{"id":94,"date":"2022-03-10T09:06:49","date_gmt":"2022-03-10T08:06:49","guid":{"rendered":"https:\/\/radix-studio.fr\/blog\/?p=94"},"modified":"2022-05-24T14:10:47","modified_gmt":"2022-05-24T12:10:47","slug":"going-deeper-on-the-m6000","status":"publish","type":"post","link":"https:\/\/radix-studio.fr\/blog\/2022\/03\/10\/going-deeper-on-the-m6000\/","title":{"rendered":"Going deeper on the M6000"},"content":{"rendered":"\n<p>I recently purchased a \u00ab\u00a0non working\u00a0\u00bb TC Electronic System 6000, here&rsquo;s a few notes of what I found while trying to fix it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"280\" height=\"226\" src=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_sos.gif\" alt=\"\" class=\"wp-image-106\"\/><\/figure>\n\n\n\n<p>The TC Electronic System 6000 is based on two units:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The Mainframe with a floppy disk drive and a PCMCIA slot<\/li><li>The Remote + Icon<\/li><\/ul>\n\n\n\n<p>In my case, the remote unit works fine: the system boots properly, shows the Windows NT4 splashscreen and then the M6000 GUI.<\/p>\n\n\n\n<p>The Mainframe unit is another story: the front panel is fixed red and.. stays red.<\/p>\n\n\n\n<p>During a normal boot process, it&rsquo;s supposed to access the floppy disk drive and the LED turns green once the boot is complete.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Mainframe parts<\/h2>\n\n\n\n<p>The mainframe unit contains the following parts:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>A power supply<\/li><li>A floppy disk drive<\/li><li>The AES\/DSP cartridge<\/li><li>The AD\/DA cartridge(s)<\/li><li>A network card<\/li><li>The mainboard<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"768\" src=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2-1024x768.jpeg\" alt=\"\" class=\"wp-image-100\" srcset=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2-1024x768.jpeg 1024w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2-300x225.jpeg 300w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2-768x576.jpeg 768w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2-1536x1152.jpeg 1536w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_parts2.jpeg 2016w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Power supply<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"768\" src=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU-1024x768.jpeg\" alt=\"\" class=\"wp-image-98\" srcset=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU-1024x768.jpeg 1024w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU-300x225.jpeg 300w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU-768x576.jpeg 768w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU-1536x1152.jpeg 1536w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_PSU.jpeg 2016w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/figure>\n\n\n\n<p>The power supply unit delivers +\/-5V and +\/-20V:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Black \/ Red 5V<\/li><li>Black \/ Gray -5,2V<\/li><li>Black \/ Brown 20,5V<\/li><li>Black \/ Blue -21V<\/li><\/ul>\n\n\n\n<p>There&rsquo;s also two wires connected to the fan (and a temperature probe): red\/blue 5V. The potentiometer is probably used to adjust the temperature level triggering the fan.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Motherboard<\/h2>\n\n\n\n<p>Taking a look inside the unit shows the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>the internal DIP switches are in default position: ON ON OFF OFF OFF OFF ON ON<\/li><li>the LEDs are in the following state: ON OFF OFF BLINK<\/li><\/ul>\n\n\n\n<p>I tried booting without additional units (AD\/DA, DSP, floppy disk drive, ethernet card) without success.<\/p>\n\n\n\n<p>I also tried replacing the floppy disk drive with a Gotek floppy to USB emulator. This actually didn&rsquo;t worked, the floppy drive is still not accessed. Since the Gotek drive has many configuration options it&rsquo;s hard to tell if it&rsquo;s normal.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>The motherboard hosts:\/ <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>H8\/3003, 16bits microcontroller<\/li><li>A QuickLogic FPGA<\/li><li>A floppy disk drive controller<\/li><li>Two RAM chips<\/li><li>A Flash chip<\/li><\/ul>\n\n\n\n<p>As far as I understand the system, the H8 is in charge of the boot process: read from the floppy disk drive (through the floppy disk drive controller) firmware updates. If found, flash the H8 bootloader itself (on the Flash chip) or the FPGA.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>At this point, I had to go deeper and try to understand how the motherboard actually works. TC Electronic does not provide any schematic nor service manual, but by searching deeper I found the Motherboard schematic here: <a rel=\"noreferrer noopener\" href=\"https:\/\/service-tcgroup.tcelectronic.com\/files\/tech_service\/s6000\/schematics\/cpu-m5100-3a2.pdf\" target=\"_blank\">https:\/\/service-tcgroup.tcelectronic.com\/files\/tech_service\/s6000\/schematics\/cpu-m5100-3a2.pdf<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reverse &amp; Serial port<\/h2>\n\n\n\n<p>The bootloader firmware \u00ab\u00a0M6bv20.ins\u00a0\u00bb seems to contain debug strings, so there&rsquo;s may be some serial output for debugging purpose.<\/p>\n\n\n\n<p>The schematics shows that the H8 has two serial ports, and following these brings us to the DIN 7  \u00ab\u00a0Remote port\u00a0\u00bb at the back of the unit. The Serial port 1 (Tx0\/Tx0) is connected as follow:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>pin 2 : GND<\/li><li>pin 3: Tx<\/li><li>pin 4: Rx+<\/li><li>pin 5: Rx-<\/li><\/ul>\n\n\n\n<p>Moreover, the unused JP3 connector also exhibits the same serial port and really looks like a debug interface:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>pin 1 (closest to the board corner): GND<\/li><li>pin 2 : Rx<\/li><li>pin 3: Tx<\/li><\/ul>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"1024\" src=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_serial-768x1024.jpg\" alt=\"\" class=\"wp-image-103\" srcset=\"https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_serial-768x1024.jpg 768w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_serial-225x300.jpg 225w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_serial-1152x1536.jpg 1152w, https:\/\/radix-studio.fr\/blog\/wp-content\/uploads\/2022\/03\/m6000_serial.jpg 1512w\" sizes=\"auto, (max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/figure>\n\n\n\n<p>I used an USB to serial adapter to connect to this port, hoping for a terminal connection (or at least debug strings). Sadly, the port seems to be inactive, at least at this part of the boot process.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reverse &amp; DIP switches<\/h2>\n\n\n\n<p>The motherboard schematics provides interesting information on the DIP switches usage:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>DIP #<\/td><td>ON<\/td><td>OFF<\/td><\/tr><tr><td>1 (sw1A)<\/td><td>Send boot_cs to inernal flash cs (Chip Select)<\/td><td><\/td><\/tr><tr><td>2 (sw1B)<\/td><td>Send pcmcia_mem_cs to fpga pcm_bus_cs<\/td><td><\/td><\/tr><tr><td>3 (sw1C)<\/td><td>Send boot_cs to fpga pcm_bus_cs <\/td><td><\/td><\/tr><tr><td>4 (sw1D)<\/td><td> Send pcmcia_mem_cs to flash cs <\/td><td><\/td><\/tr><tr><td>5 (sw1E)<\/td><td>Connect H8 MD2 to GND<\/td><td>Put 5V on the H8 MD2<\/td><\/tr><tr><td>6 (sw1F)<\/td><td>Put 5V on the H8 MD0\/MD1<\/td><td>Connect H8 MD0\/MD1 to GND<\/td><\/tr><tr><td>7 (sw1G)<\/td><td>Connect sram_cs to RAM chips CS<\/td><td>Disable external RAM<\/td><\/tr><tr><td>8 (sw1H)<\/td><td>Connect flash_cs to FLASH<\/td><td>Disable Flash<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>According the the schematic labels we also learn:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Set switches 1 and 2 to ON for ROM boot<\/li><li>Set switches 3 and 4 to ON for \u00ab\u00a0CARD\u00a0\u00bb boot (pcmcia sram)<\/li><li>Set switches 5 and 6 to ON for 8bits operation (16 bits otherwise)<\/li><\/ul>\n\n\n\n<p><strong>ROM boot: (1&amp;2)<\/strong><\/p>\n\n\n\n<p>The switches 1 and 2 are ON by default, which makes sense: the unit is supposed to boot on the ROM. When switch 1 is set to ON, the boot_cs (a signal used to enable\/disable a chip, thus select who&rsquo;s going to read data sent on a bus) is connected to the flash memory cs. The switch 2 connects the pcmcia_mem_cs (again, a signal used to enable access to the PCMCIA) to the FPGA. I guess the FPGA is in charge of driving the PCMCIA.<\/p>\n\n\n\n<p>During boot: read flash memory<\/p>\n\n\n\n<p>After boot, when using PCMCIA: use pcmcia<\/p>\n\n\n\n<p><strong>CARD boot: (3&amp;4)<\/strong><\/p>\n\n\n\n<p>When set to ON, the 3 and 4 switches enable the CARD boot. Thanks to the 3rd switch, boot_cs signal is sent to the FPGA pcm_bus_cs, which probably propagates this to the PCMCIA slot. During boot, the PCMCIA card is then enabled. The switch 4, connects the pcmcia_mem_cs to the external flash cs, thus when accessing the PCMCIA slot after the boot process, the unit will actually read the external flash.<\/p>\n\n\n\n<p>During boot: read pcmcia<\/p>\n\n\n\n<p>After boot, when using PCMCIA: use external flash<\/p>\n\n\n\n<p>Here I learned something protentially fixing my issue: I suspect the bootloader to be corrupted and thus not accessing the floppy disk drive. If if use CARD boot mode, with a pcmcia sram memory card contaning the boot image (\u00ab\u00a0M6bv20.ins\u00a0\u00bb) raw written on it, I may actually bypass the flash memory issue. I found some technical documentation explaining that the M6bv20.ins should be copied to a floppy disk, then flashed on the SRAM pcmcia using a M5000 unit (\u00ab\u00a0Wizard to disk\u00a0\u00bb tool).<\/p>\n\n\n\n<p><strong>8\/16 bits (5&amp;6):<\/strong><\/p>\n\n\n\n<p>Switches 5 and 6 interacts with the H8\/3003 MD0, MD1 and MD3 pins.<\/p>\n\n\n\n<p>According to the microcontroller documentation (<a rel=\"noreferrer noopener\" href=\"https:\/\/datasheet.octopart.com\/HD6413003TF16-Renesas-datasheet-11768175.pdf\" data-type=\"URL\" data-id=\"https:\/\/datasheet.octopart.com\/HD6413003TF16-Renesas-datasheet-11768175.pdf\" target=\"_blank\">https:\/\/datasheet.octopart.com\/HD6413003TF16-Renesas-datasheet-11768175.pdf<\/a>):<\/p>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>MD0 \/ MD1<\/td><td>MD 2<\/td><td>H8 Operation mode<\/td><\/tr><tr><td>0<\/td><td>0<\/td><td>not allowed<\/td><\/tr><tr><td>0<\/td><td>1<\/td><td>mode 4<\/td><\/tr><tr><td>1<\/td><td>0<\/td><td>mode 3<\/td><\/tr><tr><td>1<\/td><td>1<\/td><td>not allowed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Mode 3:  <em>Address pins A23 to A0 are enabled, permitting access to a maximum 16-Mbyte address space. The initial bus mode after a reset is 8 bits, with 8-bit access to all areas. If at least one area is designated for 16-bit access in ABWCR, the bus mode switches to 16 bits.<\/em><\/p>\n\n\n\n<p>Mode 4:  <em>Address pins A23 to A0 are enabled, permitting access to a maximum 16-Mbyte address space. The initial bus mode after a reset is 16 bits, with 16-bit access to all areas. If all areas are designated for 8-bit access in ABWCR, the bus mode switches to 8 bits.<\/em><\/p>\n\n\n\n<p>So clearly, these two switches are used to select 8 or 16bits memory addressing, keeping the default position to 16bits (off\/off) is a good option since I do not plan to rewrite the whole firmware \ud83d\ude42<\/p>\n\n\n\n<p><strong>External RAM (7)<\/strong><\/p>\n\n\n\n<p>When OFF, switch 7 disables the two external RAM chips, thus the H8 CPU can only use its internal memory. Clearly we don&rsquo;t want this and we&rsquo;ll let this switch to ON.<\/p>\n\n\n\n<p><strong>External Flash (8)<\/strong><\/p>\n\n\n\n<p>When OFF, switch OFF disables the Flash chip during flash operations. Again, we don&rsquo;t want this and we&rsquo;ll let this switch to ON.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Reverse &amp; JTAG<\/h2>\n\n\n\n<p> The J6 connector is a JTAG debug interface, connected to the FPGA. It&rsquo;s probably used to load the fpga firmware in the factory. Since I don&rsquo;t have a JTAG probe (and passing sniffing is pointless), it&rsquo;s currently useless.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Factory setup<\/h2>\n\n\n\n<p>As far as I currently understand the motherboard, I suppose that:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>the H8 firmware is loaded using the DIP Switch 3&amp;4 and a PCMCIA card with the bootloader firmware written. Thus, the H8 boots properly and is then able to \u00ab\u00a0update\u00a0\u00bb the bootloader using the floppy disk, writing the program on the flash.<\/li><li>the FPGA firmware is loaded using the JTAG interface, probably prior to the H8, since the FPGA seems to be in charge of controlling the floppy disk driver. <\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Host Bus interface<\/h2>\n\n\n\n<p>I used my Salaea probe to watch traffic from the motherboard to the Host Bus Interface card. I didn&rsquo;t tried to decode the whole traffic, but clearly there&rsquo;s some.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Flash memory bus<\/h2>\n\n\n\n<p>I&rsquo;m currently trying to scan the accesses to the flash memory bus, hoping it may help me to find what&rsquo;s going on. The best place to sniff the bus seems to be the Ethernet card: the card shares the BUS with the flash chip, and the connector can easily be used to connect my probes. I&rsquo;ll have to collect 3 bits lanes for each run and then reassemble, my Salaea is the 4 channel version. 1 channel will be used for the Clock (pin 43) and the 3 others for data.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I recently purchased a \u00ab\u00a0non working\u00a0\u00bb TC Electronic System 6000, here&rsquo;s a few notes of what I found while trying to fix it. The TC Electronic System 6000 is based on two units: The Mainframe with a floppy disk drive and a PCMCIA slot The Remote + Icon In my case, the remote unit works &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/radix-studio.fr\/blog\/2022\/03\/10\/going-deeper-on-the-m6000\/\" class=\"more-link\">Continuer la lecture<span class=\"screen-reader-text\"> de &laquo;&nbsp;Going deeper on the M6000&nbsp;&raquo;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-94","post","type-post","status-publish","format-standard","hentry","category-m6000"],"_links":{"self":[{"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/posts\/94","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/comments?post=94"}],"version-history":[{"count":17,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/posts\/94\/revisions"}],"predecessor-version":[{"id":130,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/posts\/94\/revisions\/130"}],"wp:attachment":[{"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/media?parent=94"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/categories?post=94"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/radix-studio.fr\/blog\/wp-json\/wp\/v2\/tags?post=94"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}