HP Forums

Full Version: dumping ROMs
You're currently viewing a stripped down version of our content. View the full version with proper formatting.

In 1995 I wrote microcode-level simulators for the HP-45 and -55 (CASMSIM) and the HP-41C (NSIM). Recently I dusted off CASMSIM and resumed development. Part of the plan is to support more models in a unified simulator. For that, I'll need ROMs. Back in 1997 or so I tried dumping some ROMs but had a lot of trouble and set it aside.

I finally started working on dumping ROMs again. I cobbled together an interface to let me capture the calculator bus signals using an LTC1045 hex level translator chip and a DLP-USB245M parallel-to-USB converter module (based on the FTDI FT245BM chip).

The level translator will be necessary for the older calculators that use PMOS levels (-10 to +6V clock, ground to +6V data).

I'm using the USB chip for input only. It takes eight data bits and a strobe. I've wired the phase 2 clock to the strobe, and the SYNC and ISA signals to two of the data pins. I wired up the top three bits as "010" so that the samples are printable characters for convenience. Then it should only take "cat </dev/ttyUSB0 >foo.log" to capture a trace.

I couldn't get it to work until I ran it as root. Strange, because I'd actually set the permissions on /dev/ttyUSB0 to 666.

I hooked the hardware up to an HP-11C. By putting the calculator into self-test mode, it checks its ROM and RAM. From the trace, I was able to extra the ROM contents, 6K words of 10 bits each.

With a little bit of hacking, it should be possible to get the 11C running in my old NSIM simulator. But rather than mess around with that, I'm going to try to add the Nut architecture to CASMSIM.

I took some photos of the ROM dumping apparatus:

Now that I know the hardware works, I'll dump the rest of the Voyager series the Spice/Spike series. These all have the self-test, so capturing the ROM image will be easy. The first and second generations do not have a self-test, so dumping those is much more difficult.

When I use this on 2nd and 3rd generation calculators, I'll have to hook up a few more of the internal signals, because I'll need detailed traces in order to reverse-engineer the processor architecture.

I'm trying to do the very same thing, I also discovered the pinout of the CPU of my HP-11C/15C, but I haven't much time do build the hardware to connect to the parallel port of my PC.

It is easy having such "analyser", don't forget that the ROM data is sent over the DATA line on the self-test (is read on C register of NUT processor). I saw it "passing" on the oscilloscope.

Good work! Let us know when you put your "HP-11C Emulator" to run!

Best regards,



I am using the same USB interface for communicating with the MLDL2000, but a different brand of PCB. How do you read in the data? Can you share the schematics and software?


> don't forget that the ROM data is sent over the DATA line on > the self-test

I haven't bothered to hook up the DATA line. It's easier to capture on the ISA (address/instruction) line. I only hooked
up the phase 2 clock, SYNC, and ISA.

The HP-11C has RAM from 0x000 through 0x00a and from 0x0e0 through 0x0ff. I expect the other Voyager models to have the same memory map, except the 15C which also has RAM from 0x010 through 0x01a and 0x0c0 through 0x0c0 throguh 0x0df.

The display still uses the opcodes 0x2e0 and 0x320, probably for the same display off and display toggle functions as in the 41C. The other 41C display instructions are not used since the display is memory mapped (RAM locations 0x009 and 0x00a). I'm not yet sure how the hardware blinking is enabled.

> Let us know when you put your "HP-11C Emulator" to run!

It now gets as far as saying "Pr Error", which is, of course,
what it's supposed to say when it's first powered up. :-)

Then when I press a key I get "0.0000". But it's not yet working beyond that.

Wonderful ! Congratulations! Hats Off!!