Previous Thread
Next Thread
Print Thread
Page 1 of 3 1 2 3
#60348 03/21/10 09:08 AM
Joined: Sep 2009
Posts: 21
C
critor Offline OP
Member
OP Offline
Member
C
Joined: Sep 2009
Posts: 21
Hi,


Using an EPROM programmer, I've unsoldered the 4.0 ROM chip from a Texas Instruments TI-80 calculator and dumped it.
The ROM-chip is a Sharp LH5359. It is pin-compatible with the AMD Am27C512 chip.

[Linked Image from datamath.org]
(ROM chip in the top right hand corner)


The dump seems ok: various system strings are readable in the file.
But it is probably partial: the chip is 64K, but the same 32K have been dumped twice. Some system strings are missing.
Either my programmer is faulty, either I've made some soldering error.
It could be possible too for the missing part of the ROM, to be included in the Toshiba T6M53A chip.
In fact, other T6M chips from Toshiba with public datasheets are including both the CPU and the OS.
I've bought another TI-80 with the 3.0 ROM - the dumping is planned. I'll check then if I'm getting the same problem or not.


Unlike what was written on some web pages, it is not Z80 assembly code.
It looks like assembly code for a 16-bit CPU.
I've found an archived web page of the Texas Instruments web site, which was mentionning a proprietary CPU running at 980KHz.
Unfortunately, I couldn't find a datasheet for the Toshiba T6M53A cpu-chip (on the left).
I've shown the dump file to several people.
Everybody is confirming it is for a 16-bit CPU (with various methods) but nobody is identifying the CPU.

Here's a partial screenshot of the dump:
[Linked Image from i63.servimg.com].

If you have any hint about which 16-bit CPU could be included in the T6M53A chip, please tell me...

Joined: Mar 2001
Posts: 17,194
Likes: 211
R
Very Senior Member
Offline
Very Senior Member
R
Joined: Mar 2001
Posts: 17,194
Likes: 211
I can't find a specific datasheet for the T6M53A and the other T6M series calculator chips are all fixed-function so that doesn't help. It might be figure-outable from the dump (certainly the part you're showing looks more than a little like Z80) but no guarantees.

Joined: Apr 2004
Posts: 1,562
Likes: 9
J
Very Senior Member
Offline
Very Senior Member
J
Joined: Apr 2004
Posts: 1,562
Likes: 9
Nah, that doesnt look like much like z80. I'm not seeing any regular z80 instructions like ld hl,xxxx ld a,(xxxx), ld (xxxx),a, call, ret in that screenshot.

Joined: Oct 2006
Posts: 1,017
Likes: 21
S
Very Senior Member
Offline
Very Senior Member
S
Joined: Oct 2006
Posts: 1,017
Likes: 21
Pinouts: a guy on USENET traced some of the pinouts to:
A0-A7 at pins 1-8
D7-D0 at pins 9-16
A8-A14 at pins 33-39

This is interesting:
http://www.datamath.org/Forensics.htm
http://www.rskey.org/~mwsebastian/miscprj/results.htm
arcsin (arccos (arctan (tan (cos (sin (9) ) ) ) ) )
8.999999007884 Toshiba T6M53 (TI-80)
8.999999007884 Toshiba T9838 (TI-60X)
8.999999007884 Toshiba TMP0620F (TI-67 Galaxy 1)
8.999999007884 Toshiba T9948A (TI-68)
So, it shares... calculation algorithms with these processors?
Those all control 10-, 12-, 16- digit LCDs. T6M53A controls the LCD screen?
A note on DataMath: "The TMP0620F Application Specific Microcontroller is based on Toshiba's TMC17C architecture, a rather simple 4-bit kernel. Single chip calculator with 1536 program steps! Unfortunately is no further information of this interesting chip public available."
Probably not useful.

They also say: "Comments: The T6A43 and T6M53 are based on the Z80-ASSP family" which as you acknowledge is probably wrong.

Why you didn't link to your ongoing thread here I don't know?
http://tibank.forumactif.com/actualites-f7/dumping-ti-80-t5019-1.htm
http://tibank.forumactif.com/actualites-f7/dumping-ti-80-t5019-15.htm

Who have you asked for information from? It looks like TI Cares and Toshiba (English) so far? Have you tried Toshiba (Japanese), Toshiba (Chinese), or Toshiba (Taiwanese)? It's possible they go to different people at different offices. I/We can help with this if you want. wink

But yes, no additional help on datasheets yet. frown

judge: could it be TLCS900-core? 16-bit, Toshiba, 1995, passing relationship with Z80 (backwards compat. w TLCS90, which is related to Z80 in a way)...
I'm probably going down the wrong path...
Definitely not if the speed is really 980kHz...

Can you measure the speed of the CPU somehow to verify?

Joined: Aug 2004
Posts: 1,458
Likes: 9
Very Senior Member
Offline
Very Senior Member
Joined: Aug 2004
Posts: 1,458
Likes: 9
I can read Z80 code like a book, and that snippet of code is definitely not Z80.

Joined: Sep 2009
Posts: 21
C
critor Offline OP
Member
OP Offline
Member
C
Joined: Sep 2009
Posts: 21
Originally Posted by Stiletto
Pinouts: a guy on USENET traced some of the pinouts to:
A0-A7 at pins 1-8
D7-D0 at pins 9-16
A8-A14 at pins 33-39

There is no A15 pin ?
That could explain why I'm getting only 32Kb of data, instead of 64Kb...

But the ROM-chip has only got 28 pins...
Why are you mentionning pins 33-39 ?

Originally Posted by Stiletto
This is interesting:
http://www.datamath.org/Forensics.htm
http://www.rskey.org/~mwsebastian/miscprj/results.htm
arcsin (arccos (arctan (tan (cos (sin (9) ) ) ) ) )
8.999999007884 Toshiba T6M53 (TI-80)
8.999999007884 Toshiba T9838 (TI-60X)
8.999999007884 Toshiba TMP0620F (TI-67 Galaxy 1)
8.999999007884 Toshiba T9948A (TI-68)
So, it shares... calculation algorithms with these processors?

Very interesting, yes!!! Thank you very much!


Originally Posted by Stiletto
Those all control 10-, 12-, 16- digit LCDs. T6M53A controls the LCD screen?

Yes that is very strange, I know. The TI-80 itself seems very strange.
But remember TI wanted to build a low-cost calculator.
So that could be understandable. "How does it controls the screen" is the question...


Originally Posted by Stiletto
A note on DataMath: "Comments: The T6A43 and T6M53 are based on the Z80-ASSP family" which as you acknowledge is probably wrong.

I've allready talked on the TI-80 with Joerg.
After confirming it was not running a z80 core, he has modified some web pages, but as you can see not all of them.



Because it's mostly in french, with many hypothesis/errors. I've copied the facts here.


Originally Posted by Stiletto
Who have you asked for information from? It looks like TI Cares and Toshiba (English) so far? Have you tried Toshiba (Japanese), Toshiba (Chinese), or Toshiba (Taiwanese)? It's possible they go to different people at different offices. I/We can help with this if you want. wink

I've asked:
- TI Cares (no reply yet)
- DataMath.org (Joerg Woerner)
- and 4 TI-z80 developpers: Brandon Wilson, GoPlat, Benjamin Moody (FloppusMaximus), Randy Crompton
- Toshiba (but they answered it was not the right office)

Yes, if you can help by contacting Toshiba, that would be great.


Originally Posted by Stiletto
judge: could it be TLCS900-core? 16-bit, Toshiba, 1995, passing relationship with Z80 (backwards compat. w TLCS90, which is related to Z80 in a way)...

Joerg and I have allready thought to the TLCS-900.

I've received an email from GoPlat who has started analysing the ROM dump.

Here is what he has found out:

Originally Posted by GoPlat
I located the TI-80's program/equation parser; it starts around address AF4E. It's somewhat similar to the parsers in the Z80 calcs, but unfortunately the bytes used to represent each token are different, so I can't always be sure of what I'm looking at. That said, here's what I've figured out about the TI-80's CPU so far.

An instruction either consists of a single 16-bit word, or two 16-bit words where the second is a jump/call target. A jump/call target word contains the address to go to divided by 2 (so the address is always even), with the highest bit being 0 for a jump or 1 for a call. Addresses range from 0000 to 3FFF (the part of the ROM we don't have) and from 8000 to FFFF (the part of the ROM we have).

Here are the instructions which I think I understand:

* 0040 = return from a call
* 1Cii = load some register (I'll call it "A" for now) with immediate value
* 74ii tttt = jump/call if A is equal to immediate value
* 76ii tttt = jump/call if A is not equal to immediate value
* 7Cii tttt = jump/call if A is less than immediate value
* 7Eii tttt = jump/call if A is not less than immediate value
* D200 tttt = unconditional jump/call
* F0ii = add immediate value to A
* F2ii tttt = add immediate value to A, then unconditionally jump/call

If he is right, then that doesn't match the TLCS-900 op codes...


If anybody wants the dump file, just PM me.

Last edited by critor; 03/21/10 08:37 PM.
Joined: May 2004
Posts: 1,767
Likes: 34
H
Very Senior Member
Offline
Very Senior Member
H
Joined: May 2004
Posts: 1,767
Likes: 34
with half the rom missing it will be hard to make a call... they could be running some virtual cpu on the cpu for all i know, especially if the first half of the rom with the boot code is missing...

Joined: Mar 2001
Posts: 17,194
Likes: 211
R
Very Senior Member
Offline
Very Senior Member
R
Joined: Mar 2001
Posts: 17,194
Likes: 211
One of the later HP calculators actually runs an emulator of the earlier "Saturn" CPU models on an ARM9 for cheap and easy back compatibility, so it wouldn't be unheard of.

Joined: Mar 2006
Posts: 1,079
Likes: 6
L
Very Senior Member
Offline
Very Senior Member
L
Joined: Mar 2006
Posts: 1,079
Likes: 6
Are you 100% certain that the LH5359 (23c512 clone?) you dumped is fully dumped and the high address line wasn't left floating high? you may want to try swapping the A15 and CS wires around and try dumping it again.

LN


"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
Joined: Oct 2006
Posts: 1,017
Likes: 21
S
Very Senior Member
Offline
Very Senior Member
S
Joined: Oct 2006
Posts: 1,017
Likes: 21
Originally Posted by critor
There is no A15 pin ?
That could explain why I'm getting only 32Kb of data, instead of 64Kb...

But the ROM-chip has only got 28 pins...
Why are you mentionning pins 33-39 ?

Here's the original thread, you be the judge:
http://groups.google.com/group/alt....mp;ie=UTF-8&q=T6M53#657d838cab80deef
As far as I can tell he is talking about the pinouts for the Toshib T6M53A chip.

Originally Posted by critor
Because it's mostly in french, with many hypothesis/errors. I've copied the facts here.

See, I like the hypotheses when it's still early in research & development like this. And when I start helping I like seeing what everyone else knows laid out "on the table" so I don't duplicate research. (Realize that really all I can help with is search and research. wink )


Originally Posted by critor
I've asked:
- TI Cares (no reply yet)
- DataMath.org (Joerg Woerner)
- and 4 TI-z80 developpers: Brandon Wilson, GoPlat, Benjamin Moody (FloppusMaximus), Randy Crompton
- Toshiba (but they answered it was not the right office)

Yes, if you can help by contacting Toshiba, that would be great.

Okay, great, thanks for the info. I'll see what I can do. (We'll likely get nowhere.) Did Toshiba say what the correct office would be?

Originally Posted by critor
If anybody wants the dump file, just PM me.

I hope you can complete the dump, it's a little hard for people with a partial dump. smile

Page 1 of 3 1 2 3

Link Copied to Clipboard
Who's Online Now
2 members (Dodg, 1 invisible), 36 guests, and 0 robots.
Key: Admin, Global Mod, Mod
ShoutChat
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics9,318
Posts121,772
Members5,074
Most Online1,283
Dec 21st, 2022
Our Sponsor
These forums are sponsored by Superior Solitaire, an ad-free card game collection for macOS and iOS. Download it today!

Superior Solitaire
Forum hosted by www.retrogamesformac.com