ADVANTEST R9211B

[m k]

Don't worry about multiple replies.
I'm just sitting here feet up and watching pictures, and poking the keyboard when something comes up.

5F1Cxx ?
5F08xx *CSRTC
5F34xx ?

It seems that I've all the time seen that CRT controller is somewhere in the I/O map as a CRTC, somehow I've mixed it with Real Time Controller.
So actually 8245B is a CRT controller, but the old one, so it is no more and current one can be very different, or it obviously is very different, but how different its I/O map is, we don't know.
So address 5F34xx can be very legit.

82C79 KBC, RTC, X2864 E2PROM and program module, those are clearly a group.
I/O map indicates that one D71054 timer is also part of it.

*BZON is easily a buzzer and can be controlled by 1/3 timer of the chip near by.

*INTCLR is tricky, or maybe not, maybe it's for the connector near by, INTensity ControLleR perhaps.

Counter chip is bidirectional, so max 4 addresses can be for 1 counter chip.
If that style is used then connections can be coded through something instead of its A0 and A1 directly to CPU address lines.

Upper edge of ROM module has some logic chips.
xx00 is 4x 2 input NAND
xx240 is 8 bit buffer/driver, same as xx244.
xx138 is 3to8 line decoder.
xx02 is 4x 2 input NOR
xx139 is 2x 2to4 line decoder.
The module has also 3x 32 pin connector and all of those logic chips are not needed for memory access.
So memory part is different, but DIP switches can be a part of the group.

xx240 is also very suitable for those DIP switches, resistor network also.
On the other hand many traces go directly past that chip, maybe it's just an angle of a picture.
2nd part is clearly for DIP switched, 1st one not so sure.

Top right of the ROM module picture is connector J2.
It's clearly connecting something near those DIP switches up or down.

If those DIP switches are a MODESET there must be a 5F18xx coded to that xx240.
Whole address contains 16 bits, that's too much, but last 8 or 9 is easy.
Since I/O map is divided as it is, it's more likely only 8 bits.

---- ---- 0001 1000 xxxx xxxx
Variations are many, either gates first or decoders first.
If both xx240 parts are uses 2x 2to4 line is spot on, that's also spot on for ROM chips.
If decoders are last then final address polarity doesn't matter.
xx02 pins 8 and 11 are shorted, it's clearly narrowing something.

If address coding is more predefined, like is rational if motherboard parts are included, the rest may be as narrow as 2 or 3 bits.
Then single decoder chip would be enough.

If MODESET is 8 bits wide with only 1 address, xx240 enable pins 1 and 19 are connected.
Output is 3-state, so no other latches are needed.
More than 1 MODESET address would be better, then sanity check is also possible with unused data bits.
And if that is the case then also 5F1Cxx address can be a completely legit thing.

Possibility is also that 3rd I/O map set is totally legit.
8245B CRT controller has the whole 8 bits wide access area in use.
If so then those 2 right side timer chips are pretty unknown.

3rd I/O map set has those RD things.
Only block diagram missing part is front panel encoder, but it's totally elsewhere and very simple.
Back panel has many input and output clocks, but all of those unknowns are RD, like read and so for input, or it can be Rear Data and so address 5F34xx is back as unknown.

*SOFTRST can be the upper timer on the right.
There are many things that can trigger it, like those clock chips.
So it can be a watchdog.

[stfjohn]

How do I figure out which is pin 5 of the 63484 from the copper side of the circuit board?

[m k]

The "dot" in the middle of the upper edge is index, so position 1 is above it.
Then normally counter clockwise, so 4th left is 5 and last is 9.

Seems that you must measure where that pin goes.

E,
I read that there are also non standard sockets.
Real or not, better do a measurement.

Standard goes so that last pin of a side has no pair and outer is smaller, but pin 1 moves to inner side when pin count goes low enough.
For 68 pins outer row of 1st side is for odd numbers, so 5 is 3rd from the end.

[stfjohn]

here is the scan as per your last post.

[m k]

That's a completely sane picture.
No chip is selected because address is 5F1Cxx and that position is empty.
So for now your problem seems to be a program error.

But maybe we can gain something from those _CS pins.
So change trigger one by one to POD 06 to 15 going low.
If it's triggered take a picture.

[stfjohn]

Trigger pod 06, 07, 08 : nothing changed.

[m k]

Pictures are rational and real I/O map seems to be quite different, so a pictured one can be only a principle map and for now program error is no more.
But now you must explain a bit how you made those pictures.
I was expecting that _CS POD line going down is visible.

We also know that CRT controller is accessed, so its _CS line goes down, but now it's missing.

Pictured addresses
5E00xx POD 13 32081 21 _SPC FPU
5E04xx 5E08xx 5E0Cxx

5E10xx 5E14xx 5E18xx 5E1Cxx

5E20xx POD 11 62421  2 _CS0 RTC
5E24xx
5E28xx POD 12 62421 15 _CS1 RTC
5E2Cxx POD 14 8279 22 _CS KBC

5E30xx 5E34xx
5E38xx POD 09 71054 31 _CS U86 timer
5E3Cxx

5F00xx
5F04xx POD 15 9914 3 _CE GPIB
5F08xx
5F0Cxx POD 10 68450 17 _CS DMAC

Missing
POD 06 63484 5 _CS CRTC
POD 07 71054 31 _CS U52 timer
POD 08 71054 31 _CS U67 timer

[stfjohn]

I took the measurements exactly as you suggested. The only doubt is that pin 5 of the 63484 is not the one in the photo where I soldered the strip...

[m k]

I'd put it to same position.
So for now a guess is that "no change" is CRTC.

Earlier stuff,
picture of reply #78, how was that triggered?

Lower part of ROM module, leave it if it's difficult,
connector side has probably some RAM chips, but other end has also something, more RAM chips or something else?

So I've been seeing things again.
ROM board J2, instead of up or down it's obviously connecting a pin of external something.

Can you easily connect a POD pin to ROM board HC240 pins 19 and 1?
It's for finding MODESET, just leave it if it's too complicated.

Can you scroll analyzer screen left and right, can you see somewhere that _CS POD pin goes down?

Few logic chip IDs needed.
Don't do it if you can't do it without dismantling the current setup, not that important.

1 left of DMAC and 5 under it, 1 is clear, rightmost seems to be 139.
1 right of FPU and 2 under it.
7 around a bottom right corner, the bigger one seems to be 74F something, but maybe not.

[stfjohn]

I did the scans again anyway, because I noticed that, for each trigger pod, the scan varies at least 4 times before stabilizing.

[m k]

Change trace mode to single.

You must get pictures where _CS POD signal goes down like POD 06.
Now we know for sure that this 5E10xx address is for CRTC, all others are unknown.
Addresses are possibly real, but they can't be connected if triggering POD signal is not going down.
There can be other addresses that have happened before or after trigger and are now in picture.

All pictures that are aborted are probably not triggered.
Others have the actual happening somewhere else, possibly later in data.

[m k]

before stabilizing.

Ok, my bad, I didn't nag enough.
I forgot your background and assumed that you've used external trigger.

Digital signals are not defined by repetition, that's for next level.
There are no practical settling time either, every moment counts.
For low frequency things like this these moments are transitions, so change of level either up or down.
There is of course a transition delay, but that's it, after that the same thing can't happen again before that same transition happens.
So it's either rising edge or falling edge, usually only one, but 68k CPU can use both.

CPU R/_W pin defines writing when it goes low, so falling edge.
Read doesn't happen when level goes up, it's defined elsewhere.
Those read and write moments are part of cycles, there are also many other cycles.

Before those actual read and write operations have meaning there must be an object.
That object must also have time to adapt, transition delay again.
Same with all parts around that happening, like buses.
Cycle includes all of those moments, one cycle lasts many clock pulses.

Generally cycle must end before next can start.
Since R/_W pin defines writing it can also define its end by going up.
That is a normal procedure, down is starting and up is ending for generally everything of falling edge things.

Inside a cycle are different periods.
It is said that certain time period the thing is valid, like data in write cycle.
So at some point when R/_W pin is down the data must be present, address also.
Since everything are based on clock pulses and everything can't happen at once there is a propagation delay.
That's sort of a settling time, but not for a signal, it's settling of different parts of a circuit and can last more than one clock pulse.
For that datasheets have cycle timing pictures.

When chip is accessed it is first selected.
There can be many chips selected at once, but then occupied bus must support that.
Usually address bus is for many and data bus for one, in our case I/O address bus is also for one.
Chip can also be valid only when it is selected, so when _CS pin is down, underline means active low.

[m k]

the scan varies at least 4 times

Our POD 00 to 05 are 6 address pins of 23, so there is an assumption that those 6 can indicate enough.

Your latest set of pictures have POD 06 going down, that moment is only moment when that chip is selected.
So address pins of that period are for that POD 06 chip.
All other addresses, before and after, are for something else.

Bright side is that those pictures have also many other chip select lines.
So if none goes down the address is also for none.

Down side is that 6 address pins of 23 can't tell much without that chip select line.
But we have other pictures and there is a pattern.
My guess is that those wide up, short down and wide up again sets are real, and if CPU R/_W pin is connected it is just like it was earlier when it was connected.

POD 06 5E10xx 63484 5 _CS CRTC

POD 07 ---- 71054 31 _CS U52 timer
POD 08 ---- 71054 31 _CS U67 timer
POD 09 ---- 71054 31 _CS U86 timer
POD 10 *** 68450 17 _CS DMAC
POD 11 *** 62421 2 _CS0 RTC
POD 12 *** 62421 15 _CS1 RTC
POD 13 ---- 32081 21 _SPC FPU
POD 14 ---- 8279 22 _CS KBC
POD 15 *** 9914 3 _CE GPIB

Dash line pictures are aborted, so no trigger.
Asterisk line means that somewhere in the data that _CS POD pin goes down and there is an address for that chip.

Chip select of floppy controller is not connected.
Same with stuff like MODESET.

something else in a picture, none of above
POD 09 5F1Cxx
POD 11 5E30xx *
POD 12 5E2Cxx
POD 13 5E30xx *

something else in earlier set of pictures, none of above
POD 09 5E38xx *
POD 10 5F0Cxx
POD 11 5E20xx
POD 12 5E28xx
POD 13 5E00xx
POD 14 5E2Cxx
POD 15 5F04xx

something else in even earlier pictures
R/_W signal present and writing
5F1Cxx
5F08xx
5F34xx

* different timing

[stfjohn]

I redid everything using the ext output trigger of the HP 1651A and with single acquisition. However, each time, I get different scans... I don't know!

[m k]

Change POD 06, connect it to CPU R/_W pin 9.

Then do POD 07 to 15 once more.
Maybe those differently timed signals are also addresses.
If new POD 06 goes down under them we know they are.
You can also scroll left and right to see different settings.

Then put analyzer a side for a moment, leave test pins as they are, if there is no harm, and pull motherboard out, or not if you're already familiar enough for measuring the under side.
No need to get stuck with the analyzer, but don't give it away if you can keep it.

Then start finding motherboard traces, that's at least more exact science.
Concentrate to high addresses of CPU first, A22 down to A20, pins 51, 50 and 48.
Check if you can find a connection, reply #74 has some chip stuff.

PAL chip pins 1 to 9 and 11 are inputs, CPU addresses can be connected there.
3to8 line 74138 pins 1, 2 and 3 are inputs, that's other promising target for CPU addresses.
Next level goes so that previous chip's output is next chip's output enable, for 74138 that's pins 4, 5 and 6.
If you find a connection between 2 logic chips you can start finding lower CPU addresses from the receiving chip.
Since some I/O area addresses are not used there can be gaps all the way, that would be a partial addressing where many addresses mean the same thing and nothing unusual.
There can be also a single gate coding those unused address pins, since 74138 has 3 enable pins that's even a probable design, but 1 must come from the higher level 74138.

If finding traces start irritating update those unknown chips from end of reply #83.
It's likely that one logic chip is not in order, so you possibly need to find it anyway.

I'll check if I can see the light in analyzer manual.
Seems that the current setup is 16 timing and 16 state channels.
We can possibly see more if we use 32 state channels.
With luck we can then forward the program step by step and finally see exactly what and where is the problem.
Since many I/O chips are 8 bits wide we can drop half of CPU data bus off and use freed pins as _CS pins and then use them as stepping stones for software hops.

Pictured addresses, not for triggering _CS pins.
POD 06 5F04xx
POD 07 5F0Cxx
POD 08 5E14xx *
POD 09 5E10xx * no CRTC _CS
POD 10 5E2Cxx
POD 11 5F30xx
POD 12
POD 13 5E38xx *
POD 14 5E34xx *
POD 15 5E28xx *

* different timing

E,
Very early picture 3 and POD 11 of reply #84 have similar happenings.
Maybe 5E30xx has something to do with the problem.

[m k]

Triggering.

From Timing Trace menu you can check your triggers.

Then Find Edge box under a label has a dollar sign if trigger is set.
Disable wrong ones by changing the pop up to period signs.
Then set the correct one to down arrow, select done and a dollar sign appears.
Trigger is now set.

Next you hit Run, soft boot the machine and hope the best.
If trigger is found before booting you can skip it.
Address is above the moment when triggered signal is down.

If soft booting is not possible the trigger may need a triggering delay.
Every _CS signals go up when problem machine start operating, so there shouldn't be any unwanted falling edges.

E,
triggering signal can't stay down.
It being down means that address and data bus are occupied.

[stfjohn]

Sorry: even with the trigger set as you suggested, then connecting the logic analyzer's trigger output to the various pods (obviously varying the trigger setting from one pod to another), I still get different readings every time I turn on the Advantest!

[stfjohn]

This is the first trigger that I then enabled on pod 06. Then I enabled, one at a time, the triggers on the other pods towards the right.

[stfjohn]

(trigger pod 15)

[m k]

Something is not right.
Your picture of Timing Trace Specification is also different than expected.
I thought there will be only one edge specifying position.

Your Timing Trace Specifications picture has only POD 1, like the whole POD.
I don't know what that means, maybe something earlier is needed but not defined.
Maybe something you did cleared some other things.

One more time then.

First Timing Format Specifications, press Format key.
There you connect physical POD pins to labels.
Every physical pin should be assigned to one label.
So finally you have signs stepping left and down.

I understand Timing Trace Specifications from the Getting Started manual so that you have a physical pin position for its label marked with down arrow.
So the arrow in your earlier picture should be for POD 1 06, but your picture doesn't have individual pins at all.

Maybe the manual I'm reading is for different software version.
If your Timing Trace is still the same with only POD 1 selection available and Timing Format was all set then no need to do new pictures.
But if you changed Timing Format then you can try again.
Timing Trace like you have is completely rational, but resulting waveforms are not.

[stfjohn]

Is this the correct procedure?

[m k]

No.
Only rightmost pin to 1st label.
Then 2nd pin from right to label B, 3rd pin from right to label C and so on.

Now your pictures are so that all physical pins are connected to POD 1.
So POD 1 row is picturing all waveforms on top of each others and other rows are empty.

[stfjohn]

And now?
But, in the "trace" screen, going to "edge", I can no longer get the dollar symbol!

[m k]

Reference Manual is not clear.

Add one more label and assign all bits to it, like the original POD 1 was.
Can you use that as a trigger source, like you did earlier?

If not then start over, put trigger source to 1st POD 1, like it was and add individual labels after it, so that finally you have 17 labels, POD 1 with all pins and 0 to 15 individual pin assignments.
Can you then use triggers, like earlier when it worked?

[stfjohn]

I checked with the oscilloscope: whatever combination I use, at the "ext trigger" output of the logic analyzer, there is no signal! I have a doubt: I have always connected the "clock" pin of the analyzer probe to pin 15 of the CPU: is this a correct procedure?