PDP-11/03, LSI-11 KEV11-C CIS option

[Eric Smith]

On Sun, Jan 31, 2016 at 10:24 PM, John Wilson <wilson at dbit.com> wrote:
>>I'd really like to get the F11 base instruction set control (part of
>>the DCF11 hybrid) and the KEF11-B CIS (six chip hybrid spanning two
>>40-pin DIP sockets) to be dumped in this way, but only if someone is
>>willing to sacrifice them. Given that the KEF11-B is fairly uncommon,
>>I'm not holding my breath...
>
> I'd certainly want to see something mostly just like it successfully
> read, before offering mine up to be next in line.  But, the beauty of
> computers is doing useful work, not hanging on the wall and being
> pretty ... so I feel like the "museum piece" mindset can easily be
> taken too far.

The MCP1600 chipset used in the LSI-11, WD16 (Alpha Micro AM100), and
WD9000 Pascal Microengine uses microcode ROMs that really are just
ROMs, so I was able to read them electrically. The trick with those is
that the control chip (CP1621 for LSI-11, CP1661 for WD16, CP2161 for
Pascal Microengine) contain two PLAs that can cause microcode jumps
based on the current microPC and the contents of the interrupt and
translation registers. The contents of the microcode ROMs themselves
are thus quite difficult to interpret without having the contents of
the PLAs.

John McMaster took photomicrographs of the CP2161 and stitched them together:
    https://siliconpr0n.org/map/wd/cp2161/mz_mit20x/
I was able to successfully extract the contents of the translation
PLAs by inspection:

I processed the PLA dumps with Python scripts into two forms, one
somewhat suitable to be human-readable, and one useful as input to a
simulator:
    http://www.brouhaha.com/~eric/retrocomputing/wd/microengine/microcode/

I used the former to annotate my microcode disasssembly, and put the
latter and the microcode ROM dumps into a simulator which has now
successfully executed the first 30 macroinstructions (UCSD p-code
instructions) from a PDQ-3 boot ROM.

A CP1621 control chip from an LSI-11 has been provided to John, and
once he has a stitched photomicrograph of that, I'll do the same with
it.  I've already disassembled the LSI-11 microcode (base, and KEV11-A
EIS/FIS), so I should be able to make progress on that quickly once
the control PLAs are extracted. I plan to simulate it as well.

Obviously I'd want to do the delid and photomicrograph of the F11 base
instruction set control chip, which is nowhere near as rare, and
verify that the contents can be extracted and make sense, before doing
the same to the KEF11-B.  I don't have any 11/23 (or 11/24) modules on
hand, or I'd be happy to sacrifice a DCF11 to do that.  If anyone
would care to sacrifice one...