Products > Test Equipment

Some old school instruments showing how it's done (HP 3325A and Fluke 8506a)

<< < (77/91) > >>

joeqsmith:
Spent a little time looking over the controller, serial and display hardware.   After incrementing the two version numbers, the meter will show Error 8.  Controller module is fault.   I suspect I need to add a CRC or checksum to one or both ROMs.  Getting closer to a working setup.     

dietert1:
I think they implemented a timeout interrupt to detect failed backplane transactions. The typical code looks like this:

MOV H,...          backplane address (L = don*t care)
ORA A               reset carry
MVI M,#$0xFF  touch backplane address
RC                     exit on carry set by timeout interrupt
 ...                      continue with module present

I think this is used  for module detection. There are four 0-terminated lists in ROM of backplane addresses to check in a sequence. The presence of modules is saved in flag bytes, e.g. at 0x4052 (8 bits) and 0x4181 (bits 0x01 and 0x02).
One PROM check i saw was a check for 0x3800 = 0x55.
Remember this is for the 8502A version 3.0.3. Hope it helps.

Regards, DIeter

joeqsmith:

--- Quote from: dietert1 on March 01, 2021, 09:35:05 pm ---I think they implemented a timeout interrupt to detect failed backplane transactions. The typical code looks like this:

MOV H,...          backplane address (L = don*t care)
ORA A               reset carry
MVI M,#$0xFF  touch backplane address
RC                     exit on carry set by timeout interrupt
 ...                      continue with module present

I think this is used  for module detection. There are four 0-terminated lists in ROM of backplane addresses to check in a sequence. The presence of modules is saved in flag bytes, e.g. at 0x4052 (8 bits) and 0x4181 (bits 0x01 and 0x02).
One PROM check i saw was a check for 0x3800 = 0x55.
Remember this is for the 8502A version 3.0.3. Hope it helps.

Regards, DIeter

--- End quote ---
That's four different sets, all the same.  So just a simple  modulo 100 checksum for the whole thing, then split it.   

I have no idea where their original tool is storing it.  There are a few FFs at the end of the file, so I appended it as the last byte, which I know is not correct as every file I have looked at was set to FF.   Thinking it's unused area and it appears to work correctly.   

dietert1:
The code for the checksum calculation starts with instruction LXI H,#$0x0000 (unique in my disassembly). It contains the check for 0x3800 = 0x55 i mentioned to determine whether the checksum calculation runs up to 0x2FFF (fourth ROM not present) or to 0x3FFF (fourth ROM detected). The calculated checksum gets output to port 0x52, maybe for debugging purposes (one of two OUT instructions).
Yes, it doesn't matter which unused byte you make an adjustment byte.
Maybe in the end we will know which ROM byte is unused except for the checksum calculation..

Regards, Dieter

joeqsmith:
Odd they would hard code the firmware regarding the checksum in the middle of the code.    The tool used to modify the file would have to know the location so they must locate that section of code in the same place.  Maybe they had another way.  As you suggest, dump it to a debug port, mod the code, rebuild, reload and try again.  Really odd but I have seen stranger things.  I would have just expected them to have a tool that runs on the binary and appends it to the end so the routine always checks for zero.  I like simple approaches.   Can you post the section of code you are referring  to.  I'll see if I can hunt it down and make some sense of it. 

I ran several builds last night using the appended checksum and it seems to be working fine.   No ill effects from changing the last byte.   

My first attempts using brute force, trial and error, divide and concur to hunt down the section I am looking for yielded some interesting results.  I think I now know a little more about the structure of the code.  I really wish the manuals had dove into more details about the inner workings.   I had hoped to be able to located the section without the logic analyzer but it's taking too much time.   That meter is just so compact its going to take some more custom adapters to instrument it.   :-DD

Navigation

[0] Message Index

[#] Next page

[*] Previous page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod