Friday, May 10, 2019

CMS 9619A SBC

I recently came into possession of a CMS 9619A Advanced Single Board Microcomputer. I have been unable to find any authoritative information on the device, but from what I can tell, it appears to be a Programmable Logic Controller for industrial applications. It features:

  • Motorola 6809 processor - 2 MHz MC68B09
  • 3* 6821 PIA - 2 MHz MC68B21
  • 1* 50 pin header for PIAs
  • 1* 6840 PTM - 2 MHz EF68B40
  • 2* 6551A ACIA - S6551A
  • 1* 26 pin header for ACIAs & PTM
  • 5* DIP28 RAM/ROM sockets
  • Motorola "EXORbus" compatible

The board was apparently made by Creative Micro Systems which was based in Los Alamitos, California (thanks for the info DaveW). There are a number of accessory boards available, and even some early MC6800 boards that I have seen. If anyone has more information about the board, please leave a comment!

Consumer retro-computer products are the subject of massive amounts of online data, scanned manuals, and schematics, but industrial controllers have very little information available on them. Probably a lack of nostalgia or general interest combined with continuing trade secrets. But this board looks like a very capable SBC just waiting to be put to good use. So, some reverse engineering is in order. I have been saving my notes in a Google Sheet available for public view.

Serial Terminal

I think that my best chance to figure this thing out is to connect to the serial port and see if there is an interface available there. Unfortunately, the 26 pin header is not a standard DB25 header for a RS232 connection. After much continuity testing, I finished the serial/timer header pinout, which is basically:

             P1 HEADER
              ______
U27-9  CTS2  |1    2|  DCD2 U27-16
U27-11 DTR2  |3    4|  RxD2 U27-12
U26-11 DTR1  |5    6|  DSR2 U27-17
U26-17 DSR1  |7    8|  TxD2 U27-10
U26-12 RxD1  |9   10|  RTS2 U27-8
U26-16 DCD1  |11  12|  TxD1 U26-10
U26-9  CTS1  |13  14|  RTS1 U26-8
       GND   |15  16|  GND
U28-7  C3    |17  18|  GND
U28-6  O3    |19  20|  C1   U28-28
U28-5  G3    |21  22|  O1   U28-27
U28-2  G2    |23  24|  G1   U28-26
U28-3  O2    |25  26|  C2   U28-4 
             |______|

Memory Map

The CMS 6919A has a PAL IC at U12 which decodes the addresses and enables the ROM and I/O ICs at the right time. I don't have the hardware to properly reverse engineer this PAL. But, I don't really need all of the details of the PAL, just the addresses when it enables most of the ICs. I do have an Apple II APIO printer interface card which sports its own 6821 PIA, and a "General" interface to all of the PIA's pins, which should work nicely to help decode it.

I soldered up a small carrier for the PAL and a binary counter IC to deal with the high address lines since I only have 8 output bits, and the PAL accepts 11 address lines (A5-A15). I also needed to add some switches to disable the PAL until the PIA is set up properly to avoid bus contention. Without that, the PAL gets hot! (Notice the brown burn mark on its paper label.) I wrote a BASIC program to run through all the possible address combinations for the PAL inputs, and list the PAL outputs, printing everything out in a nice layout. When an output from the PAL changes, the BASIC program adds a separator to the map and prompts for me to input the name of IC that the corresponding line is connected to.

Next, I had the program (not connected to hardware) run through the various addresses to the secondary decoder (U10) connected to the PAL to make a map of the I/O address space.

After paste-ing the files side-by-side on my Mac, here are the results:


                  MEMORY MAP                            I/O MAP
         |____________________________|          |____________________________|
0000:    |                            | FFC0:    |                            |
         |        > RAM               |          |        > U12 IRQ VECTOR    |
         |                            |          |____________________________|
         |                            | FFC4:    |                            |
         |_  _  _  _  _  _  _  _  _  _|          |        > U31 6821 PIA      |
         |                            |          |____________________________|
         |                            | FFC8:    |                            |
         |                            |          |        > U30 6821 PIA      |
         |                            |          |____________________________|
         |_  _  _  _  _  _  _  _  _  _| FFCC:    |                            |
         |                            |          |        > U29 6821 PIA      |
         |                            |          |____________________________|
         |                            | FFD0:    |                            |
         |                            |          |        > U27 6551 ACIA     |
         |_  _  _  _  _  _  _  _  _  _|          |____________________________|
         |                            | FFD4:    |                            |
         |                            |          |        > U26 6551 ACIA     |
         |                            |          |____________________________|
         |                            | FFD8:    |                            |
         |_  _  _  _  _  _  _  _  _  _|          |        > U28 6840 PTM      |
         |                            |          |____________________________|
         |                            | FFDC:    |                            |
         |                            |          |        > U28 6840 PTM      |
         |                            | FFDF:    |____________________________|
         |____________________________| 
A000:    |                            |               \                   /
         |        > U17 ROM           |                \_________________/
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
C000:    |                            |                         |
         |        > U13 ROM           |                         |
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
E000:    |                            |                         |
         |        > U7 ROM            |                         |
         |                            |                         |
         |                            |                         |
         |____________________________|                         |
FF80:    |                            |                         |
         |        > External I/O      |                         |
         |____________________________|                         |
FFC0:    |                            | \                       /
         |        > I/O               |  |_____________________/
         |____________________________| /
FFE0:    |                            | 
         |        > U7 ROM            | 
FFFF:    |____________________________| 

The map is upside-down due to how the counter IC increments, but still very helpful. Also, I'm not sure why the U20 socket isn't being addressed. It would make sense if it were in the $8000-$9FFF range though. Maybe a bad solder joint, or it is enabled by one of the other PAL connections that I was not sure how to simulate. Note that the $FFC0-$FFC3 range of the I/O decoder loops back to the PAL, which could then potentially enable something there.

PAL Mapper on the Apple //e PAL interface circuit board
APIO card connected to PAL interface circuit board PAL Running in the Apple IIe

Here is the AppleSoft BASIC program that did the work: 2 REM: ? "PAL MAPPER2" 4 REM: ? "SCAN THROUGH ALL INPUT COMBINATIONS" 6 REM: ? "ON MC6821 CARD TO GET ADDRESS MAP OF PAL" 8 REM: ? "A13-A15 ARE BY COUNTER IC ON A12" 9 REM: ? "ENTER SELECTED IC NAME AFTER MAP PROMPT: >" 12 DEF FN MODA (M) = A - (INT (A/M) * M) 14 SHR$ = "|_ _ _ _ _ _ _ _ _ _|" 16 MHR$ = "|----------------------------|" 18 HHR$ = "|____________________________|" 19 BIK$ = "76543210" : REM BINARY BIT KEY 20 TEXT : PR#3 : REM PR#2 : REM 80 COL, OUT TO TERM 30 SK% = 5 : REM # OF LOW ADDR LINES SKIPPED 40 LN% = (16-SK%) : REM # LINES LEFT 50 SM% = 2^SK% : REM SHIFT LEFT FOR SKIPPED 60 LST = (2^LN%)-1 : REM HIGEST ADJUSTED ADDR 70 REM TAIL$ = RIGHT$("00000000", SK%) 80 OFS = 0 : REM OFFSET 100 SLT% = 1 : REM 6821 SLOT 102 SADR = (SLT%*16)+49280 : REM SLOT ADDRESS 110 REM ? "DEBUG INIT 6522": GOTO 200 112 APR%=0: ADR%=0: ACR%=1: BPR%=2: BDR%=2: BCR%=3 114 PRSEL%=4 : DRSEL% = 0: 120 POKE (SADR+ACR%), DRSEL% : REM DDRA SEL 122 POKE (SADR+APR%), 255 : REM ALL OUTPUT 124 IF PEEK((SADR+APR%)) <> 255 THEN ? "BAD OUTPUT" : END 126 POKE (SADR+ACR%), PRSEL% : REM PDRA SEL 130 POKE (SADR+BCR%), DRSEL% : REM DDRA SEL 132 POKE (SADR+BPR%), 0 : REM ALL INPUT 134 IF PEEK((SADR+BPR%)) <> 0 THEN ? "BAD INPUT" : END 136 POKE (SADR+BCR%), PRSEL% : REM PDRB SEL 140 ? "MC6821 PIA CONFIGURED. PORT A OUT, PORT B IN " 142 ? "RESET COUNTERS, TURN ON GAL & VERIFY NOW." 143 ? "PRESS ANY KEY TO CONTINUE" : GET KEY$ 200 PRINT TAB(19); "MEMORY MAP" 210 FOR CNT = CNT TO LST 220 :LET LASTD% = IND 230 :REM LET IND = CNT : GOTO 300 240 :LET A = CNT : LET A = FN MODA(256): REM ? A 250 :POKE (SADR+APR%), A : IND = PEEK((SADR+BPR%)) 300 :REM 310 :IF IND = LASTD% THEN A = CNT*SM% : GOSUB 700 : GOTO 400 320 :LET A = 0: GOSUB 700 : REM HR 330 :LET A = CNT*SM%+OFS : GOSUB 500 : REM HEX ADDR 340 :LET A = -1: GOSUB 700 : REM BLANK 350 :LET A = IND : GOSUB 600 : REM BIN INPUT 380 :INPUT " | > " ; X$ 400 NEXT CNT 410 REM ? "ENDING" 420 LET A = CNT*SM%-1+OFS : GOSUB 500 : REM HEX 430 PRINT TAB(10); HHR$; 450 ? "" : ? "" : ? "TURN OFF PAL NOW" 499 END 500 REM : ? "PRINT HEX" 510 LET H$= "" 520 FOR I = 1 TO 4 530 :LET B = FN MODA(16) 540 :IF B > 09 THEN LET H$ = CHR$(B+55)+H$ 550 :IF B < 10 THEN LET H$ = STR$(B)+H$ 560 :LET A = INT(A/16) 570 NEXT I 580 PRINT H$; ":"; 590 RETURN 600 REM : ? "PRINT BIN" 610 LET X$ = "" 620 FOR I = 0 TO 7 630 :LET B = FN MODA(2) 640 :LET X$ = STR$(B) + X$ 650 :REM PRINT STR$(B);" "; 660 :LET A = (A - B) / 2 670 NEXT I 680 PRINT X$ : REM;TAIL$ 690 RETURN 700 REM : ? "PRINT HR" 710 IF A=0 THEN ? TAB(10); HHR$; TAB(42); BIK$: RETURN 720 IF A<0 THEN ? TAB(10); "|"; TAB(39); "|"; TAB(42); :RETURN 740 LET B = FN MODA(8192) : REM 8K; 750 IF B = 0 THEN ? TAB(10); SHR$ 760 LET B = FN MODA(2048): REM 1K : RETURN 770 IF B = 0 THEN A=-1 : GOSUB 700 : ? "" 790 RETURN 999 END

27 comments:

  1. CMS is "Creative Micro Systems", which was based in Los Alamitos, California. I don't have documentation for your board, but have the specification manual (with schematics) for the 9639, which came out in 1983, and was specifically designed to run OS-9/6809 Level II. DaveW

    ReplyDelete
    Replies
    1. Thanks for the info! That is more than I could find on Google. If the boards are similar, I would appreciate any info in the specs on how the F' pin is used, and how the U20 PIA interacts with the Timer module or the RTC. I know scanning can be a pain, so even a snapshot of the page woudld be very helpful. Thanks again!

      Delete
  2. I just put information on the CMS 9639 on my web site at http://www.sardis-technologies.com/pre-st29/cms9639.htm

    ReplyDelete
    Replies
    1. Dave,
      I recently picked up a CMS 9639 and added it to my GitHub ROM disassembly:

      https://github.com/ep00ch/CMS_SBC

      Still working on it though.

      Delete
    2. Excellent!! Would love to see a picture of it. Did you get any documentation with it?

      Delete
  3. Looks like the device installed dead-bug style by U3 on your 9619A is a delay line, probably to fix a timing problem. Pin 8 of U3 (74LS10) is an output, which feeds to pin 1 of the delay line, which is its input. The other blue wire is connected to one of the 5 output taps on the delay line, to select the desired signal delay.

    ReplyDelete
    Replies
    1. DaveW, Good eye on the delay line. It took me a while to figure that out due to its obscure part number. Your 9639 information looks awesome. I will link to it on my next post. In the mean time, I have posted some commented disassembly of the ROMs on github:

      https://github.com/ep00ch/CMS_SBC

      Delete
  4. This company probably has documentation on the 9619A and 9639 boards, but might be reluctant to give it out:
    https://www.controlrepair.com/about-us
    https://www.controlrepair.com/manufacturer/cms/1934
    https://www.controlrepair.com/product/cms-9619a-advanced-single-board-computer/66980
    and also this:
    http://www.bell-enterprise.com/products/cms/9619a/

    ReplyDelete
  5. This person worked at Creative Micro Systems in 1986:
    https://www.linkedin.com/in/frankwmiller

    ReplyDelete
  6. Does one of your ROMs contain CMS Sysmon? If so, a user manual for CMS Sysmon 2.0 is available at:
    https://www.ebay.com/itm/LOT-VINTAGE-1970S-1980S-COMPUTER-PAPERWORK-MANUALS-INTEL-HEATH-ZENITH-TOSHIBA-/333166033622

    ReplyDelete
    Replies
    1. wow, again, an impressive eye you have DaveW! The ROMS I have dis-assembled appear to be versions of the Microware Systems Corp. DEBUG program, that is basically now part of NitrOS-9. I did not see "SYSMON" in my ROM dumps, but I wouldn't mind taking a look at that manual!

      Delete
    2. I knew I had seen SYSMON somewhere. That is the Monitor for the CMS 9600A with MC6800 seen here:
      https://www.ebay.com/itm/Vintage-CMS-9600A-MPU-43-PIN-PRINTED-CIRCUIT-BOARD-Early-AMI-Intel-Chips-ICs-PCB-/392285597929?hash=item5b560b30e9

      Delete
  7. I have been in touch with the former owner of CMS, asking if anything (hardware, software, documentation) was kept from the 6809 EXORbus line of products they manufactured in the 1980's. All that was found was one 9640 timer board, one 9650 serial board, both of which are missing some components, and one 8-slot backplane. Are you interested in these 3 items? Sounds like they could be yours for just the cost of shipping. Please let me know ASAP.

    ReplyDelete
    Replies
    1. This comment has been removed by the author.

      Delete
  8. Here's a link to the documentation I've scanned for the Motorola MicroModule 17, which is a 6809 EXORbus CPU module: https://drive.google.com/file/d/1Vz24OGp05ue1qZiMJy_ESHyAPoxZgRB-/view?usp=sharing

    ReplyDelete
    Replies
    1. Nice. I have been using that same manual as a reference for the EXORbus signals. I was originally looking for a good price on the Micromodule 17 when I discovered the CMS SBCs.

      Delete
  9. And here's a photo of the CMS 9600A 6802 CPU board. I have 4 of these, but no documentation: https://drive.google.com/file/d/1lR5IBs8s3AflEG-E6krPJP37SPJ5-lyc/view?usp=sharing

    ReplyDelete
    Replies
    1. Joel, do you have any interest in trading one of your CMS 9600s for a CMS 9619? I have 3 9619s, but no 9600s

      Delete
    2. Joel, Here is some info for your board:
      https://1.bp.blogspot.com/-t5gCG72eSzM/XqUAlatDCpI/AAAAAAAABR4/3MPe4U27_vs5MHIV2uV64WdS-gjxIlp3wCPcBGAYYCw/s1600/CMS9600A.jpeg
      Do any of your boards have EPROMs in them? They usually came with a debugger named "SYSMON". Dave linked to an auction with the manual for it above, but I don't see any trace of it anymore..

      Delete
    3. My boards don't have any EPROMs, unfortunately. My dad used to work for IFR Systems, Inc, which made test equipment for avionics, 2-way radio, and early cellular phone gear. He brought home a load of stuff they were getting rid of, including these 6900 boards, 2 Motorola 6809 EXORBUS boards, and a number of CDP-1802 chips.

      If you still have an extra CMS 9619 I'd be happy to do a trade.

      Delete
    4. Joel,
      I just posted my transcription of the source for the SYSMON monitor for the CMS 9600A on GitHub
      I have a similar story about my dad that got me involved in Apple II computers!

      Delete
  10. Hi, this is knitting machine controller. In fact if you are interested I would like to buy if from you to use it...

    ReplyDelete
    Replies
    1. Hi Guillermo,
      Feel free to email me at epooches at gmail.com. I have 3 of them, so I might be interested in selling or trading one. Can you send me some more information about the knitting machine that uses it? Thanks --Eric

      Delete
  11. Dear Epooch, impressive work.

    I had crossed paths with some PAL/GAL chips, and the best way to tackle them seems to be: https://github.com/DuPAL-PAL-DUmper

    My Best Wishes,
    KK

    ReplyDelete