Post Reply 
HP-71 Diagnostics
06-06-2020, 11:07 AM
Post: #1
HP-71 Diagnostics
It's raining......

I am one of three who recently got a Diagnostics Module from TAS.

I got it mid week and today I have spent some time going through my stack of 71's.

That was the last ROM-module - made by HP - missing in my little Wooden Tea-Box, I simply had to own it.

One of the interesting parts of the module is not documented well - but has been mentioned here in the past.

When SELECT TEST is flashing after startup, you have the option to pres QQ and you get into something VERY similar to the Debugger LEX for the 82478A.

Many of the functions work exactly as described in the 82478-90001 documentation.

Except:

No Direct Access - Keys 1-9
No Options Stack
No Disassembler

It has been fun to single step through the first several steps starting at #00000 and see how Registers and Return Stack changes, trying to follow.

Because it is hardcoded and hence can't be "configured", it won't work in other ports that #1. I decided to try anyway, just for fun. To no avail... - suspect that the HALT has something to do with that.

BUT

Is that it.....?

Does anyone have a suggestion - or even better, knowledge - as to why this functionality was included in the Diagnostics ROM? It seems to be pointless or at best a curio.

I have seen, but not yet tried, that the image of this ROM can be made to work in the EMU71, that would be next unless someone in this community tells me "Don't bother"

KimH
Find all posts by this user
Quote this message in a reply
06-06-2020, 01:28 PM (This post was last modified: 06-06-2020 01:31 PM by Dave Frederickson.)
Post: #2
RE: HP-71 Diagnostics
One feature of the Diag ROM and Port 1 is that they be capable of disabling the system ROM. They do this by shorting the Output Disable signal, OD, to VDD.

This is all discussed in detail in the FRAM71 Manual Chapter 11, Using the SYSRAM feature.

The Diag ROM module has the OD pin shorted to VDD and when plugged into Port 1 it disables the system ROM and allows the Diag ROM to take-over.

If you have any further questions regarding the Diag ROM I suggest you contact the seller as he was on the development team for the 71B and probably knows a thing or two more than we do.

Dave
Find all posts by this user
Quote this message in a reply
06-06-2020, 01:32 PM
Post: #3
RE: HP-71 Diagnostics
(06-06-2020 01:28 PM)Dave Frederickson Wrote:  If you have any further questions regarding the Diag ROM I suggest you contact the seller as he was on the development team for the 71B and probably knows a thing or two more than we do.

Dave

And if that produces new information, please share it here. Smile

--Bob Prosperi
Find all posts by this user
Quote this message in a reply
06-06-2020, 01:39 PM (This post was last modified: 06-06-2020 01:49 PM by Dave Frederickson.)
Post: #4
RE: HP-71 Diagnostics
(06-06-2020 01:32 PM)rprosperi Wrote:  And if that produces new information, please share it here. Smile

And if you run out of things to do during the COVID quarantine, I've always wondered if the undocumented debugger could be used to obtain a dump of the Diag ROM. So if you could step through all 16k of the ROM and compare it to the Diag ROM image I'd really appreciate it.


On second thought, never mind. Smile

Dave

EDIT:
Speaking of take-over ROM's, I suspect the Demo ROM is a take-over ROM. If you have that one in your collection can you devise a method for obtaining a dump as it seems to be missing from the archives?
Find all posts by this user
Quote this message in a reply
06-06-2020, 04:07 PM
Post: #5
RE: HP-71 Diagnostics
Thanks Dave

I have contacted the seller as i left feedback, no response yet...

Based on your suggestion I looked at the FRAM Chapter 9.. maybe there will be some inspiration, but it does look like the "Module" has to be in PORT 1...

I was almost sure that it was the OD short on pin 11, which took care of that little detail. That pin is marked HALT in all other ports, including the IL one

I have an "exploded" 71 for experiments (and to Control the World) which I could use to "cut" that OD track on the PCB for one of the ports and determine if:

1) the 71 will turn on at all - i honestly suspect it wont, there will likely not be any D-In to configure where the ROM would reside in the memory stack

2) if it does, then poke around (and share what I find here)

In the BRILLIANT 71B Compendium from Sylvain there is a link to a ROM-dump made by J-F, so one is available. Playing with that will have to wait to next time it rains Smile

The journey continues

(06-06-2020 01:28 PM)Dave Frederickson Wrote:  One feature of the Diag ROM and Port 1 is that they be capable of disabling the system ROM. They do this by shorting the Output Disable signal, OD, to VDD.

This is all discussed in detail in the FRAM71 Manual Chapter 11, Using the SYSRAM feature.

The Diag ROM module has the OD pin shorted to VDD and when plugged into Port 1 it disables the system ROM and allows the Diag ROM to take-over.

If you have any further questions regarding the Diag ROM I suggest you contact the seller as he was on the development team for the 71B and probably knows a thing or two more than we do.

Dave
Find all posts by this user
Quote this message in a reply
06-06-2020, 04:16 PM
Post: #6
RE: HP-71 Diagnostics
(06-06-2020 01:39 PM)Dave Frederickson Wrote:  Speaking of take-over ROM's, I suspect the Demo ROM is a take-over ROM. If you have that one in your collection can you devise a method for obtaining a dump as it seems to be missing from the archives?

The Demo ROM HP 5953-5622 is just a normal 16KB ROM. When I remember correctly the demo program is written in BASIC.
Visit this user's website Find all posts by this user
Quote this message in a reply
06-06-2020, 05:14 PM
Post: #7
RE: HP-71 Diagnostics
(06-06-2020 04:16 PM)Christoph Giesselink Wrote:  The Demo ROM HP 5953-5622 is just a normal 16KB ROM. When I remember correctly the demo program is written in BASIC.

Thanks, Christoph. What's the mechanism that causes the demo to autorun?
Find all posts by this user
Quote this message in a reply
06-06-2020, 06:32 PM
Post: #8
RE: HP-71 Diagnostics
(06-06-2020 05:14 PM)Dave Frederickson Wrote:  
(06-06-2020 04:16 PM)Christoph Giesselink Wrote:  The Demo ROM HP 5953-5622 is just a normal 16KB ROM. When I remember correctly the demo program is written in BASIC.

Thanks, Christoph. What's the mechanism that causes the demo to autorun?

I suspect the Short LEX-file in the module takes care of that part
Find all posts by this user
Quote this message in a reply
06-06-2020, 10:54 PM
Post: #9
RE: HP-71 Diagnostics
(06-06-2020 06:32 PM)KimH Wrote:  I suspect the Short LEX-file in the module takes care of that part

That's correct. I suspect it contains a poll handler.
Find all posts by this user
Quote this message in a reply
06-08-2020, 02:34 PM
Post: #10
RE: HP-71 Diagnostics
So it rained again... yesterday

I got a response, no good answer as to why parts of the debugger is built in, maybe this was for the HW-designers to have the functions handy in a module, rather than loading something.

I did try to cut the HALT/OD trace in port 4 which the module uses for the "Take Over" function, as expected the machine did NOT like that. The OS ROM and the Diagnostics ROM are working (read fighting) on the same addresses, which is not good for the HW

Port obviously still works for all other modules.

I copied this text from the HW-IDS - 2.2.2 Hard Configuration

A hard configured device powers-up configured to a specific address. It will not respond to an ID, CONFIGURE , or UNCONFIGUREcommand and a bus RESET will not affect its configuration. If the device has a DAISYOU , it is always driven to the same logic level as its DAISYIN.

What i DID learn is that the 1LK7 CPU can be clocked at 1MHz if the LC circuit gets the right values. I have heard that the 1LK7 was in devices after 2623A..

That's next!


(06-06-2020 04:07 PM)KimH Wrote:  Thanks Dave

I have contacted the seller as i left feedback, no response yet...

Based on your suggestion I looked at the FRAM Chapter 9.. maybe there will be some inspiration, but it does look like the "Module" has to be in PORT 1...

I was almost sure that it was the OD short on pin 11, which took care of that little detail. That pin is marked HALT in all other ports, including the IL one

I have an "exploded" 71 for experiments (and to Control the World) which I could use to "cut" that OD track on the PCB for one of the ports and determine if:

1) the 71 will turn on at all - i honestly suspect it wont, there will likely not be any D-In to configure where the ROM would reside in the memory stack

2) if it does, then poke around (and share what I find here)

In the BRILLIANT 71B Compendium from Sylvain there is a link to a ROM-dump made by J-F, so one is available. Playing with that will have to wait to next time it rains Smile

The journey continues

(06-06-2020 01:28 PM)Dave Frederickson Wrote:  One feature of the Diag ROM and Port 1 is that they be capable of disabling the system ROM. They do this by shorting the Output Disable signal, OD, to VDD.

This is all discussed in detail in the FRAM71 Manual Chapter 11, Using the SYSRAM feature.

The Diag ROM module has the OD pin shorted to VDD and when plugged into Port 1 it disables the system ROM and allows the Diag ROM to take-over.

If you have any further questions regarding the Diag ROM I suggest you contact the seller as he was on the development team for the 71B and probably knows a thing or two more than we do.

Dave
Find all posts by this user
Quote this message in a reply
06-08-2020, 03:32 PM (This post was last modified: 06-08-2020 03:37 PM by Dave Frederickson.)
Post: #11
RE: HP-71 Diagnostics
(06-08-2020 02:34 PM)KimH Wrote:  I got a response, no good answer as to why parts of the debugger is built in, maybe this was for the HW-designers to have the functions handy in a module, rather than loading something.

Despite being one of the developers, the seller only recently learned of the undocumented, QQ debugger, so don't expect any answers in that regard.

(06-06-2020 04:07 PM)KimH Wrote:  In the BRILLIANT 71B Compendium from Sylvain there is a link to a [Service] ROM-dump made by J-F, so one is available. Playing with that will have to wait to next time it rains Smile

There are two versions of the Service ROM image. The original is 64k, like the O/S ROM, so that it'll run in Emu71/DOS. The ROM itself is only 16k and both versions will run in Emu71/Win. There is another version of the Service ROM without the HP-IL or Card Reader tests - a prototype.

Here's something I've been wondering, could the QQ debugger have been used to dump the Service ROM?

Dave
Find all posts by this user
Quote this message in a reply
06-08-2020, 04:19 PM
Post: #12
RE: HP-71 Diagnostics
(06-08-2020 03:32 PM)Dave Frederickson Wrote:  There are two versions of the Service ROM image. The original is 64k, like the O/S ROM, so that it'll run in Emu71/DOS. The ROM itself is only 16k and both versions will run in Emu71/Win. There is another version of the Service ROM without the HP-IL or Card Reader tests - a prototype.

THAT's interesting !

If it exists an alternate version, you can try to check the checksum byte at the very end of the 16K ROM (address 7FFE), using the built-in debugger.
Here is what is inside the known diag rom image:
07f20 714F714000003040404F3F780412214F
07f40 704040404F720C020F7F7408001F7E31
07f60 41414E3F790909060E3141512E5F7909
07f80 1926462949494231010F71010F304040
07fa0 4F37081068170F7028102F7364180413
07fc0 63040874030161594543400000000000
07fe0 00000000000000000000000000000046


If it's a different version, I'm ready to document the method I used to extract it.

BTW, the 64k file is just the 16k diag rom padded with 0 for loading into Emu71/DOS. It will not run in Emu71/DOS but still it was interesting for me to study it (didn't go very far actually).

J-F
Visit this user's website Find all posts by this user
Quote this message in a reply
06-08-2020, 05:40 PM
Post: #13
RE: HP-71 Diagnostics
(06-08-2020 04:19 PM)J-F Garnier Wrote:  If it's a different version, I'm ready to document the method I used to extract it.

Finally! An excuse for my significant other to buy that logic analyzer with HP-IL on eBay.
Find all posts by this user
Quote this message in a reply
06-08-2020, 06:22 PM
Post: #14
RE: HP-71 Diagnostics
J-F

It is the same - i did walk through all the lines, xxx46 is the Checksum.

But, don't let that hold you back, maybe there is some insight which can be applied elsewhere Smile

/Kim

(06-08-2020 04:19 PM)J-F Garnier Wrote:  
(06-08-2020 03:32 PM)Dave Frederickson Wrote:  There are two versions of the Service ROM image. The original is 64k, like the O/S ROM, so that it'll run in Emu71/DOS. The ROM itself is only 16k and both versions will run in Emu71/Win. There is another version of the Service ROM without the HP-IL or Card Reader tests - a prototype.

THAT's interesting !

If it exists an alternate version, you can try to check the checksum byte at the very end of the 16K ROM (address 7FFE), using the built-in debugger.
Here is what is inside the known diag rom image:
07f20 714F714000003040404F3F780412214F
07f40 704040404F720C020F7F7408001F7E31
07f60 41414E3F790909060E3141512E5F7909
07f80 1926462949494231010F71010F304040
07fa0 4F37081068170F7028102F7364180413
07fc0 63040874030161594543400000000000
07fe0 00000000000000000000000000000046


If it's a different version, I'm ready to document the method I used to extract it.

BTW, the 64k file is just the 16k diag rom padded with 0 for loading into Emu71/DOS. It will not run in Emu71/DOS but still it was interesting for me to study it (didn't go very far actually).

J-F
Find all posts by this user
Quote this message in a reply
06-08-2020, 06:50 PM
Post: #15
RE: HP-71 Diagnostics
(06-08-2020 06:22 PM)KimH Wrote:  It is the same - i did walk through all the lines, xxx46 is the Checksum.

But, don't let that hold you back, maybe there is some insight which can be applied elsewhere Smile

The problem with the Diag ROM is that it is a take-over ROM, disabling the internal system ROMs. And moreover, it generates a Module Pulled interrupt as soon as it is inserted, so you can't just have a loop in asm waiting for the insertion (I tried at the time).

The trick is that interrupt is masked IF the CPU is already servicing an interrupt. And there is an easy way: pressing a key generates an interrupt, as long as the CPU is in the keyboard servicing routine, it can't be interrupted again.
The interrupt code is in ROM, but there is a hook with the code to give a chance to an application to takeover the key processing. So the solution is to install a piece of code, redirect the hook to it, and press a key. The CPU is now in our code with interrupt masked. The diag module can be inserted, it will disable the system ROM but will not take over, and our piece of code can copy the diag rom to a safe place (I used a IRAM port) where it will survive the next memory lost that will happen when the diag rom will be removed.

Here is the piece of code:
Code:

       LEX 'CATCH'
       ID #5C
       MSG 0
       POLL 0
       ENTRY CATCH
       CHAR #F
       KEY 'CTCH'
       TOKEN 1
       ENDTXT

FNRTN1 EQU #0F216


* how to use the Catch LEX:
* plug a 32k memory module and the Forth/Ass module
* FREE PORT(x): 32k memory module as IRAM at D0000
* assemble CATCH
* HP71 OFF/ON to chain the new LEX
* CTCH
* press a key (quickly), a display pattern should indicate that the HP71 is in the HOOK loop with INTR disabled
* plug the Service ROM (no MP interrupt should happen, since INTR are disabled)
* press a key, the copy should be done
* the HP71 exists in the Service ROM.
* Remove the Service ROM
* if all worked well, the IRAM is still there, and a copy of the Service ROM is in D0040-DFFFF




       NIBHEX 00
CATCH  
* some delay
* copy DiagRom to iRam at D0040
* wait for key

* install intr handler
       GOSUB IHOOK 
HOOK   
       D0=(5) #2E104  * display
       C=0 S
       C=C+1 S
       OUT=CS
H1     C=C+1 A
       DAT0=C A   * makes a pattern on the display
       A=IN
       ?A=0 B     * wait for a key press
       GOYES H1

* copy ROM
       D0=(5) #00000
       D1=(5) #D0040
       C=DAT1 W
       ?C#0 W
       GOYES CR2   if already copied, don't do it again
       C=0 A
       P= 0
       LCHEX FFC   copy ffc0 nibbles from 0-ffbf to d0040-dffff
       A=C A
CR     C=DAT0 W
       DAT1=C W
       D0=D0+ 16
       D1=D1+ 16
       A=A-1 A
       ?A#0 A
       GOYES CR
CR2
       D0=(5) #2F43C  VECTOR
       C=0 A
       DAT0=C A
* memory lost
       C=0 A
       RSTK=C
       RTI
       
IHOOK  C=RSTK
       D0=(5) #2F43C  VECTOR
       DAT0=C A

* wait for intr (key)
WFI    GOTO WFI

* return to Basic (never happens...)
       C=0 W
       GOVLNG FNRTN1
       
       END

J-F
Visit this user's website Find all posts by this user
Quote this message in a reply
06-08-2020, 07:00 PM
Post: #16
RE: HP-71 Diagnostics
(06-08-2020 06:50 PM)J-F Garnier Wrote:  The problem with the Diag ROM is that it is a take-over ROM, disabling the internal system ROMs. And moreover, it generates a Module Pulled interrupt as soon as it is inserted, so you can't just have a loop in asm waiting for the insertion (I tried at the time).

The trick is that interrupt is masked IF the CPU is already servicing an interrupt. And there is an easy way: pressing a key generates an interrupt, as long as the CPU is in the keyboard servicing routine, it can't be interrupted again.

...

So no logic analyzer?
Find all posts by this user
Quote this message in a reply
06-09-2020, 07:26 AM (This post was last modified: 06-09-2020 07:27 AM by KimH.)
Post: #17
RE: HP-71 Diagnostics
Thanks a lot J-F!

Gutsy to move modules in and out while CPU is on/active/running, but I have yet to have a HW failure in Modules or Mainframe whilst doing that, intentionally or not.

I'll clearly go for it.

Cool code, i learned a few things from it. Looking at a short working piece of code can often be the best inspiration!

/Kim


(06-08-2020 06:50 PM)J-F Garnier Wrote:  
(06-08-2020 06:22 PM)KimH Wrote:  It is the same - i did walk through all the lines, xxx46 is the Checksum.

But, don't let that hold you back, maybe there is some insight which can be applied elsewhere Smile

The problem with the Diag ROM is that it is a take-over ROM, disabling the internal system ROMs. And moreover, it generates a Module Pulled interrupt as soon as it is inserted, so you can't just have a loop in asm waiting for the insertion (I tried at the time).

The trick is that interrupt is masked IF the CPU is already servicing an interrupt. And there is an easy way: pressing a key generates an interrupt, as long as the CPU is in the keyboard servicing routine, it can't be interrupted again.
The interrupt code is in ROM, but there is a hook with the code to give a chance to an application to takeover the key processing. So the solution is to install a piece of code, redirect the hook to it, and press a key. The CPU is now in our code with interrupt masked. The diag module can be inserted, it will disable the system ROM but will not take over, and our piece of code can copy the diag rom to a safe place (I used a IRAM port) where it will survive the next memory lost that will happen when the diag rom will be removed.

Here is the piece of code:
Code:

       LEX 'CATCH'
       ID #5C
       MSG 0
       POLL 0
       ENTRY CATCH
       CHAR #F
       KEY 'CTCH'
       TOKEN 1
       ENDTXT

FNRTN1 EQU #0F216


* how to use the Catch LEX:
* plug a 32k memory module and the Forth/Ass module
* FREE PORT(x): 32k memory module as IRAM at D0000
* assemble CATCH
* HP71 OFF/ON to chain the new LEX
* CTCH
* press a key (quickly), a display pattern should indicate that the HP71 is in the HOOK loop with INTR disabled
* plug the Service ROM (no MP interrupt should happen, since INTR are disabled)
* press a key, the copy should be done
* the HP71 exists in the Service ROM.
* Remove the Service ROM
* if all worked well, the IRAM is still there, and a copy of the Service ROM is in D0040-DFFFF




       NIBHEX 00
CATCH  
* some delay
* copy DiagRom to iRam at D0040
* wait for key

* install intr handler
       GOSUB IHOOK 
HOOK   
       D0=(5) #2E104  * display
       C=0 S
       C=C+1 S
       OUT=CS
H1     C=C+1 A
       DAT0=C A   * makes a pattern on the display
       A=IN
       ?A=0 B     * wait for a key press
       GOYES H1

* copy ROM
       D0=(5) #00000
       D1=(5) #D0040
       C=DAT1 W
       ?C#0 W
       GOYES CR2   if already copied, don't do it again
       C=0 A
       P= 0
       LCHEX FFC   copy ffc0 nibbles from 0-ffbf to d0040-dffff
       A=C A
CR     C=DAT0 W
       DAT1=C W
       D0=D0+ 16
       D1=D1+ 16
       A=A-1 A
       ?A#0 A
       GOYES CR
CR2
       D0=(5) #2F43C  VECTOR
       C=0 A
       DAT0=C A
* memory lost
       C=0 A
       RSTK=C
       RTI
       
IHOOK  C=RSTK
       D0=(5) #2F43C  VECTOR
       DAT0=C A

* wait for intr (key)
WFI    GOTO WFI

* return to Basic (never happens...)
       C=0 W
       GOVLNG FNRTN1
       
       END

J-F
Find all posts by this user
Quote this message in a reply
Post Reply 




User(s) browsing this thread: 1 Guest(s)