On Jan 6, 21:44, The Wanderer wrote: Ah, I see. Sorry, I made the wrong interpretation there :-) OK. From what you've written there, and a few other places, I assume you have some manuals and/or printsets? That makes sense. On an M9312, it simulates a power-down and then power-up. you to Are they M8728-AA or M8728-CA? The latter is only 16KW. The easy way to tell the difference, if there's no -A or -C beside the number, is that on etch revision B and higher, the 64KW board is fully populated with 64K DRAM, while the 16KW is only partly populated. I suspect there might once have been a fully-populated 16KW version that used 4K DRAMs, though. I was, no surprise to anyone, wrong about their having switches -- showing my ignorance about the specifics of 11/70's. Most of the things I've written are gleaned from the meagre information in one or two of the processor handbooks, or from my (incomplete) collection of microfiche. Anyway, the memory box has switches on the front (and I assume you've checked those?) but as far as I can see from the 'fiche, the memory card base addresses depend only on their position in the box. So the two cards have to be adjacent, and nearest the other cards, I think. Do you agree? It looks as though the box might be set to the wrong address -- 400000 is 131072 decimal, or 128K -- and is only showing 16KW (32KB) of memory. I don't know how you set the address of the box, though. value [...] OK, I've found some data (actually the listing) for that ROM. It's assembled at 165000 (but it looks like position-independant code, so that's possibly not its real address). It ends at 165776, ie 1000 bytes (octal) later. It is indeed an 11/70 diagnostic ROM for the M9312, probably just a later version than the 23-616F1 my other docs refer to. The docs say there's no way to enter the diagnostics directly, only by entering a bootstrap at the "run with diagnostics" address. They suggest that would be 173006/173206/173406/173606 depending on whether you're booting from a bootstrap ROM in socket 1, 2, 3 or 4. The docs also say that when the 11/70 powers up (or you press a boot switch attached to TP1 and TP2 on the M9312), it loads the PC from address 773024, and PSW from 773026. And indeed every boot ROM has a reserved word at that address for the PC, followed by 000340, which is the usual interrupt mask to set in the PSW for booting. Every ROM has code (opcode SEC) starting at 173x04 leading to a BCC BDIAG at 173020. In every boot ROM, that branch goes to an absolute jump, JMP @#DIAG, which in turn leads to a PC-relative jump at absolute address 165564, which goes to 165000 (the actual code is 165564 000167 177210 DIAG: JMP START). Why do you think address 777644 is the diagnostics ROM start address? All the 11/70 tests halt on error (unlike the CPU diagnostics for the 11/34 and other processors, which loop on error). The first section tests assorted instructions that needn't to use memory, the secondary CPU tests use the stack (R6 set to 000776). However, the very first instructions in the diagnostics code store registers at 000700...000704, and use 000706 to hold a flag which tells the code whether it's running on an 11/60 or an 11/70. If the memory isn't working, this will cause problems later in the diagnostics. Address 165344 is one of the error halts partway through the secondary CPU tests (assuming the diag ROM starts at 165000). What it does is set SP=776, then does a PC-relative JSR to the address 2 ahead of where it is. The code there checks to see if the top of the stack contains the correct return address, and should halt at 165326 if it doesn't (it should halt at 165320 if the JSR didn't execute). If it does see the correect return address, it adjusts the stack contents, does an RTS, ending up at 165342. At 165342, it pushes a zero and an address on the stack and then tests RTI. 165344 is the address of the push instruction, and 165350 is the RTI. That's folowed by a jump to the next test, which is the memory-sizing routine. So having it loop until you stop it, and then halt at some address ending in 344 doesn't make much sense to me. Either you're not starting at a sensible address, or there's something wrong that is sending it into a loop. That could be a CPU fault, or maybe (I've not read all the cache test code) something to do with not having memory between 000700 and 001000. -- Pete Peter Turnbull Network Manager University of York