I wanted to make a small tutorial on how to reverse engineer old PCBs, in this case how to trace the vias of a Sharp CE-160 cartridge.
After disassembling I’ve made photos of both sides of the cartridge:
The following step was inspired by an EEVBlog tutorial on reverse engineering a Rigol DS1054Z. The two photos were then aligned (photoshopped) to fit onto each other when printed. One of the two layers needed to be mirrored, and it took a bit to align all vias. Luckily the two photos was taken with a tripod from the same angle. The result was printed onto plastic photocopy foil.
This allows tracing the routes from both sides, including the vias.
In some cases traces were hidden under chips or other parts. I used my multimeter (set to measuring resistance) and needle pin tips to trace them:
Hi Kai,
very interesting work. I do have two CE-160 with empty batteries. As the CE-160 is RAM ist would be nice to rework them into something like a CE-159 8K-RAM.
As it is ram, my first thought was that the r/w-signal ig gated thru a 7400 or something like that and that signal is set only bei the CE-165 to programm the ce-160. But nope, the 4008 seems to be a 4-bit adder. And the 2nd 138?…
So it would be kewl to reengineer the schematics of the ttls. I would like to do that and it would save me a lot of work if you could provide both pcb pictures of the front and the back, so that wire-tracing can be done.
It looks a lot like the CE-159, without the size select and read-only switch. From the schematics in the ce-159 service manual I found on pc1500.info, it looks like the r/w line was moved from pin 39 to pin 21. My guess is the ce-165w uses pin 21 for programing. The PC-1500 service manual shows it as a ground.
Ok, so I cut the ce-160’s r/w line from pin 21 (pc-1500’s gnd) and rerouted it to pin 39 (previous not connected on the ce-160, pc-1500’s r/w). It’s… odd. It still maps to 0000-1fff, and poke-n-peek shows it’s read/write- until it overwrites the program. It looks like basic user ram starts in the lowest r/w memory available. MEM and STATUS 0 both show 7994 after new. LIST is very upset, seems to be acting on the contents of &4000+ (this is on a 1500a). Up and down arrows step through the program properly. Running programs seems to work fine. STATUS 3 (shows top of BASIC user ram, bottom of variable storage) shows 8192.
Poke-n-peek &4000+ works, and doesn’t overwrite itself. Not sure how useful this is, with the big hole between &2000 and &4000 the only way to reach it is peek and poke, or machine code. Could work up something for variable storage….
Hi, were you able to derive a schematic for this module? I was able to find one just recently. From reading comments above the memory mapping seems odd.
BTW, also thank you for the break out board. I was able to use it, to run code from an external EPROM mapped into the CE-150 address space. I am now working on disassembling the CE-158 ROM, boy what a mess that it is.