HP Forum Archive 13

[ Return to Index | Top of Index ]

Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #1 Posted by Bill Wiese on 27 Aug 2003, 2:53 p.m. Hi all... [reference: http://www.pmonta.com/calculators/hp-35/index.html ] Anyone out there with a dead 15C and that has access to "chip peeling"/decap equipment? Maybe we can get a ROM dump. (15C ROMs are apparently not a separate standalone chip apparently. Dunno how to 'grab' the data electrically... but that may not matter this way.) Decapping usu means use of a fuming nitric acid jet to debride the epoxy body/cap of a chip 'til the chip die & bond wires are exposed. (Then rinsed quickly so the acid doesn't hang around! :) BTW chips can work after this process!! The chip MIGHT be directly (micro)photographable like Peter Monta did, unless the line widths are a great deal smaller. If that is the case, the glass passivation layer (outermost) may need to be removed too. [Late technology chips can be harder to photomicrograph given feature size vs. wavelength of light used are in similar ranges.] Years ago I did this w/some automotive microcontrollers. A coupla chips still worked afterward for awhile - though the ones w/passivation layer ground down died shortly after. If we can get nice photos of 15C ROM array areas we might be able to differentiate btwn '1' and '0' bits in ROM, letting us "dump" it. Of course we'd have to figure out the array sense (that is, what is actually a '1' and '0' - or is it vice versa?) and array arrangement & interleaving (addr[n] is not necessarily next to or even near addr[n+1] or addr[n-1]). But with a bit of help from other 'Nut calcs we prob can figure this out statistically (opcode/operand frequency analysis, positional information, etc.) If someone can supply me with a GOOD noncompressed image(s) scan of photographs of these ROM dies I'm glad to try attempting this latter half of the work. I don't have access to the former services (decap/photograph...) anymore Bill Wiese San Jose, CA

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #2 Posted by Nelson M. Sicuro (Brazil) on 27 Aug 2003, 3:23 p.m., in response to message #1 by Bill Wiese I think that is much easy to read the ROM through eletrical means. I'm planning build one "ROM Ripper" to use it in the Voyagers. Their CPU is the SAME as the HP-41 (Coconut) and the technical description of their signals is well documented. If you can read the ROM by other means, that's great! But I think that is much harder... Best regards, Nelson

Re: Why Bother Really??? Message #3 Posted by Ron Ross on 27 Aug 2003, 3:52 p.m., in response to message #2 by Nelson M. Sicuro (Brazil) Since there is no way to up or download software from this calculator, there is no software base to recover. Why bother??? Just use the symulators already out there. I think there is an 11c floating around, and an enhancement would be better than bothering to get an exact machine with warts and all.

Re: Why Bother Really??? Message #4 Posted by Nelson M. Sicuro (Brazil) on 27 Aug 2003, 4:17 p.m., in response to message #3 by Ron Ross The thing is create an EMULATOR not a SIMULATOR. And it helps to preserve the knowledge. There is many hours of work in those algorithms and this is no trivial to do in a simulator. Can you trust any simulator your sensitive data? Besides, it is a good challenge. Regards, Nelson

Re: Why Bother Really??? Message #5 Posted by Bill Wiese on 27 Aug 2003, 4:36 p.m., in response to message #3 by Ron Ross Um, partially true... BUT: the HP15C is a very algorthmically refined calculator, esp in root finding & integral work. Pretty nice setup. It'd be great to run a true emulator of 15C ROM code. The emulator UI could, in PRGM mode, be setup to translate user keycode opcodes into text-like user instructions. It'd be REALLY great to have this run on a palmtop :) Bill Wiese San Jose CA

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #6 Posted by Bill Wiese on 27 Aug 2003, 4:28 p.m., in response to message #2 by Nelson M. Sicuro (Brazil) Hi Nelson, The 15C apparently has 3 chips. However I am not sure about partitioning of ROM on these chips. IIRC, the the main CPU chip may indeed have all the ROM and the others are just RAM chips (??) for user program area & data memories perhaps w/some extra I/O capabilities. Correct me if I'm wrong. It'd be nice to know... Indeed, if *all* ROM could be readily dumped by electrical means that would be handiest. (Perhaps even a PC running good ol' DOS and toggling bits on its LPT: parallel port and then reading back data stream could do this.) But as the paragraph below from The Museum's HP15C entry indicates, the CPU may have 61Kwords of mask ROM on it. This ROM may well NOT be 'dumpable' if all pins on this CPU are devoted to KB/LCD I/O - or the dumping action is a proprietary factory mode. And just because the external user prgm/data memory requires CPU to expose addr/data bus does NOT mean the internal ROM can be read out similarly - esp as we'd be using an external device as 'master'... "The CPU for these new machines included 61Kbits of ROM, 2.2Kbits of RAM, an LCD driver and a low-battery detector on-chip. To improve on previous designs, HP developed a new CMOSC process...." Bill Wiese San Jose, CA

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #7 Posted by Nelson M. Sicuro (Brazil) on 27 Aug 2003, 5:24 p.m., in response to message #6 by Bill Wiese I think that the three chips are (left to right if you watch the picture of inside a 15c): 1) Display Controller (and RAM??) (the bigger chip) 2) Coconut CPU (pratically the same of the one on 41CX) 3) ROM (and RAM??) and keyboard scanning I read in one HP internal documentation of the Coconut processor that it is really the same on the 41C, 11C and 12C (and consequently 15C), the only difference is the battery voltage monitor and the power down system (mask 7, CMOSV): 1LF5-301 on 11C and 1LF5-0002 on 41xx. Mine 15C have one marked "1LH1-302" (the other two: display ctrl. 1LH1-306, the ?ROM 1LM2-0001). This documment also describes the serial bus states (clock 1 and 2, sync, pwo, isa, data). With some kind of logic analyser (or PC paralell port or a microcontroller) we may get the right pins of the serial bus and cutting it from the CPU we can drive the ROM simulating the serial bus and reading the data sequentially. I'm thinking of try this approach on a less expensive HP-12C (vintage, not the new ones) and if I have any success I'll try on the 15C. Any other information will be great. Best regards, Nelson

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #8 Posted by Bill Wiese on 27 Aug 2003, 6:09 p.m., in response to message #7 by Nelson M. Sicuro (Brazil) Hi Nelson.. Unless they're referring to specific chips, that 'Coconut' term prob largely refers to a combination of instruction set & CMOS techology. I doubt the same chip was used in 41xx and 11C-15C. Also later 15Cs as Randy Sloyer pointed out have 2 chip and 1 chip versions. Regards, Bill

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #9 Posted by Nelson M. Sicuro (Brazil) on 27 Aug 2003, 6:16 p.m., in response to message #8 by Bill Wiese I saw in one picture of the interior of some 41CX that the processor is at least the very same phisical layout of one in the 15C here. Anyone have another picture of an opened 41CX to confirm this? BTW this information I get on a scanned document from HP describing the "coconut" CPU.

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #10 Posted by Vassilis Prevelakis on 27 Aug 2003, 6:48 p.m., in response to message #8 by Bill Wiese Bill Wiese wrote: > Unless they're referring to specific chips, that 'Coconut' > term prob largely refers to a combination of instruction > set & CMOS techology. I doubt the same chip was used in > 41xx and 11C-15C. Its not the same IC, the 41 series uses a different IC because it requires a higher voltage and runs faster. Apart from such minnor differences the CPUs are the same, but the ICs used are different. The 1xC series used the 1LF5-0301 while the 41 the 1LF5-0002 Having said that, the techniques for extracting the contents of the ROMs by manipulating the address and data buses would be very similar. **vp

Re: Anyone w/dead 15C that can decap/peel chips w/ ROMs?? ROMs may be internal Message #11 Posted by Bill Wiese on 27 Aug 2003, 10:57 p.m., in response to message #10 by Vassilis Prevelakis Vassilis wrote: >Its not the same IC, the 41 series uses a different >IC because it requires a higher voltage and runs faster. >Apart from such minnor differences the CPUs are the >same, but the ICs used are different. > >The 1xC series used the 1LF5-0301 while the 41 uses >the 1LF5-0002 > >Having said that, the techniques for extracting the >contents of the ROMs by manipulating the address and >data buses would be very similar Like many other microcontrollers, it sounds like the Coconuts are part of a 'line' - same instruction set but different speeds, I/O, etc. Generally speaking, for a given process technology, RAM takes up more space (chip area) per bit than ROM. So having 61Kwords of machine ROM in the CPU would not surprise me. Just because the Coconut can connect to external chips for KB/IO and user data storage does NOT mean the ROM can be dumped via these I/O lines!!! Bill Wiese San Jose, CA

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #12 Posted by Randy Sloyer on 27 Aug 2003, 5:57 p.m., in response to message #2 by Nelson M. Sicuro (Brazil) FWIW, the 15C was built in three, two and one chip versions. I have an original 3 chip, 2 board version here that works but eats batteries in a week available for disection if someone can do the work. I would love to see any technical documentation on the chips and their signals. Can you point me to a source?

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #13 Posted by Diego Diaz on 28 Aug 2003, 2:16 p.m., in response to message #12 by Randy Sloyer Hi all, Nowadays I'm involved in HP-41 ROM Packs cloning, so I'm dealing on a daily basis with Clk1, Clk2, ISA, SYNC... lines. Yes, the HP available info about 1LF5-0301 (11C, 12C) and 1LF5-0002 (41C Fullnut) clearly says that they both share the same funcionallity and pin-out, only differences are regarding Power supply voltage management. So the task can be achieved, provided: a) 15C's (at early versions) still "wear" the same chip or, b) at least another functional compatible one AND Rom's were not masked inside the processor waffer if the former is true. Further more, if a separate ROM chip of said processor is available, reading the internal code is as simple as provide it with the required lines: Clocks 1 & 2, SYNC, ISA, PWO, V+ and GND. That can be done with a PC parallel port and a +5v DC power supply. Of course it'd be better if done at ASSEMBLY language level. Remember MOV DX,AX?? :-) Another way to work it out migth be placing the said ROM chip into a 41C module, and loading it with DAVID assembler. This will also allow the M-code mnemonics dumping to printer. Wouldn't be nice?? ;-) Contact me if you're interested in the info regarding this CPU. Cheers from the Canary Islands.

Hi Diego... Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #14 Posted by Bill Wiese on 28 Aug 2003, 3:58 p.m., in response to message #13 by Diego Diaz Hi Diego... Interesting. I have a 41C but it has a 40pin(?) DIP CPU. So later 41Cs/Vx/Xs have a small flat-pack CPU? The disadvantage of dumping a 15C w/external ROM instead of a later 15C unit w/fewer chips is that you prob won't get the latest ROM & any bugfixes (offhand, I dunno what bugs are in or were fixed in 15C). Yes, I'd like to see docs on this particular Coconut chip!! You can reach me at bill[at]bwiese[dot]org - despam my address appropriately :)

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #15 Posted by Nelson M. Sicuro (Brazil) on 28 Aug 2003, 5:02 p.m., in response to message #13 by Diego Diaz I'm very interested in any information I can get about the Coconut CPU as long with its ROMs and RAMs. I'm building a emulator in hardware (fisically, a microcontroller simulating the coconut in a body of a deceased HP calc.) in my spare time as a hobby project. My email is in the header above. Best regards, Nelson

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #16 Posted by Diego Diaz on 28 Aug 2003, 8:28 p.m., in response to message #15 by Nelson M. Sicuro (Brazil) Hello everybody, First my apologise, I've just realized I did an unforgettable mistake on my second approach to this issue, namely: It's not possible to place an isolated 15C rom chip and try to fool the 41's CPU because: - The main ROM of the 15C will try to respond at the same address space (i.e. starting at address 0x0000) than the 41 main ROM, and due to that conflict the CPU won't start at all. - That main ROM can't be remaped (as normal 41's modules can via B3 & B4 lines) because it's address space is "firm-wired" inside the chip. Nevertheless the first approach is still valid and, provided you can dump the ROM contents into a binary file this can be later burnt into an EPROM and placed in a ROM-BOX, then treated a separated re-addressable module, thus DISASSEMBLED and listed. Little bit more complicated but still fairly easy... er... well, at least I think so.. :-) Regards.

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #17 Posted by Nelson M. Sicuro (Brazil) on 29 Aug 2003, 10:05 a.m., in response to message #16 by Diego Diaz I'm comparing two Voyagers, the 11C and the 15C that I have with me. The 11C have only 2 chips, from left: 1LH1-0305 and 1LM2-0001. The 15C have 3 chips, from left: 1LH1-0306, 1LH1-0302 and the same 1LM2-0001. I also read in one document (http://www.vcalc.net/hp-11.htm) that it has 2 chips, the bigger (1LH1-305 in my 11C) that is the multi-function and display chip and the CPU. The extra 15C chip I can only guess that is a RAM chip, as it have double the amount of RAM. I also guess that the multi-function chip (1LH1-030x) is also the ROM chip. My objective here is to dump the ROM, so I'll try to cut the traces between the chips and insert my own signals to read it (as soon I get the guts to do it in a working HP-11C!!). What do you think? Best regards, Nelson

Re: Anyone w/a dead 15C that can decap/peel chips w/ ROMs?? Message #18 Posted by Diego Diaz on 29 Aug 2003, 4:49 p.m., in response to message #17 by Nelson M. Sicuro (Brazil) Hi Nelson, I have no previous (neither current :-) knowledge about the Voyager series. I focus my interest in the 41 & related peripherals. There is a picture in this site where you can see a 15C's (early model) guts with three chips. One of them is the 1LF5-0301 wich is, as stated in previous post, the same functional waffer as the 1LF5-0002 used on 41 Fullnuts series but inside a flatpack package. On this basis it's possible to read 15C ROM using (or emulating) the same lines. On later 15C models the chipset were substituded so the referred aproach is useless. Nevertheless you can alwais try to take a look at the internal lines, though an oscilloscope probe shold be, in my opinion, a preferred tool instead an exact-o-knife ;-). Anyway I wish you the best of lucks whatever the method you choose. Regards.

[ Return to Index | Top of Index ]

Go back to the main exhibit hall