The control panel of a Canon Pixma MX340 multi-function inkjet has only one significant microchip. It is marked NEC K13988 and I've traced through how it is connected to the rest of the circuit board. Among these connections are two communication channels. One to the main board, and one to the LCD screen. I decided to look at main board communication first, wiring up those three pins to see how it looks under my Siglent oscilloscope. Since they were pins 1-3 on the circuit board connector, it was easiest to wire them up to channels 1-3 on the oscilloscope.

I saw a little bit of activity when I plugged in the printer, before I turned it on. Pin 2 came up to about 2.5V DC, and pin 1 came up just a little higher for 300ms before dropping back. About one second later, pin 1 came up to 3.3V, followed a few tens of milliseconds later by pins 2 and 3 together. A few tens of milliseconds after that, pin 3 dropped to ground and pin 2 dropped to 2.5V at around the same time. Then pin 1 dropped to ground, and all three lines stayed that way (pin 1+3 ground, pin 2 at 2.5V DC) for the printer standby state.

When I pressed the power button to turn on the printer, there was a flurry of activity I don't understand yet, but it quickly settled to this state:

This is what it looks like when the printer is on with data on the LCD screen, but nothing else happening. Pins 1 and 3 stay at 3.3V DC with no activity. Pin 2 (magenta line) sends something at regular intervals. A little over 9ms between pulses, or at the oscilloscope measured rate at 108.439Hz.

Zooming in on the pin 2 state, it looks like it dips to ground for about 33us.

Pressing a button triggers a change on pin 2 activity. For this exploration I tried the four buttons under the LCD screen, starting with the above trace representing the back button.

Pressing left arrow/- generated trace above.

Pressing right arrow/+.

And pressing OK.

These snapshots make pin 2 look like a digital serial communication data stream describing user input to the main board. It's a short enough burst I can probably decode the values by hand [UPDATE: I decoded them by hand.] but right now I want to look at other pins first.

This teardown ran far longer than I originally thought it would. Click here for the starting point.