HP Forum Archive 14

[ Return to Index | Top of Index ]

Son of ROM dumping Message #1 Posted by Eric Smith on 25 Jan 2004, 9:37 p.m. Ken and I dumped more ROMs today. Voyager: HP-15C HP-16C, which I broke after the dump was completed :-( Spice: HP-33C HP-34C HP-37E HP-38C HP-38E We weren't able to dump several others. Ken's HP-10C is of the early construction where the electronics module is wrapped in tape, and we didn't feel like peeling it. His HP-12C is the single chip model (but still using three button cells rather than one coin cell in the newest ones). The signals might be accessible on pins, but I only spent a few minutes trying to find them and was unsuccessful. Some of the Spice models were press-fit and others were soldered. The press-fit ones are hard to get logic analyzer clips onto. But in some of the press-fit ones, the plastic frame has little plastic fingers going between the leads of the chips, and I wasn't able to clip to those at all. Ken's 31E and 33E are of that style. I was surprised to find that the clock frequencies of Ken's Spice calculators varied from 144 KHz to 180 KHz. When I was removing the clips from the HP-16C, the phase 1 clock pin of the processor broke off completely. There is no longer any metal protruding from the package body. My friend Richard claims that it's still possible to solder to it, but Ken is trying conductive epoxy instead. I'll give him my HP-16C (an early one) if that doesn't work. If I wind up with the broken one, assuming that the epoxy doesn't prevent it, I'll try removing the CPU and replacing it with one from a different Voyager. I should probably be able to find an old HP-12C for a lot less than the cost of a HP-16C.

Re: Son of ROM dumping Message #2 Posted by Nelson M. Sicuro (Brazil) on 26 Jan 2004, 8:07 a.m., in response to message #1 by Eric Smith Hi, Eric Congratulations for your great work! I have a HP-12C with 2 chips, and it is very "beaten", leaked display, loose keyboard. It was the remains of several other that I fixed. The logic is working good, and I offer it to you to dump the ROM and replace your 16C processor, if you want. I also have a 11C (very bad shape) but I'm fixing some corroded traces on the PCB to see if the logic works. We can "trade" them for their ROM, and I have also a 15C but this one is mint and I cannot trade :8)! I can send them to you with no cost, and you send me the ROM dumping. It is OK to you? Can you send the other ROMs also? Best regards, Nelson

Re: Son of ROM dumping Message #3 Posted by Eric Smith on 26 Jan 2004, 12:59 p.m., in response to message #2 by Nelson M. Sicuro (Brazil) I spent some time studying the listings, and have determined that the HP-34C, HP-38E, and HP-38C use bank-switched ROM. The third-generation calculators appear to still have only 4K of instruction address space, and the instruction set appears to be closer to the second-generation than I had previously believed. Possibly a proper superset, though I don't yet have enough information to confirm that. The ROM sizes from the Spice and Voyagers I've dumped so far are: HP-32E: 3.5K HP-33C: 4K HP-34C: 7K HP-37E: 3K HP-38E: 5K HP-38C: 5K HP-11C: 6K HP-15C: 14K HP-16C: 6K The HP-38E and HP-38C have two banks of ROM in the 0x0400..0x07ff address block. The HP-34C has two banks of ROM in each of the 0x0400, 0x0800, and 0x0c00 address blocks. It appears that instruction 1060 (octal) is used for bank switching, and affects the memory region from which it is fetched, though I don't yet understand how the desired bank is chosen. There are also some two-word instructions in which the second work has no sync pulse and is used entirely as part of a branch address. However, I haven't figured out how the first word of these instructions are decoded. The Voyagers will are much easier to simulate since the instruction set is well-known.

Re: Son of ROM dumping - Congrats, Eirc! Message #4 Posted by Bill Wiese on 26 Jan 2004, 1:59 p.m., in response to message #3 by Eric Smith Congrats, Eric, on your graceful method of HP calc ROM extraction!! Hoo-rah. As I used to reverse microcontroller firmware for a living, and often had to jump thru hoops to extract "secure" internal microcontroller ROMs, I really appreciated your inspired "why not use the self-test ROM check" feature in these calcs to dump the ROM. Saved a whole lotta grief, and now we have ROM dumps in a wholesale fashion. If a Spice somehow were to be rigged so as to allow execution of some test ML code (i.e, kinda a 'breakpoint dump'), figuring out the extra instructions may be a bit less hairy. (And for all those who think this is a hobbyist exercise, I submit that it would be very useful for some folks to have an Windows HP calc utility that works EXACTLY like a REAL HP12C (*not* 12CPlatinum).) Regards Bill Wiese San Jose, CA [P.S. - Eric, I perused the rest of your website too. We'll have to go shooting sometime at Target Masters, Reed's or Los Altos. Hackers w/guns, always a great combo ;) ]

Re: Son of ROM dumping - Congrats, Eirc! Message #5 Posted by Eric Smith on 26 Jan 2004, 5:13 p.m., in response to message #4 by Bill Wiese Quote: If a Spice somehow were to be rigged so as to allow execution of some test ML code (i.e, kinda a 'breakpoint dump'), figuring out the extra instructions may be a bit less hairy. My thoughts exactly! I've never figured out why HP tried the press-fit approach to assembling the Spice series. Originally I thought it was a form of cost reduction, but the more I've looked at it the less convinced I've become that it would have reduced manufacturing cost at all. Ken suggested that it might have been intended for better servicability rather than reduced manufacturing cost, but I don't think that makes sense either. However, regardless of the reason, it does have the unintended benefit that it makes it a little easier for me to wire up my own ROMs to the calculator in place of the originals. I can just pull the original ROMs, reassemble the calc, and clip on a set of probes to wire it to my hardware. The probes have a tendency to want to fall off if the calculator is jiggled even slightly. I need to come up with a fixture to hold the top half of the calculator firmly in place (with the probes dangling out the bottom) so I can operate the keyboard and observe the display without knocking the probes loose. If all else fails, I could solder wires in place, but I'd prefer to avoid that. For those that are interested, although I can find NO published information on the third-generation internals, there are three published sources relating to the second generation (Woodstock, Topcat, 67, 10, and 19C): November 1976 HP Journal: two articles describe the processor architecture improvements over the first generation in general terms: Three New Pocket Calculators: Smaller, less Costly, More Powerful Inside the New Pocket Calculators U.S. Patent 4,177,520 contains what is, AFAIK, the only published source listing of any second generation microcode. It's a small chunk, but somewhat helpful. "An HP-67 Anatomy Lessson", a series of PPC Journal articles by Tom Napier, in which he describes partially reverse engineering the instruction set of the HP-67 in order to build a plotter interface: V5 N7 P7-8: Part IA, discusses hardware and bus structure V5 N8 P14-17: Part IB, discusses instruction set V5 N9 P6-7: Part II, more instruction set details V5 N10 P25-27: Part III V5 N10 P30: interfacing

Re: Son of ROM dumping Message #6 Posted by Peter Monta on 27 Jan 2004, 2:19 a.m., in response to message #1 by Eric Smith This is great work. Perhaps the various computer museums around the world should keep a copy of gtk-CASMSIM running for visitors to play with :-). I now have an HP-35 with the bugs, so I'd like to contribute that ROM when I get around to extracting it (hopefully electrically, by cutting a few traces and applying a self-test-like stimulus). I've always been curious what coding errors could cause the obscure bugs found in the early firmware (google for "hp-35 errata"). Ideally the HP-{35,45} firmware could be decompiled to some C-like language to show the algorithms (and bugs) clearly. The ROMs in my buggy HP-35 are marked 1818 0006 1818 0017 1818 0020 from top to bottom. Is this known to be the earliest set? (This is not a "red dot" model, though.) Cheers, Peter Monta

Re: Son of ROM dumping Message #7 Posted by Nelson M. Sicuro (Brazil) on 27 Jan 2004, 3:36 a.m., in response to message #6 by Peter Monta About the firmware, forget about "C-Like", is pure assembler! How do imagine they fit all functions on a 768 words ROM? Best regards, and good luck! Nelson

Re: Son of ROM dumping Message #8 Posted by Eric Smith on 28 Jan 2004, 1:55 a.m., in response to message #6 by Peter Monta My HP-35s have 1818-0024, 1818-0026, and 1818-0027. In the article forum, Tony Duell lists -0024, -0026, and -0028, but I have not seen the -0028. Tony's unit also has an 1820-0849 CTC chip, while mine have the 1818-0012 or 1818-0078. It also would be useful to find the early ROM set for the HP-45 (storage arithmetic is "backwards"), and the buggy ROM set for the HP-67. Any other known alternate firmware sets for calculators before the 41C? Quote: so I'd like to contribute that ROM when I get around to extracting it (hopefully electrically, by cutting a few traces and applying a self-test-like stimulus). We should discuss this further by email. I've got some partially completed hardware to do this.

Re: Son of ROM dumping Message #9 Posted by David Smith on 28 Jan 2004, 1:29 p.m., in response to message #6 by Peter Monta The bugs were (supposedly) caused by a bad value in a coefficent lookup table.

broken HP-16C fixed Message #10 Posted by Eric Smith on 1 Feb 2004, 10:34 p.m., in response to message #1 by Eric Smith Ken did in fact manage to repair his HP-16C that I broke. I was skeptical of the conductive epoxy plan, but it worked.

[ Return to Index | Top of Index ]

Go back to the main exhibit hall