Microcode-Level Calculator Simulation

Eric Smith

Many people want capabilities equivalent to HP calculators on other devices such as desktop computers or PDAs. This need is o ten addressed by unctional level simulation! i.e.! pro"rams which attempt to provide the user# visible behavior o the calculator without modelin" the e$act internal state o the real calculator%s hardware and microcode. &or instance! there was an HP#'( unctional simulator which ran on the Apple )) computer in the early *+,-s. HP has at times o ered unctional#level calculator simulators commercially! includin" an HP#*'. inancial calculator simulator in the HP# +( series o palmtop computers! and HP#**. scienti ic! HP#*'. inancial! and HP#*/. computer science calculator simulators in the HP#01 desktop environment. &unctional#level simulation may be adequate or many user needs! but "enerally does not produce numerical results identical to those o the real calculator. &or instance! the arithmetic precision may be di erent! and the arithmetic may even be per ormed in a di erent base. The HP#01 calculators use )EEE 2(3 binary loatin" point! while the ori"inal calculators use 4.D loatin" point. The mathematical al"orithms also may be di erent. &or simple operations this is typically not si"ni icant! but or comple$ operations like interest rate calculations! HP invested considerable resources into numerical analysis and al"orithm development to make the results as accurate as possible "iven the limited precision and memory si5e o the calculator! and unctional simulators o ten use in erior al"orithms yieldin" worse results. &unctional simulators also o ten di er rom real calculators in handlin" e$ceptional conditions and ed"e cases. An e$treme e$ample o this is the inability o most HP#3*. unctional simulators to ully handle synthetic pro"rammin"*. )t is desirable to have an alternative simulation methodolo"y that is more nearly identical to the real calculator in both numerical accuracy and unctionality. This can be achieved throu"h microcode#level simulation.

* Synthetic pro"rammin" is the use o unintended characteristics o the calculator to obtain behavior or results impossible or di icult to obtain throu"h normal means. 6 ten this is done by takin" advanta"e o bu"s. The term is most commonly associated with the HP#3*. 78ickes*+,-9.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e * o *+

History of Microprogramming
The earliest stored#pro"ram computers had a hardwired instruction set. Memory was e$pensive! so it was desirable or the instructions to per orm airly hi"h#level operations to ma$imi5e the pro"ram density. However! the amount o lo"ic and wirin" necessary to implement comple$ instructions is si"ni icant. )n *+(*! M.=. 8ilkes proposed a technique known as microcodin"! in which the pro"rammer#visible instructions o a computer are themselves implemented by the e$ecution o a micropro"ram on a simpler machine 78ilkes*+(*9. Micropro"rammin" irst "ained wide acceptance with its use in the )4M System>?/- series o main rame computers! introduced in *+/*. )n addition to usin" microcode to implement the System>?/- instruction set! these machines pioneered the concept o @emulationA! which )4M de ined to be the use o dedicated hardware and>or microcode to simulate an otherwise incompatible computer system. An option was o ered or the )4M ?/- Model ?- to emulate the earlier )4M *3-* computer. )n this paper the term @simulateA is used rather than @emulateA with re"ard to calculator simulation since no dedicated hardware or microcode is used on the simulation host system.

Microprogramming in HP Calculators
All HP desktop and handheld calculators are micropro"rammed. The micropro"ram is responsible or the basic operation o the machine! loatin" point number entry! display! and arithmetic! transcendental unctions! user pro"ram entry and e$ecution! peripheral control! etc. )n order to implement loatin" point addition! the calculator must e$ecute a series o microcode instructions to compare the e$ponents o the two operands! shi t one and increment or decrement its e$ponent until the e$ponents match! add the mantissas! normali5e the result! deal with the si"ns! etc. The processor provides 4.D inte"er operations on sub ields o the re"isters! and the necessary comparison and conditional branch instructions. &or instance! once the e$ponents are equal and the si"ns have been dealt with! the actual addition o the mantissas is accomplished by an instruction like @c B c C a 7m9A! where @aA and @cA are workin" re"isters! and @7m9A speci ies that the operation is to be per ormed on the mantissa ield Ddi"its ' throu"h *'! numbered rom ri"ht to le tE. HP irst used micropro"rammin" in the HP +*--A desktop pro"rammable scienti ic calculator 7.ochran*+/,9! introduced in *+/,! thou"h the desi"ners were not amiliar with the terms @micropro"ramA or @microinstructionA 76sborne*+,'9.
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e ' o *+

HP introduced the irst handheld scienti ic calculator! the HP#?(! in *+2'. The microarchitecture o the HP#?( was an entirely new desi"n based on di erent en"ineerin" tradeo s resultin" rom the availability o hi"h#density PM6S lo"ic circuits and ;6Ms. A strict Harvard architecture was used! in which there are separate microinstruction and data memories. The microinstruction words are ten bits wide! while data words are (/ bits wide. 8ith minor chan"es! the microarchitecure o the HP#?( was used or several succeedin" "enerations o HP calculators! culminatin" in the @FutA processor used in the HP#3*. amily o e$pandable scienti ic pro"rammable calculators! and the =oya"er series o scienti ic! inancial! and computer science calculators De.".! HP#**.! HP#*'.! HP#*/.E. A new processor architecture! @SaturnA! was introduced in the HP#2*4 handheld computer in *+,3 7Dickie,39! and was used in all HP handheld calculators introduced rom *+,/ throu"h *++,! notably includin" the HP#', and HP#3, amilies. Saturn is a =on Feumann architecture! such that there is a sin"le uni ied address space! and the data word width is increased to /3 bits. )nstructions are o variable len"th in multiples o our bits! the unit o addressin". Fevertheless! many similarities to the earlier calculator microarchitectures were preserved! such as the ability o arithmetic and lo"ical instructions to operate on di"it ran"e subsets o a data word.

User Microcode for HP Calculators

HP did not ori"inally intend or users to deal directly with the microcode o the calculators. The microcode implemented user#level unctions! and on the pro"rammable calculators! a user pro"ram consisted o a series o steps that invoked these unctions. However! users were naturally curious about the internal workin"s o their calculators! and did quite a bit o reverse# en"ineerin". Tom Fapier published a series o articles describin" his investi"ations into the inner workin"s o the HP#/2! and a plotter inter ace he constructed7PP.=(F2P29. However! the HP#/2 was not a plat orm conducive to user microcode development! as there was a i$ed amount o microcode built into the machine! with no provision or e$pansion. The HP#3*.! introduced in *+2+! was HP%s irst e$pandable scienti ic handheld calculator. )ts our e$pansion ports could hold ;AM! ;6M! or peripheral inter aces! the latter o which also contained ;6Ms. Si"ni icantly! the ;6Ms could contain user#level pro"rams! microcode! or a combination o the two. HP published some details about the internal or"ani5ation o the HP#3*. in the PP. <ournal @.orvallis Division .olumnA! such as the HP#3*. Main &unction Table7PP.=/F3P**9! HP#3*. Post i$ Table7PP.=/F(P'-9! HP#3*. Data and Pro"ram Structure7PP.=/F/P*+9 Armed with this in ormation many enthusiastic users set about usin" bu"s in
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e ? o *+

the ;6M to investi"ate unintended behavior o the calculator! brin"in" about @Synthetic Pro"rammin"A. The in ormation eventually also proved invaluable or user microcode development. Gelly Mc.lellan! <im De Arras and other users reverse#en"ineered the Fut processor bus and instruction set7PP.=/F/P397PP.=2F?P'-9! and built EP;6M bo$es and MHDH D;AME devices in order to run their own microcode. HP eventually was persuaded to release the source code o the HP#3*. ;6Ms and some o the accessory ;6Ms to PP. on a F6MAS DF6t MAnu acturer SupportedE basis! urther encoura"in" user microcode development.

Microcode-Level Simulation
Microcode#level simulation can avoid the problems o unctional simulation! and microcode#level simulators are "enerally easier to develop than a comple$ unctional simulator De.".! HP#*(.E! because the microarchitecture is by desi"n very simple in order to minimi5e the hardware cost. ) the microcode#level simulator implements the microarchitecture correctly! and the actual microcode rom the calculator is used! the unctionin" o the calculator can be reproduced nearly per ectly! includin" synthetic pro"rammin" and bu"s. HP undoubtedly used microcode#level simulation durin" the development o the calculators in order to debu" the microcode be ore hardware was available. HP even o ered the HP 3(3'?A &inancial .alculator so tware or the HP *(- @TouchscreenA computer! which consisted o microcode#level simulations o the HP#**. scienti ic and HP#*'. inancial calculators. The principle drawback o microcode#level simulation is per ormance. 4ecause many more details must be accurately simulated! a microcode#level simulator almost always requires more host .P0 per ormance than a unctional simulator in order to provide a comparable simulation rate. )n the case o early HP calculators! this is "enerally not an issue because the actual calculator hardware was e$tremely slow as compared to modern processors in desktop computers and even PDAs. Most users did not write their own microcode! but instead purchased third# party ;6Ms containin" microcoded unctions! such as the IEF;6M or AE.;6M. Due to the common use o both synthetic pro"rammin" and third#party microcode on the HP#3*.! a microcode#level simulator is much more use ul than a unctional simulator.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e 3 o *+

The Nonpareil Project

The Fut instruction set and the HP#3*. internals were well understood by the mid *+,-s! and some microcode#level simulators had been written! but none were publicly available. )n *++?! my curiousity about the internals o the earlier calculators drove me to research the 0.S. Patents "ranted to HP re"ardin" calculators. ) ound that there were some early patents that contained a detailed description o the instruction set o the irst#"eneration calculators DHP#?(! HP#,-! etc.E! alon" with the complete microcode source listin"s or the HP#3(! HP#((! and HP#,- calculators. ) typed in the listin"s! and wrote a microassembler and microcode#level simulator! which ) made available as ree so tware under the Jeneral Public Hicense7JPHv'9! by the unwieldy name @.ASMS)MA. Shortly therea ter! ) wrote a Fut microcode#level simulator @FS)MA! which ) also released under the JPH. Since that time! others have published more sophisticated microcode#level simulators or the HP#3*. and or Saturn#based calculators includin" the HP# 3, amily. Since those seem adequately represented! my own ocus has remained on early HP calculators. A ter a hiatus o several years! ) resumed work on microcode#level simulators in '--?. ) started reverse#en"ineerin" the @8oodstockA processor used in the second "eneration calculators De.".! HP#'(! HP#/2E! and "ot the HP#'( code runnin". ) was pleasantly surprised to ind that the @SpiceA series uses the same instruction set! so ) was able to "et the HP#??. runnin" in simulation airly quickly. Much o the simulation code can be shared between calculator amilies! so rather than continue to maintain independent simulators! ) mer"ed them into a sin"le simulator now named @FonpareilA Dwithout equalE. Fonpareil also is the name o a particular type o con ection! and an alternate name or a bird! the painted buntin"! so ) will probably adopt one o those or the Fonpareil lo"o.

!M "umping
A microcode#level simulation obviously requires microcode to be use ul. HP "enerally only provided the microcode embodied in ;6M chips! so it is necessary to somehow e$tract a ;6M ima"e or @dumpA. Due to their e$pandability and power ul pro"rammin" eatures! users quickly learned how to dump the ;6Ms o the HP#3*. and HP#3,. Some Saturn#based calculators such as the HP#*24! HP#'2S! and HP#3'S include a memory viewer that is capable o dumpin" memory to an HP ,'33- in rared printer or an HP#3, or other device that can receive the ); printer protocol. &or other calculators! ;6M dumpin" "enerally requires openin" the case and makin" electrical

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e ( o *+

connections to the circuitry. This orm o ;6M dumpin" is easiest on the calculators that have a built#in sel #test unction. This irst appeared on the Spice series De.".! HP#??EE! and was activated by the key sequence ST6 EFTE;K. The sel #test veri ies that the ;6M contents are correct' and that the processor and ;AM work correctly. As this sel #test takes place! it is possible to passively monitor the internal bus o the calculator usin" a lo"ic analy5er! and capture the contents o each ;6M word! so DmostlyE noninvasive ;6M dump is possible. The =oya"er series and the Saturn#based calculators also have a similar sel # test! usually invoked by pressin" the 6F key simultaneously with another key. The =oya"er calculators were the irst ones rom which ) captured ;6M dumps. 0se o a typical lo"ic analy5er to capture ;6M contents is di icult unless the analy5er has very deep capture memory! because the bus is serial. ) have built several models o dedicated hardware devices which ) call @;6MsuckersA or this speci ic purpose. The second "eneration ;6Msucker used a Hinear Technolo"y HT*-3( he$ level translator to convert the calculator si"nals DPM6S! FM6S! or .M6S! with volta"e ran"es rom #*'.(= to C*'.(=E to (= .M6S levels. These si"nals drive a DHP#0S4'3(M module which inter aces to 0S4.

Photo *L .loseup o ;6Msucker Mark ' ' All sin"le#bit errors and most multi#bit errors will be detected.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e / o *+

A Hinu$ pro"ram named @suckA was written to capture the data into a binary ile! and a pro"ram @dumplo"A decodes it into a DbarelyE human#readable te$t ile. 8ith the ;6Msucker Mark '! ) was able to dump the ;6Ms rom the HP#**.! HP#*'.! HP#*(.! and HP#*/.. ) have not yet dumped the ;6Ms rom an HP# *-.. The HP#*-. is airly rare. ) have only two units. 6ne is physically pristine! and ) am loathe to take it apart. The other is in rou"h condition! so ) don%t care so much about it. However! it uses the early =oya"er style construction in which everythin" is wrapped in antistatic shieldin"! and the chips are on a display module separate rom the keyboard. This is more challen"in" to probe! thou"h ) e$pect to "et to it eventually. )n the =oya"er calculators! the ;6M checksum is computed usin" a so tware loop. The .1)SA instruction Dnew to the Fut processorE is used to read each word. )n the earlier Spice calculators! ) was very surprised to discover that there is no equivalent o the .1)SA instruction. )nstead! the Spice .P0 has a sin"le instruction which when e$ecuted takes *-'3 bus cycles to read an entire *G word block o ;6M! and computes the checksum in hardware. 6n the calculators prior to the Spice series! dumpin" the ;6M is si"ni icantly more di icult. 8ithout a sel #test unction! and only passive monitorin"! one must e$ercise all the unctions o the calculator in an attempt to orce it to e$ecute all the ;6M instructions. ) have e$perimented with this approach usin" a version o Fonpareil instrumented or code covera"e analysis. Althou"h ) was able to ind a sequence o key presses to read all o the actually used ;6M words o the HP#3(! the problem has proven to be more di icult on more sophisticated calculators. ) you can%t "et all the ;6M words dumped this way! it is not easy to determine whether the missin" ;6M words are unused! or that you simply haven%t ound the condition that invokes them. ) plan to build a uture version o the ;6Msucker that can operate in an @invasiveA mode. This will require disconnectin" the )SA si"nal that carries the instruciton address and data between the .P0 and ;6M chips. D)n the irst "eneration calculators! the instruction and address are on the separate )S and )A lines! and only )A would need to be disconnected.E This allows the ;6Msucker to inMect addresses directly. Due to the implementation o bank switchin" in the ;6M chips Ddiscussed in more detail belowE! this will require tricky irmware in the ;6Msucker. HP desi"ned the Topcat series o calculators with a Mumper in the )SA line! apparently speci ically or dia"nostic purposes.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e 2 o *+

Some precaution will be necessary when usin" an invasive ;6Msucker with printin" calculators. PP. members who e$perimented with FFFs Dnon# normali5ed numbersE on the HP#+2 discovered that it was possible or the calculator to "et into states where heatin" elements o the printhead were turned on but not turned o a"ain in the required interval! thus permanently dama"in" the printhead. )t is possible that the intrusive ;6Msucker could put the calculator into such a state. ) believe that the calculator will work ine with the printhead le$ circuit disconnected rom the driver board. An alternate approach was used by Peter Monta to dump the ;6M code rom an HP#?(. )n a ;6M chip! the bits are encoded by the presence or absence o metali5ation at a particular location in the memory cell. )n older semiconductor technolo"y! there was only a sin"le layer o ;6M! which was the topmost layer Dthou"h possibly under a passivation coatin"E! so it can be seen optically. Peter cut the tops rom the metal#can ;6M packa"es! photomicro"raphed the ;6M chips! and wrote so tware to e$tract the ;6M bits rom the resultin" ima"es.

Photo 'L HP#?( .ircuit 4oard 8ith ;6M Packa"es Decapped Photo by Peter Monta

Peter had to spend some time studyin" the bits and the visible structure o the address decode array in the ;6M chip to determine the correct mappin" o physical location to lo"ical address and bit position. A description o the procedure and more photo"raphs can be seen on Peter%s

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e , o *+

web pa"e! at the 0;H listed in the 8eb ;e erences section at the end o this paper. ;6M e$traction rom some HP models will be particularly di icult. The ;6Ms o the HP#-* watch are inside a ceramic hybrid module. There do appear to be some test points on the module! but it is unclear whether any o them provide access to the necessary clock! sync! address! and instruction si"nals. ) not! optical e$traction may be the only viable option. ) that proves necessary! ) would much pre er to attempt it on a broken HP#-* rather than a workin" one. However! ) do not have a broken HP#-*! and even broken ones seem to etch hi"h prices on e4ay. Fote that there is a patent on the HP#-* which contains a source listin" o a prerelease o the ;6M. However! this is de initely not inal ;6M code as the keyboard layout is subtly di erent than production units! and there are nine '(/#word pa"es o ;6M listed! while the HP <ournal article on the HP#-* states that it contains two quad ;6Ms. 6 the nine '(/#word pa"es! there are over '-- unused locations! so it is quite likely that HP en"ineers were able to squee5e the code to it in two quads. )t should be possible to "et this prerelease HP#-* code workin" on a simulator! and it would be quite desirable to do so be ore destroyin" an actual HP#-* to e$tract the inal ;6M code. The HP#*- @G)SSA basic printin" calculator Dnot the later HP#*-4 or HP#*-. H.D calculatorsE appears to have the .P0 and ;6M inte"rated into a sin"le chip. Tony Duell has traced out the schematic and states that there are no e$tra pins that could provide the necessary bus si"nals. 6ptical e$traction is probably the only viable method. As with the HP#-*! the HP#*- is rare! so )%d rather do this to a broken one! but have not located one. The more sophisticated Saturn#based calculators "enerally have a separate ;6M which could relatively easily be dumped. However! most o the lower# end Saturn#based calculators have the .P0 and ;6M on a sin"le chip. )nternal HP en"ineerin" documents reveal that these inte"rated Saturn chips include a test mode that makes the internal Saturn bus cycles available on pins o the packa"e. 0n ortunately ) have no in ormation on the pinouts! and it will be a lot o work to determine how to invoke this test mode by trial and error.

!M #an$ S%itching
The irst#"eneration HP handheld calculators used ;6Ms storin" '(/ instruction words each. There was a cumbersome mechanism or selectin" one o ei"ht ;6Ms! allowin" or a ma$imum o '-3, instructions i ei"ht ;6Ms were used. The processor was not involved in ;6M selection! so the pro"ram counter and the sin"le#level return stack could only address the
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e + o *+

currently selected ;6M. Hater ;6Ms in the irst#"eneration handhelds stored *-'3 words Done @quadAE! but still unctioned as the equivalent o our '(/#word ;6Ms. The HP#(( and HP#/( needed more than 'G instructions! so later ;6M chips supported selection o one o two @"roupsA! allowin" or up to 3G instructions. These models actually used ?G o ;6MN no handhelds based on that chipset used more than ?G. These models also introduced the concept o a delayed ;6M select! so that a ;6M chan"e would occur a ter a ollowin" branch instruction! simpli yin" the pro"rammer%s task in arran"in" the pro"ram. The HP#3/! HP#,*! and HP#+,-( desktop calculators used the same chipset with more ;6M! but added e$ternal selection hardware. )n the second#"eneration chipset introduced with the 8oodstock series o calculators De.".! HP#'(E! the processor became more directly involved in ;6M addressin". The pro"ram counter and two#level return stack were *' bits wide! providin" or a ma$imum o 3-+/ instruction words. Perhaps at the time it was desi"ned this was deemed to o er some headroom! but in act it was not lon" until it became insu icient. The HP#+'! HP#+(.! HP#/2>+2! and HP#*+. all used more than 3G! so bank switchin" had to be introduced a"ain. )n the Spice series! the HP#?,E! HP#?,.! and HP#?3. also use bank switchin". ) have reverse#en"ineered the bank switchin" used in the Spice series. 8hile ) suspect that the 8oodstock bank switchin" is similar or identical! ) have not yet veri ied this. My initial e$pectation was that the Spice bank switchin" would be very similar to that used in the HP#3*.1 and some late HP#3*. ;6M modules. Those have two instructions to select bank * and bank '. E$ecutin" one o those instructions rom a bank#switched 3G block o ;6M a ects the bank selection o that block o ;6M only. However! the Spice bank switchin" is in act much simpler. There is only a sin"le bank switchin" instruction! which acts as a to""le! and a ects all bank# switched ;6Ms in the calculator re"ardless o address space. This sin"le#instruction bank to""le scheme has interestin" consequences or the ;6M sel #test. Durin" the sel #test procedure! the processor reads all o the ;6M words o a *G block o ;6M with the SOF. line activated or each word. This means that the ;6M cannot distin"uish a sel #test etch rom a normal instruction etch. Thus i a bank#switch instruction is etched durin"
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *- o *+

the sel #test! the ollowin" ;6M words will be etched rom the opposite bank! until another bank#switch instruction is etched. Thus the ;6M checksums o the bank#switched blocks o the address space are not each computed over a sin"le coherent bank! but rather on a mi$ o words or both banks. 6nce ) reali5ed that this interaction mi"ht be occurrin"! ) hypothesi5ed that any Spice bank#switched address block would contain bank#switch instructions at the same addresses in both banks. 6therwise it would be impossible or the sel #test procedure to veri y all words o both banks. &urthermore! it seemed likely that there would be an even number o bank switch instructions in each bank! so that the sel #test instruction would complete with the same bank selected as when it be"an. E$amination o the dumps rom the ;6Msucker veri ied both hypotheses or all three bank# switched models. 6nce ) updated my @dumplo"A pro"ram to account or the bank#switchin"! the HP#?,E! HP#?,.! and HP#?3. code started partially workin" in the simulator.

Multiple

!M &ersions

Some calculator models were produced with multiple ;6M revisions! usually in order to correct bu"s. The HP#?(! HP#3(! HP#/2>+2! and HP#3*. were amous or this. )n the case o the HP#3(! in addition to i$in" bu"s! the operation o stora"e arithmetic was si"ni icantly chan"ed. Some models had irmware chan"es that were less well known outside HP. &or instance! there apparently were bu" i$es to the HP#,- and HP#**.. Saturn#based calculators "enerally have a means o indicatin" the ;6M revision on the display! but with earlier calculators Dother than the HP#3*.E! one can only test or the presence or absence o known bu"s! or use hardware means to dump the ;6M contents or comparison.

Simulation Timing
The most obvious choices or timin" or a simulator are to match the real time e$ecution rate o the actual calculator! or to run at the ma$imum possible simulation speed. The latter is actually easier to implement! but can cause some di iculties. &or instance! the calculator microcode o ten uses timin" loops or button debouncin"! so runnin" at a aster than normal rate can prevent the keyboard rom operatin" correctly. )n the HP#3*.! i a key is held or appro$imately one second! the unction name in the display is replaced by @F0HHA! and no operation is per ormed when the key is released. This eature is intended to make it easier to use user#de ined keys! since you mi"ht or"et what unction you have assi"ned to a key. 4ut i the simulation runs aster than normal! the F0HH appears too quickly.
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e ** o *+

These timin" problems with ast simulation can be solved by either modi yin" the calculator ;6M ima"e to take the hi"her speed into account! or by havin" the simulator detect the timin" loop and take corrective action. Automatic detection o the necessary compensation points is not always easy! althou"h a "ood irst#order appro$imation would be to monitor all simulated instructions that re erence the key pressed la". Appropriate corrective action mi"ht be to adMust a loop counter in a simulated re"ister! or to temporarily reduce the simulation speed. Fonpareil currently attempts to use real#time e$ecution speed. Prior to Saturn! HP handheld calculators e$ecuted microinstructions at a i$ed rate. &or instance! the HP#(( e$ecutes ?(-- microinstructions per second Dbased on a crystal oscillatorE. The microcode or the HP#(( timer mode depends on this rate. Fonpareil matches it by timin" the e$ecution o a small number o instructions then suspendin" e$ecution or the amount o time needed or a real calculator to @catch upA.

Simulator Program Structure

.S)M and FS)M were written as sin"le processes! with display update and keyboard pollin" happenin" periodically. Fonpareil instead uses two processes! with one handlin" user inter ace and one runnin" the simulation core. Semaphores and mute$es are used or synchroni5ation between the two processes. The two#process structure is also help ul in implementin" debu""in" eatures! as the J0) process can easily set breakpoints and control the e$ecution o the simulator process. This is use ul or reverse#en"ineerin" e$istin" microcode! debu""in" newly written microcode! or debu""in" the simulation core itsel .

User 'nterface
.S)M and FS)M were written with the J0) code se"re"ated into a sin"le source ile that could be easily rewritten or alternate operatin" systems. The standard releases ori"inally used 1lib D1 8indow SystemE "raphics primitives! thou"h ) later switched to the JTGC toolkit. JTGC has the advanta"e that it is available on multiple plat orms! althou"h only the Hinu$>0ni$ plat orm seems mature at this time. Fonpareil also uses "lib! a portability library associated with JTGC! to provide plat orm#independent timin" and process synchroni5ation primitives. .S)M and FS)M ori"inally used "raphics primitives to render a very crude appro$imation o the appearance o the calculator! as can be seen in i"ures * and '.
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *' o *+

&i"ure *L .S)M simulatin" HP#?(

&i"ure 'L FS)M simulatin" HP# 3*.=

Fonpareil instead loads a PFJ ile to serve as the back"round o the calculator window. The PFJ ile can be a photo"raph or scan o an actual calculator! and David Hicks o the Museum o HP .alculators has "raciously "iven me permission to use some photo"raphs rom his web site in the Fonpareil packa"e. 4y de ault! Fonpareil creates the calculator window with no menu bar or other adornments! and adMusts the shape o the windows based on transparency in the PFJ ile! so that an HP#?( window is shaped like the outline o an HP#?(! as can bee seen in i"ure ?. This @shapeA mode can be disabled to provide a normal window with a menu bar! close bo$! etc. )n the de ault @shapeA mode! the menus will pop up i you click the ri"ht mouse button on the calculator display area! and the window can be moved around the desktop by clickin" and dra""in" with the le t mouse button.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *? o *+

&i"ure ?L Fonpareil showin" an HP#3( in the de ault RshapeR mode! and an HP#(( in Rnon# shapeR mode

(ML Language for Simulator Configuration

The Fonpareil user inter ace is de ined by a GMH ile. Each calculator to be simulated has one or more GMH iles! and the user speci ies one on the command line. The GMH ile tells Fonpareil what hardware to simulate! where to ind the ;6M and "raphics iles! and the locations and si5es o the buttons. GMH was de ined by SPbastien .arlier and .asey Patterson or use in Emu3,! and the speci ication is currently maintained by .hristoph JieQelink.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *3 o *+

Since the GMH speci ication ori"inally only had support or bitmapped displays! ) have added several e$tensions to GMH to support se"ment#oriented displays as used on the calculators with HED displays and seven#se"ment and ourteen#se"ment H.D displays. 6ther GMH e$tensions have also been added. )t would probably be a "ood idea to try to mer"e the Fonpareil chan"es into the o icial GMH speci ication! althou"h ) am also considerin" switchin" rom GMH to 1MH.

Legal 'ssues
) am not a lawyer! and do not o er any speci ic le"al advice. However! there are some potential le"al issues that may ace developers o simulators D unctional or microcode#levelEL

.opyri"htL

)t appears that there is no 0.S. .opyri"ht on the irmware o any HP handheld calculator introduced be ore *+,?. Prior to the 0S adoption o the 4erne .onvention! a work was required to bear a copyri"ht notice in order to receive copyri"ht protection. There were certain very limited conditions where the accidental omission o the copyri"ht notice could be corrected! but it does not appear that HP calculators quali y. Details may be ound in *2 0.S... 3-(DaE. The HP#2*4 handheld computers and all HP handheld calculators introduced a ter *+,? have copyri"ht notices! so it is "enerally not possible to distribute the ;6M ima"es without e$plicit permission rom HP. HP has "ranted permission or ;6M ima"es o some speci ic models to be publicly distributed.

PatentsL

The 0.S. patents on early HP calculators have e$pired. There are still 0.S. patents in orce re"ardin" aspects o ;PH! raction entry and display! the equation editor! etc.

TrademarksL

There are potential trademark problems with use o the name @Hewlett# PackardA or the initials @HPA in the name! description! or advertisin" o a simulator.

Current Status
.lassic seriesL HP#?(! HP#3(! HP#((! HP#,- believed workin" correctly. 8oodstock seriesL HP#'( partially workin"
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *( o *+

Spice seriesL HP#?'E believed workin" correctly. 6ther models partially work. .oconutL HP#3*.= workin"! but state save not yet implemented! and ourteen#se"ment H.D display needs improvement. =oya"er seriesL Displays memory lost! then a 5ero 1 re"ister! but no urther use ul behavior. Seven#se"ment H.D display needs improvement.

Ports
There are not yet any ports o Fonpareil to other plat orms! but there are several ports o my earlier simulatorsL David Hicks o the Museum o HP .alculators has ported it as a <ava appletL httpL>>www.hpmuseum.or">simulate>sim3(.htm <onathan Purvis has ported .S)M to Palm6SL httpL>>one#two#three# our# ive.com>palm>csim> MacieM 4artosiak ported FS)M to Mac6S 1 and si"ni icantly improved the appearanceL httpL>>homepa"e.mac.com>mba>nsim> MacieM has "raciously allowed me to incorporate some o his "raphical improvements into Fonpareil! and tells me that he is workin" on portin" Fonpareil to Mac6S 1.

Custom Hard%are
Since certain models o old HP calculators are now di icult to obtain and>or e$pensive! there may be some interest in buildin" replicas. ;ichard 6ttosen has built a custom calculator hardware prototype named @D)O#;PFA usin" a P).*,&3(' microcontroller and a */S' character H.D module. ) have written 8oodstock simulation code in assembly lan"ua"e to run on it! and am in the process o debu""in" it. The component side o the printed circuit board is shown in photo ?. The D)O#;PF keyboard uses an array o sur ace#mount @tact switchesA! which use metal snap#disc similar to Dbut smaller thanE those o traditional HP keyboards. These can be seen in photo 3. 6 course! we do not have custom double#shot inMection#molded keys. )nstead! we are currently usin" an overlay. ;ichard purchased a photo printer and scaled and modi ied a photo"raph o an HP#'(. )t works surprisin"ly well.

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e */ o *+

Photo ?L D)O#;PF component side Microcontroller needs to be installed in square socket. H.D module at top! serial and SD card Macks on le t! battery holders at bottom. Two boost switchin" re"ulators surrounded by a rectan"ular "round plane provide re"ulated (= or the microcontroller and H.D module when the calculator is turned on! and re"ulated ?.?= or the SD card when it is active. Photo by ;ichard 6ttosen.

Photo 3L D)O#;PF circuit side Sur ace mount tact switches and the ront o the H.D module. 8hen assembled! the buttons protrude throu"h holes in the top case! and a photo paper overlay provides keyboard le"ends. Photo by ;ichard 6ttosen.

Glaus Dlast name unknownE has built calculator hardware usin" a P).*/&,22 microcontroller. His so tware is written in .! usin" a portion o the Fonpareil code. The schematics and source code DJPHE are available rom his web site! listed below in the 8eb ;e erences section.

)uture *or$
Ar"uably the hi"hest priority task is to ind and i$ bu"s in the processor simulation. The bu" a ectin" the lo"arithmic and e$ponential unctions o
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *2 o *+

the HP#'( is particularly e$asperatin". 6n several occasions ) have ound errors in the code which seemed likely to be the cause o the lo">e$p bu"! only to ind that the correction has not in act eliminated the bu". ) e$pect that i$in" the underlyin" bu" causin" the lo">e$p problem may also i$ the problems with various Spice series models. ) have captured traces rom several Spice runs or comparison with simulator traces! to attempt to ind the di erences. 0n ortunately the di erences tend to occur on conditional branches a ter hundreds or thousands o instruction cycles. ) the simulator takes the wron" path o the conditional branch! it is not usually immediately obvious why this occurs! because the traces o the real hardware don%t provide direct visibility o internal re"ister state. There are still many calculator models or which more reverse#en"ineerin" will be necessary. .urrently ) have no in ormation on the operation o the card readers in the HP#/( and HP#/2>+2! and only a brie description o the printer instructions used in the HP#+*! HP#+'! HP#+(.! and HP#+2. ) have started work on a 8indows port o Fonpareil. The simulation core seems to work! but bu"s in the 8indows port o the JTGC toolkit result in missin" display updates. There is also a bu" in the JTGC support or unadorned windows! resultin" in the window shape mask bein" applied at an o set. MacieM 4artosiak has stated that he is workin" on a Mac6S 1 port o Fonpareil.

*e+

eferences

FonpareilL httpL>>nonpareil.brouhaha.com> .ASMS)ML httpL>>www.brouhaha.com>Teric>so tware>casmsim> FS)ML httpL>>www.brouhaha.com>Teric>so tware>nsim> Photos o the ;6MsuckerL httpL>>"allery.brouhaha.com>romsucker Museum o HP .alculatorsL httpL>>www.hpmuseum.or"> Peter Monta%s @;everse En"ineerin" the HP#?(AL httpL>>www.pmonta.com>calculators>hp#?(> Glaus%s )US)ML httpL>>www.in ormatik. h# wiesbaden.de>Tkhind--*>iqsim>iqsim.html
Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *, o *+

.hristoph JieQelink%s EM03, pa"e! includin" the GMH speci icationL httpL>>privat.swol.de>.hristophJiesselink>emu3,.htm

,c$no%ledgments
The author "rate ully acknowled"es assistance and in ormation provided by many individualsL

MacieM 4artosiak Hui5 .lVudio Tony Duell 4ob Edelen .hristoph JieQelink Dave Hicks 8ieland Hin"st 8lodek Mier#<edr5eMowic5 Peter Monta ;ichard 6ttosen Felson Sicuro Mark Sims ;andy Sloyer Gen Sumrall

My apolo"ies i )%ve omitted anyone.

#i+liography
8ickes*+,-L ! Synthetic Pro"rammin" on the HP#3*.! *+,8ilkes*+(*L M.=. 8ilkes! The 4est 8ay to Desi"n an Automated .alculatin" Machine! *+(* .ochran*+/,L David S. .ochran! )nternal Pro"rammin" o the +*--A .alculator! *+/, 6sborne*+,'L Thomas E. 6sborne! Hewlett#Packard .alculator Architectures! *+,' Dickie,3L <ames P. Dickie! .ustom .M6S Architecture or a Handheld .omputer! *+,3

Microcode#level Simulation o Hewlett#Packard .alculators September '( : '/ ;adisson Hotel! San <ose! .ali ornia Pa"e *+ o *+