I mentioned previously that I figured out how to make a new display for an FT-x90R. My own rig is still in pieces ‘cos I’m not quite happy with the software yet (or actually, with my reverse engineering of the display protocol, but it’s the same thing in the end).

But Dave ZS5DF wanted his rig fixed so I fitted a new display, even though it doesn’t have the F key “P” priority display function in firmware yet.


Two filament bulbs, because the replacement display needs light from the right-hand side and the S meter is on the left-hand side.


Component cost is close to R500 which almost puts it in good-money-after-bad territory but I like these little radios.


Younger kid had to build an electric motor for a school project. Having a garage full of stuff, it was no hassle to find everything required to build one.



I made her wind the coil.

But the question is, how do kids complete (or even conceptualise) something like this if they don’t have a Wouter around the house?




This is a C1166 Pulse Tetrode made by English Electric, who also made transistors. Good for switching 17 500 volts at 15 amps. But only for 1 microsecond every 1 millisecond (1T4 and AA battery for scale).

The filament alone needs almost 60 watts (9 amps at 6.3 volts).

Quite useless unless one wants to build a glowbug radar or something. But quite marvelous in a way.



Mahala gratis verniet and for free, nogal.

And it seems to work, that’s indeed a 4.7k resistor.

Look at the ridiculous scale on this thing — not only uA but nA as well. Why would I want to measure a nano-amp?

I think this will become part of my permanent test setup.

Oooh look! Someone threw out this perfectly good Spectrum SPL-603 power supply!

Well, mostly perfectly good…

She who was once the beautiful 723

The 723 had given up all its magic smoke, to the point where the socket is also buggered. Fortunately this is a stock part in my junkbox, as are 2N3055s (the one output transistor was shorted emittor-to-collector, but I can’t explain why this would break the 723). I also replaced the H1061 with a BDW93B because I could.

Truth be told, this is a terrible PSU.

  1. The non-regulated DC is 52V, which means that at 30V output the transistors are dropping 22V and at 2.5V out they are dropping just about 50V. No wonder two 2N3055s are needed for a measly 3A output (A 2N3055 is good for 15A and 115W, so when dropping 50V you can only get a smidge more than 2A out of it, and that with a good heatsink).
  2. The 723 Vcc is connected to the non-regulated DC, but the 723 is rated for 40V max Vcc. This is probably what broke it.
  3. When I set the PSU to about 6V and turn it off, there’s a ~20V spike on the output. WTF?

So why the high non-regulated DC? I thought maybe it drops under load because cheap transformer, but this is not the case. The transformer gives out 38VAC which drops to 35VAC with a 1A load.

The general schematic is similar to http://www.circuit-projects.com/cimg/2V_to_7V_8A_power_supply_by_723_and_7812.gif but with a difference — the base of the current limiting transistor is connected to a voltage divider (R4/R5) to ground. This causes the current limiting point to be higher for a higher output voltage. Again, counter-intuitive.

So I changed things around to how it should be. Fitted a different transformer, from an old UPS — it’s only good for about 18V out but that’s enough for me. Not going to try to make a purse out of this sow’s ear.






My new brewing setup. A nice large stainless steel urn with a dual element, and a cooler box with a filter that used to be a braided hose and a tap.

The box under the urn is a PID controller so that I can (in theory*) dial the temperature, have a homebrew, and have water at the right temperature on tap.

It’s not going to win a panel wiring contest, but it works. The PID doesn’t have the switching capacity, so there’s a solid state relay. I also wired diodes to send the positive part of the AC to the one element and the negative part of the AC to the other element to spread the heat.

The switch controlling whether the diodes are in-circuit or not comes from the junkbox. Been a while since one could buy something useful for R3.45.

Grain in the cooler (this is 6 kilos of pilsner, on Saturday), add the water, let it be for about an hour…

..and drain the good stuff (this is Sunday’s brew, an IPA).

The pilsner is all-grain, which means that you end up with quite a lot of liquid to boil.

That’s the next step. The urn, on low, should be able to boil the wort as well. If not, I need to get a 30 liter+ pot, I have quite a few gas burners.

Good news is that both brews started bubbling easily (I added Servomyces to both and DAP to the IPA). The pilsner is my first all-grain and my first lager — I’m using ice to keep it cool.

* The water coming out the tap seems about 5C too cold. Some calibration required, looks like.



Thank you for asking.

Background: I think I found a way to fix a broken display on my Yeasu FT-290R 2m all-mode radio. A broken display on these things is common, and displays are very much NLA. The FT-290 (2m), FT-690 (6m) and FT-790 (70cm) are all pretty much identical except for the RF bits, so a fix for one is a fix for all.

So I advertised on swop shop, looking for an “FT-290R / FT-690R / FT-790R”.

Hello   Wouter ,

Thanks for the mail. I have the requested FT-290R / FT-690R / FT-790R
in an excellent condition  I will be shipping via FedEx courier on a 3
working days delivery and will accept payment via Western Union or
Money Gram

Location: USA

What’s your complete shipping address?

First and foremost before proceeding with transaction we can only
accept payment via western union if you are satisfied with that kindly
get back to me.

Maybe I should ask for a photograph of this “FT-290R / FT-690R / FT-790R”.



Some people collect tiny transistor radios. I don’t have enough of them to call it a collection but I guess I’m working on it.

The Ross Electronics Corporation imported transistor radios from Japan from 1955 to about 1970. They were located at 589 East Illinois Street and later (I think) 2834 South Lock Street, Chicago. As far as I can tell, there’s no relation to the Ross Radio Company of Youngstown, Ohio.

Here’s a better image of the schematic on the inside of the back cover (yes, there was a time when radios came with schematics).

It would be a mistake to expect good performance from a 1965-ish design running on one 1.5V cell, but the performance of my one is beyond mediocre. But then again, I didn’t really buy it to use it.

Mike has a nicer one, in a box nogal.

Ah yes, New Years’ resolutions. Gotta love ’em.

However, I have too much stuff. There. I said it. I mean, I firmly believe in the William Morris quote,  however, times have changed.

This collection of Elektor magazines I grew up with — obsolete.
A collection of GE Ham News that someone spent money on to have nicely bound — obsolete.

Byte magazines? Obsolete.

Creative Computing? Not quite yet obsolete.

And even if I can’t find it online, scanning and dumping* is better than storing the originals until my container is auctioned off one day.

Don’t get me wrong — I’m still keeping mountains of stuff. Just not… this stuff.


* Yes, Jason doesn’t like dumping. I’m not dumping anything that’s even slightly rare, so chill.

A tale of how not to do it, with a happy ending.

Our hunting club has eight Kenwood TK-2000 walkie-talkies. This is hardly ever enough, even when I take my Baofeng UV-B5* with.

So when a fellow ham had two TK-2000s for sale, I bought them. The programming cable is easy, and the software (KPG-137D) is not hard to find.

The first radio programmed fine, the second one… is password protected. I’m sure there’s a trick to resetting the password, I just don’t know what it is. So out comes the schematic from the service manual, and there’s an EX24016 hanging off the side of the R5F2136A microcontroller. EX24016 being another way of saying 24C16 which is an EEPROM. Memory. Where things get stored.

And while my favourite programming language is not solder, I’m not half bad at it.

And one universal programmer and one of my favourite tools later we have (the bits not shown are all just FF).

OK, so what does this mean? Stumped me too. The stuff at the end is self-explanatory, it’s a TK-2000 and the serial number of this one is B1104749. I’m pretty sure it’s on the same frequency as the other one, that would be one channel only, 169.43750 with a 103.5 Hz subtone, high power, narrow band. Oh look, right at the start there’s a sequence of bytes, 50 37 94 16 repeated twice. Back to front, transmit and receive frequencies. Given enough time one could decipher the whole thing, but that’s not important right now. We need the password.

The KPG-137D help file tells me that there are two passwords, one to allow you to read the data and the other for writing.  The password is a number from zero to 999999 (six digits). This eliminates a whole bunch of hopefuls like “PTK-2000” or one of those long strings at 1824/1840.

So I stuck the EEPROM back into the radio, wired the cable up, and started guessing. I had some hope for “222222”, for example. But no, it wasn’t going to be that easy.

So I thought, maybe the KPG-137D software “knows” what the password is. In other words, is the password sent to the transceiver, or checked on the local machine? I’m not expecting strong security here. I wired a second serial port to eavesdrop on the datastream (19200 N81) and saw that there’s no traffic on the line while I’m guessing passwords. So I tried looking on the heap of the KPG-137D but I suspect the password is stored as a number, not as text, no joy there either. There’s a lot of data on the heap and anything could be the password. Someone who knows Windows better than I do would be able to trap this thing at the right place and get the password.

Next I hauled out my working transceiver, and eavesdropped the datastream with different passwords set (I started with 000000, 000001, 000002). I noticed that the first 52 bytes of a read are the same and that after that things change.

Password Bytes 53-56 Binary
000000   AC B3 AF AD 1010 1100 1011 0011 1010 1111 1010 1101
000001   B8 A7 BB B9 1011 1000 1010 0111 1011 1011 1011 1001
000002   A9 B6 AA A8 1010 1001 1011 0110 1010 1010 1010 1000
                     ^^^  ^ ^  ^^^  ^ ^  ^^^  ^ ^  ^^^  ^ ^

Note the columns that stay the same in the binary. This suggests that old favourite, XOR encryption. The only problem is that I’m changing two bits in the password and three bits are changing in the data, which suggests some other nefarious seekrit manipulation.

With enough sample cases, I can figure it out, I’m sure.

Time to try something else. I didn’t really want to potentially break my working transceiver, but desperate times. Yup, I ripped the EEPROM out of that sucker and read it as well.

Byte 16 is “0A” instead of “FF” and bytes 22/23 and 25/26 is “FF FF” instead of “56 91”. That’s the first difference in the EEPROM, might as well start there. I first converted 0x5691 and 0x9156 to decimal, that didn’t work, but plain old “5691” did. I would have put money on “9156” being more likely to work than “5691”, based on the frequency being stored arse-endian, but no.

So there you have it. If I’d tried enough numbers from the EEPROM instead of giving up after not finding the password in plain text, I would have been there a lot earlier.

* A cheap and nasty, but extremely versatile little radio. Does VHF and UHF amateur bands, PMR and FRS, marine… you can get yourself into all kinds of trouble with this thing.


« Previous Articles