BLACK BOX PLC

[koniaris 0]

I have a ghost device, a PLC of, i think, italian origin and a bit outdated (1997/98 or 99). It is a 9 card system with standard following layout : -Power supply, -cpu board with a sticker (052m04 - something of a serial part but i`m not sure), -graphicd card/keyboard connected to a "vdm 2000" crt monochrome display (part number/code - 056m) and a some input output cards(0271m01, 087m01, 079m01 etc.). The cpu board has a zilog z84c 0008 processor paired with a z84c 4008 I/O and a z84c 3008 4-channel timer/counter, with a main program (i believe) stored in a m27c256 - 12f1 EPROM. It also has a smaller board on top with two SRAM 32 Kb chips, and a few peripherals pinned about... The mark on the rack says SRM 330 I`ve been browsing the net for the past 2 weeks every single day and wasn`t able to dig out anything - which i find to be most peculiar. Any thoughts or suggestions are most welcome and i`d really appreciate your help on this one. Koniaris

[gravitar 3]

sounds interesting.. can you post a picture of it?

[TConnolly 13]

I know one thing: Using a search engine on "Italian" or "Italy" + "PLC" is not going to be of much help since PLC is an abreviation to designate a coprporation (Public Limited Company), also used like (but not exactly - no need to dive in the differences here) INC. is used in the USA or LTD in the UK after the name of a coporation. Can you post a picture of it? That might be helpful. Edited 16 Nov 2005 by Alaric

[gravitar 3]

You know what they say about great minds thinking alike.. well I guess it works for us too! If the thing powers up, screenshots from the CRT might be the best giveaway. Failing that, you might get lucky by reading the contents of the 27C256 and looking for ASCII strings. BTW a 27Cxxx is a UV-EPROM, so it would contain the CPU's firmware. I would expect to find battery-backed SRAM and/or EEPROM (like a 29Cxxx) to hold the user program.

[koniaris 0]

Yeah, sure, here`s the pic : The card has another smaller card on top with 2 SRAM 32k chips...

[koniaris 0]

for some reason, the picture won`t show...

[koniaris 0]

and another one without the smaller card on top...

[koniaris 0]

btw...any suggestions on how to read the content of SRAM? The card has a serial port but i wouln`t know the settings/timings...

[IO_Rack 181]

Do you have a picture of the entire rack? This board looks familiar although I'm sure there are many European boards that look like that. We have a similar system here at our plant made in Germany. It's proprietary and they do not allow access to the code. If you are persistant I'm sure you could find a way to communicate with it. It may not be worth the time and effort to do that although it would make a fun hobby.

[koniaris 0]

I know...i know...but why not take a shot at it... Anyway, i plan to copy the binary from EPROM, disassemble it and see what`s going on inside...It`s just that i`m so curious to see who could`ve made this... I`ll post a photo of a rack in a next thread... any ideas on how to read the content of a SRAM???

[jstolaruk 9]

The form factor looks like the PC-104 style but the edge connector is not the same, more like a VMX board.

[gravitar 3]

As you must be aware, reading the EPROM is easy but getting the contents out of the SRAM is a whole different animal! The problem being, you can't take it out of circuit.. the battery is keeping it alive. For that matter, are you sure the battery is still good and the contents of RAM are not corrupted or blank? If you were really to try reading the RAM, you'd have to use an in-circuit emulator like a Fluke 9010 or 9100, and a Z80A emulation pod. You would then need to figure out where the RAM is mapped in to memory. Once you've got that, it really wouldn't be too hard to dump the contents. But there again, what is your confidence level that the contents are valid? I'm assuming you haven't been able to get this board to DO anything, so would you even necessarily know it if the RAM was corrupt?

[koniaris 0]

Thank you for the advice...Oh btw the PLC is 100% operative. I` ve unplugged it myself. It`s just that static Ram is a subject to interference, and this plc was used in metal sheet industry for controlling a punching machine, so i wouldn`t wanna risk keeping the whole program in it. I`d prefer using it for, let`s say, keeping the last entered parameteres( metal sheet dimensions and so...) so that you could shut down the machine without completing the job, and continue where you left off the next day.... Anyways that`s exactly what happens if you turn the machine off and back on - the last entered parameters stay present on the screen... p.s. How could i get my hands on Fluke 9010/9100 or Z80A emulation pod?

[jstolaruk 9]

Personally I don't believe you'll yield any usefull information out of the RAM but scanning the contents of the EPROM may yield a string with the copyright information of the organization that programmed it. That will get you a start as to the OEM. In Circuit Emulator will be expensive but normally you can rent them. a google search should find a vendor. Example: Z80 ICE Edited 18 Nov 2005 by jstolaruk

[koniaris 0]

Thanx so much for all the usefull information... I`ll try and pick EPROM for any traces of signature... I was also thinking of putting additonal 32k SRAM with a small program - addressing the Z80 4008 I/O circuit pins one by one to see what`s going on with I/O signals, as well as adding a small program to the EPROM which should flag/tag memory jumps, double wait cycles and opcodes with 20 or more clock cycles....I hope it`ll help me in obtaining a basic idea of structure of the EPROM contents... Any suggestions/advices are most welcome...