On Sat, May 2, 2015 at 10:41 PM, Seth Morabito <lists at loomcom.com> wrote: similarities to the TDL-12 firmware. In particular I can see some binary data that would be DMA'd into the PDP-11 host memory that would be executed as the host side communication channel to the TDL-11 on board configuration utility. I would have to spend more time disassembling the firmware to try to figure out what triggers it to DMA that code into the PDP-11 host memory and then start the execution of the configuration utility.

On Sun, May 3, 2015 at 10:08 AM, Sean Caron <scaron at umich.edu> wrote: What's strange about a Z8400? That's a normal Z80 CPU. If there are two additional digits after "8400", that's the rated speed in MHz, as opposed to the older alpha scheme (Z80 = 2.5 MHz, Z80A = 4 MHz, Z80B = 6 MHz, Z80H = 8 MHz).

* On Sun, May 03, 2015 at 12:00:51AM -0700, Glen Slick <glen.slick at gmail.com> wrote: I disassembled the binary image with z80dasm, but my Z80-fu is very weak. If it were a 6502 or a WE32100 I'd have it figured out by now! Nevertheless, I'll keep at it and see if I can get anything out of it. -Seth

On Sun, May 3, 2015 at 1:49 PM, Seth Morabito <lists at loomcom.com> wrote: "KDF11-J" what's that? Do you mean M8189 KDF11-B 11/23-PLUS? If so, do you have the 23-380E4 & 23-381E4 (KDF11B-BH) or 23-453E4 & 23-454E4 (KDF11B-BJ) firmware with the MAP command? If you do then you should be able to use that to scan the I/O space to see where the TDL-11 CSR is located. The default should be 17774400. If it does not appear to be located there but you can identify where it is located maybe you can figure out how the dip switches map to the CSR address bits and relocate it to the standard address. On the TDL-12 you would use ODT to write 1000-octal to the CSR base register and then begin execution at 1000-octal after the controller DMA'd the host side DMON communication code there. After disassembling the TDL-11 firmware it appears that you might need to write 400-octal to the CSR base register instead of 1000-octal to get the controller to DMA the DMON communication code to 1000-octal. If that works and the code is DMA'd to 1000-octal and you start execution there it should result in this menu display on the console: "IAX 3.2 (C)1984 TD Systems\r\n" " B Boot\r\n" " C Configuration\r\n" " D Display\r\n" " E Exercise\r\n" " F Format\r\n" " S SCSI Cmd\r\n" " T Test TDL\r\n" " W Write BSF" Followed by a "DMON= " prompt where you would enter one of the above choices. -Glen

Well now I have egg on my face... * On Mon, May 04, 2015 at 01:05:44AM -0500, Seth Morabito <lists at loomcom.com> wrote: No, actually it DOES work. As is often the case in these situations, the failure was human error. I miscounted my QBUS slots and had this in the A&B slots of row 5 of the backplane, with nothing in C&D -- no DMA grant continuity! I switched it to C&D of row 5, and now it works: @ 17774400/000201 400 @ 1000g IAX 3.2 (C) 1984 TD Systems B Boot C Configuration D Display E Exercise F Format S SCSI Cmd T Test TDL W Write BSF DMON= Now getting it to talk to my SCSI ZIP disk will be another exercise entirely. So far it's not working, but I anticipate human error there as well. -Seth