Looking to find info on dumping code from the TMS1000. There is apparently an option to do this via the 'test mode'. Otherwise to decap ic. In my case the TMS1000 is in a model railroad controller.(1980)

Anyone used the test mode method ? Would like to discuss with someone who has.


Charlies, do you mean this chip? My research indicates that this is simply a CPU, and external ROM/RAM is used to store the program that this chip executes. Do you happen to have a link to the documentation about this "test mode"?
Hi KermMartian
Below is an extract from the patent document and the url for the document. In my case the TMS1000 is in a model railroad controller. I only need a small change to the code and then load onto a more modern ic. If I could get the code off that would be great. The extract gives information on the reading etc but above my head. If I could follow instructions I can set up but wouldneed to know what software to use.
CharlesHarris(downunder in New Zealand)

The Chip Test Functions

The facility for operating the chip in a test mode has been referred to. This mode would ordinarily be used in manufacture, either before or after the chips are sealed in the typical 28 pin plastic packages. The chips are made in batches of perhaps 100 all at one time on a silicon slice of 3 inch diameter; many slices would be processed at the same time. After all of the processing steps are complete, the slice is scribed and broken into individual chips as seen in FIG. 26. The yield of good devices from this process is sometimes considerably less than 100 percent. Tests must be made to find out which slices are good, which chips on a slice are good, then which final packaged devices are good, since there can be attrition at each process step. This testing could become very time consuming and expensive, because to be absolutely certain that every one of the 8800 transistors plus the associated connections are all perfect, all of the routines of the calculator would have to be implemented. For this reason, the testing mode has been included. The procedure would be to check each of the 1024 instruction words in the ROM, then exercise several instructions which are sufficient to check the remainder of the circuitry.

The operations available in the test mode are as follows:

First, a ROM word address may be serially loaded into the program counter 36 via the K1 pin 75-1, which goes into the gate 355 in FIG. 19 and thence into the program counter of FIG. 9 via line 350. This is under control of KC on input 206; when KC is at Vss, KC on line 199 disables the feedback circuitry through gate 351 and enables the K1 input to the program counter. Thus, in eight machine cycles, or 8 .times. 2 or 16 microseconds, a word address is presented. Each bit is loaded on 01 time, as this is when the program counter can accept new data to node 168.

Second, a ROM page address may be parallel loaded into the ROM page address register 46 via K1 to K8 lines 75, devices 196, lines 192 and gates 46' of FIG. 10. This path is also enabled by KC being at -Vdd, and the bits are loaded on 02. Since the word address comes in serially on 01, and the page address in parallel on 02, these may be time multiplexed, so no additional time is needed to load both. Recognizing that an entire new 8-bit word address is not needed to generate a new ROM address, but instead it may be advanced by one bit, it is seen that all 1024 locations could be addressed in much less than 1024 .times. 16 or 16000 microseconds.

Third, the 8-bit instruction word from the ROM, at the defined address, can be transferred into the program counter 36 from the lines 33 by external control. This is implemented by enabling the devices 162, to load R0 to R7 into nodes 164 of stages 36-0 to 36-7 as seen in FIG. 9. The devices 162 are controlled by BRNCAL on line 163, which can be generated by KC and K2 in gate 48-7 as seen in FIG. 11. This occurs in one machine cycle.

Fourth, the program counter 36 can be shifted out serially via line 165 of FIGS. 9 and 18, line 347, and segment output buffer 65-8, again under control of KC on line 199. This may occur one step ahead of, but at the same time, as a new ROM word address is being loaded in via K1 and line 350 of FIG. 19.

In order to test some or all of the ROM locations, the steps one, two, three and four just described would be implemented in order. All of the bits in all 1024 locations could be verified by a suitably designed test machine in less than about 20 milliseconds, which is much less than needed for some complex calculations in normal operation. Thus, vast savings in test time are possible.

Another test procedure is to load in a word and page address according to the first and second steps described above, then allow the machine to execute the sequence of instructions beginning at that location, then observe the results at the output terminals 17 and 18; and/or read out the last ROM output or address from the program counter after a certain number of cycles. This permits testing selected increments, which are sufficient to verify the integrity of the unit. In a typical complex operation, there are housekeeping routines which would be used again and again, perhaps hundreds of times, e.g. normallizing. These need not be checked but once. This procedure allows repetitive routines to be skipped.

It is understood, of course, that writing in and reading out ROM addresses and contents can be supplemented with reading in simulated keyboard entries.
Register to Join the Conversation
Have your own thoughts to add to this or any other topic? Want to ask a question, offer a suggestion, share your own programs and projects, upload a file to the file archives, get help with calculator and computer programming, or simply chat with like-minded coders and tech and calculator enthusiasts via the site-wide AJAX SAX widget? Registration for a free Cemetech account only takes a minute.

» Go to Registration page
Page 1 of 1
» All times are UTC - 5 Hours
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum