Decompiler help please

I'm pretty bsure this is a real long shot. I have looked online but have not yet found something that will help. So I ask here. The EPROM reader/programmer arrived yesterday and it works fine. The UV EPROM eraser should be here in a day or two. Amazon apologized for the delay. So I can copy the EPROMs just fine but I would really like the ladder programs so that I can make some changes to the machine. I understand that the decompiled ladder will noit have mnemonics but maybe I can decipher it anyway. The control in question is a FANUC 3T. Thanks, Eric

Reply to
etpm
Loading thread data ...

How in heck do yu expect help with a decompiler when you haven't told anyone what type of CPU it is?

Reply to
Clifford Heath

It's even harder...ladder logic isn't a "cpu machine language" as such, it's an interpreter running in some native cpu machine language...so there would be a whole other layer of translation involved in order to produce anything a human might be able to comprehend. Unless your computer is made from relays...but why bother.

Reply to
Bill Martin

Please try to pay attention. "The control in question is a FANUC 3T."

--
"I am a river to my people." 
Jeff-1.0 
 Click to see the full signature
Reply to
Fox's Mercantile

That's the packaged controller. It contains a CPU. The CPU interprets some ladder codes.

It's highly unlikely that the information required to decode the EPROM has ever been published. This sort of thing is usually trade secret.

If the CPU is known, and the interpreter ROM is read, there's some possibility of using a decompiler.

Reply to
Clifford Heath

A manual found online says the 3T master board uses an 8086, so it'll decom pile as an 8088 would (different bus, but same opcodes).

Reply to
whit3rd

Well, that's why I'm asking for help. I know hardly anything about this stuff. Eric

Reply to
etpm

Thanks You. Now maybe I can find something to work. This stuff is way out of my experience but with some guidance I'm hoping to be able to decipher the ladder. Eric

Reply to
etpm

Just be aware that sometimes trash is included in EPROMS to stop what you are trying to do!

Paul

Reply to
Paul Drahn

oit have mnemonics

Three things to look out for: the ordering of the data bits can be scrambled; probably you can trace thos e to the CPU pins the ordering of the address bits can be scrambled, and some may be hard to trace to the CPU pins the data and/or the address might go through inverting transceivers, which changes the bit-is-a-one /bit-is-a-zero identity.

Reply to
whit3rd

On Thursday, November 21, 2019 at 8:35:22 PM UTC-5, snipped-for-privacy@whidbey.com wrote :

I'm sure you know this but I've been bitten once and it may be worth mentio ning.

I understand you're trying to back up your EPROM holding your program. We had a similar problem in a manufacturing plant, probably with an Allen Brad ley PLC or similar. (it's been a while) The program went bad, we got the backup EPROM, and uploaded the saved program.

Except we didn't. The wording of upload and download was ambiguous and we accidentally saved the bad program from the machine onto the EPROM. We had one extra EPROM in the safe, got that out and ??? ? did exactly the same thing.

Everything was ladder logic and I came to hate those hardcopy printouts, bu t with enough time and patience we could type it back in. Ladder logic was theoretically understandable to the electricians but it violates every sin gle concept in programming. Every line can refer to any other line - no mo dular programming, no single entry single exit, etc.

Reply to
Tim R

t works fine.

ave mnemonics

In this case, the 'river to the ppl' took a wrong turn. with all due respect, FANUC 3T tells you almost nothing wrt what the OP is trying to do. One needs to open the box and find out what CPU is on the mai n board e.g. intel iX, ARM X, Atmel, etc. etc. Knowing the CPU defines the ISA of the machine, and one can begin to figure out how to set up a logic analyzer to look at the machine instructions and execution. Configuring a small, simple ladder logic example or 5 and obser ving the instruction and address trace will provide some insight into what is being R/W to memory, EPROMS, etc. which can then be used to identify an d decode the ladder login mnemonics used by the mfg. From what I know, the approach taken to codify and execute ladder logic mne monics is unique to the mfg. There are some general schemes/patterns used to execute the ladder program but again, every mfg has their own way of doi ng things. If you really need to do things at this level, it is a LOT of work and a fa ir amount of guessing. There have been a number of academic papers looking at various issues wrt L adder Logic in general and in some cases, manufacturer specific details are sometimes contained in the paper. Perhaps googling may help you. A JTAG connection and associated diagnostic software may be helpful as well . Good luck J

Reply to
three_jeeps

e:

it works fine.

d

have mnemonics

s trying to do. One needs to open the box and find out what CPU is on the m ain board e.g. intel iX, ARM X, Atmel, etc. etc.

re out how to set up a logic analyzer to look at the machine instructions a nd execution. Configuring a small, simple ladder logic example or 5 and obs erving the instruction and address trace will provide some insight into wha t is being R/W to memory, EPROMS, etc. which can then be used to identify and decode the ladder login mnemonics used by the mfg.

nemonics is unique to the mfg. There are some general schemes/patterns use d to execute the ladder program but again, every mfg has their own way of d oing things.

fair amount of guessing.

Ladder Logic in general and in some cases, manufacturer specific details a re sometimes contained in the paper. Perhaps googling may help you.

ll.

I just saw the reference to the 8086 processor. the good news is that ther e is lots of knowledge about this processor, including how to use a logic a nalyizer with it. I believe that looking at a static ROM dump of contents may not provide you with the insight for what you want to do. Looking at execution of the system would be more beneficial. But again, a LOT of work J

Reply to
three_jeeps

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.