I have finally had some time to look into this first hand. My feeling about this is that I have been screwed over by Krell, as I in fact contacted them before pursuing my purchase of a used 300iL from the states. No warning of any sort, only a message about contacting Absolute Sounds in the UK about imports and voltage conversions. Absolute Sounds didn't even bother replying. Well, now is my time to screw them back.
If you want to repeat my steps on your own amplifier, note that the warranty is lost forever. If you want to keep you warranty, be prepared to fork out at least $1000 to Absolute Sounds for them to change the chip.
I have been absorbing information about the 68hc711e9 microcontroller Krell uses in this amp, and the first thing I had to check was if the device has a "security feature". You can check this with a scope. Here's an excerpt from the 68hc11 reference manual from Motorola:
"The presence of the security option can be detected while the MCU is in reset by forcing the mode A (MODA) and mode B (MODB) pins to 1 and monitoring the strobe A/address strobe (STRA/AS) pin. When MODA and MODB are 1s, the normal expanded mode is requested. If security is engaged, the STRA/AS pin will act as a high-impedance input because the security option causes the MODA pin to be interpreted as a 0 even if it is a 1. In single-chip modes, the STRA/AS pin is configured for the strobe A input function. If the security mode is not engaged, the STRA/AS pin will act as the address strobe output, which can easily be recognized on an oscilloscope. This checking procedure allows the security mode to be detected without disengaging it. If the MODB pin were low in this experiment, the bootstrap mode would be requested rather than the normal single-chip mode. In the case of MODB low, care is required not to release reset because doing so would cause the security option to be disengaged."
Of course, you need a proper setup to do this. I use a prototype board which can be set up to boot software in the microcontroller in various ways. The best option is to put it in special bootstrap mode, and load a talker into its 256 bytes of ram on reset, allowing it to be examined and debugged by a prograam such as jbug11.
It is not a secured device , so the next step is to do some disassembling. Be sure to use proper tools as you would otherwise ruin the microcontroller. I initially used a home made extraction tool, but this will surely ruin the chips connectors after a while. Better safe than sorry, we are after all talking about a £2500 Krell amplifier here...
I have been looking at the instruction in the microcontroller, and it appears that it senses an input frequency at pin 3 on port A, This was confirmed by measuring the signal at all pins of the processor. Only pin 31 showed a signal resembling anything like a 50hz signal. This evelation was furthermore strenghtened when I found the following piece of code in the microcontroller (comments added by me):
This method is called with the following code, early in the MC init process:
As you can see, if the first method returns 1, the init process goes on and in the end turns on the amplifier, otherwise the microcontroller goes into an infinite loop, thus halting the init process. This must surely be a bug?
We can esily avoid this by replacing the instruction
with the instruction $2000, which is in effect a NOP, as it just continues with the next instruction. Thus, we need to replace the FE value with a 00 value in the PROM of the 68hc711e9 chip.
I will try to do this in the next few days. Stay tuned.
If you want to repeat my steps on your own amplifier, note that the warranty is lost forever. If you want to keep you warranty, be prepared to fork out at least $1000 to Absolute Sounds for them to change the chip.
I have been absorbing information about the 68hc711e9 microcontroller Krell uses in this amp, and the first thing I had to check was if the device has a "security feature". You can check this with a scope. Here's an excerpt from the 68hc11 reference manual from Motorola:
"The presence of the security option can be detected while the MCU is in reset by forcing the mode A (MODA) and mode B (MODB) pins to 1 and monitoring the strobe A/address strobe (STRA/AS) pin. When MODA and MODB are 1s, the normal expanded mode is requested. If security is engaged, the STRA/AS pin will act as a high-impedance input because the security option causes the MODA pin to be interpreted as a 0 even if it is a 1. In single-chip modes, the STRA/AS pin is configured for the strobe A input function. If the security mode is not engaged, the STRA/AS pin will act as the address strobe output, which can easily be recognized on an oscilloscope. This checking procedure allows the security mode to be detected without disengaging it. If the MODB pin were low in this experiment, the bootstrap mode would be requested rather than the normal single-chip mode. In the case of MODB low, care is required not to release reset because doing so would cause the security option to be disengaged."
Of course, you need a proper setup to do this. I use a prototype board which can be set up to boot software in the microcontroller in various ways. The best option is to put it in special bootstrap mode, and load a talker into its 256 bytes of ram on reset, allowing it to be examined and debugged by a prograam such as jbug11.
It is not a secured device , so the next step is to do some disassembling. Be sure to use proper tools as you would otherwise ruin the microcontroller. I initially used a home made extraction tool, but this will surely ruin the chips connectors after a while. Better safe than sorry, we are after all talking about a £2500 Krell amplifier here...
I have been looking at the instruction in the microcontroller, and it appears that it senses an input frequency at pin 3 on port A, This was confirmed by measuring the signal at all pins of the processor. Only pin 31 showed a signal resembling anything like a 50hz signal. This evelation was furthermore strenghtened when I found the following piece of code in the microcontroller (comments added by me):
Code:
D472 3C PSHX
D473 183C PSHY
D475 CE1000 LDX #$1000
D478 18CE0000 LDY #$0000
D47C 1E0008FC BRSET $00,X,$08,$D47C ; wait until bit 3 set in reg 1000
D480 1F0008FC BRCLR $00,X,$08,$D480 ; wait until bit 3 clear in reg 1000
D484 1808 INY
D486 01 NOP
D487 01 NOP
D488 1E0008F8 BRSET $00,X,$08,$D484 ; inc Y while bit 3 is set in reg 1000
D48C 1808 INY
D48E 01 NOP
D48F 01 NOP
D490 1F0008F8 BRCLR $00,X,$08,$D48C ; inc Y while bit 3 is clear in reg 1000
D494 188C0925 CPY #$0925 ; is this the magic number?
D498 2306 BLS $D4A0
D49A 8601 LDAA #$01
D49C 1838 PULY
D49E 38 PULX
D49F 39 RTSThis method is called with the following code, early in the MC init process:
Code:
D3A2 36 PSHA
D3A3 3C PSHX
D3A4 BDD98F JSR $D98F ; set up local variables
D3A7 BDD982 JSR $D982
[...]
D3B3 BDD472 JSR $D472 ; check frequency
D3B6 4D TSTA ; return value 0 or less
D3B7 2702 BEQ $D3BB ; if yes, continue
D3B9 20FE BRA $D3B9 ; otherwise, infinite loop... B I N G O !
D3BB BDD6C5 JSR $D6C5
[...]As you can see, if the first method returns 1, the init process goes on and in the end turns on the amplifier, otherwise the microcontroller goes into an infinite loop, thus halting the init process. This must surely be a bug?
We can esily avoid this by replacing the instruction
Code:
D3B9 20FE BRA $D3B9with the instruction $2000, which is in effect a NOP, as it just continues with the next instruction. Thus, we need to replace the FE value with a 00 value in the PROM of the 68hc711e9 chip.
I will try to do this in the next few days. Stay tuned.
iampivot
This is a very good work!!!
My method is more "hardware" but works fine too :
In a 300fpb, it needs two cmos oscillator, one by amplifier, because there is two processors independant in it, on each way (double mono).
Each mod is supplied by a different 5 volts (care of ground loops).
Made a HTS 7.1 and a Showcase processor too. allways 60 Hz oscillator. Init is good. Just say on the display "60 Hz version"
.
I'm looking for the principle and cabling of the Krell "remote link", nobody knows ?
I want to start the 300fpb with the 12vdc trigger of the HTS 7.1, but the 300 has only "remote link" 5 pins din socket. How to do ?
Philippe
This is a very good work!!!
My method is more "hardware" but works fine too
:In a 300fpb, it needs two cmos oscillator, one by amplifier, because there is two processors independant in it, on each way (double mono).
Each mod is supplied by a different 5 volts (care of ground loops).
Made a HTS 7.1 and a Showcase processor too. allways 60 Hz oscillator. Init is good. Just say on the display "60 Hz version"
.I'm looking for the principle and cabling of the Krell "remote link", nobody knows ?
I want to start the 300fpb with the 12vdc trigger of the HTS 7.1, but the 300 has only "remote link" 5 pins din socket. How to do ?
Philippe
I dont have any intention of doing business on this, I only want my amplifier to work.
I think there's an analogy here to the region system on dvds and copy protection on cds; companies try to set their own rules on the usage of their products. They want to limit already established consumer rights such as first sale doctrines and fair use. The result is that consumers fight back.
In any case, Krell might choose to change their ways if hacks such as these gets widespread. Hopefully they'll drop this silly practice altogether. They can ttighten their schemes, eg by using a secured device or changing the microcontroller altogether, but in the end it would increase the base cost of the amplifier.
For those others that finds this hack using google and want to try it for themselves, be sure to check that the device is not a secured device, as I described in my post.
I think there's an analogy here to the region system on dvds and copy protection on cds; companies try to set their own rules on the usage of their products. They want to limit already established consumer rights such as first sale doctrines and fair use. The result is that consumers fight back.
In any case, Krell might choose to change their ways if hacks such as these gets widespread. Hopefully they'll drop this silly practice altogether. They can ttighten their schemes, eg by using a secured device or changing the microcontroller altogether, but in the end it would increase the base cost of the amplifier.
For those others that finds this hack using google and want to try it for themselves, be sure to check that the device is not a secured device, as I described in my post.
Just a note on the conversion at Krell authorised resellers. In the UK, they charge £575 (Except A series, which is £1100), in Scandinavia (Sweeden), they charge SEK 5500 and in Germany €400. So if you prefer to have it done and still maintain your warranty, you'd better learn eine bisschen Deutsch. And note: these prices are "excluding parts"...
iampivot said:
Hi
Ok, box has arrived ;-)
First test: 230/115V transformer used to supply the amp.
After a few endless seconds of flashing led's the amp
turns into operating-mode then I push the button!!!!
No frequency-lock (I thought...).
The amp plays very well and I am happy!
Second test: Switching from 2-1-2 into 2-2-2 after checking with a
friend who owns one original KAV-400XI 230V
Edition. Plugging in 230V with a heart-rate of 170...
FEr is displayed on the 3 LED's (frequency error....)
Not possible to switch on.....
Hmmmm...strange that it should work with the external transformer and NOT with the internal switching changed
Well, will bring scope and measuring-tools home from work to find out why. Could it be that the external transformer produces an "unclean" Sinus-wave that fools the sensing circuit?
Other who have usefull info on this?
Right now I use the KAV-400XI as preamp (external trafo is to small) and a ML-331 for poweramp.
Even if it doesn't switch on, is the leftmost red led on? If so, then your amp is frequency locked.
You can see what is printed on the white sticker on the microcontroller which is located at the print attached to the front panel. It has the allowed frequencies and firmware revision printed.
Is this a brand new one or used?
--
-Torgeir
You can see what is printed on the white sticker on the microcontroller which is located at the print attached to the front panel. It has the allowed frequencies and firmware revision printed.
Is this a brand new one or used?
--
-Torgeir
Hugin said:
Yes, I'm from norway.
You will need to patch yours. It is technically possible to retrieve the complete program, but you can only reprogram a microntroller when it has an EPROM. The 68hc711e9 is a one-time programmable device (you can only turn bits from 1 to 0, not the other way around). Thus, it's much easier to find the correct program location and path a single address. A program copy would probably also be illegal, while repairing your own amplifier would be ok.
You will need to have a 68hc11 programming board to do this, and a 5v and 12v power supply. An oscilloscope would help you determine if the chip is a secured device or not. (Don't think there's much risk of seeing such a device in a krell.) I can see if I have the adress for the company that sold me mine.
- Status
- This old topic is closed. If you want to reopen this topic, contact a moderator using the "Report Post" button.