Help reading EPROM (Intersil IM6654A) and analyze firmware

I now have successfully dumped all 8 2708 EPROMs of my FESTO programming device.
Interpreting that firmware is another thing. I haven’t found any text although the device is able to disassemble and put out the mnemonics.
I’ve checked ASCII, EBCDIC and early IBM encodings (6/8-bit BCD etc) like in Rob Storey’s/Paul Pierce’s FILEUTIL/ FILEBROWS. I think, I’ll make a detailed thread about that later, I also have to recheck the manual and convert to octal words or to 12/14 bits. I found some firmware analyzing tools like BINWALK, but haven’t tested them, yet. Maybe it needs to be converted to Intel Hex or similar or it’s encrypted. I found a converter for BIN files on sourceforge for Siemens Step 5 (but probably not compatibel).

There’s another, single 4K EPROM from Intersil on the lower PCB (left on my photo). IM6654A (CMOS 512x8).
I have the Arduino programmer which can only read (and write) 2708 and MCM68764 as described by Matt Millman.
Programming the Intersil is definitely not possible (Vpp -40 V). But maybe reading?
I’ve read the EPROM datasheets and I think it’s not possible, maybe someone can confirm it. Intersil chips were (also) made by Harris.
The 2708 specs has at Vss -5V and VDD +12 V, so I think that’ll not work.
The MCM68766 has VCC 4.5-5.5 V (AC or DC?). There’s a different PIN assignment but that is changed via a switch as well.

The Intersil EPROM needs 10V as it’s IM6654A (IM6654 needs 5 V).
The DC characteristics: VCC=VDD=4.5-10.5 V
The AC characteristics: 10 V ±5%
I know it’s alternating/direct current, but what is used here when reading? I would say direct.
I haven’t checked the timing. But the main question next to the voltage is the PIN assignment what is almost like the 2708. It’s also a different size.

If possible, I want to use the same programmer and not alter it, in case I want to read or write 2708 again.
Due to the location of the EPROM in the FESTO device, I assume i/o functions (memory cartridge/teletype/tape), so not that important.

Regarding character strings, I’d expect some packed format (like 2 × 6bit). But you’ve probably thought of this, already.
As the I/O utilizes a PDP-8-like processor (if I recall this right), it may well be that this uses a format more common on the PDP-8. (Compare the Small Computer Handbook.)

I just looked at an Intersil data book, I think you’re confusing AC response with AC supply voltage. It looks like you can run that chip just fine on a +5 V supply (the ratings seem to accept any supply from +4.5 to +10.5 V for the A part). The AC characteristics table on the same page that lists 10 V +/- 5% is referring to a DC supply voltage of 10 V exhibiting the AC response/setup/hold/etc. times listed in the table. In other words, for example, at a 10 V DC supply voltage, changing the output enable pins will take a maximum of 60 ns for the AI part. Likewise, you must hold the chip enable line stable for 60 ns before expecting the device to respond according to specifications.

I don’t think you’ll have any trouble reading this part with an Arduino, I don’t know about your specific programmer. My guess is that you can make it work. You can almost certainly do it on a breadboard with a generic Arduino or other 5V-tolerant microprocessor board.

1 Like

Dumping: Yes, it’s somehow possible. But my skills are limited and I don’t want to spend more money. And I would also need a working code.
So the question was if it’s possible to dump with the existing programmer. So if it can be dumped like a 2708 or MCM68764 or with very few alterations.

An easy to build programmer for 2704 / 2708 / MCM68764 / MCM68766 EPROMs – Matt's Tech Pages

Firmware: Yes it has a PDP-8 like 12-bit Intersil 6100 CPU.
For disassembling to mnemonics someone obviously needs a printer and that is probably controlled by the single Intersil EPROM. So probably there’s the text. BTW. In the manual is a photo of a printout showing address, binary code, mnemonics and a long text with descriptions of the devices. I haven’t found the way to attribute device names to numbers in the manual.

I found one case of BCD data encoding. It’s a bit complicated, so I have to give some backgrounds.

The bus is 16 bits wide. Bits 16+15: The device can handle 4 types of data: 00 “neutral”, 01 octal, 10 decimal, 11 not used (reserved for code), remaining 14 bits are data.
Every instruction, operand and device has a “functional unit number”.
Most of the programming details are about the CPU card of the main PLC. There are no details about programming this programming device.

I found a table of character encoding in how to program the display of the CPU card (which has the same style of display like the programming device).
BCD packed (2x4) using the right 8 bits or 12 bits, depending on the data type and position of the display. The display has mainly 4 positions

xx xxxx
xx xxx

The upper right position can only display octal values, the others can display octal and decimal values and special characters.
The table (2 digits, and only for octal/neutral values) showing the combination of left and right digit (0-9, blank, F, _, E). Both values are added giving a 4 digit octal value.
Each display position has a different unit number/instruction. The programming is as usual IF/THEN (then load display pos 3 with octal value xxxx).
There are some examples. Decimal values are loaded directy (another instruction).

Instructions have 6 digits (octal). The left digit is only 0/1 and for in addition, then, else. The 2nd digit (0-7) is the command, check signal 0/1, delete, set, load, with, with address, with decimal. The other 4 digits are the function unit/device/adress/decimal.

At least the PLC has an additional 1-Bit CPU for flags “Merker”, AND, OR, brackets, etc. But the programming device also can input brackets. And check the code for errors, so maybe has another “CPU” as well.

Here is the beginning of EPROM 1

13 3D 18 3F 03 13 07 0D 13 26 13 33 0A 04 08 18 07 20 18 0B 39 0A 28 09 13 15 25 13 3D 03 3F 36 03 06 00 13 07 0D 13 2A 13 28 1A 1E 20 35 15 1A 2C 0F 28 33 0C 0F 05 1A 0C 3F 28 02 1D 24 0B 0A 02 04 13 32 38 3B 30 0A 00 37 20 00 20 34 3A 23 15 23 3E 30 00 24 13 25 30 28 19 30 14 32 13 08 10 0A 1F 3D 1F 23 10 15 11 01 07 11 20 10 11 10

I haven’t found it (in octal) as PDP-8 code. Not sure if code starting at 0. Some chapters and the appendixes are missing on the huge PDF. The device also has to control the keys, display, error handling,… When turning on there’s a self test and search for available memory cartridge and check if a PLC is connected. If both is not present, an error code is given. It has to control the i/o devices (different baud settings). But mainly store and check the code.

I tried to find PDP-8 disassembler or converter tools. I first found d8tape (the 3rd version finally could be compiled, on 32 bit only). Can open .BIN and .RIM files, but my file is not recognized as valid file (missing header/trailer/leader).
I found a very good online emulator, where you can just drag and drop a file without having to import other tapes like an OS, so much easier than SIMH. The file is immediately disassembled, but my file is again not valid. So maybe I have to convert to 12 bit or construct a header.

https://pop.aconit.org/

As it’s unclear where is code, I would need a software crawling for PDP code at every location or even converts to other formats.
I also found special Intersil patches for SIMH, tools and docs on Spare Time Gizmos, SBC6120, emulator WinEight and Windows Tool (not run on modern Windows). I haven’t tested that one, but I doubt that it will work.

http://www.sparetimegizmos.com/Hardware/SBC6120_Builders.htm

On github (mengstr/pdp8-tape2bin) I found the other way, converting a bin/rim tape to plain binary.

The PDP .BIN files are papertape images with a header and are not exactly the same as the plain ROM bin image. I first haven’t found converters (for 12 bit etc.), so I have converted my file to octal via an Hex editor and exported as text. Then I have manually converted it to 12 bit.

The tape2bin from the github has no sources. It’s for converting and burning an EPROM.
It also has another tool (tapedump) which converts my file correctly to 12 bit octal. The tools are for the simple command-line emulator pdp8emu

That has sources and includes a disassembler. The emulator works but needs papertape images. I have manually disassembled the beginning of my file.

Later, I have constructed a header and footer 16x80h each and 2 bytes before the beginning. And now this is a working papertape bin. On the online emulator it disassembles as follow (similar like my attempt).

00000 2375 S< | a0, ISZ M175
00001 3077 X> | a1, DCA M77
00002 0323 CS | a2, AND M123
00003 0715 GM | a3, AND I M115
00004 2346 S& | a4, ISZ M146
00005 2363 S2 | a5, ISZ M163
00006 1204 JD | a6, TAD M4
00007 1030 HX | a7, TAD M30
00010 0740 G | a10, AND I M140
00011 3013 XK | a11, DCA M13
00012 7112 8J | a12, CLL
00013 5011 (I | a13, JMP .-2
00014 2325 SU | a14, ISZ M125
00015 4523 %S | a15, JMS I C123
00016 7503 <C | a16, OPR 0503
00017 7766 >5 | a17, SMA SZA SNL CLA OSR HLT
00020 0306 CF | a20, AND M106
00021 2307 SG | a21, ISZ M107
00022 1523 MS | a22, TAD I M123
00023 5223 *S | a23, JMP .
00024 5032 (Z | a24, JMP .+6

The first word (2375, address?) and the following code seem not plausible to me. The 7766 at 00017 looks more like an address. The characters are also different than in an Hex editor.

2 of my 8 EPROMs have short empty sections 128 bytes each (FF/3FF), probably bad dumps, the disassembler stops with an error. I have to continue for the rest/replace the empty bytes with NOP. But I think both aren’t code segments. I think data, but not text.
The display table must also be saved somehow. I have to compare it with the manual.

d8tape now works after fixing my file and adding the correct checksum (before the trailer). There first were some issues, I had to change the checksum twice and reconvert the bin with option -b.
The 2 pass disassembly is much better and detects code and data areas etc.
Still hard to analyze.
I also did a single step run on the online emulator and manually wrote down MB and AC contents. The PDP-8 code seems valid. The first subroutine/start of code is at 0712.

The simple pdp8emu should have tracing of runs with disassembly and registers, but it crashed (at least on 64 bit). I also tried SIMH. The disassembly is simple, 1 pass. The run halts after one instruction. But I will continue (trying tracing, starting at other addresses, etc).

Text characters are in octal but I forget that they are 12-bit as well. So ‘A’ is 00 001.
There’s also a different encoding TSS/8 sixbit. I have converted to both but haven’t found any mnemonics.

1 Like

Tracing in SIMH should work (breakpoints and CPU history), but I found another way. Maybe it helps other PDP-8 fans.
Disassembling and tracing in pdp8emu now works. It previously crashed as the format/opcodes were wrong.
The dumped bin file (regular papertape bin files must have the leader removed) has to be converted to “plain bin” .EEP (eprom) format with pdp8-tape2bin.
I think this “core file” is a variant of Charles Lasner’s .IPL file format as described in the original emulator pdp8e by Douglas W. Jones. There are samples but documentation is very short and I first haven’t checked the source of the original emulator.

My dumped ROM (hex)
13 3D 18 3F 03 13 07 0D 13 26 13 33 0A 04 08 18 …
023 075 030 077 003 023 007 015 … same but octal (16 bit, see instructions below)
2375 3077 0323 … octal 12 bits
FD 04 3F 06 D3 00 CD 01 E6 04 F3 04 84 02 18 02 (.EEP format) the interpreted values are the above octal ones in the emu.

The tracing works with t,amount of instructions, and looks like this (incl descriptions), on left the PC (first values are probably not opcodes)

[0000] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:2375 ISZ @@75   ;Increment operand and skip if zero, Current page @@75
[0001] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:3077 DCA 0077   ;Deposit AC to memory then clear AC, ZP 0077
[0002] IRQ,DLY,IE=0,1,0 L/AC:0/0000 MQ:0000 IR:0323 AND @@23   ;AND operand with AC, Current page @@23
...
[0426] IRQ,DLY,IE=0,0,0 L/AC:1/2060 MQ:0000 IR:3120 DCA 0120   ;Deposit AC to memory then clear AC, ZP 0120
[0427] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:0271 AND @@71   ;AND operand with AC, Current page @@71
[0430] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:6371 GRSF       ;BB08-P: Skip on Receive Flag
[0431] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:4624 JMS I @@24 ;Jump to subroutine Indexed Current page @@24
[2251] IRQ,DLY,IE=0,0,0 L/AC:1/0000 MQ:0000 IR:0000 AND 0000   ;AND operand with AC, ZP 0000 
..

There’s a loop in between around 3 subroutines, around 40 instructions. Maybe checking or waiting for input. I have to check starting at other addresses.
The disassembly is even better than d8tape and has PDP-8/E instructions including the BB08 interface unit.

Now I found in my manual (service functions/system memory of the main PLC, not working on my device), that there are 4 pairs or ROMs. So maybe the data is an alternate mix of 2 ROMs (odd/even).
There are 2 shared memory locations for each ROM pair with (differently stored) date/month and year. I have a sticker of my ROM version date but I haven’t found that value. The year of the 4th pair is at 7776. Would be year 2393 (dec).

After setting back the EPROMS in my device, I have again checked it. (No checksum errors of bad dumps).
It’s possible to input lines of code (function keys or octal) without having errors displayed.
But I can’t read (or move) the memory contents later (due to the missing RAM cartridge).
I found schematics of the connectors but there are many parts on the cartridge, so that is impossible to be identified with a self-built one.
Import via teletype or cassette is according the manual not possible without RAM, probably same as export/ printing (line by line).
Test and simulation functions only work with the main PLC. Like for testing a single device attached to the PLC. Maybe my device is mainly used for that purpose.

Wow, you dived quite deep into this with some perserverance. It looks like you could make at least some sense of this. However, what are we supposed to understand of time travelling code from 2393? John Titor to the help! :slight_smile:
(I guess, the good news is that we are not going to fall for the great filter for another 371 years. :slight_smile: )

Yes, I don’t give up early (I’m German). I try to learn as much as possible for my purchased items.
The manual is detailed, but some parts are still unclear, especially of the main PLC or disassembling to printer and what is stored where and how.
I think I will study the code for some more few weeks. I’m still at the beginning.

Today I’ve started to check for differences between PDP-8 and original 6100 code (SBC6120 sources) before continuing the PDP-8 disassembly.
I still assume the more important code (I/O) on the undumped Intersil EPROM.
It’s still unclear what is on the 8 EPROMs. Maybe just keyboard and display handling.
Error handling must also be stored somewhere like when entering a wrong operand on instruction xy.
I assume that some few instructions are only stored on the CPU card of the PLC. But probably mostly the same code on both. Also unclear is the 2nd 1-Bit CPU and that code. Maybe I have this as well.

I have studied some sample files with source codes like the CHEKMO Chess game to find out how data and texts are stored on a PDP-8. There’s only one character stored in a 12-bit word. I wonder about the waste of space (the other byte could be used for underline or blink, but rarely used)
The online emulator prints out character representations (unlike the other disassemblers), so the text can be read on the right column vertically.

On Stack Exchange, I even found 5 different ways of storing texts. interesting is the 3/2 packing (3 chars per 2 words)

I could even think of some more like byte order reversal, compression/encryption, look-up tables, etc. So there are ~10.

There should have been special Hex editors for paper tapes, but I haven’t found any.
Octal is nothing special but 12 bit and then 6 bit and other types.
Maybe I will code a converter myself.

I have checked again my file but still couldn’t find any text. I bet, it’s on the single undumped EPROM.
I detected some data sections, maybe for the LCD output, but needs more investigation.

I could make a simulator for my device, but for an exact emulation, especially for the main PLC, there are still many questions, eg. the 14-bit registers, 2nd 1-bit CPU, i/o etc.

I also found a demo IDE for Siemens Simatic S5/S7 with automatic conversion of instructions and symbolic diagram tree and vice versa. So you can draw the block diagram “Kontaktplan” same like on my Festo, and the instructions are shown. Very complex and hard to use.

Octal and 12-bit computing is very interesting.

Don’t forget RADIX 50 packing, That is 3 letters
" ABCDEFEGHIJKLMNOPQRTSUVWXYZ0123456789$_,"
packed per 16 bits or 2 letters and a flag for 12 bits.

I strongly recommend sticking to octal, because this how people thought and how it is in any documentation. And 12 is just 14 (as in 0000…7777), anyways. :slight_smile:

Yes of course in octal. I think all Hex editors are called like this even when not using Hex values.
(I sometimes have to convert to hex though to find something in my EPROM hex dumps. And the device can handle decimal values (although they are stored as octal). Some values are packed as BCD. So there must be conversions.)

Thanks for RADIX 50. According Wikipedia it was not used on PDP-8.
There are also several other 6-bit encodings like several BCD, SCUOZE, Transcode, FIELDATA and maybe more (most are unlikely though). I have checked almost all of them but still no result.

I found some interesting data sections. Like 53 words. The 2nd byte is always 00. Word 54 is 1234.

4600
4600
3600
1200
0200
2200

But there are just 45 instructions. I have to check how many error codes and the like there are to check out what data might be. Conversion to magnetic (audio) tape must also be stored somewhere.

As I haven’t found useful text or data and I read, that on the PLC dates/checksums are stored in paired ROMs, I now have byte merged my 8 ROMs into 4 pairs (with epromhexxer), so alternate bytes from ROMs 1+2, 3+4 etc (low&/hi, odd even). Now I have a new code, which looks (much) more plausible for several reasons.

I don’t have the empty sections (FFFF, but xxFF), assumed to be bad dumps, and so there are no errors. d8tape now prints all code, around twice as much code and data than before. The first word is now the start address, confirmed to be true on a trace run.

I still haven’t found mnemonics as text but still assume them on the undumped ROM.
The online emulator still showing errors on these ROM sections although replaced with NOPs and set to model 8/E and more RAM.

I have made a custom character set in Hex editor “010” to display the correct Sixbit character set representations instead of ASCII.
The output surprisingy can’t be exported.

For better reading and saving, I wrote some code for converting and extracting just characters A-Z (no need for converting hex to octal and sixbit, just add 64 to a character’s value and make sure to just read values from 01-26 before).

Export to printer (teletype) starts with /S. I found that followed by @@ on the new file (at 1165). I found that once on my old file (at 0373) but without link to that (yet tested on the incomplete online emu). As my device doesn’t display text (except F, E) I have to focus more on data regions.

I found some details about the system test of the main PLC (RAM test, ROM test, checksums, error codes etc). Maybe my device also have a system test, but I haven’t found checksums or date/year at the end as described.
As said, the device is for programming and testing the PLC and not itself.