Roland dg dxy-1300 firmware exploration

I have extracted the ROM images from the two 27C512 chips inside the DXY-1300. I then passed them though a disassembler. This produced the asm files respectively below.

RolandDG_R15209223_LH53140H_8949E is the more interesting because it contains z80 code that starts at 0100h.

The asm files have beep passed as all code. However they need to be separated into data and code. As there is HPGL data starting around E000h in the R15209223 file and likely numerous other sections. This HPGL is the test image that is drawn when the device is powered on holding down the enter key.

boot sequence log

The goal for me is to use my Z80 ICE debugger from Tauntek to analyze the memory until its booted.

An objective is to change and find how the pen speed works. As I have a laser burner I want to mount on it.

0100h is the default place the z80 jumps to for execution and called the ORG. I also expect Ill be able to use the boot test image at location “000e0e0” to print out back engineering debug info.





I am waiting until I receive some new 27512 chips in the post as it appears the originals in the plotter are ROM or in some way not writable by my EEPROM programmer lt866cs.

here Is a simple analysis of the most used sub routine calls within the code. I believe it identifies the main execution loop.

Heating control rcr10/433-GB RDJ10RF siemens

At the bottom of this post is the Arduino sketch you can use with the IRremote.h library. This library is used to send infrared light used on remote controls for television and video recorders and such. Interestingly the Siemens radio heating control uses the same encoding for its radio signal.

The structure of the radio signal is thus.

There are two sets of pulses. The first of the left is 32 bits is Infrared Sony encoded information. This is explained further here. The 32 + 32 bit data is sent 4 times in a row. I guess for redundancy and reliability. I found also if its only sent once it does not work. So 64 bits x 4 pulses are necessary.

the library IRremote does have an API sendSONY but I found it does not work for my purposes here, because the frequency passed in the library did not fit my frequency. So I used the SendRaw() function. I also defined my own one bit and zero bit and repeated them according to the array.

I have noticed the first set of 32 bits is always the same and it related to the second set. Its related in a way that is quite interesting. Its the original 32 bits but inverted (not gated).

I have found its inverted except for 2 bits. Bits 9 and 32. This bit inversion defines whether the signal being sent is on or off. You can see this from my code below.

To get this code working on your own heater. You probably will need to change the bits that are sent here and there. As they are all unique for “security” sake. There are also dip switched to change the identity. You can record the signal from your timer with a 433 Mhz receiver via your sound card. Then interpret the ones and zeros for off and put it in the heating_code_second array. This stores the off signal. Then the array inverts the necessary bits to make the signal on. The whole command for the Arduino code accepts a 1 for on and 0 for off over the serial link.

To interface the Arduino to the radio one needs a 433Mhz transmitter and  receiver pair. The receiver can be used to record the signal from the original siemens transmitter into audacity. Then run the sketch below to check it matches your out put.

* IRremote: IRsendDemo – demonstrates sending IR codes with IRsend
* An IR LED/radio transmitter must be connected to Arduino PWM pin 3.
* Version 0.1 July, 2009
* Copyright 2009 Ken Shirriff

#include <IRremote.h>

IRsend irsend;

// just added my own array for the raw signal
unsigned int digitalOne[4] = {0,820,370,0};
unsigned int radio_preamble_a[3] = {4800,820,0};
unsigned int radio_preamble_b[3] = {4800,0,0};
unsigned int digitalZero[4] = {0,200,370,0};
unsigned int heating_code_first[33];
const unsigned int heating_code_second[33] =

String inputString = “”;         // a string to hold incoming data
boolean stringComplete = false;  // whether the string is completevoid setup()
}void loop() {// altered the code just to send/test my raw code
if (stringComplete) {
// clear the string:
unsigned int input_num = inputString.toInt();
inputString = “”;
stringComplete = false;
unsigned int i=0;
for (i=0;i < 33;i++) {
heating_code_first[i] = heating_code_second[i];
}if (input_num == 1) {//heating off
//Serial.write(“Heating on bit inversion”);
if (heating_code_first[32] == 0){
heating_code_first[32] =1;
} else {
heating_code_first[32] =0;

if (heating_code_first[9] == 0){
heating_code_first[9] =1;
} else {
heating_code_first[9] =0;
unsigned int pulse_count=0;
for (pulse_count=0;pulse_count < 4;pulse_count++) {
int bit_count =0;
irsend.sendRaw(radio_preamble_b,3,40);//God know why it does not
send the first 1???
for (bit_count=0;bit_count < 33;bit_count++) {
if (heating_code_first[bit_count] == 1) {
} else {

delay(28);//Big delay between two pulses.
irsend.sendRaw(radio_preamble_a,3,40);//God know why it does not
send the first 1???
for (bit_count=0;bit_count < 33;bit_count++) {
if (heating_code_first[bit_count] == 0) {
} else {



void serialEvent() {
while (Serial.available()) {
// get the new byte:
char inChar = (char);
// add it to the inputString:
inputString += inChar;
// if the incoming character is a newline, set a flag
// so the main loop can do something about it:
if (inChar == ‘\n’) {
stringComplete = true;

Inkscape and 1980’s plotters

I had a Inkscape itch that needed scratching and as the holidays are upon us Christmas 2014. I found the time to write a patch for Inkscape.

Currently its not easy to use a plotter (DXY-1300) and have it switch pens in Inkscape. There is no method in the GUI to switch the pens. I read on news groups that it would be a good idea to have the stroke colours assigned to pen numbers. I have written this patch that allows pen stroke colour assignment to pen numbers.

screen shot

I used the stroke colour as this the colour the line changes. I also used the primary colours. Until somebody can modify the GUI this was a comprise.


The export as hpgl now appears like so. With the pen assignments to pen numbers. Then the file will be produced with the necessary SP (Select pen) commands. The original Pen box has no function.

There are three files in the archive. They go in the extensions directory. I would also backup your originals first of course. Have fun and let me know if this helped.

These files are based on Inkscape 0.91pre3 However I don’t suspect these hpgl bit are in much flux so it should work for older versions. Mileage may vary.


There a few things that could be improved upon in hpgl_encode. The order in which the pens are selected are based upon the order in which they are drawn in the editor. This is not ideal and to solve it is a “travelling salesman” type problem. This I believe has already been solved in the Inkcut plot extension. So it would be wise to integrate that code.

Here is a test file that will select each pen in order of 1 through to 8. The lines will be drawn from the bottom up. This can be used to test the new pen select code I have added.


An anomaly I noticed was that when selecting a pen the head returns to the same place. then continues drawing with the next command. This makes the pen change look inefficient as the head will return to where is once was, even if there is no line to be drawn. Then moves to the new position. Ideally before and after the Pen select command is executed the head would not return to the same location, but instead go to a new location. This seems to be a feature of the hardware and not something the command sequence automatically does.

It would be possible to have the head go to, a location nearest the next pen section then do a SP (Select Pen) so the head only travels back to this location and appears as if its travelling to a new location after pen selection. This would require eight locations outside the pen cartridges to be defined. This may be different for every plotter however. So unless somebody asks, I can’t see the justification in this one.

Calibration of Gos 658G Oscilloscope

Realising there is no documentation on the Internet to calibrate oscilloscopes.

I have a GOS 653G Or a (ISO-TECH ISR658G) and wanted to calibrate it. Note that powering up the unit will give better calibration results as the CRT warms up and the power supply reach a static voltage. Ensure this is the case before calibration.

Cursors board

Oscilloscope Cursors board Top back

I have identified 5 variable resistors on the cursors board. This is the board that is controlling the cursors drawn on the screen. There are some things one needs to be aware of when trimming these.

1. The cursors need to be at the extremities of the screen as these need to be aligned to the edge of the graticule.

2. These need to be adjusted with caution and in ratio to the zoom variable resistor located near the CRT tube ref.




Today I was not feeling so well, man flue so I vegetating in bed on the net and stumbled across Netflix. I had a free month trial. I had heard that the Microsoft Silverlight is at the sites core and me being on Linux I would have an up hill battle. However, to my surprise it was easy to get this working. I followed the guide for my distribution (gentoo), there are guides for all other popular Linux flavours also for PipeLight

I think most people would ask why bother. I think its a matter of exploring what technologies are being used to deliver particular content. How its being used to maybe “control” users into certain decision that reflect buying decision.

And also to exercise my freedom and to show that large corporations will not encroach on my choice of operating system.

Don’t worry I know what your thinking (This guy uses a tinfoil hat to stop the government reading his thoughts). Not at all. You can either see what I’m getting at or don’t care 🙂 Let me know what you think and maybe give it a go yourself its easier than you think. The last and quite important reason I did it is to have the stability and security of Linux as the basis.