The ROM Dumping Tutorial
Why and how
Saving the system firmware is one of the standard tasks with vintage computer systems. The reasons are threefold:
- ROMs generally suffer from aging. The average ROM lifetime of early ROMs is probably anything between 20 and 40 years, even when not in use. Sooner or later they have to be replaced in order to preserve a functioning system.
- System capabilities often depend on firmware revisions or firmware add-ons. Sometimes there is the need to upgrade/downgrade or expand a system's firmware, e.g. for extended peripheral support, bug-fixing or additional command sets.
- For a deeper understanding of how a system works, a copy of the firmware code is essential. Generally it is necessary to transfer the firmware to a PC, where it can be analyzed.
The 9845 system ROMs tend to fail really often. Most of the systems which are completely 'dead' or boot up by chance suffer from bad system ROMs, sometimes with intermittent failures. If this is the case for your 9845, you'll need a replacement. This can either be a working ROM from a spare system, or an EEPROM based solution. Look at the ROM Board Project for how that can be done.
Also look at the ROM Dumping Project for ROMs published for the 9845, including ROM content downloads for those ROMs which have already been dumped.
All ROMs hold machine code, so if you like to analyze the code by yourself, please look at the 9845 Assembler Project, there is a combined assembler/disassembler for 9845 assembly language available for download.
And please, if you successfully dumped a 9845 ROM which is not yet available, make it accessible to others.
The standard procedure for most vintage systems is to draw the ROMs from their sockets and read them out with a suitable EPROM-programmer - ideally before they're loosing their content. This is generally no problem for systems designed after 1980, since they normally use standard ROMs. At the design time of the HP 9845 the thing looked different. There were many different ROM designs, and for the 9845 HP decided to make it even better, so they included a latch logic into their ROM packages in order to require less supporting chips for the address/data bus multiplexing. This did work well, but makes ROM saving and especially ROM replacement not easier.
Fortunately HP decided to place their system ROMs into sockets, so they can be safely removed and exchanged. Actually, firmware upgrades were part of the concept, and some add-ons like the 512-kByte-RAM-boards required to upgrade the firmware by replacing up to four ROM chips. Unfortunately, so-called option ROMs (like the Advanced Programming ROM, the I/O ROM or the Mass Storage ROM) were firmly suited into plastic packages bonded directly onto a PCB layer, so dumping via EPROM programmer failes for those option ROMs.
However, there are at least two ways how ROMs can be saved:
| Alternative | Prerequisites | Advantages | Disadvantages |
| EPROM-Programmer | EPROM-programmer with adaptor | Fast, versatile, reliable. Works even with 'dead' 9845 systems. | Doesn't work with option ROMs. Adaptor must be built. |
| ROM Readout Program on the 9845 | Functional HP 9845 plus Assembly Execution or Assembly Execution and Development ROM plus either working mass storage device or connection to PC | Doesn't need additional hardware. Only way to read out option ROMs. | Doesn't work with a non-functional HP 9845. Needs an Assembly Execution or Assembly Execution and Development ROM. |
Dumping with EPROM Programmers
As mentioned above, this method works only with system ROMs, not with option ROMs. However, sooner or later you will need a replacement for the system ROMs, so it is never a bad idea to have a EPROM programmer at hand. Any EPROM prgrammer should do it, as far as it is capable to read 28C64 EEPROMs (e.g. a Willem EPROM programmer).
Typical Willem EPROM Programmer
Before we start, it is necessary to have a close look on the ROMs which make up the system firmware.
All 9845B/C system ROMs are installed on combined ROM/RAM-assemblies, one for each processor (Language Processor/LPU and Peripheral Processor/PPU). The assembly PCBs are for both processors identical, they differ only in the number of DRAM chips (the LPU ROM/RAM assembly is equipped with 32 DRAM chips, wheras the PPU ROM/RAM assembly has only half of them) and in the setting of a jumper (which defines the ROM/RAM address space used).
RAM/ROM Assembly
Eight ROM chips make up the upper line, the DRAM chips are positioned below them. The ROM chips are placed into sockets (single pin sockets, not the kind of socket we use to know from later systems), the DRAM chips are firmly soldered. Since the 9845 works with 16 bit wide words, there are two 64 kBit ROMs (low and high byte) for each 8 kWord ROM address block. The lower byte ROMs are on the left (positions CE1 LB to CE4 LB), the higher byte ROMs are on the right side of the PCB (positions CE1 UB to CE4 UB).
The ROM chips themselves are organized as 8x8 kBit. There are two different chip packages used, either a ceramic package with metal shield and gold-plated pins, or plastic packages with silver pins. Those silver pins tend to get a black oxide coating. The pinout is similar to the 2364 types which are in use in the Commodore VIC-20 or 1541 floppy disk drive. The main difference between the 2364 and the ROMs used in the 9845 is that the address pins in the HP ROMs are internally latched. The latches are triggered by the signal on the output enable (OE) pin. Here's the pin layout of those ROMs (both 2364 and HP):
2364 ROM Pinout
The 28C64 pinout differs slightly from that of the HP ROMs, so all you have to do is to build a simple adaptor. The easiest way is to use a 24-pin socket and a 28-pin socket, cut off the pins 18, 21 and 24 from the 24-pin socket, wire them to the appropriate pins on the 28-pin socket (see the red connections in the diagram below), and plug both sockets together as shown in the example below. Configure your EPROM-programmer to 28C64 EEPROMs. The built-in latch of the HP ROMs should not be a problem.
2364-to-28C64 Adaptor
Double-check on your programmer that you have the right power settings for a 28C64, otherwise your HP ROMs may say good bye forever. And most important DO NOT TRY TO WRITE TO THE ROMs !!!
Example Willem EPROM Program Configuration for 28C64
But before you have to extract the ROMs from the 9845 ROM/RAM assemblies:
- The first step will be to diskonnect power, to remove the monitor and then the system cover.
- Locate the ROM/RAM assemblies and use the levers to pull them out of the card cages. Be sure to ground yourself and to use a non-static underlay (the old ROMs are extremely sensitive to static exposure).
- Make a drawing where each ROM is located.
- Use a flat edgeless tool like a wooden french fries stick to lever the ROMs softly out, or even better use a professional chip extraction tool. Be careful not to damage the PCB or to bend the ROM pins! The best procedure is to extract one single ROM, read it out with the programmer, and re-install before extracting the next one. This prevents misplacements effectively.
As stated above, each ROM holds either the lower or the higher byte of each 16 bit wide word in the 4k address space (which equals 8 kBytes). In addition (due to the negative true logic of the 9845 bus) all bits in the ROMs are inverted from 0 to 1 and vice versa. So if you want to reconstruct the original firmware, you have to merge the content of the high and the low ROM and to invert the whole data.
The 9845 Utilities are quite useful for performing this task (look at the 9845 Utilities Section for a more detailed description and downloads). Assuming the low ROM has been dumped into file rom_low.bin and the high ROM has been dumped into the file rom_high.bin just execute the rommerge utility:
rommerge rom_high.bin rom_low.bin rom_combined.bin
rommerge inverts and combines both ROM contents, and finally performs a checksum test on the result, so you get some feedback if everything worked well.
Diagnose 9845 System ROMs
Sometimes ROMs produce intermittant failures. Typical behavior is that the system boots up successfully but at a certain point 'hangs'. Obviously the ROMs then are in a state anywhere between stable operation and complete failure. Sometimes this is caused by thermal problems (the ROM chips of that time were really energy eaters and heated up noticeable). You can use an EEPROM programmer not only to read out ROMs, but also for thoroughly testing for intermittant failures. I modified the open source UniPROG Universal programmer software and added some kind of burn-in test (look here for the original software, and here for the Willem programmer changes with 28C64 and burn-in test support).
The UniPROG programmer needs the DlPortIO driver package to be installed prior to use (the DlPortIO package can be downloaded here). More information on the UniPROG program can be found at this site.
Use the modified UniPROG (assuming you are using a Willem programmer) to dump the 9845 ROMs with:
uniprog read of=<filename> chip=28C64 prog=wil
You can perform a simple burn-in test on the ROMs with:
uniprog read of=<filename> chip=28C64 prog=wil count=<n>
with <n> a number between 1 and 1024. This test will just perform n repeating reads on each address (instead reading each address only once), comparing the result with the previous one and printing an error in case the values differ. The higher the repeat count, the more the ROM will be stressed. If you get one or more error messages, youre ROM is instable and will produce intermittent failures. If the burn-in test succeeds, run the romcheck utility (again from the 9845 Utilities Section) on the resulting file:
romcheck <filename>
The romcheck utility will check the dumped ROM data for integrity. If both the burn-in test and romcheck don't report any errors, the chance is good that the ROM is ok.
Dumping with Readout Program
If you're a lucky owner of a functional HP 9845, dumping ROMs is a comparably trivial task, and you won't need an EPROM programmer.
Depending on whether you own a working mass storage drive or, alternatively, a 98034A/B HP-IB interface and a compatible GPIB board in your PC, there are several choices where the ROM data can be stored.
If you are not able to run HPDrive or to create your own 9845 utilities disk, but you own a 9895A or 9885 floppy disk drive, just send me a blank 8" floppy disk and I'll copy you the utilities package on it. One of the assembly language ROMs is necessary anyway, since direct memory acccess is not available in HP BASIC. By the way, the MTOOL program is currently the only way to dump option ROM modules, since the ROM chips in the modules have been directly mounted on a substrate and can't be read with an EPROM programmer.
The MTOOL program is part of the 9845 utilities for 9845 package, which can be downloaded as part of an hpi image from the 9845 Utilities section. The MTOOL program is quite intuitive, just run it, specify how the ROM data should be saved, select the memory block and the starting memory address in one kWord steps (both in octal notation) and how many 10K-blocks shall be saved (decimal).
Look here for a table of all 9845 ROMs ever released by HP. Use the appropriate block and address information for the readout program. No inverting or merging is necessary, since the program already reads the ROM contents with full 16-bit words just as they are available to the processor. You also can use the ROMREV program to identify the ROM location, which is included in both the 9845 utilities package and the 9845B/C System Exerciser Rev. E test suite (which can be downloaded here). ROMREV also gives you an overview which ROMs are installed in your system.
As mentioned above, there are several options how the ROM data can be saved. The easiest way is to save the ROM data into disk files, especially if you're using the HPDrive mass storage emulator. If you're using a 9885 or 9895A disk drive, you'll still have to transfer the files to a PC. Saving to the built-in tape is possible but not recommended (using tapes is generally deprecated due to the age of the available tape media).
Here is a step-by-step example how to dump a dedicated option ROM, say the Assembler Development ROM (size is four 10K-blocks):
- Insert the 9845 utilities for 9845 disk in your disk drive or start HPDrive with the 9845 Utilities for 9845 hpi image (download the 9845 utilities for 9845 [not for PC] disk image in the 9845 Utilities Project & see the HPDrive project how to start HPDrive with it)
- Make sure MASS STORAGE IS set to the right destination, then load and run the "MTOOL" program and enter the following input:
- [V]view, [S]save or [Q]uit [V]? S
- Where to save (MSUS or 7xx: for HPIB)? :H (or whereever your disk is located)
- Block Address (octal 0-37)? 17
- Start Address in KWords (octal 0-70)? 40
- Number of 10K-Blocks (1-8)? 4
- Filename? ROM1 (or whatever name you like)
MTOOL then stores the content of the Assembler Development ROM into file ROM1. If you are nor sure about the size if the ROM you want to dump, simply chose start address of 0 and 8 when asked for the number of 10K-blocks, and the whole memory block will be saved so that the desired ROM is stored completely in any case.
MTOOL also supports sending the dumps directly to the PC via an HP-IB connection (especially useful if you don't own a working mass storage device and you don't want to save on HPDrive). There is a special Getfile utility for the PC side to receive the data and save it into files. The Getfile utility runs under Windows and is included in the 9845 file transfer download package (look here for details and download). Alternatively, TransEra's HTBASIC can be used as a receiver on the PC side with an HTBASIC program which is included in the file transfer download package.
Here is a step-by-step example how to send the above ROM to the PC:
- Insert the 9845 utilities for 9845 disk in your disk drive or start HPDrive with the 9845 Utilities for 9845 hpi image (download the 9845 utilities for 9845 [not for PC] disk image in the 9845 Utilities Project & see the HPDrive project how to start HPDrive with it)
- Make sure MASS STORAGE IS set to the right destination, then load and run the "MTOOL" program and enter the following input:
- [V]view, [S]save or [Q]uit [V]? S
- Where to save (MSUS or 7xx: for HPIB)? 720: (this is the standard GPIB address where Getfile is listening)
- Block Address (octal 0-37)? 17
- Start Address in KWords (octal 0-70)? 40
- Number of 10K-Blocks (1-8)? 4
- Stop HPDrive at the PC side if it is running and execute the Getfile program instead (chose a speaking file name like "Assembler_Development.BIN")
- Get back to the 9845 and press [CONT]
The content of the Assembler Development ROM is then transferred into the file of your choice on the PC.
There is also a romcheck utility available for download as part of the 9845 Utilities for PC in the 9845 Utilities Project, which can be used to verify the correctness of the ROM dump. Just run the utility on the dumped ROM image:
romcheck <rom image>
The utility calculates checksums for each 4 kWord block (= 8 kBytes). It applies the same checksum algorithm as it has been used for the table of the released ROMs, so you can make a comparison by yourself.
The ROMREV Program
The second tape of the 9845B/C System Exerciser (Rev. B and later) contains a very useful ROMREV utility program. It is mainly a BASIC program which uses a binary program RCKSUM to scan the whole ROM address space up to block (octal) 27 for any ROMs installed. If RCKSUM returns a valid checksum, it is compared against a table of all so far released ROMs and the result is output either to screen or printer. The utility can be started inside the System Exerciser test suite and is also included in the 9845 utilities package.
ROMREV Sample Output
This utility is very useful if you are not sure which ROMs are installed and/or at which memory address to look for a certain ROM since ROMREV lists all installed ROMs, even unknown or 3rd party ROMs. Besides, it tells whether the ROM sets are complete or which ROM is missing, and it detects bad or unknown ROMs by comparing with known checksums. Please keep in mind, that all address information is provided in octal representation.
In the above example, the Graphics option ROM Rev. A (part no. 98780-65501) is reported to be installed at address octal 20K in memory block octal 7. These are the parameters you need in order to save the contents for that ROM with the MTOOL program. System ROMs all have a part number starting with "1818-" and are each represented by a pair of ROM chips, all other ROMs are option ROMs.
Note that ROMs which use the address space beyond block 27 are not identified by the ROMREV program. However, if you modify program line 4530 and exchange 23 (=octal 27) with 37 (=octal 45), even the 9845B/C TEST ROM (which uses block 45) should be detected.
The complete 9845B/C System Exerciser Rev. E test suite, including the ROMREV program, can be downloaded here.