Rohde & Schwarz NGSM 32/10 power supply firmware
================================================

CPU D301 (MC68HC711E9):
-----------------------

* NGSM_429.013.01.bin			Rev ??
  NGSM_429.013.01_EEPROM.bin
  
* NGSM_429.016.01.bin 			Rev 429.016.01  (22.05.1997)
  NGSM_429.016.01_EEPROM.bin
  
* NGSM_429.016.05.bin			Rev 429.016.04  (22.08.2000)
  NGSM_429.016.05_EEPROM_1.bin
  NGSM_429.016.05_EEPROM_2.bin  (from different units)
  
  
 EPROM D504 (27128) on RS232 option B1:
 --------------------------------------
 * (n/a)
 

 EPROM D504 (27256) on GPIB  option B2:
 --------------------------------------
 * NGSM_429.011.04.bin          ("new" layout without jumpers)
 
  
  
To read firmware from microcontroller: 
--------------------------------------

Connect FTDI UART adapter to D301 RxD, TxD, Gnd. These signals can be found at 
the Option connector X305. Pin 3 (PD0/RxD) goes to FTDI TxD, pin 4 (PD1/TxD) 
to FTDI RxD, pin 15+16 (MC_Gnd) to FTDI Gnd. Connect a 4k7 pullup resistor 
from pin 4 (PD1/TxD) to pin 1+2 (+5VMC). Connect a switch from pin 9 (/RST) to
pin 15+16 (MC_Gnd). Solder a wire from R301 pin 3 (MODB) to Gnd. This puts the 
microcontroller in Bootstrap mode.

On PC side, start a terminal program that is able to handle hex values (e.g. 
HTerm). Set 1k2,8N1. Turn on NGSM and release /RST (open the switch). Terminal 
should receive a "break" character (0x00). Start binary capture and send "0xFF 
7E BF 03" to the NGSM. It should answer with a binary stream. Capture at least 
13 000 bytes, then close the /RST switch.

With hex editor, strip the first four or five characters (0x00 plus the bytes 
you sent -- these have been echoed back. Keep 12 kB (0x3000 bytes) of code and 
delete the rest. Program counter wraps around, therefore you will see the RAM 
contents (starting from address 0x0000) following the EPROM dump.

To capture the EEPROM contents, repeat this procedure, but send "0xFF 18 CE B6 
00 7E BF 03". EEPROM size is 512 bytes, starting at 0xB600.

For advanced debugging or programming the (E)EPROM, use JBUG11 instead of the
terminal program: https://sourceforge.net/projects/jbug11/ 

Note: it is not intended to program the 68HC11E9 EPROM in-circuit. To do this, 
pin 18 (/XIRQ) of the controller would have to be separated from the remaining 
circuit (cut PCB traces) and connected to Vpp = 12.25 V. 

Remember to remove the MODB jumper wire to re-enable regular single-chip mode.


Patrick
2019-11-20 ps



