Friday, May 24, 2019

CMS SBC ROM Disassembly

Continuing my reverse engineering efforts on my CMS 9619 and 9609 SBCs, I downloaded the ROMs that were still in two of the boards. I inserted the ROMS into an Apple IIe's Super Serial Card (SSC) ROM socket, and transferred the data using the Apple IIe hardware monitor. I used a similar technique previously to program EEPROMs on the Apple IIe. However, since these are 8K ROMs, rather than the SSC's 2K ROMs, I had to solder up a little adapter board with two switches to switch in each 2K bank.

27C64 on adapter in Apple SSC27C64 adapter back side

With the ROM data in hand, I began machine code disassembly. Unfortunately I don't know 6809 assembly code, but with the help of the source code from an earlier version that I found online, I was able to figure out a lot of it. I started a new CMS_SBC GitHub project to keep the code in. It includes a makefile that translates the original Apple IIe monitor dumps into a hex dump, then a binary, then disassembles it.

Also, DaveW was kind enough to scan and post his documents for a CMS 9639 SBC that he has. It is more advanced than the 9609 and 9619 that I have, and includes an MMU. Great information there that I will need to spend some time looking at.

Friday, May 10, 2019

CMS 9619A SBC

I recently came into possession of a CMS 9619A Advanced Single Board Microcomputer. I have been unable to find any authoritative information on the device, but from what I can tell, it appears to be a Programmable Logic Controller for industrial applications. It features:

  • Motorola 6809 processor - 2 MHz MC68B09
  • 3* 6821 PIA - 2 MHz MC68B21
  • 1* 6840 PTM - 2 MHz EF68B40
  • 1* 50 pin header for PIAs
  • 2* 6551A ACIA - S6551A
  • 1* 26 pin header for ACIAs & PTM
  • 5* DIP28 RAM/ROM sockets
  • Motorola "EXORbus" compatible

The board was apparently made by Creative Micro Systems which was based in Los Alamitos, California (thanks for the info DaveW). There are a number of accessory boards available, and even some early MC6800 boards that I have seen. If anyone has more information about the board, please leave a comment!

Consumer retro-computer products are the subject of massive amounts of online data, scanned manuals, and schematics, but industrial controllers have very little information available on them. Probably a lack of nostalgia or general interest combined with continuing trade secrets. But this board looks like a very capable SBC just waiting to be put to good use. So, some reverse engineering is in order. I have been saving my notes in a Google Sheet available for public view.

Serial Terminal

I think that my best chance to figure this thing out is to connect to the serial port and see if there is an interface available there. Unfortunately, the 26 pin header is not a standard DB25 header for a RS232 connection. After much continuity testing, I finished the serial/timer header pinout, which is basically:

             P1 HEADER
              ______
U27-9  CTS2  |1    2|  DCD2 U27-16
U27-11 DTR2  |3    4|  RxD2 U27-12
U26-11 DTR1  |5    6|  DSR2 U27-17
U26-17 DSR1  |7    8|  TxD2 U27-10
U26-12 RxD1  |9   10|  RTS2 U27-8
U26-16 DCD1  |11  12|  TxD1 U26-10
U26-9  CTS1  |13  14|  RTS1 U26-8
       GND   |15  16|  GND
U28-7  C3    |17  18|  GND
U28-6  O3    |19  20|  C1   U28-28
U28-5  G3    |21  22|  O1   U28-27
U28-2  G2    |23  24|  G1   U28-26
U28-3  O2    |25  26|  C2   U28-4 
             |______|

Memory Map

The CMS 6919A has a PAL IC at U12 which decodes the addresses and enables the ROM and I/O ICs at the right time. I don't have the hardware to properly reverse engineer this PAL. But, I don't really need all of the details of the PAL, just the addresses when it enables most of the ICs. I do have an Apple II APIO printer interface card which sports its own 6821 PIA, and a "General" interface to all of the PIA's pins, which should work nicely to help decode it.

I soldered up a small carrier for the PAL and a binary counter IC to deal with the high address lines since I only have 8 output bits, and the PAL accepts 11 address lines (A5-A15). I also needed to add some switches to disable the PAL until the PIA is set up properly to avoid bus contention. Without that, the PAL gets hot! (Notice the brown burn mark on its paper label.) I wrote a BASIC program to run through all the possible address combinations for the PAL inputs, and list the PAL outputs, printing everything out in a nice layout. When an output from the PAL changes, the BASIC program adds a separator to the map and prompts for me to input the name of IC that the corresponding line is connected to.

Next, I had the program (not connected to hardware) run through the various addresses to the secondary decoder (U10) connected to the PAL to make a map of the I/O address space.

After paste-ing the files side-by-side on my Mac, here are the results:


                  MEMORY MAP                            I/O MAP
         |____________________________|          |____________________________|
0000:    |                            | FFC0:    |                            |
         |        > RAM               |          |        > U12 PAL DECODER   |
         |                            |          |____________________________|
         |                            | FFC4:    |                            |
         |_  _  _  _  _  _  _  _  _  _|          |        > U31 6821 PIA      |
         |                            |          |____________________________|
         |                            | FFC8:    |                            |
         |                            |          |        > U30 6821 PIA      |
         |                            |          |____________________________|
         |_  _  _  _  _  _  _  _  _  _| FFCC:    |                            |
         |                            |          |        > U29 6821 PIA      |
         |                            |          |____________________________|
         |                            | FFD0:    |                            |
         |                            |          |        > U27 6551 ACIA     |
         |_  _  _  _  _  _  _  _  _  _|          |____________________________|
         |                            | FFD4:    |                            |
         |                            |          |        > U26 6551 ACIA     |
         |                            |          |____________________________|
         |                            | FFD8:    |                            |
         |_  _  _  _  _  _  _  _  _  _|          |        > U28 6840 PTM      |
         |                            |          |____________________________|
         |                            | FFDC:    |                            |
         |                            |          |        > U28 6840 PTM      |
         |                            | FFDF:    |____________________________|
         |____________________________| 
A000:    |                            |               \                   /
         |        > U17 ROM           |                \_________________/
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
C000:    |                            |                         |
         |        > U13 ROM           |                         |
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
E000:    |                            |                         |
         |        > U7 ROM            |                         |
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
FF80:    |                            |                         |
         |        > FREE              |                         |
         |____________________________|                         |
FFC0:    |                            | \                       /
         |        > I/O               |  |_____________________/
         |____________________________| /
FFE0:    |                            | 
         |        > U7 ROM            | 
FFFF:    |____________________________| 

The map is upside-down due to how the counter IC increments, but still very helpful. Also, I'm not sure why the U20 socket isn't being addressed. It would make sense if it were in the $8000-$9FFF range though. Maybe a bad solder joint, or it is enabled by one of the other PAL connections that I was not sure how to simulate. Note that the $FFC0-$FFC3 range of the I/O decoder loops back to the PAL, which could then potentially enable something there.

PAL Mapper on the Apple //e PAL interface circuit board
APIO card connected to PAL interface circuit board PAL Running in the Apple IIe