Old school 8080 EPROM disassembly - is it making sense?

[SilverSolder]

It seems all the external cards are on a 7 bit address bus, taken from A8..A14:



I guess that means only the high byte of a 16 bit address actually matters, when it comes to I/O off the controller card?  - I should have looked at the diagram before looking at the code! 

[m k]

Yes,
first line of those earlier bit masks try to explain that.
It's also incomplete addressing, only set bits are checked.
Those few new modules from new manual have first gates where few zero bits are also checked.

GPIB command processing?  - it should accept single and two character commands like R2, S3, ?, and so on

I have tried those but they have evaded, though there are stuff that are almost.
Maybe it's this not very usual hardware doing its tricks.
Maybe there are no data+data but something like address+data, or addr+addr+data.

Hugging 7-segments!

Front panel addresses, 0 = active.

Code: [Select]

d   U3    U  U
6 11 10 V 4  34
5 13 12 U 5  12
4 14 15 T 6  13
3 6  7  S 7
2 4  5  W 8
1 3  2  X 9
0       R 10
Data 0x4042 7 pairs, segment data + address, U4-10.

My Ghidra listing has two reds.
Jump to RAM is explained earlier and jumping to the middle of a cammand is also fine.

The function 0x23b7 has two entry points, first has A = 0x80 and second has A = 0.
Register B value from the beginning is not used.
Address 0x23b9+1 is XRA A, can that be a memory optimization by a historical compiler.
If so can it be recognized?

That test board is so seventies 

[m k]

It seems that there are mostly always more than one operation happening, or code has a possible addon upgrade included.
It also seems that some calls are from stack.

183a
2a '*' RST7
23 '#'
2f '/'
25 '%'

Is it accpted that above is GPIB?

[SilverSolder]

It seems that there are mostly always more than one operation happening, or code has a possible addon upgrade included.
It also seems that some calls are from stack.

183a
2a '*' RST7
23 '#'
2f '/'
25 '%'

Is it accpted that above is GPIB?

I think you are on to something!  Those are a list of GPIB commands.


'*'  - Perform a reset
'#' - Go to Local mode (lock out Remote)
'/' - Toggles between 8 and 16 bit mode, for the Duplex Parallel Interface (option 7)
'%' - Halt:  Any reading or recall value commanded (but not yet returned) can be discarded by sending the halt (%)command


Another interesting remote command is the High Speed Reading Mode.
'!'  - Enter simplified high speed reading mode where the instrument runs in a tight loop: - read the ADC and transmit the reading as a 3 byte code, as fast as it can.   (Apparently, 500 readings per second is possible in this mode - the instrument literally only does I/O...  it could be interesting to find the code that does it, since it is likely to be as simple and fast as possible!).

[Roman oh]

I actually found a  MIS-7191K test controller card... 

Wow! How does one "actually find" a hen's tooth? Dumpster Dive? Old bloke next door used to work for Fluke and had a yard sale? Or just been sitting in my shed for years and can't remember where it came from?

I suspect that this is of most use in debugging the instrument hardware - ie, force a particular state (IC0-IC6) onto a peripheral card, and examine the response, rather than track the CPU execution itself. But still a cool thing to have.

[SilverSolder]

I actually found a  MIS-7191K test controller card... 

Wow! How does one "actually find" a hen's tooth?

You can find all kinds of weird stuff on eBay! 

[...]
I suspect that this is of most use in debugging the instrument hardware - ie, force a particular state (IC0-IC6) onto a peripheral card, and examine the response, rather than track the CPU execution itself. But still a cool thing to have.

There are four test modules mentioned in the manual:

Extender Card         Fluke Model MIS-7011K
Bus Monitor           Fluke Model MIS-7013K
Static Controller     Fluke Model MIS-7190K
Test Module           Fluke Model MIS-7191K

"Test Module" is wonderfully vague!  -  I would have thought the "Static Controller" is the one to exercise the non-controller hardware, and the "Test Module" can perhaps pretend to be any of the other modules, letting you manually control the communication with the controller?  -  will need to play around with it some more!

[SilverSolder]

Is there a way to single step the 8080 in the actual device, by adding some (hopefully minimal) amount of hardware?

[SilverSolder]

Annotated IEEE-488 piggyback board schematic attached.

[m k]

What kind of messages are displayed?
I know the normal one, greetings text and partial modules found text, starting with C.

What kind ofs are error messages?
Is text "Error" displayes and so on.

Somewhere is said that '?' is displayed, what it look like?

When is sign in front of exponent displayed, is it with exponent only?

What device specific messages are outputted?
I know the one with "8505  :[modules]" but are there others.

[SilverSolder]

What kind of messages are displayed?
I know the normal one, greetings text and partial modules found text, starting with C.

What kind ofs are error messages?
Is text "Error" displayes and so on.

Somewhere is said that '?' is displayed, what it look like?

When is sign in front of exponent displayed, is it with exponent only?

What device specific messages are outputted?
I know the one with "8505  :[modules]" but are there others.

There are actually very few textual messages.  I have edited the manual's explanations so they are easier to understand if you don't have the hardware:


1) There is the "HI-5.0.6" version number at start, that goes away after a short time.  (around one second, maybe less)




2) Then there is the installed module scan.  If a module is missing, its corresponding number will be replaced by a space in the array of presumably hex digits.  This also remains displayed for about one second.





3) Then there are some "momentary error messages" that are recoverable without a reset:

Error 0 
Attempt to set zero in wrong function (not V DC or OHMS) or an overrange has been entered.

Error 1
"Store" function attempted during overload condition. Change to higher range or (if storing cal correction factors) use lower value source.

Error 6
Display overflow. Check offset and scaling values.

Error 7
External Reference - voltage on one input exceeds 20V dc.

Error 8
Controller module is faulty. Replace controller module.

Error b
Illegal push button sequence in Calibration mode.

Error C
Invalid push-button sequence, or illegal value entered.

Error d
Calibration Memory faulty or not installed. Occurs when storing into, or recalling from, Calibration Memory, or at power-up.  Replace or install Calibration Memory chip.

Error F
Cal Memory check-sum problem.  Restart the meter. If necessary, reprogram Cal Memory. Replacement of Calibration Memory may be required.

Error H
Ohms connection problem. Verify that all connections are proper. Check input fuses. Check input lead polarity in four terminal connections.




4) Finally there are the "latching error messages" that are unrecoverable, the meter has to be powered down:


Error
(No error ID) System error, usually appears at power-up or reset. Repeat power-up or reset.

Error 2
Filter module faulty or not installed.

Error 3
DC Signal Conditioner module faulty or not installed.

Error 4
OHMS, A DC, or A AC error.  Applicable module may be faulty or not installed. Check for bad input level.

Error 5
Analog to Digital Converter Module error.

Error 9
Function selection error. The function module selected is faulty or not installed. V DC problem causes Error 3.

Error E
More than one type of ac converter, or the wrong type of ac converter for the instrument, is installed. Also appears when a Calibration Memory module from an 8502A is installed (it should not be installed in 8505A 0r 8506A which have calibration EPROM in the controller itself)

[Roman oh]

Is there a way to single step the 8080 in the actual device, by adding some (hopefully minimal) amount of hardware?

You presumably saw my post in the other thread, about simulation of the software. Single stepping? There lies madness
The thing executes in excess of 100K instructions (lots of loops, of course) just in the first few throes of initialisation!

[SilverSolder]

Is there a way to single step the 8080 in the actual device, by adding some (hopefully minimal) amount of hardware?

You presumably saw my post in the other thread, about simulation of the software. Single stepping? There lies madness
The thing executes in excess of 100K instructions (lots of loops, of course) just in the first few throes of initialisation!

One could look for a certain combination of address and data, and halt on that?  Just an Arduino that sits and sniffs the bus could probably keep up with most of what an 8080 is trying to do?

I'm just not sure if an 8080 can be stopped, once it gets going! 

[m k]

Is the machine asking "YES?"  anytime?

Is it telling "Err. on" any other time?

[SilverSolder]

Is the machine asking "YES?"  anytime?

Is it telling "Err. on" any other time?

Yes, it does ask when entering some parameters after pushing some of the controls on the front -  it can say a few other very short things.

For example, to display the High PEAK value in PEAK mode, you press a sequence of buttons as follows:


BUTTON          DISPLAY
<RECALL>          "?"  (including the quotes! using a 7 segment display, it does look a little crude)
<HI>              YES?
<PEAK>           (displays the actual value)

[m k]

I think I've now got mostly all possible texts.
Am I missing something?

1234567890bCdEFAHL-
HI-5.0.6
HI-6.0.7
r100
r300
r  1
r  3
r 10
r 30
r100
r500
Err. on
Err. oF
Error
CLEAr?
YES?
PASS
"?"
HI
LO

I've also made a disassembler and ignoring memory orientation seems to give more reasonable listing.
Means that code is listed when it is accessed.
It has few bugs though,  one is legendary, it can save but load is garbage.

[SilverSolder]

I think I've now got mostly all possible texts.
Am I missing something?

1234567890bCdEFAHL-
HI-5.0.6
HI-6.0.7
r100
r300
r  1
r  3
r 10
r 30
r100
r500
Err. on
Err. oF
Error
CLEAr?
YES?
PASS
"?"
HI
LO

I've also made a disassembler and ignoring memory orientation seems to give more reasonable listing.
Means that code is listed when it is accessed.
It has few bugs though,  one is legendary, it can save but load is garbage.

That is pretty cool -  looks like resistance is futile! 

I guess 8080 disassemblers don't grow on trees these days?



1234567890bCdEFAHL-   List of valid alphanumerics, maybe array indexed? maybe for errors and to identify options on boot
HI-5.0.6              Version number for 8505a
HI-6.0.7              Version number for 8506a
r100                  100mVAC range (-3 in exponent display) (8506a only)
r300                  300mVAC range (-3 in exponent display) (8506a only)
r  1                  1VAC range (8506a only)
r  3                  3VAC range (8506a only)
r 10                  10VAC range (8506a only)
r 30                  30VAC range (8506a only)
r100                  100VAC range (8506a only)
r500                  500VAC range (8506a only)
Err. on               Latching errors enabled (during calibration)
Err. oF               (should have 2Fs?) Latching errors disabled (during calibration)
Error                 Can occur by itself but usually followed by an alphanumeric
CLEAr?                Displayed when confirming clearing of stored cal constants (during calibration)
YES?                  Used when recalling HI or LO peak
PASS                  In LIMITS mode, display indicates HI, LO, PASS instead of a numeric value
"?"                   Prompt whenever STORE or RECALL button is pressed on panel.  (Asking e.g. "Store what?")
HI                    Used with LIMITS mode, and PEAK mode
LO                    Used with LIMITS mode, and PEAK mode

[m k]

Many Z80 thingies can do 8080 or 8085 stuff, emulating also, but finally something is always missing.

Since 7-segmant is a bit slow to check I did a viewer.
(Win32)
It's also quite good for repetitions.

It only reads first 65k but can be extended if needed.

[SilverSolder]

Many Z80 thingies can do 8080 or 8085 stuff, emulating also, but finally something is always missing.

Since 7-segmant is a bit slow to check I did a viewer.
(Win32)
It's also quite good for repetitions.

It only reads first 65k but can be extended if needed.

That is super nifty tool!  What address did you find the display strings at?

[m k]

From 506_607.bin

3c9a 1234567890bCdEFAHL-
3eec HI-5.0.6
3ef6 HI-6.0.7
3f46 r100
3f4c r300
3f52 r  1
3f58 r  3
3f5e r 10
3f64 r 30
3f6a r100
3f70 r500
304f Err. on
3df8 Err. oF
3bd1 Error
3cf9 CLEAr?
3ad0 YES?
3b00 PASS
3bd8 "?"
3b06 HI
3b0c LO

[m k]

I already started seeing those 7-segments directly from hex.

New viewer version, minor changes.
Now upper right follows upper left checks.

No idea how that 4-segment(?) part is coded.
Educated guess says that 0x80 is a like with 7-segment.

Texts are clearly 6 wide.
Maybe it would be better to start from earlier model.

8500A seems to be 5,5 digits.
What is the first wider one, 8502A?

[SilverSolder]

8505A is 6.5 digs (has a 7.5dig averaging mode)
8506A is the same

[dietert1]

Finally i noticed that backplane address lines IC0..IC6 are inverted from the 8080A address bus. Backplane addressing in the disassembly looks like
..
MVI   H,0E5H ;backplane address
MOV M,A        ;write A to hardware register
..
This operates the active filter module at backplane address 1A. Another example: After power-on front panel operations are in the sequence of  six writes at 23, 22, 21,23, 22, 21 and finally a read at 43. In the firmware those adresses are coded as DC, DD, DE and BC. Now it makes a little more sense.

Regards, Dieter

[SilverSolder]

Finally i noticed that backplane address lines IC0..IC6 are inverted from the 8080A address bus. Backplane addressing in the disassembly looks like
..
MVI   H,0E5H ;backplane address
MOV M,A        ;write A to hardware register
..
This operates the active filter module at backplane address 1A. Another example: After power-on front panel operations are in the sequence of  six writes at 23, 22, 21,23, 22, 21 and finally a read at 43. In the firmware those adresses are coded as DC, DD, DE and BC. Now it makes a little more sense.

Regards, Dieter

That was a good catch!  The outlines of a programming model is beginning to emerge from the fog!

[m k]

Since hex coding, even 8080, is a pain I did a simple assembler inside the emulator.
Then when testing it I lost some time again.

The test code was from "Radio Shack" manual page 178.
I didn't realise my Adobe Reader DC does OCR trace on the fly by default.
(few characters didn't match)

Emulator generally is not totally insane.
At least it put "Error" to display memory area, no wonder, without a HW map.
A bit different what an old Z80 emulator did, maybe there are some nuances, like always so no AC flag.

[SilverSolder]

Since hex coding, even 8080, is a pain I did a simple assembler inside the emulator.
Then when testing it I lost some time again.

The test code was from "Radio Shack" manual page 178.
I didn't realise my Adobe Reader DC does OCR trace on the fly by default.
(few characters didn't match)

Emulator generally is not totally insane.
At least it put "Error" to display memory area, no wonder, without a HW map.
A bit different what an old Z80 emulator did, maybe there are some nuances, like always so no AC flag.

That sounds pretty amazing!  -  The code scans the installed option cards on boot, the controller might give up if basic parts are missing, like the A/D converter?