[sigrok-dumps.git] / mcs48 / hp3478a / README

-------------------------------------------------------------------------------
Intel MCS-48 external memory access
-------------------------------------------------------------------------------

Example dump of external program memory access on an Intel 8039 (like the 8048,
part of the MCS-48 family) in an HP 3478A bench multimeter.

The 8039 has no internal ROM. The respective mcs48 PD was designed to
reconstruct a ROM dump without needing to desolder the ROM IC.

The HP3478A is special in that it needed to access 8kB of code -- the normal
MCS-48 address space is 4kB, so an extra address line was added (A12) under
software control. In other words, they have crafted their code to toggle a
pin to control A12 and thus switch memory "banks".

Details:
https://github.com/fenugrec/hp3478a_utils/blob/master/sigrok_PD/notes.txt
https://en.wikipedia.org/wiki/Intel_MCS-48
https://www.keysight.com/en/pd-3478A%3Aepsg%3Apro-pn-3478A/55-digit-dmm-with-hp-ib-interface


Logic analyzer setup
--------------------

The logic analyzer used was an Saleae Logic16 clone (at 8MHz).

  Probe       i8039
  -----------------
  0           A8
  1           A9
  2           A10
  3           A11
  4           A12
  5           ALE
  7           PSEN
  8           D0
  9           D1
  10          D2
  11          D3
  12          D4
  13          D5
  14          D6
  15          D7

A sampling rate of 8MHz was sufficient to validate transitions on ALE and PSEN.


Data
----

Example sigrok-cli invocation to dump the memory accesses:

 $ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN

The text annotations are formated as "XXXX:YY" where XXXX is the address
and YY the byte at that address.

A more useful command:

 $ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN -B mcs48 > rom_access.bin

This writes every access to a raw file, simply as 3-byte chunks [XX XX YY]
which may easily be post-processed to reconstruct the full ROM image.
Commit	Line	Data
97be9424	1	-------------------------------------------------------------------------------
	2	Intel MCS-48 external memory access
	3	-------------------------------------------------------------------------------
	4
	5	Example dump of external program memory access on an Intel 8039 (like the 8048,
	6	part of the MCS-48 family) in an HP 3478A bench multimeter.
	7
	8	The 8039 has no internal ROM. The respective mcs48 PD was designed to
	9	reconstruct a ROM dump without needing to desolder the ROM IC.
	10
	11	The HP3478A is special in that it needed to access 8kB of code -- the normal
	12	MCS-48 address space is 4kB, so an extra address line was added (A12) under
	13	software control. In other words, they have crafted their code to toggle a
	14	pin to control A12 and thus switch memory "banks".
	15
	16	Details:
	17	https://github.com/fenugrec/hp3478a_utils/blob/master/sigrok_PD/notes.txt
	18	https://en.wikipedia.org/wiki/Intel_MCS-48
	19	https://www.keysight.com/en/pd-3478A%3Aepsg%3Apro-pn-3478A/55-digit-dmm-with-hp-ib-interface
	20
	21
	22	Logic analyzer setup
	23	--------------------
	24
	25	The logic analyzer used was an Saleae Logic16 clone (at 8MHz).
	26
	27	Probe i8039
	28	-----------------
	29	0 A8
	30	1 A9
	31	2 A10
	32	3 A11
	33	4 A12
	34	5 ALE
	35	7 PSEN
	36	8 D0
	37	9 D1
	38	10 D2
	39	11 D3
	40	12 D4
	41	13 D5
	42	14 D6
	43	15 D7
	44
	45	A sampling rate of 8MHz was sufficient to validate transitions on ALE and PSEN.
	46
	47
	48	Data
	49	----
	50
	51	Example sigrok-cli invocation to dump the memory accesses:
	52
	53	$ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN
	54
	55	The text annotations are formated as "XXXX:YY" where XXXX is the address
	56	and YY the byte at that address.
	57
	58	A more useful command:
	59
	60	$ sigrok-cli -i i8039_sample.sr -P mcs48:d0=D0:d1=D1:d2=D2:d3=D3:d4=D4:d5=D5:d6=D6:d7=D7:a8=A8:a9=A9:a10=A10:a11=A11:a12=A12:ale=ALE:psen=PSEN -B mcs48 > rom_access.bin
	61
	62	This writes every access to a raw file, simply as 3-byte chunks [XX XX YY]
	63	which may easily be post-processed to reconstruct the full ROM image.