Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Topics - jerryw200

Pages: [1]
CODING AREA / Reverse Engineering a 6800 system
« on: June 29, 2018, 09:46:02 AM »
I am not sure this post is in the right section but any assistance would be appreciated.
I am trying to restore an old ZIP30 teleprinter but I do not have any technical information or schematics and I have got it working except for a final problem that I am trying to resolve. The CPU is an MC6800 and controls everything via 4 6821 PIA's.
Because I have no schematics I have decided to reverse engineer the Firmware to see where the fault lies but I have run into a problem that hopefully someone here can help with.
I have removed the ROM's (2708's) and read them and decompiled them into .asm and .lst files.
I have identified where in the address space the ROM's are and the address range of each ROM.
The problem is that while I have been writing in machine code for decades I am not very familiar with the 6800 and something odd has come up.
At the start of one of the ROM's there is a series of jmp instructions to direct the code to various handlers.
They are instruction 7E which I understand should simply load an absolute 16 bit address into the instruction pointer.
eg 7E 33 C0 should jump to 33C0
But this is not happening
I have a logic analyser attached and I am triggering on the jmp instruction address which I can see is correct but the processor jumps to a different address than that given by the 2nd and 3rd byte of the instruction.
Can anyone shed any light on this?
I did not think that 7E was an indexed address so I assume it does not use X as part of the jump calculation.

I do not think it is stuck address bits because the difference in the expected and actual addresses has too many bits different and the system is working for most functions which it would not if so many bits were stuck. Also other addresses are as expected such as the address of the actual jmp instruction.


I am in the process of restoring a datadynamics ZIP-30 teleprinter.
It had over 100 faults and was in a terrible state when I got it but it is finally getting close to being fully functional but I have a remaining problem that is proving hard to resolve.
The unit has both a paper tape punch and a reader and I have got the punch working fine but I am having a problem with the reader.
It will read single bytes at a time but when I press the read button it just drives to the next sprocket hole and stops. It seems to be waiting for a command to read the next byte but I cannot find the fault.
I have stripped the units and all the sensors work and the buffer amplifiers all work. I have traced all bit signals back to the processor PIA and they are all there except one. The sprocket channel has two sensors which read out of phase and while both signals are getting through the buffer amplifiers I can only find one of these signals at the processor board. The second phase signal goes into some logic on the interface board (which is in the punch) but because of the way the units are constructed it is very difficult to trace the signals any further.
Does anyone have any service data or schematics for a ZIP-30?
Or has anyone come across this issue.
Note that I have tried adjusting the amplifier gain pots for the two channels but this made no difference and I know the data channels are working because the single byte read is reading correct data.
Any help would be appreciated.


Pages: [1]