[tcom-frazzled]

Folks,

I need to add drip feed to an older 0-MC with PMC-L. I have an EPROM reader and grabbed the images from OE1 and OE2 to pull into the old DOS fladder software, but I'm curious about how the binary data from the EPROMs needs to be combined (and then split again after the ladder is edited). I'm assuming that the address layout is such that one chip contains the high order byte, the other the low order byte, but wanted to see if anyone can tell me for sure. I wouldn't put it past Fanuc to have swapped address lines just to obfuscate things.

Yes, I know I can pay the extortion fee for the converter software from 3BH, but I'm not really interested in going that route. I can easily write a script to combine the files once I know the address mapping. I'm hoping that someone can share that info so I don't have to go the route of borrowing a logic analyzer to hook up to the address/CS/OE lines on the EPROMS and decode the addressing layout by watching the PMC load from the chips.

Thanks!

[tcom-frazzled]

.....or, if anyone has OE1, OE2, and the corresponding #EX for a given ladder, I can figure it out from there if you're willing to share those three files.

[tc429]

send me your binaries, I'll burn'en, upload thru the pcwriter and send you back the fladder files.

I looked into this a while back, the data is like the merged ex file, BUT they changed from binary to hex or something similar in the output- but think the sub2 break points are added in also...I couldnt sort it out for sure, but I cant do a lot of things


if you have the fladder, just leave the chips out, boot up, hit 1 to upload your new edited ladder from fladder(f6/f3/f1 to send thru a normal serial cable)...but it will get lost eventually if you dont put the chips in it. Ive forgot to burn chips a few times and the ladder got dumped, once I did it myself and I KNOW i hit 3 not 1, yet 'ladder not exist' msg popped up as If I hit 1.

just this afternoon I had one running on ram, for curiousity tried loading the ex file from procomm instead of fladder, wasnt really surprised, but no it didnt read it... figured there would be some control strings sent first, never snooped the communications to see what goes in when uploading to the pmc.

[tcom-frazzled]

Here are the OE1 and OE2 files. 15 years of staring at hex might not all be a complete waste.

If I sort out the translation, I'll post a free converter. I'm really getting tired of everything related to Fanuc controls costing an arm and a leg, especially for basic stuff like this. I saw a few previous posts that you made offering assistance related to this, but didn't want to specifically ping you for help out of the blue.

Thank you! I appreciate the assistance.

[memoryman]

I wrote a QB program to combine the OE1 and OE2 files from Fanuc6 PLC and produce an output file looking like this:
1 RD 200.0
2 OR.NOT 200.0
3 WR 200.0
4 RD 65.7 MA NC>PC
5 WR 3.3 M18 PC>MT
6 RD 64.6 SA NC>PC
7 WR 3.0 M11 PC>MT
8 RD.NOT 38.4 *ESP MT>PC
9 WR 3.4 M21 PC>MT
10 RD 38.4 *ESP MT>PC
11 WR 102.4 *ESP PC>NC
12 RD 38.5 *SP MT>PC
13 AND 35.6 *SVF4 MT>PC
14 WR 102.5 *SP PC>NC
15 END.1 ---END OF HIGH LEVEL
16 RD 132.2
17 RD 2.2 SF PC>MT
18 RD 200.0
19 MOV SUBROUTINE 8
20 P1 0011
21 P2 0111
22 P3 64
23 P4 0
24 RD 200.0

I can send a copy of the .BAS program and would like to see a similar program for other Fanuc ladders.

[tcom-frazzled]

I'd certainly be interested to see that program, especially considering that it not only combines the binaries but it also decompiles it and converts it to mnemonic ladder text. I was just planning to put one together that combines the split binaries into a #ex that can be read into fladder and decompiled there.

[memoryman]

send me a private message with your email.

[tc429]

maybe you can help me out if you get some free time- I wrote a basic 6 decompiler too, posted the basic source a while back in here... I'll gather it up with some rom data and instructions- I decoded everything except for the checksum words, like tenth and last words on the merged chips, they are always inverse, always add to 100h, but I tried for weeks in my spare time to see how they came up with them...I was originally trying to replace my old suitcase programmer for the 6, coulda probably done it if not for those 2 words... the mnemonic output from the combined binaries works fine, but I couldnt convert back without first figuring out the checksums and the sub2 break points...mine dont work on PMC-B either, just tried it for the first time for a guy in here last year, and I didnt have time to even look at why...

heres your data in fladder readable format:

[tcom-frazzled]

thank you sir! Now I get to dig into this whole mess and start working on a decompiler. In the meantime (since I do have a machine that needs to make chips), would you be willing to recompile and burn it after I add a few rungs to the ladder? It might be a week or so, as I don't want to mess with it in the middle of a production run.

[tc429]

if you get a chance- not urgent at all/likely wont go anywhere anyways, but I'd love to know how they get it- heres the source code for the old 6>mnemonic printing basic thing I wrote, and a 4 k file of the merged eproms(they were tiny 2716 chips), and the printed output of that binary from my basic program...

note the @ is the location in the binary file, the ladder starts at 160... just a few words before 160 is one that adds to 100h in the word after the last ladder word, and they are inverse if I remember right (cant even view the hex as dont have a dos machine handy, and I never tried thru windows...) my memory sucks anymore and havent messed with this source since getting the mnemonics working...have used it quite a few times, but honestly all i remember about fighting thru it was the throwing in the towel after dicking around like 3 weeks trying to figure out the checksum... with my luck, you might look at it and in 5 minutes say, oh thats easy

I tried adding/rolling over/dividing, etc to figure how they get these numbers, couldnt make heads or tails of it...but know changing even one address in the ladder would result in totally different values, so I assumed it was a checksum... as I'm just a tinkerer, I dont even know WTF a checksum really is, I was just wanting 'something to do' that winter to pass the time in the evenings, thought learning a little basic might be fun... thought it might be cool to replace the old suitcase...ended up a lot more crap than what I thought, but it was fun. really frustrated me that I couldnt get the last piece to be able to make edits/write the chips... somewhere Ive got a mnemonic to graphical ladder thing too, it was only about halfway complete though when forgotten about...

always wanted to go back and fix the goofy spaces in the addresses of the mnemonics too...printout looks sloppy, and reading it back in to the graphic converter had to filter them out...

anyways, if you ever get a few minutes and might shed some light on how they did the checksums, it would be appreciated. not needed, just one of those things I couldnt do no matter how hard i tried...
Tim

[tc429]

thank you sir! Now I get to dig into this whole mess and start working on a decompiler. In the meantime (since I do have a machine that needs to make chips), would you be willing to recompile and burn it after I add a few rungs to the ladder? It might be a week or so, as I don't want to mess with it in the middle of a production run.

youre welcome-
if you have the fladder for IBM and a old dos laptop with a real serial port, you can do it and dump it in thru the serial- just pull the chips, at bootup a different screen will appear, hit 1, send it from fladder, then hit 3 when the screen comes up again...every boot up, hit 3 till the chips are made, but till then, you can run/debug, if you need to 'not worry' just put the old roms back. send your new files to anyone with a pc writer to burn your chips when done debugging...

[tcom-frazzled]

The old DOS laptop with a serial port is going to be the tricky part. I guess I can try it using a USB to serial adapter with DOS and fladder running in a virtual machine, which is how I'm using it right now.

[tc429]

The old DOS laptop with a serial port is going to be the tricky part. I guess I can try it using a USB to serial adapter with DOS and fladder running in a virtual machine, which is how I'm using it right now.

good luck with that...I saw one work once on another PLC, bought several other adapters, but only that one worked...no brand if you find one that will do it, please share where you got it from and when... seems even radioshack sells different ones than they did a couple yrs ago (that was the one that worked on our PLCs)

[tcom-frazzled]

Tim,

I'll take a look at the files you posted and see if I can come up with some sort of CRC/XOR/etc function for the checksum. The good thing is that the fladder software was written long before one way mathematical functions like MD5 and SHA became popular, so it's probably a function that can be derived without breaking out my advanced cryptography book.

[tcom-frazzled]

A lot of the usb to serial port adapters don't work properly because they don't actually meet the and maintain the proper +/-12v signal levels and timing. Many are based upon the exact same converter chips made by prolific, but the 12v front signal conditioning varies wildly from vendor to vendor. The other common issue is that the prolific converter chip and corresponding drivers are absolutely horrid when it comes to buffer management. It doesn't take much to blow through the buffer on those things and end up having the chip get stuck in a tx-rx loop.

If you want a solid USB to serial solution start with a USB to TTL UART like an FTDI FT234XD and add your own max232 +/- 12v front end. Way, way, way more reliable.

[tc429]

along the same 'dos' issue lines... I have dosbox on a smartphone(never had one till 2 days ago) and it seems to work fine...should have a bluetooth 232 adapter next week- would be really handy for backing up/reloading controls, even dumping ladders into ram maybe

my supply of DOS laptops is about depleted... had 20 at one time (2 bucks on ebay was common a few years back) but gave quite a few to guys at work, cannibalized parts to keep them going, had a rash of them fail the past 3 years, found out the clock batteries were leaking/eating up the boards... just put my last 3 1/2 inch drive in my next-to-last functional 486

the last couple i bought had the boards ate up too... loved those old toshiba 2100 series, no powersupply needed, durable, they were cheaper than a screwdriver, so didnt hurt too bad if one fell in the coolant... those days are gone, but the old serial port machines remain, along with the antique programming tools...on the 0-A I still have to use one of our P-Gs- the 65 pound portable, as fladder for ibm wont do the 011/012 chips...

[tc429]

A lot of the usb to serial port adapters don't work properly because they don't actually meet the and maintain the proper +/-12v signal levels and timing. Many are based upon the exact same converter chips made by prolific, but the 12v front signal conditioning varies wildly from vendor to vendor. The other common issue is that the prolific converter chip and corresponding drivers are absolutely horrid when it comes to buffer management. It doesn't take much to blow through the buffer on those things and end up having the chip get stuck in a tx-rx loop.

If you want a solid USB to serial solution start with a USB to TTL UART like an FTDI FT234XD and add your own max232 +/- 12v front end. Way, way, way more reliable.

you ought to make some up and sell them on here if that bluetooth thing works I'll be happy...cheep (im cheep) no wires to drag around, etc...

[guhl]

I can help you free of charge
but it's possible for 27C256 eproms only
just PM me if you need

[gbowne1]

I always wondered what the different version's of the PMC for the series 0

I use the PMC M but hadn't been able to locate the PMC manual(s) for the 0.

I knew someone who would let me have different ones for testing purposes.

[mrt tecnologies]

hello
I need editing ladder of my machine with fanuc om controller.
I have eprom reader
can you help me
tanks