I did do a capture of the data bus while holding CTRL-BRK. It does force it to go to the cold boot routine and it goes to 7DF5H as shown below:
; ====================================================== ; Cold boot routine ; ====================================================== 7DE7H (31H) LXI SP,F5E6H ; Load the SP with Cold Boot location 7DEAH (CDH) CALL 7EE1H ; Calculate physical RAM available 7DEDH (06H) MVI B,90H ; Prepare to copy 90H bytes of code to RAM 7DEFH (11H) LXI D,F5F0H ; Active system signature -- Warm vs Cold boot 7DF2H (21H) LXI H,035AH ; Initialization image loaded to F5F0H ->> Does this call 7DF5H (CDH) CALL 2542H ; Move B bytes from M to (DE) - hooks & signatures 7DF8H (CDH) CALL 7EC6H ; Initialize RST 38H RAM vector table 7DFBH (3EH) MVI A,0CH 7DFDH (32H) STA F930H It goes through copy all 144 (90H) bytes to RAM ; ====================================================== ; Move B bytes from M to (DE) ; ====================================================== 2542H (7EH) MOV A,M 2543H (12H) STAX D 2544H (23H) INX H 2545H (13H) INX D 2546H (05H) DCR B ->> it gets to here 2547H (C2H) JNZ 2542H ; Move B bytes from M to (DE) 254AH (C9H) RET It does not do the return it seems. Below is the last of the data bus capture with source annotation added in by hand. Notice that the data values on the bus are going up (more or less) one by one. Also recall I'm only capturing the bits 0-6 as bit 7 is on the /RD* and used as a clock to decode the parallel data in the logic analyzer software, this is not perfect, but it is close enough to work. 0.100086875000000,0x007E Source 2542H (7EH) MOV A,M 0.100089750000000,0x0012 Source 2543H (12H) STAX D 0.100092625000000,0x0023 Source 2544H (23H) INX H 0.100095000000000,0x0013 Source 2545H (13H) INX D 0.100097500000000,0x0005 Source 2546H (05H) DCR B 0.100099125000000,0x0042 C2 Source 2547H (C2H) JNZ 2542H ; Move B bytes from M to (DE) 0.100100750000000,0x0042 0.100101875000000,0x0049 should this be 25H?? or is this the return? 0.100103500000000,0x0057 0.100104750000000,0x000A 0.100106000000000,0x0057 0.100107625000000,0x0058 0.100109250000000,0x0059 0.100110875000000,0x005A 0.100112500000000,0x005B 0.100114125000000,0x005C 0.100115750000000,0x005D 0.100117375000000,0x005E 0.100119000000000,0x0020 0.100120250000000,0x005F 0.100121875000000,0x0060 0.100123500000000,0x0061 0.100125125000000,0x0062 0.100126750000000,0x0063 0.100128375000000,0x0064 0.100130000000000,0x0065 Based on what I have seen before in the captured data when a RET is encountered the next two bytes on the data bus is the return address, for example: 0.097737500000000,0x0049 C9 Source 7F00H (C9H) RET 0.097739125000000,0x006D ED return address 0.097740375000000,0x007D retrun address But what I see above is garbage and I have repeated the capture 3 more times and get the same result. Does this indicate a bad ROM? It seems odd that it would read the ROM fine up until this point. It always stops here which is right at the 100ms mark from the release of the reset button, not sure if the time is important or not. As luck would have it I found another Model 100 on the other side of Missouri on Craig's list (from original owner with original box). And, it works! Just got an email from him saying it was shipped out today and it should be here by Saturday (only about 200 miles away). At the very least if it is the same motherboard revision I can take the same capture on it and compare, and perhaps even swap the ROM over. Otherwise I am out of ideas at this point. Maybe with a good night's sleep something else will come to me. Jeff
