Reading HP67 ROMs

[Marcovecchio]

I have 2 defective HP67. The history of both machines is too long to tell here, but one of them had leaked batteries, and the other was turned on with inverted power supply, so the situation is not good.

After studying the excellent HP67 Internals document from Tony Duell, I tested all I could in the hardware, but I can't be positive about ROMs condition.

Since they're small 8 pin chips, and there are only two pins dedicated to addressing and data (ISA and DATA), I have been wondering: how do they work? What is the protocol, timings and so on? Is it documented?

What I want to do is to build a simple Arduino interfacing setup that I could use to test the ROMs. I think all I need is to read all ROM bytes, check if they're correct, and write and read all RAM positions, to assure the chips are good (or not).

Is the protocol documented somewhere? Does anyone know how these chips work?

Many thanks!

[teenix]

I am putting something together for myself now. I was going to get some components tomorrow to get started.

The timing diagrams supplied in the 97 service manual give some idea, and I have some info in my Classic Notes pdf, although that info is not directly related to the type of ROMs in the 67. Once I play around a bit, I will publish what I find.

Using an oscilloscope, you can analyze the waveforms on the Is and Data busses to see what is going on.

You will also need a -12V and a 6.25V rail plus Phi1 and Phi2 and sync signals. The Arduino will need to cope with the 6V signals on the busses.

The only thing I'm not sure of is how the busses are driven. I "think" they are pulled Logic HI when asserted, and require a pull down resistor, but I am not sure. The other thing I'm not sure of is whether the ROMs react to the instructions on the Is bus as well as the address info. They need to monitor the sync bus because this has an effect on addressing also, depending on what instruction executes. However, just for reading the ROM, I don't think this will matter.

Eric Smith did his "ROM Sucker" project for private use but has no details. I did try to make contact recently but had no luck.

Aside from being time consuming, it is not too hard to monitor the ROM busses and determine where a fault may lie. I have detected faulty ROMs and ARC in the past.

cheers

Tony

[Marcovecchio]

Thanks for your reply, Tony!

I'll try to analyze the signals to see if I can understand them. My main problem here is that the calculators aren't working, but I'll try!

By the way, do know which pins are inputs and outputs? I mean the Isa and data pins, in particular. Or do they change roles during operation? Well, I guess I can try turning the calculator on with and without the ACT and other chips to watch and deduce pin behavior, but any additional info is greatly appreciated!

Many thanks,

Eduardo

[teenix]

The the ROM IC Is and Data pins are both bi-directional because they read and write data. Sync, Phi1 and Phi2 are inputs.

It may just be a faulty ROM in which case you will see invalid data on the Is bus when that ROM is accessed. I used my emulator code flow printout to follow the code execution and relate it to what I saw on the scope. As mentioned, it works but is time consuming.

I will try to get some pictures of the bus activity today if I get time.

cheers

Tony

(05-05-2022 10:53 PM)Marcovecchio Wrote:  Thanks for your reply, Tony!

I'll try to analyze the signals to see if I can understand them. My main problem here is that the calculators aren't working, but I'll try!

By the way, do know which pins are inputs and outputs? I mean the Isa and data pins, in particular. Or do they change roles during operation? Well, I guess I can try turning the calculator on with and without the ACT and other chips to watch and deduce pin behavior, but any additional info is greatly appreciated!

Many thanks,

Eduardo

[Marcovecchio]

Thanks for the help, Tony! Understanding how each ROM is selected and accessed will be a huge help.

I also have a simple Saleae 8 channel logic analyser that may help a lot on capturing bus activity and analyse it on the PC.

Thank you very much!

Eduardo

[teenix]

I am unsure of the ROM address decoding. I imagine they read the 12 bits on the Is bus and react accordingly. However, to access the full address space, which is $0000 to $17FF, there needs to be a 13th bit. It is feasible then that when a Bank Switch instruction is issued, one or more of the ROMs detect this instruction and becomes active for address above $0FFF. The ROMs will have to be mask programmed to respond or not respond to the instruction, the same as they will be mask programmed to occupy a specific 1K address space. This applies to ROM 0 too which also decodes the LED display for the anode driver.

The ROMs must also detect when an address is between $0000 and $03FF which disables the ROMs in the upper bank and allows the ROMs in the lower bank to respond. This is probably the reason why there is no mapped ROM space between $1000 and $13FF.

The HP-97 is the same except that with an extra ROM chip, the address range extends to $1BFF to cater for the printer.

New Classic Notes uploaded with some HP-67 bus info at the end.

cheers

Tony

[teenix]

Hi all,

I added some more info in the Classic Notes document showing more clocking detail between Phi1, Phi2, Sync, Is and Data busses.

cheers

Tony

[Marcovecchio]

Tony, I have no words to thank you for your kindness! Many, many thanks, for your effort and time, this is invaluable info for our community.

As soon as I have some free time, I will study the signals and try to understand them. Hopefully someday I'll be able to build some hardware to interface to these memory chips and test them.

Eduardo

[teenix]

My pleasure :-)

I have just finished my own ROM reader circuit which should also access the ROM's RAM data storage. It is based on a cheap PIC16F18346. It has a dual +6.25V and -12V supply. +5V is tapped from the +6.25V to power the PIC.

The PIC can control the -12V Phi1, Phi2 signal and the +6.25V SYNC signals. It also has logic level shifting to read or write the signals on the Data and Is lines. The component cost including a small mains center tapped transformer cost about $Aus25.00. PC comms is via USB using a cheap FTDI board and has re-flash capability.

I am going to try clocking the ROMs at a lower frequency so I can transfer data to/from the PC without the need for a high speed interface.

If it works, I'll publish the project on my web page.

cheers

Tony

(05-08-2022 01:30 AM)Marcovecchio Wrote:  Tony, I have no words to thank you for your kindness! Many, many thanks, for your effort and time, this is invaluable info for our community.

As soon as I have some free time, I will study the signals and try to understand them. Hopefully someday I'll be able to build some hardware to interface to these memory chips and test them.

Eduardo

[teenix]

(05-05-2022 03:59 AM)teenix Wrote:  The only thing I'm not sure of is how the busses are driven. I "think" they are pulled Logic HI when asserted, and require a pull down resistor, but I am not sure.

Hi all,

I did some experimenting and disconnected the Is bus from the ACT which is easily done by opening a link on the circuit board. The bus signals appear HI and LO in this mode.

When a resistance is connected to Vcc and the Is bus, all signals stay HI.

When a resistance is connected to GND and the Is bus, all signals go HI and LO again but the HI has a reduced amplitude.

This indicates that the bus is loosely held LO and the active IC pulls it HI when required.

I updated the Classic Notes again.

cheers

Tony

[Dreato]

Marco - I PM'ed you.

[Marcovecchio]

Thank you, Dave! I sent you a reply.

Tony, again, thanks for the pull up information! Now that you mentioned about disconnecting the ACT from the Is bus, it got me wondering: to make a simple ROM test, I could just put it on a breadboard, supply clock and power supply voltages, and then watch for activity on data and Is lines, right?

If I understand correctly, it's like each ROM acts as a simple microcontroller, capable of decoding simple commands and reacting accordingly, sometimes reading data, and other times asserting the bus to send data.

I don't know it that would work, but if that helps sorting dead and good ROMs, this is all I need. But I'm looking forward for you PIC project, that will be awesome!

Eduardo

[teenix]

Hi Eduardo,

I updated the Classic Notes with everything I know to date.

I have breadboarded a circuit and will attempt to connect it to the Is bus and see what happens.

If I get time I was going to make the project work in one of two modes.

1) Connect direct to the HP circuit board after isolating the Is bus to read the ROMs.

2) Separate power supply, clocking etc. and sockets for the ROMs including the 18 pin ROM0 chip to test them individually and be able to read/write RAM as well. This method should also work with Spice ROMs.

This might take awhile, as I am still in temporary accommodation while battling crazy property prices and dwindling stocks where I would like to be.

cheers

Tony

[teenix]

Hi all,

I got the PCB for the ROM reader today. It is not fully populated as I am verifying the board before soldering some ICs and I am still waiting on a couple of parts. The LED at lower right corner is flashing away so the PIC processor is running and has communication to the PC.

It is pretty simple but looks complicated due to the fact it can supply the voltages to read the ROMs directly or it can tap into the HP circuit board and use its inbuilt power supply. Most of the circuitry is for generating the phi1 and 2 signals plus the interface for the Is and Data busses. These can be bypassed with a switch (or plug links) when using the signals direct from the HP board and the PIC processor will then supply the system clock signal to the ACT.

There is a plug link to switch the Phi signals for +6V and -12V, or +6V and GND depending on the ROM being read, for example HP-67 or Spice. There are 2 sockets on the board for 8 pin ROMs and the 18 pin ROM 0 chip. There is also a connector for flying leads which can connect a ROM IC with different pin outs.

There is some software to write and some testing then should be done.

I also got the Spice boards today so will start dealing with that when I can.

cheers

Tony

[Marcovecchio]

This is great, Tony! There is a lot of effort and knowledge in there, many thanks for putting this together.

And also, thanks for ROM0 support, this is a very welcome addition! With this piece of hardware, it will be much easier to pinpoint defective chips on classic or spice calculators. And I think it may work with Woodstock ones with almost no modifications, right?

This ROM dumper might even evolve in the future into a ROM checker / identifier, all that is needed is a small table of CRC pre calculated vales for the known ROMs. Then the ROM would be read, have it's CRC calculated and compared to the table. If found, the ROM is both OK and identified with no margin for error! This feature might be completely implemented as software at PC side.

[teenix]

(06-10-2022 08:50 AM)Marcovecchio Wrote:  This is great, Tony! There is a lot of effort and knowledge in there, many thanks for putting this together.

And also, thanks for ROM0 support, this is a very welcome addition! With this piece of hardware, it will be much easier to pinpoint defective chips on classic or spice calculators. And I think it may work with Woodstock ones with almost no modifications, right?

This ROM dumper might even evolve in the future into a ROM checker / identifier, all that is needed is a small table of CRC pre calculated vales for the known ROMs. Then the ROM would be read, have it's CRC calculated and compared to the table. If found, the ROM is both OK and identified with no margin for error! This feature might be completely implemented as software at PC side.

As I already have the data for most ROMs, it can verify against the library data and also list the opcodes on screen as it reads them.

I am hoping to check all the RAM registers via the DATA line as well.

As well as the sockets, there is also a connector for flying leads which can connect direct to the chip pins with suitable connectors - even on a prototype board.

I just played around with a 67 CRC chip and fooled it into reading a card. The CRC did all the normal motor control etc when a dummy card was inserted, but the data actually came from a PIC processor and afterwards the program ran nicely too - interesting

cheers

Tony

[teenix]

Hi all,

Some progress, the board read its first ROM chip today :-)

It seems to ignore the first word out, which I think is a software issue but its a good start.

And yes the Bank Switch does indeed turn the ROM off.

Example readout...

Reading ROM - HP-97...

0400 2FC 6 -> p
0401 11A 0 -> c[w]
0402 258 load constant 9
0403 033 go to $0C
0404 31C if s12 # 1
0405 000 no operation
0406 03A 0 -> b[w]
0407 23C 1 -> p
0408 0D8 load constant 3


cheers

Tony

[Marcovecchio]

This is great progress! I'm sure this will help diagnose ROM condition very easily.

Also, fully understanding how each ROM chip interfaces externally, will help building replacements. I know there are the whole board replacements, but it's interesting to be able to replace each one individually.

Eduardo

[teenix]

(06-25-2022 10:57 PM)Marcovecchio Wrote:  This is great progress! I'm sure this will help diagnose ROM condition very easily.

Also, fully understanding how each ROM chip interfaces externally, will help building replacements. I know there are the whole board replacements, but it's interesting to be able to replace each one individually.

Eduardo

I have the ROMs mostly figured out. I just have to play with a few more and I should have the secrets I need. They operate slightly different across the models.

I have written the code to read and write the RAM inside the ROM chips but need to double check the code output because the IC could be damaged if not done correctly due to bus conflicts.

I have looked into individual ROM replacements and I don't think it is that hard once one understands how the internals work. Once I have it working good enough I will publish what I find.

cheers

Tony

[teenix]

Hi all,

After some code fiddling, I can now read and write to the RAM stored in the ROM chips. This now enables testing of the ROM as well as RAM and the abbreviated RAM test output is as follows...

Cmd: Check Data... >OK

RAM Memory Bank: 0

Pass 1 - Write $A5

Writing: 0
Writing: 1
etc
Writing: 14
Writing: 15

Reading: 0 OK
Reading: 1 OK
etc
Reading: 14 OK
Reading: 15 OK

Pass 2 - Write $5A

Writing: 0
Writing: 1
etc
Writing: 14
Writing: 15

Reading: 0 OK
Reading: 1 OK
etc
Reading: 14 OK
Reading: 15 OK

Completed - RAM Test Passed

I wanted the ROM Reader also to be able to hook directly onto the calculator CPU board and test all ROMs at once, but this could lead to bus conflicts so I will stick to individual ROM chips only.

cheers

Tony