HP-41CV "HFF" ROM set
#1

For the first half of the product life of the HP-41CV, and the tail end of the product life of the HP-41C, the mainframe ROMs used were the "GFF" ROMs, which fixed most of the serious known bugs of earlier ROMs. Some of those bug fixes upset early synthetic programming fans, such as fixing "bug 2" which allowed program memory and status registers to be accessed by addresses that wrapped around, and "bug 3" which allowed altering system flags. Of course, other methods were developed for doing those things without reliance on bug 2 and bug 3.

Around late 1983, the HP-41CV changed to using the "HFF" ROM set. As far as I know, there is no published explanation of the difference between ROM 0 revisions G and H. Aside from the version number and checksum, there are two actual changes, at address range 01c9..01f3, and the single word at 081a. I haven't figured out the latter, but I've discovered what the 01c9 change does.

The HP-41 mainframe ROMs have code to support expansion ROMs using "buffers" of registers allocated in main RAM, just after the key assignments. The first register of a buffer contains two copies of the buffer number, used by an expansion ROM to identify the buffer it owns, and a buffer length which is used to locate the next buffer, or the end of the buffers.

There was a longstanding bug in the mainframe ROMs which would cause a hard lockup if the length of a buffer was mismarked as zero. The code to scan the buffers would sit in a tight loop looking at the same zero-length buffer forever. This situation could easily be caused by buggy synthetic programs. The ON-backspace trick wouldn't recover from this, because the buffer check happened before the ON-backspace check. Recovery generally requires removing the batteries until the RAM contents are lost.

The code change at 01c9 in the 0H ROM, and also the 0N ROM of the 41CX, fixes this bug! They reversed the order of the tests, so that the ON-backspace test is done before the buffer scan, so that it can avoid the zero-length buffer lockup.

It has been reported that the 41CV with HFF ROMs may have the "buzz mode" of the 41CX (PPCJ v10n9p24), but I don't have a 41CV with HFF ROMs so I can't confirm that.


Edited: 24 July 2011, 5:13 a.m.

#2

Hmm, 081a changed to NOP (deleted, bug) in H ROM, what did it do before?


Quote:
Around late 1983, the HP-41CV changed to using the "HFF" ROM set. As far as I know, there is no published explanation of the difference between ROM 0 revisions G and H. Aside from the version number and checksum, there are two actual changes, at address range 01c9..01f3, and the single word at 081a. I haven't figured out the latter, but I've discovered what the 01c9 change does.


#3

I've been looking at the code, but I haven't puzzled it out yet.

#4

I checked and understand. It is a bug. It used to increment the number of instructions in an XROM before checking if a given instruction number was in range.

If you have an instruction XROM i,j and look it up for execution, it will scan the ports for a module with ID i plugged in. Now if j is just one instruction beyond was is actually in the FAT, it will incorrectly think it found the instruction, take the FAT 0,0 trailer and build an execution address from it.

What it should do is keep looking for another module with the same ID i, but with more FAT entries. This is what happens in H ROM.

To take an example, if you look for XROM 10,30, it means you are looking for a module with at least 31 instructions (it starts with 0). So it starts scanning for XROM 10. When found it will load the number of instructions in the FAT. Say it is 30, meaning it has instructions 0-29. In H ROM it loads the instruction count and compare 30<30, so it is false and it will keep looking for another XROM 10 with more instructions.
In G ROM it increments the count and compare 30<31, which is true and it will build an instruction address using the FAT trailer words. It should end up executing from the first address in the ROM page.


Quote:
I've been looking at the code, but I haven't puzzled it out yet.

#5

Cool! Thanks for the details! I think that bug was described in the PPCJ or Wlodek's book, but I had no idea that they had bothered to fix it.



Possibly Related Threads...
Thread Author Replies Views Last Post
  HP 41CV Repairs William Mabotja 3 589 11-20-2013, 04:45 PM
Last Post: Mike Powell
  "Packing" syndrome of my HP-41CV PGILLET 12 1,299 11-03-2013, 02:46 PM
Last Post: Hans Holzach
  How to set the Date.Time etc on a WP34S Harold A Climer 4 729 10-29-2013, 09:32 PM
Last Post: FORTIN Pascal
  Prime Program number of set bits kris223 3 643 10-23-2013, 03:05 PM
Last Post: David Hayden
  HP85 Programmable ROM cardtridge 82929A-service ROM not working- inaki 2 608 04-25-2013, 08:08 AM
Last Post: inaki
  HP-41CV - A Walk Down Memory Lane Tom Lewis 9 1,004 03-18-2013, 11:14 PM
Last Post: BShoring
  Able to set HP 48G axis tick marks at integers? Randal B 1 388 01-24-2013, 12:40 AM
Last Post: Chris Dreher
  shelf life time of a ROM, EEPROM, EPROM vs Mask Rom Guido (Canada) 6 885 01-11-2013, 04:09 PM
Last Post: Thomas Falk
  Big ROM - 41 System DEMO ROM Ángel Martin 5 824 10-16-2012, 05:28 AM
Last Post: Ángel Martin
  HP-41CV power problem Don Davis 2 480 10-11-2012, 09:13 PM
Last Post: Don Davis

Forum Jump: