EEVblog #410 - Microtek 8086 In-Circuit Emulator Teardown

[EEVblog]

Dave.

[ftransform]

did you say penultimate?

[baoshi]

I have a 1987 80286 motherboard, using a similar PLCC packaged 286 processor 

[amyk]

One of those would be perfect for determining the behaviour of undocumented instructions, useful for emulator writers and the like.

The unidentified ICs:
X2212P EEPROM-backed nonvolatile SRAM.
uPD71054 programmable timer/counter (clone of Intel 8254).

[cengland0]

In the power supply section, what is the blue rectangle object that looks like the plastic casing has melted?

[firewalker]

It is a multi turn trimer variable resistor with glue on the shaft.



Alexander

[Moshly]

Hi, Dave & everyone

I've been meaning to join the forum for ages, but now i have something to add.
Had this EPOD-8052 in a junk box for years, borrowed the ZIF socket to test a bunch of chips.

Dave can have it, if you want it. Collect the whole set. But the ZIF socket is mine   

[Stonent]

Just some info on the 80186. It was based on the 8086 but was more focused on embedded systems.  The chip had a lot of the external parts associated with an 8086 or 80286 built in.

http://en.wikipedia.org/wiki/Intel_80186

It was most commonly known as the CPU in the MS-DOS compatible (but not fully PC compatible) Tandy 2000 computer.
It featured a lot of good specs that exceeded the PC-AT but by breaking a lot of standards. It ran 2MHz faster than the AT, featured proprietary DSQD floppies (Double Sided Quad Density) 5.25" floppies. 640x400 proprietary graphics. I remember if you needed to use the serial ports you had to have a special TSR loaded called a fossil driver so that programs that used PC compatible ports could use the serial ports on this computer.

There were a few instruction set differences in the 186 also.  In the end it made for a system that could run text based MS-DOS programs faster than IBM but not much else that wasn't made by Tandy. I heard they were pretty good CAD systems with the good graphics capabilities but it still ran on the older 9 pin graphics port (no VGA 15 pin here). A lot of the unsold computers became database "servers" in the store or were just wired in as terminals to the Tandy mainframe or their AS/400.

Also some European PC clones at the time used the chip as it lowered the chip count on the motherboard.

Because so much was integrated in the chip, it was more efficient than the 8086 and 80286 in a lot of operations since everything was on board.

This chip was also used in the Australian Dulmont Magnum laptop.

http://en.wikipedia.org/wiki/Dulmont_Magnum

[free_electron]

That's not a Plc but an LCC package : Leadless Chip Carrier.

Essentially what this kind of emulator does is use tap into every single pin of the processor and apply data in response of the CPU demanding it , ( so it serves as code memory : you don't install the roms on the target board but they get emulated in this box. That's why there is all those 28 pin rams. The second part is a tracer. They simply record every pin state at every clock change in those Sony 2k rams. And then decode that.

The x2212 chip on the processor board is a xicor part. Most likely it i a Realtime clock.

I have an 8051 emulator similar to this thing. Same principle.

Now, the unit Dave has is a debugger for a microprocessor, meaning no internal ram or rom/EPROM.  Emulators for microcontrollers are scarce and only the chip manufacturers and some specialized companies like Nohau that are licensed by the processor maker ever made those. Those use a so called bond-out chip. This is a special version of the chip that has its internal data and address busses
Brought out on extra pins that are not available on the real chip. These chips cost a fortune and sit in sometimes really weird packages... Like dip40 with a 28 pin ic socket on their back ... I have an emulator chip from Dallas semi that has an 28 pin ram on its back. I used to have one for nationals COP400 series as well but I lost that one over the years. Also mostek 37xx had these special bond outs. You could actually take a regular EPROM , burn the code in there, poke that on the bond out,back( they called that a piggy-back package) and the chip would run just like a normal microcontroller would. These were made for Microcontrollers that were only available with mask rom option. It was cheaper to run piggyback packages in a few thousand parts than relay out the part with real EPROM on board.  As process technology matures and die size shrank they switched away from mask rom altogether as they could make now EPROM cells that were smaller than masks om cells. So it made sense to simply place EPROM and use it as an OTP( one time programmable)  and simply sell a few of them in ceramic windowed package for the code developers.

http://www.cpu-world.com/CPUs/680x/MANUF-Hitachi.html second from the top is a piggyback package

A real bond out chip for usage in emulators ( so not to simply hook up an external EPROM )
http://www.cpu-world.com/CPUs/680x/MANUF-Hitachi.html

[tesla500]

A real bond out chip for usage in emulators ( so not to simply hook up an external EPROM )
http://www.cpu-world.com/CPUs/680x/MANUF-Hitachi.html

Which one is the bond out chip?

[free_electron]

oops. posted the smae link twice ...

this is a bond-out chip for an 8051 chip:

http://www.serverpartswarehouse.com/Intel-8051-ICE-Bond-Out-Chip-C8051EG-tested-P1898935.aspx

talk a bout a weird package... ceramic , with slits in it , pin number 1 is actually the number '1' in shape

some more esoteric piggy backs.

i think i have an 80c451 at home somewhere. that machine can be used as bond-out. the 451 is a regular 8051 bit with 6 i/o ports as opposed to the regular 4. by flicking a bit or pulling a certain line to some level on power up the two extra ports become address/data and you hook up an eprom there. so the other pins ar elike a normal 8051. that thing sits in an 68 pin really large package ( DIP like a motorola 68000 but i believe it is even larger than an 68000 )
it is not a true bond-out as the true bond-outs can eb stopped and any flipflop in the core can be read or written , so you can actually read or alter the contents of any internal register.  the 80386 had that capability too. any 80386 can be flicked in a special 'sidechannel debug' mode you could even manipulate cache . there was some hidden scratchpad memory in there. i forgot the details. in later steppings they removed that as someone figured out how to do it at runtime and basically wrote aprgram that could 'sniff' anything running... a serious backdoor...

[cengland0]

I found the patent application for a bond out chip.

http://www.google.com/patents?id=9XKHAAAAEBAJ&printsec=abstract&zoom=4#v=onepage&q&f=false

[SeanB]

I would guess the ISA card is actually a standard EPP centronics card, with only an address change to 300H or 330H and possibly a non inverted set of control lines. As to why the 80186 is used is because it integrated a lot of the required peripherals needed to make a 8080 work, like the clock generator, the CTC and such. I still have one of these from my first laptop.............

74F stands for flaming hot, 74s stands for smoking hot, those do need the fan cooling from the back for sure. They were nice, being able to run at the then unheard of speed of 60MHz or more with almost no delay. The bus drivers though did do better with a small heatsink epoxied on top, especially if they were driving a large load and long lengths of track.

Love the 8255's, I have a whole box full of them..............

[EEVblog]

oops. posted the smae link twice ...

this is a bond-out chip for an 8051 chip:

http://www.serverpartswarehouse.com/Intel-8051-ICE-Bond-Out-Chip-C8051EG-tested-P1898935.aspx

talk a bout a weird package... ceramic , with slits in it , pin number 1 is actually the number '1' in shape

some more esoteric piggy backs.

I tried to find an interesting image of a bondout chip on Google to include in the video, but failed!

Dave.

[free_electron]

i'm gonna go rifle through the surplus store tonight. i believe a saw an original intel 8051 ICE in there a couple of weeks ago.. it may have such a bond out chip .... if i find one i'll send it to you

[jnd]

I love this stuff, especially when it's older than me



Ad piggyback, these are chips which have the internal memory lines routed to top for easy prototyping and ROM version development while all the regular I/O pins are free to use by your app. Mostek had one version of it's MK3870 which has not just standard memory interface but full featured bus with the whole 64k address space on the top socket with all the read and write signals so you could use it for really compex ICE. But I don't think I've seen that particular model out there. On the other hand the regular piggyback version  is also interesting because it actually allows for write backs to the memory. Not useful for EPROM/EEPROMS but if you got NVSRAM or even modern FRAM you can read and write to it in single cycle, like usual RAM. It begs for developing bootloader so you don't have take the memory out for reprogramming in external programmer and putting it back. It's one of many items on my to do list...

Well at least I got it working after having some problems when I had to use Rigol's logic analyzer on the piggyback socket to find out I have decoupling problems, possibly caused by oxidized wires in the breadboard. Debugging the debugger 

Somehow I find it more fun and more challenging to play with these late 70's microcontrollers (single chip version of Fairchild F8) than modern stuff, today every kid can program some ARM in high level language.

[EEVblog]

i'm gonna go rifle through the surplus store tonight. i believe a saw an original intel 8051 ICE in there a couple of weeks ago.. it may have such a bond out chip .... if i find one i'll send it to you

Sweet!
I was looking on ebay again, hoping to score one, but the ones that are on there are pretty darn expensive.

Dave.

[voidptr]

This is a really nice treasure !
This ICE was surely many $1000 bucks !
I wish I had one at that time, when I was working !
Everybody were developping addon card for pcs..it was the platform for industrial stuff too ...
Everybody had their pc open and were swapping hardware prototype cards ....
Geez  I remember that I had to many time search around few people pc to find who had stolen my 8087
(who was quiet expensive too)  ...

Good old time :-)  I think  this weekend I will reboot my old pc 8088 clone, it was still booting fine last winter !
)

[Hamster]

Dave, what do yo do with these things you buy? this would look nice next to my Fluke 9110FT