Broken calculator

[blackjetrock]

Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

[Csaba Tizedes]

(09-02-2017 01:40 PM)blackjetrock Wrote:  Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

[blackjetrock]

(09-02-2017 02:05 PM)Csaba Tizedes Wrote:  

(09-02-2017 01:40 PM)blackjetrock Wrote:  Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

[Csaba Tizedes]

(09-02-2017 03:09 PM)blackjetrock Wrote:  

(09-02-2017 02:05 PM)Csaba Tizedes Wrote:  I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

When I go home I'll make a video and you can see. It's works, but "random" characters appears on the LCD when you type characters.

Csaba

[Alejandro Paz(Germany)]

DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine

[blackjetrock]

(09-03-2017 06:11 AM)Alejandro Paz(Germany) Wrote:  DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine

There's a lot of information on casio calculators here:
http://www.pisi.com.pl/piotr433/

This page has the schematic created by reverse engineering, so there's quite a lot of information about the pins:

http://www.pisi.com.pl/piotr433/fx502sch.pdf

I'm pretty sure that the FX850P uses a different processor. The newer the technology, the harder it is to see the features on the chip as they get smaller and smaller. The older Casios should be OK for viewing, up to the FX880, I'd guess.

I also found this on the hp forums:

(02-26-2017 11:12 PM)jebem Wrote:  Good question on the processor type, Alejandro.

The only source of information on these Casio internal architecture that I'm aware of is from Piotr Piatek.

Apparently these Hitachi or NEC processors from that period are custom designed for the job and are not based on any other common model like the Zilog Z80 or the Intel 4004 or 8080, or the 6502 series.

Crossing that information from Piotr Piatek with some more pictures of Casio internals from other folks like Kyoro and checking the SRAM memory types and interfaces, it seems that there are two main groups of processors concerning the data bus size that may imply a specific ALU size as well.

- 4-bit data bus processors:
HD61747 fx-5500, fx-5200P, fx-4000P, FC-200, PB-120, PB-500,
HD61913 fx-700P
HD61917 PB-700

HD43191 fx-602P, fx-702
HD43108 fx-502P


- 8-bit data bus processors:
HD61700 8-bit PB-1000

HD62002 8-bit fx-603P
HD62076 8-bit SF-9300
HD62021 ?-bit fx-61F
HD62001 ?-bit fx-5000F, fx-3900P

There is a pattern in the naming convention, where the HD61 series are 4-bit (with one exception only for the HD61700) and the HP62 are 8-bit processors.
So this HD62001 Processor is very close to the HD62002 and therefore could be a 8-bit processor.

Additionally, why did Casio use a interface controller between the processor and the SRAM memory on this fx-5000F?
The only cases I'm aware of are to allow a 4-bit processor to access a 8-bit data wide SRAM, or the other way around like in this case, where a 8-bit processor access an HD61914C 4-bit data wide SRAM memory.
(The HD61914C is very well documented and uses a 4-bit data wide bus).

So, probably this Hitachi HD62001 processor uses a 8-bit data bus connected to a HD61914C 1024 4-bit words SRAM thru a OKI M5268V-H1 interface controller that is aggregating SRAM 4-bit data word pairs into 8-bit words to present to the CPU.

I can't find information on the OKI M5268V-H1 either, but looking into the circuit I can see this OKI chip interfacing the SRAM to the Processor.

[Csaba Tizedes]

(09-02-2017 05:57 PM)Csaba Tizedes Wrote:  ... a video ...

[Csaba Tizedes]

(09-02-2017 03:09 PM)blackjetrock Wrote:  I can give you an 602P ... it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

So, check my video, this is clearly shows what is the problem with it.
If you're interested, I'm ready to trade it for something.
Of course we will discuss in private how I will compare the price difference of the two stuffs.

Please send me a private if you're interested and I will send what is interested for me.

Csaba

[Alejandro Paz(Germany)]

Quote:Good question on the processor type, Alejandro.

Ups,

I may have asked twice...

[blackjetrock]

I have taken an fx602p apart and removed the processor chip. It was broken in some way so this wasn't destruction of a working example. I then decapped the chip and photographed it.

I have attached a low-ish resolution photo of it for perusal. I have higher resolution photos for anyone who wants one. Unfortunately it's got some flaws and I'm going to redo the photos sometime. Then, when I have a perfect photo I'm going to have a go at removing th etop layers to see if I can see some ROM contents.
   

[Dan]

Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.

[toml_12953]

(04-24-2018 08:04 AM)Dan Wrote:  Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.

You said it! I know that you have to inspect the image to see which bits are ones and which are zeroes but where do you start and which way do you read them? It's like magic to me!

[blackjetrock]

Well, I have to first find the 0s and 1s, I'm not sure I'll be able to do that, but I'm going to have a go once I have a decent clean die shot of the chip as it is at the moment. I've written a tool that should be able to extract the ROM data (I've used it on another calculator, a Casio HL-802, which has it's ROM data visible without any layer removal). Then, it's a case of unscrambling the bits so they are arranged in the correct order. You can use the circuitry that is visible to do some of this, for instance looking at which address lines go to which rows. Then you have to work out what the data is doing. If there's a well known microcontroller then you're OK as you can hopefully get the instruction set. If the ROM drives a custom state machine though, then you'll have to decode that too. It's early days for me at the moment, I'm still coming to grips with what transistor look like and so on.

If you want to see an example of this then have a look at this page, it's fascinating:

http://files.righto.com/calculator/sincl...lator.html

[hjalfi]

I know this is a little necromantic, but... did anything come of decapping the FX-602?

I have an FX-805P which I'm going to attempt to reverse engineer; I'm hoping to be able to extract the internal ROM by watching the bus with a signal analyser; but if someone has an actual ROM dump that would of course be preferable!

[blackjetrock]

No, the 602 decapping hasn't moved on. I think I need to remove the top layer(s) in order to see the bit patterns and I don't have equipment to do that. I don't want to use acids so may try lapping the die, which will need some equipment to perform.
I have, however, been capturing the ROM contents of a Rockwell 920, using a processor attached to the ROM bus. This sounds similar to what you are trying to do with the Casio (do you mean 805P? or 850?). I am using a Blue Pill and some voltage dividers. I also used a Blue Pill to sniff the display bus on a Casio FX-702P, that is also similar. It was much harder reverse engineering the protocol on that device. There's similar projects and information on this web site:

http://www.pisi.com.pl/piotr433/

Some links to my attempts:

https://www.youtube.com/watch?v=pDH0wQUhD8w&t=16s
https://www.youtube.com/watch?v=PFEQpZJrdY4&t=823s
https://trochilidae.blogspot.com/2020/12...00khz.html

I've also decapped one of the chips in a CQ-1, but that is a whole different story.

Regards
Andrew

[hjalfi]

Er, yes, FX-850P. Sorry!

I have a PSoC5 development board, which is a 5V ARM with a mini FPGA attached; it has a million GPIO ports and should be relatively easily modifiable into a bus snooper and ROM/RAM emulator. Of course, as it's Harvard architecture with separate code and data address spaces there's no guarantee that I'll see code accesses on the external bus, but it's worth a try. I've found a reference in the short-lived Poche Computers magazine that the HD62002 has 20kB of code ROM, so if I'm very very lucky I can force the CPU to jump to an unused part of the code ROM and use the PSoC to simulate my own ROM code...

Thanks for the links; your videos are really interesting. I knew about Piotr Piatek and had dropped him a note, as I'm curious about how he managed to read 16-bit instruction words from an 8-bit bus. I'll see what he says.

[blackjetrock]

I think your main problem will be the speed of the processor. the Rockwell has a clock speed of 200kHz and the Blue pill runs at 48MHz and it just has time to capture the bus. On the 850 I suspect the bus speed is a lot higher and you will need a processor clock speed much higher. I have used an STM32 with a clock speed of 400MHz or so, but even then you may not be able to sample an 8MHz bus,m for example.
If there's an external ROM chip then desoldering it is an option. Also, if the processor has a halt or bus request line then you could take over the bus and read the ROM contents that way. Another way to snoop the bus is to use a logic analyser, I've done that too, but you do need a logic analyser. An FPGA is another way, that is much faster.

Regards
Andrew