K2521TEST: standalone test ROM for the MG80 CPU board (K2521 / ZRE)
This ROM tests the CPU board on its own: CPU, data and address bus, the 8 × U202 RAM chips (reported per data bit), all four CTC channels, IM2 interrupts and the PIO outputs. Results appear as scope signals and as a readable serial report.
It was verified in a cycle-exact U880/CTC/PIO emulator, with injected faults (see the last section).
1. What you need
- The K2521 board alone, out of the MG80.
- +5 V only.
- One single-supply 2716 (Intel 2716, U2716C, К573РФ2; not a TMS2716) programmed with
K2521TEST_2716.bin, in socket ADR 0000.- This image holds the 1 KB program twice. The 2716's A10 (socket pin 19, which is +12 V VDD on a 2708) then makes no difference.
K2521TEST_1K.binis the plain 1 KB image.
- On a 2708-type socket, the 2716 also needs:
- pin 21 (VPP) at +5 V. Strap the 5N rail (X1:A15/C15) to +5 V on the bench, or isolate the pin.
- pin 19 never at +12 V.
- Sockets 0400 / 0800: leave them empty, or fit 2716 copies of the MG80 ROM2/ROM3 (fitted the same way). The test identifies them.
- An oscilloscope. A UART decoder or a USB-TTL serial adapter (9600 8N1) is useful but not essential.
| Check | Value |
|---|---|
K2521TEST_2716.bin CRC32 | 02541AC7 |
K2521TEST_1K.bin CRC32 | 8BB943B1 |
2. Power pins (X1, system bus)... |
Summary
The MG80 firmware is intact. The most likely cause of a completely dead unit is the heating control holding the CPU in reset.
- Firmware: the 3 KB image
rom123.binwas fully disassembled and run in a cycle-exact emulator. Every function works: keyboard, Morse and telex transmit, the eight message memories, training and the receive modes. It is not the cause of the fault. - Prime suspect: the 0 °C thermistor R702 on the backplane, or its wiring. If it is open, the heating control keeps /RESET low for ever. The panel then stays in the reset pattern: BA and GT lit, plus one LED in each row. The repair manual itself allows bridging R702.
- Other causes produce distinct symptoms (see Fault analysis). A RAM or ROM fault shows only as "no LED walk", because this firmware revision has no self-test.
- Test the CPU board on its own first. A purpose-written test ROM, K2521TEST, needs one 2716 EPROM, +5 V and a scope. It reports the state of each RAM chip, the EPROMs, the CTC, interrupts and the PIO.
First actions: measure /RESET at X501/AC13 after power-on, and run K2521TEST on the bare CPU board.
Scope and method
The analysis set out to explain why an RFT MG80 Morse/telex keyer does not work at all. It combined the firmware with the original documentation and a simulation of the CPU board.
| Step | What was done |
|---|---|
| Disassembly | rom123.bin (MD5 c4a5507776bc5d3f43248d7c128e8c93) disassembled in Ghidra. All 50 functions and 60 labels named and commented |
| Emulation | A cycle-exact U880 (Z80) emulator with CTC and PIO models runs the real ROM, with the keyboard and outputs simulated |
| Fault injection | Dead RAM chips, blank EPROMs, broken CTC channels, missing interrupts and reset faults were injected, and the symptoms recorded |
| Documents | K2521 board description, MG 80 circuit documents (Schaltungsunterlagen) and the 1984 repair manual (Reparaturanleitung) |
| Test tooling | A standalone diagnostic ROM for the CPU board, verified against the same injected faults |
Not covered: the audio and relay boards beyond the interface schematic, and the physical position of each key.
The equipment
The MG80 is built around a Robotron K2521 (ZRE) CPU board running at 2.4576 MHz. All other boards hang off its PIO and CTC.
| Board | Role |
|---|---|
| ZRE K2521 | U880 CPU, 3 × U555 EPROM (1 KB each), 8 × U202 RAM (1K × 1, one chip per data bit), CTC U857, PIO U855 |
| Keyboard | 62 keys in an 8 × 8 matrix; column latch on port 10h, rows on PIO-B |
| Display | BA (mode) and GT (speed) LED rows, SP LED; tone and level controls |
| Interface | Tone generator, Morse keying, double-current output, electronic contact, telex current loops; driven only by PA7 (Morse) and PA6 (telex) |
| Heating control | Temperature sensing and heater relays; also drives /RESET |
| Backplane | Carries NTC R702 and the CTC2 → CTC0 wire link (X2:A23 → C25) |
| Address / port | Device | Use |
|---|---|---|
| 0000–03FF | ROM1 | Reset, vectors, character tables, Morse/telex bit routines |
| 0400–07FF | ROM2 | Keyboard and command handling, CTC interrupts, transmit |
| 0800–0BFF | ROM3 | Random groups, speed and baud, memories, training |
| 0C00–0FFF | RAM | Messages, buffers, variables, stack |
| 80–83 | CTC | Morse clock, telex clock, 2133 Hz timebase, key debounce |
| 84–87 | PIO | A: LEDs and outputs; B: keyboard rows |
| 10 | Latch | Keyboard column select |
Firmware findings
The firmware is complete and runs every feature correctly in the emulator. It is a later revision than the one the 1984 repair manual describes.
Architecture. After start-up the CPU only executes EI / HALT; all work happens in Z80 mode 2 interrupts. The keyboard uses PIO-B, then CTC3 for a 17.4 ms debounce. Morse timing uses CTC0, clocked from CTC2's 2133 Hz output through the backplane link. Telex timing uses CTC1.
Start-up seen on the panel:
- Reset: BA, GT and one LED in each row, for under 1 s.
- LED walk: both rows step through 0, 1, 3–7 at 200 ms per step, about 1.4 s.
- Ready: BA5 and GT4 lit, within 3 s.
- If a key is held at power-up, the teleprinter prints
ENDE/TASTE:x.
Features confirmed: Morse at 10–99 groups per minute, telex at 45.45–300 Bd, eight 128-byte message memories, a 16-character type-ahead buffer with SP LED warning, random training groups with an automatic check of the copy.
Revision difference. The repair manual describes a power-on self-test that reports RAM, EPROM and CTC errors as blink codes. This ROM has no such test. A memory fault therefore shows only as a missing LED walk, which is why a separate test ROM was written.
Receiving Morse. The firmware can decode Morse at 10–80 groups per minute without a speed setting, but only from an audio tone on PA4. On the MG 80 nothing drives PA4 or PA6 as inputs, so receiving needs the MG-80M hardware.
Fault analysis
Each failing part gives its own symptom, so the front panel narrows the fault before any probing.
Heating control and reset. Besides the K2521's own 300 ms power-on reset, open-collector gate G13 (D504) on the heating control pulls /RESET low at X501/AC13.
- The 0 °C sensor T0 is NTC R702 (TNK-A10/100/10) on the backplane, pulled up by R506 (820 Ω). When warm, it pulls T0 low.
- Latch G13/G14 with R505/C502 (10 kΩ / 470 µF) sets at power-on and releases /RESET once T0 goes low.
- If R702, its wiring or connector X806 is open, T0 stays high and the CPU never starts. The same happens below 0 °C with an SV 81 supply, which provides no heater voltage.
- Faults in D504, C502 or R512 have the same effect.
Symptoms and causes (from emulator fault injection, checked against the schematics and repair manual):
| Symptom | Likely cause | Check |
|---|---|---|
| Stuck in reset pattern (BA + GT + one LED per row) | /RESET held low: R702 or wiring open, D504, C502, R512 | X501/AC13 must go high; T0 (X501/AC3) low when warm; bridge R702 |
| No LEDs at all | Power supply, E/A key, display cable | X602 voltages; bridge X201/AC12–AC13 |
| No LED walk, not in reset pattern | Clock, ROM1, any single U202, PIO-A, /WAIT or /BUSRQ low | 2133 Hz on X2:A23; run K2521TEST |
| LED walk repeats | NMI pulses or supply dips | /NMI (X1:A23) high; +5 V under load |
| Walk OK, keys do nothing | ROM2 or ROM3, CTC3, PIO-B interrupts, jumper X14/X15, X12/X13 fitted | K2521TEST INT line; keyboard test points |
| No Morse, telex OK | CTC2/CTC0 or the A23 → C25 link | 2133 Hz on both A23 and C25 |
| No telex, Morse OK | CTC1 | Pulses on X2:A24 |
| BA5 sends nothing, BA1 and BA4 work | One CTC channel stalls the shared loader | Test BA1 and BA4 separately |
| PA6/PA7 toggle, no output | Interface board | Hand-key test on X606 |
| BA LED blinks at 5 Hz | Over-temperature or T60 sensor fault | X501/AC11 |
Tools produced
The analysis produced a CPU-board test ROM plus reusable files for further repair work.
K2521TEST ROM. A 1 KB diagnostic for socket ADR 0000, programmed into a single 2716 and run on the bare CPU board with +5 V only. It uses no RAM until the RAM has passed, so a dead U202 is reported instead of crashing the test. A healthy board prints this every 1.7 s on PA7 (X2:C13) at 9600 Bd 8N1:
K2521 TEST V1
ROM 0000 D91C OK
ROM 0400 C15D MG80
ROM 0800 DA05 MG80
RAM BITS 00 OK
CTC0123 PPPP
INT 0A OK
PB=FF OK
RAM BITS: each set bit names the faulty U202 (08 = the D3 chip).CTC0123: P or F for each channel.INT: interrupts counted in 100 ms; 00 means none reach the CPU.- PB0–PB7 show the same results as DC levels (high = pass), and PA0–PA6 output square waves from 25.6 kHz to 400 Hz.
In the emulator, it correctly reported each injected fault: a dead U202, missing RAM, a stuck address line, empty or wrong EPROMs, a dead CTC channel, no interrupts and NMI pulses.
| File | Content |
|---|---|
K2521TEST.zip |
Test ROM image (2716 CRC32 02541AC7), source, assembler, emulator tests, guide |
MG80_apply_all.py |
Ghidra script applying all names, labels and comments |
MG80_annotated_full.asm |
Full symbolic listing that rebuilds the ROM byte for byte |
MG80_simulator.zip |
Python emulator of the MG80 with behaviour and fault tests |
MG80_2716_images.zip |
The three MG80 ROMs as 2716 images |
MG80_firmware_analysis.md |
Detailed technical reference behind this report |
Recommended procedure
Test the CPU board alone first, then let the front panel at power-on decide where to probe in the complete unit.
- Bench-test the CPU board with K2521TEST: +5 V only, test 2716 in socket ADR 0000. Look for 2133 Hz on X2:A23, then read the serial report on X2:C13.
- Read your unit's three EPROMs and compare them with the checksums in the appendix.
- Refit the board, power on after at least 10 s off, so C502 has discharged. Watch the panel for 3 s and follow the matching branch of the diagram.
- If the unit starts, check the outputs: PA7 (X2:C13) in BA4 and PA6 (X2:A13) in BA1 while typing. Then do the hand-key test on X606 for the interface board.
- For indoor use or an SV 81 supply, leave R702 bridged; the manufacturer uses this to block the heating control.
Appendix: EPROMs and sources
Compare your unit's three EPROMs against these checksums. A mismatch means a different revision or a corrupted chip.
| Socket | Range | First bytes | Sum16 | CRC32 |
|---|---|---|---|---|
| ROM1 / ADR 0000 | 0000–03FF | ED 5E 21 00 10 | 7CDF | 02E431DA |
| ROM2 / ADR 0400 | 0400–07FF | 3E A7 D3 83 D3 | C15D | 5CA67DAE |
| ROM3 / ADR 0800 | 0800–0BFF | D9 01 00 05 51 | DA05 | 553C6D93 |
Replacing a U555 (2708) with a 2716. Use a single-supply 2716 (Intel 2716, U2716C, К573РФ2), not a TMS2716. Program the doubled 2 KB images so the 2716's A10 line doesn't matter.
| Pin | 2708 | 2716 | Rule |
|---|---|---|---|
| 18 | PROGRAM (0 V) | /CE | Fine as is |
| 19 | +12 V | A10 | Must never see +12 V |
| 20 | /CS | /OE | Fine as is |
| 21 | −5 V | VPP | Must be +5 V |
In the complete MG80 the supply puts +12 V and −5 V on pins 19 and 21, so those pins must be isolated with an adapter or bent-out pins.
Sources: Crypto Museum MG-80 · K2521 board description · MG 80 Schaltungsunterlagen · MG 80 Reparaturanleitung (Feb 1984) · cpushack U555C · retrocmp 2708
Report dated 23 October 2026.
