Cool, that's nice to know, I'm curious what will be the level on mine, but as I've said, if we can recover the firmware it's perfect, to allow for a fast "clean room" implementation, similar with the Compaq and original PC BIOS, to get rid of all the copyright crap, if not, reversing the FP schematic and communication protocol with the signal board is the way to go, there are TONS of libraries for LCD driving and key matrix reading, hey we could even implement a FW update using either the USB or the, now useless, serial port header on the PCB.
Also, if its the level 2 already programmed, I've asked a more HW oriented friend what can we do, besides un-soldering the chip, and his response was disconnecting the power supply, and replacing it with a pulsing slightly negative current supply, something like 1KHz /-0.6V/few mA just to put the protection diodes in conduction, but not overload them, and then blasting the chip with a cooling spray to at least -25C or lower.
2-3 cycles and the flash content is gone, or so he says.
If I'll have to replace the chip anyway (if level 2 protection is programmed) I may try this before replacing the chip.
Related, if someone who had the generator FP borked, and can sell or loan the defective device/FP for a reasonable price, including shipping to Germany, for research purposes, please PM me. In case of a loan I promise to follow the pharmacists principle
"Primum non nocere, hic curare" so it will most likely not have its state worsened.
Its one.
Though it is always possible they changed it to two on later builds / firmware's especially with all these links to Frauenhofer around.