It occurred to me while studying simulator traces that it might be interesting to investigate a bug in early versions of the 82104A card reader for the HP-41C calculator. The bug was fairly esoteric and easily avoided, as it seemed to occur when backspacing over a four-digit numeric prompt after EEX and two digits have been entered. (This is somewhat reminiscent of the famous Therac-25 bug, though without the fatal consequences.)
The card reader bug is present in the 1E version of the card reader (and probably 1D), and fixed in the 1G version. I haven’t got a 1D or 1F to check. I discovered the bug around 1981, and I think I saw it mentioned by someone else in the PPC Journal at one point.
With the card reader plugged in, press the key sequence
GTO . EEX 0 0 backspace backspace
What you should see after that is
If you have the bug, the display rotates so it reads
0 GTO .1
From study of a instruction trace, it appears that the bug is due to the card reader ROM’s I/O service poll routine violating one of the requirements of the mainframe polling code. From the mainframe source code:
All subroutine levels are available except in I/O service entry. If PKSEQ is set then I/O service routines must either preserve three subroutine returns on the subroutine stack or else terminate the partial key sequence.
The CR-1E I/O service poll code uses two levels of subroutines. Perhaps the CR-1G ROM was changed to not need two levels of subroutines, though I haven’t yet disassembled the code to determine what the actual changes are.