Nat Semi SC/MP Low Cost Development System

[Realtime]

Originally Posted by Phil__G

I'm not so sure. His proposal matches what we've found so far in the software and uses what appears to be identical techniques... at the time, well before Clive, wasnt he Nat Semis only serious potential customer in the UK, maybe they lent him a prototype?

I’m reverse engineering a schematic from the PCB. It’s slow going (about half way there) but already it’s looking very close to the ETI block diagram.
Later today I’ll collate Phil‘s, Tim‘s and Circuitboy‘s comments and code mark ups into a new version for review.
The unit definitely has a problem starting up reliably. I thought it was reset related but not so sure now. It looks like a variable at +$47(P2) is not initialised after power on, and that happens to be used to control Flag1. Any views on that would be appreciated

[circuitryboy]

Originally Posted by circuitryboy

There's no way JM-K would have had access to a TELEKIT or its detailed circuit.

OK, I've studied that diagram with a 'linen-tester' on laid-flat screen and I concede that most components can be resolved
(when you know what they might be) and match to Realtime's Real Thing. (I still can't read most of the flow chart.)
So JM-K had insider info.
One thing that would be easy to check: Diagram has a 9x5 matrix (5?). Sout is shown to both DM8546s and also as one edge
of the 9 in the matrix. (Why? Keypad needs all 9.)
Does the TELEKIT have Sout on the matrix?

[circuitryboy]

[QUOTE=Realtime;1589288] It looks like a variable at +$47(P2) is not initialised after power on, and that happens to be used to control Flag1./QUOTE]
I haven't dissected the code fully, but $47 is accessed in 3 places.
At 002B there's LD +$47(P2), CAS. On first pass through $47 doesn't seem to have been initialised.
At 0068 there's a curious sequence: LDI $00, ADI $02, ST +$47(P2).
At 0098 there's: LDI $03, JMP -$30 - which lands on the ST in line above (not the ADI).

[Phil__G]

It could still be a tired eprom - the difference between a LD and a ST is one misread bit...

[Realtime]

Originally Posted by Phil__G

It could still be a tired eprom - the difference between a LD and a ST is one misread bit...

I read the EPROM 4 time and all images have the same C2 47. To get CA 47 (ST +$47(P2)) would mean erasing bit 3. Obviously that hasn't happened so C2 47 seems genuine. I have another route to check this. I can plug the TELEKIT EPROM into the LCDS processor card and inspect its contents byte-by-byte. Will try that later.

[Realtime]

Originally Posted by Realtime

To get CA 47 (ST +$47(P2)) would mean erasing bit 3. Obviously that hasn't happened so C2 47 seems genuine.

Correction: I had forgotten that the MM5204's erased state is all 00's (not all FF's) so it is possible that bit 3 has erased and changed from CA to C2 - in theory.

Originally Posted by Realtime

I have another route to check this. I can plug the TELEKIT EPROM into the LCDS processor card and inspect its contents byte-by-byte.

Did this and verified that the EPROM does contain C2 47

Here's the updated code with the latest comments merged together.

[circuitryboy]

The only other references to $47 are setting it, to x02 or x03. Right at the end before cycling back to $0001.
Looks like a Bug!
Also, there are 4 instructions at $0102. Look odd.
There is no "; to $0102" !

[circuitryboy]

Looking at TELEKIT-05:
P3 = 0x00CC is not an Interrupt Vector. The code does not contain any IEN instruction which would be necessary at the end of an Interrupt Routine.

[Phil__G]

0106   B9  65   DLD +$65(P1)

65h on from P1 is 200h - the start of RAM?

[circuitryboy]

Yes. P2 is pointed at x0201.

[Realtime]

Originally Posted by circuitryboy

Looking at TELEKIT-05:
P3 = 0x00CC is not an Interrupt Vector. The code does not contain any IEN instruction which would be necessary at the end of an Interrupt Routine.

Interrupts can also be enabled by directly setting bit 3 of the status register, but I'm inclined to agree that it's probably not a vector. I just wondered why the TTY input is connected to both SENSEA and SENSEB - could it be to generate an interrupt at the start of a TTY byte?

[Realtime]

Just catching up on some previous messages.

Originally Posted by Realtime

CL 0001 is equivalent to PC 0001, which is shown at reset on the LCDS led display, (program counter). I take CL to mean current location but haven’t found an actual definition.

I now realise that CL is actually <CR> <LF>. This would make sense as the LCDS advances the teletype to a new line on power up.

Originally Posted by circuitryboy

I've been comparing the TELEKIT and Financier keypads, matching them up with the MM5762 schematic.

Note the flexi part number. Is that the same as the one you have?

Originally Posted by ortek_service

my Introkit also has a ceramic-packaged SC/MP (although a dark grey/red/brown, rather than White) Gold-top/pins one - Did they ever make the original PMOS SC/MP in a plastic-package, that the single-rail NMOS SC/MP-II always tends to be in?

Apprently there was no plastic version of the SC/MP, only ceramic (ISP-8A/500D). The datasheet only shows the ceramic package.

Originally Posted by circuitryboy

OK, I've studied that diagram with a 'linen-tester' on laid-flat screen and I concede that most components can be resolved (when you know what they might be) and match to Realtime's Real Thing. One thing that would be easy to check: Diagram has a 9x5 matrix (5?). Sout is shown to both DM8546s and also as one edge
of the 9 in the matrix. (Why? Keypad needs all 9.) Does the TELEKIT have Sout on the matrix?

Yes it does. There are some inverters in circuit depending on which S/R SOUT is connecting to but yes, all 4 S/Rs and the keypad receive SOUT. In fact it connects to pins 1 and 5 on the keypad flexi (not sure which end is pin 1 though so that might be pins 17 and 13).

[Phil__G]

So it seems JMK either had one (maybe on an NDA) or had detailed insider knowledge... it does seem that his account of the Telekit has far more detail than could be guessed or gleaned from a US magazine advert... the manner of his writing to me sounds like he's trying to tell us... but in his position at the time, he couldnt afford to upset Nat Semi

[circuitryboy]

Some points:
> I finally realised Fig.1 has 'MM74C175' at the bottom of the matrix and the main text also '74C175'.
So the Great Man made a mistake...?
> The most legible box in Fig.2 is the end of main loop - 'DELAY 2 mS'.
The only delay in the code has C400, 8F00 at $00C8 - which gives 13 µcycles = 52µS for 1MHz clock.
> I think the 'cascade' of x00 at $013D-$0194 is just a fail-safe filler. But if it were executed then the
XPPC P3 waiting at $019B (as a safety-net?) will crash at $0002 (!).
> The business with '+$65(P1)' is odd. Looks like an 'Oops!' realisation that P2 should have been $0200
all along.

[Phil__G]

Originally Posted by Realtime

I read the EPROM 4 time and all images have the same C2 47. To get CA 47 (ST +$47(P2)) would mean erasing bit 3. Obviously that hasn't happened so C2 47 seems genuine. I have another route to check this. I can plug the TELEKIT EPROM into the LCDS processor card and inspect its contents byte-by-byte. Will try that later.

A tired eprom might well read identically every time - I have several from my Nascom & Genie days that read and CRC exactly the same data every time, but are definitely corrupted - but not massively corrupted, usually with the odd (or a few) incorrect bits, which could be what we have here... key thing is they are permanently incorrect bits, same every read.
The odd 'bad' bit could change a load to a store, a pointer to a different pointer, etc...

On the other hand, the keypad table and 7-seg table have come over perfectly. Its a puzzle.

I'm thinking that surely NS wouldnt release something with bad code, this Telekit must have been working at some stage, so the eprom at the time contained working code - which appears now it might not.
Maybe try a few bit-flips and see if it makes any more sense?

Originally Posted by Mark1960

Post #16 shows uv eprom, with no label on the glass window, though it probably spent all its life inside the calculator case.

[SiriusHardware]

I'm not following in detail, but just a reminder that an auto-indexed LD instruction of the form...

LD @1(P1)

...(or similar) is sometimes just used as a way to increment or decrement the 16-bit value held in the specified pointer, with the actual data loaded from the source just being discarded.

This can give rise to a 'why are they loading data from there when the location being loaded from has not been initialised?' query.

[Buzby123]

I can't add much to this thread, but back in the day I had a 'bit rot' problem. It was a character EPROM in a dot-matrix printer.

The printer started printing characters with dots missing, not many, but enough to diagnose it was a character EPROM problem.

I put the EPROM in my homebrew programmer, and could see some of the the missing bits, but not all the ones that I had seen in the physical printout.

I tried changing the 5v supply to values between 4.5v and 5.5v. ( You can do things like that on a homebrew ! )

The bits returned !.

Copied the EPROM to a file, and re-wrote to a new EPROM. Printer fixed !.

This might not be a solution to all 'bit rot' problems, but it worked in this case.

Cheers,

Buzby

[circuitryboy]

Is the TELEKIT reset just by connecting power?
And it doesn't always misbehave? (Odd if it's bad code - unless RAM contents survive for a short while?)

[Phil__G]

Ok heres an example.
Nothing definite, just me following up the 'tired eprom' suggestion:

; Startup sets P3 to 0x00CC so the following could be a subroutine:

00CD   06       CSA 		; test for any status change, could be Sense A/B
00CE   01       XAE		; status to E
00CF   06       CSA		; read status agin
00D0   60       XRE		; different to whats in E?
00D1   98  06   JZ LAB014	; if no change, goto LAB014   ; to $00D9
00D3   06       CSA		; there was a change. Read stat again
00D4   01       XAE		; status into E, A has previous status
00D5   07       CAS		; restore stat to previous? why, we didnt change it!
00D6   60       XRE
00D7   9C  EF   JNZ LAB013      ; to $00C8
LAB0014: etc
;

This either makes no sense, or is poor programming, or its very clever 'trick' programming - or is it an example of bit rot?
Now, a single bit error at 00D5 would turn it into:

; Startup sets P3 to 0x00CC so the following could be a subroutine:

00CD   06       CSA 		; test for any status change, could be Sense A/B
00CE   01       XAE		; status to E
00CF   06       CSA		; read status again
00D0   60       XRE		; did it change from whats in E?
00D1   98  06   JZ LAB014	; if no change, goto LAB014   ; to $00D9
00D3   06       CSA 		; there was a change. Test for another status change, could be Sense A/B
00D4   01       XAE		; status into E
00D5   06       CSA		; read status again
00D6   60       XRE		; did it change from whats in E?
00D7   9C  EF   JNZ LAB013      ; to $00C8
LAB0014: etc
;

This amended code is looking for a pulse on Sense A or Sense B.
It looks for a change, if it changed, it waits for another change.
So we continue from LAB0013 (delay and return) or LAB0014 (more processing...) depending whether sense A or B pulsed or not.
I've no idea if this is right, I'm just showing how it can make much more sense after a single-bit change


.

[Realtime]

Originally Posted by Phil__G

So it seems JMK either had one (maybe on an NDA) or had detailed insider knowledge... it does seem that his account of the Telekit has far more detail than could be guessed or gleaned from a US magazine advert... the manner of his writing to me sounds like he's trying to tell us... but in his position at the time, he couldnt afford to upset Nat Semi

Taking it one step further, perhaps JMK designed it and wanted Nat Semi to productionise it. Just a thought.