TD Systems TDL-12 QBus SCSI controller information?

[gslick]

Does anyone have any information on the TD Systems TDL-12 QBus SCSI controller? A search on the net does not turn up any detailed information. I did find some 10 year old posts from someone who was able to obtain a copy of the manual directly from TD Systems. Their home page now says "TD Systems Corporation is no longer an operating concern".

This controller appears to emulate an RLV12 controller for RL02 disk drives and has a base device address of 17774400.

There appears to be an on board configuration utility. The following text strings from a dump of the 27128 firmware EPROM appears to be from the main configuration menu:

C Configuration
D Display
E Exercise
F Format
I Initialize
L Error log
S SCSI Cmd
T Test self
W Write BSF

It is not currently known to me how this on board configuration utility can be accessed. The only connector on the controller board is the 50-pin SCSI header connector. There is no separate connector that could be for a serial port. Possibly if the magic sequence is manually poked into the controller registers a host based utility will be downloaded into the PDP-11 system memory, which can then be executed on the PDP-11 host.

 

[RSX11M+]

Looks "way cool" to me.

Could you share the ROM dump? Maybe one of us will spot some hints in it.

I've heard of this kind of thing before... hoping something will jogg my memory. From googling around I see there was a VAX application for it too.


Have you tried to boot it as an RL yet?

Just something to try.

 

[gslick]

The TDL-12 version 1.80 firmware image along with some higher resolution scans of the controller board are currently available here:

https://sites.google.com/site/glensvintagecomputerinfo/td-systems/tdl-12

I haven't peeled the label off of the CPU. My guess is that it is a Z80 and from a quick look the firmware does appear to be Z80 code.

I suppose I could just hook up a SCSI drive at ID 0 and boot RT-11 or XXDP from a different controller and try to initialize RL0 and see what happens.

-Glen

 

[RSX11M+]

Just try booting it as an RL with no drive attached. If it has any intelligence at all, it might supply a substitute BOOT block routine for first time use.

Then again, it might not. LOL

 

[PG31]

It may be similar to the SIGMA or WEBSTER disk controllers that use WOMBAT. i.e. initialize controller in ODT and then a deposit in IP register and start a specific address. Obviously the manual would help here.

 

[Al Kossow]

There appears to be an on board configuration utility.

it isn't great, but
ftp://ftp.avanthar.com/dan/viking_scsi/vikuser.txt

shows that the serial port comes out of pins on the scsi connector

PINOUTS: VIKING scsi CONNECTOR (JI) PINOUTS: ADAPTER BOARD TO SCSI DEVICE
PIN SIGNAL PIN SIGNAL PIN SIGNAL PIN SIGNAL
2 .DB(0) 1 GROUND 2 -DB(0) 1 GROUND
4 -DB(1) 3 GROUND 4 -DB(1) 3 GROUND
6 -DB(2) 5 GROUND 6 -DB(2) 5 GROUND
8 -DB(3) 7 GROUND 8 -DB(3) 7 GROUND
10 .DB(4) 9 GROUND 10 -DB(4) 9 GROUND
12 -DB(5) 11 GROUND 12 -DB(5) 11 GROUND
14 -DB(6) 13 GROUND 14 -DB(6) 13 GROUND
16 -DB(") 15 GROUND 16 -DB(7) 15 GROUND
18 -DB(P) 17 GROUND 18 -DB(P) 17 GROUND
20 CONTX(RS232) 19 GROUND 20 GROUND 19 GROUND
22 CON Rx (RS232) 21 GROUND 22 GROUND 21 GROUND
24 GROUND 23 GROUND 24 GROUND 23 GROUND
26 +5V FUSED 25 (OPEN) 26 TERMPWR 25 (OPEN)
28 FR TX (RS232) 27 GROUND 28 GROUND 27 GROUND
30 FR RX (RS232) 29 GROUND 30 GROUND 29 GROUND
32 -ATN 31 GROUND 32 -ATN 31 GROUND
34 GROUND 33 GROUND 34 GROUND 33 GROUND
36 -BSY 35 GROUND 36 -BSY 35 GROUND
38 -ACK 37 GROUND 38 -ACK 37 GROUND
40 -RST 39 GROUND 40 .RST 39 GROUND
42 -MSG 41 GROUND 42 -MSG 41 GROUND
44 -SEL 43 GROUND 44 SEL 43 GROUND
46 -CID 45 GROUND 46 C/D 45 GROUND
48 -REQ 47 GROUND 48 -REQ 47 GROUND
50 I/O 49 GROUND 50 -I/O 49 GROUND

 

[RSX11M+]

Can't wait to see how this one turns out.

A quick look at those ROM contents shows it's really a nice device. It includes IOMEGA drive compatibility and a non-volatile Error Logging facility. Doing RL emulation would be a big plus to my collection - and replace aging DSD drives. I think I might need one.

Any way you could verify those SCSI lines are brought to pins on ICs? Might be the easiest way to verify that's how to talk to it. I see no RS232 tranceivers so it seems likely it'll be a TTL level interface if any. The Z8536 is a Parallel CIO, but I guess it could be used to bit-bang a serial interface. (?) They're clearly talking to the Serial EEROM somehow.

 

[gslick]

Some progress...

I didn't try cabling up a serial port to the 50-pin connector. However I did check to see if the TDL-12 provides a boot ROM. I was using an M8189 KDF11-B which by defaults provides a boot ROM at 17773000. I installed the jumper between J10 and J15 to disable the M8189 on board boot ROM and now when I restart the system or do a 17773000G I do get the BOOT> prompt from the TDL-12.

The only strings I have been able to get the TDL-12 BOOT> prompt to accept are {DL0, DL1, DL2, DL3} {DX0, DX1, DX2, DX3} and {DY0, DY1, DY2, DY3}. Any other strings result in an immediate ? response followed by the BOOT> prompt again. The DX and DY strings immediately result in dropping to ODT, I assume that's because I don't have an RX02 controller installed. The DL strings result in an apparent hang. I would have expected that would eventually timeout without any SCSI devices attached to the controller.

In the firmware dump I do see the DMON> prompt string in addition to the BOOT> prompt string. I just haven't figured out how to get to the DMON> prompt from the BOOT> prompt. Typing V at the boot prompt results in an immediate ?.

Maybe it is time to try disassembling the firmware and seeing if I can figure out anything there.

-Glen

 

[RSX11M+]

Hmmm....

I'd pull the TDL-12 and repeat that test, just to be sure you're actually getting all that from the board.

 

[Lou - N2MIY]

Yeah, that's the boot prompt from the monitor on the older ROM revision (non-Micro 11/23+) KDF11-B. It didn't have an MSCP bootstrap, which is why you only get DL/DX/DY etc (pre-MSCP devices).

Lou

 

[gslick]

I'm sure in this case that the BOOT> prompt in this system is coming from the TDL-12. I know that the M8189 KDF11-B I am currently using has the 23-380E4 / 23-381E4 KDF11-BH firmware installed since I installed that myself just a couple of days ago. Without the jumper installed between J10 and J15 to disable the M8189 on board boot ROM I get the KDF11-BH firmware boot menu, which is completely different than the plain BOOT> prompt that I get after installing the jumper between J10 and J15 to disable the M8189 on board boot ROM.

Also, one of the two jumpers on the TDL-12 appears to disable its boot support. With that jumper removed and with the jumper installed on the M8189 to disable its on board boot ROM the system drops into the ODT prompt with neither the KDF11-BH boot menu or the TDL-12 BOOT> prompt.

-Glen

 

[RSX11M+]

Ok, excellent.

I'll look at the ROM to see if I can figure out the input it's waiting for then. Maybe someone else will have a look too.

Should I assume you've tried all the usual ^C, ^Z, ESC and other keys? Heck, just try em all!

 

[gslick]

Yep, I poked every key on the keyboard. Upper and lowercase alpha, numeric, punctuation, control characters. Anything except a D results in an immediate ? Anything after a D except an L, X, or Y results in an immediate ? Anything after DL, DX, or DY except a 0, 1, 2, or 3 results in an immediate ? The D, L, X, and Y are not case sensitive.

-Glen

 

[RSX11M+]

Later tonight, I'll look at the ROM to find the PDP-11 instructions - should give me a clue.

It may not be accessible from there though. Some other methods I can think of is a different jumper config, or try going to 17773000 +2n where n is the number of tries. Maybe it's at another entry point.

 

[gslick]

Here's the TDL-12 boot ROM as visible to the PDP-11 host:

@17773000/012700
773002/000340
773004/106400
773006/012700
773010/174400
773012/105710
773014/100376
773016/012710
773020/000400
773022/105710
773024/100376
773026/000137
773030/002000
773032/000000
773034/000000
773036/000000
773040/?
@17773000g
BOOT>

 

[RSX11M+]

Good - that will help, thanks.

 

[RSX11M+]

Please reboot again, 1773000G
When the BOOT> menu appears
HALT the processor
Use ODT to dump the contents of memory beginning at 2000
Give me about 20 or so locations please.

If you can supply a screen capture, it should tell me where the CPU was when you halted too.

Thanks.

 

[gslick]

Powered on with the Halt button depressed. Memory contents at that point were zero. After executing the boot ROM code and then pressing the Halt button again the memory at 2000 was then non-zero.

Tried a few times and it seems to consistently Halt at 002754 or 002760.

173000
@2000/000000
002002/000000
002004/000000
002006/000000
@17773000g
BOOT>
002760
@2000/012706
002002/002000
002004/010067
002006/000016
002010/012737
002012/002034
002014/000004
002016/012737
002020/000340
002022/000006
002024/000404
002026/174400
002030/000114
002032/000000
002034/000000
002036/016700
002040/177770
002042/105700
002044/001406
002046/042700
002050/177774
002052/010067
002054/177754
002056/000167
002060/000232
002062/012767
002064/000114
002066/177740
002070/005067
002072/177736
002074/012700
002076/002300
002100/004767
002102/000610
002104/004767
002106/000644
002110/020027
002112/000015
002114/001457
002116/020027
002120/000104
002122/001405
002124/012700
002126/000077
002130/004767
002132/000604
002134/000752
002136/004767
002140/000576
002142/004767
002144/000606
002146/020027
002150/000114
002152/001406
002154/020027
002156/000130
002160/001403
002162/020027
002164/000131
002166/001356
002170/010067
002172/177634
002174/004767
002176/000540
002200/004767
002202/000550
002204/020027
002206/000015
002210/001421
002212/020027
002214/000060
002216/103742
002220/020027
002222/000064
002224/103337
002226/004767
002230/000506
002232/042700
002234/177774
002236/010067
002240/177570
002242/004767
002244/000506
002246/020027
002250/000015
002252/001324
002254/012700
002256/002310
002260/004767
002262/000430
002264/026727
002266/177540
002270/000114
002272/001410
002274/000167
002276/000102
002300/005015
002302/047502
002304/052117
002306/000076
002310/005015
002312/000000
002314/016701
002316/177506
002320/005061
002322/000002
002324/005061
002326/000004
002330/005061
002332/000010
002334/012761
002336/177400
002340/000006
002342/016700
002344/177464
002346/000300
002350/052700
002352/000014
002354/010011
002356/032711
002360/100200
002362/001775
002364/100753
002366/011100
002370/042700
002372/176377
002374/000167
002376/000216
002400/000000
002402/005737
002404/177170
002406/004567
002410/000250
002412/016700
002414/177414
002416/006300
002420/006300
002422/006300
002424/006300
002426/010067
002430/177400
002432/012701
002434/177172
002436/004567
002440/000170
002442/000013
002444/111102
002446/100402
002450/000167
002452/177724
002454/012703
002456/000100
002460/032702
002462/000040
002464/001403
002466/052700
002470/000400
002472/006303
002474/005002
002476/012705
002500/000001
002502/004567
002504/000124
002506/000007
002510/010511
002512/004514
002514/012711
002516/000001
002520/004514
002522/100002
002524/000167
002526/177650
002530/004567
002532/000076
002534/000003
002536/032737
002540/004000
002542/177170
002544/001413
002546/010311
002550/004514
002552/010211
002554/004514
002556/122525
002560/060302
002562/060302
002564/022702
002566/001000
002570/001344
002572/000404
002574/006303
002576/111122
002600/004514
002602/077303
002604/005000
002606/105767
002610/177220
002612/001401
002614/005200
002616/022737
002620/000240
002622/000000
002624/001401
002626/000000
002630/005007
002632/012504
002634/050004
002636/000240
002640/010437
002642/177170
002644/010704
002646/005741
002650/032711
002652/000240
002654/001775
002656/005721
002660/000205
002662/012700
002664/000004
002666/011002
002670/010604
002672/005003
002674/010710
002676/010406
002700/005303
002702/001402
002704/005737
002706/170000
002710/010210
002712/000205
002714/010146
002716/010001
002720/112100
002722/001403
002724/004767
002726/000010
002730/000773
002732/010100
002734/012601
002736/000207
002740/105737
002742/177564
002744/100375
002746/110037
002750/177566
002752/000207
002754/105737
002756/177560
002760/100375
002762/013700
002764/177562
002766/042700
002770/177600
002772/020027
002774/000141
002776/103402
003000/042700
003002/000040
003004/000207
003006/000000
003010/000000
003012/000000
003014/000000
003016/000000
003020/000000
@

 

[RSX11M+]

Most excellent - just what I thought would happen and what I needed.

It'll probably not be tonight that I get to all this, but I can give you a brief on what's going on so far.

After RESET, the TDL-12 offers a very short BOOTSTRAP at 773000 if jumpered to do so. This is only enough to load memory at 2000o with a longer "loader", and jump to it. I expect this is the code [at 2000] that actually prompts you with BOOT> and performs the next steps. It may be the whole deal, or just another intermediary step.

Apparently all boots of this board's BOOTSTRAP use this path. I suspect that it somehow differentiates situations where it's registers are accessed from other BOOTSTRAPS [like that in the KDF11-B] and it behaves compatibly. [Possibly because it's not configured to present at 773000]

However it happens, in your instance, the T.D. Systems "Aware" code gets loaded at 2000o, and is then executed.

This is the code we need to understand. I'll give it another hour this evening, but I have an early appointment in the morning, so I'll need to quit soon.


Maybe with this knowledge you can make progress without me. I'll try to return to the fight later tomorrow if you all haven't cracked it by then.

I'll post an update when I knock-off for the night.

 

[gslick]

First time I've ever used SIMH to disassemble code. For anyone else following along, here's the initial controller ROM mini bootstrap which loads the larger bootstrap code from the controller through the controller register at 174400, and then jumps to it at 2000:

sim> exam 773000-773030
773000: 012700
773002: 000340
773004: 106400
773006: 012700
773010: 174400
773012: 105710
773014: 100376
773016: 012710
773020: 000400
773022: 105710
773024: 100376
773026: 000137
773030: 002000

sim> exam -m 773000-773030
773000: MOV #340,R0
773004: MTPS R0
773006: MOV #174400,R0
773012: TSTB (R0)
773014: BPL 173012
773016: MOV #400,(R0)
773022: TSTB (R0)
773024: BPL 173022
773026: JMP @#2000

I'll disassemble the larger bootstrap code at 2000 and see if I can make any sense of what it is doing.

-Glen