Re: Has anyone fully decoded the X9000 memory mapping?
what is the definition os a simple trigger?
As for another mode to toggle to/from it can probably even be empty or rx only but a different freq than you have in mode one
|
Re: Has anyone fully decoded the X9000 memory mapping?
I just ran through every pin one at a time with it running in continuous mode and verified they went inactive while comparing to the datasheet. Each seems to be accurate. The LA software pins are zero?based numbering so each pin is off by one so I just focused?on my labels. I am not using any sort of trigger other than Simple Trigger with no specific triggers enabled. I was hoping I could do CE low as a trigger and it only show data when that line is low but that doesn't work. There is probably a way to setup?advanced?trigger to do that but I haven't figured it out yet.
Here is another upload. It's a 5 second 50 MHz read.
I was typing the same time you were.......
If OE=p19 is a typo too it looks like just typos in your labeling.
|
Re: Has anyone fully decoded the X9000 memory mapping?
That's the great thing about standards,,,there are so many to choose from!
IEEE uses the same as resistor/cap color code.
ICEA uses a repeating patern adding different color traces to each tier.
ISA/IEDA has their own means too, as does anything that comes from Europe and Japan.
It is a PITA fixing engineering's screw ups to interface German or Japanese equipment to ICEA power/control cables and a DCS designed per ISO standards. Hated the OT but loved the paycheck.
On one GE frame 5 co-gen project, GE basicly told us, "We provide the package. It's up to you to figure out how to make ours stuff interface to your equipment"? ............REALLY loved those paychecks!
That's the only pinout for a 2816 that I'm aware of so I'd presume the ,pdf is the correct one as well.
It is busy running it's "main loop", accessing the FW for the next instruction, refreshing the WDT, maybe managing the audio shaping circuitry and what ever else is in it's perview to maintain per the FW instructions.
I dont expect a read of the codeplug unless requested by a mode change, or scan is enabled, maybe a squelch break will cause some traffic for the digital side of the audio circuits. I imagine it already has the frequency data and PL data from the index/pointers in RAM for the mode you are sitting on.
?
Yes, I suspect keeping up with all the physical and mental portions of these diagnostics is taxing....
Please, allow me consume another cold adult beverage for you in honor of your efforts.....
|
Re: Has anyone fully decoded the X9000 memory mapping?
The LA has fly leads that plug in groups of four and the colors > repeat since there aren't enough different colored wires for each pin > to be unique. It's a shame no one ever came up with a standard-ish color code scheme for large groups of wires. :) De
|
Re: Has anyone fully decoded the X9000 memory mapping?
Let me check it all again. I did drag some pins around in the program to keep things grouped but that just moves them in place and doesn't alter the data of course.
I'll check it again and upload another file and do some other tests. It's difficult to discern what it's doing because the thing is so active even when idle. I can remove each line one at a time and do a run to see what remains idle for confirmation.
It's also difficult to keep track?of all the leads. The LA has fly leads that plug in groups of four and the colors repeat since there aren't enough different colored wires for each pin to be unique.? As you mentioned the schematic is labled for a 28 pin part which is very confusing so I have ignored it and focused on the actual chip's datasheet. I believe I'm looking at the correct one. It's the only one I could find online.
I was also enjoying some cold beverages which might have contributed to the chaos.?
|
Re: Has anyone fully decoded the X9000 memory mapping?
I was typing the same time you were.......
If OE=p19 is a typo too it looks like just typos in your labeling.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Had to gig up? a 2816 and a 2864 pdf.
Knowing there is a difference and remembering what exactly it is, is two different things...lol
Looks like the mismatch is just your labeling, CE and WE are swapped per your pin description, but I wouldnt expect WE to ever go low (unless being programed) so the trace data looks right.
This may be just a description thing too, but addr 03 (physical pin 5)is skipped.
I also wouldnt expect anything on the data lines to be relevant to the EEPROM unless both the OE and the CE are low (active).
Per a previous post you have one mode programmed w/TX.RX and Alt TX and are? sitting on that mode?
Let me suggest programming a second mode and manually incrementing/toggling? between the mods while observing the busses.
Should see CE and OE go active at the same time then and see the data presented to the bus. I'm curious how much of the byteset it reads.
Does it read againwhem tx is initiated?
Inquiring minds.....
|
Re: Has anyone fully decoded the X9000 memory mapping?
I am going off the SEEQ datasheet using this 2816A pinout.
Casey,
Verify ypur pinouts with a 2816 .pdf
If you are following the SM schematic, that pins out an 8K chip.
Different setup for a 2k chip.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Casey,
Verify ypur pinouts with a 2816 .pdf
If you are following the SM schematic, that pins out an 8K chip.
Different setup for a 2k chip.
|
Re: Has anyone fully decoded the X9000 memory mapping?
BTW: A more readable version of the screen shot is in "pictures" in the groups.io.? And you can download the full version, I sure can't read it after it got inserted into my message.
73's Skip WB6YMH
|
Re: Has anyone fully decoded the X9000 memory mapping?
That's probably just a noise glitch. I've been looking at your trace and something doesn't look right.? For one thing OE isn't active during CE...?? If I ignore that as a wrong connection it still doesn't look right.? Two reads of the same address (108) get different results ???  Here's the?
|
Re: Has anyone fully decoded the X9000 memory mapping?
One of these I/O lines data period is 20 nanoseconds. Hmmm...quit  e fast.
|
Re: Has anyone fully decoded the X9000 memory mapping?
Right on... So I just did a 50 MHz read. It's 124 Mb. Here is a link to it.
On Sat, Aug 6, 2022 at 10:07 PM Skip Hansen < skip@...> wrote: I generally like to sample?about?4x the smallest pulse I'm looking at.? So if the shortest pulse (write line probably) is 100ns I'd set the sampling rate for 25ns (40 Mhz).
Write being active while?chip enable isn't sounds reasonable, it's probably writing?to some I/O.? All we care about is what's happening?when chip enable IS active.
73's Skip WB6YMH
On Sat, Aug 6, 2022 at 7:51 PM Casey Crane < ccrane148@...> wrote: I just finished rebuilding my adapter thingy for EEPROM sniffing and have all the lines labeled. It was giving a fail 84 and it turns out that if anything is wrong as in being plugged in wrong or what not the?EEPROM is easily corrupted, probably the WE being engaged when it shouldn't. It seems to be solid now.
?I'm using a 2k chip so the extra 4 pins are not utilized (24 pin part). Already seeing some interesting things if my connections are correct. It appears it's hitting up the EEPROM every 4.6 milliseconds to grab some data but not all that much data, like 13 or 15 bursts of one bit width of data then it recycles but the patterns are not exactly the same. Write enable does go active quite often as well which is interesting but from what I'm seeing just in looking briefly just now it's not simultaneous to CE of the EEPROM so perhaps it's writing something else....dunno...strange.?
I'm still learning DSView since everything I do involves me doing a cannonbal?into the deepest end then flailing around learning the tools and methods simultaneously. I will try to push out a file here in a bit and anyone should be able to grab DSView since it's free and view it.?
What speed and file size should I use? I am using the DSLogic U3Pro32. Right now I'm just looking at 1 second at 1 Mhz with it sitting on a channel not scanning and zero options enabled, not even PL. I think it's RX 30.000, TX 31.000 TA freq 32.000.?
LOL I just did a 1 Mhz 20 second read and exported to CSV. It created a 1 Gb Excel file. Damn!
On Sat, Aug 6, 2022 at 7:50 AM Skip Hansen < skip@...> wrote: Wow, that screen looks familiar!? But I've never seen so many traces.? I missed the message where you said you were going with the DreamSource box. Now I want to write a disassembler for the 6301, squirrel, hell it's a tree full of them!
Please upload your capture when you get a chance!
73's Skip p.s. That was FAST for a DreamSource ... can I ask where you got it??
On Fri, Aug 5, 2022 at 9:09 PM Casey Crane < ccrane148@...> wrote: Yikes... full live 1 second read zoomed in with one of the channels being chip select. I still need to figure out how to organize and label the channel names (surely I can do that like in Saleae Logic's stuff. Off to RTFM. At least it seems to be working.
|
Re: Has anyone fully decoded the X9000 memory mapping?
I generally like to sample?about?4x the smallest pulse I'm looking at.? So if the shortest pulse (write line probably) is 100ns I'd set the sampling rate for 25ns (40 Mhz).
Write being active while?chip enable isn't sounds reasonable, it's probably writing?to some I/O.? All we care about is what's happening?when chip enable IS active.
73's Skip WB6YMH
On Sat, Aug 6, 2022 at 7:51 PM Casey Crane < ccrane148@...> wrote: I just finished rebuilding my adapter thingy for EEPROM sniffing and have all the lines labeled. It was giving a fail 84 and it turns out that if anything is wrong as in being plugged in wrong or what not the?EEPROM is easily corrupted, probably the WE being engaged when it shouldn't. It seems to be solid now.
?I'm using a 2k chip so the extra 4 pins are not utilized (24 pin part). Already seeing some interesting things if my connections are correct. It appears it's hitting up the EEPROM every 4.6 milliseconds to grab some data but not all that much data, like 13 or 15 bursts of one bit width of data then it recycles but the patterns are not exactly the same. Write enable does go active quite often as well which is interesting but from what I'm seeing just in looking briefly just now it's not simultaneous to CE of the EEPROM so perhaps it's writing something else....dunno...strange.?
I'm still learning DSView since everything I do involves me doing a cannonbal?into the deepest end then flailing around learning the tools and methods simultaneously. I will try to push out a file here in a bit and anyone should be able to grab DSView since it's free and view it.?
What speed and file size should I use? I am using the DSLogic U3Pro32. Right now I'm just looking at 1 second at 1 Mhz with it sitting on a channel not scanning and zero options enabled, not even PL. I think it's RX 30.000, TX 31.000 TA freq 32.000.?
LOL I just did a 1 Mhz 20 second read and exported to CSV. It created a 1 Gb Excel file. Damn!
On Sat, Aug 6, 2022 at 7:50 AM Skip Hansen < skip@...> wrote: Wow, that screen looks familiar!? But I've never seen so many traces.? I missed the message where you said you were going with the DreamSource box. Now I want to write a disassembler for the 6301, squirrel, hell it's a tree full of them!
Please upload your capture when you get a chance!
73's Skip p.s. That was FAST for a DreamSource ... can I ask where you got it??
On Fri, Aug 5, 2022 at 9:09 PM Casey Crane < ccrane148@...> wrote: Yikes... full live 1 second read zoomed in with one of the channels being chip select. I still need to figure out how to organize and label the channel names (surely I can do that like in Saleae Logic's stuff. Off to RTFM. At least it seems to be working.
|
Re: Has anyone fully decoded the X9000 memory mapping?
OK so the CSV could be helpful but it's similar to the episode?of Halt and Catch Fire where they dump the entire BIOS chip using LEDs writing each bit on a notepad. No thanks. I exported a .dsl file and it does open up in the software and display what I was seeing so I'm going to attach that instead. It's a 20 second 1 MHz per channel read using a 2.5 volt trigger threshold voltage and instant mode and streaming mode. Radio is a lowband?unit.?
I just finished rebuilding my adapter thingy for EEPROM sniffing and have all the lines labeled. It was giving a fail 84 and it turns out that if anything is wrong as in being plugged in wrong or what not the?EEPROM is easily corrupted, probably the WE being engaged when it shouldn't. It seems to be solid now.
?I'm using a 2k chip so the extra 4 pins are not utilized (24 pin part). Already seeing some interesting things if my connections are correct. It appears it's hitting up the EEPROM every 4.6 milliseconds to grab some data but not all that much data, like 13 or 15 bursts of one bit width of data then it recycles but the patterns are not exactly the same. Write enable does go active quite often as well which is interesting but from what I'm seeing just in looking briefly just now it's not simultaneous to CE of the EEPROM so perhaps it's writing something else....dunno...strange.?
I'm still learning DSView since everything I do involves me doing a cannonbal?into the deepest end then flailing around learning the tools and methods simultaneously. I will try to push out a file here in a bit and anyone should be able to grab DSView since it's free and view it.?
What speed and file size should I use? I am using the DSLogic U3Pro32. Right now I'm just looking at 1 second at 1 Mhz with it sitting on a channel not scanning and zero options enabled, not even PL. I think it's RX 30.000, TX 31.000 TA freq 32.000.?
LOL I just did a 1 Mhz 20 second read and exported to CSV. It created a 1 Gb Excel file. Damn!
On Sat, Aug 6, 2022 at 7:50 AM Skip Hansen < skip@...> wrote: Wow, that screen looks familiar!? But I've never seen so many traces.? I missed the message where you said you were going with the DreamSource box. Now I want to write a disassembler for the 6301, squirrel, hell it's a tree full of them!
Please upload your capture when you get a chance!
73's Skip p.s. That was FAST for a DreamSource ... can I ask where you got it??
On Fri, Aug 5, 2022 at 9:09 PM Casey Crane < ccrane148@...> wrote: Yikes... full live 1 second read zoomed in with one of the channels being chip select. I still need to figure out how to organize and label the channel names (surely I can do that like in Saleae Logic's stuff. Off to RTFM. At least it seems to be working.
|
Re: Has anyone fully decoded the X9000 memory mapping?
I just finished rebuilding my adapter thingy for EEPROM sniffing and have all the lines labeled. It was giving a fail 84 and it turns out that if anything is wrong as in being plugged in wrong or what not the?EEPROM is easily corrupted, probably the WE being engaged when it shouldn't. It seems to be solid now.
?I'm using a 2k chip so the extra 4 pins are not utilized (24 pin part). Already seeing some interesting things if my connections are correct. It appears it's hitting up the EEPROM every 4.6 milliseconds to grab some data but not all that much data, like 13 or 15 bursts of one bit width of data then it recycles but the patterns are not exactly the same. Write enable does go active quite often as well which is interesting but from what I'm seeing just in looking briefly just now it's not simultaneous to CE of the EEPROM so perhaps it's writing something else....dunno...strange.?
I'm still learning DSView since everything I do involves me doing a cannonbal?into the deepest end then flailing around learning the tools and methods simultaneously. I will try to push out a file here in a bit and anyone should be able to grab DSView since it's free and view it.?
What speed and file size should I use? I am using the DSLogic U3Pro32. Right now I'm just looking at 1 second at 1 Mhz with it sitting on a channel not scanning and zero options enabled, not even PL. I think it's RX 30.000, TX 31.000 TA freq 32.000.?
LOL I just did a 1 Mhz 20 second read and exported to CSV. It created a 1 Gb Excel file. Damn!
On Sat, Aug 6, 2022 at 7:50 AM Skip Hansen < skip@...> wrote: Wow, that screen looks familiar!? But I've never seen so many traces.? I missed the message where you said you were going with the DreamSource box. Now I want to write a disassembler for the 6301, squirrel, hell it's a tree full of them!
Please upload your capture when you get a chance!
73's Skip p.s. That was FAST for a DreamSource ... can I ask where you got it??
On Fri, Aug 5, 2022 at 9:09 PM Casey Crane < ccrane148@...> wrote: Yikes... full live 1 second read zoomed in with one of the channels being chip select. I still need to figure out how to organize and label the channel names (surely I can do that like in Saleae Logic's stuff. Off to RTFM. At least it seems to be working.
|
Xcat bootloader source released
For anyone that is interested I've put the source for the Xcat bootloader on github
73's Skip WB6YMH
?
|
I've uploaded the Xcat schematic and bootloader hex file to the file area.
?
This will allow the brave/crazy to build a DIY Xcat.??
?
NB: We missed the need for pullup resistors on A0 to A7 in the original design.??
On a "real" Xcat this was fixed by adding a 2.2K SIP resistor pack on the back?
of the connector (pins 9 to 16).
?
The needed resistors are **NOT** shown on the schematic.
?
73's Skip WB6YMH
|
Re: Has anyone fully decoded the X9000 memory mapping?
Maybe we could start a spreadsheet of the versions and store the hex
> > dumps. > I could probably host this dumped ROM collection. Happy to add others' dumps to this. De
|
Re: Spectra RSS success w/ Win98 and 400 Mhz Celeron!
Well it didn't work on my Pentium II box under XP. The box died
before I could try it from DOS, sigh. Booted ONCE and ran beautifully
(much to my shock) and that was it. Now it just turns off before it
even tries to boot. Power supply issues I expect.
73's Skip
toggle quoted message
Show quoted text
On Sat, Aug 6, 2022 at 3:02 PM Kris Kirby <kris@...> wrote:
On Sat, 6 Aug 2022, Skip Hansen wrote:
Well it took a week of raiding my garage for old PCs, but I
**FINALLY** got RSS for the Spectra to run successfully. IIRC that one is Pentium-safe.
Of course a Spectra is newer than the Syntor X9000 so I don't know if this
box will run the X9000's RSS or not. The X9000 is only really picky for some of the option cards like MDC600.
Otherwise, a 25/50 MHz 386/486 laptop or tablet (e.g. Fujitsu 500) with
a slow CPU mode or low power mode works well for the DOS RSS radios,
control heads, DTMF controller and Siren/PA units.
That said, I have no idea if the X9000E with the trunking controller is
any amount of speed sensitive. Of course, it's impossible to brick an
X9000 because the firmware is EPROM, not EEPROM. The other EEPROM radios
can be bricked.
The Atmel Mega256 does have three serial ports, should it be necessary
to convert from USB to several serial ports.
It is unlikely anyone has the CPUs and firmware to set a radio up as the
second radio. Another idea therein is using the second control head
address (Rear control head).
--
Kris Kirby, KE4AHR
Disinformation Architect, Systems Mangler, & Network Mismanager
|
