• Please review our updated Terms and Rules here

Homebrew Z80 No. 3

Also note, if the EPROM is truly broken (as the dumps appear to show), you have little hope of getting anything to light up (without replacing the EPROM with a complete image).
 
An interesting clue, or at least piece of data. The EPROM has a label on it "MLF". Inside the keypad, there is a socketed (PROM?) part that is also labeled "MLF". This might simply be the initials of the person that built it, but it also might be clue as to the designation/origin of the machine design. Since half the EPROM contents is gone, we are only 50% certain there are (were) no manufacturer/author strings in it.
 
Thanks for your thoughts! I did get some better pics of the mainboard. They are here.

So my suspicion about the EPROM socket on the far left being the place the EPROM originally was is likely correct. The second socket from the left is full of dust, indicating nothing was installed there for a while.

The HP LED device is an HDSP-2111. Looks like it was manufactured in 1987. And no I wouldn't expect it does anything without the EPROM. I did, just for fun, hook it up to power, which I deduced were those loose wires at bottom left. Just the 5v. I got a flash out of it briefly on power down, and I can see clock and memory and everything working via probe.. but yeah bad code = no chance. Hopefully the MLF provides a useful hint.
 
Last edited:
One other question.. the EPROM this computer has, has a gold strap that runs from the EPROM window and looks like it connected to a gold leaf in the middle of the chip. Does that have any impact on performance of the chip? I assume no.. I've seen other chips where this link is broken. I assume it's some sort of ground.
 

Attachments

  • Screenshot_20221128-225938_Facebook.jpg
    Screenshot_20221128-225938_Facebook.jpg
    215.5 KB · Views: 13
Re: gold strap. Those were common on ceramic parts. I'm fairly certain it is non-functional outside of the manufacturing/testing phases, but I don't know why it exists.

Thanks for the photos, that gives me a lot to look at. Already, I can see that the pair of telephone cables was for RS-232. Will be helpful to know where/how the keypad attaches (or maybe it is not related, but the seller tossed it into the kit by accident?).

That display is interesting, and I see that even DigiKey still stocks them... at $55 each. I wonder if they were expensive back in 1987 - and what that tells us about the origins of the board (i.e. how many hobbyists would have sprung for an expensive display like that - whereas a company would have used that for a prototype without hesitation).
 
It's also possible that a display like that could have been acquired via surplus. I found some old radar detector with an alphanumeric LED display that was still available at like $30 or so. (Someday I'll come across it again when I'm ready to tinker with the display.) Those prices are probably "last of a discontinued part" prices.
 
I feel pretty confident the keypad and computer go together. But I think the keypad was used before the computer came along with something else. I'd power it up but without the computer being functional it's pointless.
 
I feel pretty confident the keypad and computer go together. But I think the keypad was used before the computer came along with something else. I'd power it up but without the computer being functional it's pointless.
Sure. It would be good to find out if the keypad uses RS-232 to communicate or something else. I haven't seen a photo of the connections. The computer RS-232 cables seem to terminate at a telephone modular plug and a telephone junction block (or maybe just a female modular housing). Knowing this helps with interpreting the ROM code.
 
I can take more detailed pictures of the inside of the keypad box if it helps. I had originally suspected the phone cable wiring going into the keypad box connected to the power supply and that the power supply in the keypad box powered the computer. Wasn't an unreasonable guess I figure as there were four wires and for a serial based computer for power you'd usually have GND, +5v, +12v and -12v. But I tested those with DMM and three wires did not connect to anything power wise. The loose wires do. I'm assuming it's probably +5v, +12v, and -12v but not one hundred percent sure where the +12v would be used on the board, so afraid to plug in.

As I traced it out the phone wires going into the box terminate on the little PCB in there, so I'm thinking you're correct and the keypad interfaces with that box. I think the suggestion that it might be an autodialer or phreaking tool kinda makes some sense. Maybe the 50 pin connector on the mainboard went to a printer or something, Wargames style?
 
Discovering more about the system, but 2-D photos aren't really working well. Need to be able to examine it in 3-D.

The four loose wires are for power, where black is ground, red is +5V, brown is -12V and blue is +12V. The unlabeled push button next to RESET is for NMI. The four toggle switches are connected to the A/B modem control inputs on the SIO - looks like a "cheap" way to implement configuration switches. I must not be able to properly trace the wires for the SIO/RS-232 port, as they don't make sense. But, the twin-telephone-cables are definitely RS-232 for the SIO.

It appears that the display device operates at I/O ports 0x80-0xbf, however I see no code in the ROM that accesses this port range (not surprising, since half is missing).

I'm having trouble tracing the I/O decoder lines for the PIOs, SIO, and CTC. Maybe you can trace where the 74LS139 pins 9, 10, 11, and 12 go. They should be going to the Z80-CTC pin 16, PIOs pin 4, and SIO pin 33. Also, I can't tell how the address lines are connected to the PIOs, SIO, and CTC. A0 and A1 should be connected, in some order, to PIOs pins 5,6; SIO pins 32,34; and CTC pins 18,19.

I did confirm that the left-most ROM socket is for address 0000. Interesting, the CPU leaves A13, A14, A15 unconnected. Clearly, it was never intended to use more than 8K of ROM/RAM.

The two empty 14-pin sockets in the upper right are some sort of I/O expansion, it would seem. They provide buffered access to A0-A7 and D0-D7. I can't tell what control signals are presented there.

The system seems to operate at 2.5MHz.

The 50pin IDC connector is definitely connected to the PIOs, but it seems like more of a GPIO than parallel printer port. It even could be for a EPROM programmer, but that's just a guess.
 
I have started a github project to track the reverse-engineering effort. https://github.com/durgadas311/homebrew3

Specifically, there is an (incomplete) schematic at https://github.com/durgadas311/homebrew3/blob/master/kicad/homebrew3.pdf and the companion layout drawing and BOM at https://github.com/durgadas311/homebrew3/blob/master/kicad/perfboard-layout.pdf

I was able to make some guesses as to the I/O decoding, although confirmation would be good - especially for the CTC. I found parts of the code that uses the PIOs, and it does seem to be some custom (non-standard at least) interface using three 8-bit output data ports and one control port, of which two lines are used to strobe different types of data to the remote device. This could be something like an EPROM programmer, as the number of data bits adds up (16-bit addr + 8-bit data).

The code also seems to be using both channels of the SIO together, or at least simultaneously. Perhaps it is some "tandem" consoles sort of thing, where one could enter things by either an ASR-33 or something else (the keypad?). That's not entirely clear yet.
 
I will trace these out tonight. Thanks so much for doing this... love seeing the detective work happening! I've shown it off in a video in my youtube channel and about 90% of comments think it's something phone related.
 
I really was disappointed the other day to find that A8 was bad. The code is a bit less of a mess to disassemble after zeroing out those blocks. I see one spot in the code where it is trying to convert from hexadecimal, so it definitely wasn't just using the keypad.

Anyhow one thing I thought of for its purpose is that the keypad being on that long of a wire could mean it might have been outside a door or around the corner as an access device. Then it would control something on that 50-pin header. The other serial port would connect to a terminal, maybe for debugging. That would mean this wasn't just some toy to program for fun, it was actually being used for something!

The display flash was probably a power-on glitch that the display itself quickly cleared on reset.

And those two empty sockets in the corner still bother me. Being a wire-wrap mess makes it harder to reverse-engineer the circuitry, but you should really try to learn how to map out the wiring and make a schematic... it's fun!

As for the phone connector, you have to be early GenX to remember them, they basically vanished by 1980 or so as RJ-11 was quickly adopted. The Carterfone decision was in 1968, and customer-owned phones needed a better connector.

Here's a disassembly with the junk zeroed out:
 

Attachments

  • hb3.bin.lst.txt
    17.2 KB · Views: 1
What little PIO code I've seen (code the uses the 50-pin connector) is doing block transfers of 2K bytes. That fits an EPROM programmer or some external storage device more than device control. Also, the ROM code has elements of a debugger and monitor command loop, so seems oriented more towards a Z80 eval or trainer. For example, the NMI button seems to be a way to break a running program and gather the complete CPU state, and RST1 seems to be intended as a software debug breakpoint.

I'm still not convinced that the keypad has anything to do with the computer, but we can find out more with a reverse-engineer of the keypad electronics. I'd really like to see the cable(s) that come out of the keypad unit, so far I've not see how they mate with the cables on the computer board.
 
Discovering more about the system, but 2-D photos aren't really working well. Need to be able to examine it in 3-D.

The four loose wires are for power, where black is ground, red is +5V, brown is -12V and blue is +12V. The unlabeled push button next to RESET is for NMI. The four toggle switches are connected to the A/B modem control inputs on the SIO - looks like a "cheap" way to implement configuration switches. I must not be able to properly trace the wires for the SIO/RS-232 port, as they don't make sense. But, the twin-telephone-cables are definitely RS-232 for the SIO.

It appears that the display device operates at I/O ports 0x80-0xbf, however I see no code in the ROM that accesses this port range (not surprising, since half is missing).

I'm having trouble tracing the I/O decoder lines for the PIOs, SIO, and CTC. Maybe you can trace where the 74LS139 pins 9, 10, 11, and 12 go. They should be going to the Z80-CTC pin 16, PIOs pin 4, and SIO pin 33. Also, I can't tell how the address lines are connected to the PIOs, SIO, and CTC. A0 and A1 should be connected, in some order, to PIOs pins 5,6; SIO pins 32,34; and CTC pins 18,19.

I did confirm that the left-most ROM socket is for address 0000. Interesting, the CPU leaves A13, A14, A15 unconnected. Clearly, it was never intended to use more than 8K of ROM/RAM.

The two empty 14-pin sockets in the upper right are some sort of I/O expansion, it would seem. They provide buffered access to A0-A7 and D0-D7. I can't tell what control signals are presented there.

The system seems to operate at 2.5MHz.

The 50pin IDC connector is definitely connected to the PIOs, but it seems like more of a GPIO than parallel printer port. It even could be for a EPROM programmer, but that's just a guess.
So far for the 74LS139:

Pin 9 -> Right side PIO Pin 4
Pin 10 -> Left side PIO Pin 4
Pin 11 -> SIO Pin 35 (not 33)
Pin 12 -> CTC Pin 16
 
Z80 A0 -> CTC Pin 18 -> SIO Pin 34 and to Both PIOs Pin 6
Z80 A1 -> CTC Pin 19 -> SIO Pin 33 and to Both PIOs Pin 5

And that's SIO Pin 33 not Pin 32.

Hope that helps!
 
Thanks! This fills it all in. I had used a kicad symbol for what looked like a Z80-SIO/0 but was actually some other variation. Now that I'm using the correct pinout, your signals and the RS-232 hookup all make sense.
 
Are you using a TL866 to read the ROM? IMO its ability to read old 2716's is marginal. With an arduino you might be able to get a good dump.
 
Saw some more interesting code in the ROM, which may give use more clues as to how this thing was used. I see code that is using the serial ports. Of course, not all the code is present. But, it appears to be taking characters from channel B and passing them to channel A (and also possibly vice versa), and also optionally interpreting those characters as Intel HEX data (I see code that watches for ':' and then ignores everything between CR/LF and the next ':'). At first I was thinking that channel B was connected to something like a paper tape reader, but then there is code to interpret a ^] on channel A to cause a BREAK out on channel B. Possibly the paper tape reader used BREAK as a STOP command (I've not heard of that, though), but then I also thought about how we used to connect to mainframes and other remote computers back in the day - BREAK (RS-232 line condition) was often used as either an interrupt or a disconnect. It could be that this machine was connected to some other computer, which could have been used to send Intel HEX files (load programs). Might have been that channel A connected to a "console" device and channel B went to a modem or other remote connection.

I also noticed that most of the parts used in this machine have date codes from the late 70's/early 80's, but a few (only the display?) have 1987 date codes. That might indicate that the display was added later, and perhaps the ROM never had routines to use it (could have been added for experimentation using code that was loaded and run in RAM).
 
i remember something;

back in the day compiling was a problem for speed. many people had time share mainframe access they would compile the programs on the mainframe then send the binary back to the user which could be funneled directly to a eprom programmer. it sped up making corrections/programming/ and lowered the cost since software was extremely expensive back then.

If the person had a smart terminal or maybe a local micro computer with little ram with a modem they would connected remotely to the mainframe they would have had access to the development language and compiler/linker then they would have shot the binary back to themselves (Xmodem) and had the eprom burnt right there in front of them for install into whatever device they were working on.
 
Back
Top