TMS7000 onboard ROM Dumping project

[+acadiel]

Brought to my attention by the person who helped with the CC-40 MAME emulation:

 

https://github.com/palazzol/PIC70x1_TMS70x2_dumper

 

For example, all the CC-40 and TI-74 and peripherals have TMS70xx ICs with either 2K or 4K onboard ROM (I think the only 4K one is the CC-40+ and TI-74).  My video controller has a socketed 2K TMS7000 series, which should make it easy to remove to try this (once I verify the unit works).

 

(By the way, the video controller is just a Hexbus VT-100 terminal that outputs video to a TV.  You control it by using device #40 and OPEN, PRINT, and CLOSE statements in BASIC.  Or the appropriate assembly commands.  To move the cursor around, use chr$(27) plus VT100 escape codes. - Stephen Reid)

 

[+OLD CS1]

On 12/15/2022 at 9:05 AM, acadiel said:

(By the way, the video controller is just a Hexbus VT-100 terminal that outputs video to a TV.  You control it by using device #40 and OPEN, PRINT, and CLOSE statements in BASIC.  Or the appropriate assembly commands.  To move the cursor around, use chr$(27) plus VT100 escape codes. - Stephen Reid)

No idea why, but I find this exceptionally cool.

[+FarmerPotato]

The video controller would be a good candidate to re-implement in a small FPGA.

 

First there is the HexBus interface.  Was this already implemented in VHDL or was it just Jim Brain's AVR code?

2. A state machine to accept the various commands and data. Keep track of cursor position. 

3. Screen buffer 2K , 25x80-column.

4. Finally, well-known code to output VGA signals for text in the screen buffer, using a 8x8 TI char ROM (1K) or perhaps a 9x12 IBM char ROM. 

Typical FPGA RAM will have a write port and a read port, else just multiplex access to regular RAM. 

 

I've done 3 and 4 on the BlackIce2 using the TI char set.  Following the book: Pong,  Chu: FPGA Prototyping using Verilog.  I used the text only to show counts of bus transactions.

[Knarfian]

 

FYI, we just updated this repo last night and changed the name, FWIW.

https://github.com/palazzol/TMS7xxx_dumper

 

It now supports all these chips:

PIC70XX, TMS70XX, TMS70XXX, TMS77XX, TMS70CXX, and TMS77CXX

 

Also, there is a brand new blog entry about it here:

https://abzman2k.wordpress.com/2022/12/23/tms7xxx-dumper/

 

 

 

[+acadiel]

Thanks to the project (thanks, @Knarfian and others!), I have one of these inbound, and the first one I'll attempt to dump is the Hexbus Video Controller CPU.

 

If that works, I'll gently desolder (and put sockets in) some of my other peripherals to try and dump the CPU ROMs from them.  

 

 

 

[Knarfian]

I wanted to give an update on this.

 

We've been working hard making this dumper work for every known TMS7000 variant in existence

 

First off, the original design works fine for many of the chips, including all the 40pin DIPs (normal and narrow) and 44 pin PLCCs.  As of yesterday, we've finally tested all these variations.  We are gonna send these out in the next couple days to the 2 folks who need them. 

 

 

Then, we realized that there are 28pin "TMS70CTXX" variations which don't have enough pins to support the way were doing the dumping!  So, we prototyped a new design, using a different way of using the pins and hopefully working for every last variation.  Along the way, we found a way to support the "piggyback" chips which may have up to 16K ROM as well.  And we found we could minimize the external EPROM to only 4K.  This design has now been tested with a CT chips, and it works for those too.  (We got one from broken CD-player)

 

 

Next, we looked at the TI calculator chips which have limited documentation - the TMS70C46 series.  These come in 54pin narrow dips and a QFP60 pin, that we know of.  We reverse engineered the pinout of the 54-pin dip from the TI-74 schematics and hardware, and then applied that knowledge to the QFP60 pinout in the TI FIA-10 calculator, which is currently not dumped.  These chips have a built-in address/data demux, so the adapter for this chip will plug into the new design replacing both the TMS7000 footprint and the LS373 latch.  We will be able to test our new dumper on both of these chips soon, but we believe it will work fine.

 

Interestingly, every chip we've tested have internal ROM, even chips which supposedly do not contain internal ROM.

 

Finally, we discovered there is yet another late variation, the TMS70Cx8 series.  These appear to come in PLCC 68 and DIP 64 narrow.  It looks like these were only released in Europe, as we have only found a 1991 databook and some chips from there.  We will also be testing the new dumper design with these chips soon, we just need to make adapters.

 

 

So, in short:

 

1) We have the original design that handles the common stuff, and has been fully tested. (40pin and 44pin stuff, 2K, 4K, and 12K rom support)

2) We have a new design which we are still prototyping/testing, but should to work for all known (to us) variants

3) We have examples of every chip type we know of.

 

There are a number of undumped chips out there that we know of, and probably more we don't.  Please spread the work that this tech exists!  I recently learned that one rare chip was decapped prematurely, when it could have been dumped first!

 

[+acadiel]

Thanks for the work on this!!!

 

So far, I'm aware of the following which I will attempt to dump:

• Hexbus Video Controller
• Hexbus RS232 Interface
• Hexbus Modem
• Hexbus Printer/Plotter
• Hexbus Wafer Tape Drive
• Hexbus Printer 80*

* = I don't have this

 

If there are any other Hexbus peripherals with TMS7000 ICs, we can desolder and dump them.

 

I'm not sure what these have:

• Dockbus Printer for the TI-74/95
• Mechatronics QuickDisk Hexbus drive

 

 

 

[Knarfian]

These are the undumped/bad dump things on our list at the moment.  I think there is some overlap with your list.  People have already mentioned other things too, just since my last post.

 

GI	PIC7040-519	8604 CAY			DIP40	PIC7040	Sewing Machine - Singer ultra unlimited 6268
TI	?				DIP40?	TMS7042	Exelvision ExelTel Aux CPU
TI	L11001				DIP40N2	TMS70C20	HX-2000 Wafertape
TI	ADC1984C	C11202NL			DIP40	TMS70C20	Architectural Data Corp - Data Dimensioner
TI	C14018				DIP40N2	TMS70C20	HX-3000/P RS-232+Parallel Interface
TI	C14020				DIP40N2	TMS70C20	HX-1000 Video Interface
TI	C71003				DIP40N2	TMS70C20	HX-3100 Data Modem
TI	TMC70016				DIP54N2?	TMS70C46	TI PC-324 Printer
TI	TMC70035				QFP60	TMS70C46	TI Financial Investment Analyst FIA-10
TI	?				?	?	Pinball - Technoplay - X Force - Audio CPU
TI	C61013?	TMS70C40F?	(C)1987 TI		PLCC44??	TMS70C40?	Tiger - Punch Your Lights Out (some versions)

[Knarfian]

1 minute ago, Knarfian said:

These are the undumped/bad dump things on our list at the moment.  I think there is some overlap with your list.  People have already mentioned other things too, just since my last post.

 

 

GI	PIC7040-519	8604 CAY			DIP40	PIC7040	Sewing Machine - Singer ultra unlimited 6268
TI	?				DIP40?	TMS7042	Exelvision ExelTel Aux CPU
TI	L11001				DIP40N2	TMS70C20	HX-2000 Wafertape
TI	ADC1984C	C11202NL			DIP40	TMS70C20	Architectural Data Corp - Data Dimensioner
TI	C14018				DIP40N2	TMS70C20	HX-3000/P RS-232+Parallel Interface
TI	C14020				DIP40N2	TMS70C20	HX-1000 Video Interface
TI	C71003				DIP40N2	TMS70C20	HX-3100 Data Modem
TI	TMC70016				DIP54N2?	TMS70C46	TI PC-324 Printer
TI	TMC70035				QFP60	TMS70C46	TI Financial Investment Analyst FIA-10
TI	?				?	?	Pinball - Technoplay - X Force - Audio CPU
TI	C61013?	TMS70C40F?	(C)1987 TI		PLCC44??	TMS70C40?	Tiger - Punch Your Lights Out (some versions)

FWIW - These references all came from personal contacts, MAME, or the datamath.org website

[+acadiel]

Check out this post (and the one after) for the Wafertape TMS7000 DSR Source.  I’m not sure if the one that I will dump will match either one of these, but I know there’s at least two versions possible.

 

 

[+acadiel]

Here's the 4K ROM for the Hexbus Video Controller, a simple peripheral that turns your TV into a VTxx terminal.  

 

(FWIW, @Ksarul, there's a 7805 there under that shield - but there's also four 1N4003 diodes, so I'm guessing it's AC in, and regulated down to 5V - the TMP9118 and TMS4416s are both 5V only and almost everything else *should* be.)

 

  Software: TMS7xxx Dumper - v1.3

  DetectedID: TMS7040

     RomSize: 4096

     RamSize: 128

     Process: NMOS

ti-hexbus-video-x-c14020n21-4k-rom.bin

[+FarmerPotato]

@acadiel

WOW, first time I've seen that --if you posted it before I missed it!

 

Where is the 7000? Is it that 40-pin chip in the corner socket? It looks like... SOJ-40.  I didn't know those had sockets! I speculate that the X is for Experimental/Development.
 

This board has so much in common with a 99/2! The giant capacitor, RF modulator/chan3-4 switch, 9118 video with 4416s, and of course the HexBus interface chip(right?) Love it. 

THM 6045 a heat sink? That's a new shape for me. I see TL780 underneath.

 

Wild guess: THM = TI heat management(yuck) ,else  TI had the best prefix ever for Thermal! I've been looking through a lot of historical TI part numbers lately. 

[+acadiel]

1 hour ago, FarmerPotato said:

@acadiel

WOW, first time I've seen that --if you posted it before I missed it!

 

Where is the 7000? Is it that 40-pin chip in the corner socket? It looks like... SOJ-40.  I didn't know those had sockets! I speculate that the X is for Experimental/Development.
 

This board has so much in common with a 99/2! The giant capacitor, RF modulator/chan3-4 switch, 9118 video with 4416s, and of course the HexBus interface chip(right?) Love it. 

THM 6045 a heat sink? That's a new shape for me. I see TL780 underneath.

 

Wild guess: THM = TI heat management(yuck) ,else  TI had the best prefix ever for Thermal! I've been looking through a lot of historical TI part numbers lately. 

A lot of the 7000s used custom markings, and yes, it's the 40 pin chip in the blue socket. The heat sink just has a 7805 5V regulator underneath the THM part, and yeah, it's the first time I've seen one of those!

 

I also saw a string in the ROM - "SELF TEST COMPLETE" too!

 

I hope @mizapf can talk to the people that have done the TMS7000 CC-40 MAME emulation about possibly getting Hexbus working now that we're dumping the peripheral CPU ROMs.

 

[+Ksarul]

2 hours ago, acadiel said:

(FWIW, @Ksarul, there's a 7805 there under that shield - but there's also four 1N4003 diodes, so I'm guessing it's AC in, and regulated down to 5V - the TMP9118 and TMS4416s are both 5V only and almost everything else *should* be.)

That may be right--but I'd probably feed it no more than 6-8VAC there, once I traced out the diodes to make sure they were operating as a full-wave rectifier.

[+FarmerPotato]

It kinda looks like one of the power pins goes through the DPDT switch, then through a diode rectifier, then the giant cap. The switch also controls a VCC trace. 

My 99/2 has a weird AC transformer that puts out no more than 18V (hard to measure.) It is a strange 2-pin JST type. 
 

@acadiel is that a DC barrel jack or is it two pins?

 

 

 

 

[+acadiel]

3 minutes ago, FarmerPotato said:

It kinda looks like one of the power pins goes through the DPDT switch, then through a diode rectifier, then the giant cap. The switch also controls a VCC trace. 

My 99/2 has a weird AC transformer that puts out no more than 18V (hard to measure.) It is a strange 2-pin JST type. 
 

@acadiel is that a DC barrel jack or is it two pins?

 

 

 

 

It's a two pin jack.

[+FarmerPotato]

1 hour ago, acadiel said:

It's a two pin jack.

Do you have a transformer for it then? 
 

This should be a separate thread for the Video Controller. 
 

 

6 hours ago, acadiel said:

[+acadiel]

    Software: TMS7xxx Dumper - v1.3

  DetectedID: TMS70C20

     RomSize: 2048

     RamSize: 128

     Process: CMOS

 

This is not as near as exciting, but here's the TI Hexbus Modem CPU ROM (2K).

 

This is a 2K TMS70C20AN2L IC, 40 pin, 1.78mm pitch (high density 40 pin DIP compared to the normal 2.54mm).

 

Dumped multiple times, verified, and raw S9 and binary are attached.

 

 

ti-hexbus-modem-tms70c20an2l-c71003s.bin ti-hexbus-modem-raw-s9.txt

[+acadiel]

I've noted that a lot of the TMS7000 CPUs seem to have TMP and TMX designations on them both in the CC-40's and in some of the Hexbus peripherals.  Here's the defintions.

 

[+Ksarul]

5 hours ago, acadiel said:

I've noted that a lot of the TMS7000 CPUs seem to have TMP and TMX designations on them both in the CC-40's and in some of the Hexbus peripherals.  Here's the defintions.

 

That sequence applies to just about any old-school TI chip. I actually have a couple of TMX9918s in my collection, and almost every single original 9909 is a TMX9909NL, although I actually do have a single TMS9909 in my set.

[+FarmerPotato]

12 hours ago, Ksarul said:

That sequence applies to just about any old-school TI chip. I actually have a couple of TMX9918s in my collection, and almost every single original 9909 is a TMX9909NL, although I actually do have a single TMS9909 in my set.

Acadiel is correct--a few catalogs from the 70s onward define P and X like that, with S meaning standard commercial.

But TMP is only for MOS chips.

It's explained clearly in the TMS320 data book (1985) for one. 

 

I've been digging into 1960s-80s semiconductor catalogs, price lists, etc. Less common  than the orange data books. 
 

From 1956-1966, TI sold hundreds (if not thousands) of different semiconductor products.  They were registered with JEDEC and given standard numbers like 2N2502. Total market for semiconductors had grown 100x in size during that period, and Silicon was displacing Germanium technology. (Check)

 

In 1967 to 1975, you see the majority of these parts become obsolete or renamed under TI "house numbers" which began with... TI.  I'm sure there's a story about  growth and competition there. 

 

The 1967-68 and later "Preferred Semiconductor" catalog/data books provide a cross reference from JEDEC to "TI" numbers. 
 

TIP was being used for Power MOSFETs, while TIL was for linear (op amps.) The prefix TIX is defined as: a part not yet having extensive qualification or reliability data. 
 

The same page provides a map from obsolete TIX parts to final names.  Among these are a half dozen TIXP prefixes. Curious, because one TI engineer described transistor TIXP40 as "experimental for one customer only." (Link here)

Maybe in 1967, TM becomes  the prefix for TI MOS, along with TMS, TMP and TMX. (MOS=metal oxide semiconductor: process for integrated circuits like logic and memories.) 

 

Related: TMAM for packaged microcomputer systems, TMSW for software packages for 9900 micros. Some territory overlap with Digital Systems (for which I've not found catalogs). 

I also learned about SN51/71, 72, 73, 74 designations... That's another story. 

[+FarmerPotato]

I've gotten out the Speech Education Module, and transferred the CPU to @Knarfian's ROM dumper device.

 

I feel really stupid to have not checked the chip facts before requesting a dumper.  The dumper IDed the chip as a TMS7040 (ID=8), but locked up after printing just a couple lines of hex.

 

S00600004844521B
S12300000020772DB40A521F0D88E0000E9E0E10D5DFDDD5DFF7DDDFF5FFF7DFDFFFFFD734
S12300200D8FFDED1F0F8FFDEDFD0D0FEFFF2F2D8EFFAEAEAE8EFFAEFFBEFFEFDF9EFFDE55
S12300400D9D0F1DDF0FEDCD8FFD7F5F8DDD0DDD119FF1D73D31F3533D3DF35F7D3D1DF79A
S1230060222F2AE62E7F222EE6E2AEF3E6AF2FE6F9F9FBFDFFFFFDFDFBFDFBFFF9F9F9FB51

 

The chip here is a TMX7000.  The 7000 had no ROM. 

 

Looking at the manual again. It does say 7040:

 

Quote

 

The Speech Education Module is based on a TMS7000 series microcomputer. The processor used is a TMS7040 microcomputer which contains an internal 4K byte ROM.  The internal ROM contains a portion of the Forth software monitor.  

 

Jumper W14 is used to ground the memory pin of the TMS7040 for full expansion mode. This allows the TMS7040 to access its full 64K byte of address space.  4K of the 64K reside as internal ROM.

 

The TMS7040 internal ROM is memory mapped as F000-FFFF.  When operating in the full expansion mode, the memory space at location U15 should be mapped to B000. Jumper W4 is provided for this."

 

Jumpers W3 and W13 provide for microprocessor mode of the TMS7000 Series microcomputer.  This disables the 4K internal ROM.  Refer to the TMS7000 User's Guide for additional information.

 

Jumpers:

 

--EPROM-- (near U12)

W1 closed

W2 closed

W3 closed    EPROM at U15 gets address F000.

W4 --         this would have put the U15 EPROM at B000.

--POWER-- (near Q3)

W5 --

W6 closed

--SERIAL PORTS-- (near J1 port)

W7 --

W8 closed

W9 closed

W10 --

W11 closed

W12 --

--CPU-- (near S3)

W13 closed   disables internal 4K ROM of TMS7040.

W14 --        no 64K expansion mode?

 

 

So the 2532 at U15 supplies external ROM at F000. Proper for either a TMS7000, or a TMS7040 with internal ROM disabled. 

 

 

From the BOM list:

 

U1-7   TMS4016 or TMM2016 2k x 8 static RAM
U8,U17 MC68A50 asynch comm
U12-14 TMS2532
U15    ???
U21    TMS7000 
U43-44 TMS6100 
U45    TMS5220 

 

I see:

 

U6,U7 are populated with Toshiba TMM2016 RAMs.  U6 is address 0800. U7 is address 3800. 

U8,U17 are MC68A50 UARTs (the board also uses 68A21 peripherals)

U12-15 have 2532.

U21 was the TMX7000.

U43 is empty. 

U44 is off-the-shelf VM61002, a TMS6100 speech rom with "industrial vocabulary". (#2 of 7 demo speech ROMs.)

U45 is a TMS5220. (no C)

Curiously, I have a LS390 dual-decade counter at U38 which was marked DELETE on the BOM.

 

The PCB is marked 2456226A.   Its silkscreen says Diagram 2465527.

 

The manual (in the TI Archive) included the schematic 2465527 A. It is dated  8-25-81, issue date OK 10-27-81.  

My Speech ROM is date code 8144. The latest date code on my board is 8201 on the 5220.  That matches up. 

 

I guess it was designed for either TMS7000 or TMS7040, in case the sales volume of the education module ever justified a mask ROM.  (I don't think it did! These are rare.)

 

Edited May 1, 2023 by FarmerPotato

[jbdigriz]

ROM dumps for the TMS7000 EVM here: https://electrickery.nl/comp/tms7k/doc/

 

And much else.