Reverse Engineering a Sharp CE-160 Cartridge

I wanted to make a small tutorial on how to reverse engineer old PCBs, in this case how to trace the vias of a Sharp CE-160 cartridge.Disassembly of a Sharp CE-160 cartridge

Disassembled Sharp CE-160 cartridgeAfter disassembling I’ve made photos of both sides of the cartridge:

Sharp CE-160 - Top layerSharp CE-160 - Bottom layer

The following step was inspired by an EEVBlog tutorial on reverse engineering a Rigol DS1054Z. The two photos were then aligned (photoshopped) to fit onto each other when printed. One of the two layers needed to be mirrored, and it took a bit to align all vias. Luckily the two photos was taken with a tripod from the same angle. The result was printed onto plastic photocopy foil.

Sharp CE-160 - Top and bottom layer overlay Sharp CE-160 - Printed top and bottom layer overlayThis allows tracing the routes from both sides, including the vias.

In some cases traces were hidden under chips or other parts. I used my multimeter (set to measuring resistance) and needle pin tips to trace them:

Tracing Sharp CE-160 tracks with needle-tip probes

4 thoughts on “Reverse Engineering a Sharp CE-160 Cartridge

  1. Hi Kai,

    very interesting work. I do have two CE-160 with empty batteries. As the CE-160 is RAM ist would be nice to rework them into something like a CE-159 8K-RAM.

    As it is ram, my first thought was that the r/w-signal ig gated thru a 7400 or something like that and that signal is set only bei the CE-165 to programm the ce-160. But nope, the 4008 seems to be a 4-bit adder. And the 2nd 138?…

    So it would be kewl to reengineer the schematics of the ttls. I would like to do that and it would save me a lot of work if you could provide both pcb pictures of the front and the back, so that wire-tracing can be done.

  2. It looks a lot like the CE-159, without the size select and read-only switch. From the schematics in the ce-159 service manual I found on, it looks like the r/w line was moved from pin 39 to pin 21. My guess is the ce-165w uses pin 21 for programing. The PC-1500 service manual shows it as a ground.

  3. Ok, so I cut the ce-160’s r/w line from pin 21 (pc-1500’s gnd) and rerouted it to pin 39 (previous not connected on the ce-160, pc-1500’s r/w). It’s… odd. It still maps to 0000-1fff, and poke-n-peek shows it’s read/write- until it overwrites the program. It looks like basic user ram starts in the lowest r/w memory available. MEM and STATUS 0 both show 7994 after new. LIST is very upset, seems to be acting on the contents of &4000+ (this is on a 1500a). Up and down arrows step through the program properly. Running programs seems to work fine. STATUS 3 (shows top of BASIC user ram, bottom of variable storage) shows 8192.
    Poke-n-peek &4000+ works, and doesn’t overwrite itself. Not sure how useful this is, with the big hole between &2000 and &4000 the only way to reach it is peek and poke, or machine code. Could work up something for variable storage….

  4. Hi, were you able to derive a schematic for this module? I was able to find one just recently. From reading comments above the memory mapping seems odd.

    BTW, also thank you for the break out board. I was able to use it, to run code from an external EPROM mapped into the CE-150 address space. I am now working on disassembling the CE-158 ROM, boy what a mess that it is.

Leave a Reply

Your email address will not be published.