JTAG for the SuperH4 processor identified and mapped out. Will connect a probe there next and try to enumerate/halt
JTAG for the SuperH4 processor identified and mapped out. Will connect a probe there next and try to enumerate/haltgreat work
I just hope the debug interface is not disabled. Or at least if it is disabled, it can be enabled by moving some pull-up/down resistors on the board that can be identified (like in Keysight 3000A scopes)
by the way, can I ask how you identified the pins? just by tracing to the CPU pins?
I always suspected that empty pin header but never really dug into it...a lot of things now can be done through jtag
i am not an expert on this matter but I dont think you need the Renesas emulator. Segger J-Link that I do my jtags with and is excellent, does support this cpu here and I dont think that extra pin needs connecting...
the problem you are describing still very much looks like the memory (RAM) issue that I had some time ago...the symptoms were very similar to what you describe although I didnt do that much deep measurements as you have but i did measure "bad looking" signals on the memory chips
and started changing them randomly (starting from the bottom) and after the second chip the unit came back to life...maybe with deeper dive you can even pinpoint which memory it might be, i just had a strong suspicion by the general look of the signals on the data lines..changing those chips is relatively easy...maybe you have already done that?
as a general rule, I have come to the conclusion that when an instrument stops so early in the boot process, usually (i am not saying always) my first suspect is the RAM and then the bootrom wherever it is. this has been the case in multiple occasions in various instruments at least for me...
the problem you are describing still very much looks like the memory (RAM) issue that I had some time ago...the symptoms were very similar to what you describe although I didnt do that much deep measurements as you have but i did measure "bad looking" signals on the memory chips
and started changing them randomly (starting from the bottom) and after the second chip the unit came back to life...maybe with deeper dive you can even pinpoint which memory it might be, i just had a strong suspicion by the general look of the signals on the data lines..changing those chips is relatively easy...maybe you have already done that?
as a general rule, I have come to the conclusion that when an instrument stops so early in the boot process, usually (i am not saying always) my first suspect is the RAM and then the bootrom wherever it is. this has been the case in multiple occasions in various instruments at least for me...
I just received fresh RAM chips... I see some jitter on some of the address lines, but I'm not sure if it's just a bad trigger setting or legit. How did you determine "bad looking" signals, @analogRF?
Fortunately that IC is really cheap and seems like it's obtainable
After running for 5min the temperature stays stable at 53C at 14V and 300mA... that's a bit more than 4W and it seems that it might be taking the power budget since all other ICs are hovering 30C
Thanks for the hints and experience with those things! I think test some of the pins (any recommendations on what I should see?).
I think I'll order one of those LAN91C111 anyway and replace, looks like a winner... I hopve no other passives around it are toasted and/or cause it to fail that way.
I'm on the edge of my seat reading this, and I don't even own one of these !
Unfortunately that SH4 cpu doesn't have the "AUD" debug interface that the older / smaller SH2 devices have, which can be used to view PC value on every branch/call - useful to find out if it's looping a small section of code...
That ASEBRK pin doesn't look like it should interfere with JTAG ? datasheet says "leave open" when not using an emu.
Were you able to look at the reset code on this thing or is it still part of that undumped flash BGA ? I quickly checked the STBCR registers and not sure if it's possible to disable the HUDI module at all, but if so : you can look at early-early boot code (I'm talking reset vector) to see if it's soft-disabled.
After seeing that the network IC was that hot I decided to order it and wait for it to come on the mail
if you have working OpenOCD configs for that SH4 processor
The debug options that are available once the user code is running are astonishingly helpful
After seeing that the network IC was that hot I decided to order it and wait for it to come on the mail
I think it's a good next step. Although looking at the DS, it says it can draw "up to 140mA" ? on 3.3V right ? that's a fair amount of power, probably only in certain cases, but if the CPU is leaving that IC in a weird state (or spamming some function inside it that draws more power) it could be another wild goose.
How about removing it altogether in the meantime ? See if that affects the boot sequence at all ?Quoteif you have working OpenOCD configs for that SH4 processorSorry, haven't much to add. HUDI/JTAG wasn't easily accessible on the board I worked on but AUD was, and that provided what I needed.
JTAG should give you at least boundary scan according to the DS... Is it realistic to write some massive bitbanging code to read the external memory that way ?
Otherwise I'm not sure what else it provides if there's no support code in the fw...QuoteThe debug options that are available once the user code is running are astonishingly helpful
Oh do you still have access to the vxworks console ?
IIRC you can even load + run arbitrary code that way, right ?
However, the only problem that I have right now is that the tracking generator option is nowhere to be seen
my instrument passes all self tests and works perfectly but the tracking gen is not anywhere...
However, the only problem that I have right now is that the tracking generator option is nowhere to be seen
my instrument passes all self tests and works perfectly but the tracking gen is not anywhere...
Did you have any luck getting the tracking generator option to reappear?
it's been a long time since then...yes, I got a destroyed main board from a ms2721b with TG, and transferred its EEPROM chip to mine and then changed the S/N in service menu