Previous Thread
Next Thread
Print Thread
Page 11 of 366 1 2 9 10 11 12 13 365 366
Joined: Mar 2006
Posts: 1,050
L
Very Senior Member
Offline
Very Senior Member
L
Joined: Mar 2006
Posts: 1,050
Originally Posted By seanriddle

Also, I opened the Maniac case, and instead of a TMS-1x00, there's a GI PIC1655A! I haven't decapped one of those before. The current PICs make ROM extraction difficult, but this one is so old I bet it can be visually dumped.


PIC1655's can be dumped electrically using a debug mode, kevtris knows details.
PIC16C55 on the other hand is a whole different can of worms.

LN


"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
Joined: Mar 2006
Posts: 1,050
L
Very Senior Member
Offline
Very Senior Member
L
Joined: Mar 2006
Posts: 1,050
Originally Posted By seanriddle
I put up a composite of the TMC0271NL pics that I've taken so far: http://www.seanriddle.com/speakandspell.html There's a 6000 pixel GIMP image at http://www.seanriddle.com/tmc0271nl.xcf
I'll re-shoot the output PLA above RAM and the instruction decoder PLA at top right with a higher magnification objective and post those. Any other areas?
I dumped the '351 and '352 from the other S&S and the contents are identical to the other unit's chips.


Can you do a high-res image of the remaining portion of the tmc0271 rom? about 80% of it is still readable, and could be useful to compare against the patent firmware (which i suspect matches the 'bug fixed' 1979 one, hence we need this older rom on the chip).

Also, can you image the 4 rom areas of the tmc0281? It is an older '0280 A / 281' chip, while the tms5100 on siliconpr0n is '0280 B / 281 A' which is newer.
https://dl.dropboxusercontent.com/u/7909...die%20small.png shows the rom areas on a tms5200, but the 5100/0281 has the rom areas in question in (nearly) the same places on the die. (ignore the copyright area, its in the upper right on the 5100/0281 and i can see it in your low res image just fine)

LN

Last edited by Lord Nightmare; 12/21/14 04:16 AM. Reason: we still do need the rom area of the damaged 0271 imaged

"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
Joined: May 2010
Posts: 1,049
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,049
Originally Posted By Lord Nightmare
PIC1655's can be dumped electrically using a debug mode, kevtris knows details.

Thanks. It is a PIC1655A, and I sent Kevin a note. I noticed the TEST pin on the datasheet, so I searched for any info, but didn't find anything.

Joined: May 2010
Posts: 1,049
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,049
Originally Posted By Lord Nightmare
Can you do a high-res image of the remaining portion of the tmc0271 rom? about 80% of it is still readable, and could be useful to compare against the patent firmware (which i suspect matches the 'bug fixed' 1979 one, hence we need this older rom on the chip).

Also, can you image the 4 rom areas of the tmc0281? It is an older '0280 A / 281' chip, while the tms5100 on siliconpr0n is '0280 B / 281 A' which is newer.
https://dl.dropboxusercontent.com/u/7909...die%20small.png shows the rom areas on a tms5200, but the 5100/0281 has the rom areas in question in (nearly) the same places on the die. (ignore the copyright area, its in the upper right on the 5100/0281 and i can see it in your low res image just fine)

LN

Will do.

Joined: May 2010
Posts: 1,049
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,049
Originally Posted By seanriddle
The patent Claus references, 4125901, shows 13-bit ROM, but it sure looks like 16-bit to me.

My bad- there are 13 groups of 16 rows, which should correspond to the 16 banks of 13 bits. There are 128 columns, so that gives 2048 13-bit words.
The ROM array is rotated 90 degrees from the TMS1x00; based on Fig 7c in the patent, I think the bottom rows are the msbs. That means rotating the die shot CCW should put it in the same orientation as the others. It looks like the byte decoder is sequential, but I haven't spent the time to figure out if it's top-to-bottom or bottom-to-top. I also don't know the order of the 16 pages- previously they were 0-7,F-8.
I tried to find the first word of the ROM dump in the patent ($1213), but didn't find it by observation. Of course, I'm not sure how similar the actual ROM is to the patent ROM dump.
Claus references HrastProgrammer, who has a TI-57 emulator for HP calculators which he created from reading the patents. I looked briefly for the ROM dump in his emulator, but didn't see it. The patent scan is clear and entering the dump again shouldn't be too difficult.

Joined: Mar 2006
Posts: 1,050
L
Very Senior Member
Offline
Very Senior Member
L
Joined: Mar 2006
Posts: 1,050
here's a better pic of what needs to be imaged on 0281:
https://dl.dropboxusercontent.com/u/79094972/tmc0281quickice-annotated.jpg

LN


"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
Joined: May 2010
Posts: 1,049
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,049
I put the '281 pics here: www.seanriddle.com/tmc0281nlparts.7z

Joined: May 2010
Posts: 1,049
S
Very Senior Member
OP Offline
Very Senior Member
S
Joined: May 2010
Posts: 1,049
Here's the ROM dump from patent 4125901: www.seanriddle.com/4125901.bin

I'm a little concerned about it, though. In the patent, the letter o was used in several places instead of zero, S was used twice (I replaced it with 5), and H was used once (I replaced it with A). Two of the numbers didn't start with 1 or 0- AC16 and DE08, which I replaced with 1C16 and 0E08. Also, 3 of the line numbers were typoed. It kind of makes me think that someone retyped the hex dump for some reason, which means there could be errors that we can't ID without trying to run the code.

HrastProgrammer said "This code was retyped and analyzed by me from the original TI patents + I fixed various bugs from this ROM in order to make it work correctly." I'm not sure if the bugs were mistakes in the dump, or actual bugs in the version of the code used for the patent.

Joined: Aug 2009
Posts: 192
P
Senior Member
Offline
Senior Member
P
Joined: Aug 2009
Posts: 192
Originally Posted By seanriddle

Using the '5200 and '51XX, you don't have to level-shift either, do you?


I pretty copied the schematics of the TI99 speech adapter for my TMS5200 protoboard. (you can hook yourself TTL to that one).

As far as the TMS51XX is concerned, I tried a few things, but the best was to hack the negative voltage the way the Stern Bagman board does it (voltage dropping diodes). But its flaky, it would have benefited from proper leveling that one.

Joined: Mar 2002
Posts: 1,165
H
hap Offline
Very Senior Member
Offline
Very Senior Member
H
Joined: Mar 2002
Posts: 1,165
www.seanriddle.com/4125901.bin is TI-57? I think we'll need a new MCU core for this one. It will be interesting to emulate, but I won't put it on my TODO just yet. smile Maybe other devs are interested too?

Sean, If it's not too much time, could you use your bit-reading tools and make a rom'dump' of the CD2708 MCU from that high res image on siliconporn?

Page 11 of 366 1 2 9 10 11 12 13 365 366

Link Copied to Clipboard
Who's Online Now
3 members (Golden Child, Hubz, MrBogi), 24 guests, and 3 robots.
Key: Admin, Global Mod, Mod
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics8,853
Posts116,508
Members4,927
Most Online890
Jan 17th, 2020
Powered by UBB.threads™ PHP Forum Software 7.7.5