VOGONS


First post, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie

Hi,

I got this IBM 5160 PC XT from Germany. After cutting off a failed tantalum capacitor on the 12V rail, it works fine. The BIOS counts up to 512 KB RAM.

There's a RAM expansion card in it. It says 256KB on a sticker on the slot cover, but there are 512KB worth of DRAM chips on it. Strange! And intriguing. The card has barely any writing on it, so I couldn't find documentation for it. I appreciate help and tips to understand the card and getting the XT up to the full 768 kB RAM. Let's solve the riddle!

There are pictures of the card below and I did some experiments. I'll try to clearly separate observations and conclusions.

The card has:
- writing "info-pc" and "LS"
- a sticker "256KB" on the slot cover, which I presume is original from the 80s
- one row of 9 Samsung KM41256-15 256K x 1 bit DRAM ICs
- one row of 9 Mitsubishi M5M4256P-15 256K x 1 bit DRAM ICs
- 8 switches in a DIP
- one Jumper JP1
- a leaked battery (I'll remove it)
- one 74LS00N, a 4xNAND
- one 74LS32N, a 4xOR
- two 74LS75AN, a 2xflipflop
- one 74LS85N, a 4bit comparator
- one 74LS125AN, a 4xbus buffer
- two DM74157N, a mux (selects 1 of 2 inputs for the output)
- one 74LS245N, an 8 bit bus transceiver
- one SN74LS280N, a parity generator/checker
- one 74LS283N, a 4bit full adder
- one IC with the writing M3000-16PC-D371 8-MEM84-16 (?) that I couldn't find anything about
- two N82S153N-F, a programmable logic array (PLA)

For the experiments I recorded how far the BIOS counts the RAM, and what this BASIC program outputs (ran when booted directly into the ROM BASIC):

10 S=4096
20 DEF SEG=S
30 POKE 0,85
40 V=PEEK(0)
50 PRINT HEX$(S);V
60 S=S+4096
70 GOTO 20

(P.S. the program terminates. Try to think why 😀)

This program writes 55H (=85) to the byte at addresses 1000:0 2000:0 ... F000:0 and reads it back. There are three cases:
- 0 means I got E9h back
- 1 means I got 55h back
- 2 means I got FFh back

The motherboard is the 64KB-256KB one. It has all four banks populated with 64k chips for a total of 256 KB onboard RAM. Switches 3 and 4 on the motherboard were set accordingly. The fixed disc adapter (FDA), which has a ROM BIOS at C800 was removed for the test. There's a hercules card with memory at B000. JP1 on the card was in the position as shown on the photo.

DIP-Switches | BIOS RAM count | BASIC program results
1 234 5678 | |
-----------------------------------------------------
MDA BIOS ROM
| |
| | bank: | |
| | 0123 456789ABCDEF
-----------------------------------------------------
0 000 0000 | 320KB | 111 122220010000
0 000 0001 | 384KB | 111 112222010000
0 000 0010 | 448KB | 111 111222210000
0 000 0011 | 512KB | 111 111122210000
0 000 0100 | 256KB | 111 011112212000
0 000 0101 | 256KB | 111 001111212200
0 000 0110 | 256KB | 111 000111112220
0 000 0111 | 256KB | "F8000 ROM\nERROR."
0 000 1000 | Screen blank
0 000 1100 | Screen blank
0 001 0000 | 320KB | 111 122200010000
0 001 0001 | 384KB | 111 112220010000
0 001 0010 | 448KB | 111 111222010000
0 001 0011 | 512KB | 111 111122210000
0 001 0100 | 256KB | 111 011112210000
0 001 0101 | 256KB | 111 001111212000
0 001 0110 | 256KB | 111 000111112200
0 001 0111 | 256KB | 111 000011112220
0 010 0000 | 320KB | 111 122000010000
0 010 0001 | 384KB | 111 112200010000
0 010 0010 | 448KB | 111 111220010000
0 010 0011 | 512KB | 111 111122010000
0 010 0100 | 256KB | 111 011112210000
0 010 0101 | 256KB | 111 001111210000
0 010 0111 | 256KB | "C8000 ROM\nERROR." (with FDA)
0 010 0111 | 256KB | 111 000011112200 (without FDA)
0 010 1011 | Screen blank
0 011 0000 | 320KB | 111 120000010000
0 011 0100 | 256KB | 111 011112010000
0 100 0000 | 320KB | 111 100000010000
0 100 0001 | 384KB | 111 110000010000
0 100 0011 | 512KB | 111 111100010000
0 100 0100 | 256KB | 111 011110010000
0 101 0000 | 256KB | 111 000000010000
0 101 0100 | 256KB | 111 011100010000
0 110 0100 | 256KB | 111 011000010000
0 111 0100 | 256KB | 111 010000010000
1 000 0001 | 192KB | "30000 01 201"
1 000 0011 | 320KB | 111 122222210000
1 000 0100 | 256KB | 111 012222212000
1 100 0100 | 256KB | 111 012220010000
1 110 0100 | 256KB | 111 012000010000
1 110 1100 | 256KB | 111 000000010120

My assumptions from this:

1. Switches 5-8 determine the start address in 64KB increments, 0000 = start at 64k to 1110 = start at 960k (and 1111 = start at 0k?)
2. Switches 2-4 determine the size of the memory that the card responds to in 64k increments: 000 = 512k down to 111 = 64k
3. Interestingly, there seems to be no conflict when card RAM is mapped into address space that the onboard RAM occupies; see all experiments with switches 5-8 at less than 100b
4. Switch 1 function is unclear. The observations seem to suggest that it switches between 256 KB (0) and 64 KB (1) working memory: Compare the results for switch setting 1 000 0100 and 0 000 0100. Both have start address = 320k and size = 512k. With switch 1 set to 0, I get 55h back for the first 4 banks starting at 320k (4000h), and E9h for the 4 banks after that (except for B000h, which is the video RAM). With switch 0 set to 1, I get 55h only for the 1st bank ay 320k or 4000h, and E9h for the remaining 7 banks (again, except for B000h).

So, here are some questions:
- does anyone know this card or where to find documentation for it?
- why is there a battery on the card? A RTC would be an obvious answer, but I don't know enough to say whether the ICs on the board make that a plausible hypothesis, or how it could be tested. CheckIt 3.0 finds no RTC.
- What is the purpose of Switch 1?
- and the biggest question: Why are there 512 KB of ICs on the card, but only 256KB seem to be usable?
- and finally: any tips on how to proceed with unraveling the mystery?

Thanks!

Markus

Reply 1 of 23, by rmay635703

User metadata
Rank Oldbie
Rank
Oldbie

Lots of cards like that for 64kb pc 5150

https://forum.vcfed.org/index.php?threads/d-l … o-needed.71678/

The card likely sold with 256k but could support 512k, my guess is it was fully populated and installed in a mismatched system.
Rarely half bad ram was used in duplicate but that is very unlikely.

A RTC is very likely but I haven’t gone through the ICs to see which are what.

Reply 2 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t

The battery is indeed likely to be for the RTC function of this card. I suppose the M3000 chip is the RTC, and it is accessed using I/O ports. The card has the IO write and IO read signal connected on the ISA bus. The backside photo shows that a 2-pin component seems to hide below the M3000 chip, which might be the 32.768kHz crystal required for a typical RTC IC.

OK, it seems you get E9 back if nothing responds to the read request, 55 if you hit RAM or a ROM that happens to start with 55, and FF if something responded actively with FF. You see both the 55 area and the FF area moving with the DIP switches, so it is sensible to assume that you get working RAM from one 256K bank, and just FF from the second 256K bank. Furthermore, it is reasonable to assume that the 74LS245 is a driver chip that forwards data from the ISA bus to the card unless a read to the memory on the card or the RTC happens. In that case, the direction of the buffer is reversed and data from the card is forwarded from the card to the ISA bus.

Switch #1 is likely to choose between 41256 chips (256K per bank) and 4164 chips (64K per bank), and you seem to have discovered the meaning of switches 2 to 8 correctly. There seems to be a defect on the card that makes the second bank not work, so it always returns FF on reads. As TTL inputs (for example on the 74LS245) read "high" if nothing is driving the input, you would get FF if the 74LS245 is enabled to forward data from the card to the bus, but no RAM chips are enabled. I assume the card drives RAS to the memory chips on every memory cycle (possibly even on cycles that do not decode to the card), and drives CAS only on the selected bank. Under this assumption, refresh implementation is easy because you want to refresh both banks at the same time, and you just need RAS for that. So if every cycle drives RAS on both banks, you automatically get refresh affecting both banks without further logic. Looking at the traces on the back side, I see a trace that connects to CAS of some chips on the bank farther away from the slot bracket, but does not connect to CAS of the chips closer to the slot bracket. This seems to confirm my theory that bank selection is handled using CAS. Your symptom thus looks like the second bank does not get a proper CAS signal, which might be due to a broken trace or a defective decoder (likely one of the PLAs). If you happen to have a continuity tester, you can check whether the CAS pins of each banks are connected to some pin of the PLAs, but possibly the 74LS125 is used to buffer a PLA output to drive that many RAM chips. a single 74LS125 is good to buffer a common RAS signal, two CAS signals and the common WE signal (I've seen traces that confirm that WE is common between both banks).

Assuming you have a multimeter: I recommend you to buzz out the logic that should generate CAS for either bank. If everything looks fine, try whether you can detect a slight drop in voltage of the CAS signal of the selected bank when you repeatedly read a byte using basic in that bank. Obviously, a scope would be preferrable, but I wouldn't assume you have one or get one for a one-off test. If you can detect a change in average DC voltage level between a selected and an unselected bank, you can use the multimeter to test where the CAS signal for the second bank disappears.

Reply 3 of 23, by wierd_w

User metadata
Rank Oldbie
Rank
Oldbie

There's a lot of tantaulm caps as well. Might be worth checking if any have internal shorts.

Edit

I see a lot of corrosion under the leaky battery. Removal, alklyline reversal, then trace checking is indicated.

Reply 4 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
wierd_w wrote on 2025-11-05, 20:37:

There's a lot of tantaulm caps as well. Might be worth checking if any have internal shorts.

I don't think they are tantalums. They are 100nF multilayer ceramic caps. In those days, it was usual to have one 100nF decoupling capacitor next to every IC. Usually they are yellowish brown (as on this card) or blue.

Reply 5 of 23, by wierd_w

User metadata
Rank Oldbie
Rank
Oldbie

It only takes a few seconds to check against shorts.

And, that corroded battery still needs to come off. (Blech)

Reply 6 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
wierd_w wrote on 2025-11-05, 20:37:

I see a lot of corrosion under the leaky battery. Removal, alklyline reversal, then trace checking is indicated.

Indeed. Especially if my guess is correct that the 74LS125 is used as RAS/CAS/WE driver. That chip is directly next to the leaky battery, so if the battery leakage damaged some traces or vias, it's quite likely that RAM control signals are affected. And, as I already stated, the broken second 256K look like a broken CAS trace.

Reply 7 of 23, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie
mkarcher wrote on 2025-11-05, 20:18:

The backside photo shows that a 2-pin component seems to hide below the M3000 chip, which might be the 32.768kHz crystal required for a typical RTC IC.

Indeed! I removed the IC from its socket and there's what looks like a crystal oscillator below it, see attached photo. (There's still some corrosion on the diode next to where the battery was. I'll clean that up too.) Good to know! I'll try various clock programs for it and see if I find one that sees an RTC.

mkarcher wrote on 2025-11-05, 20:18:

55 if you hit [...] a ROM that happens to start with 55

Doh, of course, option ROMs start with 55AA, so I should have tested with a different value.

mkarcher wrote on 2025-11-05, 20:18:

[very helpful explanation and tips]

Assuming you have a multimeter: I recommend you to buzz out the logic that should generate CAS for either bank. If everything looks fine, try whether you can detect a slight drop in voltage of the CAS signal of the selected bank when you repeatedly read a byte using basic in that bank. Obviously, a scope would be preferrable, but I wouldn't assume you have one or get one for a one-off test. If you can detect a change in average DC voltage level between a selected and an unselected bank, you can use the multimeter to test where the CAS signal for the second bank disappears.

I'll do that and report back!

Reply 8 of 23, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie

A little update: I don't just want to fix the board, I want to understand completely how it works and then fix it, hopefully including the RTC. I have started buzzing out the traces on the board and putting the results in a KiCAD file. I learned a lot from that already and could also confirms that the 74LS245 bus transceiver is always enabled and buffers the data on the bus for the card. It reverses direction on an AND of two signals, one from the first PAL, and one from the second PAL, so its role is likely as you suspected, @mkarcher.

I have also employed a logic analyzer to see:
- the top 4 bits of the address on the ISA bus from one of the inputs to the 74LS283 full 4-bit adder
- RAS0, CAS0, RAS1 and CAS1 and A8 at the DRAM chips
- CLK to get a feeling that the sample rate is good enough

I captured these signals while a program was running that repeatedly reads the whole 1M of memory space byte-wise. The loop of 64k iterations, the max on an 8088 afaics, starts and ends at x8000h so that after the access to xffffh the access to (x+1)0000h immediately follows without other memory access due to code execution at the end of the loop. IRQ0 is masked so that the BIOS and DOS timer code doesn't pollute the capture. I'll attach the code when I get it off the XT a bit later.

In the capture on the first screenshot are visible from left to right:
- the RAS-only refresh - on both banks simultaneously
- the read of address 7FFFFh, which is the last working address. RAS and then CAS go active low.
- another RAS-only refresh
- the read of address 8000h, which is the first non-working address. Indeed, RAS goes low, but CAS stays high all the time. What a life!

The second screenshot shows a time when the memory read does not decode to the card. BA16-19 are 0000, so we're somewhere in the first 64K. The card sits at start address 40000h - 256K. It is visible that RAS is quiet except for the RAS-only refresh. So RAS is driven only when the address decodes to the card.

Also, I found a broken trace directly after the crystal oscillator. Turns out it's visible on the photo attached to the first post as well, but in the top-down view it looks very much like a via. I attached a close-up.

The damage on the PCB that broke the trace does look kind-of deliberate to me. Maybe they intentionally disabled the RTC and 256K and sold the card as a 256K card? Wouldn't be the first time something like that was done.

Reply 9 of 23, by the3dfxdude

User metadata
Rank Oldbie
Rank
Oldbie
mbertheau2 wrote on 2025-11-12, 00:44:

The damage on the PCB that broke the trace does look kind-of deliberate to me. Maybe they intentionally disabled the RTC and 256K and sold the card as a 256K card? Wouldn't be the first time something like that was done.

I don't agree with that. If they wanted to sell a stripped down card, why leave it fully populated with the battery?

I'd guess that the card is damaged by a leaking battery.

Reply 10 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
mbertheau2 wrote on 2025-11-12, 00:44:

Also, I found a broken trace directly after the crystal oscillator. Turns out it's visible on the photo attached to the first post as well, but in the top-down view it looks very much like a via. I attached a close-up.

Please check whether the broken trace connects the crystal to the unpopulated C1 position. This may be an optional varicap to fine-tune the RTC clock speed. As C1 is not populated on your card, routing the clock there makes no sense, and could degrade the signal integrity if that trace works as antenna.

Reply 11 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
mbertheau2 wrote on 2025-11-12, 00:44:

the read of address 8000h, which is the first non-working address. Indeed, RAS goes low, but CAS stays high all the time. What a life!

Which confirms a broken CAS1 signal, as I suspected. But I was lucky, as RAS1 and RAS0 are separate as well. The same symptom would be visible with missing RAS1.

Reply 12 of 23, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie

A short update:

- The CAS1 trace on the front side of the PCB, coming from the resistor network below the 74LS32, a quad 2-input OR, and going up to a via in the battery area, is indeed broken. When I bridged that temporarily, the whole 512 KB worked. One of the next things for me is to decide how I'll try and permanently fix this. It's going to be my first trace repair.
- The other broken trace directly after the crystal indeed goes to the unpopulated C1 position. Good educated guess, I guess!

I'm now tracing out the rest of the board to fully understand how it works.

One thing I already don't understand is why there are resistors on the card-internal address lines. The ISA bus address lines go to two 74LS157 ICs, which are quad 2-to-1 multiplexers. Based on a signal they select the first or second 8 bits of the address bus and put those on the lower 8 address lines of the DRAM ICs. But before that, they go through a resistor. Why?

The same with the two RAS and CAS lines: they go through a resistor before they go to the DRAM ICs. Why is that?

Thanks!

Reply 13 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
mbertheau2 wrote on 2025-11-27, 22:50:

One thing I already don't understand is why there are resistors on the card-internal address lines. The ISA bus address lines go to two 74LS157 ICs, which are quad 2-to-1 multiplexers. Based on a signal they select the first or second 8 bits of the address bus and put those on the lower 8 address lines of the DRAM ICs. But before that, they go through a resistor. Why?

The same with the two RAS and CAS lines: they go through a resistor before they go to the DRAM ICs. Why is that?

It's called "series termination", this is a method to dampen reflections. This is especially important on fast edge-triggered signals like /RAS and /CAS, as extra edges generated by overshoot and ringing can generate funny faults. Maybe they terminated the address lines the same way to make sure the address lines don't transition "too fast", but at the same speed as the RAS and CAS lines. As the resistor slows down charging the input capacitances of the RAM chips, it will introduce a small delay.

Reply 14 of 23, by mdog69

User metadata
Rank Member
Rank
Member

It looks as if the two 74157 devices have been replaced at some time - the date code dates them to 1993, whereas the rest of the board has devices from 1984/1985.
As previously noted they are used to multiplex the address lines.
I reckon the original devices were 74LS157 and got replaced with whatever was to hand.
74LS series have a lower propagation delay compared to the original 74.
That could be causing timing issues.
Might be worth changing them for LS157 devices (or even HCT157).

In my experience most designs used the same 74 family across the board - the only variations usually being around oscillator circuits, and then it was normally a 74S04.

Reply 15 of 23, by mkarcher

User metadata
Rank l33t
Rank
l33t
mdog69 wrote on 2025-12-01, 13:58:

74LS series have a lower propagation delay compared to the original 74.
That could be causing timing issues.

I don't think replacing 74157 by 74LS157 will cause timing issues. I just looked at the data sheets for the National Semiconductors (rebranded to Fairchild) DM74157 and DM74LS157. The original TTL DM74157 has progataion delay specified at a load resistance of 400 ohms and a capacitance of 15pF, while the LS one has a specification at 2kOhm and 15pF. The specified propagation delays are identical with the LS chip driving a lighter DC load.

Schottky TTL chips are more efficient, that is they consume less power to operate at the same speed compared to standard TTL chips. There are two main series of Shottky based TTL logic, the LS series which aims to be approximately as fast as standard TTL at a considerably lower power consumption ("low power Schottky"), while the S series aims for maximum speed. In case of the 74S157, that chip is nearly twice as fast as the 74LS157 or the original 74157, but consumes even more power: The S chip is specified at 50mA typical (outputs unloaded), the original one at 30mA typical, and the LS one at around 10mA typical. The lower consumption at the same speed explains why you are unlikely to see the original 74 series if used for their logic function. As the original 74 series operated at higher signal currents, they were used a lot longer in applications that are more focussed on the "output driving" aspect than the "logic" aspect.

Reply 16 of 23, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie

A small update: If the jumper in JP1 is in the bottom position, the card drives the /CARD SLCTD signal on the ISA bus, so that it'll work in Slot 8 on the XT motherboard. However, with the card in Slot 8 and the jumper in the bottom position, the BIOS counts the memory correctly, but the system hangs when booting PC-DOS 3.3, so.. yeah.

Reply 17 of 23, by rmay635703

User metadata
Rank Oldbie
Rank
Oldbie
mbertheau2 wrote on 2025-12-08, 11:22:

A small update: If the jumper in JP1 is in the bottom position, the card drives the /CARD SLCTD signal on the ISA bus, so that it'll work in Slot 8 on the XT motherboard. However, with the card in Slot 8 and the jumper in the bottom position, the BIOS counts the memory correctly, but the system hangs when booting PC-DOS 3.3, so.. yeah.

If you could get one of the post cards that has a full memory check you could at least isolate what memory region(s) are broken

Reply 18 of 23, by mbertheau2

User metadata
Rank Newbie
Rank
Newbie

I worked on my first broken trace and got to continuity, yay!

I'm almost through with the schematics, and will look at the signals of the M3000 and the bottom PAL IC. It receives at least the lowest 10 address bits, the IO Write and IO Read as well as the Address Enable lines from the ISA bus. Three lines to from that PAL to the M3000. My plan is to read a bunch of I/O addresses with the CPU and see when something lights up around the M3000. That will hopefully give me a range of I/O addresses that the RTC chip responds to. Then with some trial and error, and looking at how other RTC chips are implemented, maybe I can figure out how to talk to it. It's interesting that the RTC chip has only 4 data lines connected to the data bus.