• Please review our updated Terms and Rules here

Homebrew Z80 No. 3

falter

Veteran Member
Joined
Jan 22, 2011
Messages
6,556
Location
Vancouver, BC
This is my 3rd Z80 homebrew and kind of unusual at that.

It has a numeric keypad and I think they built the power supply into the case for it. And then they have an old school 4 conductor telephone plug, which adapts into a modern telephone plug, and I'm not sure but I'm guessing the power gets carried on phone wires over to the board.

Not sure how it works - I'm thinking it's not working in hexadecimal without the letters available.. octal maybe?

I've dumped the code as well.. not sure if anyone has any thoughts on it. It looks like it has an 8 inch floppy connector possibly - maybe it just boots straight into something. I'm wondering if the FFs are intentional or bitrot.

:100000003EC932DC1F186AFFE32BE31859FFFFFFDC
:10001000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0
:10002000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE0
:10003000FFFFFFFFFFFFFFFFC3DE1FFFFFFFFFFF0D
:10004000C39400C3CE01C3E101C3C401C3DF03FFF6
:10005000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB0
:10006000FFFFFFFFFFFFF53AFC1FA7200AF1C3A324
:100070000221A01F22D61F31C01F21B2030614CDBA
:100080000E023E10D306DB06CB6F280821DA0306EA
:1000900002CD0E02CDBC01010100ED43FC1F0DAFEE
:1000A00032FB1FCDA60138172100001805CDA6018F
:1000B000380D3C32FB1F3D29292929856F18EEFE9A
:1000C000472839FE2F2858FE562862FE49CA51019A
:1000D000FE542853FE50CAF600FE52CA6B02FE4878
:1000E000CA8004FE0A2822FE0D2827FE5E28293E2B
:1000F0003FCDE101189E2AD81F2318073AFB1FA7FE
:100100003EC932DC1F186AFFE32BE31859FFFFFFDB
:10011000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEF
:10012000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDF
:10013000FFFFFFFFFFFFFFFFC3DE1FFFFFFFFFFF0C
:10014000C39400C3CE01C3E101C3C401C3DF03FFF5
:10015000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFAF
:10016000FFFFFFFFFFFFF53AFC1FA7200AF1C3A323
:100170000221A01F22D61F31C01F21B2030614CDB9
:100180000E023E10D306DB06CB6F280821DA0306E9
:1001900002CD0E02CDBC01010100ED43FC1F0DAFED
:1001A00032FB1FCDA60138172100001805CDA6018E
:1001B000380D3C32FB1F3D29292929856F18EEFE99
:1001C000472839FE2F2858FE562862FE49CA510199
:1001D000FE542853FE50CAF600FE52CA6B02FE4877
:1001E000CA8004FE0A2822FE0D2827FE5E28293E2A
:1001F0003FCDE101189E2AD81F2318073AFB1FA7FD
:100200003FD8FE3A3805FE41D8D607D630C94E232E
:10021000EDA320FAC9C5E50126E0093806011A0058
:10022000093824E1C17CCD2A027DF5CB0FCB0FCB61
:100230000FCB0FCD3702F1CD3D02C3E101E60FC672
:1002400030FE3AF8C607C9E1E501D9E3093E52CDCF
:10025000E1017EA720043E2B180BCB6F2807E65F39
:10026000CDE1013E27CDE101E1C1C9CDCE01CDE116
:10027000015FCD9702CDCE01CDE101FE27200C7BA1
:10028000F620CD9702CDCE01CDE101FE2FC2EF00C9
:1002900001261C09C31F01219903011900EDB1C8F2
:1002A000C3EF0022DA1FE122D81FED73D61F31D62B
:1002B0001FF5ED57F32EC9E2BD0221FBC922DC1F59
:1002C00067ED5F6FF1FDE5DDE5E508D9E5D5C5F53D
:1002D00008D92ADA1FE5D5C5F5CDC4013E3ECDE1EA
:1002E000012AD81FCD1502C39400AF32FC1FF1C103
:1002F000D1E122DA1F08D9F1C1D1E108D9E1F57CB9
:100300003FD8FE3A3805FE41D8D607D630C94E232D
:10031000EDA320FAC9C5E50126E0093806011A0057
:10032000093824E1C17CCD2A027DF5CB0FCB0FCB60
:100330000FCB0FCD3702F1CD3D02C3E101E60FC671
:1003400030FE3AF8C607C9E1E501D9E3093E52CDCE
:10035000E1017EA720043E2B180BCB6F2807E65F38
:10036000CDE1013E27CDE101E1C1C9CDCE01CDE115
:10037000015FCD9702CDCE01CDE101FE27200C7BA0
:10038000F620CD9702CDCE01CDE101FE2FC2EF00C8
:1003900001261C09C31F01219903011900EDB1C8F1
:1003A000C3EF0022DA1FE122D81FED73D61F31D62A
:1003B0001FF5ED57F32EC9E2BD0221FBC922DC1F58
:1003C00067ED5F6FF1FDE5DDE5E508D9E5D5C5F53C
:1003D00008D92ADA1FE5D5C5F5CDC4013E3ECDE1E9
:1003E000012AD81FCD1502C39400AF32FC1FF1C102
:1003F000D1E122DA1F08D9F1C1D1E108D9E1F57CB8
:10040000FE1D2838D30518DEDB07CB4728DDDB06C9
:10041000CB5728D7DB05DDCB004E281CDDCB007E7B
:100420002804FE3A2838FE0A280AFE0D2806DDCBED
:1004300000BE1804DDCB00FED30418AFDD3501206B
:10044000AA3E05D3073E78D307C50600480C20FD19
:100450000420FAC13E05D3073E68D3071888CD6350
:10046000041883F5C5D5E50E07AFC32B03FFFFFFC7
:10047000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8C
:100480003E0FD30AD30BD30E3ECFD30F3E0FD30F65
:10049000FD21D607CD49003E5FCD46000E00CB8141
:1004A000210000CDE305FE303812FE38300ECD4677
:1004B00000D630292929856FCBC118E7FE0D2863A6
:1004C000FE2E2867FE2C2870FE5CCA5F05FE0A28F7
:1004D00077CD4600FE53283AFE52283BFE58CA40CC
:1004E00000FE4DCA8B06FE2FCA8805FE5E2875FEEB
:1004F0003E283DFE3C2846FE47CA0606FE50CA2B53
:10050000FE1D2838D30518DEDB07CB4728DDDB06C8
:10051000CB5728D7DB05DDCB004E281CDDCB007E7A
:100520002804FE3A2838FE0A280AFE0D2806DDCBEC
:1005300000BE1804DDCB00FED30418AFDD3501206A
:10054000AA3E05D3073E78D307C50600480C20FD18
:100550000420FAC13E05D3073E68D3071888CD634F
:10056000041883F5C5D5E50E07AFC32B03FFFFFFC6
:10057000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8B
:100580003E0FD30AD30BD30E3ECFD30F3E0FD30F64
:10059000FD21D607CD49003E5FCD46000E00CB8140
:1005A000210000CDE305FE303812FE38300ECD4676
:1005B00000D630292929856FCBC118E7FE0D2863A5
:1005C000FE2E2867FE2C2870FE5CCA5F05FE0A28F6
:1005D00077CD4600FE53283AFE52283BFE58CA40CB
:1005E00000FE4DCA8B06FE2FCA8805FE5E2875FEEA
:1005F0003E283DFE3C2846FE47CA0606FE50CA2B52
:1006000007D308C1F1C9CDBF0511000021001601B3
:1006100000F8CDEE05DB0D7713CDEE05DB0DED6FAC
:1006200013230C20ED0420EAC39404CDBF05110070
:10063000002100160100F8CDEE057E0F0F0F0FD33D
:100640000C13CDEE057ED30C13230C20EA0420E717
:10065000C394043E02CD4C00C39404CDBF050E0DDF
:10066000AFED797CE60F20067DFE04DA0B052B2B1F
:100670007DEE01D3083E10ED79AFED7929297CD3C9
:10068000083E20ED79AFED79C39404CDBF057CB56C
:100690002003210100E5AFD3084FD309AFD30CDB12
:1006A000093CFDBE0038F3060179D30978D30CAFBD
:1006B000D3091600B9200150DB0DBA281DCD490021
:1006C0003E44CD4600DB09CDB30779CDB307DB0D42
:1006D000CDB30778CDB307CDC807DB093CFDBE001D
:1006E00038CECB2078E60F20C079D309AFD30C0CDD
:1006F00079FDBE0038B1AFD3090601AFD30878D376
:1007000007D308C1F1C9CDBF0511000021001601B2
:1007100000F8CDEE05DB0D7713CDEE05DB0DED6FAB
:1007200013230C20ED0420EAC39404CDBF0511006F
:10073000002100160100F8CDEE057E0F0F0F0FD33C
:100740000C13CDEE057ED30C13230C20EA0420E716
:10075000C394043E02CD4C00C39404CDBF050E0DDE
:10076000AFED797CE60F20067DFE04DA0B052B2B1E
:100770007DEE01D3083E10ED79AFED7929297CD3C8
:10078000083E20ED79AFED79C39404CDBF057CB56B
:100790002003210100E5AFD3084FD309AFD30CDB11
:1007A000093CFDBE0038F3060179D30978D30CAFBC
:1007B000D3091600B9200150DB0DBA281DCD490020
:1007C0003E44CD4600DB09CDB30779CDB307DB0D41
:1007D000CDB30778CDB307CDC807DB093CFDBE001C
:1007E00038CECB2078E60F20C079D309AFD30C0CDC
:1007F00079FDBE0038B1AFD3090601AFD30878D375
:00000001FF
 

Attachments

  • hbz803-1.jpg
    hbz803-1.jpg
    235.3 KB · Views: 46
  • hbz803-2.jpg
    hbz803-2.jpg
    292.6 KB · Views: 42
  • hbz803-3.jpg
    hbz803-3.jpg
    353 KB · Views: 41
That code is a mess. The first thing I noticed when trying to disassemble it was there seem to be a lot of bad branch offsets. A lot of the FFs seem to be padding to make things line up to xxx0 addresses, and also to NMI at 0066.

Then I noticed padding up to 0166, and yep, it was the same as 0066. You have a bad dump, A8 is stuck low.
 
As Bruce said, the dump has repeated patterns as if A8 were stuck, probably stuck low (the 0000-00FF part of the dump does look reasonable).

The FFs used to fill unused areas is quite normal for EPROMs, as their erased state is FF and so those parts of the EPROM could later be programmed without having to erase the whole chip. I do notice that the EPROM erasure window is not covered, so there may have been loss of data (some FFs but also random bits flipped to "1") depending on how this machine was stored. I would cover the window with an opaque sticker, preferably foil-based. Might be too late, but best to avoid any further damage (photo flash, sunlight, fluorescent lights, ...)

If you can get a complete ROM dump, it should be possible to reverse-engineer the hardware. Some more information on the 8-digit HEX(?) display module would be nice, but there may be no visible markings. More info on how the keypad would be good too, including how it connects (does the keypad decode the key presses? or is it a simple set of scan lines?). Interesting that there is a Z80-SIO, and it appears to be what those "phone wires" are soldered to.

I don't see any evidence of floppy support, more likely that connector is for GPIOs (i.e. parallel) . A view of the back (wiring side) would help, although it appears there is a protective backing bolted onto it and so that might require some careful disassembly.
 
The filling with FFs thing is just about being tidy lining up the code, especially if you're poking raw hex patches into RAM, which I did a lot as a kid back in the day. I didn't have access to EPROMs, so not sure what I would have done with that. Yes you could still burn those bytes, but how do you re-burn references to the new code?

Losing an address line is not a failure mode of erasure. It's just a bunch of bits randomly going 1, sort of like nuclear half-life decay. (people have done that kind of test since a long time ago) The first thing I would try is a re-dump with doing a few hits of the Verify command and sliding the chip around in the ZIF socket for better contact. But I'm worried that an open address input pin usually goes high, so it might be a problem on the silicon.

I didn't look closely at the boards before. I'm impressed about having a whole 4K of SRAM on that. The connector on the side, yeah that's probably parallel from the PIO, or maybe a full bus. And I'm amused at using phone wiring for the serial port, in my first "real" embedded job we used those for both RS-232 and RS-485 all around the office. (Paper clips are a great way to string RJ-11 wires along a drop ceiling from the lab area to your desk.)

The Mostek chip is probably driving the LED. Not sure if the LED has a built-in chargen, or if the Mostek chip is doing that. And the keypad implies the guy probably programmed it in octal.

Wait... did the keypad hook up with that old 1970s phone plug? I think we need a look in there too. I would have expected it on those sockets in the corner until I looked at the big picture.
 
Having worked in the industry during that era, I can tell you that the FFs fill was the standard way of filling unused portions of EPROMs. At the very least, it meant the EPROM Programmer could skip those bytes - which could significantly speed up programming. While it may not have always been easy to patch new code or fixes into an EPROM, I've seen some cases of pretty innovative - and successful - patching out there.

I was not suggesting that the A8 symptom had anything to do with UV exposure and erasure. I was pointing out that the EPROM is unprotected and there may have been a lot of photons falling on that chip over the years. The A8 problem could any number of things, but note that the EPROMs are MOS technology so you can't assume that an open pin will float high.
 
Thanks guys! Yeah I'll check the contacts on the EPROM. It's a 2716, the window has been exposed, which in my experience usually isn't a problem, even after years.. but with the FFs sprinkled around I was worried. Hopefully the chip itself isn't damaged. I'll try cleaning the pins, repeating and dumping a few times to see if the output changes.

I'm quite confused about the Tel line stuff. I thought it was simply plug in male rj11/12 from mainboard to the adapted jack on the keypad box, but there is an additional rj11/12 jack on the mainboard also. I'll get the keypad box apart and see whats in there. I figure one line must be for power, and the other must be for the keypad signals.
 
My guess would be that the phone cable was simply a way to get additional conductors. My hobby days were spent scavenging all sorts of similar stuff. Telephone wire/cable (multi-conductor) was gold.
 
I'll caution one last time about the un-covered EPROM. It is just careless to take chances, especially with this one-of-a-kind device.
 
I've covered it.. but unfortunately it came uncovered.

And it's reading the same no matter what I do.. sigh.
 
As a last ditch hope, maybe check that your EPROM programmer is working. If it is an older style with plugin personality modules, make sure all that is working.
 
The 2708 isn't supposed to *need* it, but another last-ditch thing you could try is adding a pull-up to A8. Nothing too heavy, try 4.7k-10k-ish?

(The 2708's datasheet specifically says it can be driven by TTL-level logic without external pull-ups, but that was a new-ish feature when it came out, it was pretty common for MOS parts to need them. It's at least possible your programmer might need a little help.)
 
It's a 2716... I think they're different electrically aren't they? My GQ-4x4 can read 2716s but not 2708s.
 
It's a 2716... I think they're different electrically aren't they? My GQ-4x4 can read 2716s but not 2708s.

Sheesh, I don't know where I somehow picked up the idea it was a 2708. (The main difference between the two other than capacity is the 2708 wants the old-fashioned MOS +5/+12/-5v power supplies, which is why it's hard to find a modern programmer that will want to deal with a 2708.)

You could still *try* the pull-up idea, but I'm even less optimistic it'd help.
 
As a last ditch hope, maybe check that your EPROM programmer is working. If it is an older style with plugin personality modules, make sure all that is working.

Nah it's a new GQ-4x4. So far it's been pretty reliable.

I guess there's no way to unscramble things.. too many possibilities?
 
Did you try a pull-up on A8? You can rig that easily enough by just clamping a resistor between A8 and VCC (Again, I'd suggest a value between 4-10K-ish.) I think it's unlikely to hurt anything to try.

Anyway, it's not a matter of "unscrambling" things, if an address pin is stuck then you're simply missing half the data, full stop. The distribution of that missing half will just vary depending on which pin is stuck. (A8 stuck means you'll be getting two copies of every even block of 256 bytes. If A0 were stuck then you'd be missing every other byte. Etc, etc.)
 
I did a little looking at the code we do have. The initialization routine does the classic Z80 trick of initializing the hardware (PIOs, SIO, CTC) using a table of I/O port and data byte pairs. That table would give a really good picture of the hardware and how it is used, but unfortunately that table is in an area with A8=1 so we don't have any of it. Might be able to make some guesses, but would need more of the schematic. At least the I/O decode circuit. I might take another look at the code and see if any clues pop out.
 
Did a little recreational analysis of the code this morning. It does look like a fairly-complete debugger/monitor environment. The code I'm recognizing is oriented around an ASR-33 teletype (or similar uppercase-only terminal) and might even handle reading Intel HEX Format paper tapes.

I wonder if this is actually either a prototype or a "home spun recreation" of a popular trainer/eval unit for Z80? If that is the case, the ROM might be found under some other device/product, but we just don't know what criteria to search with.
 
Man this thing is strange.

So I think I was wrong about the connections between the computer and keypad. There is a power supply in the keypad housing. But it doesn't appear to supply power to the computer. That's accomplished by some loose wires. I think, anyway. They keypad actually has a bunch of ICs on a custom protoboard inside. The weird thing is, the keypad and ICs in its enclosure seem to be several years older than the Z80 machine. So maybe it predates? I think the telephone cable handles some kind of communications between them.

I also don't know if this matters, but the 2716 I think has been recently moved to the socket it was in when I received it. The reason is there is a ton of dust underneath in the socket.. but on the socket next to it and under the RAM there's much less dust, as you'd expect if the chips were in the way. I think the 2716 actually belonged in the leftmost socket. Or maybe it doesn't matter, the four sockets up top all seem to be wired the same way.

I did try, just for fun, powering it up with just 5v. Nothing smoked but nothing happened either. The LEDs didn't light up.

Yeah. Weird one.
 

Attachments

  • Screenshot_20221127-225609_Gallery.jpg
    Screenshot_20221127-225609_Gallery.jpg
    274.5 KB · Views: 18
  • 20221127_204133.jpg
    20221127_204133.jpg
    500.2 KB · Views: 18
  • 20221127_204057.jpg
    20221127_204057.jpg
    1.1 MB · Views: 17
It looks like the keypad contains a full encoder. Would need to see more on the cable(s) connecting it to the main board to see whether it is 4-bit parallel or something else (serial?).

Are there any markings on the display array? There might be something on the long edges, and that would help tell us about it - is it multiplexed? Or just 8x TL311(-like) fully-decoded and latched displays? or ??? I did not see (yet) any code that appeared to be multiplexing a display, but it might be there (or in the missing chunks). Looking at the wired-side view, it does APPEAR that the display is a "smart" display, i.e. one just selects the digit number and data and "latches" it - presumably the display decodes the digit into a 5x7 pattern and displays it. It may even be an alpha-numeric (e.g. ASCII) display.

Note that the 24-pin sockets are only NEARLY identical, and they are not interchangeable. The RAM chips have nearly the same pinout as the EPROM chips, but there are differences. The wire-side view does show the /G (output enable) pins on the EPROMs are wired to some sort of address decoder, as are the /CS pins on the RAM. And the RAM /WE and /OE pins appear to be wired to the Z80 /WR and /RD signals (which makes sense).

If we can determine the I/O mapping used for the SIO, PIOs, and CTC, plus others, that might allow reconstruction of the ROM and also could enable creation of a simulator for this unit. Some good, unobstructed, photos of front and back would help with this. Not all wires are going to be traceable from a photo, but I presume you could answer any questions by doing a closer inspection.
 
Back
Top