HP 20s - Page 1
Forum section: electronics / beginners

author: ace
author_rank: Newbie
timestamp: May 11, 2022, 12:10:47 am
content: Hi all, I have an HP-20s calculator which I have taken apart for my own curiosity. When i first opened the casing, I found only an LCD and a single chip with no cables connecting the anything (I was using it up until the moment I took it apart, so I know it works). Some pictures i took up close to the LCD appear to show a very regular light/dark pattern which could be conductive traces that go into the LCD? The graphite pads on the board with the chip rest on these light/dark area, so this seems to confirm that this is how the SOC talks to the LCD, although I am still not certain.The chip on the board appears to be the "Bert" SOC containing a HP Saturn processor inside, which contains the ROM and RAM as well. I found no external chips besides the SOC and the LCD, so that seems to be correct. I would like to read the ROM of this calculator as the instruction set for the HP Saturn CPU appears to be well documented, and I'm curious to see what the microcode inside the ROM looks like. However, since the ROM is integrated into the SOC, it appears unlikely to be able to talk to the ROM directly. Though this paragraph from a document from 2004 appears somewhat promising (https://nonpareil.brouhaha.com/microcode_simulation.pdf):QuoteAssuming that the processor reads through most of the ROM during startup, connecting to external pins to read out the bus data would be possible. Presumably one could also read from the memory directly if this test mode were enabled. What makes me believe this paragraph a little bit is that on the board which the SOC is connected to, there are16 total pins23 total pins which are not connected to any traces. Is it possible that some of these are used for a test mode as described, or to write to the ROM?Main Questions:- How does the LCD talk to the SOC?- Is this test mode described something that would reasonably exist on this chip?- Is it likely that these unconnected pins on the chip have something to do with a test mode?- Would it be feasible to enable this test mode?- Would it be feasible to read from ROM directly using this mode if the mode works as described?- Would it be possible to write to ROM?More disassembledHP-20s Pictures:https://imgur.com/a/zTtNmcG

author: ledtester
author_rank: Super Contributor
timestamp: May 11, 2022, 01:52:10 am
content: Quote from: ace on May 11, 2022, 12:10:47 amConnections to an LCD are often made with an "elastomeric connector":https://en.wikipedia.org/wiki/Elastomeric_connector

author: SiliconWizard
author_rank: Super Contributor
timestamp: May 11, 2022, 01:54:39 am
content: You're not showing the LCD, but I bet it just has elastomer strips to make contact with the PCB.The principle is this:https://www.fujipoly.eu/resources/design-guidelines/connectors/Other than this, I have no clue how you could dump the ROM content of this Saturn chip (the Bert indeed has 10KB of integrated ROM.)Emu42 is supposed to be able to emulate the HP20s:https://hp.giesselink.com/emu42.htmbut they do not provide the ROMs (obviously) and I didn't find clear instructions on how to dump them, but I'm supposing this is possible. Maybe someone from this project or having worked with it could help you.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: May 11, 2022, 06:52:03 am
content: I did a quick search for "HP-20s rom dump", and the first link I clicked on was from hpcalc.org, which has plenty of emulators, but without the rom dmps.Probably some copyright thing but there probably are plenty of places to get those dumps from.

author: ace
author_rank: Newbie
timestamp: May 12, 2022, 01:43:49 am
content: Thank you all,I started labeling all the pins that I could find on the "Bert" SOC and a majority are connected to the LCD, some are connected to the battery and there are multiple connected to ground.I'm a bit confused why there are multiple ground pins on the chip? I did a continuity test with my multimeter and found multiple ground pins with multiple shorted together via the traces, what is the reason for doing this? are some of these pins shorted together not actually ground?(position of pins in picture match labeled pins in spreadsheet)

author: WattsThat
author_rank: Frequent Contributor
timestamp: May 12, 2022, 03:41:30 am
content: The unused pins are grounded for ESD protection of the device. The function of the pins bonded together are unknown to those outside of the design team. If someone ever decaps a device, it might make sense.The 20S retained the same device package as used in the 32Sii, which has a dot matrix lcd, rather than the lower pin count package used on its business model brother, the 10B. Perhaps the 20S needed more rom and/or used a different line width process or larger die, nobody seems to know at this point.The 17B/ii, 27S and 42S have had their roms downloaded as the processors have a debug mode and have IR output. The 10B, 14B, 20S, 22S and 32S/ii have never been cracked because the processors don’t expose any bus pins to the outside world.

author: Bobson
author_rank: Regular Contributor
timestamp: May 26, 2022, 07:25:13 pm
content: Quote from: WattsThat on May 12, 2022, 03:41:30 amWrong. Several years ago some guy posted his advances (hpmuseum.org, AFAIK) in reading ROMs using hi-res X-ray camera or just milling down an IC and making a photo (I don't remember the technique used).I've seen this technology working in mid eighties.Some examples:https://hackaday.com/2018/04/12/dumping-arcade-roms-the-hard-way/https://hackaday.com/tag/rom-dump/https://duo.com/labs/research/microcontroller-firmware-recovery-using-invasive-analysis