Hardware - ernie76/tip-toi-reveng GitHub Wiki

Revision Overview

Here is a list of the hardware revision that have been seen so far. See below for the component details.

Feature/Revision A4 B5 B6 (2GB) B6 (4GB)
Date 2010.3.26 2010.11.29 2012.2.14 2012.2.14
PCB Revision 1391A4 1391B5 1391B6 1391B6
Flash size 512 MB 512 MB 2 GB 4 GB
Usable flash size 464 MB 464 MB 1.71 GB
Flash type HY27UF084G2B HY27UF084G2B H27UAG8T2BTR MT29F32G08CBACA
EEPROM FM24C02B FM24C02B FM24C02B FM24C02B
Encryption IC ZC90 ZC90 ZC90B ZC90B
Amplifier 8891UL 8891UL 8891UL
Speaker 8 Ohm, 0.3 W
OID Decoder SN9P601FG-301 SN9P601FG-301 SN9P601FG-301
S/N AB......
G0......
AD...... CA......?
CC......
CD......
DD......?

Revision A4

This is the first version which was available on the market.

(please provide images of front and back side)


Revision B5

Changes from previous revision:

  • improved controller (ZC3202N instead of ZC3201)

(please provide images of front and back side)


Revision B6 (2 GB)

Changes from previous revision:

  • larger flash memore (2 GB instead of 512 MB)
  • new version of encryption IC (ZC90B instead of ZC90)

PCB overview

back side of PCB


Revision B6 (4 GB)

  • larger flash memore (4 GB instead of 2 GB)

front side of PCB
back side of PCB


Component Details

(measured on Revision B6 (2GB) if not indicated differently)

Main controller

Chomptech ZC3202N (in version sold in 2010: ZC3201)
64-pin LQFP, most probably an SoC provided by Anyka based on AK11XX with ARM926EJ-S core
http://www.anyka.com/en/productInfo.aspx?id=77

Flash Memory

The Chip Enable signal of the flash (pin 9) seems to be driven by general purpose I/O pin 13 (GPIO13 = pin 59) of the main controller. This control signal is accessible on a dedicated test pad on the back side of the PCB. Pinning to "high" prevents that the flash is read.

OID 1.5 image decoder

Sonix SN9P601FG-301
LQFP48, crystal/RC, LVD & LDO built in, 2-wire interface V2 data output
http://www.sonix.com.tw/sonix/oid15.jsp
(documentation about the OID2.0 version, SN9P701FG, can be found easily on the Internet)

7 test vias next to Sonix SN9P601FG-301:
(via 1 = located next to the tip of the pen)
Via 1: 3.4 V when powered on; very slowly discharging from about 300 mV after power-off
Via 2: 3.4 V spikes of 7.6 ms in 1.0 s period; 900 ms high after power-on
Via 3: I²C data to EEPROM (SDA)
Via 4: I²C clock to EEPROM (SCL)
Via 5: GND
Via 6: 2.0 V when powered on
Via 7: 3.4 V when powered on

I2C data transmission to EEPROM
yellow: via 4 (SCL), blue: via 3 (SDA)

EEPROM

Shanghai Fudan Microelectronics FM24C02B
2 Kbit (256 x 8 bit)
http://www.fmsh.com/xqitadmin/uploadFiles/20120306113321.pdf
The first 48 bytes of the EEPROM content are read once about 2 s after power-on (probably for reading of OID configuration data).

OID 1.5 sensor module

Sonix SNM9S102C2000B (not yet confirmed by IC marking)
0 - 35° reading angle, 8-bit ADC, 7000 Lux
http://www.sonix.com.tw/sonix/oid15.jsp

Encryption IC

Chomptech ZC90B (in version sold in 2010: ZC90)
unknown spec
Pin 1: VDD (3.2 V)
Pin 2: constant low
Pin 3: constant low
Pin 4: data transmission after power-on and when LED is flashing
Pin 5: analog spike after power-on
Pin 6: constant low
Pin 7: data transmission after power-on and when LED is flashing
Pin 8: constant low, probably GND

ZC90B - Pin 4 ZC90B - Pin 7
first: pin 4, second: pin 7

Audio Amplifier

8891UL
1.0 Watt

Quartz

12.000 MHz

Power button

36-ms flashes with a period of 10.34 s
(measured at the via next to the green cable on the switch PCB)

⚠️ **GitHub.com Fallback** ⚠️