pulse widths. CKC80 is 1.8432MHz, which means the clock width is 542ns, so a long pulse is 271ns and a short one 135ns. The keyboard circuit shown there uses a 200ns one-shot to pick a test point between the two. I don't think a 8049 is fast enough to do this without help (and there isn't any on the keyboard). Its instruction cycle is 1.36µs with the fastest allowed crystal, 11MHz.

Rather, DO seems to be an 8-bit serial output with unique make and break codes for each key, with the eighth bit indicating break. A somewhat more conventional encoding.

There are no start or stop bits. Rather, it is clocked by the SI input.

Using just a square wave, the pattern is pretty clear.

Mai-Basic-A.png (90.49 KiB) Viewed 3783 times

Mai-Basic-S.png (83.45 KiB) Viewed 3783 times

Mai-Basic-D.png (98.25 KiB) Viewed 3783 times

Mai-Basic-F1.png (70.46 KiB) Viewed 3783 times

Mai-Basic-ESC.png (93.1 KiB) Viewed 3783 times

Mai-Basic-IV.png (92.66 KiB) Viewed 3783 times

Mai-Basic-L-SHIFT.png (85.48 KiB) Viewed 3783 times

However, I still do no understand how to do the triggering reliably.

Here is a run for the space bar.

Mai-Basic-SPACE-suspect.png (93.21 KiB) Viewed 3783 times

The break bit isn't in the right place, at 1 instead of 80. Both the codes are misaligned. Here is another run.

Mai-Basic-SPACE-better.png (93.55 KiB) Viewed 3783 times

There is also the question of being able to tell when the keyboard stops transmitting to keep from interpreting a few bits as garbage.

It's quite possible that SI carries more information than just the clock. We know that the earlier keyboard distinguished pulse widths. Or perhaps the phase is more subtle than just running all the time. It could also be that the period I picked somewhat at random isn't ideal.

An 8049 has a masked ROM, so there isn't a (practical) way to get the program off of it. It's possible that there is a newer Service Manual around someplace that just hasn't been scanned yet.

Alternative, maybe someone has an whole terminal and could either get the terminal side of the program off of it or scope it talking to its keyboard.

[kelvinhall05]

An 8049 has a masked ROM, so there isn't a (practical) way to get the program off of it. It's possible that there is a newer Service Manual around someplace that just hasn't been scanned yet.

So I actually mapped the matrix and sold the keyboard a while back, so I can't test it anymore unfortunately. But this looks very promising.

There are easy ways to dump 8048/49/50(?) ROMs. I have not tried them yet but know people who have, and it worked great for them.
http://qemulator.blogspot.com/2020/05/d ... -roms.html
https://www.sbprojects.net/projects/8049spy/index.php
I may look into throwing together a little PCB for this as I think it would be very useful to have in the future.

[MMcM]

There are easy ways to dump 8048/49/50(?) ROMs.
I may look into throwing together a little PCB for this as I think it would be very useful to have in the future.

You're right; I was confused about which models still had that capability. I do have such a reader here already.

I don't think the chip is socketed, so it'll need to be desoldered to do this reliably.

Maybe someone who converted the matrix directly saved theirs.