PEN Hardware Details - entropia/tip-toi-reveng GitHub Wiki

(measured on Revision B6 (2GB) if not indicated differently)

PCB overview

Schematic of the Revision B6

(IMPORTANT: All information shown in this section was compiled from information freely available on the Internet. It is provided without any guarantee and may be erroneous!)

Tiptoi B6.pdf

Main controller

Chomptech ZC3202N (in version A4: ZC3201); ChipID: "1090"
64-pin LQFP, an SoC provided by Anyka based on AK1050 with ARM926EJ-S core
http://www.anyka.com/en/productInfo.aspx?id=77

Standard mode

Boots from external flash memory and executes code from there (paging by MMU?)
Power supply is controlled by the on-board circuitry (auto-hold)
The ID of the NAND flash is output at the start of the boot process with 115200 bps on GPIO13 (pin 39):

Mass Storage Boot

(IMPORTANT: All information shown in this section was compiled from information freely available on the Internet and confirmed by own experiments. It is provided without any guarantee and may be erroneous!)

GPIO13 (pin 39) pulled to low (eg. by a 1 kOhm resistor) during power-up:

The string "Snowbird2_Massboot>" and some other bytes are sent via GPIO13 in UART protocol with 38400 bps immediately after start-up
Ready for firmware update via USB
The TT is powered down as soon as the power button is released!

UART Boot

GPIO9 (pin 37, accessible on Revision B6 between R66 and R67) pulled to low (eg. by a 1 kOhm resistor) during power-up:

The string "SNOWBIRD2-BIOS>#" is sent via GPIO13 (pin 39) in UART protocol with 38400 bps immediately after start-up
Commands can be sent to the SOC via GPIO12 (pin 36): "download", "setvalue", "go", "dump"
Remark: Cut the connection between GPIO12 and the power button module for this purpose!
Commands need to be terminated with a carriage return character('\r')
Input should be sent character by character and not all at once, otherwise this may lead to "communication errors"
The data transmitted over UART is usually echoed back
Addresses need to be given as hexadecimal numbers without "0x" prefix
BIOS: 0x00000000 - 0x0000FFFF, Registers: 0x04000000 - 0x040AFFFF, RAM: 0x08000000 - 0802FFFF
Check out Realterm for communicating with the SOC (also for downloading of dumps and uploading of ARM code into RAM)
The TT is powered down as soon as the power button is released!
The tool snowbirdopter has been written for the Tiptoi to perform the low level commands ("download", "go", etc.) automatically. It can be used to run own executables and find out more about the execution environment.

Contact locations in Rev. B6	Circle
	green: RESET (pin 29) red: GPIO13/TXD (pin 39) blue: GND
	red: GPIO9 (pin 37)
	red: GPIO12/RXD (pin 36)

NAND Flash Memory

The WE signal is clocked with about 7.24 MHz from pin 60 of the main controller. The name of the NAND chip is output during normal operation and USB drive mode on GPIO13 repeatedly with 115.200 bps 8N1 (e.g. "Hynix H27UAG8T2B").

Hynix HY27UF084G2B
NAND 512 MB (512 Mbit x 8)
Package: TSOP-48
Hynix H27UAG8T2BTR
NAND 2 MB (2 Gbit x 8)
Package: TSOP-48 http://www.farnell.com/datasheets/1641691.pdf
Micron 29F32G08CBACA
NAND 32 Gbit (32 Gbit x 8)

OID 1.5 sensor module

Sonix SNM9S102C2200A (not yet confirmed by IC marking)

CMOS digital image sensor IC Sonix SN9S102CE: 3.0 - 3.6V
12 mA (typ)., standby current: 50 µA (typ.)
runs with up to 8 MHz
12-pin sensor module interface
Programmable exposure/gain control through serial bus
2-bit nibble format for data output
8-bit ADC resolution
built-in IR LEDs

http://www.sonix.com.tw/article-cn-1664-7097 SNM9S102C2200A Spec v1.0 (pdf)

Image sensor die (click for full resolution):

^{(image by @Siliconinsider)}

Same as found in Revision R5:
Image of sensor

OID 1.5 image decoder

Sonix SN9P601FG-301
LQFP48, crystal/RC, LVD & LDO built in, 2-wire interface V2 data output
http://www.sonix.com.cn/article-tw-1639-6656

Specs of SN9P601FG (pdf)

7 test vias next to Sonix SN9P601FG-301:
(via 1 = located next to the tip of the pen)
Via 1: 3.4 V when powered on; very slowly discharging from about 300 mV after power-off
Via 2: 3.4 V spikes of 7.6 ms in 1.0 s period; 900 ms high after power-on
Via 3: I²C data to EEPROM (SDA)
Via 4: I²C clock to EEPROM (SCL)
Via 5: GND
Via 6: 2.0 V when powered on
Via 7: 3.4 V when powered on

EEPROM

Shanghai Fudan Microelectronics FM24C02B
2 Kbit (256 x 8 bit)
http://www.fmsh.com/xqitadmin/uploadFiles/20120306113321.pdf
The first 48 bytes of the EEPROM content are read once about 2 s after power-on (probably for reading of OID configuration data).
As the EEPROM is connected directly to the OID decoder and only control codes and OID codes are transmitted between OID decoder and SOC, the EEPROM seems not to be used for storing SOC relevant information.

Content of EEPROM from Rev B6(4GB):
00: 06 07 01 50 06 08 01 2c 04 73 01 2c 04 b8 00 00 ???P???,?s?,??..
10: 04 b9 01 f4 04 ba 46 50 04 bb 48 44 04 bc 01 f3 ??????FP??HD????
20: 04 bd 03 e7 04 be 48 43 04 bf 4a 37 aa cc ac ac ??????HC??J7????
30: aa cc ac ac aa cc ac ac aa cc ac ac 01 80 01 00 ???????????????.
40: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
50: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
60: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
70: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................

Crypto IC

Chomptech ZC90B (in version sold in 2010: ZC90)
unknown spec
Pin 1: VDD (3.3 V)
Pin 2: constant low
Pin 3: constant low
Pin 4: data transmission after power-on and when LED is flashing
Pin 5: analog spike after power-on
Pin 6: constant low
Pin 7: data transmission after power-on and when LED is flashing
Pin 8: constant low, probably GND

ZC90B - Pin 4 ZC90B - Pin 7
left: pin 4, right: pin 7

Audio Amplifier

8891UL
1.0 Watt

Speaker

Specification: 8 Ohms, 0.3 Watts

similar to Kingstate KDMG20008
(see for example https://ch.farnell.com/kingstate/kdmg20008/lautsprecher-micro/dp/1502730?Ntt=1502730)

Quartz

12.000 MHz

Power button

36-ms flashes with a period of 10.34 s
(measured at the via next to the green cable on the switch PCB)

Testpoints T2 and T3 can be used to add an extra On/Off Switch (Version 2 Pen)

At least in Rev. A4 the power button includes a LED. It is soldered on a separate tiny PCB labeled "1399A0". The power button PCB is connected to the main PCB using four cables:

The red cable connects #1 from the main PCB to #1 of the power button PCB.
The black cable connects #2 from the main PCB to #2 of the power button PCB.
The green cable connects #3 from the main PCB to #3 of the power button PCB.
The blue cable connects #4 from the main PCB to #4 of the power button PCB.

The LED is connected between pins #3 and #4, the normally open (n.o.) switch is connected between pins #1 and #2.

With wiring:

Power button (front) Power button (back)

Without wiring, more detailed:

Power button PCB (front) Power button PCB (back)

Fuse

This fuse protects the internal circuitry against overcurrent. It should have a resistance of 0 Ohm. If it's blown for example because lines were shortcut during measurements, it has an extremely high resistance. In this case the pen is dead because it is not supplied by the battery voltage.

The fuse can be replaced for example by a Bourns SingleFuse SF-0603F100 (1 A) which is available from Voelkner.de.

RT1

Tiptoi Generation 4 Camera Module Repair

If your Tiptoi can be switched on and there is a welcome text, but there is no reaction if you touch any of your Tiptoi pictures, there might be a problem with the camera module. After opening the device, the camera module can be seen in the bottom right corner of the following picture.

tiptoi_opened

The camera module can be disconnected from the motherboard by lifting the dark handle of the J2 connector of the adapter board. The camera module consists of the adapter-board and the CMOS-board. The data transfer between the camera module and the motherboard is handled by an I2C bus system via the white 10 wire flat ribbon cable. In this case, the I2C clock connection (SCL) was o.k. but the data connection (SDA) was interrupted.

camera_module_01 camera module with CMOS-board in front

camera_module_02 camera module (adapter board with connectors J2 and J3)

camera_module_03 camera module (adapter board with connector J1)

To find out if there is a functioning SDA connection between the camera module and the motherboard, you could measure the resistance between the pin 2 of Jumper J1 to all other 7 pins of the adapter board. If there is no ohmic resistance to at least one of the other 7 pins measureable, than the SDA connection between pin 3 of J2 and pin 2 of J1 to the via of the CMOS-board is broken. If there is a measurable resistance between pin 2 (J1) and any one of the other 7 pins, there exists another failure which is not covered in this contribution.

camera_module_04 camera board with connectors

In this case, the contact area of pin 2 (J1) was separated from the CMOS-board and therefore the connection to the near via contact broken. This via contact delivers the SDA signal to the CMOS-chip directly opposite on the other side of the CMOS-board. Soldering the pin to the via is not possible due to the placement of the via under the adapter-board between J1 and J3. That means, that you have to unsolder the adapter-board completely from the CMOS-board to get access to the leftover parts of the SDA via. This can be done best with a hot-air soldering equipment. After having separated the adapter-board from the CMOS-board, a thin copper wire can be soldered to the leftover of the SDA via. The wire should be long enough to be placed outside around pin 1 (J1) for later soldering to pin 2 (J1). If the wire is too short, it might not be possible to finally keep the connection to the via. After having prepared the extra wire, you can solder the 7 pins exept the pin 2 (J1) from the adapter-board to the CMOS-board. Finally you can solder the open end of the copper wire to pin 2 (J1) of the adapter-board. The connection is established if you can measure a resistance between pin 2 (J1) and any one of the other 7 pins as described before.

connections interconnection diagram

The upper diagram describes the interconnection of the motherboard with the camera module of the Tiptoi (4th generation). The shown voltages were measured with the connected 10 wire flat ribbon cable between the motherboard and the camera module. Perhaps this info will help for further failure analyses.