More ROM dumping


Last night I dumped the ROMs from an HP-32E. I had figured
out the pinouts of the chips back in 1995, and looked at the
bus during self-test on an oscilliscope, but I hadn't done
anything about it until now.

I was surprised to discover that rather than having an instruction to read a single word of ROM (like CXISA on the Nut in the 41C and Voyagers), the third-generation hardware (Spice series) has an instruction that apparently makes the CPU checksum an entire 1K block of ROM. After the instruction is fetched, it immediately proceeds to do 1024 read cycles to consecutive ROM addresses, starting from the base of the 1K block the instruction was fetched from. They have short subroutines in every 1K block to do this. That's why the Spice self-test is so much faster than the Voyager self-test.

The HP-32E has 4 Kwords of ROM (0x000..0xfff), but only 3584 words are actually used (0x000..0xdff). The remainder just contain zeros. So much for the second half of Bill Wickes' claim "Life is short and ROM is full." :-)

AFAIK, the third generation instruction set has never been described in any published documents, and the second generation architecture is only described in very general terms in the HP Journal articles. It will be a fair bit of work to reverse-engineer these, so I'll work on getting the Voyager simulation running first.

The rest of my Spice and Voyager calculators are packed away in storage, but my friend Ken has agreed to help me dump the ROMs of all of his on Sunday afternoon. He's done a speedup mod to his 16C, so it might be too fast for my romsucker, but the rest should be OK.


It surprised me that a Spice could be considered a later generation (from an instruction set poont of view) than the 41C or Voyagers (Nut based). I may have been wrong for years, but I always supposed that the Spices were closer to the Woodstocks in terms of technology, just a little more evolved, and manufactured with a cheaper process. My apologies to all Spices fans out there...


Spice (3xE, 3xC) is third generation and the Nut-based calculators, Coconut (41C) and Voyager (1xC), are fourth generation.


Well, that was just my point, since you discovered more advanced features on the Spices, such features not being present in Voyagers.


I disagree. I don't consider anything I've discovered to date about the Spice series to be more advanced than the Voyager series.


Perhaps I misunderstood your mention to the block checksum operation on the Spices.

I agree Nut based machines are more advanced than Spices; that's why the fact that such feature was missing in the fourth generation puzzled me. It may be just a not-so-useful feature, swept away fo make room (logic gates? microcode space? opcode space?) for more useful things on the Nut.

Thank you and congratulations again.


Yes, the Spice has a single instruction that checksums an entire 1K block of ROM. But that is LESS sophisticated than the Nut CPU, because it provides no way for the software to read individual words of ROM, such as for table-lookup or to store user code in ROM (e.g., HP-41C application modules).

The ONLY benefit it has over the Nut is that the self-test is faster, but do people really run the self-test often enough to care?


"Ken has agreed to help me dump the ROMs of all of his on Sunday afternoon. He's done a speedup mod to his 16C"

How do you speed up the 16C?

Pictures & instructions, please!



He got the instructions from the Internet, of course. I haven't looked for it. I imagine it's done by reducing the value of the capacitor in the LC oscillator, as on most other HPs.

I'll ask him if he has a pointer to the info.


Eric Smith wrote:

He got the instructions from the Internet, of course. I haven't looked for it. I imagine it's done by reducing the value of the capacitor in the LC oscillator, as on most other HPs.

I'll ask him if he has a pointer to the info.

Ken Sumrall replies:

Actually, I figured it out myself. Years ago, when I was
in college, someone wrote in to PPC Journal and offered to
triple the speed of anyone's Voyager calculator if you sent
it and $25 to Hong Kong. I was not about to send my new
HP-16C (I won it when the Michigan State Programming team
came in first at the regional competition!) to Hong Kong,
but decided I should be able to figure it out myself. I
popped mine open, and saw the oscillator parts,
but mistakenly thought I saw a cap and a resistor. Thus, at
the time, my efforts to speed it up were in vain.

However, after college, I joined HP, and e-mailed an
engineer still in the calc division in Corvallis, and
learned it was an inductor, not a resistor (duh) on the board, and the rest was just some experimentation at HP's
lab stock room. Just add another inductor in parallel
with the original, and bingo, it goes faster.

Of course, this probably reduces the temperature operating
margins of the device, but I tend to do my hacking in an
air conditioned/heated office/house, so I didn't care.
Also, the device is probably less tolerant of low batteries,
but again, they last so long anyhow, I don't care if I have
to replace them as soon as the low batt indicator comes on.

I've sent all my notes on this speedup to Eric, and if he
doesn't post them here in a day or two, I'll post them


Hi Eric,

Congratulations on the ROM dumps! It looks like you're having lots of fun over there.

I've been looking into how to do the same thing for Woodstocks. I have a couple of approaches thought out based on a CPLD or FPGA. Unfortunately this is a busy time for me and I'm not sure when I'll be able to pursue this.

Still, it occurs to me that you will still need to interpret the ROM dump, figure out the instruction set, etc. Perhaps I (we?) can help, if youwant to put up one of the ROM dumps along with what you've learned so far. I don't want to horn in on your project or anything, but it might make a fun group project and could get some new calculator emulations into circulation faster. Just a thought.

I'm looking forward to hearing more about this soon!

- Michael

Possibly Related Threads...
Thread Author Replies Views Last Post
  Trouble dumping Pioneer ROM via IR Neil Hamilton (Ottawa) 6 1,752 06-20-2013, 08:14 AM
Last Post: Neil Hamilton (Ottawa)
  HP85 Programmable ROM cardtridge 82929A-service ROM not working- inaki 2 1,191 04-25-2013, 08:08 AM
Last Post: inaki
  shelf life time of a ROM, EEPROM, EPROM vs Mask Rom Guido (Canada) 6 1,842 01-11-2013, 04:09 PM
Last Post: Thomas Falk
  Big ROM - 41 System DEMO ROM Ángel Martin 5 1,545 10-16-2012, 05:28 AM
Last Post: Ángel Martin
  HP-41 FOCAL to .ROM for Clonix/NoV's (or any other ROM-box) Diego Diaz 6 1,660 06-08-2010, 01:44 PM
Last Post: Meindert Kuipers
  PPC ROM 2C / Melbourne ROM manual ZOleg 2 878 12-08-2008, 08:21 PM
Last Post: ZOleg
  HP-42S Rom Dumping using PalmOS. JOSÉ LAURO STRAPASSON 2 698 07-24-2005, 10:41 PM
Last Post: José Lauro Strapasson
  Son of ROM dumping Eric Smith 9 1,622 02-01-2004, 10:34 PM
Last Post: Eric Smith
  More ROM dumping photos Eric Smith 0 467 01-30-2004, 06:55 PM
Last Post: Eric Smith
  dumping ROMs Eric Smith 5 1,103 01-24-2004, 03:17 PM
Last Post: Andrés C. Rodríguez (Argentina)

Forum Jump: