HP82143 Processor details

[blackjetrock]

Does anyone know if there is information about the processor in the HP82143 printer?
I want to add printer output over USB to the Pico attached to an HP41C and I have the NPIC or interface IC so know what the instructions are to get data to and from that IC (the one in the module). What I don't have is any information about how that data maps to the printer. So, for instance, I see the ENPIC instruction in my bus trae and can get data but I have no idea what status is needed to be emulated to get printer data to go from the HP41C to the emulated NPIC or how those characters are formatted.

Andrew

[MeindertKuipers]

Hi Andrew,

There is quite a lot of information about the HP82143 printer, and I happened to have made a deep dive into this recently. Getting this printer emulated is actually one of the things I would like to implement on a platform like this.
Best is to send the characters to print straight into a USB emulated serial port (or a real UART) to a hasot computer running Christophs HP82240 emulator in HP82143 mode, so you do not have to worry about the printing itself.

My recommendation is to start with Doug Wilders great article 'HP82143A Printer Study' (available at TOS).

More than willing to help, easiest is probably direct communication with me for questions.

I have ordered a set of Pico's and I am installing the toolchain. Permitting other non calculator related activities I should be able to get a setup up and running in a few weeks

[blackjetrock]

(06-02-2023 10:10 AM)MeindertKuipers Wrote:  Hi Andrew,

There is quite a lot of information about the HP82143 printer, and I happened to have made a deep dive into this recently. Getting this printer emulated is actually one of the things I would like to implement on a platform like this.
Best is to send the characters to print straight into a USB emulated serial port (or a real UART) to a hasot computer running Christophs HP82240 emulator in HP82143 mode, so you do not have to worry about the printing itself.

My recommendation is to start with Doug Wilders great article 'HP82143A Printer Study' (available at TOS).

More than willing to help, easiest is probably direct communication with me for questions.

I have ordered a set of Pico's and I am installing the toolchain. Permitting other non calculator related activities I should be able to get a setup up and running in a few weeks

Thanks for that information. I have also found useful stuff in an emulator, so I think I'll be ok.
I think those printer emulators are Windows, and I don't have any Windows machines, so I'll have
to use USB text.

I started with Eclipse on the Pico toolchain but an update lost all my config files (about 20) so I moved to emacs and GDB for debug if needed. It's much faster to write,burn,debug.

Andrew

[brouhaha]

The processor in the printer is a mask-programmed MK3870 microcontroller (Fairchild F8 architecture) with 2KiB of ROM and 64 bytes of RAM.

I don't think you actually need to know anything about the 3870, which is good because AFAIK no one has dumped the internal masked ROM yet, and we don't have any internal HP doc such as an ERS for that firmware. The NPIC documentation that we do have gives almost everything you need to know to interface to it. At one point I had a logic analyzer hooked up to it to confirm some details, whcih I've since forgotten, but there wasn't anything unexpected.

EDITED 2023-09-20: I mistakenly originally wrote that the MK3870 had 1KiB of ROM. Also corrected a typo of 3470.

[cruff]

I recall Steve Leibson told me in reference to the 98037A that the 3870 has no way to read out the contents of the ROM without decapping the chip and extracting it from the mask.

[blackjetrock]

(06-02-2023 09:38 PM)brouhaha Wrote:  The processor in the printer is a mask-programmed MK3870 microcontroller (Fairchild F8 architecture) with 1KiB of ROM and 64 bytes of RAM.

I don't think you actually need to know anything about the 3470, which is good because AFAIK no one has dumped the internal masked ROM yet, and we don't have any internal HP doc such as an ERS for that firmware.

That is interesting information. If I can get hold of a broken printer I could have a go at de-capping the IC and getting a die shot. If the ROM data is visible then knowing the processor type would mean a ROM dump could be extracted. I just need to find an unfixable printer...

Quote:The NPIC documentation that we do have gives almost everything you need to know to interface to it. At one point I had a logic analyzer hooked up to it to confirm some details, which I've since forgotten, but there wasn't anything unexpected.

Yes, I have that document, I ws after the bit assignments in the registers so I
could drive the ROM code correctly. I think I have that from some emulator
source code I found.

Thanks for the information

Andrew

[blackjetrock]

(06-03-2023 01:31 AM)cruff Wrote:  I recall Steve Leibson told me in reference to the 98037A that the 3870 has no way to read out the contents of the ROM without decapping the chip and extracting it from the mask.

Yes, that is a very common situation. Sometimes there is an exploit that can be used to get ROM data, but a lot of the time a de-cap is the only way. I have done this a few times and have a metallurgical microscope to do the image capture. Sometimes the ROM contents aren't visible without layer removal, which I haven't attempted yet. Sometimes it is visible without further processing.

This is totally destructive so a dead IC and/or printer is the best donor device to use for this.

Andrew

[brouhaha]

(06-03-2023 01:31 AM)cruff Wrote:  I recall Steve Leibson told me in reference to the 98037A that the 3870 has no way to read out the contents of the ROM without decapping the chip and extracting it from the mask.

Steve Leibson is very knowledgeable about almost everything electronic, but this is a rare case in which he is mistaken. The MK3870 has a documented test mode that can be used to dump the ROM. It's tricky to do so, but possible.

[blackjetrock]

(06-03-2023 05:57 PM)brouhaha Wrote:  

(06-03-2023 01:31 AM)cruff Wrote:  I recall Steve Leibson told me in reference to the 98037A that the 3870 has no way to read out the contents of the ROM without decapping the chip and extracting it from the mask.

Steve Leibson is very knowledgeable about almost everything electronic, but this is a rare case in which he is mistaken. The MK3870 has a documented test mode that can be used to dump the ROM. It's tricky to do so, but possible.

Hmm, I have a working printer and have found a ROM dump procedure, so I think I'll have a go, maybe.

[Craig Bladow]

Someone on 6502.org has successfully dumped MK3870 ROMs.

http://forum.6502.org/viewtopic.php?t=3366

Although there appears to be a way to protect the ROM contents by blowing a fuse on the TEST pin.

[blackjetrock]

(06-03-2023 06:50 PM)Craig Bladow Wrote:  Someone on 6502.org has successfully dumped MK3870 ROMs.

http://forum.6502.org/viewtopic.php?t=3366

Although there appears to be a way to protect the ROM contents by blowing a fuse on the TEST pin.

Yes, if that is the case then a decap will be necessary, but it looks like the ROM contents are visible in that case.

[brouhaha]

(06-03-2023 06:50 PM)Craig Bladow Wrote:  Although there appears to be a way to protect the ROM contents by blowing a fuse on the TEST pin.

That's in the Fairchild F38E70 EPROM-based part, but not in any masked-ROM MK3870.

[blackjetrock]

it turns out that I have an HP82143 printer. It's suffered from quite a lot of battery leakage and I'm not sure it will work. So, an ideal candidate for ROM extraction.
I've removed the IC from the PCB and put a socket in.

The IC markings:
   

No mention of 3870, but if you look at the underside of the IC:
   

Next step is to build a ROM extraction widget and have a go at getting the code out...

[blackjetrock]

I've built am M3780 dumper PCB using a RP Pico and the circuit from Sean Riddle's webpage. I've ported the code and finally got it working. i bought a Boris chess machine as a control and dumped that IC first and got a dump that was similar to Sean's but not identical at all. As a first test I dumped the HP82143 processor ROm as well. It wasn't blank so I may have a dump. The data is attached in the interests of preservation. The end of the dump repeats the same data pattern, this may be a dumper problem or it may be that the data wraps after the end of the ROM, I'm not sure.

The dump is a straight text capture from the dumper tool.

Andrew

[brouhaha]

(09-19-2023 07:51 PM)blackjetrock Wrote:  The data is attached in the interests of preservation. The end of the dump repeats the same data pattern, this may be a dumper problem or it may be that the data wraps after the end of the ROM, I'm not sure.

Thanks for doing that, Andrew!

The fact that your text file contains two dumps, which have some similarities but in general are significantly different, is rather disconcerting.

A normal MK3870 (without a /nn suffix) has 2KiB of ROM (earlier in the thread I mistakenly said 1KiB), so I would expect addresses 800 and up to either be empty (probably 00 or ff), or repeats of the data at 00. It's remotely possible that this is actually a 4K ROM 3870, in which case the empty area or wraparound would occur after FFF.

The original MK3870 with no numeric suffix has only an 11-bit program counter. The numeric suffixes /10, /20, /30, and /40 have 1K, 2K, 3K, and 4K of ROM respectively, but all three of those have a 12-bit program counter, so the /10 is compatible wth the no suffix except under contrived circumstances. The /12, /22, /32, and /42 versions are the same except that the last 64 bits of the ROM address space contain RAM. (That means that the /42 doesn't really have 4K of ROM.)

You might try dumping the Boris 3870 a few more times, and see whether you get consistent data between multiple reads.

[blackjetrock]

Yes, I suspect something is not quite right with my dumper. I'll cary on with it and see if i can get consistent dumps. The voltages on the test pin might not be correct either, as Sean's voltages don't quite agree with the datasheet I have for the 3870.

I thought I'd upload what I have so far, though, just in case...

Andrew

[blackjetrock]

After a bit of investigation and coding I think I have a dumpo of the ROM.

Along the way I found that my port of Sean's code didn't work too well on my Pico. i examined the datasheets and found that firstly, the 3870 seems to be a dynamic device so you have to keep the clocks running for it to operate. At a minimum of about 1MHz. After that difficulty I wrote my own dumper which can insert arbitrary code into the device (as opposed to Sean's dumper that inserts a couple of instructions). I needed this as I didn't and still don't get consistent values from memory addresses. i suspect it's some timing issue. Instead of fixing it I read each location a few hundred times and only if they are the same do I use that value.
the instructions that are injected are in a table, so you can run whatever you like on the device.

After collecting the values that the code decides is the correct one for each memory location you get a dump of the ROM.
I have dumped the Boris again and get a very similar dump this time. I dump 4K each time and get a difference when off the end of Sean's dump. Not sure why.

I have also dumped the printer ROM.

Andrew

[brouhaha]

If the difference at the end is only in the bytes from addresses 0xfc0 through0xfff, it could be that your boric chip, his, or both, are actually MK3870/n2 chips, in which those addresses are extra RAM rather than ROM. The RAM is NOT mirrored at lower addresses on e.g. the MK3870/22.

[blackjetrock]

(09-25-2023 03:15 PM)brouhaha Wrote:  If the difference at the end is only in the bytes from addresses 0xfc0 through0xfff, it could be that your boric chip, his, or both, are actually MK3870/n2 chips, in which those addresses are extra RAM rather than ROM. The RAM is NOT mirrored at lower addresses on e.g. the MK3870/22.

That is an interesting idea. I have written some code and run it on both ICs and it looks like the top few bytes are ROM, as I can't change the value stored there. That's assuming that the code I wrote is correct, it's small and simple so I'd think it was OK. So I still don't know what those values are or why they are different to Sean's file.

Andrew

[brouhaha]

Another possibility is that in the parts with less than 4K of advertised ROM, they might have another small undocumented ROM at the high addresses for factory diagnostics. Motorola did that on some microcontrollers, though they documented its presence.