- VCF South West - June 14 - 16, Davidson-Gundy Alumni Center at University of Texas at Dallas
- VCF West - Aug 2 - 3, Computer History Museum, Mountain View, CA
- VCF Midwest - Sept 7 - 8 2024, Schaumburg, IL
- VCF SoCal - Mid February 2025, Location TBD, Southern CA
- VCF East - April 2025, Infoage Museum, Wall NJ
-
Please review our updated Terms and Rules here
Computek PCM210 - what is this ISA card?
- Thread starter ppieczul
- Start date
Dwight Elvey
Veteran Member
It is not likely to do much. The RCA jack is likely driving a buzzer when activated, with a square wave. The driving circuit is typical of that type of signal. It is clearly designed to interact with something. The first thing to do is look at the code and see how it sets up the I/O pins. Things like how many pins are set to input and how many to output.
Dwight
Dwight
mediasponge
Experienced Member
This same card apparently raised the same question on a German site. They came to the same conclusion (no idea)!
mediasponge
Experienced Member
If the printing on the card says "PCM" maybe the card takes input from the DB port, does some kind of PCM encoding on it, then sends it out again on the RCA jack. Perhaps some kind of communications device? PCM might also stand for Process Control Module. But why use a PC's ISA bus to power some industrial control with no software interaction?
Dwight Elvey
Veteran Member
My guess is that it is an alarm. I doubt the RCA outputs anything other than a buzz.
Dwight
Dwight
I attached an oscilloscope and
RCA has a constant output of -5V, it does not change in time
DB9 pins have +5V or 0 and they do not change in time too
I suppose some of them are inputs and maybe the CPU will react to changes in those
Next I will desolder the ROM and read its content
RCA has a constant output of -5V, it does not change in time
DB9 pins have +5V or 0 and they do not change in time too
I suppose some of them are inputs and maybe the CPU will react to changes in those
Next I will desolder the ROM and read its content
Dump of ROM content:
View attachment computek_pcm210.zip
And the disassembly, it actually looks like making some sense, though I have not yet tried to analyse it:
View attachment computek_pcm210.zip
And the disassembly, it actually looks like making some sense, though I have not yet tried to analyse it:
Code:
ORG 00007H
DIS I ; 0007
DIS TCNTI ; 0008
SEL MB0 ; 0009
SEL RB0 ; 000A
CLR A ; 000B
MOV R2,A ; 000C
MOV R3,A ; 000D
MOV R4,A ; 000E
MOV R6,A ; 000F
MOV R7,A ; 0010
DEC A ; 0011
MOV R1,A ; 0012
MOV R5,A ; 0013
CLR F0 ; 0014
CLR F1 ; 0015
CPL F1 ; 0016
OUTL P1,A ; 0017
OUTL P2,A ; 0018
STRT T ; 0019
MOV A,#0FAH ; 001A
MOV T,A ; 001C
ANL P2,#0BFH ; 001D
JF0 0025H ; 001F
ORL P2,#080H ; 0021
JMP 029H ; 0023
ANL P2,#07FH ; 0025
ORL P2,#040H ; 0029
MOV A,R7 ; 002B
ANL A,#0FFH ; 002C
JNZ 003BH ; 002E
IN A,P1 ; 0030
XRL A,R1 ; 0031
ANL A,#007H ; 0032
JZ 0045H ; 0034
MOV R2,A ; 0036
MOV R7,#00CH ; 0037
JMP 045H ; 0039
DJNZ R7,0045H ; 003B
IN A,P1 ; 003D
XRL A,R1 ; 003E
ANL A,R2 ; 003F
JZ 0045H ; 0040
XRL A,R1 ; 0042
MOV R1,A ; 0043
CLR F1 ; 0044
IN A,P1 ; 0045
XRL A,R1 ; 0046
ANL A,#030H ; 0047
JZ 0062H ; 0049
CLR F1 ; 004B
XRL A,R1 ; 004C
XCH A,R1 ; 004D
RR A ; 004E
RR A ; 004F
ANL A,#00CH ; 0050
MOV R0,A ; 0052
MOV A,R1 ; 0053
SWAP A ; 0054
ANL A,#003H ; 0055
ORL A,R0 ; 0057
ORL A,#0F0H ; 0058
MOVP A,@A ; 005A
JB1 0062H ; 005B
INC R3 ; 005D
JB0 0062H ; 005E
DEC R3 ; 0060
DEC R3 ; 0061
IN A,P1 ; 0062
XRL A,R1 ; 0063
ANL A,#0C0H ; 0064
JZ 007FH ; 0066
CLR F1 ; 0068
XRL A,R1 ; 0069
XCH A,R1 ; 006A
SWAP A ; 006B
ANL A,#00CH ; 006C
MOV R0,A ; 006E
MOV A,R1 ; 006F
RL A ; 0070
RL A ; 0071
ANL A,#003H ; 0072
ORL A,R0 ; 0074
ORL A,#0F0H ; 0075
MOVP A,@A ; 0077
JB3 007FH ; 0078
INC R4 ; 007A
JB2 007FH ; 007B
DEC R4 ; 007D
DEC R4 ; 007E
MOV A,R6 ; 007F
ANL A,#00FH ; 0080
JZ 0090H ; 0082
DEC R6 ; 0084
CLR C ; 0085
CPL C ; 0086
MOV A,R5 ; 0087
RRC A ; 0088
MOV R5,A ; 0089
CLR F0 ; 008A
JC 00BBH ; 008B
CPL F0 ; 008D
JMP 0BBH ; 008E
MOV A,R6 ; 0090
ORL A,#00CH ; 0091
MOV R6,A ; 0093
CLR F0 ; 0094
ANL A,#0F0H ; 0095
JNZ 00A7H ; 0097
JF1 00BBH ; 0099
CPL F1 ; 009B
MOV A,R6 ; 009C
ORL A,#050H ; 009D
MOV R6,A ; 009F
MOV A,R1 ; 00A0
ANL A,#007H ; 00A1
ORL A,#080H ; 00A3
JMP 0B9H ; 00A5
MOV R5,#0FFH ; 00A7
MOV A,R6 ; 00A9
ADD A,#0F0H ; 00AA
MOV R6,A ; 00AC
ANL A,#0F0H ; 00AD
JZ 00BBH ; 00AF
JB4 00B7H ; 00B1
CLR A ; 00B3
XCH A,R3 ; 00B4
JMP 0B9H ; 00B5
CLR A ; 00B7
XCH A,R4 ; 00B8
CPL F0 ; 00B9
MOV R5,A ; 00BA
JTF 001AH ; 00BB
JMP 0BBH ; 00BD
ORG 000F0H
data 0A05000A000A0A05050A0A000A00050A
END
Last edited:
This seems correct - the NEC Dx lines are connected to ROM Dx outputs and at the same time to the 74373 8-bit latch inputs. The outputs of 74373 go to ROM address lines. Address is latched by NEC ALE signal that triggers the 74373 to latch.
I think I am going to draw a reverse engineered schematic here. This topic becomes more and more interesting!
Dwight Elvey
Veteran Member
That is typical 8039 usage.
It might help us understand what was happening if you'd trace which pins on the connector go to the uC and which pin of the uC goes through the resistor to the base lead of the transistor?
Dwight
It might help us understand what was happening if you'd trace which pins on the connector go to the uC and which pin of the uC goes through the resistor to the base lead of the transistor?
Dwight
So here is a schematic of the board. Now you can see how RCA and DB9 are connected.
View attachment computek.pdf
Combining this with the ROM listing, it should lead somewhere, but I have no more time today.
View attachment computek.pdf
Combining this with the ROM listing, it should lead somewhere, but I have no more time today.
2icebitn
Banned
The german discussion seems to indicate it is part of a point of sale system, and the board is only to supply power. Maybe connects to a scanner?
Dwight Elvey
Veteran Member
It looks like a combination lock in the code. Different EPROM, different combination. The RCA looks like the output.
That makes sense as the company that is current there does security systems for dental records.
Dwight
That makes sense as the company that is current there does security systems for dental records.
Dwight
Nonsense.
There's a processor on the board, so it's obviously supposed to process some signal.
Dwight Elvey
Veteran Member
Looking at the code, P1 is only used as inputs. The only output is to the transistor that drives the RCA connector. The code does a lot of rotating and XORing based on the signals from the 9 pin connector. It is not yet clear how fast it has to run but the timer is only set to run for about 1 millisecond. I've not looked at the code deep enough to determine if it uses a single pass the counter or multiple passes. That would determine if it was connected to a key pad or an electronic key. I'm suspecting an electronic key.
Dwight
Dwight
mediasponge
Experienced Member
POS sounds possible. Perhaps this board generated the signal to open the cash drawer after a sale was recorded. Digital combination lock only makes sense if the board was behind the lock. An RCA jack isn't exactly secure.
Let the fun continue...
I have looked through the beginning of the code and came to an interesting conclusion that P1.4 and P1.5 must be some signals that are expected to be phase synced - change at the same time.
The algorithm seems to detect which signal is lagging behind which and tunes R7 accordingly.
Looking forward to your opinions!
I have looked through the beginning of the code and came to an interesting conclusion that P1.4 and P1.5 must be some signals that are expected to be phase synced - change at the same time.
The algorithm seems to detect which signal is lagging behind which and tunes R7 accordingly.
Looking forward to your opinions!
Code:
; disable external interrupt
DIS I ; 0007
; disable timer/counter interrupt
DIS TCNTI ; 0008
; select memory bank 0 and register bank 0
SEL MB0 ; 0009
SEL RB0 ; 000A
; set R2, R3, R4, R6, R7 to 0x00
CLR A ; 000B
MOV R2,A ; 000C
MOV R3,A ; 000D
MOV R4,A ; 000E
MOV R6,A ; 000F
MOV R7,A ; 0010
; set R1, R5 to 0xFF
DEC A ; 0011
MOV R1,A ; 0012
MOV R5,A ; 0013
; clear flags and complement F1
CLR F0 ; 0014
CLR F1 ; 0015
CPL F1 ; 0016
; clear external ports
OUTL P1,A ; 0017
OUTL P2,A ; 0018
; initialize timer to 0xFA and start it
; timer runs at 7.457 kHz, this timer run will expire (overflow) in 6 cycles
; that is 0.8 ms
STRT T ; 0019
MOV A,#0FAH ; 001A
MOV T,A ; 001C
; 0xBF = clear P2.6
ANL P2,#0BFH ; 001D
; if F0 is set, enable P2.7 (will not happen on the first run)
JF0 0025H ; 001F
ORL P2,#080H ; 0021
JMP 029H ; 0023
; otherwise disable P2.7 and enable P2.6
ANL P2,#07FH ; 0025
ORL P2,#040H ; 0029
;;;;;;;;;;;;;;
;; this section detects if any of P1.0, P1.1, P1.2 changed their state and kept
;; it changed for around 10ms
; check if R7 is zero (will be at first run)
MOV A,R7 ; 002B
ANL A,#0FFH ; 002C
JNZ 003BH ; 002E
; if R7 is zero: if any of P1.0, P1.1, P1.2 is zero on first run or
; changed their value from the previous check
; remember which one in R2 and set R7 to 12
IN A,P1 ; 0030
XRL A,R1 ; 0031
ANL A,#007H ; 0032
JZ 0045H ; 0034
MOV R2,A ; 0036
MOV R7,#00CH ; 0037
JMP 045H ; 0039
; decrement R7, if went down to zero check if P1.0, P1.1 or P1.2
; still have the changed values, if yes store the new values in R1 and clear F1
DJNZ R7,0045H ; 003B
IN A,P1 ; 003D
XRL A,R1 ; 003E
ANL A,R2 ; 003F
JZ 0045H ; 0040
XRL A,R1 ; 0042
MOV R1,A ; 0043
CLR F1 ; 0044
; F1=0 if such event happened
;;;;;;;;;;;;;;;;
; check if P1.4 or P1.5 changed their values
IN A,P1 ; 0045
XRL A,R1 ; 0046
ANL A,#030H ; 0047
JZ 0062H ; 0049
; if yes, set F1 to 0 immediately
CLR F1 ; 004B
; restore A to P1 value
XRL A,R1 ; 004C
; replace A and R1: R1=P1 value, A=previous P1 (PP1)
XCH A,R1 ; 004D
; PP1 >> 2
RR A ; 004E
RR A ; 004F
ANL A,#00CH ; 0050
MOV R0,A ; 0052
MOV A,R1 ; 0053
; R0.3=PP1.5 R0.2=PP1.4 (rest is 0)
; here A contains P1 value again
SWAP A ; 0054
; keep only P1.4 and P1.5 on bits 0,1
ANL A,#003H ; 0055
; now we have on one nibble previous and current value of bits:
; A3-0 = PP1.5,PP1.4,P1.5,P1.4
ORL A,R0 ; 0057
; now it is 0xF(PP1.5,PP1.4,P1.5,P1.4)
ORL A,#0F0H ; 0058
MOVP A,@A ; 005A
; read a value from memory depending on previous and current values of P1.5,P1.4
; +-------+-------+------+------+-----+-----+
; | PP1.5 | PP1.4 | P1.5 | P1.4 | ADR | VAL |
; +-------+-------+------+------+-----+-----+
; | 0 | 0 | 0 | 0 | 0x0 | 0A | 1010
; | 0 | 0 | 1 | 1 | 0x3 | 0A |
; | 0 | 1 | 0 | 1 | 0x5 | 0A |
; | 0 | 1 | 1 | 0 | 0x6 | 0A |
; | 1 | 0 | 0 | 1 | 0x9 | 0A |
; | 1 | 0 | 1 | 0 | 0xA | 0A |
; | 1 | 1 | 0 | 0 | 0xC | 0A |
; | 1 | 1 | 1 | 1 | 0xF | 0A |
; 0A - both bits behave in the same way - both change or both stay the same
; it may be interpreted as P1.5 and P1.4 are in phase sync
; +-------+-------+------+------+-----+-----+
; | PP1.5 | PP1.4 | P1.5 | P1.4 | ADR | VAL |
; +-------+-------+------+------+-----+-----+
; | 0 | 0 | 0 | 1 | 0x1 | 05 | 0101
; | 0 | 1 | 1 | 1 | 0x7 | 05 |
; | 1 | 0 | 0 | 0 | 0x8 | 05 |
; | 1 | 1 | 1 | 0 | 0xE | 05 |
; 05 - P1.5 is lagging behind P1.4
; | 0 | 1 | 0 | 0 | 0x4 | 00 |
; | 0 | 0 | 1 | 0 | 0x2 | 00 | 0000
; | 1 | 1 | 0 | 1 | 0xD | 00 |
; | 1 | 0 | 1 | 1 | 0xB | 00 |
; 00 - P1.4 is lagging behind P1.5
; for 0x00 increment R3
; for 0x05 decrement R3
JB1 0062H ; 005B
INC R3 ; 005D
JB0 0062H ; 005E
DEC R3 ; 0060
DEC R3 ; 0061Dwight Elvey
Veteran Member
It is secure if it is in the box that is locked. Anyway, it looks like to may send out yet another code?
Dwight
Chuck(G)
25k Member
A box with an electronic combination lock? (the lead/lag could be a direction indicator).
Dwight Elvey
Veteran Member
Chuck(G)
25k Member
Maybe nothing more than a position indicator using quadrature signals. Perhaps not a security device at all.