The chips are the same on the TI-Nspire and the TI-Nspire CAS.
As can be seen on the above image, there are empty pads for a connector labelled "J04". Maybe, there are signals to get a little bit further into the calculator.
I've analyzed the signals on the pins and found out a little about the types of signals.
"GND" means signal ground, it has the same potential as the whole ground plane on the PCBs. The minus pole of one battery is directly connected to it. "Vcc 3.3V" means the 3.3V power supply of the calculator. It seems to be present even if the calculator is off. "Floating" is a signal with an undefined voltage level, this state is very likely for inputs. "High" is a signal with almost 3.3V, but not a supply signal. These signals can be outputs switched to "high" or inputs with pull-up resistors.
|Vcc 3.3V||3||4||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|High||5||6||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|High||7||8||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|Floating||9||10||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|GND||11||12||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|Floating||19||20||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|Floating||21||22||Square-wave: 112Hz, 99% duty-cycle, not present if the calc is off|
|Floating||23||24||RS232 Output (115'200,8,n,1)|
|Floating||25||26||Maybe RS232 Input|
TODO: Double-check the results and find out, what these signals (Floating, High, Square-wave) really are. Maybe, there are common interfaces as RS232, JTAG, I2C or whatever.
While starting up, the calculator sends some logging information through the serial (RS232) interface.
A log (including deletion and reprogramming the OS) can be found here: http://www.activevb.de/members/philippburch/hackspire/log.txt ( Log mirrored here)
240x320, 16 grayshades LCD screen.
Manufacturer: Texas Instruments
Model: TI-NSPIRE / L9A0702 / TI-NS2006A-0 / LSI LOGIC / ZEVIO / U 0714 / WYJ14052-1
(Seems to be the same one in TI-nspire CAS, 0702 and 0714 might be datestamps)
Die photos are now available, showing an in-house part number and dual CHIPIDEA cores.
Model: HYB18L256160BF-7.5 WV22400
Function: 32MB SDRAM (16bit bus)
Storage (?) memory
Model: NAND 256 / R3A2BZA6 / GK 0JF 8Y / CHN 88 711
Function: 32MB FLASH NAND (block access) memory
Notes: This memory does not support "Execute In Place" (XIP). If executable code is contained in this memory, it has to be copied in RAM first. Probably contains the Operating System, the documents and the invisible file system of the OS which needs to survive a reboot.
Model: 39WF400A 90-4C-B3KE
Function : 512KB NOR FLASH (16bit bus, memory mapped)
Notes: Probably contains the boot code which loads the Operating System kept in the storage memory. As on previous calculator models with flash memory, contains code to receive a new Operating System. This memory would be read-only, only the storage memory would be written to. Another possible scenario is that the whole kernel (Nucleus RTOS) is stored here, and that OS updates do not include it (a two memories flashing seems unlikely), but in this case the kernel couldn't be updated.
The clock is correctly emulated in the TI-84 Plus mode of the TI-Nspire. Although the TI-Nspire OS doesn't display any clock as the TI-89 Titanium and the TI-84 Plus do, the TI-Nspire keeps track of time when the TI-84 Plus keypad is replaced by the TI-Nspire keypad, and then put back. We can be quite sure there is an RTC inside. It is also interesting to mention the XML tags dfmt (date format) and tfmt (time format) set to 1 in the factory settings (phoenix/syst/locales/en/settings/factory.zip/settings.xml of the compressed file system) in the OS file of both the TI-Nspire and the TI-Nspire CAS. These two parameters don't appear in the system settings dialog of the TI-Nspire OS, as it is the case for the tags curr and unit of settings.xml.
The TI-Nspire may have a Memory management unit, but we can't be sure for the moment. If it had one, the Nucleus MMU extension for Nucleus RTOS would probably be used. But since the TI-NSpire is not open for third-party development, would the protections offered by an MMU really needed?