jurjen@lijster.cwi.nl (Posted for Eric Toonen) (02/09/90)
(This is posted for Eric Toonen by Jurjen N.E. Bos)
Nice features of the HP27S
I got an HP27S for a weekend, without the manuals.
In this document I describe what I have found, playing around
with it. I think some of these things might (or might not) be
in the manuals. I just wanted to share it with you all.
Eric.
----------------------------------------------------------------
In the Single-Step Selftest:
The Keyboard-combination [ON]-[LN] brings you to
the single-step selftest.
After that:
[root-x] will display the CPU speed
[x^2] will test the beeper
when you hit [ON] while beeping, the frequence decreases
(This also happens when you hit [ON] while testing the
beeper in the repeating selftest)
[e^x] will test the display (needs 7 additional keys)
[LN] will test the ROM
[y^x] will test the DRAM
[1/x] will test the URAM
[STO] will test the keyboard
(needs all keys, left to right, top to bottom)
It will display the message "KBD 0xxyy" if you missed
one. xx is the keynr you typed, while yy is the keynr
expected.
[RCL] displays ESD and beeps repeatively, until you strike a key.
I don't get it... (Can someone help me out on this one?)
If you press [RCL] again, it won't stop, and if you keep
holding [RCL], it beeps slower (but that is probably because
of the interrupt generated by the key)
[SIN] will display "OK-27S-E"
[<-] will start the debugger (see later in this document)
every other key.. will really start the single step selftest.
----------------------------------------------------------------
The debugger:
In the debugger:
The display is made up like
+----------------------+
|xxxxx:yyyyyyyyyyyyyyyy|
| |
+----------------------+
Where:
xxxxx is the current address, and
y are nibbles at this address,
with the mostleft nibble at xxxxx
the second left nibble at xxxxx+1, etc...
The keyboard has the following functions:
[0],[1],[2],[3],[4],[5],[6],[7],[8],[9] alter the current address with
their respective values
[root-x],[x^2],[e^x],[LN],[y^x],[1/x] alter the current address with
values #A..#F respectively
After an alteration has taken place, the current address is
incremented.
[+] increases the address with #00001
[-] decreases the address with #00001
[X] increases the address with #00100
[/] decreases the address with #00100
[TAN] prints the display, and increases the address with #00010
[<-] redisplays the display
[.] starts execution at the address
any other key...
will bring you back to the place before you
entered the debugger (As if you just typed [ON]-[LN])
----------------------------------------------------------------
What I did with the debugger:
When you start the debugger, you will always start with address
0219A. When you execute this address, you will see the following:
-The display clears
-You see "B" mostleft, and a digit (I had "0", "1", "2" and "3" on several
occasions) mostright.
-After a pause, the display is restored.
I guess the B is the romversion, and the digit means something too.
BUT: After it returns, the debugger totally freaks out,
So I restarted it and...
After studying the code at 0219A, I saw that the B was gotten from
address 1FFF6. So I went over there, and yes:
1FCE0..1FFC1 = empty (So there are 738 nibbles left in the ROM)
1FFC2..1FFE5 = "COPYRIGHT HP 1987",#00
1FFE6..1FFF5 = "OK-27S-E"
1FFF6..1FFF7 = "B"
1FFF8..1FFFF = 8 bytes of junk, maybe a checksum over the ROM?
It may be obvious, that the ROM is at addresses
00000..1FFFF (that is 64Kb)
Being this far from home (0219A that is), I went on, and concluded
that 20000..3FFFF is unused (It is probably not connected at all)
But 40000..4xxxx is!
Poking about, I found out that
40000..4020B is the memorymapped I/O space of the LCD.
it is organized pretty different from the HP28S:
The LCD is, however, again divided into two parts, but
instead of two chunks of I/O space, it is organized like:
(x=40000)
(left)
+--------------+
| x+001 x+000 |
b | x+005 x+004 | t
o | | o
t | etc... | p
t | |
o |--------------| <-center
m | x+003 x+002 |
| x+007 x+006 |
| |
| etc... |
| |
+--------------+
(right)
Just like the memory mapped I/O space of the HP28S, there are
al sorts of weird hardware thingies connected to the addresses
after the LCD...
The addresses in square brackets are the addresses with the same function
on the HP28S
^
40210..40250: all annunciator status
40210..40217 all annunciators
40218..4021F arrows
40220..40227 (should be shift)
40228..4022F printer
40230..40237 appointment
40238..4023F (should be batt)
40240..40247 G
40248..4024F RAD
402FF output (not input) to 40207
40300 is the CPU speed (Default 7), 0=slowest, F=fastest [FFF00]
40301 is the LCD contrast (Default 6) [FFF01]
40303 is the LCD power (A=normal on, 8=half, 2=normal off)[FFF03]
40304..40307 is the clock value [FFF04..FFF07]
40308 is the batteries value (0=low, 4=full) [FFF08]
40310..403F6 probably unconnected
403F8..403FF clock
Since I had only one 27S, I cannot be sure about this last address,
also, because of this, I know nothing about the "B" version-nr.,
and possible differences with other versions.
It is sometimes amusing to compare it with the HP28S:
While testing the contrast (by using [ON]-[-] and [ON]-[+] in the
debugger) I found that the 27S had 17 (!) contrast levels, compared
to 16 in the 28S. I can explain this to you by making a simple chart:
xxx01 | xxx03
LCD-contrast | LCD-power
--------------+-------------
#F | #A <--- highest contrast
#E | #A
#D | #A
#C | #A
#B | #A
#A | #A
#9 | #A
#8 | #A
#7 | #A
#6 | #A
#5 | #A
#4 | #A
#3 | #A
#2 | #A
#1 | #A
#0 | #A [ <--- lowest contrast of 28S ]
#F | #8 <--- lowest contrast
--------------+------------
#? | #2 <--- LCD off
TO ALL THE 28S OWNERS:
I leave it as an excercise to you, to make a program
on the 28S, using BAG or POKE, that can set the LCD
contrast in as small steps as possible.
I warn you however, not to get more power to the LCD
than #A, and not less than #2, because you might damage
the LCD.
SORRY, 27S OWNERS, BACK TO YOU...
After going further, It was easy to see that
50000..53FFF is the RAM, double allocated to
54000..57FFF, 58000..5BFFF, 5C000..5FFFF
----------------------------------------------------------------
RAM-Addresses known to me now:
5008A..500AB is the keyboard buffer [ hp28s: C0038..C0059 ]
with: 5008A index to last key used [C0038]
5008B index to last key typed [C0039]
5008C..500AB keybuffer [C003A..C0059]
50464..50503 are the RCL/STO memories [ ofcourse there are no 28S
equivalents ]
with: 5045B..5046A STO_0
5046B..5047A STO_1
5047B..5048A STO_2
5048B..5049A STO_3
5049B..504AA STO_4
504AB..504BA STO_5
504BB..504CA STO_6
504CB..504DA STO_7
504DB..504EA STO_8
504EB..505FA STO_9
----------------------------------------------------------------
ROM-Addresses known to me now:
00000 Machine reset
00776 Machine reset
01009 Is fun and useless
01011 Is more fun, and more useless (keep pressing [.] for lots of
variations)
(These two are included for "2 lost hours of work"'s sake..)
028FC Again defines a object type, this is ofcourse because of
the CPU instruction. To get this routine at this precise
address, they even skipped a large amount of ROM!
The following addresses are (some of the?) objects,
I haven't had the time to figure them out:
02911 029A4
02933 029C6
02955 029E8
0297B 02A0E
I tried to find a way to return from the debugger to normal
operation, but I had no success...
If you execute 00000, you get a machine-reset, which also
resets the speed, contrast and all those goodies.
I did find a way with limited possibilities:
Execute one of:
03B1F
02E42
and you will return, but: THE [SHIFT] DOESN'T WORK (grrr..)
----------------------------------------------------------------
Well, enough material here for a rainy day...
Sweet "debug"-sessions,
-------------------------------------------------------------------------------
Eric Toonen And.. the best of this article:
AN E-MAIL ADDRESS!:
Djept-Zuid 6
5502 RP Veldhoven UUCP: s89406143@hsepm1.hse.nl
The Netherlands -----------------------> "So what?
Use an alias!"
-------------------------------------------------------------------------------
--
| | "Never imagine yourself not to be otherwise than what |
| Jurjen N.E. Bos | it might appear to others that what you were or might |
| | have been was not otherwise than what you had been |
| jurjen@cwi.nl | would have appeared to them to be otherwise." |dylan@cs.washington.edu (Dylan McNamee) (02/13/90)
This is a really neat posting, but I can't figure out how to get into single step test mode. The directions say [ON] [LN], but I don't know what this means. (natural log?) [ON] [Cursor-Down] puts it into a test mode, but it doesn't behave the same as described. I really want to try this stuff out. dylan dylan@cs.washington.edu