Valhalla 2720GS

[Kleinstein]

The plan looks a bit odd in some places. Tr6 and TR7 may have gate and source swapped. Just the gate conneded to easch other makes little sense.

[branadic]

You are right, there was an error in the lib, which resulted in swapped gate and source. Already updated the schematic.

-branadic-

[branadic]

Updated the schematic again, now everthing should be complete and correct, but schematic needs some re-arranging to make it more readable. It is consistent with the layout in the post before.

-branadic-

[Kleinstein]

I think there is likely a link missing from the source of TR6 / TR7 to some output / connector. These 2 should be switches to choose between the 2 references.

[branadic]

You are right, the path got lost when I updated the pinout of the transistors in the schematic the other day. Schematic and board image have been updated. I'm happy that the path was there when I've ordered the board, so it won't need a bodge wire

-branadic-

[branadic]

Schematic was cleaned up and updated. It is more readable now.
Aluminum casing was hand over to me, I'm almost there to power up the board. The right oven setting is still unknown.

-branadic-

[branadic]

It's done, the board is ready. It only took 4 bodge wires to fix some reverse-engineering errors I made. Below is the board and a comparison to an original reference board of the unit.
The reference is working, but ...

It has the NOVRAM content of reference 1. The memory content seems to contain some serial number, which causes an issue during boot sequence, once reference 1 and my copy cat are installed at the same time.
If one of them is pulled, the instruments powers up without issues. So I need a NOVRAM with the content of a totally different reference board to get that board working with the rest of the references or need to find out which part of the NOVRAM content causes the conflict. Other than that it works as it should. I also tested with only my copy cat installed and get reasonable readings.

-branadic-

[branadic]

Updated schematic with the information on how to adjust the oven settings:

https://www.eevblog.com/forum/metrology/valhalla-2720gs/msg4991971/#msg4991971

From the schematic we can now extract what to do for an ADR1399 upgrade, we need to replace R15 = 4.32k and add the output filter as well.

-branadic-

[martinr33]

branadic, have you dumped the EPROM for the main 6809 processor? That might contain some clues.

I have attached a zip file with converted data files and a short file containing the contents of each memory (without labels).

BTW, congrats on a very nice piece of engineering on the reference board.

Back in 6809 days, floating-point hardware did not really exist, and there were not many applications for it because MPUs were generally slow and simple. I've found some useful references to a 6809 floating point library that might have been used. If not floating point, the system could have used 16 or 24 bit arithmetic (16 bit with a 65mV offset, which seems narrow, so 24 bit is more likely.)

https://gtoal.com/src/asm-expand/
https://jefftranter.blogspot.com/2019/04/a-6809-single-board-computer-mc6839.html

[branadic]

Hello martin,

you missed the attachement, however, you find the EPROM content here:
https://www.eevblog.com/forum/metrology/valhalla-2720gs/msg4873862/#msg4873862

Front panel EPROM here:
https://www.eevblog.com/forum/metrology/valhalla-2720gs/msg4884920/#msg4884920

and all the rest here:
https://www.eevblog.com/forum/metrology/valhalla-2720gs/msg4945894/#msg4945894

-branadic-

[martinr33]

Thanks, got it!

I started the disassembly. The ROM is "only" half full, but the code is very dense with no obvious text blocks. So nothing much yet.

Also, the data sheet states that the system stores 30-bit drift and calibration data in te local memory of each reference, so we are looking for patterns in 4-byte blocks.

The data sheet also indicates that the system could update the data, which means that you might be able to track which bytes change, and from there eliminate some more memory locations. I think that the least significant bit in such a word might represent 10 nV (based on the 1e9 address space of 30 bits) , so we might have a way in there by looking for values that represent the 7+ volts or so that the reference produces.

[PrecisionFreak]

After several emails with branadic, I registered here, finally.
I started disassembling the AT27C256.BIN, also, and found some 48-bit constants at addresses 8264, 8BBE.
And a list of GPIB-Commands, I think, at B14A:
        FDB    comUD_A398
        FDB    comPO_823E
        FDB    comDR_9CB3
        FDB    comRD_ADF4
        FDB    comRP_AD33
        FDB    comER_9C49
        FDB    comFC_9AE1
        FDB    comFD_9B19
        FDB    comCS_9488
        FDB    comTP_9C1F
        FDB    comCT_84C4
        FDB    comSW_9B63
        FDB    comCM_9C56
        FDB    comCL_9560
        FDB    comCN_9591
        FDB    comCA_9766
        FDB    comCE_97CA
        FDB    comIL_9CC0
        FDB    comIE_9D31
        FDB    comSC_9D7A
        FDB    comIC_9D7F
        FDB    comSZ_9C8F
        FDB    comIL_9CC0
My aim is to find the password / passphrase  and to check if it is possible to read / write the nvrams in situ, in the 2720GS without opening it.
Attached you find the files to generate a disassembly with BEEBDIS.
I tried to work with IDA, but I think to disassemble 6809  I need the costy pro-version.
Can we use  Ghidra  or  Radare?
martinr33, which disassembler did you use?

maxwell3e10, do you have a better (printed?) copy of the manual? The photo 2720Transformer.jpg  shows good resolution.
It would be very helpful to understand the circuits, e.g. the signal names and IC-pins.

Did anyone see hidden keys in the front panel? The manual shows a matrix with 8*7=56 keys, but only 45 are visible.
See attached JPG for the missing 11 / 12. (Enter are 2 separate keys)
There is a photo with all the displays / LED designators, too.

[maxwell3e10]

I did get a printed manual, but it does not seem to be much better in resolution than the online pdf version. If there is a particular place in the circuit you want me to test, I can scan a page or two.

[branadic]

I started comparing the memory content of the NOVRAMs (removed the leading zero first) of the 3 references to find similarities between them but also similarities within each memory. I color coded the corresponding sections.

-branadic-

[PrecisionFreak]

Hi all,  branadic, I did the same thing.  But as long as it is difficult and time consuming to change RAM contents, what would you do?
Does anyone have the 2720GS connected to a working GPIB-bus?
I checked the commands, if you send a request SW, it should answer with the firmware version, here 61.
Additionally to the beforementioned commands, there are also some System / Service / Internal Calls (adress table in 9D3C  / 9D6A):
comSC_9D7A
        LDX     #tblSC_9D6A
        BRA     L9D82

comIC_9D7F
        LDX     #L9D3C
L9D82
        LDA     <L005F
        CLR     <L005D
 which I am looking at.
I hope to find commands to modify NVram contents in the device.

maxwell3e10: Thank you for your time, pages 15 to 21 of 99 would be interesting, as they are poor in the pdf.
There must be a manual with around 150 instead of 99 pages (including volume 1?), does someone have this?

I updated the valhal2.zip-file with disassembly-listing.

One thing to note: Valhalla connected the address-decoders 74138 and 74154 in an unusual way:
the outputs are not addressed in linear order, because for example A15 is wired to IC4/1 (input A), not IC4/3 (input C), as one would expect.

Update: Branadic, the oven adjustment must be -0.5V (ca. 53°C) for RV1, not -0.8V (71°C).  RV2 is for overtemp, where 71°C are correct.
Attached you find a simulation.  I put the zener D7 to constant 69°C to get fixed 6.3V.  The AD590 generates a current in µA proportional to absolute temperature (PTAT), at 27°C 300µA, which results in 5.8V at R7+R8=19320 Ohms
I would run the reference at a lower temperature, e.g. 45°C, depending on ambient and internal device temperature.

[branadic]

But as long as it is difficult and time consuming to change RAM contents, what would you do?

I simply don't know. My best chance is that someone else with a 2720GS shares his memory contents and I then have some NOVRAM chips programmed.
Some MBM2212-20 arrived today, but there is also CAT22C10 available. I'm not sure if it makes sense to put an empty memory chip into the copy cat reference board and see how the instrument deals with that 

Update: Branadic, the oven adjustment must be -0.5V (ca. 53°C) for RV1, not -0.8V (71°C).  RV2 is for overtemp, where 71°C are correct.

You are right, that was a copy&paste error. Corrected the schematic.

-branadic-

[Mickle T.]

Can I hope that someday we will see graphs of non-linearity and short-term instability of the 2720GS? 

[maxwell3e10]

Here is for example page 19 of the service manual. One can't really see board markings.
I have posted some initial stability plots shortly after turn-on.

[dietert1]

The memory dumps shown in "Ref1-Ref2-Ref3.jpg" and the more recent "MemoryComparison.png" are different, e.g last byte in second row. Why is that?

Regards, Dieter

[branadic]

The memory dumps shown in "Ref1-Ref2-Ref3.jpg" and the more recent "MemoryComparison.png" are different, e.g last byte in second row. Why is that?

Seems like a typo with "0" instead of "9". Fixed.

-branadic-

[branadic]

Can I hope that someday we will see graphs of non-linearity and short-term instability of the 2720GS? 

One step after the other

I quickly tried fitting a reference board with an empty NOVRAM, but the instrument doesn't like that either and stops during boot phase.

-branadic-

[PrecisionFreak]

I think I found the default password (by chance after 1 hour lurking in the code), it was not that difficult. The sum of the digits is 31.
What is it good for?
I think, one can set a password to the cal-key additionaly.  If you forget this password, you need the "universal key" master default pwd.

Branadic, did the 2720 show any message with the empty NVRAM? I think it should show "REF 0 NO CALDATA" or "REF 0 LOST DATA " (replace 0 with the number of the board). At page 2 of the manual we find:
---- snip ----
REFERENCE MODULE OPTIONS
OPTION  # REF BDS   LOCATIONS
HSR        4 BDS.         A, B, C, D
GS          3 BDS.         A, B, C
54-4T     2 BDS.         A, B

ALL REFERENCE BOARDS ARE TO BE COMPLETELY SOAKED AND
TAKEN FROM 2710 REFERENCE SYSTEM. ANY GRADE BOARD
MAY BE USED IN OPTION 54-4T. GS OR HSR GRADE BOARDS
MAY BE USED IN OPTION GS. ONLY HSR GRADE BOARDS MAY
BE USED IN OPTION HSR. BOARDS MUST BE COMPLETELY
INSERTED INTO CARD GUIDES.
---- snip ----
AFAIUnderstand, the 2710 reference system is their station to burn in and test the ref boards. And probably write to the NOVRAM.
We have to look  if and how they marked the grade on the boards.
We could find HSR grade boards in lower grade units.

COMPLETELY SOAKED  could mean: washed with isopropanol thoroughly.
Here is a listing of all 169 display messages (there are some more short strings):
  1     1   string $A470 16 ; "ILIM 13V  000mA "
  2     2   string $A481 16 ; "ILIM 130V 000mA "
  3     3   string $A492 16 ; "ILIM1200V 000mA "
  4     4   string $A4A3 16 ; "-- 100mA MAX ---"
  5     5   string $A4B4 16 ; "--- 30mA MAX ---"
  6     6   string $A4C5 16 ; "UPPER VOLT LIMIT"
  7     7   string $A4D6 16 ; "LOWER VOLT LIMIT"
  8     8   string $A4E7 16 ; "SETTING DEFAULTS"
  9     9   string $A4F8 16 ; "INT REF 0000DAYS"
10     A   string $A509 16 ; "DIVIDER 0000DAYS"
11     B   string $A51A 16 ; "INT CAL 0000DAYS"
12     C   string $A52B 16 ; "NULLMTR 0000DAYS"
13     D   string $A53C 16 ; "SETZERO 0000DAYS"
14     E   string $A54D 16 ; "EXT REF 0000DAYS"
15     F   string $A55E 16 ; "- VERSION 0000 -"
16   10   string $A56F 16 ; "I/O ROM FAILURE "
17   11   string $A580 16 ; "  CLOCK FAILURE "
18   12   string $A591 16 ; " I/O uP FAILURE "
19   13   string $A5A2 16 ; "I/O RAM FAILURE "
20   14   string $A5B3 16 ; "- IEEE FAILURE -"
21   15   string $A5C4 16 ; " INPUT VOLTAGE? "
22   16   string $A5D5 16 ; "DATA ENTRY ERROR"
23   17   string $A5E6 16 ; "NOT WARM 00 MINS"
24   18   string $A5F7 16 ; " DIVISION RATIO?"
25   19   string $A608 16 ; "- CHANGE DATE? -"
26   1A   string $A619 16 ; "TEMPERATURE  00C"
27   1B   string $A62A 16 ; "  TEMPERATURE ? "
28   1C   string $A63B 16 ; "- CAL  ABORTED -"
29   1D   string $A64C 16 ; "  CONNECTIONS?  "
30   1E   string $A65D 16 ; "- AMMETER  CAL -"
31   1F   string $A66E 16 ; "  AMMETER CAL?  "
32   20   string $A67F 16 ; "PROVIDE 100ohm ?"
33   21   string $A690 16 ; "- CAL  FAILURE -"
34   22   string $A6A1 16 ; " DRIFT ANALYSIS "
35   23   string $A6B2 32 ; "-- USE DATA FOR DRIFT ANALYSIS? "
36   24   string $A6D3 16 ; "TURN OFF CAL KEY"
37   25   string $A6E4 16 ; "CALIBRATION END "
38   26   string $A6F5 16 ; "  ENTER 10V STD "
39   27   string $A706 16 ; "  ENTER 1V STD  "
40   28   string $A717 16 ; " ENTER 100V STD "
41   29   string $A728 16 ; " ENTER 1000V STD"
42   2A   string $A739 16 ; "IEEE ADDRESS 00 "
43   2B   string $A74A 16 ; "NO A-D CONVERTOR"
44   2C   string $A75B 16 ; "- INTERNAL CAL -"
45   2D   string $A76C 16 ; " OUTPUT GAIN ?  "
46   2E   string $A77D 16 ; " OUTPUT ZEROES? "
47   2F   string $A78E 16 ; "INT CAL COMPLETE"
48   30   string $A79F 16 ; "----- PASS -----"
49   31   string $A7B0 16 ; "----- FAIL -----"
50   32   string $A7C1 16 ; "- CAL - KREFAV -"
51   33   string $A7D2 16 ; "-- CAL -- KB2 --"
52   34   string $A7E3 16 ; "-- CAL -- KA2 --"
53   35   string $A7F4 16 ; "-- CAL - KA10 --"
54   36   string $A805 16 ; "-- CAL  KA100 --"
55   37   string $A816 16 ; " CAL - DVM ZERO "
56   38   string $A827 16 ; " CAL DVM SCALING"
57   39   string $A838 16 ; " CAL - DAM ZERO "
58   3A   string $A849 16 ; "CAL - NULL ZERO "
59   3B   string $A85A 16 ; "CAL - NULLMETER "
60   3C   string $A86B 16 ; "  CAL ¶5V ZERO  "
61   3D   string $A87C 16 ; " CAL -MDAC ZERO "
62   3E   string $A88D 16 ; " CAL 650mV ZERO "
63   3F   string $A89E 16 ; "CAL 1300mV ZERO "
64   40   string $A8AF 16 ; " CAL  °65V ZERO "
65   41   string $A8C0 16 ; " CAL   ±3V ZERO "
66   42   string $A8D1 16 ; " CAL 13V ZERO   "
67   43   string $A8E2 16 ; " CAL 26V ZERO   "
68   44   string $A8F3 16 ; " CAL 65V ZERO   "
69   45   string $A904 16 ; " CAL 130V ZERO  "
70   46   string $A915 16 ; " CAL 600V ZERO  "
71   47   string $A926 16 ; " CAL 1200V ZERO "
72   48   string $A937 16 ; " CAL - EXT REF  "
73   49   string $A948 16 ; " NO SUCH MEMORY "
74   4A   string $A959 16 ; "--MEMORY--000---"
75   4B   string $A96A 16 ; "- ERROR LIMIT? -"
76   4C   string $A97B 16 ; "--- STANDBY? ---"
77   4D   string $A98C 16 ; "--- HI THERE ---"
78   4E   string $A99D 16 ; "--- HI THERE ---"
79   4F   string $A9AE 16 ; " RESET REQUIRED "
80   50   string $A9BF 16 ; "REF 0 NOT FITTED"
81   51   string $A9D0 16 ; "REF 0 NO CALDATA"
82   52   string $A9E1 16 ; "REF 0 FAULTY    "
83   53   string $A9F2 16 ; "REF 0 NEEDS CAL "
84   54   string $AA03 16 ; "REF 0 NEEDS DATA"
85   55   string $AA14 16 ; "REF 0 SMALL ERR "
86   56   string $AA25 16 ; "REF 0 OVEN HOT  "
87   57   string $AA36 16 ; "REF 0 LOST DATA "
88   58   string $AA47 16 ; "REF 0 BEING USED"
89   59   string $AA58 16 ; "EXREF NOT FITTED"
90   5A   string $AA69 16 ; "- EXREF FAULTY -"
91   5B   string $AA7A 16 ; "--- EXREF OK ---"
92   5C   string $AA8B 16 ; "- OPTION EXR1 --"
93   5D   string $AA9C 16 ; "- OPTION EXR7 --"
94   5E   string $AAAD 16 ; "- OPTION EXR10 -"
95   5F   string $AABE 16 ; "---- DVM OK ----"
96   60   string $AACF 16 ; "-- DVM FAULTY --"
97   61   string $AAE0 16 ; "-- AMMETER OK --"
98   62   string $AAF1 16 ; " AMMETER FAULTY "
99   63   string $AB02 16 ; "--- AtoD OK ----"
100   64   string $AB13 16 ; "-- AtoD FAULTY -"
101   65   string $AB24 16 ; "NO OPTn BAT/EBU "
102   66   string $AB35 16 ; "LOW VOLT BAT/EBU"
103   67   string $AB46 16 ; " BAT/EBU FITTED "
104   68   string $AB57 16 ; "- NO NULLMETER -"
105   69   string $AB68 16 ; "FAULTY NULLMETER"
106   6A   string $AB79 16 ; "- NULLMETER OK -"
107   6B   string $AB8A 16 ; "   13V AMP OK   "
108   6C   string $AB9B 16 ; "  13V AMP FAULT "
109   6D   string $ABAC 16 ; "  130V AMP OK   "
110   6E   string $ABBD 16 ; " 130V AMP FAULT "
111   6F   string $ABCE 16 ; "  1200V AMP OK  "
112   70   string $ABDF 16 ; "1200V AMP FAULT "
113   71   string $ABF0 16 ; "- SYSTEM CHECK -"
114   72   string $AC01 16 ; "--- DIGITAL? ---"
115   73   string $AC12 16 ; "CHECKING DIGITAL"
116   74   string $AC23 16 ; "---- AtoD's? ---"
117   75   string $AC34 16 ; "  CHECKING DVM  "
118   76   string $AC45 16 ; "CHECKING AMMETER"
119   77   string $AC56 16 ; " CHECKING AtoD  "
120   78   string $AC67 16 ; "--- OUTPUT ? ---"
121   79   string $AC78 16 ; "CHECKING 13V AMP"
122   7A   string $AC89 16 ; "CHECKING 130VAMP"
123   7B   string $AC9A 16 ; "CHECKING1200VAMP"
124   7C   string $ACAB 16 ; "-- NULLMETER? --"
125   7D   string $ACBC 16 ; "CHECKING REF SYS"
126   7E   string $ACCD 16 ; " NOVRAM  FAULTY "
127   7F   string $ACDE 16 ; " OUTSIDE LIMITS "
128   80   string $ACEF 16 ; "--- EXT REF? ---"
129   81   string $AD00 16 ; "CHECKING EXT REF"
130   82   string $AD11 16 ; "CHECKS COMPLETED"
131   83   string $AD22 36 ; "-- REMOVE CONNECTIONS (NO TO ABORT) "
132   84   string $AD47 16 ; "NO FAULTY PARTS "
133   85   string $AD58 16 ; "REQUIRES EXT CAL"
134   86   string $AD69 16 ; "DIVIDER OVEN HOT"
135   87   string $AD7A 16 ; "-- DIVIDER OK --"
136   88   string $AD8B 16 ; "REQUIRES INT CAL"
137   89   string $AD9C 16 ; "INT CAL DATA OK "
138   8A   string $ADAD 16 ; "WARMUP IS 00MINS"
139   8B   string $ADBE 16 ; "SYSTEM ERR- MATH"
140   8C   string $ADCF 16 ; " CANNOT OUTPUT  "
141   8D   string $ADE0 16 ; "- OUTPUT  SLOW -"
142   8E   string $ADF1 16 ; " NO  REFERENCES "
143   8F   string $AE02 16 ; "-- OVER  TEMP --"
144   90   string $AE13 16 ; " CANNOT CAL YET "
145   91   string $AE24 25 ; "-- UNDEFINED SYSTEM ERROR"
146   92   string $AE3E 16 ; " ENTER PASSWORD "
147   93   string $AE4F 16 ; " WRONG PASSWORD "
148   94   string $AE60 21 ; "-- NO DIVIDER NOVRAM "
149   95   string $AE76 21 ; "-- NO INT CAL NOVRAM "
150   96   string $AE8C 16 ; "-- UNDER TEMP --"
151   97   string $AE9D 16 ; "--- CHANGES ----"
152   98   string $AEAE 16 ; "-- SELF  TEST --"
153   99   string $AEBF 16 ; " SERIAL NUMBER ?"
154   9A   string $AED0 16 ; " CHECK REF SYS? "
155   9B   string $AEE1 22 ; "-- INCORRECT SOFTWARE "
156   9C   string $AEF8 16 ; " REPAIR DATA ?  "
157   9D   string $AF09 16 ; "REFERENCE REPAIR"
158   9E   string $AF1A 16 ; " DIVIDER REPAIR "
159   9F   string $AF2B 16 ; "   DVM REPAIR   "
160   A0   string $AF3C 16 ; "   DAM REPAIR   "
161   A1   string $AF4D 16 ; "   KB2 REPAIR   "
162   A2   string $AF5E 16 ; "   KA2 REPAIR   "
163   A3   string $AF6F 16 ; "  KA10  REPAIR  "
164   A4   string $AF80 16 ; "  Ka100 REPAIR  "
165   A5   string $AF91 16 ; "  ZERO  REPAIR  "
166   A6   string $AFA2 16 ; "   EXR REPAIR   "
167   A7   string $AFB3 16 ; "NULLMETER REPAIR"
168   A8   string $AFC4 16 ; "----------------"
169   A9   string $AFD4 36 ; "JANFEBMARAPRMAYJUNJULAUGSEPOCTNOVDEC"

[branadic]

Branadic, did the 2720 show any message with the empty NVRAM?

No, the system shows "Hi There" on both screens, then the lower display shows the firmware version "61.61" and then beeps. That happens with the copy cat reference having an empty memory, but also if the memory content is one of the other three references.
That's why I believe that at least some content has to be present, like some serial number or the like.

-branadic-

[branadic]

I wonder if it would help to start the instrument with the key in CAL position? Will give that a try tomorrow.

4.1.12.3 “DATA REPAIR" Hidden Key
Immediately below the "LAST CAL" key there is another key which
is known as the data repair key. The use of this key is only
enabled while the key operated calibration switch is in the "CALIBRATE"
position. After pressing this key the 2720GS will prompt the
user for a password, after correct entry of this password {only
available from your nearest Valhalla Scientific service center)
the 2720GS will perform a comprehensive test and repair of all
calibration data, including the automatic internal calibration
of any lost data items which can be achieved without the use of
external equipment or connections.

Following a system check or a Reset the 2720GS will display the
status of all the references (only the not in use references following
a Reset). The list below gives the list of status messages and
their cause.

NO CALDATA - A reference which has no valid calibration data.

NOT FITTED - A reference which is not fitted. This may also
be caused by the reference having a faulty NOVRAM
which will not accept calibration data (see
Section X for details).

"NOVRAM FAULTY "
A faulty NOVRAM has been detected. Check REFERENCE MODULES, OUTPUT
SYSTEM PCB, NULLMETER PCB and EXR1/7/10 option. The status display
at the end of system check will determine which has failed. This
failure can also be caused by a failure of the Main uP IC9 or
associated circuitry.

-branadic-

[PrecisionFreak]

I just wanted to post this, but the session timed out, now it it too late ;-)

I wonder what the following messages mean:
156   9C   string $AEF8 16 ; " REPAIR DATA ?  "
157   9D   string $AF09 16 ; "REFERENCE REPAIR"
158   9E   string $AF1A 16 ; " DIVIDER REPAIR "
159   9F   string $AF2B 16 ; "   DVM REPAIR   "
160   A0   string $AF3C 16 ; "   DAM REPAIR   "
161   A1   string $AF4D 16 ; "   KB2 REPAIR   "
162   A2   string $AF5E 16 ; "   KA2 REPAIR   "
163   A3   string $AF6F 16 ; "  KA10  REPAIR  "
164   A4   string $AF80 16 ; "  Ka100 REPAIR  "
165   A5   string $AF91 16 ; "  ZERO  REPAIR  "
166   A6   string $AFA2 16 ; "   EXR REPAIR   "
167   A7   string $AFB3 16 ; "NULLMETER REPAIR"

What to do  to come into repair-mode?

By the way: Does't the 6803G have a serial interface (IC10/10, 11, 12)?
Maybe the 2-letter commands I posted aren't GPIB, but serial commands.
The two processors communicate serially via optocouplers (68A09 via IC10 ACIA 6850)

Branadic, do you still have  means to program the NOVRAMs?
We could do a binary mix-search with two NOVRAMs:
Board  NOVRAM
1                1
2                2
3               1/2 of 2  and 1/2 of 3
In the case that a serial number is in the first half of the contents, it should reject board 3. Otherwise the serial number is in the second half.
Then go on looking in a quarter of the contents   and so on.