acadiel

I'm sure it can do it - it actually states it supports the following. The above is the one that I need, though. Combinatorial PAL10L8 PAL16L8 PAL20L8 Registered PAL16R4 PAL16R6 PAL16R8 PAL20R4 PAL20R6 PAL20R8

I did find an arguments for espresso that reduces the output into algebraic equations: Combinational output (probably not valid) $ espresso -o eqntott tiworkshop.tbl0 >test0.txt # PAL16R4 io18 = (!i3&i4&!i5&i9&!io13); io19 = (i2); ro17 = ; ro16 = ; ro15 = ; ro14 = ; io18oe = (); io19oe = (); Registered output: $ espresso -o eqntott tiworkshop.tbl1 >test1.txt # PAL16R4 io18 = (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | (!i9) | ( i5) | (!i4) | (i3); io19 = (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | (!i9) | ( i5) | (!i4) | (i3); ro17 = (!i8) | (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | ( !i9) | (i5) | (!i4) | (i3); ro16 = (!i7) | (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | ( !i9) | (i5) | (!i4) | (i3); ro15 = (!i6) | (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | ( !i9) | (i5) | (!i4) | (i3); ro14 = (!io12) | (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | ( !i9) | (i5) | (!i4) | (i3); io18oe = (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | (!i9) | ( i5) | (!i4) | (i3); io19oe = (!i2&!fio19) | (i2&fio19) | (io13&!fio18) | (!io13&fio18) | (!i9) | ( i5) | (!i4) | (i3); This looks a bit closer, but still need to learn the idiosyncrasies of some of the nomenclature (like the "f") @Fritz442, thoughts?

Hah, if only I understood the output and how to translate it to JEDEC.

I've re-run the jobs and verified the same results. etinambp:DuPAL_Analyzer Jon$ ./template.sh [main] INFO info.hkzlab.dupal.analyzer.App - DuPAL Analyzer null [main] INFO info.hkzlab.dupal.analyzer.palanalisys.explorers.OSExplorer - exploreOutStates() -> Initial state: OS[O:41|Z:00] [main] INFO info.hkzlab.dupal.analyzer.palanalisys.explorers.OSExplorer - exploreOutStates() -> Can't find a path to an unexplored state from OS[O:01|Z:00] [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - Got 64 output states! [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - saveOutputToFile() -> Saving to tiworkshop -rw-r--r-- 1 Jon wheel 5827770 Feb 22 22:12 tiworkshop retinambp:DuPAL_EspressoConverter Jon$ java -jar DuPAL_EspressoConverter.jar tiworkshop tiworkshop.tbl DuPAL Espresso Converter null [main] INFO info.hkzlab.dupal.EspressoConverter.App - Got file for PAL type PAL16R4 [main] INFO info.hkzlab.dupal.EspressoConverter.formatter.EspressoFormatter - formatEspressoTableHeader() -> Will format a table for a PAL16R4, IO mask 41 [main] INFO info.hkzlab.dupal.EspressoConverter.App - saveOutputToFile() -> Saving to tiworkshop.tbl.tbl0 [main] INFO info.hkzlab.dupal.EspressoConverter.App - saveOutputToFile() -> Saving to tiworkshop.tbl.tbl1 -rw-r--r-- 1 Jon wheel 1704107 Feb 23 13:41 tiworkshop.tbl.tbl0 -rw-r--r-- 1 Jon wheel 426155 Feb 23 13:41 tiworkshop.tbl.tbl1 retinambp:DuPAL_EspressoConverter Jon$ mv tiworkshop.tbl.tbl0 tiworkshop.tbl0 retinambp:DuPAL_EspressoConverter Jon$ mv tiworkshop.tbl.tbl1 tiworkshop.tbl1 retinambp:DuPAL_EspressoConverter Jon$ espresso tiworkshop.tbl0 # PAL16R4 .i 16 .o 8 .ilb i2 i3 i4 i5 i6 i7 i8 i9 io13 io12 fio18 fio19 psro17 psro16 psro15 psro14 .ob io18 io19 ro17 ro16 ro15 ro14 io18oe io19oe #.phase 00000000 .p 3 -010---10------- 10000000 1--------------- 01000000 ---------------- 00000011 .e retinambp:DuPAL_EspressoConverter Jon$ espresso tiworkshop.tbl1 # PAL16R4 .i 16 .o 8 .ilb i2 i3 i4 i5 i6 i7 i8 i9 io13 io12 fio18 fio19 psro17 psro16 psro15 psro14 .ob io18 io19 ro17 ro16 ro15 ro14 io18oe io19oe #.phase 00000000 .p 12 ------0--------- 00100000 -----0---------- 00010000 ----0----------- 00001000 ---------0------ 00000100 0----------0---- 11111111 1----------1---- 11111111 --------1-0----- 11111111 --------0-1----- 11111111 -------0-------- 11111111 ---1------------ 11111111 --0------------- 11111111 -1-------------- 11111111 .e

Hey all - I finally got my DuPAL PAL brute forcing tool working, and was able to get it to process my TI Workshop protected PAL16R4. It's a multi part process. First, I have to identify what's called the "output mask" by having it scan the 16R4 with the DuPAL Analyzer Java app. Then re-run the analyzer again with the "41" at the end. Ending up with a huge JSON of all possible input/output combinations. $ java -jar dupal_analyzer.jar /dev/tty.usbserial-1420 16R4 out.json [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - detectIOTypeMask -> Currently detected mask is 41 [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - Detected the following IO as Outputs mask: 41 [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - Now, turn OFF and ON again the DuPAL to reset the PAL and run this tool again by specifying the mask and output file. $ java -jar dupal_analyzer.jar /dev/tty.usbserial-1420 16R4 41 out.json [main] INFO info.hkzlab.dupal.analyzer.App - DuPAL Analyzer null [main] INFO info.hkzlab.dupal.analyzer.palanalisys.explorers.OSExplorer - exploreOutStates() -> Initial state: OS[O:41|Z:00] [main] INFO info.hkzlab.dupal.analyzer.palanalisys.explorers.OSExplorer - exploreOutStates() -> Can't find a path to an unexplored state from OS[O:01|Z:00] [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - Got 64 output states! [main] INFO info.hkzlab.dupal.analyzer.board.boardio.DuPALAnalyzer - saveOutputToFile() -> Saving to out.json $ ls -l -rw-r--r-- 1 Jon wheel 5827770 Feb 22 15:47 out.json Second, I have to then actually let it do the conversion of that huge JSON with the DuPAL Espresso Converter Java app: $ java -jar DuPAL_EspressoConverter.jar out.json output.json.tbl DuPAL Espresso Converter null [main] INFO info.hkzlab.dupal.EspressoConverter.App - Got file for PAL type PAL16R4 [main] INFO info.hkzlab.dupal.EspressoConverter.formatter.EspressoFormatter - formatEspressoTableHeader() -> Will format a table for a PAL16R4, IO mask 41 [main] INFO info.hkzlab.dupal.EspressoConverter.App - saveOutputToFile() -> Saving to output.json.tbl0 [main] INFO info.hkzlab.dupal.EspressoConverter.App - saveOutputToFile() -> Saving to output.json.tbl1 $ ls -l -rw-r--r-- 1 Jon wheel 1704107 Feb 22 15:48 output.json.tbl0 -rw-r--r-- 1 Jon wheel 426155 Feb 22 15:48 output.json.tbl1 And lastly, condense the output tables. Since this is a registered PAL, you get one for the registered outputs and one for the combinational outputs. $ espresso output.json.tbl0 # PAL16R4 .i 16 .o 8 .ilb i2 i3 i4 i5 i6 i7 i8 i9 io13 io12 fio18 fio19 psro17 psro16 psro15 psro14 .ob io18 io19 ro17 ro16 ro15 ro14 io18oe io19oe #.phase 00000000 .p 3 -010---10------- 10000000 1--------------- 01000000 ---------------- 00000011 .e $ espresso output.json.tbl1 # PAL16R4 .i 16 .o 8 .ilb i2 i3 i4 i5 i6 i7 i8 i9 io13 io12 fio18 fio19 psro17 psro16 psro15 psro14 .ob io18 io19 ro17 ro16 ro15 ro14 io18oe io19oe #.phase 00000000 .p 12 ------0--------- 00100000 -----0---------- 00010000 ----0----------- 00001000 ---------0------ 00000100 0----------0---- 11111111 1----------1---- 11111111 --------1-0----- 11111111 --------0-1----- 11111111 -------0-------- 11111111 ---1------------ 11111111 --0------------- 11111111 -1-------------- 11111111 .e I'm going to re-run this job just to make sure it's ok, but wanted to throw this in here in case anyone knows how to make heads or takes of this output. This could very well be gibberish

I hate to necropost… but I just built this beautiful gizmo - a DuPAL, which will let me “brute force” the PAL in my TI Workshop cart. Gotta wait for my MAX232 (legitimate ones) to come in… and will try to dump this PAL16R4. I’ve been in a dumping mood lately… Hexbus CPU ROMs, now PALs.

True, but to be honest, it’s likely only people rolling their own CRU bank switched programs with the CRU-controlled DBT Super Space. I do know Super Space was used to develop the DBT CRU-controlled cartridges. I don’t foresee it really being used outside of someone doing a one-off solution. That’s why I made it a mission to try and get all the other CRU DBT utility/game carts converted to the 378/379 method. The community really delivered there.

Yep. Here they are (I think for the most part). Let me know if I missed one. Someone needs to take TI Workshop one day and slap it with a large trout debug why it tends to overwrite areas of memory that don't belong to it - wiping out RAM disks, causing corruption on non standard disk controllers, etc. Probably only accessible with a debugger. I love the cartridge to death, I just don't trust it on anything other than a diskette system. DataBioTics Converted.zip

Software: TMS7xxx Dumper - v1.3 DetectedID: TMS70C20 RomSize: 2048 RamSize: 128 Process: CMOS This is not as near as exciting, but here's the TI Hexbus Modem CPU ROM (2K). This is a 2K TMS70C20AN2L IC, 40 pin, 1.78mm pitch (high density 40 pin DIP compared to the normal 2.54mm). Dumped multiple times, verified, and raw S9 and binary are attached. ti-hexbus-modem-tms70c20an2l-c71003s.bin ti-hexbus-modem-raw-s9.txt

We have a rough spec for a DSR that allows for on cart "file storage" for things such as adventures - but this needs a ROM based DSR. Fred Kaal and I called it romDSK. It's pretty much complete spec-wise, but needs hardware implementation. I don't see why we can't take this same spec and reimplement it in a GPL DSR (like MINIMEM or another GROM DSR) and build it into an UberGROM. We'd need someone who can interpret the ROM DSR code that Fred has written and rewrite it in GPL, but yes, we could then "format" the Adventure files and put them on ROM segments (files are split across normal bank switched 8K ROM banks - minus disk header type info in each bank) and then you can have all the TI adventures all in romDSK. You'd be able to load them on an unexpanded TI. The specs and such are there in case anyone wants to do it

It's a two pin jack.

A lot of the 7000s used custom markings, and yes, it's the 40 pin chip in the blue socket. The heat sink just has a 7805 5V regulator underneath the THM part, and yeah, it's the first time I've seen one of those! I also saw a string in the ROM - "SELF TEST COMPLETE" too! I hope @mizapf can talk to the people that have done the TMS7000 CC-40 MAME emulation about possibly getting Hexbus working now that we're dumping the peripheral CPU ROMs.

Here's the 4K ROM for the Hexbus Video Controller, a simple peripheral that turns your TV into a VTxx terminal. (FWIW, @Ksarul, there's a 7805 there under that shield - but there's also four 1N4003 diodes, so I'm guessing it's AC in, and regulated down to 5V - the TMP9118 and TMS4416s are both 5V only and almost everything else *should* be.) Software: TMS7xxx Dumper - v1.3 DetectedID: TMS7040 RomSize: 4096 RamSize: 128 Process: NMOS ti-hexbus-video-x-c14020n21-4k-rom.bin

Just following back here with this document for APTest - there's some great instructions here. APPENDIX B: DOCS-ON-DISK FOR APTEST TRACK-CENTERING These docs appear when selected from the APTEST menu. They are reproduced here to facilitate printing a paper copy. Also, some users might prefer the 80 column text display rather than the 40 column display on the APTEST file. A.P.P.L.E. PRESENTS DISK - DRIVE RELATIVE ADJUSTMENT BY CHARLES SUITOR (1980) This program does not measure the absolute alignment of a disk. It does measure the relative alignment between a drive and any diskette. There is no standard set for the results presented here. However, we do expect the results to be useful in several situations. The slot and drive that you wish to test will be requested. The program will then try to read the diskette in that drive on many tracks and between them. After several seconds, the drive will stop and results will be shown. The "fraction right" is the fraction that the data tracks were read correctly, and should always equal 1. The other numbers are results from trying to read between two tracks. They are the fraction of times the higher track was read minus the fraction the lower track was read. The first difference is the average of all such tries. The one labeled "GOING" comes from motion from low to high tracks, which is the same direction that initialization occurs. Thus, this number will usually be small (less than .1 for a diskette tested in the same drive it was initialized in. The difference marked "COMING" results from motion from high to low tracks and is often .1 to .2 more positive than the "GOING" difference. However, these results will vary as much as .1 to .2 on successive trials, so be sure to repeat any questionable tests. If the differences are greater than +0.9 or less than -0.9, then the drive is reading one track consistently when it should be reading between the two. The drive that initialized the diskette is not positioning its head where yours is. This outcome suggests that the alignment of the two is different. That alone does not require any action; diskettes can be read reliably with differences of 0.9 or more. However, if you have trouble reading diskettes from a particular source, and the difference on these diskettes is very high, then alignment may be a problem. To see whether alignment is your problem, test diskettes from a reliable source such as the Apple distribution disks. Test as many as you can; not even Apple is infallible. If your differences are mostly .3 to .4, then you are probably quite well aligned. In that case, ask your disk source to check his alignment! If your differences are much more than 0.3, then you may have problems with diskettes from those who are off by similar amounts in the other direction. If you do have problems, then take the drive to a reliable service facility to have the drive checked and realigned. There are many other disk problems besides alignment. If you have trouble with disks when read by the same drive in which they were initialed, then alignment is not the problem. Many problems are caused by work or otherwise defective diskettes. But if you have problems with diskettes from one drive not being readable by another, then the following track-centering alignment tests may help you isolate your problem. ALIGNING THE DRIVE If you are doubtful about this procedure, then please do not attempt it! These instructions are not official, authoritative, or otherwise blessed! No warranty is made as to their accuracy or applicability. We recommend that you take your drive to an authorized service dealer. The purpose of these instructions is to share our experience with other fools who would tinker with their drive despite all advice to the contrary. You can damage the drive by shorting the leads or test points. You can put the drive into worse alignment than it is now. You can void the warranty! 1. Remove the top cover of the drive. 2. Remove the bottom cover of the drive. On the bottom of the drive is a stepping motor, secured on two sides with screws (bolts). These bolts are in slots so that the motor can rotate slightly when the bolts are loose. This rotation of the stepping motor in the slots is the alignment adjustment. Adjust by moving clockwise if the difference numbers were too negative and you wish to make them more positive. Adjust counter-clockwise to make the differences less positive. Not much movement is needed! It is difficult to make positional adjustments of the stepping motor that will change the differences by less than 0.3. 3. Make the desired adjustment on the stepper motor bolts. 4. Check the alignment with the APTEST disk. 5. Repeat steps 3 and 4 until the difference score is sufficiently low: a difference score of 0.4 or less. 6. Reassemble the disk drive when finished. ------------------------------------------------------------- TRACK-CENTERING ALIGNMENT DATA SCREEN FRACTION RIGHT = _______ THE FRACTION RIGHT SHOULD BE EQUAL TO 1. DIFFERENTIAL FRACTION = ______ DIFF. FRACTION GOING = ______ DIFF FRACTION COMING = ______ THE DIFF. FRACTIONS, ESPECIALLY THE "GOING" ONE, SHOULD BE WITHIN +/- .4 IF THE DISKETTE IS ALIGNED WELL WITH THE DRIVE. -------------------------------------------------------------

Just some fun pictures/memories though the years... the guy was always smiling, cutting jokes/wisecracks at me, and fit the very definition of "jovial". Some of my favorite people here in these pics. Gonna miss you, man.

From Hal Shanafield on Facebook today: I have some very sad news to report. Berry Harmsen, the chairman of the Dutch TI Users Group, and a very good friend of many years, died today. His sister called to give us the news minutes ago. He had been on dialysis for some time. She found him next to his bed and he had already passed away. His funeral will be tomorrow. I will post any more information as soon as I receive it.

The Tomy might also have the concept of cartridge and DSR headers, but nobody really would know until we disassemble some of the ROM and see exactly which hooks it has. I think I saw the cartridges DID have a standard ROM (like >AA01 on the 99, but it's a different value). The DSR's, I don't think anyone's dug that deep. @jedimatt42 is correct about the external port being able to take over. That's how @tanam1972's cartridge works to override the Japanese BIOS with a US one, for example. There's a plethora of information in this thread here with pinouts and such:

Ouch. Glad you are ok, @Shift838!

Check out this post (and the one after) for the Wafertape TMS7000 DSR Source. I’m not sure if the one that I will dump will match either one of these, but I know there’s at least two versions possible.

Welcome! 🙂

32K nowadays is a must have. The best bet is to get a TI Pi with a SAMS attachment - that will give you everything you need - memory plus a storage mechanism that's easy to upload things to (SAMs has 32K built in). https://www.arcadeshopper.com/wp/tag/tipi/#!/TIPI/c/115338525 Ping @arcadeshopper - he may or may not have these in stock. The hard part will be getting a Raspberry Pi right now.

Thanks for the work on this!!! So far, I'm aware of the following which I will attempt to dump: Hexbus Video Controller Hexbus RS232 Interface Hexbus Modem Hexbus Printer/Plotter Hexbus Wafer Tape Drive Hexbus Printer 80* * = I don't have this If there are any other Hexbus peripherals with TMS7000 ICs, we can desolder and dump them. I'm not sure what these have: Dockbus Printer for the TI-74/95 Mechatronics QuickDisk Hexbus drive

What are the GROM numbers on the inside PCB?

Yep, and I know it might be overwhelming right now - if you don’t know how to solder, feel free to ask for help - I’m sure someone in here can help try and diagnose it. There’s only so many of these in the wild and it makes sense to try and fix them. Two more things I just thought of in case anyone else reads this thread in the future: 1) triple check that nobody removed the regulators. Sometimes, people mod their PEBs to use a PC PSU, and they have to remove the regulators on the cards to get them to work. These regulatorless cards could be damaged in a regular PEB. 2) Check the 74LS buffer chips on the flex interface card. I’ve seen most people just replace the ones in the black boot, but have seen others also replace the other side on the actually slot 1 interface card too.

I really, really love the idea of this! As soon as you get a new version, I'll try and get it over to my /4A with F18A. (I need to get off my tail and update my F18A, with 1.9, too..)