]>
Commit | Line | Data |
---|---|---|
97be9424 | 1 | ------------------------------------------------------------------------------- |
2 | Intel MCS-48 external memory access | |
3 | ------------------------------------------------------------------------------- | |
4 | ||
5 | Example dump of external program memory access on an Intel 8039 (like the 8048, | |
6 | part of the MCS-48 family) in an HP 3478A bench multimeter. | |
7 | ||
8 | The 8039 has no internal ROM. The respective mcs48 PD was designed to | |
9 | reconstruct a ROM dump without needing to desolder the ROM IC. | |
10 | ||
11 | The HP3478A is special in that it needed to access 8kB of code -- the normal | |
12 | MCS-48 address space is 4kB, so an extra address line was added (A12) under | |
13 | software control. In other words, they have crafted their code to toggle a | |
14 | pin to control A12 and thus switch memory "banks". | |
15 | ||
16 | Details: | |
17 | https://github.com/fenugrec/hp3478a_utils/blob/master/sigrok_PD/notes.txt | |
18 | https://en.wikipedia.org/wiki/Intel_MCS-48 | |
19 | https://www.keysight.com/en/pd-3478A%3Aepsg%3Apro-pn-3478A/55-digit-dmm-with-hp-ib-interface | |
20 | ||
21 | ||
22 | Logic analyzer setup | |
23 | -------------------- | |
24 | ||
25 | The logic analyzer used was an Saleae Logic16 clone (at 8MHz). | |
26 | ||
27 | Probe i8039 | |
28 | ----------------- | |
29 | 0 A8 | |
30 | 1 A9 | |
31 | 2 A10 | |
32 | 3 A11 | |
33 | 4 A12 | |
34 | 5 ALE | |
35 | 7 PSEN | |
36 | 8 D0 | |
37 | 9 D1 | |
38 | 10 D2 | |
39 | 11 D3 | |
40 | 12 D4 | |
41 | 13 D5 | |
42 | 14 D6 | |
43 | 15 D7 | |
44 | ||
45 | A sampling rate of 8MHz was sufficient to validate transitions on ALE and PSEN. | |
46 | ||
47 | ||
48 | Data | |
49 | ---- | |
50 | ||
51 | Example sigrok-cli invocation to dump the memory accesses: | |
52 | ||
53 | $ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN | |
54 | ||
55 | The text annotations are formated as "XXXX:YY" where XXXX is the address | |
56 | and YY the byte at that address. | |
57 | ||
58 | A more useful command: | |
59 | ||
60 | $ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN -B mcs48 > rom_access.bin | |
61 | ||
62 | This writes every access to a raw file, simply as 3-byte chunks [XX XX YY] | |
63 | which may easily be post-processed to reconstruct the full ROM image. |