16700B & 68K IA newbie question... - Page 1
Forum section: electronics / beginners

author: LittleFrog
author_rank: Contributor
timestamp: December 22, 2023, 01:43:31 pm
content: Hi,EDIT: Corrected listing screenshotThis is a newbie question about trying to make my LA & 68K IA function correctly. If I run through what I've done so far, I'd really appreciate any comments / help.I have recently obtained a used 16700B Logic Analyzer with a single 6556A input card. The LA has a 68K IA installed. I have just enough LA inputs to attempt IA on my 68K based system (which is a Sage II computer with a 64 pin 68K running at 8MHz). I don't know if the IA has been doctored in some way in the past by the way.Loading the 68K IA, I can use the Setup & Trigger -> Format screen to figure out what to connect where. I'm not using any kind of clever transition module, just the basic grabbers.... That could be the root of the problem of course (other threads on this site have suggested that one is a prerequisite). See photo.I've taken the Gnd line from each pod to a common 0V point on the Sage II PCB.Although the Format screen is good, I notice several anomalies (well, they are to my eye);1. A0 does not exist as a single signal in 68K land so why does the IA specify one? (-UDS and -LDS are covered on other pins)2. Some of the signal definitions show their -ve logic but others do not. Does this mean anything?3. -VMA is missing. Don't think this is the problem.4. Some of the signals have modified names, for example BG is called "BG_1"5. And the big piece of missing information is.... What do I use as a clock??? I'm using a 16MHz clock (i.e. 2* 68K clock) and feeding it into pod 4 "CLK" signal.A summary of my connections are contained in an attached screen shot.The LA has some amazing features, one of which is that the Format screen shows pin activity all the time. I've used this to check that every signal is active; as far as I can tell, every one contains a meaningful signal APART FROM -BG which is a 68K output.... N/C on the Sage II computer. I was expecting this to be logic 1, but it is logic 0 all the time. This could mess up the LA of course. I don't have the source of the IA for the 68K so I can't see if this could be a problem. It is possible that -BG expects an external pull up resistor. I can't see in the 68K User Manual anything that suggests that this is the case.In order that I test the IA, I wrote a simple program as follows;Code:00000000 =00001000 8 RAMbase equ $00100000000000 =00FFC011 9 GPIOBase equ $FFC01100000000 1000001000 11 ORG RAMBase00001000 1200001000 13C0 00FFC011 13 START: move.b d0, GPIOBase00001006 4EF8 1000 14 jmp START0000100A 150000100A 16 END STARTI hand enter that code, use the monitor disassembler to make sure I've not made an error and set it running.Using a scope, I can check that the program is running; attaching a probe to -CS on the GPIO chip I see that it's all good. See scabby photo attached. I should point out that actually there's some jitter that you can't see but i think this is because I've not disabled INTs.I don't know how to extract a listing from the LA (yet) but I (finally!) I press "Run Once" on the LA and this is what I see is shown in the attachment....It's really close....I can see sensible address buss values. My screen shot shows (what I think) is my program running between 1004 and 100A and maybe an ISR right in the middle.The data bus is totally messed up though.I have tried clocking off other signals and although the listing looks different, it's no better.I have looked into the IA alignment problem but I don't think I need to so this on a 68K.I guess my only thought is... If the IA implementation for the 68K is really good, then it should know about every state that it sees and should be able to work out what's going on. But then again, if I'm clocking off 68K CLK * 2 then there will be many states for which there is no meaningful inverse assembly possible (e.g. some instructions require several memory reads just to get everything into the processor so the instruction can be executed).It would be lovely to see a real listing from the 68K IA if anyone has a fragment they could post me.Thanks for reading, if you have any comments/thoughts, I'd be most grateful to read them.Dave

author: MarkL
author_rank: Unknown
timestamp: December 23, 2023, 05:23:13 pm
content: I unfortunately don't have a 68k processor to experiment along with you.However, looking at the timing diagrams in the 68k user manual, I think you might try setting up your state clock as the rising edge of -LDS or -UDS (in the LA's nomenclature: -LDS^ + -UDS^). It appears that all the other bus signals are valid at that time, and without additional qualifiers.Hopefully there's not significant skew between these two signals that they are interpreted as a double state clock. There's no spec for any skew in the timing diagrams. It's probably fine since they are likely simultaneous (driven by the same internal clock).It's also possible such clocking is not what the IA is expecting. Maybe it wants to see all the other extra bus cycles and is keeping track of it in a state machine, but it's worth a try.

author: LittleFrog
author_rank: Contributor
timestamp: December 23, 2023, 05:45:02 pm
content: Hi Mark,Thanks so much for your posting. I will try as you have suggested but I think that you've pointed me in the right direction; this is a problem related to triggering....In my original post, I said something like "...The address bus is OK but the data bus is not...", well that's not true. If I look at the IA listing, the data is actually credible. The problem is that because I'm not triggering off the correct bit(s), then the IA is struggling to make sense of it all.So as I say, I will try as you have proposed but meantime I have found this;https://www.ele.uri.edu/iced/protosys/test_equipment/hp_1662_doc/HP_10391B_Inverse_Assembler_Manual_10391903.pdfRight now I'm looking at appendix C. It explains how to make the IA trigger correctly for the related 68010. I feel that if I can translate this correctly to 68000, then all will become clear. I'll report back with findings.Thanks again.Dave

author: MarkL
author_rank: Unknown
timestamp: December 23, 2023, 07:02:49 pm
content: Well, it tells you the clocking right at the top of Appendix C:QuoteSo, try using the rising edge of -AS as the clock.The timing specifications for some of the bus cycles are measured from the rising edges of -UDS/-LDS which is why I picked them, but maybe it doesn't matter if you use -AS instead.One minor note on terminology. For the logic analyzers, a "trigger" is a set of conditions to be met to start recording a stream of data. What we're talking about here is "clocking", which defines the conditions when the bus and other signals are valid to capture. Once captured, this data is sent to the triggering sub-system to determine when recording should begin.The trigger sub-system in these analyzers is fairly sophisticated with programmable state machines and counters and can trigger other internal analyzers, or external devices like oscilloscopes. You can also define what NOT to capture in a data stream to save on memory if you're looking for specific event. I think the default is to trigger unconditionally and immediately, and save everything to memory, so you get data to work with right away.Once the trigger cycle is complete (usually when memory is filled), the IA interprets the captured data. The goal is to get the clocking set up properly so you're only capturing data that is relevant for the IA, and not the extra bus activity that is not meaningful for disassembly.

author: LittleFrog
author_rank: Contributor
timestamp: December 24, 2023, 10:53:01 am
content: Hi Mark,Thanks for the further pointers and terminology prompt.It works. I used -AS as the clock and all is well. I've not worked out how to save the output from the IA (should be wrapping presents!) but that's something to look forward to. For reference, here is the program;Code:00000000 =00001000 8 RAMbase equ $00100000000000 =00FFC011 9 GPIOBase equ $FFC01100000000 1000001000 11 ORG RAMBase00001000 1200001000 13C0 00FFC011 13 loop: move.b d0, GPIOBase00001006 4EF8 1000 14 jmp loopAnd the attached photo shows output.

author: MarkL
author_rank: Unknown
timestamp: December 24, 2023, 08:25:49 pm
content: Great - glad that -AS worked.As for saving the output, there's several ways.The easiest is to use File --> Print to file... from the Listing window. Then you can use FTP or rcp (rsh) to copy the file to a computer.Another way is to use the network API at TCP socket 6500 (they call it RPI: Remote Programming Interface). You can telnet to this socket to play with it. It uses plain ASCII commands, and also supports a binary transfer option for voluminous captured data. Here is the manual:https://www.keysight.com/us/en/assets/9018-40955/user-manuals/9018-40955.pdfType "help all" for a list of commands in addition to what's in the manual. It also has detailed built-in help for many of the commands, for example:help allpattgen -hscope -hanalyzer -hemulator -hme_infoTo download a listing of the disassembly, first you could enter:tlist -rWhich would show the current range of lines in the listing. And then, for example, if you wanted to download lines 1 through 100:tlist -a 1..100Or, another possibility that just gets them all in a slightly different format:listing -d -l all -r allYou can control everything on the analyzer through this interface. It's not just for downloading results.

author: LittleFrog
author_rank: Contributor
timestamp: December 24, 2023, 09:06:48 pm
content: Hi Mark,The 16700 is just so functional. I bought it because I thought it might help me to debug a program I'm writing (Parallel IDE interface for my Sage II computer) but learning and using the LA has taken me off on so many enjoyable tangents... I got the RPI interface working, downloaded my listing and now setting up a test with some actual code.I've realised that I can watch the IDE interface (which is memory mapped) and/or look at my code running. This is just way beyond what I thought might be possible with a LA (I only have experience of a Rigol MSO 4024 which has 16 LA inputs and no meaningful functionality past looking at bit patterns).Just got to thank you for your help.Kind regards,Dave

author: MarkL
author_rank: Unknown
timestamp: December 25, 2023, 02:41:12 am
content: You're welcome! Yeah, there is some amazing capabilities in these old analyzers.Another way to save output is via the "File Out" utility, which you can find under the Workspace manager (Window --> System --> Workspace, or use the dedicated button at the top), which is good for recording multiple runs automatically. But if you're already writing to the API, that's the way to go.If you're compiling/assembling your own source, take a look at the symbol table facility under the "Symbol" tab in the analyzer setup window.And your analyzer might already have them enabled, but if not, HPAK has allowed non-commercial use for the many add-on software tools. See these posts:https://groups.io/g/HP-Agilent-Keysight-equipment/message/69153https://groups.io/g/HP-Agilent-Keysight-equipment/message/89205I've also found that using the analyzer via X11 provides a lot more screen real-estate than being stuck in VNC with 1600 x 1200 (I think it is) max. You might want to give it a try if you haven't used it yet.Have fun!