PB686 CMOS is 64 bytes: 40h to 7Fh alias 00h to 3Fh

Revised 2026-10-25. Applies to: Packard Bell PB686, TI TACT82000 chipset; read 2026-09-02 and 2026-09-11 under the original Phoenix 3.10 BIOS with MS-DOS DEBUG scripts

The Packard Bell PB686 has 64 bytes of CMOS and no more. If you select index 40h through 7Fh at port 70h, you get the same registers as 00h through 3Fh: reading 4Eh gives you 0Eh, 6Eh gives you the checksum byte at 2Eh, and so on. The RTC ignores bit 6 of the index. There's no extended CMOS bank on this board, so anything that treats 40h to 7Fh as spare storage is really overwriting the clock, the configuration bytes and the checksum.

Applies to

• Packard Bell PB686, TI TACT82000 chipset. See PB686 chipset: TI TACT82301, 82302 and 82303, not Chips and Technologies.
• Read on 2026-09-02 and again on 2026-09-11, both times with the board's original Phoenix ROM BIOS PLUS 3.10 fitted. Address decoding is hardware, so the BIOS shouldn't change it.
• Tool: MS-DOS DEBUG, driven by a script of o 70 / i 71 pairs.
• Indices above 7Fh were not tested, so I can't tell you what they do.

Evidence

• Measured on real hardware [I] (measured on real hardware), twice, on separate boots nine days apart, each time against a separate read of 00h to 3Fh taken minutes or seconds apart in the same session. On 2026-09-02 all five sampled pairs matched (0Dh, 0Eh, 10h, 12h, 14h against 4Dh, 4Eh, 50h, 52h, 54h). On 2026-09-11 the non-clock indices matched; the fourteen written up include the checksum pair 2Eh/2Fh (0D 57) against 6Eh/6Fh.
• The clock settles it [I] (measured on real hardware). Indices 40h to 49h, read as if they were the clock registers, gave the time of day. On 2026-09-02 that was 14:52:04 on 2 September 2026, and on 2026-09-11 it was 18:16:07 on 11 September 2026, which matched the timestamps of the files written in the same run. A separate bank of RAM wouldn't hold the running clock.
• The method only reads. The script selects an index at port 70h and reads port 71h; it never writes port 71h.
• The checksum covers 10h to 2Dh [I] (measured on real hardware), stored at 2Eh/2Fh. Checked on the PB686 on 2026-09-12: the stored 0D 57 matched the computed sum. That range is also the standard AT layout [D] (documented only, not measured).
• 64 bytes is what a Motorola MC146818A holds: 14 bytes of clock and control registers and 50 bytes of general RAM [D] (documented only, not measured). I have no datasheet for the PB686's RTC, so "behaves like a 64-byte MC146818A" is as far as I can go.

One side effect to know about. Because 4Ch is really 0Ch, reading index 4Ch reads RTC Register C, and on an MC146818A reading Register C clears every pending interrupt flag [D] (documented only, not measured). The 2026-09-02 sweep did exactly that without meaning to: 4Ch read 50, so two flags were pending and that read cleared them. It was harmless here, but a probe that only meant to look at "extended CMOS" was touching the clock's interrupt state.

Check it yourself

You need DOS and DEBUG. This only reads.

1. Read a low index and its alias: o 70 8e, i 71, then o 70 ce, i 71. The first pair reads 0Eh and the second reads 4Eh. Setting bit 7 of the index (the 8 in 8e and the c in ce) masks NMI while you read; my extended-CMOS script set it on every index. On the PB686 both reads give the same value.
2. Repeat for a few more pairs, for example 10h/50h and 2Eh/6Eh (o 70 90/o 70 d0, o 70 ae/o 70 ee).
3. For the convincing version, read 40h, 42h and 44h (o 70 c0, o 70 c2, o 70 c4, each followed by i 71) and compare them with the seconds, minutes and hours on your clock. If they show the current time, 40h is the clock.
4. Avoid 4Ch unless you mean to: it reads Register C and clears its flags.
5. Finish with o 70 0d and i 71, which leaves the index on Register D with NMI unmasked. My script ends the same way.

On a board with a real extended bank, the reads in steps 1 and 2 would usually differ, and step 3 would not show the time.

Sources

• Motorola, MC146818A Real-Time Clock Plus RAM datasheet (1984), public copy: https://www.scs.stanford.edu/10wi-cs140/pintos/specs/mc146818a.pdf. Page 1 gives the 64 locations (14 clock and control, 50 general purpose). The interrupt section says reading Register C clears its flags.

Revised

2026-10-25.

Revision log:

• 2026-10-25: first version.

Wrong about something? Tell me at [email protected].

Index of /library/