Recent content by dan_n

Thanks for confirming that part number. I could only see part of a number in a blurry pic but that was enough to confirm a match with the erase/program code in the firmware. The earlier boards used a 512kB EPROM chip (M27C4001) for firmware and later when it got bigger used a 1MB EPROM chip...

I've sucessfully tested erasing and programming the flash memories in-circuit using my service firmware. I verified this on both flash chips confirming my understanding of the chip selects and extended addressing interactions. In theory I can now unbrick a panel that got bricked during an...

For what it's worth I've confirmed that the 4.0b firmware and language data in both flash chips are identical with each other and with the chip eproms. The language data exactly matches the 20A05-2 2.0 eprom chip I copied from my 20 year old panel. But I'm not sure where the 4.0b firmware file...

I've been working on a small standalone service firmware for diagnostics/repair. One interesting discovery is that the 2 flash chips seem to have the exact same data but in different places. I've also found firmware code that copies data from one flash chip to another so there may already be a...

Wow, I actually finished what I set out to do in post #32. My new modded firmware (only 11 overwrites + 24 bytes of new code!) does true instant digital communication of Contact-ID alarm reports, no relays clicking or phone line seizing at all. My first firmware mod in the previous post...

SUCCESS! I've successfully tested a firmware mod that adds a new feature to my OmniProII panel! Still very early lab prototyping but the concept has been confirmed. I want my panel to transmit a digital Contact-ID (CID) alarm report to an external processor that can then send a real SIA DC-09...

While waiting for parts to build a ROM emulator I've been doing deep dives into the firmware. I've found non-standard things that cause problems for standard tools such that even if an awesome former developer gave us the source code we couldn't build it without modified tools. Example: the...

You can also do this on a flash firmware board by removing jumper JP10 and install an eprom chip in the socket (details here).

Here's a schematic of the EPROM jumpers described in post #16. The flash chip is completely disabled by removing the jumper, perfect if you want to use the EPROM socket for an emulator or a chip with different firmware. HAI likely used this for initial/recovery programming of the firmware...

I've done some more OmniPro II reverse engineering after deciding to learn about the incredible power of the $5 RPi Pico2's programmable io (PIO) state machines. So I used PIO to implement bus capture of the communication between the OP2 cpu and dsp. Why? I have a vague idea of implementing...

Most likely that means no connection. It's very unlikely but possible the VOIP is doing something non-standard by not keeping a constant line voltage but instead sending out short pulses to detect on/off-hook. To rule that out measure again with the phone off hook. If connected correctly and...

To follow up, I'm still seeing this issue occasionally but have now 100% ruled out the panel as the cause of the wrong code. New data appears to show the alarm company ignoring the checksum and accepting a garbled message. I had a digital recorder on my phone line and captured the...

It wont' work if the polarity is reversed. An easy check with a multimeter: set meter to DC volts ignore phone wire colors. Touch black test probe to OmniPro PHONE screw marked "GRN" Touch red test probe to OmniPro PHONE screw marked "RED" Good reading is +40-50V. Negative means wires are...

This disassembly listing shows the initialization code with the setup values for all control registers, i/o ports and peripherals. This is key to any deeper analysis of the firmware. As mentioned above, the listing shows the code starting at address C000 while the actual EPROM location is...

This thread needs at least one firmware disassembly listing. The attached file shows the firmware code (4.0b chip) that writes 1 byte into the cpu internal EEPROM and gives an idea of what's involved in writing that EEPROM. I couldn't find a separate hw bulk erase subroutine so they must call...