Son of ROM dumping



#11

Ken and I dumped more ROMs today.

Voyager:

  • HP-15C
  • HP-16C, which I broke after the dump was completed :-(

Spice:

  • HP-33C
  • HP-34C
  • HP-37E
  • HP-38C
  • HP-38E

We weren't able to dump several others.

Ken's HP-10C is of the early construction where the electronics module is wrapped in tape, and we didn't feel like peeling it.

His HP-12C is the single chip model (but still using three button cells rather than one coin cell in the newest ones). The signals might be accessible on pins, but I only spent a few minutes trying to find them and was unsuccessful.

Some of the Spice models were press-fit and others were soldered. The press-fit ones are hard to get logic analyzer clips onto. But in some of the press-fit ones, the plastic frame has little plastic fingers going between the leads of the chips, and I wasn't able to clip to those at all. Ken's 31E and 33E are of that style.

I was surprised to find that the clock frequencies of Ken's Spice calculators varied from 144 KHz to 180 KHz.

When I was removing the clips from the HP-16C, the phase 1 clock pin of the processor broke off completely. There is no longer any metal protruding from the package body. My friend Richard claims that it's still possible to solder to it, but Ken is trying conductive epoxy instead. I'll give him my HP-16C (an early one) if that doesn't work. If I wind up with the broken one, assuming that the epoxy doesn't prevent it, I'll try removing the CPU and replacing it with one from a different Voyager. I should probably be able to find an old HP-12C for a lot less than the cost of a HP-16C.


#12

Hi, Eric

Congratulations for your great work!

I have a HP-12C with 2 chips, and it is very "beaten", leaked display, loose keyboard. It was the remains of several other that I fixed. The logic is working good, and I offer it to you to dump the ROM and replace your 16C processor, if you want. I also have a 11C (very bad shape) but I'm fixing some corroded traces on the PCB to see if the logic works. We can "trade" them for their ROM, and I have also a 15C but this one is mint and I cannot trade :8)!

I can send them to you with no cost, and you send me the ROM dumping. It is OK to you? Can you send the other ROMs also?

Best regards,

Nelson


#13

I spent some time studying the listings, and have determined that the HP-34C, HP-38E, and HP-38C use bank-switched ROM. The third-generation calculators appear to still have only 4K of instruction address space, and the instruction set appears to be closer to the second-generation than I had previously believed. Possibly a proper superset, though I don't yet have enough information to confirm that.

The ROM sizes from the Spice and Voyagers I've dumped so far are:

  • HP-32E: 3.5K
  • HP-33C: 4K
  • HP-34C: 7K
  • HP-37E: 3K
  • HP-38E: 5K
  • HP-38C: 5K
  • HP-11C: 6K
  • HP-15C: 14K
  • HP-16C: 6K

The HP-38E and HP-38C have two banks of ROM in the 0x0400..0x07ff address block. The HP-34C has two banks of ROM in each of the 0x0400, 0x0800, and 0x0c00 address blocks.

It appears that instruction 1060 (octal) is used for bank switching, and affects the memory region from which it is fetched, though I don't yet understand how the desired bank is chosen.

There are also some two-word instructions in which the second work has no sync pulse and is used entirely as part of a branch address. However, I haven't figured out how the first word of these instructions are decoded.

The Voyagers will are much easier to simulate since the instruction set is well-known.


#14

Congrats, Eric, on your graceful method of HP calc ROM extraction!! Hoo-rah.

As I used to reverse microcontroller firmware for a living, and often had to jump thru hoops to extract "secure" internal microcontroller ROMs, I really appreciated your inspired "why not use the self-test ROM check" feature in these calcs to dump the ROM. Saved a whole lotta grief, and now we have ROM dumps in a wholesale fashion.

If a Spice somehow were to be rigged so as to allow execution of some test ML code (i.e, kinda a 'breakpoint dump'), figuring out the extra instructions may be a bit less hairy.

(And for all those who think this is a hobbyist exercise, I submit that it would be very useful for some folks to have an Windows HP calc utility that works EXACTLY like a REAL HP12C (*not* 12CPlatinum).)

Regards

Bill Wiese

San Jose, CA


[P.S. - Eric, I perused the rest of your website too. We'll have to go shooting sometime at Target Masters, Reed's or Los Altos. Hackers w/guns, always a great combo ;) ]


#15

Quote:
If a Spice somehow were to be rigged so as to allow execution of some test ML code (i.e, kinda a 'breakpoint dump'), figuring out the extra instructions may be a bit less hairy.

My thoughts exactly!

I've never figured out why HP tried the press-fit approach to assembling the Spice series. Originally I thought it was a form of cost reduction, but the more I've looked at it the less convinced I've become that it would have reduced manufacturing cost at all. Ken suggested that it might have been intended for better servicability rather than reduced manufacturing cost, but I don't think that makes sense either.
However, regardless of the reason, it does have the unintended benefit that it makes it a little easier for me to wire up my own ROMs to the calculator in place of the originals.

I can just pull the original ROMs, reassemble the calc, and clip on a set of probes to wire it to my hardware.

The probes have a tendency to want to fall off if the calculator is jiggled even slightly. I need to come up with a fixture to hold the top half of the calculator firmly in place (with the probes dangling out the bottom) so I can operate the keyboard and observe the display without knocking the probes loose.

If all else fails, I could solder wires in place, but I'd prefer to avoid that.

For those that are interested, although I can find NO published information on the third-generation internals, there are three published sources relating to the second generation (Woodstock, Topcat, 67, 10, and 19C):

  • November 1976 HP Journal: two articles describe the processor architecture improvements over the first generation in general terms:
  • U.S. Patent 4,177,520 contains what is, AFAIK, the only published source listing of any second generation microcode. It's a small chunk, but somewhat helpful.
  • "An HP-67 Anatomy Lessson", a series of PPC Journal articles by Tom Napier, in which he describes partially reverse engineering the instruction set of the HP-67 in order to build a plotter interface:
    • V5 N7 P7-8: Part IA, discusses hardware and bus structure
    • V5 N8 P14-17: Part IB, discusses instruction set
    • V5 N9 P6-7: Part II, more instruction set details
    • V5 N10 P25-27: Part III
    • V5 N10 P30: interfacing
#16

This is great work. Perhaps the various computer museums
around the world should keep a copy of gtk-CASMSIM running
for visitors to play with :-).

I now have an HP-35 with the bugs, so I'd like to contribute
that ROM when I get around to extracting it (hopefully
electrically, by cutting a few traces and applying a self-test-like stimulus). I've always been curious what coding errors could cause the obscure bugs found in the early firmware (google for "hp-35 errata"). Ideally
the HP-{35,45} firmware could be decompiled to some
C-like language to show the algorithms (and bugs)
clearly.

The ROMs in my buggy HP-35 are marked

1818 0006

1818 0017

1818 0020

from top to bottom. Is this known to be the earliest
set? (This is not a "red dot" model, though.)

Cheers,

Peter Monta


#17

About the firmware, forget about "C-Like", is pure assembler! How do imagine they fit all functions on a 768 words ROM?

Best regards, and good luck!

Nelson

#18

My HP-35s have 1818-0024, 1818-0026, and 1818-0027. In the article forum, Tony Duell lists -0024, -0026, and -0028, but I have not seen the -0028. Tony's unit also has an 1820-0849 CTC chip, while mine have the 1818-0012 or 1818-0078.

It also would be useful to find the early ROM set for the HP-45 (storage arithmetic is "backwards"), and the buggy ROM set for the HP-67.

Any other known alternate firmware sets for calculators
before the 41C?

Quote:
so I'd like to contribute that ROM when I get around to extracting it (hopefully electrically, by cutting a few traces and applying a self-test-like stimulus).

We should discuss this further by email. I've got some partially completed hardware to do this.

#19

The bugs were (supposedly) caused by a bad value in a coefficent lookup table.

#20

Ken did in fact manage to repair his HP-16C that I broke. I was skeptical of the conductive epoxy plan, but it worked.


Possibly Related Threads...
Thread Author Replies Views Last Post
  Trouble dumping Pioneer ROM via IR Neil Hamilton (Ottawa) 6 1,217 06-20-2013, 08:14 AM
Last Post: Neil Hamilton (Ottawa)
  HP85 Programmable ROM cardtridge 82929A-service ROM not working- inaki 2 906 04-25-2013, 08:08 AM
Last Post: inaki
  shelf life time of a ROM, EEPROM, EPROM vs Mask Rom Guido (Canada) 6 1,302 01-11-2013, 04:09 PM
Last Post: Thomas Falk
  Big ROM - 41 System DEMO ROM Ángel Martin 5 1,179 10-16-2012, 05:28 AM
Last Post: Ángel Martin
  HP-41 FOCAL to .ROM for Clonix/NoV's (or any other ROM-box) Diego Diaz 6 1,251 06-08-2010, 01:44 PM
Last Post: Meindert Kuipers
  What calc for my 7 years old son? Jose Gonzalez Divasson 22 2,192 10-27-2009, 01:33 AM
Last Post: designnut
  PPC ROM 2C / Melbourne ROM manual ZOleg 2 633 12-08-2008, 08:21 PM
Last Post: ZOleg
  HP-42S Rom Dumping using PalmOS. JOSÉ LAURO STRAPASSON 2 499 07-24-2005, 10:41 PM
Last Post: José Lauro Strapasson
  More ROM dumping photos Eric Smith 0 333 01-30-2004, 06:55 PM
Last Post: Eric Smith
  More ROM dumping Eric Smith 10 1,119 01-25-2004, 07:53 PM
Last Post: Michael F. Coyle

Forum Jump: