The Rogue HP-12c

[dm319]

   

I hope you don't mind the cross-post. But the Brazilian HP-12c finally arrived. For those following the previous discussions, here is a photo of the device. It looks very good to be honest - better than my HP-12c platinum.

I wanted to start a blog, so this is as good a time as any, and I may be foolish in believing this story may be of interest to those who don't have a specialist interest in calculators. Maybe I am naive! None-the-less here is my article:

Article here

I only got the device this week, so haven't had much chance to play around with it other than try out the battery of TVM tests that had picked it up in the first place.

[AnnoyedOne]

More photos!

Front
Back
Battery compartment

Firmware version?

From the article

Quote:The firmware is given as ChE–3198h and dated recently as 2023-03-19. The last known (and fully regular) firmware of the HP-12c was dated 2015-01-08.

So the same as

https://www.hpmuseum.org/forum/thread-21...#pid190755

Serial number?

Without actual (vs marketing) images showing details of the actual unit nothing further can be said.

A1

[HPing]

The blog post was a great read! dm319 will have a tough time topping that one.

Over time, the 12c's reliable, repeatable results became its leading feature IMHO. It was great for immediate calculations, price quotes, and as a sanity check for black box models.

The 12c's functionality, form factor, build quality, and nostalgia are great too, but became second-order features.

My buddy designed and maintained super computers (including a globally ranked system). We were discussing reliability and I asked him about the 12c. He told me that all electronics eventually glitch over the (very) long-term. That is a different issue than addressed in the blog.

[dm319]

(09-11-2024 12:58 PM)AnnoyedOne Wrote:  More photos!

Your wish...!

Front:



Back:



Battery:



Close up of the keys:



Overall, it looks like a very nice machine. The typeface is very clearly printed, and the keys have quite a nice feel. They have a good tactility, and a very muted click. The material feels some what soft, not hard and shiny, not rubbery, somewhere in between.

[dm319]

(09-11-2024 03:57 PM)HPing Wrote:  The blog post was a great read! dm319 will have a tough time topping that one.

Thank you! I apologise that a lot will be obvious to most readers here.

(09-11-2024 03:57 PM)HPing Wrote:  It was great for immediate calculations, price quotes, and as a sanity check for black box models.

It's beautifully designed, outside and in. I love the UI, the way you can chain calculations so easily. My HP-12c platinum was the cheapest I could find on ebay, and it functions very well, but the keys are not great. This newer machine really makes me want a 15c now.

[AnnoyedOne]

(09-11-2024 07:28 PM)dm319 Wrote:  Back:

Serial #: C1GP328

The same as the one here.

https://imgur.com/a/8r61ecW

Is that where you got it from?

(09-11-2024 07:28 PM)dm319 Wrote:  Battery:

So it has a 6-pin POGO connector so the current firmware may be readable (if not protected). And/or HP firmware dated 2015-01-08 could be loaded. Or HP-15C CE firmware

A1

PS: Have you checked for hidden Platinum/Prestige functionality? Is there a delay showing the firmware info?

[dm319]

(09-11-2024 07:40 PM)AnnoyedOne Wrote:  Is that where you got it from?

Yes, very much so!

(09-11-2024 07:40 PM)AnnoyedOne Wrote:  So it has a 6-pin POGO connector so the current firmware may be readable (if not protected). And/or HP firmware dated 2015-01-08 could be loaded. Or HP-15C CE firmware Smile

Yes would be curious to extract it.

As for re-flashing it ... I'm not sure what to say!

[brouhaha]

Given the firmware date, and the screw for the battery compartment, and if you can see gold contacts in the pogo connector holes, then it's highly likely that it uses the same electronics as the "normal" post-2015 12C. If so, you should be able to dump the firmware using the cable from The Calculator Store, and SAM-BA.

When you dump firmware from these, use a starting address of 0x4000 and size of 0x1c000 to dump just the calculator firmware, to get an image you can program into another calculator.

It's potentially of interest to also dump to a separate image starting addrexx 0x0000 and size 0x4000, which is the bootloader, for comparison to the bootloader of other recent flashable Voyager models.

Based on the descriptions of behavior of this model, it seems like someone at HP or Moravia may have written new 12C firmware that doesn't simulate the Nut processor.

[dm319]

(09-12-2024 12:13 AM)brouhaha Wrote:  that doesn't simulate the Nut processor.

That's intriguing - dropping the emulation could have been a motivation here. Do we know what the HP-12c platinum runs on? The Platinum TVM behaviour would suggest 12c code running on Saturn hardware.

[Steve Simpkin]

(09-12-2024 09:26 AM)dm319 Wrote:  

(09-12-2024 12:13 AM)brouhaha Wrote:  that doesn't simulate the Nut processor.

That's intriguing - dropping the emulation could have been a motivation here. Do we know what the HP-12c platinum runs on? The Platinum TVM behaviour would suggest 12c code running on Saturn hardware.

I believe the HP-12C platinum models use the Sunplus SPLB20D2 (earlier) or Generalplus GPLB31A 6502-based CPU with original code running natively on that processor (no emulation).
https://en.wikipedia.org/wiki/HP-12C#HP_.../_Prestige
http://www.brouhaha.com/~eric/hpcalc/voy...iants.html

[AnnoyedOne]

(09-12-2024 09:26 AM)dm319 Wrote:  That's intriguing - dropping the emulation could have been a motivation here.

I'll try and explain this as simply as I can. It may be longish. Again I did this stuff, professionally, for decades.

As Steve Simpkin stated the HP-12C Platinum/Prestige use the Sunplus SPLB20D2 (v1 firmware) or Generalplus GPLB31A (v2 firmware). Both SoC's use a 8-bit 6502 core CPU. Why? Inexpensive. That's why chip-makers frequently have 8-bit (e.g. 8051) cores in their products. Less silicon area means lower cost. Up the clock, add more ROM/RAM so you can write in 'C' (as inefficient as that can be) and your product can be reasonably fast. ARM-based SoC's (32-bit CPU's) are challenging that market in both cost and speed.

To my knowledge the HP-12C Platinum firmware was completely rewritten and is not a NUT emulation like the HP-12C+ or DM12L. I think the code was mostly written in 'C' (likely with some assembler). Again a complete rewrite that acts similarly to the HP-12C (but not identically).

I have read (and understood) the Generalplus GPLB31A datasheet. That device has 256KB of masked-ROM and 3KB+ of RAM. My understanding is that the Sunplus chip is almost identical possibly because of company renaming (Sunplus to Generalplus), a take-over, or whatever. Both having masked-ROM have fixed and unchangeable (by anyone) firmware. Who created it? HP? Some contractor? Who knows.

By contrast 2015+ HP-12'S use a Atmel ATSAM2LC2CA SoC (32-bit CPU) emulating the original HP-12C NUT firmware. The HP-15C CE does the same as does the HP-15C LE. SwissMicros calculators also use a ARM-based SoC. In their case NXP (formerly Philips) LP11xx Cortex M0 products. The Atmel part has a M4 Cortex core and is a little faster. The latest known HP-12C+ firmware for this part is CHE--d1d1h, 2015-01-30.

Notice that the ATSAM2LC2CA firmware checksum values are 16-bits long but the two bytes are the same value (e.g. 0A 0A, D1 D1, etc). In addition I've looked at multiple firmware image files and the same (single byte) value is stored at the end of them. I did the exact same thing over decades of writing firmware (8-bit LRC, 8/16-bit addition, 16/32 bit CRC methods). Or the start depending on the CPU. I had PC programs that calculated the checksum and wrote it to the image I made. My firmware would calculate the checksum at reset and compare it to the stored value. The same and all is good.

My theory is that when displayed by ATSAM2LC2CA based calculators one byte is calculated while the other is read just as I used to do. In legitmate firmware the two should match.

By contrast the HP-12C Platinum/Prestige calculators appear to calculate a 16 bit checksum. The two bytes do not match With masked-ROM firmware the chances of error/alteration are very low so why bother checking? Maybe ROM is verified. Maybe not. Being slower the Platinum/Prestige can take a brief time to do this. Atmel ATSAM2LC2CA based hardware, being much faster, is almost instantaneous.

The unknown firmware in dm319's HP-12C has a 16-bit checksum just like the Platinum/Prestige models. My theory is that although the hardware is ATSAM2LC2CA based (modified) GPLB31A code was recompiled to produce the firmware. Perhaps bugs were introduced by this process. By whom? I've no idea and we'll probably never know.

This is why I asked (and got no answer) if the HP-12C in question had any hidden Platinum/Prestige functionality. If so that would tend the confirm my theory (left over and unremoved code--but no Platinum keyboard markings or LCD annunciators).

One easy test is 2, ENTER, g+X [x^2]. On a Platinum/Prestige you'd get 4 (2 squared). On a HP-12C nothing would happen (no g+X [x^2] function).

The point of all this is that one must be a detective and have some idea what to check for. Physical features (from photo's, inspection) can provide clues but won't tell you everything.

A1

[cheesy]

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  One easy test is 2, ENTER, g+X [x^2]. On a Platinum/Prestige you'd get 4 (2 squared). On a HP-12C nothing would happen (no g+X [x^2] function).

2, ENTER, g+* will return 4 on both the 12C and 12CP as there will be a 2 in both the X and Y registers.

Use either
2, g + *
or
2, ENTER, Rolldown, g+*

[AnnoyedOne]

(09-12-2024 03:00 PM)cheesy Wrote:  2, ENTER, g+* will return 4 on both the 12C and 12CP...

You're right. Thanks for the correction. I was doing other stuff and didn't try it.

A1

[dm319]

(09-12-2024 12:13 AM)brouhaha Wrote:  If so, you should be able to dump the firmware using the cable from The Calculator Store, and SAM-BA.

Very tempted to do this!

(09-12-2024 12:05 PM)Steve Simpkin Wrote:  I believe the HP-12C platinum models use the Sunplus SPLB20D2 (earlier) or Generalplus GPLB31A 6502-based CPU with original code running natively on that processor (no emulation).
https://en.wikipedia.org/wiki/HP-12C#HP_.../_Prestige
http://www.brouhaha.com/~eric/hpcalc/voy...iants.html

Yes, not quite what I meant! I think I phrased it badly - don't really mean emulation - I think Saturn simulation is probably a better word. I'm going to quote you to you now:

(07-05-2024 06:56 PM)Steve Simpkin Wrote:  I recall Cyrille De Brébisson mentioning that they had recreated the Saturn math library in C for use in their more modern calculators that did not use Saturn emulation like the HP 39gII and the HP Prime. I believe that Home mode on the HP Prime utilizes this library which is why it has the same forensic results as Saturn-based models.

Edit: Here is a reference from Cyrille mentioning the recreating of the math library.
https://www.hpmuseum.org/forum/thread-14...#pid124770

On the forensic results, the Hp17B/17BII+, 20b, 30b, 50g, 17BII etc etc return pretty much identical results. The HP-12cp often does too, but there are some interesting exceptions - like returning only the integer for solve-for-N, like the 12c.

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  I'll try and explain this as simply as I can. It may be longish. Again I did this stuff, professionally, for decades.

As you know, I have zero career knowledge of these things - so do go slowly.

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  To my knowledge the HP-12C Platinum firmware was completely rewritten and is not a NUT emulation like the HP-12C+ or DM12L. I think the code was mostly written in 'C' (likely with some assembler). Again a complete rewrite that acts similarly to the HP-12C (but not identically).

No, I didn't think it was NUT emulation and I don't think I was saying that. Please see reply above re: the Saturn maths library, which I guess 'simulates'(?) the behaviour on the original Saturn hardware.

So I've hinted at this before, but I'm going to outright say it. The idea that the HP-12c platinum was some kind of blind re-write using not much more than some technical specs and the user manual for the 12c can't be right.

The forensic tests return the exact same results as the other Saturn financials, to the same degree of digit accuracy, except for a couple of exceptions. One exception is the result for puzzle 7, where it is remarkably similar to the regular 12c, and performs better than any Saturn machine. The other is the integer return on the solve-for-N, again something that only the 12c does.

I don't know what went on, but I simply don't believe the idea that Kinpo acquired a decade of HP TVM refinements and knowledge, to code their own TVM solver that essentially knocks it out the park, but also suspiciously behaved very much like a cross between the 12c and the Saturn machines.

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  The unknown firmware in dm319's HP-12C has a 16-bit checksum just like the Platinum/Prestige models. My theory is that although the hardware is ATSAM2LC2CA based (modified) GPLB31A code was recompiled to produce the firmware. Perhaps bugs were introduced by this process. By whom? I've no idea and we'll probably never know.

Ok this is very interesting. This suggests the code in this 12c is running natively then, and not running on a NUT emulator?

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  Perhaps bugs were introduced by this process.

I feel like I'm repeating myself but this isn't a bug. You don't accidentality introduce an entirely re-implemented solver. Oh whoops, I coded a whole new solve-for-i algorithm just before I hit re-compile! All I meant to do was remove the algebraic mode, but look what I've gone and done!

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  This is why I asked (and got no answer) if the HP-12C in question had any hidden Platinum/Prestige functionality. If so that would tend the confirm my theory (left over and unremoved code--but no Platinum keyboard markings or LCD annunciators).

Happy to try these out for you, but was unsure what you meant.

The rogue HP-12c does not enable stack lift after inputting values into the TVM, I believe this is standard 12c behaviour (though I don't have a regular 12c, just this weird one), but it is not standard platinum behaviour, which enables stack lift after inputting data.

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  One easy test is 2, ENTER, g+X [x^2]. On a Platinum/Prestige you'd get 4 (2 squared). On a HP-12C nothing would happen (no g+X [x^2] function).

If I do 2 g+X on the platinum I get 4, on the rogue 12c I get 2 x whatever was in x before.

(09-12-2024 01:50 PM)AnnoyedOne Wrote:  The point of all this is that one must be a detective and have some idea what to check for. Physical features (from photo's, inspection) can provide clues but won't tell you everything.

Everything's a clue really... if you have suggestions, I am all ears.

Do you know how to check the firmware of the HP-12c platinum? I tried doing the same on the 12cp as the 12c, but it went very strange - each key press kept filling in another segment of the display and I couldn't fix it without resetting.

[dm319]

BREAKING NEWS!

The Rogue HP-12c has 16 digit precision!

Now I wish I'd checked this before writing the article. It actually achieves higher precision than not only the 12c but also the 12c platinum. (Tests 1, 1b and 2).

Doesn't make a difference to the many failed solves though.

[AnnoyedOne]

(09-12-2024 10:06 PM)dm319 Wrote:  This suggests the code in this 12c is running natively then, and not running on a NUT emulator?

That is my theory based on the 12CP-like checksum in your Brazillian 12C. I've no proof of that though. Having the firmware image would prove/disprove it with the presence/absence of NUT firmware.

(09-12-2024 10:06 PM)dm319 Wrote:  I feel like I'm repeating myself but this isn't a bug.

I was referring to the "comma" issue not any TVM results. Those are of little interest to me. To you yes. And others maybe. The same with effective digits of precision.

I think the WP34S calculator project has some 34 digits of precision. Fine if you're an astro-physicist wanting to calculate the circumference of the universe to the nearest millimeter. For me (and most engineers in general) 4-6 digits is plenty. For boundary TVM (and some other) calculations the more the better.

(09-12-2024 10:06 PM)dm319 Wrote:  If I do 2 g+X on the platinum I get 4, on the rogue 12c I get 2 x whatever was in x before.

That suggests that the 12CP x^2 functionalty was removed or was never present in your 12C. It doesn't disprove my 12CP firmware adaption theory but it doesn't support it either.

Perhaps HP back-ported code from newer (Saturn) models to the 12C and it "got out into the wild" before testing was complete. Maybe they have the same checksum code. Or Brazillians were unwitting "beta testers".

(09-12-2024 10:06 PM)dm319 Wrote:  Do you know how to check the firmware of the HP-12c platinum?

The same way as for HP-12C+'s, the 15C LE and 15C CE.

From off, hold g and ENTER, then press ON. The display shows 1.L 2.C 3.h or 1.L 2.C 3.h 4.CPu in later 12CP's. Pressing 2 (2.C) should show the firmware information. I believe that 12CP'S have a brief delay (while calculating the checksum?) before showing

Code:


ChE--564Ah
Ver 02
C 2004 hP

[One line at a time--press any key for the next line.]

A1

[AnnoyedOne]

(09-12-2024 10:06 PM)dm319 Wrote:  

(09-12-2024 12:13 AM)brouhaha Wrote:  If so, you should be able to dump the firmware using the cable from The Calculator Store, and SAM-BA.

Very tempted to do this!

You probably already know this but you're the only one in these forums (to my knowledge) that has a "Rogue 12C". It is your, and yours alone, decision whether to buy a HP-15C CE programming cable, download SAM-BA 2.16, and extract the current firmware yourself. That'll cost you money. Or you can find, someone local, who has the knowledge/equipment to do it for you. That may cost as well (e.g. postage etc). The former gives you more options IMHO.

That said I suspect that some here are willing to spend some time to do some examination/testing of the firmware if you do this. Just keep the image private and share by request (e.g. email) only. It is not yours to make public. You don't want to receive any letters from any HP/Moravia lawyers

A1

[dm319]

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  That is my theory based on the 12CP-like checksum in your Brazillian 12C. I've no proof of that though. Having the firmware image would prove/disprove it with the presence/absence of NUT firmware.

I'm sure you are right - after seeing results with 16
digits, there is no way NUT emulation is going to return
that.

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  I was referring to the "comma" issue not any TVM results. Those are of little interest to me. To you yes. And others maybe. The same with effective digits of precision.

Ok fair enough. The bug is the least interesting bit for
me, though it was the initial thing that caught my attention
about the calculator.

I don't know why you don't find the TVM results interesting.
If this was just the bug it would be a mild curiosity. The
TVM results are what tells us that the firmware is entirely
re-written.

PS confirmed bug is present on this device

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  I think the WP34S calculator project has some 34 digits of precision. Fine if you're an astro-physicist wanting to calculate the circumference of the universe to the nearest millimeter. For me (and most engineers in general) 4-6 digits is plenty. For boundary TVM (and some other) calculations the more the better.

That's really not my interest in the digit precision - this
tells me this isn't NUT and it isn't Saturn either. This is
completely re-written.

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  That suggests that the 12CP x^2 functionalty was removed or was never present in your 12C. It doesn't disprove my 12CP firmware adaption theory but it doesn't support it either.

I don't think this is anything to do with the HP-12cp
firmware - not only does the TVM not behave like it, but
returning 16 digits would not fit with that either.

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  Perhaps HP back-ported code from newer (Saturn) models to the 12C and it "got out into the wild" before testing was complete. Maybe they have the same checksum code. Or Brazillians were unwitting "beta testers".

I do like the idea of this, but they would probably have
used the Saturn C libraries. I wonder if they were planning
a new native calculating platform that had 16 digit
precision? It probably would have worked out fine if it
wasn't for the TVM solver.

(09-13-2024 12:16 PM)AnnoyedOne Wrote:  From off, hold g and ENTER, then press ON. The display shows 1.L 2.C 3.h or 1.L 2.C 3.h 4.CPu in later 12CP's. Pressing 2 (2.C) should show the firmware information. I believe that 12CP'S have a brief delay (while calculating the checksum?) before showing

Thanks, got this:

Code:


1.L2.C3.H4.Cpu
ChE--564Ah
Ver 02
C 2004 hP

(09-13-2024 03:01 PM)AnnoyedOne Wrote:  You probably already know this but you're the only one in these forums (to my knowledge) that has a "Rogue 12C".

I feel very special. There has already been a fair
significant cost, so maybe with my next pay check... Of
course if anyone in the UK fancies lending it to me, and I
can send it back. My main worry is damaging the device.

(09-13-2024 03:01 PM)AnnoyedOne Wrote:  That said I suspect that some here are willing to spend some time to do some examination/testing of the firmware if you do this. Just keep the image private and share by request (e.g. email) only. It is not yours to make public. You don't want to receive any letters from any HP/Moravia lawyers

Yes, have been avoiding using my yacht this week anyway...

Can I canvas some help - I'm suspicious this probably isn't
BCD - can anyone help me prove it? I believe some modern
Casios are binary underneath, but with enough hidden digits
this is very difficult to prove.

[AnnoyedOne]

(09-13-2024 06:00 PM)dm319 Wrote:  PS confirmed bug is present on this device

Comma bug confirmed? Or user error?

(09-13-2024 06:00 PM)dm319 Wrote:  ... have been avoiding using my yacht this week anyway...

LOL!

Per my ancestry I'm a "cheap bastard". Nor do I live near any ocean (but have). No yacht(s).

A1

[dm319]

(09-13-2024 06:13 PM)AnnoyedOne Wrote:  Comma bug confirmed? Or user error?

Sadly neither of us may ever know!

(09-13-2024 06:13 PM)AnnoyedOne Wrote:  LOL!

Being a cheap bastard is better than having a really bad sense of humour.

D