HP Forums

Full Version: HP-97 reverse engineering progress
You're currently viewing a stripped down version of our content. View the full version with proper formatting.

I've been studying logic analyzer traces of the HP-97 bus. I was surprised to find that there are a lot more hitherto unknown instructions than I expected. From the HP Journal article on the 91 (or was it the 92?) I knew that there were about six instructions for the printer, and an unknown number for the keyboard and card reader, but thus far I haven't captured any traces involving printing.

The PIK chip controls both the printer and the keyboard (with buffer), so I expected that there would be at least one new keyboard-related instruction. I've been able to identify the instruction that tests whether there are any keycodes available in the buffer.

Reading a keycode out of the buffer doesn't use a new instruction; actually it can't, because it's not possible for chips external to the ACT processor to add new instructions that transfer data into ACT internal registers. So instead, it is mapped as RAM, to address 0xFF. (The actual RAM inside the combined RAM/ROM chips appears to be mapped from 0x00 through 0x3F.) I've determined a portion of the hardware keycode encoding information, but not yet all of it.

Thus far I've seen 13 "new" instructions, of which one is the keyboard status test.

Probably some of the extra instructions are asking the card reader whether a card has been inserted, and asking the printer whether it is in the home position. Maybe this will become more apparent when I capture traces with the printer or card reader in active use. I will need to refurbish the card readers in my 97 (and 67) before doing any reverse-engineering of that.

The ROM bank switching on the 97 does NOT appear to use the same instruction as used in the Spice models. I know there is some form of ROM bank switching going on, because the ACT can only address 4K of ROM, but the 97 has 6K, and some other ACT-based calculators including the 67 and 19C have 5K. I'm hoping that it uses essentially the same scheme they used in the later Spice series and merely a different opcode, but I don't yet have enough trace data to find it.

Right now I'm limited to capturing about six seconds of execution at a time.

I think it will take a long time to build up a full understanding of the HP-97, but once that is done I should be able to simulate all of the Topcat models as well as the HP-19C.

Finished mapping all of the internal keycodes.

I think I've identified which instruction asks the CRC chip for the state of the PRGM/RUN switch. Should be fairly easy to find the instruction that ask the CRC about the NORM and ALL states of the printer switch (TRACE is encoded as the absence of either NORM or ALL).

Edited: 10 Apr 2005, 4:09 a.m.

It would be interesting to do gate-level simulations of these machines---for one thing, a gate model would be more debuggable than the real hardware and might help with this sort of instruction-inference. It would certainly be the authoritative source for instruction semantics if it could be understood.

A netlist of each chip would be needed, which would be challenging to construct (I've been wanting to try this, but there just hasn't been time). An FPGA with the actual ACT and ROM guts inside would be amusing. The synthesis tool would optimize the design, though, so if one didn't entirely trust the tool, for extra correctness one could do a really dumb translation directly to LUT primitives and accept a slow cycle time (probably this is overly paranoid).

Or I imagine a desktop machine with a reasonably clever cycle-based simulator might come close to real time.

Quote:
It would be interesting to do gate-level simulations of these machines

Definitely an interesting idea.

I'm told that there are services that will take a chip and return you a netlist or even an HDL model, but that they are very expensive.

There was a CAE tool named "LayBool" developed at a university that did part of this process; it would turn geometric layout information into logic equations. I'm not sure that it would be able to handle old dynamic PMOS stuff. But it was acquired by a CAE tool vendor. It may or may not still be available (perhaps under a different name now), but it was incredibly expensive at one time, and probably still is.

I'm going to try to glean as much as I can from logic analyzer captures, but if that isn't satisfactory, the next step will be to replace the ACT with my own hardware that can act as a stimulus to probe the behavior of the PIC and CRC chips.

If all else fails, maybe these chips are simple enough (compared to even 1980s chips) to decapsulate and photomicrograph, and generate a netlist by hand. I know a tiny amount about CMOS circuit design, and have an old book by AMI (one of the fab houses HP used for these chips) on PMOS design, so I suppose I could learn enough to do it.

And once I had the photomicrographs, mabye I could write tools to automatically recognize certain features and do some of the work.