Reverse Engineering: PC1031-0B Part 3

In Part 2, we confirmed the PCB connections but now we need to confirm the connections going out from the shift registers IC1, IC2 and IC3. Figure 1 illustrates the scratched out notes from tracings between each of the shift register's outputs and their destination.

Figure 1. Scratched out mapping of shift register bits.

Basically these are three columns of 8 bits (in rows). The first bits traced were the /WR signals to each LED module. These clock data into each module.  Then I traced from the DLG module sockets to the shift registers for D0 through to D5. D6 proved to be a bit of a mystery at the time. More about this later.

Then all that remained were the push button LEDs, which were simply marked in groups (the push buttons and corresponding LEDs were least important to me at the time).

This permitted the mapping of bits in C/C++ using the bitfield feature:

 struct  {

     uint32_t   wr03 : 4;    // /WR0..3 (LSB)

     uint32_t   led03 : 4;   // /LED0..3

     uint32_t   d3 : 1;      // D3

     uint32_t   d2 : 1;      // D2

     uint32_t   d1 : 1;

     uint32_t   d0 : 1;

     uint32_t   led47 : 4;   // /LED4..7

     uint32_t   d5 : 1;      // D5

     uint32_t   d4 : 1;      // D4

     uint32_t   a1 : 1;      // A1

     uint32_t   a0 : 1;      // A0

     uint32_t   wr47 : 4;    // /WR4..7

     uint32_t   d6 : 1;      // D6

     uint32_t   fill : 7;    // MSB

};

The bit assignments are from least significant bit to most significant bit. On the AVR platform this is is little endian sequence (I will be using the ATmega328P for my testing). The bit field d6 was added as bit 25, which will be discussed shortly. The field marked fill just rounds it up to 32 bits and is not used.

Figure 2 shows the traced D6 back to pin 3

Figure 2. D6 traced back to IC4 (CD4001)

Later on, when I did find a schematic for this, that particular schematic simply had input pin 2 of IC4 grounded, effectively sending an inverted D5 to D6. With the voltage divider in my version of the PCB, there looked like there was some trick involved (which I never got to work). With both CP and STR high, D6 would by high. If D5 was low, and either CP or STR were low, then D6 would be high. Either way, with D5 influencing D6, it was impossible to get the whole character set from the display.

Full Character Set

The remainder of IC4 is unused. So to obtain the full character set control, I simply removed IC4 from its socket (it is otherwise unused).  Then I figured out that I could wire D6 directly up to IC3 (CD4094), pin 10, which is that chip's QS2 output.

Figure 3 illustrates the logic diagram view of the CD4094. There is one additional latch after QP7, which holds an extra bit until CP goes low. Since each bit clocks in on the low to high transition, QS2 will hold a QP8 so to speak, until the CP signal goes low again. On the falling edge of CP, QS2 will reflect the same logic level as QP7. 

Figure 3. NXP's logic diagram for CD4094 (IC3)

The important part of QS2 here though, is that while the CP signal remains high, it holds an extra bit. Given that IC3 provides the last 8 bits (of 24), QS2 provides the 25th bit.

The AVR code then sends the 25th bit first, so that it shows up at QS2 after the other 24 "command word" bits are shifted out.

LED Driver Bits

It was later traced for the struct presented earlier, members led03 and led47 drive the LEDs for the push buttons in the following way-- least significant bit in led03 drove the left most button LED. Starting with the least significant bit of led47, drove the 5th through 8th LEDs. Using the AVR code to test, it was discovered that the LEDs are lit when these bits are zeros (the LED anodes were wired to +5V).