Found a weird old computer dumpster diving. (z80?) - Page 1
Forum section: electronics / projects

author: tsvisimcha
author_rank: Contributor
timestamp: March 27, 2020, 07:28:23 am
content: I was going dumpster diving and I found a Smith & Nephew DYONICS PS3500EP Arthroscopic Surgical System. It had a cool enclosure and some nice clicky switches so I took it. Upon popping it open it appears to have a Zilog z80 CPU and a bunch of other DIP socketed chips. What I assume is the motherboard looks similar to very old PCs I've seen however this hardware is a bit before my time. Does anyone know if there's anything interesting I can do with it? I can send some pictures of the inside later if anyone's interested.Thanks!

author: daqq
author_rank: Super Contributor
timestamp: March 27, 2020, 07:57:21 am
content: QuoteSure, build a z80 computer.

author: brabus
author_rank: Frequent Contributor
timestamp: March 27, 2020, 09:03:47 am
content: Pics, pics, pics!

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 02:28:42 am
content: Here's the picture of the mainboard. I took it out of the unit to get a better picture. The rest of the components seem to be for high voltage (big transformers and scary caps) and I'm a little scared to remove them in case one of the caps is still charged (doubtful).

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 02:39:02 am
content: More pics

author: jbeng
author_rank: Regular Contributor
timestamp: March 28, 2020, 05:03:49 am
content: That's the first I've seen of 74c911 chips, had to look them up. Turns out they're controllers for multiplexed CC LED displays, 8 segments x 4. They're obsolete, but kinda cool, nonetheless.

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 28, 2020, 05:38:04 am
content: More pics, especially under the speaker. There may be static RAM there.There are two 16550 UARTs for the RS232 port. There is a socketed EPROM which you might like to dump to disassemble. NVRAM next to it, presumably for persistent settings. DAC and ADC chips in the middle of the board which drive the wite things. 74c911 to drive displays as already mentioned. NTSC 3.58 MHz crystal so a 4 MHz Z80. Chip dates from mid-90s.It probably doesn't have enough RAM to run CP/M, but you might be able to make a controller not sure of what of it.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: March 28, 2020, 01:28:21 pm
content: Quote from: greenpossum on March 28, 2020, 05:38:04 amThe white things are 4N26 optocouplers.https://www.vishay.com/docs/83725/4n25.pdf

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 28, 2020, 04:37:16 pm
content: Although the marking on some chips are hard to read, I can't seem to see any RAM chip on this board? Has anyone seen any?

author: MLXXXp
author_rank: Frequent Contributor
timestamp: March 28, 2020, 04:57:49 pm
content: RAM could be just the 2K x 8 non-volatile RAM at U27, beside the EPROM, or there could be more under the speaker.

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 05:45:33 pm
content: Under the speaker

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 05:46:33 pm
content: Another angle

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 05:54:54 pm
content: I have a bus pirate somewhere so I can try to dump the eeprom if someone wants to take a look at it.

author: rstofer
author_rank: Super Contributor
timestamp: March 28, 2020, 06:19:24 pm
content: Quote from: tsvisimcha on March 28, 2020, 05:54:54 pmDisassembly from a ROM dump is a fool's exercise. All the author needs to do is put in some bogus 0x21 (LXI H) bytes to throw off disassembly. The next two bytes would be an operand for the LXI H but are actually the start of some other instruction because the LXI H is never executed. The BDOS component of CP/M has this feature. Or at least that's what I came up with when I tried to disassemble it. The first byte of any other multi-byte instruction will do the same thing.Just scatter so DB 0x21 instructions in the code.

author: rstofer
author_rank: Super Contributor
timestamp: March 28, 2020, 06:23:37 pm
content: It might be better to remove the speaker completely. The Z80 and the NVRAM are pretty sweet. I don't care for desoldering but I might make an exception. I have several Z80 systems including a complete CP/M system running on a 50 MHz eZ80. The system just screams at that speed!

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 06:35:38 pm
content: Not sure if it's clear from the pictures but the nvram and the z80 are both socketed

author: james_s
author_rank: Super Contributor
timestamp: March 28, 2020, 06:36:02 pm
content: There's not going to be any high voltage in that beyond the mains voltage, the capacitors are physically big but they are almost certainly just filters on a linear power supply, I'd be very surprised if any are rated over 50V and the actual voltages on them will be lower.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: March 28, 2020, 06:41:29 pm
content: U8, under the speaker, is a AY38912 sound generator. I can't quite read the number on U6 but it's probably an audio amplifier, like a TDA2002, to drive the speaker from the signal from the sound generator IC.http://pdf.datasheetcatalog.com/datasheets2/54/545148_1.pdfhttp://pdf.datasheetcatalog.com/datasheet/SGSThomsonMicroelectronics/mXyzxrtt.pdfSo, probably the only RAM is U27, which is a 2K x 8 static RAM with a lithium backup batteryhttp://www.greenwichinst.co.uk/datasheets/GR281.pdf

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 28, 2020, 07:01:02 pm
content: Yeah doesn't seem to have much RAM. Could be other stuff on that (likely) bus connector though. How many boards in the whole thing?Tim

author: Gyro
author_rank: Super Contributor
timestamp: March 28, 2020, 07:05:12 pm
content: I wonder what was behind NS feeling the need to print "PATENTED" quite so prominently on a simple UART (16550) back in 1994, they were commodity parts by then.

author: MLXXXp
author_rank: Frequent Contributor
timestamp: March 28, 2020, 07:22:30 pm
content: Quote from: T3sl4co1l on March 28, 2020, 07:01:02 pmFor what the machine does, 2K is probably plenty.

author: tsvisimcha
author_rank: Contributor
timestamp: March 28, 2020, 07:24:18 pm
content: What kind of chips am I going to need to get if I want to build a CP/M machine?

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 28, 2020, 08:50:10 pm
content: Quote from: rstofer on March 28, 2020, 06:19:24 pmHowever getting the code isn't the only purpose of disassembly. By looking for IN and OUT instructions one might be able to see where the peripherals are in the I/O space. Otherwise trace the address lines through the decoders to the chips.I wouldn't bother trying to make a CP/M machine out of it. It would be easier to start from scratch.

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 28, 2020, 09:23:51 pm
content: Quote from: MLXXXp on March 28, 2020, 07:22:30 pmI mean, obviously. Whatever it did, it was able to do...I have no idea what the machine does. Did someone link the manual above and I scanned past it?The ADC/DAC does suggest some analog data processing, but it could well be low bandwidth process parameters, or even housekeeping like voltages and temperatures. My guess would be it's one or two serial interfaces, perhaps stateful with something like an ANSI command line (terminal) interface, perhaps with some relationship between the two channels (maybe one is master to a PC, the other collects data from more devices; maybe they're equivalent and it's like a multi-user terminal interface; lots of possibilities). The 16550s (versus 8250s or Z80-SIOs) imply modest bandwidth, but obviously nothing a Z80 can't handle. And the small RAM implies not much buffering, enough to run terminal interface(s) say, and some kind of basic state machine for the actual core functionality.Tim

author: MLXXXp
author_rank: Frequent Contributor
timestamp: March 28, 2020, 10:38:35 pm
content: Quote from: T3sl4co1l on March 28, 2020, 09:23:51 pmI think it's basically a glorified "Dremel" for arthroscopic surgery.http://www.medicalproductguide.com/term/3771/arthroscopic-shaver-systemshttps://www.somatechnology.com/Medical-Products/Endoscopy/Arthroscopic-Shavers/dyonics-ps-3500-ep-endoscopy-arthroscopic-shavers.aspxhttps://en.wikipedia.org/wiki/Arthroscopy

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 28, 2020, 10:58:02 pm
content: I couldn't see much of anything under the speaker. You should put it away. Knowing how much RAM there really is will give an idea of what could be done with this board. I wouldn't bother with CP/M with less than 32KB.Next step would be to reverse-engineer the address decoding. I think that's all you'd really need to do. And then write your own programs. I'd probably replace the EPROM with some 5V flash chip so you can reprogram it faster/make your life a bit easier.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 28, 2020, 11:15:44 pm
content: Quote from: rstofer on March 28, 2020, 06:19:24 pmIIRC this "feature" was not intended as an obfuscater but as a code-dense way of implementing a decision chain which would be expressed in C asCode:if (a) {z=const1;} else if (b) {z=const2;} else if (c) {z=const3;{ else.....Assuming that z can be held in an 8 bit register the 8-bit direct load is 2 bytes - if you don't mind sacrificing a 16-bit pair you construct a block of 16-bit immediate loads where the 16-bit "operand" is actually an 8-bit load.You then jump in at an 8-bit load and "fall-through" all the 16-bit loads to the next bit of code. Saves a byte per element over a stack ofCode:ld reg, constjr next_bitIIRC the Microsoft Z80 BASIC interpreter used the same trick.As for the board - obviously a controller for the device that you mention - too little RAM (looks like the 2k "non volatile" chip is all that it has) to be much use as a general purpose computer.

author: james_s
author_rank: Super Contributor
timestamp: March 28, 2020, 11:37:31 pm
content: Quote from: SiliconWizard on March 28, 2020, 10:58:02 pmDepending on how the address map is arranged, adding RAM could be fairly trivial. All you need is a single SRAM chip and some address decoding which can either be done the old fashioned way or with a small CPLD.I'd get the map worked out first though and then write a "hello world" program to blink an LED assuming there is one.

author: obiwanjacobi
author_rank: Super Contributor
timestamp: March 29, 2020, 06:23:19 am
content: Confused:Code:0x21 (LXI H)does not sound like a Z80 instruction.21-hex translates into 'LD HL, nn' ...?And I have never heard of mnemonic 'LXI'...Please explain.

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 29, 2020, 07:26:04 am
content: Quote from: obiwanjacobi on March 29, 2020, 06:23:19 amOh dear. The Z80 instruction set is a superset of the 8080 instruction set but the designers chose to use different (and IMO better) mnemonics. LXI H is simply load immediate extended, i.e. HL, to old timers. So really the same instruction.

author: obiwanjacobi
author_rank: Super Contributor
timestamp: March 29, 2020, 07:59:14 am
content: Quote from: greenpossum on March 29, 2020, 07:26:04 amYeah - well you can't know everything ...Even then - sprinkling LD HL, nn's around requires 3 bytes not 1 and can really mess up the logic if you start loading HL with random stuff.I still don't understand how this could work.But I don't want to take the discussion too far off topic so lets drop it.---What I find puzzling is that these opto-couplers go to beefy connectors.I would expect smaller connectors or some sort of switching transistors.How much current (or voltage?) would this be good for?

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 29, 2020, 11:50:21 am
content: Probably they're just using the connectors for convenience, or consistency. Those are, the uh... Molex something ancient, can't remember the series offhand unfortunately. They'd be rated for some amperes, 8A I think, give or take the usual disclaimers of course. Not that you need to use them at that level or anything.The optos are good for a few to 10s of mA. They all seem to be pointed inboard, actually, and the current-limiting resistor (on the connector side) seems to be present as well.They're also rated for some kV of isolation, but the board does not appear to be designed for any significant voltage. It's probably a belt-and-suspenders solution for galvanic isolation (say <100V).Tim

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 29, 2020, 02:44:03 pm
content: Quote from: james_s on March 28, 2020, 11:37:31 pmCertainly, but at some point, you'd waste less time redesigning a full Z80-based board rather than trying to reverse-engineer and reuse this one, if you have something like this to add - and it may not even be possible to effectively modify the address decoding scheme if the original design had no free zone.In any case, as I pointed out and you also mentioned, figuring out the address decoding on the board would be the first thing to do before deciding.

author: james_s
author_rank: Super Contributor
timestamp: March 29, 2020, 05:52:55 pm
content: Sometimes it's just fun to hack something, even if there's no really logical reason to do so. One advantage of using the existing board is that you know it's wired up correctly and works.

author: rstofer
author_rank: Super Contributor
timestamp: March 29, 2020, 07:26:36 pm
content: Quote from: obiwanjacobi on March 29, 2020, 06:23:19 amYes, I used the 8080 mnemonics, oops.Either way, it is a load immediate of the HL pair with the constant bytes following the command.

author: tsvisimcha
author_rank: Contributor
timestamp: March 29, 2020, 09:41:26 pm
content: Hey all I'm having some trouble figuring out how to dump the eeprom. Any ideas? I have a bus pirate and a raspberry pi. I also have an Nvidia Jetson nano which has gpio.

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 29, 2020, 10:09:49 pm
content: Quote from: tsvisimcha on March 29, 2020, 09:41:26 pmIt's just a UV erasable parallel EPROM, not electrically erasable serial EEPROM. You'll need to peel off the sticker to find out if it's a 2764, -128, -256 or even -512. You could build an EPROM reader from an Arduino but you proabably need a port expander. You'll need an (E)EPROM burner if you intend to make your own.

author: Ian.M
author_rank: Super Contributor
timestamp: March 29, 2020, 11:27:59 pm
content: An Arduino Mega 2560 has enough I/Os (and even enough complete 8 bit ports) to read even large parallel EPROMs directly. A UNO, NANO or similar doesn't have enough I/Os. You've got 11 available digital pins (excluding D0/RXD and D1/TXD for host comms) and six analog pins that can be used as digital, for a total of 17 I/Os. Add an eight bit counter for EPROM A7:A0, with clock and clear from the Arduino I/Os, and you can read anything up to a 27C256 (32Kx8).Your bus pirate doesn't have enough I/Os broken out so will need I/O expanders. Probably the best bet is 2x 8 bit SIPO shift registers (e.g 74HC595) to drive the address bus and an 8 bit PISO shift register (e.g. 74HC165) to read the data bus, driven as a SPI device. N.B. the data will lag one SPI frame behind the address.A Pi has enough I/Os, but the 3.3V levels will be a royal PITA interfacing to a 5V EPROM. Probably the best option would be to use 74HCT (HCTto get 3.3V input level compatibility) shift registers in the same way as you would with a bus pirate, with a 1K8-3K3 resistor divider to drop MISO to 3.3V levels.

author: james_s
author_rank: Super Contributor
timestamp: March 29, 2020, 11:53:00 pm
content: If you want to dump the ROM, pick up a TL866, unless you have a lot of free time and want to hook up something like an Arduino Mega.

author: rstofer
author_rank: Super Contributor
timestamp: March 30, 2020, 12:32:14 am
content: Quote from: obiwanjacobi on March 29, 2020, 07:59:14 amYou just sprinkle the 0x21s without the following two bytes. The disassembler hits the LXI H instruction and considers the following two bytes to be the operand. Unfortunately, those bytes are some other instruction entirely.Code:sub01: <do something><do some more>RETdb 0x21 ; the fake instruction to trip up the disassemblersub02: LDA <addr> ; the disassembler takes the first two bytes of this LDA instruction as operand bytes for the LXI H<do some more>RET<lots more code>call sub01<and more code>call sub02<and so on>The point is, the LXI H, is never executed it is there simply to trip up the disassembler. It looks like the start of a code block because it follows a RET but it is not really an entry point.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 30, 2020, 06:41:58 am
content: Quote from: rstofer on March 30, 2020, 12:32:14 amOf course if you wish to deliberately get a disassembler out of sync any instruction which takes an operand placed before a block of code will do it.However it will only consistently confuse simple disassemblers - more sophisticated ones which aim to build a list of entry points by scanning for jumps and calls will be harder to trick with this technique.As I said the BDOS code and a similar block is not intended to confuse disassemblers (though it might do so) - it is there to turn a block ofCode:ep1: ld r, const1jr next_stepep2: ld r, const2jr next_stepep3: ld r, const3jr next_step...next_step:intoCode:ep1: ld r, const1db 0x21 ; fall through eating the 8 bit load immediately following - r should not be H or L, obviouslyep2: ld r, const2db 0x21 ; fall throughep3: ld r, const3db 0x21 ; fall through...next_step:It saves a byte per entry point and is primarily about code density over execution speed (and clarity, until you recognise the trick).

author: T3sl4co1l
author_rank: Super Contributor
timestamp: March 30, 2020, 06:55:25 am
content: Also easy to find if it's only ever done with the 0x21 byte.Tim

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 30, 2020, 07:00:32 am
content: Quote from: james_s on March 29, 2020, 11:53:00 pmPlus OP will need the burner if intending to make his own *EPROM.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 30, 2020, 03:49:14 pm
content: Quote from: greenpossum on March 30, 2020, 07:00:32 amThat's why I suggested the OP to replace it with a Flash chip. All you'd need is a TL866 which can handle these fine (check the one you select is supported) No need to mess with UV erasers and such.I've done that to restore a Sinclair QL.As I said before, I think reverse-engineering the address decoding on the board would be much faster than trying to figure it out from the disassembled code (I haven't seen any PAL/GAL, only discrete logic?), but in any case, a programmer such as a TL866 will come handy.

author: tsvisimcha
author_rank: Contributor
timestamp: March 30, 2020, 04:00:50 pm
content: Will this work?https://m.aliexpress.com/item/32951386262.html?pid=808_0000_0101&spm=a2g0n.search-amp.list.32951386262&aff_trace_key=&aff_platform=msite&m_page_id=7316amp-6U1iuuFAU6RA7PUPX_omKQ1585583972595&browser_id=e9767940aded429aa2f1e4fb52beaf99&is_c=Y

author: greenpossum
author_rank: Frequent Contributor
timestamp: March 30, 2020, 04:05:44 pm
content: Quote from: tsvisimcha on March 30, 2020, 04:00:50 pmIt's a clone of this:https://www.microchip.com/Developmenttools/ProductDetails/PG164130for programming PIC chips, not EEPROMs. TL866s start at around $50. If you don't want to spend that money, EEPROMs can be programmed with simpler circuitry with a Arduino. Something like this:https://github.com/beneater/eeprom-programmeror many others that a search will get you. Those designs will also allow you to read an *EPROM. But a TL866 is handy for later too.

author: rstofer
author_rank: Super Contributor
timestamp: March 30, 2020, 05:42:36 pm
content: Quote from: T3sl4co1l on March 30, 2020, 06:55:25 amI know that any 3 byte instruction (LXI H, LXI B, LXI D, LDA, STA and others that don't come quickly to mind) will work. I don't see why 2 byte instructions wouldn't do the same.In any event, it's something to look for if the disassembly seems to go off the rails.

author: TomS_
author_rank: Frequent Contributor
timestamp: April 01, 2020, 07:16:31 am
content: Quote from: tsvisimcha on March 28, 2020, 07:24:18 pmYou might not be able to do it without significant modification. CP/M wants RAM to start from address 0, but the Z80 starts executing from address 0, so you have to do tricks to swap ROM and RAM after boot. Might not to worth it on a board like this if it was purpose built for some other application.Otherwise there have been several Z80 machines built to run CP/M in recent times. Things like RC2014 can do it, there was a system by Sergey Kiselev and/or Grant Searle that could also do it. You might get some ideas of what you need from those systems.

author: Ian.M
author_rank: Super Contributor
timestamp: April 01, 2020, 02:08:35 pm
content: Its reasonably easy* to make a daughterboard to fit in the Z80 socket, carrying the Z80, extra RAM and logic to remap the memory map to something CP/M compatible, but unless the I/O facilities on the DYONICS PS3500EP board are particularly spectacular and useful, it just isn't worth it - you might as well just rob it for chips to build your own no compromises Z80 SBC.* assuming you are familiar with PCB design and comfortable ordering PCBs online, or alternatively are a demon at complex protoboard construction.