have info on new CPU in HP12C Platinum...



#4

The 6502 Lives!!

The SPLB20D2 CPU mentioned in the MSNBC article (there's a link in a forum entry a dozen or so lines below this) is in fact a Sunplus CPU - they call it an LCD controller for data bank.

See this chip & related ones at

http://w3.sunplus.com.tw/products/lcdcontroller/splb.htm

While these data sheets give the specifications for hardware, I/O and memory layout they don't indicate overall CPU architecture other than calling it an "8-bit RISC processor". There's another document around somewhere else that'll go into register layout, opcodes, etc.

From prior searches about Sunplus, I'm pretty sure this is a 6502-based CPU. (Their other low-end 8bit CPU is an 8051, but I think this just shows up as a core in other special function ASIC products like their camera/imaging/speech chips.) A brief look indicates it has 32KB ROM and ?? RAM (I believe this is purchaser-selectable, since RAM takes up a fair bit of die area and thus affects the cost.)

The memory map indicates some vectors in the $FFF0 region, which is consistent w/6502 architecture. (A standard 6502 has 2-byte vector entries for /RST, /IRQ and /NMI in the upper 6 bytes of its 64KB addr space. Peripherals may add some extra interrupt vectors to this design.)

I am not yet sure if this is a plain 6502 instruction set or a improved 65C02 instruction set - or some crazy mix of the two.

This looks to be a ROM'd chip - as opposed to flash or EPROM - and there may not be a way to dump/verify ROM data for reverse engineering.

There is a good chance that much of the HP12C-Plat ROM code is written in C not assembly - making reverse engineering harder. (It can be easier to figure what another engineer does, except when he gets real 'tricky', than to guess what a compiler does.)

In a perfect world, if this were in a PLCC package like orig 12C and there were spare lines for address & data we could just clamp on an EPROM on top, put the chip into emulation mode and have fun. Guess not.

When I know more I will let y'all know... maybe there's room for hacking...

Hope so, as I love the 6502. Been a long time since my Commodore 64 days!


Bill Wiese
San Jose, CA
bill[at]bwiese[dot]org


#5

Hi Bill,

Thanks for pointing out Sunplus. What follows is a combination of things I found on the Web site plus some guesswork on my part.

Yes, the CPU is a 6502 of some sort, but no hint as to whether it has any extra instructions. They call their 6502 core the "CPU14B." According to their FAQ for another product,

Quote:
The SPL61A/191A CPU is an 8-bit Full Instruction Set microprocessor. It includes 151 instructions with Y Index Register. The ICE environment must be upgraded to v.5.7 instead of ICE v5.1. Note that the ICE command, "CPU F6502", must be applied on ICE command line for Full Instruction Set.

The SPLB20D has 32K ROM, and three areas of RAM: 128 bytes CPU RAM ($80-$FF), 64 bytes display RAM ($00-$3F) and 2K data RAM ($1000-$17FF). I notice that none of the memory is mapped to the 6502 stack area ($01xx); the data sheet shows this area as "Reserved."

There is a Test pin. I suspect it generates an interrupt on one of the three reserved vectors in high memory ($FFF2-$FFF7). The bottom 2K of ROM is reserved by Sunplus for a test program.

The amount of RAM on the chip is probably not customer-selected as you state, but different members of the family have various amounts of ROM and RAM so the customer will pick the appropriate device after he knows how much memory he'll need.

It looks as if there's an emulation board with EPROM for testing. No other details are given.

I think we're out of luck as far as dumping ROM is concerned. The Sunplus test program might include that function but there's no way to know. There is one other possibility though. It might be possible to dissolve the glop covering the chip, photograph the ROM and get the bits from there. Peter Monta did this with the HP-35 ROMs so it's at least possible.

If anyone can find out anything else about this chip or the 12Cp, I'd like to hear about it.

- Michael


#6

Michael..Hi Bill,

> Yes, the CPU is a 6502 of some sort, but no hint as to
> whether it has any extra instructions. They call their
> 6502 core the "CPU14B."

If it has bit set/clr operations it's a 65C02. There's prob a few extra addressing modes for a few instructions in the 65C02 not in 6502. Don't think there's any new addressing modes though. If not it's a plain ol' 6502.

I wonder if they still have the original Rockwell JMP bug
(IIRC, JMP instruction crossing page boundary doesn't increment the PC's MSB. Thus orig 6502 assemblers had to check for this and pad with NOPs).

> SPL61A/191A CPU is an 8-bit Full Instruction Set
> microprocessor. It includes 151 instructions with
> Y Index Register.

The 151 sounds like 6502 - all valid operations with all valid addressing modes. The "..with Y index register" worries me but it just could be Chinese phrasing: a normal 6502 has both X and Y index registers.

> Note that the ICE command, "CPU F6502", must be
> applied on ICE command line for Full Instruction Set.

Now that I vaguely remember, these may be the guys offering a skinny 6502 that has only an X register and few addressing modes. So it sounds like this is a std 6502.

> There is a Test pin. I suspect it generates an interrupt
> on one of the three reserved vectors in high memory
> ($FFF2-$FFF7).

Hmmm. Maybe this is an old design without JTAG scan test.
Wonder if the test pin is just held Hi or Lo or if you can shift stuff in and read stuff back. JTAG scan tests can drive logic with test sequences. Sometimes on CPUs instructions can be shifted in - might be a way of peeking at ROM using an LDA $addr opcode/operand shifted in.

I once wrote a flash EPROM burning routine so a 'naked' (i.e., no bootcode) oddball CPU could burn its own flash by shifting in instructions over JTAG port. Since P/ROM was mapped out, you only had an address space depth of one, so you couldn't branch anywhere. Just loads & stores.

> bottom 2K of ROM is reserved by Sunplus for a
> test program.

Interesting. With JTAG that really shouldn't be necessary.
JTAG can excercise more of the die than any program code can.

> SPLB20D has 32K ROM, and three areas of RAM: 128 bytes
> CPU RAM ($80-$FF), 64 bytes display RAM ($00-$3F) and
> 2K data RAM ($1000-$17FF). I notice that none of the
> memory is mapped to the 6502 stack area ($01xx);
> the data sheet shows this area as "Reserved."....
> ... amt of RAM on the chip is probably not customer-
> selected as you state, but different members of the
> family have various amounts of ROM and RAM so the
> customer will pick the appropriate device after he
> knows how much memory he'll need.

OK so these are separate RAM sections. From the way I (quickly) looked at the diagram there might have been 3 flavors w/3 differing RAM amounts. Guess not, just different areas.

On pg 5 of 13 on the Sunplus LB20DV12.PDF document I see that "CPU working SRAM" is from $80-$FF so that must be the stack. They put the I/O registers and LCD buffer all below $100 so as to take advantage of 6502's more efficient zero-page addressing opcodes.

> It looks as if there's an emulation board with EPROM
> for testing. No other details are given.

That prob means they have a 'bond out' chip. Everything's mapped the same but there are extra pads for external addr/data bus. Perhaps this die could be bonded out...

> I think we're out of luck as far as dumping ROM is
> concerned. The Sunplus test program might include
> that function but there's no way to know.

Yes. If we found out more about the Test pin that might be useful.

> one other possibility though. It might be possible
> to dissolve the glop covering the chip, photograph
> the ROM and get the bits from there. Peter Monta
> did this with the HP-35 ROMs so it's at least possible.

Yes. However this is likely a much smaller geometry chip than the HP35. What was that, 10+ microns? This is prob something around a .75 or .90 micron process. So might be hard to photomicrograph well without blowing away the glass passivation layer. Even then detecting 1s from 0s may take a bit of effort. Bit/byte addressing may be scrambled/interleaved too so that's another puzzle to solve.

Bill Wiese
San Jose, CA
bill[at]bwiese[dot]org


Possibly Related Threads...
Thread Author Replies Views Last Post
  HP12c Present Value of $1.. Inaccurate??? Edward Dixon 12 611 11-12-2013, 11:32 AM
Last Post: Edward Dixon
  HP 12C Platinum Programming v. Gold Face Dean Lewis 10 539 11-03-2013, 07:30 PM
Last Post: Kimberly Thompson
  HP 50g info Jan 7 405 10-21-2013, 09:09 PM
Last Post: Mike Morrow
  Prime 'CONTENT' section not retaining info text Geoff Quickfall 2 243 10-17-2013, 05:24 PM
Last Post: Geoff Quickfall
  HP12C Platinum PC software activation fails Russell Clinton 0 173 07-02-2013, 02:32 PM
Last Post: Russell Clinton
  Prime Info DavidShenk 0 138 06-14-2013, 11:39 AM
Last Post: davidshenk
  HP 12c Platinum Emulator Activation Server Problem Danny Farley 5 273 04-09-2013, 09:13 PM
Last Post: Danny Farley
  HP-71B CPU frequency? Christoph Giesselink 18 627 03-02-2013, 09:35 AM
Last Post: Gerson W. Barbosa
  Good deal : HP 12c Platinum for half-price Mic 1 171 01-21-2013, 03:51 AM
Last Post: Vincent Guilbault
  HP12C Limited Edition 30 anniversary keyboard Revan Ng 0 140 01-11-2013, 12:49 AM
Last Post: Revan Ng

Forum Jump: