Posted on jeu. 15 février 2018 (last updated on ven. 02 mars 2018)

This part is about my attempt to modify the firmware to "fix" the problem of weird intial setup: a -160MHz offset and a resolution set to 5 digits.

In the previous part, we figured some probable spots in the firware where these default setup configurations might be set.

EPROM checksums

In order to be able to modify the content od the firmware without generating an error at startup, we must understand how checksum are computed.

The Service Manual for the 578B does not explain how it is computed. The one for the 545A gives a clue but is not valid for the 545B: in the Option 2 (power meter) calibration procedure, since the "power vs. power" and "power vs. frequency" calibration tables are stored in the EPROM, the checksum must be computed when a calibration is performed. For this unit, the value at address 0x02F6 must be set so that the sum modulo 256 of all bytes of the EPROM is equal to 0xFF.

So the checksum is just a matter of sum modulo 256, but on the 545B, each EPROM chip has its content verified, as can be deduced by the fact there are 3 error codes (31, 32 and 33), one for each EPROM chip.

I found the part of the initialisation code that compute this checksum:

; Test PROM bank i (i in 1,2,3);
; M000C: start address
; M000E: i
6041 Z6041       CLRA                             ;4F
6042             LDY     #Z4000                   ;10 8E 40 00
6046             LDX     Z000C                    ;9E 0C
6048 Z6048       ADDA    ,X+                      ;AB 80
604A             LEAY    -$01,Y                   ;31 3F
604C             BNE     Z6048                    ;26 FA
604E             STX     >Z000C                   ;BF 00 0C
6051             LDB     >Z000E                   ;F6 00 0E
6054             CMPB    #$03                     ;C1 03
6056             BEQ     Z605E                    ;27 06
6058             DECB                             ;5A
6059             LDX     #MFFEA                   ;8E FF EA
605C             ADDA    B,X                      ;AB 85
605E Z605E       COMA                             ;43
605F             RTS                              ;39

This chunck of code is called with the start address in 0x000C (set to 0x4000 on normal initial execution), and EPROM 'bank' in byte 0x000E (can be 1, 2 or 3). Once again, during normal init execution, this function is called with the value 1 in this memory cell.

So when i = 1 or 2, the sum if computed (in register A), and the result is compared to the value stored at 0xFFEA (first EPROM) and 0xFFEB (second EPROM).

For the third one (in which those checksum values are), no comparison is made, the sum is expected to be 0xFF, which can be achieved by modifying the value of byte 0xFFEC.

Frequency Offset

As explained before, the frequency offset initial value seems to be set in the chunck of code around 0x6118-0x6125:

6118             LDX     #M0276                   ;8E 02 76
611B             LDA     #$01                     ;86 01
611D             STA     ,X                       ;A7 84
611F             STA     $02,X                    ;A7 02
6121             LDA     #$60                     ;86 60
6123             STA     $03,X                    ;A7 03

So the easiest way to remove this is to replace this code by NOPs. I've tried this, computed the checksums and burnt a pair of EPROMs (only bank 1 and 3 are modified).

And it worked! Mostly. The offset set to 0 as expected, but the "Offset" indicator remains on. I can live with that, but I'll try to figure out how to fix this also, if possible.

Digits Resolution

The chuck of initialisation code related to this setup is:

6125             LDX     #M005D                   ;8E 00 5D
6128             LDA     #$0D                     ;86 0D
612A             STA     $01,X                    ;A7 01
612C             LDA     #$05                     ;86 05
612E             STA     >M0045                   ;B7 00 45

At least the last 3 lines are directly related to this resolutin setup. So I've tried to replace these few opcodes with NOPs.

And the result is a partial success: all the digits are displayed when I power the device on, but the frequency counter still computes only 5 digits, the other ones stay zero. The gating is not modified. Not very useful as is... More digging required!