• Please review our updated Terms and Rules here

TD Systems TDL-12 QBus SCSI controller information?

Yeah, at 2760 it's in a subroutine, so where it returns to isn't easy without knowing the stack contents.

A disassembly beginning at 2000 will save me having to do it from memory, though it is fun.




BTW - I like to represent that code like this:


Code:
773000: 012700  MOV #340,R0
773002: 000340
773004: 106400  MTPS R0
773006: 012700  MOV #174400,R0
773010: 174400  
773012: 105710  TSTB (R0)
773014: 100376  BPL 173012
773016: 012710  MOV #400,(R0)
773020: 000400
773022: 105710  TSTB (R0)
773024: 100376  BPL 173022
773026: 000137  JMP @#2000
773030: 002000

Let's folks see how it really works from a "word by word" perspective.

I'm out for the evening - sorry.
 
Ok, not surprising that it Halts at either 2754 or 2760. That looks like the loop that waits until a new character is ready at the console RCSR 177560 and reads it from the RBUF 177562. Then I think it does a conditional lower to uppercase conversion and returns the character. Now to look at the code that processes that character...

2754: TSTB @#177560
2760: BPL 2754
2762: MOV @#177562,R0
2766: BIC #177600,R0
2772: CMP R0,#141
2776: BCS 3004
3000: BIC #40,R0
3004: RTS PC
 
Just a quickie... did you see this?
3.3.2 Running DMON from the Bootstrap
The Diagnostic Monitor (DMON) may also be started from bootstrap.
Simply type 'V<CR>' in response to the bootstrap prompt, then another
<CR> to get the DMON prompt.

Never mind - I see now that you did.

Shoulda quit while I was ahead.
 
Last edited:
It looks like the bootstrap code that is copied into the PDP-11 host memory at 2000-3004 by the 773000 mini bootstrap resides in the firmware EPROM at 0x3999-0x3B9E. That is the only occurrence in the firmware EPROM of the string "BOOT>". From a quick look at that code in the PDP-11 host memory it looks like it is hard coded to only accept D{L,X,Y}{0,1,2,3} or shorter defaults of those strings.

There is only one occurrence in the firmware EPROM of the string "DMON>" at 0x12B1. I wonder if that is in the middle of code that is also actually PDP-11 host code and if there is an alternate mini bootstrap sequence that will load the "DMON>" code into the PDP-11 host memory instead of the "BOOT>" code.
 
Just stopped by on my way out this morning.

Ok then - The simplest thing to try next would be to test all 4 position combinations of links "A" and "B" on the board.

Code:
IN---IN = BOOT>
IN--OUT = ?
OUT--IN = ??
OUT-OUT = Probably Bootstrap disabled

One of them may select the code to be loaded somehow.

I'll try disassembling it myself if you haven't posted one by the time I return.


Are we having fun yet?

I am.
 
Some progress has been made in disassembling the TDL-12 Version 1.80 Z80 firmware. There appears to be a routine at 0x24BD which will output the NULL terminated string embedded in the calling code immediately following the CALL 0x24BD instruction. That appears to be how the main configuration menu and the DMON> prompt are output. There also possibly appears to be a routine at 0x23BA which will input characters. The routine at 0x23BA is called after the routine at 0x24BD is called to output the DMON> prompt. Following that is logic to dispatch to the main configuration menu routines based on the character which was input. This main configuration menu code begins around 0x1223 in the firmware. So it appears that the configuration interface is driven by code running on the controller Z80 and not on the host PDP-11. I'll have to look at the firmware code further and see if it can be determined how these character input and output routines work.

I have updated the page here with the work in progress of the TDL-12 Version 1.80 Z80 firmware disassembly:
https://sites.google.com/site/glensvintagecomputerinfo/td-systems/tdl-12
 
...So, either the Z80 interfaces to the user via another path [e.g. serial port on SCSI pins] or there is some manner by which this prompt can be sent to the PDP-11 Console serial port...

Is that what I'm hearing?

Sounds plausible.

I've completely disassembled the code at 2000o and will begin analyzing tomorrow. Should go quickly as most of it is reworked blocks of familiar boot code. I know you did this too, but there's not much for me to contribute but to double check.

I am also exchanging emails with someone who may be able to help us. Keep your fingers crossed. - more on this later.

On a hunch, I also dug out my peripherals manual and am looking at the standard RL controller register definitions to gain insights on how the boot code at 1773000o stimulated the loader to be DMA'd to 2000o. May lead to another piece of loadable code.
 
On a hunch, I also dug out my peripherals manual and am looking at the standard RL controller register definitions to gain insights on how the boot code at 1773000o stimulated the loader to be DMA'd to 2000o. May lead to another piece of loadable code.

The mini bootstrap code writes 400 octal to the Control/Status Register at 774400. That sets the Function Code bits F0-F2 to 0, which is the Maintenance Mode command according to the EK-RLV12-UG-002_Mar82.pdf manual. That is not too surprising that that command was chosen as the trigger for this controller to DMA the bootstrap code from the controller firmware into the PDP-11 host memory.

The single bit that is set is for the DS0 Drive Select. I tried all four Drive Select combinations with the Maintenance Mode command and only that one had any obvious effect on the PDP-11 host memory.

It might be time to see if actually is a serial interface on the 50-pin connector. One thing that was not clear to me is that those document files for the other versions of the controller listed CON TX and CON RX, and FR TX and FR RX signals on the 50-pin connector. I'm not sure what the difference would be between the CON and the FR signals, and which ones should be used. I guess I could just try hooking up a serial connection to one pair and if that doesn't work try the other.
 
Mystery solved!

The mini bootstrap at 1773000o writes 400o to the controller CSR at 774400o. If I boot with the Halt button in to disable executing the mini bootstrap, then manually write 1000o instead of 400o to the controller CSR at 774400o an alternate set of PDP-11 host code is DMA'd into host memory at 1000o instead of 2000o. If I then begin execution at 1000o the alternate set of PDP-11 host code begins commuicating with the DMON> configuration utility running on the controller. Now that I know how to get to the DMON> configuration utility I haven't actually experimented with it yet.

Code:
173000
@1000/000000 
001002/000000 
001004/000000 
001006/000000 
@17774400/000201 1000
@1000/000402 
001002/000015 
001004/000000 
001006/106427 
001010/000340 
001012/012706 
001014/001000 
001016/005000 
001020/005001 
001022/004767 
001024/000140 
001026/004767 
001030/000110 
001032/022701 
001034/000023 
001036/001006 
001040/005001 
001042/004767 
001044/000074 
001046/005701 
001050/001774 
001052/005001 
001054/004767 
001056/000040 
001060/004767 
001062/000010 
001064/022700 
001066/000003 
001070/001354 
001072/000000 
001074/005700 
001076/001007 
001100/005767 
001102/177676 
001104/001404 
001106/116700 
001110/177670 
001112/005067 
001114/177664 
001116/000207 
001120/005701 
001122/001406 
001124/005767 
001126/177654 
001130/001003 
001132/010167 
001134/177646 
001136/005001 
001140/000207 
001142/005701 
001144/001007 
001146/105767 
001150/176406 
001152/100004 
001154/116701 
001156/176402 
001160/042701 
001162/177600 
001164/000207 
001166/005700 
001170/001406 
001172/105767 
001174/176366 
001176/100003 
001200/110067 
001202/176362 
001204/005000 
001206/000207 
001210/000000 
001212/000000 
001214/000000 
001216/000000 
@1000g
TDL12 1.80 (C) 1987 TD Systems
 C  Configuration
 D  Display
 E  Exercise
 F  Format
 I  Initialize
 L  Error log
 S  SCSI Cmd
 T  Test self
 W  Write BSF

DMON>C
Configuration
DLn = Type  Cntrl  Drive  Off
 0    RL02    0      0     0
 1     ??
 2    RL02    1      0     0
 3     ??
Autoboot off

DMON>D
Display parameters:
 Controller= 0
 Drive= 0
 Controller type= 0
 Sector size (1,2)= 2
 Sectors/track (D)= 0
 Interleave (D)= 1

DMON>D
Display parameters:
 Controller= 0
 Drive= 1
 ? No parameters entered

DMON>D
Display parameters:
 Controller= 1
 Drive= 0
 Controller type= 0
 Sector size (1,2)= 2
 Sectors/track (D)= 0
 Interleave (D)= 1

DMON>L
Display error log
 No entries
 
As luck would have it, my attempts to make contact with folks at the original manufacturer have also borne fruit and resulted in a manual. [better late than never] I am hopeful of even more, so please "stay tuned".

In any case - He confirms our work so far.

Glen - Look for a PM from me.
 
Back
Top