Vakumat Circuit Tracing and Bus Probing
After extracting the program, I wanted to probe the bus on the EPROM to decide which code is actually executed. While doing that, I decided to trace which pins on the CPU connect to the headers and see if I can correlate that with the IIC code I found in the EPROM. So I scanned the circuit board top and bottom and overlaid the result while adjusting the color channels. Some traces are more visible in some combination than others.
So the DB9 port on the side of the unit is not a RS232 type serial bus but some IIC bus plus one extra line, so I monitored that together with the bus. For that I used a SLA5032 32 Channel Logic Analyzer, which is supported by Sigrok/PulseView.
When I removed the circuit board, one of the wires in one of the connectors came loose. I fixed that as I put the board back in. Much to my surprise the error beep that the furnace used to make no longer occured. At first, I thought I had broken something and traced all the voltages, fuses, etc. But shortly after turning on, the unit starts cycling through the relays. So maybe the error beep was not due to the missing control panel, but due to the loose wire?
Sigrok/PulseView did yield the desired run-time information:
Of course, there is no useful data coming in on the IIC bus since the font panel is missing, but I can now follow the code addresses that get executed during this bus access. So the next step is to carefully determine what kind of data flow that code expects.