ticalc.org/ticalc_org_rev_b.iso/archives/text/misc/ti-bugs.doc

Text File | 2001-07-01 | 20.8 KB | 519 lines

   TI-85 and TI-92 tips, tricks, bugs, and undocumented features
             by David Ellsworth ([e-mail])
                         Created: 1996.02.20
                   Last Modified: 1996.05.06
                   Daily Version: 1


This file can be downloaded from:
ftp://users.aol.com/davidells/TI-Calc/TI_bugs_etc.zip

Even though the version of this file is indicated by a date, I may
update it more than once in one day. If I do, the daily version
number will have a value other than one. The following day, it will
be set back to 1.

I have had a TI-85 for a long time and got a TI-92 at December 25,
1995. I am the type of person to test all aspects of a system
thoroughly, so I have found many bugs and undocumented features in
these calculators. I have listed my finds in this document. I realize
that some of this has already been documented elsewhere, but I want
it to all be listed in one place. The TI-92 information is based on
ROM version 1.3.

This file does not include any in-depth technical info about the
internals TI-85 and TI-92. For the TI-85, comprehensive information
is already available for ZShell programmers. For the TI-92,
information will soon be available; I am working on a machine
language shell for the TI-92 with two other people. When this is
released, we will also release a set of text files on its internals.

---------------------------------------------------------------------

There is a very interesting bug in the TI-85. It exists in all ROM
versions. I found it while I was waiting for TI-Graph Link to arrive
in the mail after I had ordered it; I was planning to use the link to
corrupt memory in various and sundry ways.

But I was impatient, and wanted to find a bug I could use to do
this. Amazingly, I did. I used it to figure out and collect all the
ASCII codes of the TI-85. BTW, when I was doing this I knew nothing
about ZShell or anything else that other people have found about
the TI-85. Anyway, I collected all the unaccessable ASCII characters
and transferred them to another TI-85, then reset mine and
transferred them back. This, needless to say, took a long time, and
would have been much easier using TI-Graph Link, but what can I say?
I was impatient and persistant. At the time, I was fascinated that
the TI-85, a calculator, uses standard ASCII from 32 to 126.

Here are instructions for activating the bug. First, make sure you
have a backup of your TI-85's memory; then reset ALL (optional). Go
into the solver and type " " (a single space) for the equation and
press [ENTER]. This will crosslink the custom menu with the xStat
variable. Go into [CATALOG] and put something in the third position.
Then edit xStat. You will see lots of hexidecimal numbers. You can
get the TI-85 to do all sorts of weird things at this point.

Here is a list of keys that will do the job: (reset all first)

[2nd] [GRAPH] [ALPHA] [(-)] [ENTER] [2nd] [CUSTOM] [F3] [F3] [2nd]
[EXIT] [2nd] [-] [F4] [F1] [ENTER] [down] [down] [down] [EXIT] [2nd]
[-] [F4] [F1] [ENTER] [F1]

Sit back and watch the show. Press [ON] when you have seen enough.

---------------------------------------------------------------------

On the TI-85, there is a bug that allows the NUL character (ASCII 0)
to be created without a link cable. Just use the following script:

 A=<ch>
 Eq>St(A,A)
 sub(A,2,1)->A

Replace <ch> with one of the following characters:

 The "10" character from 10^
 The superscript "x" from xth root
 The ">" character from unit conversions
 The "E" character (the [EE] key)
 One of the "?", "#", "&", "'", "@", "$", "~", or "|" characters
 The upside-down "?" or "!" characters
 Any other character that does not have a token associated with it
  and cannot exist in a variable name

After running that script, the variable "A" will be a one-character
string containing the NUL character.

If you convert "A" to equation with St>Eq, then convert it back to a
string with Eq>St, even stranger things will happen. Here is a script
to create a 51979 byte string that takes up no memory:

 A=<ch>
 Eq>St(A,A)
 sub(A,2,1)->A
 St>Eq(A,A)
 ""->B
 Eq>St(A,A)

When the last line is executed, the memory following the "A" variable
is overwritten with garbage. The "B" variable follows "A" in memory,
so one of the effects of this is that the size of "B" is modified. A
more detailed explanation of what happens is beyond the scope of this
file.

---------------------------------------------------------------------

When I received TI-Graph Link in the mail, I almost immediately
started sending backups, modifying them, and sending them back. I
eventually found out that weird things could be done from the custom
menu. Even later, I found that in fact machine language could be
executed, and spent a long time mapping out all the opcodes by trial
and error. I did not know that the TI-85 had a Z80, but after
mapping out most of the unprefixed opcodes, I had that idea. I
checked out the Z80 text files, and -- lo and behold -- it did have
a Z80 processor! I was flabbergasted, half-upset, and half-overjoyed
that I had spent/wasted all that time mapping out the opcodes. I
wrote some very simple programs, figured out some of the I/O ports,
and made a ROM dump. But I only recently found out that other people
have done this sort of thing with the TI-85, and that there was a
program called ZShell. I was incredibly thrilled when I found this on
the Internet.

---------------------------------------------------------------------

The TI-92 has 32 contrast levels, just like the TI-85. It just
doesn't display the contrast level. When memory is reset or a
backup is restored, the contrast is set to 17/31. There are also
other times that the contrast will be set to an absolute value.

---------------------------------------------------------------------

Taking a battery out while the TI-92 is on will not reset it, as
long as it is waiting for input (not doing calculations). It will
just turn itself off. When you put the battery back in, the TI-92
will turn itself back on and be in the same state it was before.

---------------------------------------------------------------------

Sometimes the TI-92 will crash unexpectedly. I have had no luck in
predicting this or figuring out a script to generate it (except for
one that I will reveal shortly, which uses the self test). When it
does crash, here are some of the messages it gives:

The following errors are displayed at the top center of the screen
in the medium-sized font. Behind the error is a black bar covering
the top line (8 vertical pixels):
  "Illegal Instruction"
  "Address Error"
  "Line 1111 Emulation"

Sometimes, the TI-92 will instead display
  "SYSTEM DEAD, CORRUPT SUPERVISOR STACK"
on the bottom of the screen in the small font.

---------------------------------------------------------------------

Here are some notes on the TI-85 and TI-92 self-tests.

On the TI-85:
[2nd] [MODE] [ALPHA] [S]
The TI-85 will ask "Enter self test?" and give you the ROM version.
Pressing [ENTER] will erase memory and enter the self test. Any
other key will exit. Once you are in the self test, it will count
from 0 forever. It is testing various aspects of the TI-85, such as
ROM and RAM. Press [ON] to interrupt it. On earlier ROM versions,
you must adjust the contrast at this point. You will see 5 different
LCD te st patterns, and then all 32 contrast levels will be tested.
Press any key to cycle through all this, or press [ON] to skip to
the next step. You will see "11". Press all the keys in sequence
according to the codes returned by getky (page 16-13 in the ma
nual). After you're done, it will display "OK". Press any key, and
memory will be reset.

On the TI-92:
Go to the home screen and press [F5] [DIAMOND] [(]. You will see
copyright notices and a ROM version.

If you go into VAR-LINK from the copyright screen and then exit back,
the title bar of the VAR-LINK dialog will remain on the screen. The
menu bar would have been redrawn at that point, but the copyright
screen has no menu bar associated with it.

You can press [S] to go to the self-test. (Actually, you can press
any key that contains an "S", such as [COS] or [SIN]). The contrast
will be set to 13/31. The TI-92 will list a menu of things you can
do. Pressing [Q] will quit this menu and set the con trast to 12/31.
Simply going into this menu with [S] will do strange things to
memory; 3786 bytes will be added to system memory. If that much
memory isn't free, the menu won't be cleared when you press [Q] to
quit it. When you do quit the menu, the bottom dividing line on the
screen will be gone permanently, and will never be redrawn until you
reset the TI-92 or restore a backup.

From the copyright screen, you can also press [R]. This will return
to the home screen and the TI-92 will not respond to any keypresses
(except it will respond to modifiers, shift, diamond, and 2nd). What
is actually going on: the TI-92 is waiting to be controlled by
remote. To control it, send a two-byte word (raw) through the
linking port. The word must be in big-endian format (MSB before
LSB). This word will be interpreted as a key-code (these are listed
starting at page 484 of the manual). For example, 0x0041 is [A] and
0x107 is [CLEAR]. All home screen output will be sent through the
linking port raw. To turn the TI-92 off, either send 0x210B
(diamond-off), take a battery out and put it back in, or wait 5.5
minutes for the TI-92's Auto Power Down to activate. When it is
turned back on, it will no longer be in remote control mode.
However, it will still be sending output to the linking port. To
get out of this "link" mode, go back to the copyright notice and
press [R] again. Staying in the "link" mode will allow you to
cause the TI-92 to crash. Most methods of causing memory to run out
will accomplish this quite well. Here are two examples.

1) Type the following:
 x|x=x

2) Type the following:
 "entry(1)"
 expr(entry(1))
 expr(entry(1))

Variations on this theme will generate different crashes.

---------------------------------------------------------------------

Here are some undocumented getkey() codes:

 [2nd] [Diamond]         [Hand] = 0xF1FE = 61950
                 [Shift] [Hand] = 0x017C = 380
 [2nd]           [Shift] [Hand] = 0x0160 = 352
       [Diamond] [Shift] [Hand] = 0x0036 = 54
 [2nd] [Diamond] [Shift] [Hand] = 0x0180 = 384

     [2nd] [ON] = 0x110B = 4363
 [Diamond] [ON] = 0x210B = 8459

When you are editting a label in the geometry editor, 0x0100..0x01FF
will generate ASCII characters. For example, pressing [Shift] [Hand]
will generate the character "|".

---------------------------------------------------------------------

The cursor keys are treated as a special case by the TI-92. Although
there are 8 getkey() codes listed in the manual, there are only four
hardware switches:

  [Left] = 0x151
    [Up] = 0x152
 [Right] = 0x154
  [Down] = 0x158

When multiple switches are held down, these codes are ORed together.
For example, pressing [Up] [Left] will generate 0x153; this is listed
in the manual. However, if you take apart a TI-92, it becomes
possible to press combinations that would be physically impossible
otherwise. For example, pressing [Left] [Right] will generate 0x155,
a code *not* listed in the manual.

You can hold down more than one modifier while pressing a cursor key.
They are added up as follows:

     [2nd] = 0x1000
 [Diamond] = 0x2000
   [Shift] = 0x4000
    [Hand] = 0x8000

For example, [2nd] [Diamond] [Left] generates 0x3151.

--------------------------------------------------------------------

The two rectangular [ENTER] keys are the same. But the curved one
below the cursor pad is different from these two. If this sounds
strange, try holding down one, pressing another, and releasing the
first one. If the two were the same, only one [ENTER] would be
registered. But if they were different, [ENTER] would be registered
twice.

---------------------------------------------------------------------

To move through a comment or label while editting it, you must use
[Diamond] + an orthogonal cursor key, as said in the manual. As
the following table shows, this actually generates an ASCII character.
If you generate one of these characters yourself through the [CHAR]
menu, it will in fact act as a cursor key.

 [Diamond] [Left]  = char(28)  = set union
 [Diamond] [Right] = char(29)  = set intersection
 [Diamond] [Up]    = char(30)  = is a subset of
 [Diamond] [Down]  = char(31)  = is a member of

If you edit a label using F7:4, [Diamond]+cursor will work as it
should. But there is also another way to edit a label. If you start
typing immediately after creating a point (the point can be part of a
multipoint object) a label will be created. You can only type a 5
character label through this method. But, pressing [Diamond]+cursor
while typing a label this way will generate a character rather than
moving the cursor. Characters will be added at the end of the label
until it reaches 5 characters or you press [ENTER]. You can then
later edit the label with F7:4.

---------------------------------------------------------------------

On the TI-92, strings can be manipulated as numbers. Try typing
  "hello"+"hello"
or
  "hello"*"hello"
or
  "hello"/"hello"

My favorite application of this is using "" (the null string) as a
variable/constant. But you cannot solve an equation for "", since ""
is not a variable.

---------------------------------------------------------------------

Here some TI-92 entries and their corresponding results:

2^(a+b)
  e^(ln(2)*(b+a))

2^(a+b+c)
  2^c*e^(ln(2)*(b+a))

2^(a+b+c+d)
  e^(ln(2)*(d+c))*e^(ln(2)*(b+a))

2^(ln(a)+ln(b)+ln(c))
  c^(ln(2))*b^(ln(2))*a^(ln(2))

2^("a"+"b"+"c")
  2^"a"*e^(ln(2)*("b"+"c"))

2^(ln("a")+ln("b")+ln("c"))
  "a"^(ln(2))*"b"^(ln(2))*"c"^(ln(2))

If Pretty Print is off, all occurences of "e^" will be deleted. If
the result it pasted back, or converted to a string via the function
"string()", the same thing will happen. However, if the result is
used in a calculation, the "e^" will be retained.

From these results, we can deduce the following:

* Given any expression that, when simplified, contains "e^()" with
  multiple terms inside the parentheses, when the expression is
  converted to a string, either by auto-pasting or by the function
  "string()", the "e^" will be deleted.

(pausing to catch my breath)

* If the base is a constant,
 a) the variable exponents will be sorted in descending order
 b) the constant exponents will be sorted in ascending order

* If the base is a variable,
 a) the variable exponents will be sorted in ascending order
 b) the constant exponents will be sorted in descending order

* The exponents will be divided into groups of two, and sorted in
  the same order as they would be otherwise. If there are an odd
  number of exponents, the first one will be placed alone, and the
  "e^(" and "ln(" will cancel each other out.

* You should not place too much confidence in the TI-92's symbolic
  manipulation. ;-)

NOTE: I have been told that this bug was fixed in version 1.5.

---------------------------------------------------------------------

On a TI-92's home screen, typing
  1|1=2
will generate the "Constraint expression invalid" message. However,
you can type
  1|1=x and x=2
The answer will be 2.

---------------------------------------------------------------------

On the TI-92, ans() and entry() are actually macros that are
substituted at compile time, not run time. To prove this, type
something in the home screen that will generate an answer. Write a
program with the single line
  ans()
When you run it, it will compile. Edit it, and you'll find that
ans() was replaced with whatever the last answer was at the time.
To use the answer at run-time, use something such as
  expr("ans()")
Speaking of which, you can use "expr" to execute statements as well
as evaluating expressions.

---------------------------------------------------------------------

There is also another way to edit-lock programs on a TI-92. The
Try...Else...EndTry structure has an alternate syntax (read: bug).
The normal syntax is this:

 :Try
 : [Block 1]
 :Else
 : [Block 2]
 :EndTry

If Block 1 causes an error, the TI-92 jumps to Block 2.
Here is a simplified, but equivalent, version of the same structure:

  Try:[Block 1]:Else:[Block 2]:EndTry

The "alternate" syntax is as follows:

  Try [Block 1]:Else:[Block 2]:EndTry

When this is tokenized by the TI-92, then converted back into text,
everything following the "Try" will disappear.

To edit lock a program, insert the following construction at the
beginning of the program:

  Try Else:EndTry

---------------------------------------------------------------------

On a TI-92, type
  56789:Return 123
from the home screen, preferably in Pretty Print mode. Look at the
strange result. You can replace the numbers with anything you want.
The right side of the first expression will be chopped off according
to the length of the second expression. Various strange things can
be done with this result.

To edit-lock a program, first type
  1:Return 1
from the home screen. Then, create a program and put anything you
want in it. Make sure the first line is
  If false:ans()
After the program is compiled (run), view it from VAR-LINK.
Everything after the "If false:" will seem to be gone, but the
program will still run. When you edit the program, it will
permanently self-destruct. Who needs TI-Graph Link to edit lock a
program?

---------------------------------------------------------------------

The TI-92 cannot integrate some simple expressions. Try
  integ(deriv(e^(x^2+x),x),x)
replacing "integ" and "deriv" and "e^" with their respective
symbols. The integral should cancel the derivative, yielding
"e^(x^2+x)". But instead, the TI-92 returns a result containing
two new, unsolvable integrals. Here is the more general form of a
solvable integral that is unsolvable by the TI-92:
  integ(deriv(e^(f(x)+g(x)),x),x)

---------------------------------------------------------------------

The TI-92 cannot solve some simple equations in exact mode.

Try
  exact(solve(x^2/(x-2)^2=1,x))
It cannnot solve that (the answer is 1). But it can solve
  exact(solve(x^2=(x-2)^2,x))
It can also correctly solve it if you replace "1" with a variable,
like this:
  exact(solve(x^2/(x-2)^2=a,x))

---------------------------------------------------------------------

You can make the TI-92 generate any error message outside a Try...
Else...EndTry construction. Try
  810->errornum:PassErr
replacing "->" with the STO> symbol. The error codes are listed
starting at page 472 of the manual. The undocumented codes are:
  1020-1029: Internal error
  1030-4094: Protected memory violation
  4095-32767: Unknown ERROR code
  0-9 or 32767-65535: (ignored -- no error message)
Where 100-109 means that any number from 100 to 109 will generate
the error. Error numbers are truncated to make the value fall
between 0 and 65535.

---------------------------------------------------------------------

On a TI-92, go to VAR-LINK and view any variable or folder with
[F6]. Turn the TI-92 off with [DIAMOND] [ON]. Turn it back on. The
contents window will disappear.

Press [DIAMOND] [K] to bring up the list of keys. Turn the TI-92 off
with [DIAMOND] [ON]. Turn it back on. The keyboard window will
disappear, but this time the TI-92 will also turn itself off again.

Notice that both the contents window and the keyboard window have
the same border.

---------------------------------------------------------------------

In the TI-92, there is a While...EndWhile loop but there is no built
in Repeat...Until loop. There is a quick way to do it however.
As a replacement for
  Repeat:...:Until x
Use
  Loop:...:If not(x):EndLoop
You do not need to use
  Loop:...:If x:Exit:EndLoop

---------------------------------------------------------------------

This TI-92 bug happens when you are very low in memory. Press [2nd]
[RCL] and then [DIAMOND] [K]. Type something to cancel the keyboard
window, such as [SPACE]. The contents of the "Recall" window will be
erased, and only changes will be updated. This also works for other
windows that ask you to input a string, such as "Save Copy As" and
"New".

---------------------------------------------------------------------

There is a bug in the TI-92's "Send" command. This command is used to
send data to the CBL unit. The data must be in the form of a
numerical list. In normal use, such a list is very small. If you try
to send a list with more than 128 entries, the TI-92 will crash.

---------------------------------------------------------------------