+- HP Forums (https://www.hpmuseum.org/forum)
+-- Forum: Not HP Calculators (/forum-7.html)
+--- Forum: Not remotely HP Calculators (/forum-9.html)
+--- Thread: Broken calculator (/thread-8966.html)
Broken calculator - blackjetrock - 09-02-2017 01:40 PM
Hi,
I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?
Andrew
RE: Broken calculator - Csaba Tizedes - 09-02-2017 02:05 PM
(09-02-2017 01:40 PM)blackjetrock Wrote: Hi,
I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?
Andrew
I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)
Csaba
RE: Broken calculator - blackjetrock - 09-02-2017 03:09 PM
(09-02-2017 02:05 PM)Csaba Tizedes Wrote:(09-02-2017 01:40 PM)blackjetrock Wrote: Hi,
I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?
Andrew
I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)
Csaba
What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.
RE: Broken calculator - Csaba Tizedes - 09-02-2017 05:57 PM
(09-02-2017 03:09 PM)blackjetrock Wrote:(09-02-2017 02:05 PM)Csaba Tizedes Wrote: I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)
Csaba
What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.
When I go home I'll make a video and you can see. It's works, but "random" characters appears on the LCD when you type characters.
Csaba
RE: Broken calculator - Alejandro Paz(Germany) - 09-03-2017 06:11 AM
DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine
RE: Broken calculator - blackjetrock - 09-03-2017 09:37 AM
(09-03-2017 06:11 AM)Alejandro Paz(Germany) Wrote: DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine
There's a lot of information on casio calculators here:
http://www.pisi.com.pl/piotr433/
This page has the schematic created by reverse engineering, so there's quite a lot of information about the pins:
http://www.pisi.com.pl/piotr433/fx502sch.pdf
I'm pretty sure that the FX850P uses a different processor. The newer the technology, the harder it is to see the features on the chip as they get smaller and smaller. The older Casios should be OK for viewing, up to the FX880, I'd guess.
I also found this on the hp forums:
(02-26-2017 11:12 PM)jebem Wrote: Good question on the processor type, Alejandro.
The only source of information on these Casio internal architecture that I'm aware of is from Piotr Piatek.
Apparently these Hitachi or NEC processors from that period are custom designed for the job and are not based on any other common model like the Zilog Z80 or the Intel 4004 or 8080, or the 6502 series.
Crossing that information from Piotr Piatek with some more pictures of Casio internals from other folks like Kyoro and checking the SRAM memory types and interfaces, it seems that there are two main groups of processors concerning the data bus size that may imply a specific ALU size as well.
- 4-bit data bus processors:
HD61747 fx-5500, fx-5200P, fx-4000P, FC-200, PB-120, PB-500,
HD61913 fx-700P
HD61917 PB-700
HD43191 fx-602P, fx-702
HD43108 fx-502P
- 8-bit data bus processors:
HD61700 8-bit PB-1000
HD62002 8-bit fx-603P
HD62076 8-bit SF-9300
HD62021 ?-bit fx-61F
HD62001 ?-bit fx-5000F, fx-3900P
There is a pattern in the naming convention, where the HD61 series are 4-bit (with one exception only for the HD61700) and the HP62 are 8-bit processors.
So this HD62001 Processor is very close to the HD62002 and therefore could be a 8-bit processor.
Additionally, why did Casio use a interface controller between the processor and the SRAM memory on this fx-5000F?
The only cases I'm aware of are to allow a 4-bit processor to access a 8-bit data wide SRAM, or the other way around like in this case, where a 8-bit processor access an HD61914C 4-bit data wide SRAM memory.
(The HD61914C is very well documented and uses a 4-bit data wide bus).
So, probably this Hitachi HD62001 processor uses a 8-bit data bus connected to a HD61914C 1024 4-bit words SRAM thru a OKI M5268V-H1 interface controller that is aggregating SRAM 4-bit data word pairs into 8-bit words to present to the CPU.
I can't find information on the OKI M5268V-H1 either, but looking into the circuit I can see this OKI chip interfacing the SRAM to the Processor.
RE: Broken calculator - Csaba Tizedes - 09-03-2017 10:11 AM
(09-02-2017 05:57 PM)Csaba Tizedes Wrote: ... a video ...
RE: Broken calculator - Csaba Tizedes - 09-03-2017 12:47 PM
(09-02-2017 03:09 PM)blackjetrock Wrote: I can give you an 602P ... it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.
So, check my video, this is clearly shows what is the problem with it.
If you're interested, I'm ready to trade it for something.
Of course we will discuss in private how I will compare the price difference of the two stuffs.
Please send me a private if you're interested and I will send what is interested for me.
Csaba
RE: Broken calculator - Alejandro Paz(Germany) - 09-04-2017 05:25 AM
Quote:Good question on the processor type, Alejandro.
Ups,
I may have asked twice...
RE: Broken calculator - blackjetrock - 04-22-2018 12:00 PM
I have taken an fx602p apart and removed the processor chip. It was broken in some way so this wasn't destruction of a working example. I then decapped the chip and photographed it.
I have attached a low-ish resolution photo of it for perusal. I have higher resolution photos for anyone who wants one. Unfortunately it's got some flaws and I'm going to redo the photos sometime. Then, when I have a perfect photo I'm going to have a go at removing th etop layers to see if I can see some ROM contents.
[attachment=5849]
RE: Broken calculator - Dan - 04-24-2018 08:04 AM
Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.
RE: Broken calculator - toml_12953 - 04-24-2018 09:52 AM
(04-24-2018 08:04 AM)Dan Wrote: Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.
You said it! I know that you have to inspect the image to see which bits are ones and which are zeroes but where do you start and which way do you read them? It's like magic to me!
RE: Broken calculator - blackjetrock - 04-25-2018 07:22 PM
Well, I have to first find the 0s and 1s, I'm not sure I'll be able to do that, but I'm going to have a go once I have a decent clean die shot of the chip as it is at the moment. I've written a tool that should be able to extract the ROM data (I've used it on another calculator, a Casio HL-802, which has it's ROM data visible without any layer removal). Then, it's a case of unscrambling the bits so they are arranged in the correct order. You can use the circuitry that is visible to do some of this, for instance looking at which address lines go to which rows. Then you have to work out what the data is doing. If there's a well known microcontroller then you're OK as you can hopefully get the instruction set. If the ROM drives a custom state machine though, then you'll have to decode that too. It's early days for me at the moment, I'm still coming to grips with what transistor look like and so on.
If you want to see an example of this then have a look at this page, it's fascinating:
http://files.righto.com/calculator/sinclair_scientific_simulator.html
RE: Broken calculator - hjalfi - 05-02-2021 10:18 PM
I know this is a little necromantic, but... did anything come of decapping the FX-602?
I have an FX-805P which I'm going to attempt to reverse engineer; I'm hoping to be able to extract the internal ROM by watching the bus with a signal analyser; but if someone has an actual ROM dump that would of course be preferable!
RE: Broken calculator - blackjetrock - 05-03-2021 10:34 AM
No, the 602 decapping hasn't moved on. I think I need to remove the top layer(s) in order to see the bit patterns and I don't have equipment to do that. I don't want to use acids so may try lapping the die, which will need some equipment to perform.
I have, however, been capturing the ROM contents of a Rockwell 920, using a processor attached to the ROM bus. This sounds similar to what you are trying to do with the Casio (do you mean 805P? or 850?). I am using a Blue Pill and some voltage dividers. I also used a Blue Pill to sniff the display bus on a Casio FX-702P, that is also similar. It was much harder reverse engineering the protocol on that device. There's similar projects and information on this web site:
http://www.pisi.com.pl/piotr433/
Some links to my attempts:
https://www.youtube.com/watch?v=pDH0wQUhD8w&t=16s
https://www.youtube.com/watch?v=PFEQpZJrdY4&t=823s
https://trochilidae.blogspot.com/2020/12/reverse-engineering-at-17v-and-200khz.html
I've also decapped one of the chips in a CQ-1, but that is a whole different story.
Regards
Andrew
RE: Broken calculator - hjalfi - 05-03-2021 01:48 PM
Er, yes, FX-850P. Sorry!
I have a PSoC5 development board, which is a 5V ARM with a mini FPGA attached; it has a million GPIO ports and should be relatively easily modifiable into a bus snooper and ROM/RAM emulator. Of course, as it's Harvard architecture with separate code and data address spaces there's no guarantee that I'll see code accesses on the external bus, but it's worth a try. I've found a reference in the short-lived Poche Computers magazine that the HD62002 has 20kB of code ROM, so if I'm very very lucky I can force the CPU to jump to an unused part of the code ROM and use the PSoC to simulate my own ROM code...
Thanks for the links; your videos are really interesting. I knew about Piotr Piatek and had dropped him a note, as I'm curious about how he managed to read 16-bit instruction words from an 8-bit bus. I'll see what he says.
RE: Broken calculator - blackjetrock - 05-03-2021 04:16 PM
I think your main problem will be the speed of the processor. the Rockwell has a clock speed of 200kHz and the Blue pill runs at 48MHz and it just has time to capture the bus. On the 850 I suspect the bus speed is a lot higher and you will need a processor clock speed much higher. I have used an STM32 with a clock speed of 400MHz or so, but even then you may not be able to sample an 8MHz bus,m for example.
If there's an external ROM chip then desoldering it is an option. Also, if the processor has a halt or bus request line then you could take over the bus and read the ROM contents that way. Another way to snoop the bus is to use a logic analyser, I've done that too, but you do need a logic analyser. An FPGA is another way, that is much faster.
Regards
Andrew