Diagnostic Serial Console

The printer (left) and modem (right) ports of a Macintosh Classic. The Serial Test Manager uses the modem port.

The diagnostic serial console is the Serial Test Manager in the ROM of many 68000-family Macintosh computers: a command interface on the modem port that runs the ROM's power-on tests on demand and reports which test failed and which data bits were wrong. Apple's TechStep service tool used it to test logic boards, and any computer with an RS-232 port and a terminal program can use it. The community reference for the command set is Adrian Black's Macintosh Diagnostics / Test Manager spreadsheet, built on data published by Rob Braun in 2015 with additions from David Giller and SuperSVGA.

Black's test matrix covers the Macintosh SE, SE/30, Classic, Classic II, the Macintosh II family, the Portable and PowerBooks, the LC, LC II and LC III, Color Classic, and the Quadra and Centris models. It lists the Macintosh Plus as "not likely to have any test mode".

Connecting

Connect the Macintosh's modem port to the serial port of another computer. Doug Brown used a mini-DIN-8 to DB-25 cable followed by a DB-25 to DE-9 adapter to reach an RS-232 port. Set the terminal to:

• 9600 baud
• 8 data bits
• no parity
• 2 stop bits (8N2)

Commands must be typed in upper case; lower case is ignored. When pasting a series of commands, add a delay between characters or the ROM misses some of them.

Entering test mode

• If the machine has played the "chimes of death" or shown a sad Mac, it is probably already in test mode.
• Press the interrupt switch (the programmer's switch) straight after reset or power-on. This only works during start-up: pressed after the system has booted, the switch brings up the debugger instead, which is not the serial test mode.
• On some machines, grounding a pin on one of the VIAs forces test mode, but Black found this does not appear to work on the SE/30.

Reset (triangle) and interrupt switches on the side of a Macintosh Classic II

The ROM does not echo commands in its default mode. Type *A: if the terminal shows *A, the ROM is listening and has switched to ASCII mode for command arguments. In test mode the ROM may also send a repeating banner such as *APPLE*876543210000*1*, where the last field is the machine identifier (1 for the Macintosh II family including the SE/30, 2 for the SE, B for the Classic). *S stops the banner. A ? reply means the command was not recognised.

Commands

Serial Test Manager commands

Command	Function	Works on SE/30	Notes
*A	ASCII mode	Yes	Command arguments are typed as ASCII hexadecimal
*H	Hex (binary) mode	Yes	Arguments sent as binary; the default
*S	Stop banner	Yes	Stops the repeating *APPLE* message
*5	Start boot message	Yes	Restarts the banner; commands still accepted
*V	Version	–	Diagnostics and ROM version
*R	Return status	Yes	Status register (D6) and major error code
*4	Clear result	Yes	Clears the result of the previous test
*0	Load A0	Yes	32-bit argument, loaded into D6 then A0; start address for tests
*1	Load A1	Yes	32-bit argument, loaded into D6 then A1; end address for tests
*T	Run critical test	Yes	See below
*N	Run non-critical test	–	See below
*L	Load address	Yes	Address for *D and *M
*B	Byte count	Yes	Byte count for *D and *M
*D	Load data	Yes	Stores the following bytes at the *L address
*M	Memory dump	Yes	Prints memory at the *L address
*C	Checksum	?	Checksum of memory at the *L address for the *B count
*G	Execute	Yes	Jumps to a 32-bit address
*2	Cache on	Yes	On the SE/30 and Macintosh II, enables the instruction cache; on later models, loads the cache control register
*3	Cache off	Yes	On the SE/30 and Macintosh II, disables the instruction cache; on later models, disables the MMU
*6	CPU reset	–	Executes the reset instruction
*7	Prevent sleep	–	Macintosh Portable only
*P	Power Manager command	–	Portable and PowerBook models
*E	Echo commands	?	Possibly echoes command parameters
*I	Restart Test Manager	?	The machine boots if VIA_TEST is not asserted and there are no errors

Critical tests

*T takes three 2-byte arguments: the test number, the number of times to run it, and option flags. *T000200010001 runs test 2 (Mod3 RAM test) once. The RAM tests run between the addresses set with *0 and *1; writes are 32 bits wide, so an end address finishes in C.

Critical tests

Test	Command	Name	Notes
0	*T000000010001	Size memory	Returns the detected top of RAM
1	*T000100010001	Data bus test	Writes test patterns to 8 bytes starting at the A0 address
2	*T000200010001	Mod3 RAM test	Patterns DB6DB6DB, 6DB6DB6D, B6DB6DB6
3	*T000300010001	Address line test	Walks the RAM address lines
4	*T000400010001	ROM checksum
5	*T000500010001	RevMod3 RAM test	Inverse of test 2; set the start and end addresses first
6	*T000600010001	Extra RAM test	Writes 00 and FF alternately over the range
7	*T000700010001	ModInv RAM test	Not implemented on the Macintosh II and SE/30; always returns 0
8	*T000800010001	Size video RAM	V8 memory controller machines only; returns ? on the Macintosh II and SE/30

The option bits are 12 (stop on first failure), 13 (loop on failure), 14 (store results in PRAM) and 15 (boot when done). Black found that no test options seem to work on the SE/30.

Non-critical tests

*N takes the same argument format: *N008400010000 runs test 0x84.

Non-critical tests

Number	Test
0x80–0x83	Mapper RAM and video RAM tests, Macintosh Portable and PowerBook 100
0x84–0x86	SCC (serial controller)
0x87	VIA
0x88	SCSI
0x89	Sound
0x8A	PRAM
0x8B	RBV
0x8C	SWIM
0x8D	FPU
0x8E	Parity generator/checker
0x8F–0x90	FMC memory controller
0x91–0x92	OSS (Macintosh IIfx)
0x93	RAM parity unit (Quadra 840AV)
0x94	Egret (runs the Egret's built-in diagnostics)
0x95	Sound interrupts
0x96	Colour lookup table (LC, Quadra 700/900, LC III)
0x97	Video RAM (V8 controller)
0x98–0x99	Classic II PWM and sound interrupts
0x9A	53C96 SCSI
0x9B–0x9D	SONIC Ethernet
0x9E	Greyscale chip registers
0x9F	PG&E power manager (PowerBook Duo)
0xA0	Colour support chip registers

Reading the result

*R returns twelve hexadecimal digits followed by *R. The first eight are the status register; after a RAM test they show which data bits failed. The last four are the major error code. Doug Brown found that after the chimes of death the status register holds meaningless data, because the code that plays the sound overwrites it; clear it with *4, run the relevant test over a small range, and read the result again.

Major error codes

Code	Failure
01	ROM checksum
02	Initial RAM failure
03	RAM bank A
04	RAM bank B
05	RAM addressing
06	VIA1 access
07	VIA2 access
08	Data bus error accessing RAM
09	MMU
0A	NuBus access
0B	SCSI
0C	IWM
0D	SCC
0E	Data bus test
10	Power Manager
11	Error sizing memory
12	SCC IOP
13	Dynamic bus sizing
14	Power Manager turn-on
15	RAM parity
30	Egret
FF01, FF02, FF03, FF04	Bus error, address error, illegal instruction, divide by zero
FF16	Interrupt (programmer's) switch pressed (level 7 interrupt)

Black's examples: 000000FF000E is a data bus test failure with bits 0–7 in error; FF0000FF000E has bits 0–7 and 24–31 in error; FFFFFFFF000E has all 32 bits failing, as when no RAM is installed.

Doug Brown's Performa 450 (LC III) played the chimes of death after its capacitors had been replaced. *R gave error code 0003 (RAM bank A). After *4, *000001000, *100002000 and *T000200010001, the test failed and *R returned 000008000000: bit 11. Continuity checks found data line D11 broken between the onboard RAM and the rest of the board, near a capacitor that had leaked. On a Performa 410 (LC II) the code was 30, an Egret failure, which was cured by cleaning capacitor leakage around the Egret.

Examples for the SE/30

Memory test of the first 4 MB:

*A               ASCII mode
*S               stop the banner
*4               clear the previous result
*000000000       start address 0
*1003FFFFC       end address, 4 MB
*T000600010001   Extra RAM test
*R               read the result; eight zeros before the error code is a pass

Mod3 test of the SE/30's video RAM:

*A
*S
*0FE000000       start of video RAM
*1FE00FFFC       end of video RAM (64 KB)
*T000200010001   Mod3 RAM test
*R

Write and read back memory:

*L00000000       address
*B0004           byte count
*D12345678       store 12345678
*L00000000
*B0004
*M               prints 12345678

Black's spreadsheet also gives short programs, loaded with *D and run with *G, that fill the SE/30's video RAM with white or black, animate vertical lines, and read the VIA buffer and direction registers.

SE/30 and Macintosh II address map

Addresses used with the test commands (32-bit mode)

Address	Use
0x0000 0000	DRAM start
0x4000 0000	ROM start
0x5000 0000	I/O start; VIA1
0x5000 2000	VIA2
0x5000 4000	SCC (Z8530)
0x5000 6000	SCSI (pseudo-DMA with DRQ on the II; handshake on the SE/30)
0x5001 0000	SCSI (normal)
0x5001 4000	ASC (Apple Sound Chip)
0x5001 6000	IWM/SWIM floppy controller
0xFE00 0000	SE/30 video RAM page 1
0xFE00 8000	SE/30 video RAM page 2 (active at boot)
0xFEFF 0000	SE/30 video ROM (8 KB)

The SE/30's video logic emulates a NuBus card in slot $E.

Bench observations on an SE/30

The following were recorded on a 4 MB SE/30 at the bench. They are observations from one machine and ROM, not Apple specifications.

Data bus mapping of the SIMM slots

With 1 MB SIMMs in slots 1 and 2 only, writing 11223344 to address 0 and reading it back gave xxxx3344, so slots 1 and 2 carry the lower 16 bits of the data bus. With the SIMMs in slots 3 and 4, the read-back was 1122xxxx: slots 3 and 4 carry the upper 16 bits. Each 30-pin SIMM carries one byte of the 32-bit data bus, and Apple's rule is four SIMMs per bank, so two SIMMs fill half the bus. In the SE/30 schematic the sockets pair up the same way: S1A and S3A carry D0–D7, S1B and S3B D8–D15, S2A and S4A D16–D23, and S2B and S4B D24–D31.

Memory reads

*M returned 4 bytes per command whatever the *B count, and advanced the address by 4 each time. After *L00000000, *B0008, *D1122334455667788 and *L00000000, the first *M returned 11223344 and the second 55667788.

Response codes seen

In this format the first eight digits mark the failing bits, so with RAM on bits 0–15 only (slots 1 and 2) the data bus test, error 0E, reports bits 16–31 as failing, and with slots 3 and 4 the reverse.

Codes observed on the bench SE/30

Response	Observed with
004000000000	4 MB installed (0x00400000 = 4,194,304 bytes)
FFFF0000000E	SIMMs in slots 1 and 2 only: bits 16–31 failing
0000FFFF000E	SIMMs in slots 3 and 4 only: bits 0–15 failing
000000800000*R	RAM test reaching the 8 MB boundary on a 4 MB machine
FFFFFFFF0005*R	Addressing test (error 05) on a 4 MB machine
00080000xxxx	A RAM test that wrote 0xFF patterns correctly but read back 0x08 in the second byte when 0x00 was written: bit 3 of that byte stuck high. Check the SIMM in the corresponding slot, its socket and the board traces.
0F000D	Interrupt switch pressed during boot

Address boundaries

• The end address reported for 4 MB was 1003FFFC.
• Tests 2, 5 and 6 failed at address 0x800000 (the 8 MB boundary) on the 4 MB machine, even when asked to test a smaller range such as 64 KB, with error 0005. On this machine that is normal behaviour, not a fault.
• There is no protection against addressing beyond installed RAM. Writes and reads past the end wrap to low memory, typically the first bytes, which is also how the ROM sizes memory. With 1 MB SIMMs installed the wrap did not occur within the tested range.
• After entering test mode with the interrupt switch, *5 reported 000001300F and not the RAM size. Running *T000000010001 (size memory) first made later *5 calls report correctly.

Apple TechStep

TechStep is Apple's hand-held diagnostic tool for service providers. It is built around a Motorola MC68HC11 microcontroller with a four-line, 16-character LCD and a 15-key keypad. Tests for each product are on slide-in ROM packs, and a detachable port pack carries two ADB ports, two mini-DIN-8 serial ports, a SCSI port and a stereo audio port. The first release shipped with the CPU Tests, Volume 1 ROM pack, covering the Macintosh Classic, SE, SE/30, II, IIx and IIcx, and a SCSI HD Tests pack for Apple HD SC drives. TechStep sends its test logs from its built-in serial port to a Macintosh's modem port for Apple's Report Generator application.

Related pages

• Sad Mac Error Codes and Sad Mac Decoder
• MacsBug Reference and Debugging Guide
• Apple TechStep User Guide
• Macintosh SE/30 Troubleshooting
• Macintosh SE/30 Memory Upgrade Guide