Subject: [E3-hacking] E1

From: David Given <[email-masked]>
Date: Mon, 29 Sep 2008 23:30:52 +0100

While doing some work on my E2 I managed the serial port. Apparently it
doesn't like repeated power cycling. So I went scrounging on Freecycle
for another one; I didn't get one, but I *did* get an E1.

The E1 is a decidedly more primitive device than the E2. It's heavier
and the styling is definitely older --- it's even got a BT logo on it!
The screen is the same, but it's on a 2D swivel rather than the simple
hinge of the E2 and E3. The keyboard has hard plastic keys rather than
the soft rubber Spectrumalike keys of the more recent models and is
actually surprisingly comfortable to use. Inside the case was a bit of a
shock; rather than the elegant little PCB of the E2 and E3, there are
two, count 'em, chunky PCBs wired together. Unfortunately the wiring
loom is complex and well stuck on so I didn't want to tinker too much,
but the CPU is a LH77790B. I did spot an Alliance AS4C1M16E5 2MB DRAM
chip, though.

The built-in software is pretty much identical to the E2. The 'Settings'
menu claims it's got a Venus 33.6 ISA 1520-37LV modem and PBL V9.0
Build:0256.

The interesting thing is round the back; instead of USB there's a 25-pin
PC printer port, and instead of the EXP jack there's a standard female
9-pin serial socket.

Plugging this into a PC with a straight-through serial cable shows
nothing at all on boot. However, pinging it with the usual 0x1b bytes on
startup triggers PBL and the LEDs start flashing. But I don't get
anything back down the cable, so I can't talk to it. So either the
protocol's different, or else it's non-standard wiring (or my cable is
broken), or the E1 has a fried UART, or it might not be a standard port
after all and may need level-shifting.

I'll clean it up and post some photos at some point, but I suspect this
is really only of historical interest.

(I also got a Pocket Dockit. Can I do anything interesting with one of
these?)

-- 
┌─── ｄｇ＠ｃｏｗｌａｒｋ．ｃｏｍ ───── http://www.cowlark.com ─────
│ "...it's not that well-designed GUI's are rare, it's just that the
│ three-armed users GUI's are designed for are rare." --- Mike Uhl on
│ a.f.c

---

From: Ralph Corderoy <[email-masked]>
Date: Tue, 30 Sep 2008 11:03:57 +0100

Hi David,

> nothing at all on boot. However, pinging it with the usual 0x1b bytes
> on startup triggers PBL and the LEDs start flashing. But I don't get
> broken), or the E1 has a fried UART, or it might not be a standard
> port after all and may need level-shifting.

Or baud rate?  You could be right on the level-shifting.  Any clue from
peering inside?

Cheers,

Ralph.

---

From: David Given <[email-masked]>
Date: Tue, 30 Sep 2008 11:19:47 +0100

Ralph Corderoy wrote:
[...]
> Or baud rate?  You could be right on the level-shifting.  Any clue from

The socket's on the back of the main board, which means all the traces
are hidden between the main board and the other board, so I haven't
managed to figure out what it's connected to. The baud rate seems to be
9600, because it doesn't respond on anything else. I'll try hooking up a
voltmeter and seeing what the E1's TX is producing. If it does need
level shifting then it obviously doesn't want inverting as well, because
it *is* responding to 0x1b.

Hopefully I haven't managed to damage something connected RS232-level
signals to it...

-- 
David Given
[email-masked]

---

From: David Given <[email-masked]>
Date: Wed, 01 Oct 2008 23:01:42 +0100

David Given wrote:
> I'll try hooking up a
> voltmeter and seeing what the E1's TX is producing.

With PBL running, I'm reading about -9V at the E1's Tx pin and +9V at
CTS and DSR. When PBL's not running it leaves CTS and DSR low. This
sounds like a real serial port to *me*.

But nothing seems to come out. I need a scope.

It might be waiting for some sort of passkey, although this seems a
little unlikely. If so, though, our only options are either hope that
some nice person from Amstrad tells us what it is, or else to build a
JTAG adaptor and extract the ROM...

Incidentally, I took another peek inside looking for jumpers, and I did
notice two unpopulated 0.1" headers: one is a 16-pin one, but next to it
is a 20-pin one with a box around it. It's not labelled other than as
JB1, but it could very well be a standard JTAG header. I would *not* be
keen on soldering pins to that, though, particularly if I wanted them to
be in a straight line.

BTW, any recommendations on JTAG hardware? It occurs to me that now I've
fried the UART on the E2, I might as well have a go with attaching JTAG
pins --- I can't make it any less useful than it is now.

---

From: Ralph Corderoy <[email-masked]>
Date: Thu, 02 Oct 2008 00:21:33 +0100

Hi David,

> JTAG adaptor and extract the ROM...

I suspect it's more primitive than the E2's PBL so I doubt a passkey is
required.  Request 00 always replies with a NAK in PBL V3.1 but perhaps
it does something useful in the earlier version and was changed to be a
constant NAK later?  Do you get anything from request 01?

    PBL V3.1 Build:1277 EXP packet format
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

        Offset  Size  Value  Name   Description
          0       1     2    stx    ASCII STX byte.
          1       1    0/1   comp   Is `data' compressed.
          2       2     -    len    Length of data.
          4      len    -    data   Payload.
        4+len     1     -    cksum  Sum modulo 0x100 of bytes in len and data.

    First byte of payload gives message type.

    Payload requests
    ~~~~~~~~~~~~~~~~

    Contents of data in received packet.  First two bytes given request
    number.  Reply is request_number | 0x80 if all went well, or a NAK reply
    otherwise.

        Request: 00
            Not used.
        Reply: 15
            NAK message, sent to indicate disagreement.

        Request: 01 00
            Set 0x1001c = 0x01 to remember request 01 received.
        Reply: 81 00

Cheers,

Ralph.

---

From: David Given <[email-masked]>
Date: Fri, 03 Oct 2008 01:09:31 +0100

Ralph Corderoy wrote:
[...]
> constant NAK later?  Do you get anything from request 01?

I haven't tried 01 specifically, but pblq pings stuff with request 02
(GETVERSION) on connect, and I don't get any response. I'm not receiving
*anything* from it, not even the 0x06 when PBL interrupts the boot sequence.

At this point I suspect I definitely need a capturing scope to try and
see if anything at all is coming out. Alas, they're not cheap.

Incidentally, I also took the lid off the Pocket Dockit. As expected
it's calculator technology --- ICs glued directly to the PCB with resin
blobs poured on top --- but I do notice a bunch of pads labelled Vdd,
GND, RESET, SDAT and SCLK. SPI, perhaps? There may even be a real PIC
under there...

---

From: Jas Strong <[email-masked]>
Date: Thu, 02 Oct 2008 17:39:41 -0700

If it was SPI, it'd have two data lines, not just one (MISO and MOSI).

My guess is that it's I2C.

-J.

David Given wrote:
> ------------------------------------------------------------------------
>
> _______________________________________________
> e3-hacking mailing list
> [email-masked]
> http://www.earth.li/cgi-bin/mailman/listinfo/e3-hacking
>