Rohde & SchwarzSMS/SMS2 Microprocessor Board, where is the code/firmware stored? - Page 1
Forum section: electronics / repair

author: RichardM
author_rank: Frequent Contributor
timestamp: September 05, 2023, 06:35:53 am
content: Hi All,No responses from the R&S forum so thought I would try hereAfter successfully repairing an old SMS unit I could not help myself and purchased a spares unit. It was appealing as it had the oven oscillator option as well as the 1040MHz option which my working unit does not have.Anyway, I knew it was not working but thought I would at least try to power unit up and do some initial testing to see if it is repairable or not. This unit has a different Y11 microprocessor board (302.7111) versus my other unit that has 302.7057. This Y11 board has Intel P8049AH and P8355 IC's. I have identified there is a fault on this board and suspect it may be either to P8049 or P8355. I believe these both have masked rom but I am not certain. My question is, where is the R&S SMS firmware stored on this version of the Y11 ? My working unit has a UV EPROM. Is it on both the P8049 or P8355 ? or perhaps one of them ? The P8355 has a sticker with 302.7257 which suggests it may be stored here ? The other question is if either chip is dead then I guess the unit is not repairable, assuming the firmware cannot be read out or re-programmed ?Richard

author: fzabkar
author_rank: Super Contributor
timestamp: September 05, 2023, 07:21:49 am
content: P8049AH has a 2K x 8 ROM (page 101)http://bitsavers.informatik.uni-stuttgart.de/components/intel/_dataBooks/1988_Intel_Embedded_Controller_Handbook_Volume_I_8-Bit.pdf8755/8355 is a 2K x 8 EPROM/ROM with I/O (page 406/413)http://www.bitsavers.org/components/intel/MCS80/98-153D__MCS-80_Users_Manual_Oct77.pdfYears ago I managed to dump a faulty 8355 and then reprogram an 8755. I suspect that one of its I/O lines was bad.

author: RichardM
author_rank: Frequent Contributor
timestamp: September 05, 2023, 11:33:03 am
content: Thanks.How did you manage to dump the contents ? I have a an old Willem programmer working via parallel port and I have just etched an adapter pcb for the P8049AHto try. If there was an easier way to check the P8049AH that would be great.

author: Tom D
author_rank: Contributor
timestamp: September 05, 2023, 12:46:33 pm
content: The P8049 on my 7111 board also has a sticker on it (302.7234). Although I wouldn't bet the farm on it, I suspect the firmware is in the masked ROM in the P8049 microcontroller. If you can extract the ROM contents of the 8049 chip, the contents can be programmed to an 8749 EPROM to take its place.Tom

author: fzabkar
author_rank: Super Contributor
timestamp: September 05, 2023, 05:08:17 pm
content: Quote from: RichardM on September 05, 2023, 11:33:03 amI used to have a Sunshine Expro-80.

author: RichardM
author_rank: Frequent Contributor
timestamp: September 06, 2023, 04:37:41 am
content: Thanks TomMy P8049 has no sticker on it. Perhaps that is the issue,ie. someone had it replaced without realising the software is like pre-programmed on it. I get the feeling this is not going to be repairable unless someone has extracted the masked rom. Or maybe it is the same as the software on the eproms on my other microprocessor board?Richard

author: Tom D
author_rank: Contributor
timestamp: September 06, 2023, 05:23:50 am
content: G,day Richard,I've yet to see a P8049AH (HMOS) on a 7111 board, only the P8049. You've probably already noticed in my pic that in addition to the stick-on label, an R&S engineering number is also marked under the date code by Intel. 3027134 for the P8049 and 302.7286 for the P8355 chip. Earlier versions of P8355 chips, typically fitted to SMS units manufactured in the late seventies, were marked 3027140. How do the date codes on your P8049AH microcontroller correspond with the dates on the other chips on your 7111 board? It would be a real bummer if someone scrounged this chip out of a washing machine or something and fitted it to your SMS micro board.The firmware in the EPROM on the 7057 board is different to the firmware on the 7111 board.Tom

author: RichardM
author_rank: Frequent Contributor
timestamp: September 06, 2023, 06:30:50 am
content: Thanks TomI have attached a picture of my Microprocessor Board. Both B1 and B2 are dated 1977 which is encouraging. I am just hypothesising at the moment that the fault on the micro board is due to either B1 (P8049AH) or B2(8355). It may be something else, I have checked all the logic chips and diodes.Richard

author: Tom D
author_rank: Contributor
timestamp: September 06, 2023, 06:53:38 am
content: Hi Richard,Unless my eyes are deceiving me, it looks to me like the B1 chip (P8049AH) has a date of the 39th week of 1991 and the date of the B2 chip (P8355) is the 13th week of 1980.Tom

author: RichardM
author_rank: Frequent Contributor
timestamp: September 06, 2023, 07:52:48 am
content: Ahh, I clearly do not know how to read the date codes. So it does appear the 8049ah is a replacement, damn.

author: RichardM
author_rank: Frequent Contributor
timestamp: September 07, 2023, 12:38:15 am
content: So my only hope is for someone to be skilled enough, willing enough, game enough, to try to extract the firmware form their P8049 and generously upload.

author: Tom D
author_rank: Contributor
timestamp: September 07, 2023, 05:37:56 am
content: Hi Richard,If it was me, I don't think I'd bother to go through all of that. Rather, I'd be on the lookout to obtain an EPROM based 7057 board to upgrade the machine. As you may be aware, there are quite a few extra features the 7057 micro board provides over the basic 7111 equipped SMS.These are being able to set the GPIB address without having to pull the cover off the machine, non-volatile storage of 40 complete device settings (including frequency, modulation and level), current device settings are saved in the event of shut down or AC supply failure, and push button conversion into any of the four level units (uV, mV, dBuV and dBm) - if you do this on a 7111 equipped SMS, it makes like a Tasmanian; it's too dumb to calculate or convert the level units and the Overflow LED flashes.I have two 7057 board equipped SMS's I've used together. After a very late night imbibing obscene amounts of caffeine whilst plotting third order intercept points of radio control receivers, it was nice to be able to shut down everything and retire for the night knowing I could resume where I left off, with all the settings intact, at my own leisure. On the other hand, a 7111 micro board equipped SMS is terminally afflicted with power-on Alzheimer's Disease.Tom

author: RichardM
author_rank: Frequent Contributor
timestamp: September 07, 2023, 09:01:19 am
content: Hi TomI will keep key eyes open online for a 7057 board. I really don’t need a third complete unit so I may be waiting for a while.I may transplant the oven open option and doubler in the meantime. Nice to have another set of buttons also:)Richard

author: MathWizard
author_rank: Super Contributor
timestamp: September 11, 2023, 06:28:20 am
content: So how much code would there be on 1970s-80's era test equipment ? From scratch, how long would it take to recreate ? Would it be like a weekend problem, or more like an end of the semester project ?As more chips from that era fail, how hard is it to splice in modern chips and create suitable programming ?I have an older 3.5d or 4.5d Keithley DMM, I think all the hardware is off-the-shelf parts. Way down the road, I'd like to try make some code for it, w/ some modern MCU. I think I found it's firmware before, and it didn't seem that big to me, a novice programmer.If I could do that, I'd also like to try upgrading from 3.5d (or 4.5d) to 4.5d(5.5), with a few new chips added. BUt IDK how much work that would really take, for good results anyways.

author: RichardM
author_rank: Frequent Contributor
timestamp: May 16, 2024, 03:28:16 am
content: I managed to source another 7111 board on ebay. To my horror it appears the P8049 chip on that board is dead. Argh!!!!I built an Arduino reader based on the great work on mattmillman.com but the 2k mask rom read is different every time. The arduino writes and reads a P8749 fine. If only there was an SMS owner out there willing to read and upload the P8049 ROM for future prosperity 😀

author: RichardM
author_rank: Frequent Contributor
timestamp: May 16, 2024, 12:28:30 pm
content: OK, so after trying another method to dump the 8049 mask rom fromhttps://www.eevblog.com/forum/microcontrollers/mcs-48-disassemble-8049-dump/msg3121778/#msg3121778I managed to get a consistent rom dump. I have no idea if it is valid code. I used DASMx to disassemble and get the code attached.Programming this into an 8749, trying this with a 7111 board in a working SMS and........ no change. Just mixed characters on the display. So, maybe there is nothing wrong with the 8049 after all? Or, the code attached is rubbish ? Anyone willing to look at the assembly attached and make an educated post that would be much appreciatedCheersRichard

author: RichardM
author_rank: Frequent Contributor
timestamp: July 20, 2025, 05:08:48 am
content: Just closing this thread out after my obsession with trying to read the ROM from the P8049 Intel chip has come to an end.I ended up buying an old EMP-20 programmer and was success in reading the contents of the SMS P8049 (B1) and P8355 (B2) chips. One of the P8049 chips was indeed faulty and the code above was gibberish. Thankfully I had another working P8049 from another R&S SMS. I then confirmed are working by programming thrm back onto a P8759 and P8755 UV IC's.Richard