Furby source code - BlueSyncLine

Note: the newer variant of Furbish spelling will be used throughout the article: oo-nye, originally u-nye.

Due to my Furby obsession, I was looking for the source code of the original firmware, supposedly attached to the patent US6544098B1.

According to it, there should have been a microfilm attachment containing the original source listing, however that was nowhere to be found (I even checked the official Web services of the USPTO), so - according to some answers - obtaining a copy probably involved lots and lots of bureaucracy.

I was not ready for that, so I kind of gave up.

But recently, when googling the relevant terms out of sheer boredom, I've discovered a post on bannister.org (apparently, some kind of a MAME forum), where an user named seanriddle said that he did complete the process and has got an actual printed copy.

Immediately, I wrote an e-mail to him and Sean has agreed to scan the document.
He made multiple 30-page scans and eventually published the whole document as a PDF which I uploaded to archive.org (with his permission).

Hardware notes

The first Furby generation used an SPC81A microcontroller from SunPlus, which has an architecture similar to 6502.

A TSP50C04 (also called "TI50C04") produces the speech and also features a 8-bit core, which is used as a coprocessor for IR communication.

The SPC81A only has 128 bytes of RAM and 80KiB of ROM, and has speech synthesis functionality too (but it's unused). Its architecture differs from 6502 in the lack of the Y index register.

In addition to speech synthesis, the TI chip also controls the infrared transmitter (but not the receiver).

Unfortunately, the source code only covers the SPC81A firmware.

Let's look at the code!

The 297-page assembly listing is well-commented, but appears a bit incomplete due to the lack of definitions for some of the labels used, e.g. Name_table.

And before you ask, yes - it does contain some jokes and profanity! :)

The title page claims that the code was notarized via Fitch, Even, Tabin & Flannery.

On the very first actual page of the listing one can see that an incorrect codepage was used to print the text. This code appears to be formatted under DOS (CP437) and then printed with Windows-1252, additionally featuring a mismatch in line width.

By the way, who is Wayne Schulz? His first name is unintelligible here, but it does appear later clearly.

The first interesting comment is to be seen on page A-23:

                
                ; On power up or reset, Furby must go select a new name ,,, ahw how
                cute.

Page A-23: Dave does have a sense of humor :)

                
                Simon3:
                ; do to lack of time I resort to brute force ... YUK....

Page A-60: this is a part of the "Simon says" game. Its code is indeed pretty confusing.

The use of the SBC instruction for comparison is pretty interesting too.

                
                    LDA  HCEL_LO        ; get current
                    STA  IN_DAT         ; reset game sensor counter
                    SBC  #16     ; ck if max number of sensors
                    BCS  Simon4         ;
                    JMP  Simon1         ; loop up
                Simon4:
                    LDA  #16            ; set to max
                    JMP  GS_rentr       ; start next round

Page A-61: why is SBC used here instead of CMP?

                
                Tbl1_Macro117:          ;WIERD SHIT SEE 101

Page A-161: some profanity is eventually going to make way into anything! However, this is the only occurence :)

Conclusion

Every word and action is encoded as a macro of speech commands and motor movement, and tables of those occupy more than a half of the code.

According to a list found on pages A-126/127, there initially were only 15 possible Furby names, this was extended to 24 later.

Here they are (in the order as they appear in the code, the 9 new names are bold):

Name	Meaning in Furbish
Koh-koh	more
Mee-mee	very
Ee-day	good
Doo-moh	please
Toh-dye	done
Boo	no
Toh-loo	like
Ay-tay	hungry
Way-loh	sleep
Oo-tye	up
Ay-loh	sun
Kah	me
Dah	big
Boh-bay	worry
Nah-bah	down
Loo-loo	joke
Ah-may	pet
Noo-loo	happy
May-may	love
May-lah	hug
Dah-noh-lah	big dance
Toh-loo-kah	like me
Kah-dah	me big
May-lah-kah	hug me

A list of the 24 Furby names.

There's a deep sleep mode which was added after the first Furby release, but the code for it seems to be present in the pre-production version!

Apparently, there aren't any easter eggs previously unknown, but the sensor pattern for "Dance" isn't listed in the (incomplete) code.

Easter egg name	Sensor pattern
Fortune teller	Light	Light	Pet
Rap mode	Sound	Sound	Sound	Sound
Hide and seek	Light	Light	Light	Tickle
Simon says	Tickle	Pet	Sound	Light
Burp attack	Feed	Feed	Feed	Pet
Say name	Tickle	Tickle	Tickle	Pet
Twinkle	Sound	Sound	Sound	Pet
Rooster	Light	Light	Light	Pet

The sensor patterns for the easter eggs.

A switch on Furby's belly senses "tickling".
The back switch is for "petting".
"Light" means covering and uncovering Furby's forehead.
"Sound" means a loud sound (e.g. clapping your hands).
"Feeding" is pressing the tongue switch inside the beak.

Thanks to Sean Riddle (seanriddle.com) for scanning and sending me the source code.
Inspired by the Y Combinator discussion.
Looking for a copy of the source code? Click here!
Kah may-may 6502!

Analysis of the Furby source code

Intro

Hardware notes

Let's look at the code!

Conclusion