Debugging a 6502 based instrument (Genrad 1658 Digibridge)

[ezalys]

Hey all,

I have on my hands a Genrad 1658 Digibridge that won't start up. I turn it on and the display stays blank... or may sometimes display some random letters/numbers. The power supply voltages are in spec and show low ripple. I probe the data lines (attached first) and the IRQ line (attached second) on the MCS6502 and they both look a bit odd. I understand the 6502 has some tristate outputs... I'm just not sure what these lines should look like in a functioning unit. If normal, what's a good place to search next, and if abnormal, what could this mean and what's the best way to proceed?

[Armadillo]

The reset line ripple voltage is high ~1V peak to peak. At 2V/Div setting, it should be a straight line. So check the capacitor at this line there. Verify is it from dedicated reset ic or simple RC connection to reset pin.

Diode Mode, measure the data bus and Address bus, Red to Ground, Black to Pins and record;

a.  with all components intack
b.  with all external rams taken out [if socketed, otherwise its quite apparent in [a] reading.

[ezalys]

This is an IRQ pin and not reset. I don't see any passives on this net.

[Armadillo]

Oops, mistaken. The reset line is important in troubleshooting. Need to check it first. There are timing requirement for proper reset and power up.
I think you can 'One Shot' the Reset Line in the scope to verify.

Yes, the IRQ line is pulled up to VCC by a resistor. You should scope the VCC again. Ripple there!

[ezalys]

All address and data lines diode test open on a DMM without removing anything, and I reckon removing components won't change this. VCC looks clean. Much cleaner than the IRQ line.

[rhb]

If the 6502 is socketed, make a "free run" harness.  This is a socket which has the data lines hard wired to present a NOP to the CPU.  This results in the CPU cycling through the 16 bit address space. If you then monitor the data lines from the device you'll be able to make a memory map for the system.

You can also probe ROM address lines to see if they are getting the address signals.  And IIRC, all the other CPU lines except the clock should not change.

Thirty five years ago I used this method with a single channel 5 MHz recurrent sweep scope to identify a blown ROM in a Vic20.  One of the address lines didn't change. Starting at A15, each pin will toggle twice as fast as the previous pin.  Despite very crude gear, I was able to locate an address line which did not change and thus, prevented the system from working.  I didn't fix it because a new ROM cost 20-30% of a C64. So I bought a C64.

As this is not a Vic20, if the 6502 is not socketed, install a socket.  Or PM me and we can discuss a sale.

[Armadillo]

In the Data line picture, it shows the voltage is at 4V Peak and some pulse fluctuate lower than 4, your 5V power supply don't seems able to take the computing load pull of current. The signal mess-up like analogue!
Anyway can you carefully substitute external 5V to proof.?

[capt bullshot]

The data line looks ugly, but to me there's nothing wrong with the signal.
There are various devices on the data bus, each one outputting a slightly different high level. As long as these are "high enough" (roughly above ca. 2V ... 2.5V), the data bus works. Different technology ICs (like the MOS 6502, RAM, EPROM, 74LS bus drivers) have different output levels for "high".
IRQ line looks indeed scary, but should represent a constant "high" level to the CPU. The IC driving that line might have an open VCC or GND pin.
Check 5V supply to the chips directly at the ICs pins.
Check the reset, try a manual reset by tying the reset line to (usually) low.
Look at each address and data line for data bus contentions, or open pins. That would look different, an open pin causes some R/C decay waveform, a bus contention shows an invalid logic level ( between 0.7V and 2V).
Look for an EPROM / firmware image on the net and burn fresh EPROMS.

[rhb]

After RES goes high, the 6502 waits 6 clock cycles and then loads the address at 0xFFFC into  PCL and 0xFFFD into PCH.

To check that the RES signal is valid, put a probe on the RES and on Vcc and apply power.  RES should stay low until Vcc is stable. 

The attached page scan should prove useful.

[ezalys]

After RES goes high, the 6502 waits 6 clock cycles and then loads the address at 0xFFFC into  PCL and 0xFFFD into PCH.

To check that the RES signal is valid, put a probe on the RES and on Vcc and apply power.  RES should stay low until Vcc is stable. 

The attached page scan should prove useful.

Here’s what reset does. Looks pretty weird but it does get held low for a while before popping up. I took this photo last night while just poking around. I'll try again while also probing Vcc when I get home to make sure the reset circuit does indeed work...

But okay, if anyone out there as the ROM files for the 1658, I'd really really appreciate them! Furthermore, I haven't seen them anywhere on the internet, so if you even have a 1658 and a ROM reader, I think it'd be a great service for this instrument if these could be posted!

 

[rhb]

Have you contacted IET?

https://www.ietlabs.com/genrad_history/home

They were looking for someone to update their website.  I spoke with them about it, but decided it was not something I wanted to do.

But I got the impression it's a very engineer oriented business.

It would help if you annotated the plot to explain what we're looking at.   Is the trigger at  power on?  If so, it looks to me as if it has issues.

Is the ROM socketed so you can pull it and read it?  If not you'll need a logic analyzer and the proper clip.  I'd try reading the ROM with the CPU in free run a bunch of times and compare the files.  The problem might be something as simple as a noisy address or data line. I'd probe Vcc and Gnd on all the chips while in free run.  The problem might be the capacitor next to one of the chips.

[ezalys]

Have you contacted IET?

https://www.ietlabs.com/genrad_history/home

They were looking for someone to update their website.  I spoke with them about it, but decided it was not something I wanted to do.

But I got the impression it's a very engineer oriented business.

Yeah I have. No ROM data for this instrument. I think what I might do is hook a logic analyzer up to the bus and see if it hang out banging on a specific area of memory. I worry that it’s stuck in a loop waiting for a certain part of circuitry to respond and it never does. If I can see over what addresses it’s stuck, that may provide some insight.


Sent from my iPhone using Tapatalk

[rhb]

IRQ loads from FFFF & FFFE

RST loads from FFFC & FFFD

NMI loads from FFFA & FFFB

All are active low.

Databus is tri-state and will drive one TTL load and 130 pF

The address bus is not tri-state but also drives one TTL load and 130 pF

I have the 1984 Rockwell databook.  You can single step the CPU using the RDY line

[ezalys]

I hooked the logic analyzer to the address bus. The CPU seems in a fairly tight loop around 0xB5C_,0xB5D_,0xB5E_, periodically hitting address 0x4082. The 0xB.... addresses are in one of the ROMs. No idea what 0x4082 corresponds to though. Guess I have to trace out the address bus or something

[rhb]

Time to dump the assembly and look for a bit error in an instruction.  With a modest amount of luck, the bit error will not always be present and you can identify the correct instruction.  Otherwise you have to understand what the code is doing.

[ezalys]

https://imgur.com/a/4COPtQU - From the GPIB card

0x4082 = 0100 0000 1000 0010

This means for U1 on the GPIB card

CS2^ = A15 = 0
CS1   = A14 = 1
CS0   = A7   = 1

Seems like it's trying to address this PIA

[ezalys]

I should note there's no GPIB addon installed in this unit. I think I'll attach the logic analyzer to the data bus too and disassemble the instructions it seems to be stuck on. I really would feel better about putting more hours into this thing if I could find some ROM files for it.

[rhb]

Have you verified that all the address lines are OK?  If they are not, then you need to identify the component which has the bad address line.  If it is not one of the ROMs,  disconnect that address line from the part and dump the ROMs.

If it is one of the ROMs try dumping it multiple times and see if you get lucky and get a good read.  If an address  line is stuck low, you might try raising the voltage of that line a little with a level shifter.

In any case, you need to free run the CPU to do any of the above, or else remove the CPU and apply a logic pulser to the address lines while watching them with a scope at the ROMs.  To dump the ROMs you'll need to remove them or build a free run harness which runs the board data lines to your LA.

There are "tested working" units on eBay for under $300.  You might be able to get ROMs from the seller.  Otherwise, I might be tempted to buy a unit and copy the ROMs for you. How much would you pay for ROM images?

[ezalys]

Maybe 30 dollars once I've reached relative certainty that it's the ROM images? I'm a grad student so I don't have a ton of spare cash. I'd really insist that these ROM images be put in a public archive to prevent more of these instruments from ending up in a landfill. Otherwise I'd be putting the money towards a fix that isn't guaranteed to help myself, or others.

It's quite curious that three of the address lines stay constant in the loop that the unit is stuck in.

I'll add that none of the address lines curve-traced weird.

https://imgur.com/a/QVXS9O0

But this may of course just be coincidence. As you say, free-running the CPU and checking that the lines twiddle is a really good idea.

[rhb]

Can you post a good photo of the board?  The manual photo is not very good.  It would help a lot to know what is socketed and what's not.

Something I just thought of.  Is there any solder flux or other grime visible *anywhere* on the board?  If so, clean it off with 91% or better isopropyl alcohol and a soft brush.  Let it dry and then try it again.  I should have mentioned that earlier.  Flux is hygroscopic.  It's not as big a problem with 5 V logic, but a very serious problem with 3.3 and 1.8 V logic.  A brown spot of flux residue on the 3 address lines with one line held low by the CPU could force the other two low.  The single TTL load fanout of the 6502 makes that a very likely possibility.  I usually use a small spray bottle to apply the alcohol, but I have also put a board in a container poured alcohol on it it and gone to work with a soft toothbrush.  Just pay attention to moisture sensitive partss and make sure it is *completely* dry before applying power.  I generally dry the boards with a hair dryer.

I got a 34401A from eBay that arrived wonky.  When I opened it up there was a 1 cm area of solder flux visible.  I cleaned that off and it works perfectly.  I did the same thing a few weeks ago with a motion sensing night light from Harbor Freight that didn't work and had been chucked in my scrap bin.  I took it apart to see if I could scavenge a AAA cell holder from it.  I noticed a bit of flux residue, so I cleaned it.  It works fine now.  I've done this about 5-6 times now.  In one instance I had to do it twice, but that was because I didn't do an adequate job of cleaning it the first time as access was difficult. After cleaning the CD player worked for 3-4 months and then stopped working.  So I cleaned it again.  That was 2-3 years ago.  Never had a problem since.

If I copied the ROMS I'd post them to BAMA or similar location.

[rhb]

A couple of suggestions:

Make a 1.5 V continuity tester using a 1.5 V buzzer, AAA cell and a couple of banana jacks.  You'll need it many times as lots of the DMM continuity tests are at voltages which would damage logic circuits.  My 34401As use 7-8 V.

Buy or build a level shifter such as this:

https://www.allelectronics.com/item/llc-46/logic-level-converter-bi-directional/1.html

I put one in a small box with banana jacks for the power for the high and low levels and the signal lines.  It's ideal for raising the voltage on a particular address line by a few percent using a bench supply to overcome a slightly insensitive address line on a failing ROM. 

I bought all the stuff except the banana jacks  for both projects from All Electronics.

But the 3 adjacent address lines stuck at logic low really suggests that cleaning the board will fix it.

[Armadillo]

Maybe you are right.

But I just want to caution on this concept. Logic analyzer will always display very nice 1 and 0 depending on the logic threshold set, so a 1 could read 0 for example.

6502 is without internal Rom.

So you should write an small program onto external Rom to address and data lines to display specific patterns, so that you can easily identified stuck lines. 

I'll add that none of the address lines curve-traced weird.

https://imgur.com/a/QVXS9O0

[rhb]

Very good point.  This is why a scope is needed to check the actual address line voltage levels.  I should have been more explicit.  Thank you for calling attention to my omission.

If my hypothesis about leakage loading from flux, etc is correct, the scope will show the voltage rising, but not making it to logic 1.

[JFJ]

The duration of the reset pulse, pictured in reply #9, appears to be about 0.4ms. However, the values for the capacitor and resistors used in the reset circuit (shown in Fig 6-7 of the 1658 manual), suggests that the reset pulse should be at least 10x longer.



The manual shows the ROMs to be type 2316. The original Commodore PET used similar ROMs, which ran very hot and were prone to premature failure. A failed ROM was often replaced with a 2716 EPROM - mounted on a small circuit board with some logic gates (to decode the 3 chip select lines).

[bob91343]

I own a 1658 and love it.  Once it died, and the fix was to replace a protection diode, shorted.  I don't recall the symptom when it didn't work.  I believe a 1N4148 was what I used.

I would like to help any way I can.  However, appreciate that I don't want to risk damaging my unit.  This thing is an amazing piece of work, relying on only one resistor as a standard for all measurements.

Without a test fixture, I cobbled one up with a piece of double sided board and have wonderful 4 wire measurements of all functions.

My only complaint is the limited test frequency of either 120 Hz or 1 kHz.  I would like to measure at dc as well as a wide frequency range but honestly am really happy with it.  Also, it uses a purchased oscillator as a clock, and has no adjustment for frequency.

Mine has the legends on the plastic panel rubbed off so I printed new ones and pasted it on.