Broken calculator

[blackjetrock]

Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

[Csaba Tizedes]

(09-02-2017 01:40 PM)blackjetrock Wrote:  Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

[blackjetrock]

(09-02-2017 02:05 PM)Csaba Tizedes Wrote:  

(09-02-2017 01:40 PM)blackjetrock Wrote:  Hi,

I'm looking for a source of a broken calculator, preferably a casio fx-502p. My aim is to decap the processor and hopefully extract the program that it runs. I have two fx-502ps, but both of them work and it seems criminal to destroy one in order to do this. Does anyone have a completely broken 502p?

Andrew

I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

[Csaba Tizedes]

(09-02-2017 03:09 PM)blackjetrock Wrote:  

(09-02-2017 02:05 PM)Csaba Tizedes Wrote:  I can give you an 602P with a strange behaviour if you give me an 502P (or something similar - eg. an HP35s, HP10C, HP41 Time Module, Suunto Vector (workable but scratched is OK) etc...)

Csaba

What strange behaviour is it showing? It sounds like it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

When I go home I'll make a video and you can see. It's works, but "random" characters appears on the LCD when you type characters.

Csaba

[Alejandro Paz(Germany)]

DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine

[blackjetrock]

(09-03-2017 06:11 AM)Alejandro Paz(Germany) Wrote:  DO you have any specifics on the processor used by these machines ? Is it similar to say the one in a FX-850P ? I know it is a later machine

There's a lot of information on casio calculators here:
http://www.pisi.com.pl/piotr433/

This page has the schematic created by reverse engineering, so there's quite a lot of information about the pins:

http://www.pisi.com.pl/piotr433/fx502sch.pdf

I'm pretty sure that the FX850P uses a different processor. The newer the technology, the harder it is to see the features on the chip as they get smaller and smaller. The older Casios should be OK for viewing, up to the FX880, I'd guess.

I also found this on the hp forums:

(02-26-2017 11:12 PM)jebem Wrote:  Good question on the processor type, Alejandro.

The only source of information on these Casio internal architecture that I'm aware of is from Piotr Piatek.

Apparently these Hitachi or NEC processors from that period are custom designed for the job and are not based on any other common model like the Zilog Z80 or the Intel 4004 or 8080, or the 6502 series.

Crossing that information from Piotr Piatek with some more pictures of Casio internals from other folks like Kyoro and checking the SRAM memory types and interfaces, it seems that there are two main groups of processors concerning the data bus size that may imply a specific ALU size as well.

- 4-bit data bus processors:
HD61747 fx-5500, fx-5200P, fx-4000P, FC-200, PB-120, PB-500,
HD61913 fx-700P
HD61917 PB-700

HD43191 fx-602P, fx-702
HD43108 fx-502P


- 8-bit data bus processors:
HD61700 8-bit PB-1000

HD62002 8-bit fx-603P
HD62076 8-bit SF-9300
HD62021 ?-bit fx-61F
HD62001 ?-bit fx-5000F, fx-3900P

There is a pattern in the naming convention, where the HD61 series are 4-bit (with one exception only for the HD61700) and the HP62 are 8-bit processors.
So this HD62001 Processor is very close to the HD62002 and therefore could be a 8-bit processor.

Additionally, why did Casio use a interface controller between the processor and the SRAM memory on this fx-5000F?
The only cases I'm aware of are to allow a 4-bit processor to access a 8-bit data wide SRAM, or the other way around like in this case, where a 8-bit processor access an HD61914C 4-bit data wide SRAM memory.
(The HD61914C is very well documented and uses a 4-bit data wide bus).

So, probably this Hitachi HD62001 processor uses a 8-bit data bus connected to a HD61914C 1024 4-bit words SRAM thru a OKI M5268V-H1 interface controller that is aggregating SRAM 4-bit data word pairs into 8-bit words to present to the CPU.

I can't find information on the OKI M5268V-H1 either, but looking into the circuit I can see this OKI chip interfacing the SRAM to the Processor.

[Csaba Tizedes]

(09-02-2017 05:57 PM)Csaba Tizedes Wrote:  ... a video ...

[Csaba Tizedes]

(09-02-2017 03:09 PM)blackjetrock Wrote:  I can give you an 602P ... it's not totally dead and I don't want to destroy any of these machines unless they are utterly dead.

So, check my video, this is clearly shows what is the problem with it.
If you're interested, I'm ready to trade it for something.
Of course we will discuss in private how I will compare the price difference of the two stuffs.

Please send me a private if you're interested and I will send what is interested for me.

Csaba

[Alejandro Paz(Germany)]

Quote:Good question on the processor type, Alejandro.

Ups,

I may have asked twice...

[blackjetrock]

I have taken an fx602p apart and removed the processor chip. It was broken in some way so this wasn't destruction of a working example. I then decapped the chip and photographed it.

I have attached a low-ish resolution photo of it for perusal. I have higher resolution photos for anyone who wants one. Unfortunately it's got some flaws and I'm going to redo the photos sometime. Then, when I have a perfect photo I'm going to have a go at removing th etop layers to see if I can see some ROM contents.
   

[Dan]

Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.

[toml_12953]

(04-24-2018 08:04 AM)Dan Wrote:  Wow, that's cool. But how does one actually go about extracting the program from that image? Seems really difficult.

You said it! I know that you have to inspect the image to see which bits are ones and which are zeroes but where do you start and which way do you read them? It's like magic to me!

[blackjetrock]

Well, I have to first find the 0s and 1s, I'm not sure I'll be able to do that, but I'm going to have a go once I have a decent clean die shot of the chip as it is at the moment. I've written a tool that should be able to extract the ROM data (I've used it on another calculator, a Casio HL-802, which has it's ROM data visible without any layer removal). Then, it's a case of unscrambling the bits so they are arranged in the correct order. You can use the circuitry that is visible to do some of this, for instance looking at which address lines go to which rows. Then you have to work out what the data is doing. If there's a well known microcontroller then you're OK as you can hopefully get the instruction set. If the ROM drives a custom state machine though, then you'll have to decode that too. It's early days for me at the moment, I'm still coming to grips with what transistor look like and so on.

If you want to see an example of this then have a look at this page, it's fascinating:

http://files.righto.com/calculator/sincl...lator.html