As I was studying HP-41CV microcode running in simulation, I finally uncovered what one of the bug fixes in the HFF ROM version does. This has been a mystery for many years, though there’s still one more unexplained change relative to the earlier GFF version.
For the first half of the product life of the HP-41CV, and the tail end of the product life of the HP-41C, the mainframe ROMs used were the “GFF” ROMs, which fixed most of the serious known bugs of earlier ROMs. Some of those bug fixes upset early synthetic programming fans, such as fixing “bug 2″ which allowed program memory and status registers to be accessed by addresses that wrapped around, and “bug 3″ which allowed altering system flags. Of course, other methods were developed for doing those things without reliance on bug 2 and bug 3.
Around late 1983, the HP-41CV changed to using the “HFF” ROM set. As far as I know, there is no published explanation of the difference between ROM 0 revisions G and H. Aside from the version number and checksum, there are two actual changes, at address range 01c9..01f3, and the single word at 081a. I haven’t figured out the latter, but I’ve discovered what the 01c9 change does.
The HP-41 mainframe ROMs have code to support expansion ROMs using “buffers” of registers allocated in main RAM, just after the key assignments. The first register of a buffer contains two copies of the buffer number, used by an expansion ROM to identify the buffer it owns, and a buffer length which is used to locate the next buffer, or the end of the buffers.
There was a longstanding bug in the mainframe ROMs which would cause a hard lockup if the length of a buffer was mismarked as zero. The code to scan the buffers would sit in a tight loop looking at the same zero-length buffer forever. This situation could easily be caused by buggy synthetic programs. The ON-backspace trick wouldn’t recover from this, because the buffer check happened before the ON-backspace check. Recovery generally requires removing the batteries until the RAM contents are lost.
The code change at 01c9 in the 0H ROM, and also the 0N ROM of the 41CX, fixes this bug! They reversed the order of the tests, so that the ON-backspace test is done before the buffer scan, so that it can avoid the zero-length buffer lockup.
It has been reported that the 41CV with HFF ROMs may have the “buzz mode” of the 41CX (PPCJ v10n9p24), but I don’t have a 41CV with HFF ROMs so I can’t confirm that.