From: Pentti.Haka@mikrolog.fi (Pentti Haka)
Subject: Re: TEK 7854 Oscilloscope ROM board needed
Date: Mon, 26 Apr 1999 06:54:52 GMT

I found the ROM images. But, as usual, I have not documented anything,
and do not exactly remember what it was that I did. So the following
is based on vague memory:

The board contains three types of chips:

- the basic ROM set, 16 kwords, at address 0
- a patch EPROM set, 2 kwords, at address 0x9000
- an FPLA that maps the patched addresses to the patch EPROM instead
of the base ROM

Normal ROM board accesses go to the base ROM. When a part of the
program in the base ROM has been revised (patched), the FPLA directs
memory accesses to the patch EPROM instead. The FPLA only decodes the
patched addresses, and the actual patch code resides in the EPROM. A
typical patch is a few words only, inserting a jump instruction for
example, which then causes a jump to the EPROM address space where the
actual patch code resides. The patch EPROM contains three types of
data: 1) the patch words, that the FPLA inserts into the
instruction/data stream to cause jumps/calls to the patch code, 2)
actual patch code (subroutines etc) which are directly executed from
the patch EPROM and 3) part of the "normal" operating system code also
seems to reside on the patch EPROM.

At least in my scope, if I disable the patching mechanism altogether,
the scope does not work. This would indicate that the base ROM set
alone without patches is not a working version.

When the ROM board contents are read out using the edge connector bus,
the patches are automatically "visible" and are already contained in
the ROM image, so the patch FPLA must be disabled when the new EPROMs
burned from the image are installed (your FPLA probably isn't the same
version as my ROM image, so the patch addresses decoded by the FPLA
would be wrong anyway). However, you must still have the correct
version of the patch EPROM installed, since the EPROM also seems to
contain "normal" code, in addition to the patch data and code.

I have attached all files I found.

7854MSB.ROM and 7854LSB.ROM are the straight binary ROM images from
the base ROM, without patches. This is what you would get if you'd
read the ROM contents from each ROM chip individually.

7854MSB.PAT and 7854LSB.PAT are the straight binary ROM images from
the base ROM, and they include the patches. This is what you get when
you read out the board contents via the edge connector bus.

78549000.LSB and 7854-9F9.MSB are the straight binary patch EPROM
images. Do not ask why I have named the files like that, I do not
remember.

So what you should do is:

Burn 7854MSB.PAT and 7854LSB.PAT into 16 kbyte EPROM chips and
substitute these for the original ROM chips, using the technique of
your choice (I hope you have the service manual)

Burn 78549000.LSB and 7854-9F9.MSB into 2 kbyte EPROMS and plug into
the patch EEPROM sockets

Disable the patch FPLA, so that all accesses in the range 0-0x7fff
will access the two new base EPROMS (accesses above 0x9000 still must
go to the patch EPROM)


Hope this helps,
Pentti

======================
Pentti Haka
OH2TC
Pentti.Haka@Mikrolog.Fi
======================