Close
0%
0%

Brother Super PowerNote Reverse Engineering

Can we turn a cheap 90s word processor into a CP/M laptop?

Similar projects worth following
Reverse engineering a Z180 powered word processor from the mid 1990s. Inspired by a similar project that ported a CP/M clone to an old Brother typewriter with similar hardware.

Last week I saw a post on Reddit where somebody successfully ported a CP/M clone they wrote to run on of all things a typewriter.  This caused me to remember that the same manufacturer produced a line of laptop form factor word processors.  A 1990s word processor with all its software built into mask ROM wouldn't normally be too exciting, but the specifications of this piece of hardware could actually make for a pretty nice CP/M portable:

  • Bitmapped LCD display at 640 x 200 resolution
  • Serial and parallel ports built in
  • 1.44 MB floppy drive
  • Internal battery
  • Some quantity (at least 32KB) of RAM
  • A lot lighter than a Kaypro or Osborne

  • What's in the box?

    Lincoln R.02/15/2020 at 06:23 1 comment

    Before we try writing code, it makes sense to figure out what we can learn about the hardware we're dealing with.  A good first start is to look at the motherboard and see what chips and other interesting components are there.  Fortunately it's pretty easy to get to the board, just remove 3 screws from the bottom of the machine and lift the keyboard out.  Below is a close-up photo of the main interesting part of the PCB, the rest of it mostly seems to be power electronics, passive components, and jacks.

    Helpfully, Brother actually put the full part numbers of some of the smaller chips on the silkscreen.  There's a piezo speaker, and the Tetris game on floppy disk is capable of playing some simple music, so we know the hardware is capable of more than just fixed-frequency beeps.  The ROM is a small 32 pin SOIC but there are unpopulated pads for a 32 pin DIP labeled "8M ROM", perhaps some models used a DIP ROM instead of the SOIC or DIP EPROMs were used in development.  The large gray ribbon cable goes to the floppy drive, the small thin one is for the keyboard.

    The largest chip is a Hitachi HG62F33R32FH UC2836-A.  You might expect this to be the CPU, but a quick search reveals it to be a semi-custom CMOS gate array.  Given how few other chips are in the board I suspect this chip handles a lot of "glue logic", possibly interfacing to the LCD and keyboard, etc.  Since this is a custom gate array the datasheet doesn't tell us much other than that the gate count is 3,297 and 128 pins are available for I/O since this is the 136 pin version of the chip.  Figuring out exactly what's implemented in this would be difficult to impossible without trying to decap the chip, but that is destructive and time intensive, and something I don't have the tools for.  We can probably figure out the important bits by tracing pins and looking at firmware.

    To the left of the gate array is a Hitachi HD64180RF6X - This is the CPU.  It's a 6 MHz Z80 derivative with a few handy built-in peripherals:  Two UARTs, an MMU supporting up to 1 megabyte of memory, a two-channel DMA controller, a two-channel "programmable reload timer for output wave generation", and a few other interesting goodies.  Maybe one of those programmable timers is being used as the audio output?  We could probably detect that by looking for writes to the I/O ports for the timers in something that we know plays music.

    Other components of note include:

    • HD63266F floppy controller.  I couldn't find a full datasheet for this but the floppy drive is a standard 34 pin PC drive so it's probably similar to a PC floppy controller.
    • UC8247-A-PN87 mask ROM.  This contains the word processor's firmware.  If we can figure out the pinout of this chip we could extract the code and have a look at it.
    • Samsung KM681000BLG-7 128K x8 bit SRAM.  This is probably used as main RAM for the software as well as document storage.
    • 2x Hyundai HY6264A-LJ10 8K x8 bit SRAM.  Maybe this extra RAM is for the display?
    • Toshiba TC8521AM real-time clock
    • Rohm BA10339F quad comparator
    • M51953BFP voltage detector/reset generator
    • Three clock crystals, marked 18.0 MHz, 12.2 MHz, and 32.768 kHz.  Based on location and frequency, 32.768 kHz is almost certainly for the RTC, and the 12.2 MHz is probably being divided by 2 to make a 6.1 MHz clock for the CPU.  I'm not sure why 18 MHz is required, maybe it's being used to generate timing for the floppy controller or LCD.
    • An unpopulated 7 pin header labeled "BKMN".  Some other Super PowerNote models contained a second circuit board that could read Franklin Bookman cards, this is probably where that would connect.
    • (Not Visible) A CR2032 coin cell battery for backing up the SRAM.

View project log

Enjoy this project?

Share

Discussions

Lincoln R. wrote 09/03/2021 at 16:35 point

Hi Jim,

Sorry I didn't respond to your earlier comment.  I had started on this project then other aspects of my life got really busy and I haven't had time to revisit it.  Thanks for pointing me to your ROM dump.  I suspect the 8800 and 8700 hardware are actually pretty similar, especially given that the custom gate array has the same part number on it (I'm guessing the UC2836-A is the Brother part number for the specific mask programming of that gate array given that they used UC2xxx part numbers on the mask ROMs).

How did you end up dumping your ROM?  I suspect the pinouts are almost certainly the same, did you remove the chip and use a chip programmer, or hook up wires to some microcontroller board to dump it?  I'm happy to try dumping mine sometime.

I wonder what the upside-down mounted DIP IC on your Bookman daughtercard is.  I've never looked that extensively at the Bookman hardware but you can tell that chip was clearly added on as an after-the-fact hack.  My guess based on the wiring is that it's some 7400 logic gate IC.

  Are you sure? yes | no

Jim wrote 09/06/2021 at 14:01 point

Hi Lincoln, I desoldered the chip and put it on a SOP32 breakout board- then dumped it through that. I'm pretty sure the pinouts are exactly the same. I didn't end up using a chip programmer for this, but a Raspberry Pi Zero and some MCP23017 port expanders over i2c. It wasn't fast but since it wasn't running on my main machine I could just leave it be for a few hours and come back with a dumped ROM.

Here's the code I wrote for that btw: https://github.com/jsyang/i2c-rom-dumper

  Are you sure? yes | no

Jim wrote 09/03/2021 at 11:27 point

Hi there, I left another comment on your first log! I was able to dump the ROM from my PN8800FXB, which is quite similar to the PN8500MDS. Only outward differences being the Bookman slot + interface program (the things I'm actually interested in) and an IrDA port at the back. I've got a dumped ROM file here if you're interested, maybe it will be of some help to you?

https://jsyang.ca/franklin-electronics/reveng/teardowns/PN-8800FXB/PN8800FXB.KM23C800.bin

And my other analysis notes (mirroring some of your own) on that particular device:

https://jsyang.ca/franklin-electronics/reverse-engineering.html#brother-super-powernote-pn-8800fxb

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates