MONARCH - THE DIGITAL CALL CONNECT SYSTEM
SOFTWARE RELEASE M MEQ N2.4
PRODUCT - CD SYSTEM
SITE CODE - DN098Q0A/000
The address bus on the 8088 in 16 bits ie 0000 - FFFF (64k)
but the Monarch uses "banking" to fit more things in.
Below is a monarch memory map, but it does NOT match the system I have.
eg My Monarch's Database PROM in 2x8k and starts at 16, NOT at 32k as in the diagram
so its between 16k-32k ?
Using the LMEM command you can read memory locations in Eprom,RAM and EEprom
The 16k (2x8k eeprom, IC49, IC50) Daughter card (ASU 2A1/SA21023) can be found in the memory map ..
IC49 - between 03FF:0010 and - 05FF:000F or starting at 16k (16384 decimal)
IC50 - Between 05FF:0010 -07FF:000F
so both can be read ( with a little extra below and above) with the commands
LMEM 03FF 0 FFF
LMEM 04FF 0 FFF
LMEM 05FF 0 FFF
LMEM 06FF 0 FFF
LMEM 07FF 0 010
There is also a RAM copy of the database that can be found between
7FFF:0010-83FF:000F or starting at 512k -
To read the Ram copy of the database use the following commands
LMEM 7FFF 0 FFF
LMEM 80FF 0 FFF
LMEM 81FF 0 FFF
LMEM 82FF 0 FFF
LMEM 83FF 0 010
The contents are read from eeprom to ram after a reset if cpu switch 3 is "On" or
the ram database checksums are found to be wrong.
VCST IS DISPLAYED IF RAM HAS BEEN OVERWRITTEN WITH eePROM DATA
FINE IS DISPLAYED IF THE RAM VERSION OF THE CONFING DATABASE IS USED
The FTDB command causes the database in the NVram to be copied into the EEprom on the daughter board(ASU 2A1/SA21023)
Its similar to the TDB that copied the database in the NVram to a blank eprom in the daughter board.
One of the major hurdles to getting control of my Monarch was not being able to get into the MMI.
It had non standard passwords set.
I found that the passwords could be found in the IC49 EEprom
If you get an eprom reader and get it to export in intel hex format, you will get something like this...
At line 129 you would find something like this.
:200FE000FFFFFFFFFFFFFFFFFF8E000F27C90755AADD444E3039385130412F30303011C6FF
The :200FE000 is not eeprom contents its the location
The FF at the end is again not eeprom contents its a line checksum
8E00 s the OSLC password in this case 142 =HEX2DEC("008e")
0F27 is the OSLM password in this case 9999 =HEX2DEC("270F")
C907 is the OSLS password in this case 1993 =HEX2DEC("07c9") i.e. OSLS 1993
If you can access the MMI, you can see the passwords (system keys) in
EEPROM copy of the config database here with LMEM
03FF:0FF0 FF FF FF FF FF FF FF FF FF 8E 00 0F 27 C9 07 55
or the ram copy of the config database here with LMEM ie "LMEM 7FFF FF0 F"
7FFF:0FF0 FF FF FF FF FF FF FF FF FF 8E 00 0F 27 C9 07 55
The LSK - List System Keys command does not list the OSLS password for some reason...
These passwords can be found in a similar way to the 16k ones above, but at a different location
:200A6000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7AFFFFDE000F27721297E5
222,9999,4722
The first table in the data base starts at byte 2, the fist byte may be a checksum
The data in this table can be read with the LEND command
It looks like for each equipment number between 0 and 795 it holds 1 byte of what type of port it is.
What I know.
Table starts at 7FFF:0011 which is EN0 ( equipment number zero)
shelf5 starts at 7FFF:0206 which is en500 ( equipment number 500)
shelf 5 finishes at around 7fff:0264 which is EN 595 or 599 ?
when x2102 was en=1 and ln=1
80FF:0920 FF FF FF 00 00 01 00 02 00 03 00 04 00 05 00 06 BA
2100 2101 2102 2103 2104 2015 2106 2107
when x2102 became spare (RDN 2102 2885)
80FF:0920 FF FF FF 00 00 FF FF 02 00 03 00 04 00 05 00 06 B7
2100 2101 2102 2103 2104 2015 2106 2107
--------
when 2885 and 2878 was spare
80FF:0F30 FF FF FF FF FF FF FF 26 02 23 02 21 02 1F 02 FC 44
2878 2879 2880 2881 2882 2883
(RDN 2102 2885)
ADDN 2146 2878
became
80FF:0F30 FF FF FF FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 73
2876 2877 2878 2879 2880 2881 2882 2883
2D hex = 45 decimal = EN45
80FF:0F40 01 25 02 FF FF 22 02 20 02 1E 02 1C 02 1A 02 18 AC
2883 2884 2885 2886 2887 2888 2889 2890
after (RDN 2102 2885)
80FF:0F40 01 25 02 01 00 22 02 20 02 1E 02 1C 02 1A 02 18 AF
2883 2884 2885 2886 2887 2888 2889 2890
01 hex = 01 decimal =EN for x2885
x2876 was spare
80FF:0F30 FF FF FF FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 73
2876 2877 2878 2879 2880 2881 2882 2883
ADDN EXTN 2122 EXTN 2876
80FF:0F30 FF 15 00 FF FF 2D 00 26 02 23 02 21 02 1F 02 FC 8A
2876 2877 2878 2879 2880 2881 2882 2883
15 hex is 21 decimal =LN
2D hex is 45 decimal =LN
SECOND PILOT DN MEMBER OF PSC REC MASTER ACTIVE/
EXTN EXTN OF GROUP PICK-UP GROUP ENABLED ANN EXTN MANBSY
2122 2876 3 ACTIVE
2877 SPARE
2146 2878
2879 42
2880 39
SELECT WAITING SIC DIVERT VDU FORCE
EXTN EN LN ANSWER AMP CHECK OVRIDE FBACK RELEASE MF4 10PPS
2878 121 45 1 1
SECOND PILOT DN MEMBER OF PSC REC MASTER ACTIVE/
EXTN EXTN OF GROUP PICK-UP GROUP ENABLED ANN EXTN MANBSY
2122 2876 3 ACTIVE
SELECT WAITING SIC DIVERT VDU FORCE
EXTN EN LN ANSWER AMP CHECK OVRIDE FBACK RELEASE MF4 10PPS
2122 13 21
---------------------------------------------------------------------------------
LEND 64 74
EN PORT-TYPE DN/TN
64 EXTN2W 2664 D
65 EXTN2W 2665 D
66 SPARE
67 SPARE
68 SPARE
69 SPARE
70 SPARE
71 SPARE
72 SPARE
73 SPARE
74 SPARE
SELECT WAITING SIC DIVERT VDU FORCE
EXTN EN LN ANSWER AMP CHECK OVRIDE FBACK RELEASE MF4 10PPS
2664 64 72 1 1
2665 65 73 1 1
BEFORE
80FF:0D80 FF FF FF FF FF FF FF FF FF 48 00 49 00 FF FF FF 91
2664 2665 2666
AFTER
80FF:0D80 FF FF FF FF FF FF FF FF FF 48 00 49 00 4A 00 FF DD
2664 2665 2666
48 HEX = 72
49 HEX = 73
4A HEX = 74
SELECT WAITING SIC DIVERT VDU FORCE
EXTN EN LN ANSWER AMP CHECK OVRIDE FBACK RELEASE MF4 10PPS
2664 64 72 1 1
2665 65 73 1 1
2666 66 74 1 1
CHANGE DAYANSWER POINT FOR TRUNK 13 FROM 2170 TO CONSOLE (2897)
BEFORE
81FF:00A0 02 4C 02 4C 02 4C 02 4C 02 4C 02 45 00 4C 02 4C 87
AFTER
81FF:00A0 02 4C 02 4C 02 4C 02 4C 02 4C 02 F9 01 4C 02 4C 3C
4500 hex -69 - 69 is the LN of 2170 !
f901 hex - 505
? LTKA 13
TN TYPE DIRN EN LN CONS I/C GRP KEY ACCESS GROUP
13 EXCH2W IN 84 621 1
TN DAP NAP DDI DN GP ATTEN REMOTE END PW TYPE
13 CONS 2170 OFF 3 ACTIVE