SRS PS310: ROM code supports GPIB option Needed - Page 1
Forum section: electronics / testgear

author: z80tw
author_rank: Contributor
timestamp: November 19, 2015, 03:27:04 pm
content: I bought a SRS PS310 which does not include GPIB option last week,I put the GPIB ICs on the ic sockets(TMS9914ANL,SN75160BN,SN75161BN),made the cable and connected it to a GPIB female connector.but when I try to set the GPIB address by pushing the "GPIB" key it displayed err5 (Err5 No GPIB Interface The unit does not have the GPIB option so the GPIB address cannot be set.),I believe the ROM code in my PS310 doesn't support GPIB option,If I can reprogram the EPROM with the ROM code of PS310 which supports GPIB option then I may make the GPIB function works.or can I enable the GPIB function by modifying my current ROM code?Jack

author: harm
author_rank: Contributor
timestamp: January 31, 2017, 02:37:49 pm
content: Any luck finding the firmware for SRS PS310?HarmThe Netherlands

author: z80tw
author_rank: Contributor
timestamp: January 31, 2017, 02:44:35 pm
content: No luck so far.....Jack

author: TheSteve
author_rank: Unknown
timestamp: January 31, 2017, 05:46:36 pm
content: Can you read the firmware and look for ASCII strings in it that would indicate it has the gpib commands present?

author: z80tw
author_rank: Contributor
timestamp: February 01, 2017, 02:19:12 am
content: Quote from: TheSteve on January 31, 2017, 05:46:36 pmYes, I can read the firmware and look for ASCII strings but I don't know where are the gpib commands,I think I can find the gpib commandsif I know their memory addresses or specific strings to look for.Jack

author: TheSteve
author_rank: Unknown
timestamp: February 01, 2017, 02:31:19 am
content: Well I see IDN there. Makes me think there is a decent chance the needed firmware is already present, you just need to figure out how to enable it. Maybe a hardware jumper or a flat in firmware.

author: z80tw
author_rank: Contributor
timestamp: February 01, 2017, 03:59:58 am
content: Quote from: TheSteve on February 01, 2017, 02:31:19 amThanks for your comments,I found no jumpers or test points on the main board,I can't figure out how to unlock the GPIB function ,the complete ROM code copied and attached here,hope someone can figure out how to modify the rom code and help me to restore the GPIB function.The memory addresses for model and serial no.19CC~19CD PS0157~0159 310 (Model No,PS310)1FFC~1FFF 7397(Serial No,last 4 bytes, total 8K bytes)Jack

author: picburner
author_rank: Frequent Contributor
timestamp: February 01, 2017, 09:02:23 am
content: In attachment there is the manual, with all GPIB commands, and the schematic in next post(> 2MB allowed) .As you have already noticed there are no jumpers on pcb to enable the GPIB.Into the rom code I don't see all GPIB commands but these may have been converted into 'tokens'.There could also be a trick contained in the battery backuped SRAM that enables GPIB.....Good luck!

author: picburner
author_rank: Frequent Contributor
timestamp: February 01, 2017, 09:31:22 am
content: .... and this is the PS300 series schematic:http://www.electronicsandbooks.com/eab2/manual/Hardware/S/Stanford%20Research%20www.thinksrs.com/Product/PS300%20PS310%20PS325%20PS350%20Power%20Supply/Schematics%20A3%20c20120517%20.pdf

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 01, 2017, 12:03:46 pm
content: Can you please upload the ROM file?That would be easier to do a "grep" on the file than looking at screenshot looking for GPIB commands.According to the schematics, the main CPU is a Z80.We can try to run a disassembler on it.On the screenshots, there is some GPIB commands like "SAV" or "IDN", but not all.Especially, the device specifici "HVON" or "HVOF" (output enable/disable) GPIB commands are nowhere to be found.

author: z80tw
author_rank: Contributor
timestamp: February 01, 2017, 02:22:35 pm
content: Quote from: picburner on February 01, 2017, 09:02:23 amThanks for your information,The parts number printed on the SRAM has been defaced completely,I guess it's a 24 pin 2k bytes SRAM like HM6116 (DIP).I tried to download the schematics but the web site showed me "error 404" ,the page doesn't exist.Jack

author: z80tw
author_rank: Contributor
timestamp: February 01, 2017, 02:38:03 pm
content: Quote from: anotherlin on February 01, 2017, 12:03:46 pmYes, the CPU is a Z80,I found "VON" and "VOF" in the ROM codes,please see the pic,are they the GPIB commands you talked about?The ROM file (ZIP) is attached.let me know if you need more information.Jack

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 01, 2017, 04:14:50 pm
content: Thank you. Seems like we have a nice little reverse engineering project here !I have some good results with the disassembly, see the attached file.I used yazd (https://github.com/toptensoftware/yazd)First thing code is doing, is to set up the stack top at 0x4ff (top of 2k SRAM) and set interrupt mode 1.I'll have a deeper look at the code tonight. With the schematic, we have everything at hand, unless the SRAM has some pre-programmed values.Regarding the "VON" and "VOF", that may well be possible. Code may look at first character and then check the rest of the command name.Also, the manual mentions only one part number for the ROM chip, so I would expect that there's only one ROM code.edit: forgot the attachment

author: dr.diesel
author_rank: Super Contributor
timestamp: February 01, 2017, 04:19:57 pm
content: I have a PS350 with GPIB if you'd like to compare the FW?

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 01, 2017, 04:39:11 pm
content: Quote from: dr.diesel on February 01, 2017, 04:19:57 pmIf you have the rom dump available, I'll gladly have a disassembly of it.

author: dr.diesel
author_rank: Super Contributor
timestamp: February 01, 2017, 04:46:41 pm
content: Quote from: anotherlin on February 01, 2017, 04:39:11 pmPlease see the attached.

author: picburner
author_rank: Frequent Contributor
timestamp: February 01, 2017, 04:52:01 pm
content: Quoteyou must copy and paste the link. I don't understand why but the last part ( .pdf) was not included in the link itself.I could not place the file directly because it is bigger than 1 MB.

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 01, 2017, 06:11:54 pm
content: Quote from: dr.diesel on February 01, 2017, 04:46:41 pmPlease see the attachedSo what you guys are saying is that the last 4 bytes of the ROM dump is always the serial number ("4243" for the PS350) ?If so, it is then possible that they (SRS) put a flag to enable or disable the GPIB.It seems that they also keep "calibration" data.I'll have more time later in the night to further investigate.Very interesting !

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 02, 2017, 12:00:02 am
content: Ok, got a look at the code and schematic, but it is now 1amFrom the schematic, IO ports are control by 2 74HC138 mux.The one that interest us is U505: enable is: -A6 & -IORQ & M1.M1 is on whenever the Z80 is not fetching an instruction.Output signal -Y7 is connected to -GPIB, that is -CE of the TM9914.MUX select is A5-A3.A0-A2 are connected to RS0-RS2 (register select) of TM9914.So basically, any IN or OUT instruction targeting ports x0111xxx is talking to the GPIB chip.Example: OUT (38h), A would be written data in A to register 00h of GPIB.In PS310 ROM we do have write accesses (see end of html) to GPIB ports 38h, 3Bh, etc, but only write!In PS530 ROM we do have access GPIB ports too, a few more than PS310, and read/write.The code doesn't appear to be encrypted. The SRAM could have be used to have decrypted code from ROM for instance.But that doesn't seem to be the case.In fact, it is very similar. Main loop is at E3h for PS310 and E0h for PS350.Note the jump right before, with a decoding (for digit display) of the string "ERR0" in a subroutine. Must be the self testing.My feeling is that each ROM is custom compiled. This is because of the serial number at the end (1FFCh).So they can basically load one with GPIB support and one without.The one without probably having code just to write on ports to tell it to shutdown, or go to a certain state.On first look PS310 and PS350 seem to have very similar firmware code.That needs to be further checked.But if SRS decided to use a same firmware code for all models, I would think that it should possible to tweak the PS350 for the PS310.I've just skimmed the surface. This needs further investigation.I'll continue, this is very fun

author: z80tw
author_rank: Contributor
timestamp: February 02, 2017, 03:34:00 am
content: There is a clue,according to the user's manual the GPIB address must be set before enabling GPIB function,this means the "GPIB" key must be pressedin order to set the gpib address.thus find out the key scan subroutine and how cpu handle the key event of "GPIB" key pressing.the process of gpib key event will tell us how CPU judges whether the gpib option is available or not.if the GPIB is not available PS310 will show theerror message "err5".Err5: No GPIB Interface The unit does not have the GPIB option so the GPIB address cannot be set.(the GPIB option must be encrypted in the ROM code or SRAM)Default SetupThe factory default setup can be recalled bypressing the CLR key while turning the unit on orrecalling setup 0 (RCL 0). The default setup is alsorecalled after a power on memory error (ERR 1).The default setups are shown below.PS310 Voltage Set 0 VVoltage Limit 1250 VCurrent Limit 21 mACurrent Trip 21 mAReset Mode MANHigh Voltage OFFGPIB Addr 14 (if applicable)I suppose the GPIB address will be saved in battery backuped SRAM once user set a GPIB address.Jack

author: z80tw
author_rank: Contributor
timestamp: February 02, 2017, 11:29:39 am
content: Quote from: picburner on February 01, 2017, 04:52:01 pmI believe the link I copied is different from the original(due to language version)http://www.electronicsandbooks.com/eab2/manual/Hardware/S/Stanford%20Research%20www.thinksrs.com/Product/PS300%20PS310%20PS325%20PS350%20Power%20Supply/Schematics%20A3%20c20120517%20Could you send me the schematics by email?Jack

author: picburner
author_rank: Frequent Contributor
timestamp: February 02, 2017, 11:52:36 am
content: @z80tw:Send me your email in PM and I will send you the schematic.

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 02, 2017, 01:38:21 pm
content: Quote from: z80tw on February 02, 2017, 03:34:00 amPressing CLR key at start, it will reset the SRAM.But after that can you use the machine directly, or do you have turn it off and on again?There is code at the beginning of the fw which read the keys.I would guess it is the CLR key for SRAM reset.And that piece of code indeeds writes default values into the SRAM (in 4000h).But it then goes into a separate loop, not the main loop.

author: z80tw
author_rank: Contributor
timestamp: February 02, 2017, 01:59:46 pm
content: Quote from: anotherlin on February 02, 2017, 01:38:21 pmThe attached pic will show you the display after pressing CLR at start ,I can use it without turning it off and on againJack

author: z80tw
author_rank: Contributor
timestamp: February 02, 2017, 02:38:23 pm
content: Just found out I have about 10 pcs of used 2764 EPROM IC and an EPROM eraser!I am wondering what will happen if I put an EPROM IC with ROM code of PS350(supports GPIB option) in it anduse it in a PS310?will it damage my PS310?Jack

author: z80tw
author_rank: Contributor
timestamp: February 02, 2017, 03:07:09 pm
content: I just replaced the ERPOM IC of PS310 with the one with ROM code of PS350 in it .When turning it on the display showed the serial number "4243" and model no. "350" (1~2 seconds,pic 1),after that the PS310 entered reset status(pic 2).I pressed the GPIB key and got gpib address "GP14" on display(pic 3).I haven't tested the actual output voltage and GPIB communication yet.Jack

author: z80tw
author_rank: Contributor
timestamp: February 03, 2017, 01:33:33 pm
content: Quote from: anotherlin on February 02, 2017, 01:38:21 pmToday I did a little modification in the ROM code of PS350:Model No. 350------>310 (0157~0159: 33 35 30---->33 31 30)Serial No. 4243----->7397(1FFC~ 1FFF: 34 32 34 33----->37 33 39 37)After that I tested the PS310 with the modified ROM code of PS350:1.Actual output voltageSET/Display Actual output50V 12.01V100V 24.46v200v 49.679v500v 124.498v1000v 250.498v(PS310 Max output:1250V, PS350 Max output:5000V, 5000/1250=4)2.GPIB communication:PC---->PS310:*IDN?PS310 response:StanfordResearchSystems,PS310,7397,1.40PC---->PS310:VSET1.0E3 (set output=1000V)PC---->PS310:VSET?PS310 response:1.000E3 (=1000V)PC---->PS310:HVON(output turned on)PC---->PS310:HVOF(output turned off)The GPIB works!Jack

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 03, 2017, 02:12:19 pm
content: Quote from: z80tw on February 03, 2017, 01:33:33 pmSeems like "350" at 156h is for display purpose.PS350 is 5kV vs PS310 is 1.25kV. Values are divided by 4, seems consistent.I've found some code right at the beginning that check the keyboard (see IN A, (30h) at address 2Eh) and jumps to a subroutine instead of the main loop.If you're not afraid, can you try to boot with key "ENT" and/or "7" pressed and see what happens?

author: z80tw
author_rank: Contributor
timestamp: February 03, 2017, 04:10:25 pm
content: Quote from: anotherlin on February 03, 2017, 02:12:19 pmI did as you asked,this is what happened after booting with key ENT pressed,the top segment(a) of left most seven segment LED light turned on(pic1).now the PS310 response only to two keys,up-arrow and down-arrow keys,if you press up-arrow key the (a) segment turns off and (b) segment turns on,push up -arrow key again (c) segment is on,(b) segment off.if you continue to push the up-arrow key again and again the display will continue from segment (a) to (h)-(dot)(pic2 & pic3)then repeat it again on next seven segment LED,one segment turns on at one time.after two 7 segments displayed in this manner all 7 segment LEDs turns on(pic4),after thatis the indicator LED "trip" turns on then "AUTO"--->"MAN"--->"REAR"---->"SET"--->"LIMIT(voltage)"--->"LIMIT(ma)"--->"TRIP"---->"LIMIT(status)"---->"REM"---->"SRQ",one by one at one time.after that you push one key you will see a code on display(pic 5):key press displayMan 01GPIB 02left-arrow 03Right arrow 04up-arrow 05 (pic 5)down-arrow 06Enter 07Select 08STO 09RCL 10CLR 11. 120 137 144 151 168 175 182 199 206 213 22It looks like it's a key board and display test program.Jack

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 06, 2017, 08:11:50 am
content: Quote from: z80tw on February 03, 2017, 04:10:25 pmGreat a (not so useful) undocumented feature

author: z80tw
author_rank: Contributor
timestamp: February 06, 2017, 02:42:39 pm
content: Quote from: anotherlin on February 06, 2017, 08:11:50 amI set the GPIB bus address to 09 and saved it,then turned the power off and on again,after power on I pressed the GPIB key this time I saw "GP09"(see pic) on the display,I took out the EPROM(PS350) and verified it with the ROM file with my EPROM writer,they are the same ,no change at all,thus the new GPIB address must be saved in SRAM.I downloaded a free z80 disassembler and disassemled the binary files(PS310 & PS350),Following information came from my brief analysis of PS350 ROM files and schematics:1.Memory address of EPROM: 0000~1FFF (program space:8KB,ST M2764A)2.SRAM: 4000~47FF (data space:2KB,Hitachi HM6116)3.I/O address:20h:Status128h:Status230h:-KBD38h:-GPIB48h:-Sets50h:-DAC58h:-LED60h:-SEGB68h:-SEGA70h:-STROBE78h:------------------------------bit0:-SHUTDOWNbit1:UPOKBIT2:-FLAG RESETBIT3:-TIMER RESETBIT4:(spare)BIT5:-POSbit6:-NEGbit7:FILTER------------------------------Key code of "GPIB" :20hI found only two read key code commands ("in a,(30h)") in the ROM file of PS3501.0000~0044h:002c db30 in a,(30h) ----read key code002e fe80 cp 80h ------check if "ENTER" / "7" key pressed or not0030 ca1714 jp z,1417h ------if yes then jump to 1417h,---the keyboard/display test program your asked me to check.0033 c36800 jp 0068h-----if neither "ENTER" nor "7" pressed then jump to 0068h-----proceed regular power on procedures?2.Subroutine 0FC2~0FD5h: 0FD2h db30 in a,(30h)0fc2 3a1440 ld a,(4014h)0fc5 fe02 cp 02h0fc7 d8 ret c0fc8 fe05 cp 05h0fca d0 ret nc0fcb 218740 ld hl,4087h0fce 5f ld e,a0fcf 1600 ld d,00h0fd1 19 add hl,de0fd2 db30 in a,(30h)0fd4 77 ld (hl),a0fd5 c9 retI will continue to analyze the ROM files.Let me know if you find any thing wrong about my analysis.Jack

author: z80tw
author_rank: Contributor
timestamp: February 08, 2017, 02:55:59 pm
content: After I did couple modifications on the ROM code of PS310 the GPIB function now is enabled!but I still can't change the GPIB bus address by pressing the "GPIB" key,when I press the "GPIB" key I still see "Err5" on the display.The codes I have modified:1.(pic 1)00b3h cd1710 call 0117h ------> cd301f call 1f30h2.(pic 2)1f30h~1f32h: ff ff ff ----->cd 58 12 call 1258h (basically I inserted only one command in the program:call 1258h,to initialize GPIB controller )1f33h~1f35h: ff ff ff ----->cd 17 01 call 0117h1f36h:ff ---->c9 RETAfter installing new rom code in PS310 I turned on the power.PS310 powered on and displayed normally,then I pressed the "GPIB" key but saw "Err5" on display again.next I tested the GPIB communication.it works!(pic 3)I issued coulple commands and got correct response from PS310:*IDN?PS310 response:StanfordResearchSystems,PS310,7397,1.40VSET=1.0E2(Vset=100V)VSET?PS310 response:1.00E2(=100V)HVON (output turned on)HVOF (output turned off)Now I am going to figure out how to make the setting of GPIB bus address works.PS.current GPIB bus address of PS310 is: 9 (saved in SRAM since I changed it yesterday)Jack

author: z80tw
author_rank: Contributor
timestamp: February 11, 2017, 03:08:20 pm
content: Today I found out why I couldn't set GPIB address by keyboard of front panel,because the CPU jumped to "Err5" subroutineevery time I pressed "GPIB" key! in the ROM file of PS350 there is no "Err5" subroutine,instead of "Err5" subroutine there isa subroutine which will enable GPIB interface and address setting by keyboard of front panel .Thus I have to replace the "Err5" sub with the GPIB option sub(copied from PS350).The software version modified by meI called it Version 1.41(original Ver 1.40)(pic 1)Now GPIB interface of my PS310 works, the GPIB address can be set by keyboard of front panel and saved in SRAM(pic 2,no more "Err5")How I replaced the "Err5" sub with GPIB option sub from ROM file of PS350?1.I changed the code of 028fh~0292h:(pic3)028f~0291 cd 40 1f call 1f40h0292 c9 RET2. Copied GPIB option subroutine of PS350 (029b~02c0) and pasted itto address 1f40~1f65h:(pic4)1f40 af xor a1f41 321740 ld (4017h),a1f44 328240 ld (4082h),a1f47 328340 ld (4083h),a1f4a 3e04 ld a,04h1f4c 322440 ld (4024h),a1f4f 3e01 ld a,01h1f51 321940 ld (4019h),a1f54 211240 ld hl,4012h1f57 cbee set 5,(hl)1f59 3a4c41 ld a,(414ch)1f5c e67f and 7fh1f5e 322240 ld (4022h),a1f61 af xor a1f62 322340 ld (4023h),a1f65 c9 retNow my problem solved!Thanks to all of you who has helped me by providing schematics,ROM code of PS350,hardware and software analysis,without your helps I could not have fixed this problem.Jack

author: picburner
author_rank: Frequent Contributor
timestamp: February 11, 2017, 04:06:58 pm
content: Congratulations, you've done a really good job!

author: bingo600
author_rank: Super Contributor
timestamp: February 12, 2017, 07:49:39 am
content: Cool detective workIf you're nice , you'd upload the fixed eprom contents here./Bingo

author: z80tw
author_rank: Contributor
timestamp: February 12, 2017, 10:44:32 am
content: Quote from: bingo600 on February 12, 2017, 07:49:39 amHere attached is the modified ROM file,Version 1.41,Model No.PS310,Serial No.2017(<---users have to modify it according to the serial no of their PS310.)hope it will help other owners of SRS PS-310 / PS-325 who has same problem I faced.Jack

author: anotherlin
author_rank: Frequent Contributor
timestamp: February 13, 2017, 08:43:58 am
content: Quote from: z80tw on February 11, 2017, 03:08:20 pmThis is not problem solving, but a nice firmware hack!Congrat!

author: z80tw
author_rank: Contributor
timestamp: February 13, 2017, 02:44:13 pm
content: Quote from: anotherlin on February 13, 2017, 08:43:58 amFirmware hack! but without your inspiration I couldn't have done it!thanks for all efforts you have done for me.Jack