Restoring another PDP-11/04
Translation of the article on the restoration of another PDP-11/04. The last trilogy can be read here - part 1 (PDP-11/04 itself), part 2 (TU60 tape station), part 3 (terminal LA30). Italic my comments.
We received this device from Gunnar Barbro, and with him came a bunch of different goodies for the PDP-11. But the state of the computer itself was far from perfect. There was a shortage of processor and memory boards, the power switch was replaced by a new version, and everything was terribly dusty. A KY11-LB, XY11 programming console board (a module for controlling a plotter, for example IBM 1627, which was delivered with DEC machines, and was canonical CalComp 565 ), KW11-P ( a programmable RTC module, yes ) were connected to the backplane. yes, there was a whole board under the RTC! ), the main board RK11-D with a set of modules (a controller for magnetic disk drives, it was a set of cards (3 or 4 pieces) combined with a common board ), and DR11-B (a DMA controller, which , again, consisted of several boards: M7194, M971, M5916, M7820, ... ), also with all modules.
')
We disassembled the computer into parts and gently washed them with soap, and then blew the compressor dry. After drying, they are collected in a single unit. During these procedures, rust spots were found here and there.
Of course, nothing worked even when we connected the processor and memory boards taken from our stocks! The console was dead. If at first we could dial digital codes, and they were displayed on the console (a seven-segment six-digit indicator ), then after some time the situation worsened, and this opportunity was gone.
The KY11-LB is a very interesting option available for the PDP-11/04 and PDP-11/34. You can not only turn on and off the CPU, debug the code, view and change the memory, thus bringing programs and data into the machine, but also use the service mode, in which step-by-step debugging of the processor's microcode is available! This feature is provided by connecting a pair of loops to the processor module. But if the processor is missing or frozen, KY11-LB allows you to work with Unibus (a bus connecting modules in many DEC computers ) without CPU involvement. This is realized due to the presence of its own microprocessor i8008. In the photo below I circled it in red. And this is great news if you need to check the performance of the bus itself or to conduct simple tests of memory and I / O boards. When a non-existing destination is requested, the BUS ERR light comes on. Jörg Hoppe wrote an excellent document on the use of KY11-LB.
Having connected the logic analyzer, I checked that the 8008 on the M7859 (KY11-LB) is working normally and is running the recorded program correctly. But the code believed that no one presses any keys ... It turned out that all CLR signals ( clear, signal to clear the register ) for the output registers were active. The unibus bus controller that processed the DCLO signal (the signal on the Unibus bus that informs that the DC voltage is too low ) is buggy. Several open-collector buffer drivers and register microcircuits were faulty. As soon as I replaced them, the console came to life! But again there was a failure after starting the processor and testing the diagnostics of its functionality. And twice. The first is an error in the M9301 boot boot. The 8th bit on the data bus was the last available for the bus driver. He could not read enough data from the bus. The second time the processor simply hung. Nothing was put on the address bus, and studying the microcode showed that the plug-in happened while trying to capture the bus. The processor started working only after I took out the M7859 ( KY11-LB ). It turned out that the M7859 generated a 9 MHz signal BBSY on the Unibus bus ( Bus Busy, in the active state it signals that the signals D0-D15 (the requested data was being sent) were used by someone ). Why? One trigger 7474 broke and oscillated like crazy. After its replacement, diagnostics of the processor and memory was successful!
In the PDP-11/04, the M9301-YB is a primary load module and terminator. The PROM of the board stores the console emulator and boot code for several common devices. In order for the processor to start execution right away from the boot area in the PROM, the module generates a special address 0173000 on the bus ( 300ms pulse using multivibrator 9602 ) ( often the octal number system is used for pdp, so the zeros at the beginning of the numbers are not CC ), and the processor requests the address of the resumption of work after a power failure, putting on the Unibus-bus address 024/026 ( at the first address MMIO-register, which is a PC, on the second - PSW, processor status word, various flags and processor status ) . As a result, there is a request for data on the bus at addresses 0173024 and 0173026. For cell 0173024, M9301 finds a correspondence between the set of values of microswitches ( in the photo - 10 central units on the right in the center ) and the data in the PROM. These switches, in fact, determine from which address in space 0173xxx the processor will begin execution. I dumped four PROM chips - 23-038A9 , 23-039A9 , 23-040A9 and 23-041A9 . Since M9301-YB inverts some bits to support the possibility of disjunction of the board switches with external signals ( in the photo are contacts TP1 / TP2 / TP3, their OR values are with the values of microswitches on the board, for example, TP1 is associated with S1 and S2 ), a small program that combines these four files into a single binary . Having done only the initial analysis of the disassembled listing, I, nevertheless, have already noticed that the code is very similar to the PROM from M9301-YA, except that the code blocks are scattered at different addresses.
To run each of these programs need the appropriate procedure in the code of the primary loader. Usually, such procedures are carried out in a separate PROM chip, the execution of the code from which occurs when certain characters are typed in the console emulator. But this machine is equipped with the M9201-YB board, which does not contain the primary DU loader ( DEC has very informative names, DU is a bootloader from media through MSCP (MSCP is a communication protocol with drives, such as ATAPI) ). Therefore, I had to hammer this bootloader manually (the console emulator, which is part of this module, supports 4 functions - loading address L, reading memory at address E, writing at address D, starting execution S, and this allows you to enter the code manually. Sequence teams of type L 016000, D XXXXXX, D XXXXXX, ..., S 16002 ). It was not easy to find a suitable working bootloader, but I still got one in the source code of SimH ( emulator of various ancient systems ). With the help of PDP11GUI , I threw a small file into the memory of the machine. And it works (at least in most cases).
Dump this MSCP bootloader:
Start filling the memory with 016000, and execution with 016002 ( 0x4455 - magic word ).
After that, I tried to run a disk image with XXDP v2.2. But, alas, there was no success. The XXDP command line appeared, but any commands that worked on the disk, such as "D" ( get the list of files on the loaded media ), ended with an error in the console "? RD ERR". It looks as if the program can not access the disk. Therefore, I checked a small RT11 distribution ( real-time operating system for PDP-11 ). Created a disk image with version 5.3 and tried to run. And everything went great! You can play Adventure or program on BASIC'e!
PDP-11/04, sent by Gunnar
We received this device from Gunnar Barbro, and with him came a bunch of different goodies for the PDP-11. But the state of the computer itself was far from perfect. There was a shortage of processor and memory boards, the power switch was replaced by a new version, and everything was terribly dusty. A KY11-LB, XY11 programming console board (a module for controlling a plotter, for example IBM 1627, which was delivered with DEC machines, and was canonical CalComp 565 ), KW11-P ( a programmable RTC module, yes ) were connected to the backplane. yes, there was a whole board under the RTC! ), the main board RK11-D with a set of modules (a controller for magnetic disk drives, it was a set of cards (3 or 4 pieces) combined with a common board ), and DR11-B (a DMA controller, which , again, consisted of several boards: M7194, M971, M5916, M7820, ... ), also with all modules.
')
Cleaning
We disassembled the computer into parts and gently washed them with soap, and then blew the compressor dry. After drying, they are collected in a single unit. During these procedures, rust spots were found here and there.
Build and validate
Of course, nothing worked even when we connected the processor and memory boards taken from our stocks! The console was dead. If at first we could dial digital codes, and they were displayed on the console (a seven-segment six-digit indicator ), then after some time the situation worsened, and this opportunity was gone.
KY11-LB
The KY11-LB is a very interesting option available for the PDP-11/04 and PDP-11/34. You can not only turn on and off the CPU, debug the code, view and change the memory, thus bringing programs and data into the machine, but also use the service mode, in which step-by-step debugging of the processor's microcode is available! This feature is provided by connecting a pair of loops to the processor module. But if the processor is missing or frozen, KY11-LB allows you to work with Unibus (a bus connecting modules in many DEC computers ) without CPU involvement. This is realized due to the presence of its own microprocessor i8008. In the photo below I circled it in red. And this is great news if you need to check the performance of the bus itself or to conduct simple tests of memory and I / O boards. When a non-existing destination is requested, the BUS ERR light comes on. Jörg Hoppe wrote an excellent document on the use of KY11-LB.
Having connected the logic analyzer, I checked that the 8008 on the M7859 (KY11-LB) is working normally and is running the recorded program correctly. But the code believed that no one presses any keys ... It turned out that all CLR signals ( clear, signal to clear the register ) for the output registers were active. The unibus bus controller that processed the DCLO signal (the signal on the Unibus bus that informs that the DC voltage is too low ) is buggy. Several open-collector buffer drivers and register microcircuits were faulty. As soon as I replaced them, the console came to life! But again there was a failure after starting the processor and testing the diagnostics of its functionality. And twice. The first is an error in the M9301 boot boot. The 8th bit on the data bus was the last available for the bus driver. He could not read enough data from the bus. The second time the processor simply hung. Nothing was put on the address bus, and studying the microcode showed that the plug-in happened while trying to capture the bus. The processor started working only after I took out the M7859 ( KY11-LB ). It turned out that the M7859 generated a 9 MHz signal BBSY on the Unibus bus ( Bus Busy, in the active state it signals that the signals D0-D15 (the requested data was being sent) were used by someone ). Why? One trigger 7474 broke and oscillated like crazy. After its replacement, diagnostics of the processor and memory was successful!
M9301-YB
In the PDP-11/04, the M9301-YB is a primary load module and terminator. The PROM of the board stores the console emulator and boot code for several common devices. In order for the processor to start execution right away from the boot area in the PROM, the module generates a special address 0173000 on the bus ( 300ms pulse using multivibrator 9602 ) ( often the octal number system is used for pdp, so the zeros at the beginning of the numbers are not CC ), and the processor requests the address of the resumption of work after a power failure, putting on the Unibus-bus address 024/026 ( at the first address MMIO-register, which is a PC, on the second - PSW, processor status word, various flags and processor status ) . As a result, there is a request for data on the bus at addresses 0173024 and 0173026. For cell 0173024, M9301 finds a correspondence between the set of values of microswitches ( in the photo - 10 central units on the right in the center ) and the data in the PROM. These switches, in fact, determine from which address in space 0173xxx the processor will begin execution. I dumped four PROM chips - 23-038A9 , 23-039A9 , 23-040A9 and 23-041A9 . Since M9301-YB inverts some bits to support the possibility of disjunction of the board switches with external signals ( in the photo are contacts TP1 / TP2 / TP3, their OR values are with the values of microswitches on the board, for example, TP1 is associated with S1 and S2 ), a small program that combines these four files into a single binary . Having done only the initial analysis of the disassembled listing, I, nevertheless, have already noticed that the code is very similar to the PROM from M9301-YA, except that the code blocks are scattered at different addresses.
Launch RT11SJ and XXDP V2.2
To run each of these programs need the appropriate procedure in the code of the primary loader. Usually, such procedures are carried out in a separate PROM chip, the execution of the code from which occurs when certain characters are typed in the console emulator. But this machine is equipped with the M9201-YB board, which does not contain the primary DU loader ( DEC has very informative names, DU is a bootloader from media through MSCP (MSCP is a communication protocol with drives, such as ATAPI) ). Therefore, I had to hammer this bootloader manually (the console emulator, which is part of this module, supports 4 functions - loading address L, reading memory at address E, writing at address D, starting execution S, and this allows you to enter the code manually. Sequence teams of type L 016000, D XXXXXX, D XXXXXX, ..., S 16002 ). It was not easy to find a suitable working bootloader, but I still got one in the source code of SimH ( emulator of various ancient systems ). With the help of PDP11GUI , I threw a small file into the memory of the machine. And it works (at least in most cases).
Dump this MSCP bootloader:
0016000 042125 012706 016000 012700 000000 012701 172150 012704 0016020 016162 012705 004000 010102 005022 005712 100001 000000 0016040 030512 001773 012412 006305 100370 105714 001434 012702 0016060 007000 005022 020227 007204 103774 112437 007100 110037 0016100 007110 112437 007114 112437 007121 012722 007004 010522 0016020 012722 007104 010512 024242 005711 005712 100776 005737 0016040 007016 001743 000000 005011 005003 012704 016020 005005 0016060 005007 100000 007204 000000 000001 004420 020000 001041 0016200 000000 Start filling the memory with 016000, and execution with 016002 ( 0x4455 - magic word ).
After that, I tried to run a disk image with XXDP v2.2. But, alas, there was no success. The XXDP command line appeared, but any commands that worked on the disk, such as "D" ( get the list of files on the loaded media ), ended with an error in the console "? RD ERR". It looks as if the program can not access the disk. Therefore, I checked a small RT11 distribution ( real-time operating system for PDP-11 ). Created a disk image with version 5.3 and tried to run. And everything went great! You can play Adventure or program on BASIC'e!
Source: https://habr.com/ru/post/390793/
All Articles