Hacking the Termtek TK-635 color terminal
The Termtek TK-635 is a color terminal which (probably?) only supports text
Output is given through a VGA port.
It has two serial ports (1 DB25 "SERIAL 1" and 1 DB9 "SERIAL 2"), and a parallel
port (1 DB25 "PARALLEL").
Input can also be given with a PS/2 keyboard, which is also used to configure
It is possible to go in the terminal configuration by pressing
Alt and Escape at the same time.
Currently, I think these are the specifications:
- 25Mhz 80188 CPU
- Custom video and I/O chip
- 256KB of flash memory
- 160KB of RAM (128KB + 32KB)
AMD N80C188-25 (CPU):
This a 25Mhz CMOS version of the 80188 processor by AMD.
The 80188 is a 16-bit x86, which has some additional instructions compared to
the 8086/8088. Unlike the 80186, the 80188 has an 8-bit data bus.
TERMTEK TKA-200 (???):
probably a chip which handles the serial, parallel, PS/2 and VGA ports.
PMC Flash Pm29F002T-12PC:
256 kilobyte eeprom flash memory which contains the firmware. It can be replaced
by any other 32 pin 5V flash memory which uses the same package (write name here)
and follows the JEDEC standard.
I've successfully made a working backup flash by using a SST MPF 30SF020 flash memory.
Winbond W29C020C flash memory also works fine.
The original flash chip of my terminal had a label saying "TK-635 V0.23" on it.
The firmware does not check itself, it doesn't do any checksum.
Two 74HCT3730 C4463ME HRn9927 F (???):
I don't know what these are for.
Winbond W241024AJ-15 934SE292260001IG (memory):
128 kilobyte "high-speed" CMOS static RAM.
The motherboard of my terminal has some free space where a second chip like this should be,
so memory is probably expandable to 256 kilobytes.
32 Kilobyte "Ultra High Performance" CMOS static RAM
How to reprogram (and dump) the flash memory
You could obviously do it with an EEPROM programmer, but they're expensive and few people
have them. Or you could try this other way...
The flash memory used by this terminal is similiar to the one many Pentium II era computers use
for their BIOS, a 32-pin socket.
To reprogram or dump the flash memory of your terminal you have to boot your (x86!) computer in DOS,
as is, without loading any drivers, and remove your computer BIOS's flash memory when it's running,
then you put your terminal's flash in that socket and then use a flashing program.
I used UNIFLASH successfully, so I recommend you to use that.
To remove the flash from the socket simply push the flash up with small pliers or a small flat screwdriver
dyou use with your eye) in the part between it and the socket. Beware not to bend any pins,
and if you do, straighten them up or they will easily break when you put the flash back.
To put the flash in the socket, simply align it in the right way, and do not press it not much,
otherwise it will be a pain to remove.
Put your computer's BIOS flash memory back once you don't need to reprogram anything anymore.
Just make sure the BIOS's flash is JEDEC compliant, in rare cases it might not be.
The motherboard I used to do this is a Chaintech 6LTM, a Slot 1 board.
It seems that the flash begins at 0xC0000 (Segment 0xC000).
Far calls/jumps are all done at least at segment 0xC000, so that's why I take this assumption.
It's also compatible with the size of the flash (256kb.), in fact it would be located at the top
256kb of the address space.
Code seems to start at offset 8 in the firmware.
Motherboard power connector pinout
These are the voltages you should feed the connector.
Pin 1 - Black (Ground)
Pin 2 - Red (+5V)
Pin 3 - Orange (+12V)
Pin 4 - White (-12V)
Pin 5 - Red (+5V)
Pin 6 - Black (Ground)
I adapted an ATX power supply successfully.
Status light power connector pinout
These are the voltages you get from the connector.
This is located on the motherboard and only works when the motherboard power connector is connected.
Pin 1 - +5V
Pin 2 - Ground
GLT725608-15J3 datasheet #2
AMD N80C188-25 datasheet
Winbond W241024AJ-15 datasheet
TK-635 Firmware version 0.23
Last modified on October 7th, 2009