Idorobots/temex-reverse

Uni Siegen Temex CPU card reverse-engineering.

★ 0Forks 0CGitHub ↗Compare

README

Uni Siegen TEMEX-1 CPU card reverse-engineering

Chips

  • Z80A CPU
  • Z80 SIO (DTRB optionally used for MAX691 watchdoag timer)
  • Z80 PIO
  • Z80 CTC (came inserted backwards in the card, likely due to the incorrect placement of the "notch" in the stand)
  • Intersil ICM7170
  • Maxim MAX691 (just backup battery, optional watchdog timer and reset)
  • 64kb EPROM (plus extra slot for another one)
  • 64kb SRAM (enable buffered via MAX691)
  • Two 74373 read-only ports on the external connector

Memory map

IO devices

74139 decoder:

/G B A Y0 Y1 Y2 Y3
/IORQ A7 A6 /CTC /SIO /PIO /RTC
L L L L H H H
L L H H L H H
L H L H H L H
L H H H H H L

Map:

Segment Device
00 - 3F CTC
40 - 7F SIO
80 - BF PIO
C0 - FF RTC

Memory devices

74139 decoder:

/G B A Y0 Y1 Y2 Y3
/MREQ A15 A14 /ROM0 /ROM1 /RAM /REGS
L L L L H H H
L L H H L H H
L H L H H L H
L H H H H H L

Map:

Segment Device
0000 - 3FFF ROM0
4000 - 7FFF ROM1
8000 - BFFF RAM
C000 - FFFF REGS

Memory extra

74139 decoder:

/G B A Y0 Y1 Y2 Y3
/REGS /RD A0 /REG0 /REG1 -- --
L L L L H
L L H H L
L H L H H
L L L H H

Map:

Segment Device
0 REG0
1 REG1

Program

Init

Stack is just 200 bytes deep set at lower boundary of the RAM. The RTC is not initialized.

Reset code:

restart_vector:
        ld sp,08200h            ;0000
        jp init                 ;0003

Init:

init:
pio_init:
        ; Configure Port A: input
        ld a,04fh               ;0069
        out (082h),a            ;006b

        ; Configure Port B: output
        ld a,00fh               ;006d
        out (083h),a            ;006f
ctc_init:
        ; Reset CS1 & CS2, use time constant
        ld a,007h               ;0071
        out (000h),a            ;0073
        out (001h),a            ;0075

        ; Set time constant to 4
        ld a,004h               ;0077
        out (000h),a            ;0079
        out (001h),a            ;007b
sio_init:
        ; Reset & send abort
        ld a,018h               ;007d
        out (042h),a            ;007f

        ; Select WR4
        ld a,004h               ;0081
        out (042h),a            ;0083

        ; CLK x16 (effectively 2400 baud), 1 stop bit, no parity
        ld a,044h               ;0085
        out (042h),a            ;0087

        ; Select WR3
        ld a,003h               ;0089
        out (042h),a            ;008b

        ; RX 8 bit, auto enable off, RX on
        ld a,0c1h               ;008d
        out (042h),a            ;008f

        ; Select WR5
        ld a,005h               ;0091
        out (042h),a            ;0093

        ; DTR off, TX 8 bit, TX on
        ld a,068h               ;0095
        out (042h),a            ;0097

        ; Select WR1
        ld a,001h               ;0099
        out (042h),a            ;009b

        ; Disable interrupts
        ld a,000h               ;009d
        out (042h),a            ;009f

Interrupts

CTC takes precedence over SIO, which takes precedence over PIO.

Interrupt vectors:

nmi_vector:
        jp l01dfh               ;0066

Interrupt handlers:

l01dfh:
        push af                 ;01df
        push hl                 ;01e0
        ld hl,09009h            ;01e1
        ld a,(hl)               ;01e4
        cp 063h                 ;01e5
        jp z,l01fah             ;01e7
        ld a,(08304h)           ;01ea
        cp 009h                 ;01ed
        jp z,l026fh             ;01ef
        add a,001h              ;01f2
        ld (08304h),a           ;01f4
        jp l0275h               ;01f7
l01fah:
        ld a,(08304h)           ;01fa
        cp 009h                 ;01fd
        jp z,l020ah             ;01ff
        add a,001h              ;0202
        ld (08304h),a           ;0204
        jp l0275h               ;0207
l020ah:
        ld (hl),000h            ;020a
        ld hl,0900ah            ;020c
        ld a,(hl)               ;020f
        cp 063h                 ;0210
        jp z,l0225h             ;0212
        ld a,(08304h)           ;0215
        cp 009h                 ;0218
        jp z,l026fh             ;021a
        add a,001h              ;021d
        ld (08304h),a           ;021f
        jp l0275h               ;0222
l0225h:
        ld a,(08304h)           ;0225
        cp 009h                 ;0228
        jp z,l0235h             ;022a
        add a,001h              ;022d
        ld (08304h),a           ;022f
        jp l0275h               ;0232
l0235h:
        ld (hl),000h            ;0235
        inc hl                  ;0237
        ld a,(hl)               ;0238
        cp 063h                 ;0239
        jp z,l024eh             ;023b
        ld a,(08304h)           ;023e
        cp 009h                 ;0241
        jp z,l026fh             ;0243
        add a,001h              ;0246
        ld (08304h),a           ;0248
        jp l0275h               ;024b
l024eh:
        ld a,(08304h)           ;024e
        cp 009h                 ;0251
        jp z,l025eh             ;0253
        add a,001h              ;0256
        ld (08304h),a           ;0258
        jp l0275h               ;025b
l025eh:
        ld a,000h               ;025e
        ld (09009h),a           ;0260
        ld (0900ah),a           ;0263
        ld (0900bh),a           ;0266
        ld (08304h),a           ;0269
        jp l0275h               ;026c
l026fh:
        inc (hl)                ;026f
        ld a,000h               ;0270
        ld (08304h),a           ;0272
l0275h:
        pop hl                  ;0275
        pop af                  ;0276
        retn                    ;0277

Rest of the logic:

l00a1h:
        in a,(042h)             ;00a1
        and 001h                ;00a3
        jp z,l00a1h             ;00a5
        in a,(040h)             ;00a8
        ld (08301h),a           ;00aa
        ld a,001h               ;00ad
        out (042h),a            ;00af
        in a,(042h)             ;00b1
        ld (08300h),a           ;00b3
        and 070h                ;00b6
        jp z,l00bfh             ;00b8
        ld a,030h               ;00bb
        out (042h),a            ;00bd
l00bfh:
        ld a,000h               ;00bf
        ld (08304h),a           ;00c1
        ld a,(08301h)           ;00c4
        cp 04eh                 ;00c7
        jp z,l00d7h             ;00c9
        ld a,000h               ;00cc
        ld (09009h),a           ;00ce
        ld (0900ah),a           ;00d1
        ld (0900bh),a           ;00d4
l00d7h:
        ld a,000h               ;00d7
        ld (08305h),a           ;00d9
        ld (0900eh),a           ;00dc
l00dfh:
        ld a,094h               ;00df
        out (081h),a            ;00e1
        in a,(080h)             ;00e3
        and 07ch                ;00e5
        jp z,l0100h             ;00e7
        ld b,a                  ;00ea
        ld a,00ch               ;00eb
        out (081h),a            ;00ed
        ld a,(0900eh)           ;00ef
        and b                   ;00f2
        xor b                   ;00f3
        jp z,l010ch             ;00f4
        ld (0900dh),a           ;00f7
        call sub_01c7h          ;00fa
        jp l010ch               ;00fd
l0100h:
        ld a,000h               ;0100
        ld (0900eh),a           ;0102
        ld (0900dh),a           ;0105
        ld a,00ch               ;0108
        out (081h),a            ;010a
l010ch:
        ld a,b                  ;010c
        ld (0900eh),a           ;010d
        in a,(042h)             ;0110
        and 001h                ;0112
        jp z,l00dfh             ;0114
        in a,(040h)             ;0117
        ld (08303h),a           ;0119
        ld a,001h               ;011c
        out (042h),a            ;011e
        in a,(042h)             ;0120
        ld (08302h),a           ;0122
        and 070h                ;0125
        jp z,l012eh             ;0127
        ld a,030h               ;012a
        out (042h),a            ;012c
l012eh:
        ld hl,08305h            ;012e
        inc (hl)                ;0131
        ld h,090h               ;0132
        ld a,(08305h)           ;0134
        ld l,a                  ;0137
        cp 001h                 ;0138
        call z,sub_0149h        ;013a
        call sub_01d4h          ;013d
        ld a,l                  ;0140
        cp 00dh                 ;0141
        jp z,l00d7h             ;0143
        jp l00dfh               ;0146
sub_0149h:
        push af                 ;0149
        push bc                 ;014a
        push de                 ;014b
        push hl                 ;014c
        ld b,000h               ;014d
        ld de,09001h            ;014f
        call sub_01aeh          ;0152
        ld b,080h               ;0155
        ld de,09002h            ;0157
        call sub_01aeh          ;015a
        ld b,040h               ;015d
        ld de,09003h            ;015f
        call sub_01aeh          ;0162
        ld b,0c0h               ;0165
        ld de,09004h            ;0167
        call sub_01aeh          ;016a
        ld b,020h               ;016d
        ld de,09005h            ;016f
        call sub_01aeh          ;0172
        ld b,0a0h               ;0175
        ld de,09006h            ;0177
        call sub_01aeh          ;017a
        ld b,060h               ;017d
        ld de,09007h            ;017f
        call sub_01aeh          ;0182
        ld b,0e0h               ;0185
        ld de,09008h            ;0187
        call sub_01aeh          ;018a
        ld a,00ch               ;018d
        out (081h),a            ;018f
        ld a,014h               ;0191
        out (081h),a            ;0193
        in a,(080h)             ;0195
        and 07ch                ;0197
        ld (0900ch),a           ;0199
        ld a,00ch               ;019c
        out (081h),a            ;019e
        ld a,094h               ;01a0
        out (081h),a            ;01a2
        in a,(080h)             ;01a4
        ld (0900dh),a           ;01a6
        pop hl                  ;01a9
        pop de                  ;01aa
        pop bc                  ;01ab
        pop af                  ;01ac
        ret                     ;01ad
sub_01aeh:
        ld a,b                  ;01ae
        out (081h),a            ;01af
        call sub_01c0h          ;01b1
        ld a,b                  ;01b4
        add a,004h              ;01b5
        out (081h),a            ;01b7
        call sub_01c0h          ;01b9
        in a,(080h)             ;01bc
        ld (de),a               ;01be
        ret                     ;01bf
sub_01c0h:
        ld c,014h               ;01c0
l01c2h:
        dec c                   ;01c2
        jp nz,l01c2h            ;01c3
        ret                     ;01c6
sub_01c7h:
        in a,(042h)             ;01c7
        bit 2,a                 ;01c9
        jp z,sub_01c7h          ;01cb
        ld a,(0900dh)           ;01ce
        out (040h),a            ;01d1
        ret                     ;01d3
sub_01d4h:
        in a,(042h)             ;01d4
        bit 2,a                 ;01d6
        jp z,sub_01d4h          ;01d8
        ld a,(hl)               ;01db
        out (040h),a            ;01dc
        ret                     ;01de

External connector

Looking at the connector from the pin side, component side up (pin 1 on the right, top on the... top).

Pin Top Bottom
1 VCC VCC
2 SIO CTSB PIO ARDY
3 SIO CTSA PIO BSTB
4 SIO TxDA PIO ASTB
5 SIO TxDB PIO A0
6 PIO B0 PIO A1
7 PIO B1 PIO A2
8 PIO B2 PIO A3
9 PIO B3 PIO BRDY
10 PIO B4 PIO A4
11 PIO B5 PIO A5
12 PIO B6 PIO A6
13 PIO B7 PIO A7
14 VCC SIO DCDA
15 SIO RxDA SIO RxDB
16 CTC TO2 GND
17 CTC TRG2 GND
18 Z80 RST Z80 NMI
19
20
21 SIO RTSA
22 SIO DTRA
23 REG0 D4 GND
24 REGS CLK REG0 D5
25 REG0 D7 REG0 D6
26 REG1 D4 REG1 D3
27 REG1 D5 REG1 D2
28 REG0 D2 REG0 D3
29 REG0 D1 REG0 D0
30 REG1 D6 REG1 D1
31 REG1 D7 REG1 D0
32 GND GND

Contributors

Idorobots

Issues