================================== Hardware reverse engineering notes ================================== Identifying data ================ Samsung SE-506CB S-506CB/RSBD F/W=TS00 S15E6YMF200GRS FEBRUARY 2014 H/W:A Ver.CB Portable BD Writer Model SE-506 Designed by Toshiba Samsung Storage Technology 5V 1.3A Class 1 laser product Factory ID : T MADE IN PHILIPPINES BG68-02024A Rev.00 Components ========== - USB Mini-B Connector - 25 MHz main XTAL - (2x) Sled closed switch - Eject button - Sled stepper motor - Front panel LED (blue) - Eject latch solenoid - Probably NO sled homing sensor. Seems designed to slam the sled into the edge to zero it. - Lens focus/tracking voice coils - Spindle brushless (also coreless?) motor - System on a Chip - Direct connection to USB port - Includes 4MB DRAM, 2MB Flash, several small SRAMs - Includes "DSP" and servo control - Encode/decode hardware - "RF" - "MICOM" - Runs quite hot! MEDIATEK MT1956UWDN 1352-BCSL DKWP2N 01XAP34HJ 03XB3N87630001 D7FY1 - Switching power supply controller ST Microelectronics logo ST e3 ODD03 MYS403 - Motor control chipset Texas Instruments logo TPIC1391 3CTG4 ADPR (Smaller & on the right in mainboard-fpc-pins.jpg) - LED - VCM fine control 2CAJELTG4 TPIC1356 (Bigger & on the left in mainboard-fpc-pins.jpg) - Eject solenoid - Stepper motor (sled) - Brushless motor (spindle) - VCM coarse control Test Points =========== Top side: - Fiducial markers in corners, look like test points but no connection. - Most test points are obscured by solder balls. Some of these may be vias that are intentionally or accidentally untented. Some may be intentional test points. Bottom side: - Two normal test-points near the motor controllers. - Five vias that have been enlarged into test points. Could be motor control or power related. - Test points near PCB trace inductors under the power supply. These are - probably different grounds (analog, digital, shield). - Threee normal test-points near the SoC - Two via test points near the SoC - Three via test points are especially elongated and form a row adjacent to the SoC thermal pad. These seem most likely to be a factory programming interface. - Viewed with USB connector in top-right corner, from left to right, numbering these pads 1, 2, 3. - Pads 1 and 2 float near 0v - Pad 3 is at 3.3v - Possibly a serial interface? Wiring Harness ============== - Main PCB - SoC - USB Mini-B connector soldered on - Tray closed switch soldered on - 56 pin flex cable leading to tray PCB --- 1 - 4 PD DATA High speed serial signals, probably two differential pairs 1:2 and 3:4. These are amplified but otherwise unprocessed outputs from the photodiode detectors. They're routed as differential pairs on the FPC, then they go straight into the SoC on the main PCB. Both pairs are active when reading from a CD-ROM. Seeing a signal with ~350 mV peak-to-peak. Signal rate is about ~16 MHz when spinning at normal rates, but I can slow down the signal by pressing on the spindle. Both signals are read. They might be quadrants from the photodetector. Haven't tried sampling multiple signals concurrently yet. 5 GND 6 - 7 PD DATA A little thicker than usual, capacitively coupled to SoC. Looks like another differential or AC photodiode signal. Speed proportional to disc rotation rate. 8 ANALOG Regular thickness, levels suggest an AC signal, no discernable signal when reading a CD-ROM 1.68v when burning BD-R. 9 5V_a Switched 5V power 10 - 13 ANALOG ~1.7v during BD-R burn 14 GND 15 - 17 ANALOG Seem to be high speed analog or data signals, riding on ~1.5-2v DC bias +/- 80mv or so. 18 5V_a Switched 5V power (same as 9) 19 DATA 0v during BD-R burn 20 DATA 3.3v during BD-R burn 21 DATA 0v during BD-R burn 22 - 23 DATA High-speed (>= 40 MHz), 300 mV p-p, probably differential Laser burn data? Active during BD-R burn. 24 5V_a Switched 5V power (same as 9) 25 - 26 DATA High-speed (>= 40 MHz), 300 mV p-p, probably differential Laser burn data? Active during BD-R burn. --- 27 GND (This may represent the point where this FPC splits, --- 28 GND tray electronics below and pickup electronics above.) 29 ANALOG? 130mV during BD-R burn 30 ANALOG? 670mV during BD-R burn 31 ENABLE? 3.3v during BD-R burn, thin trace 32 5V Switched 5V power 33 5V Switched 5V power 34 ENABLE 3.3v signal, to SoC 35 - 38 COIL x4 4x, to TPIC1391, VCM fine-control ~50mV, fine tracking waveforms 39 - 44 COIL x6 6x, to TPIC1356, VCM coarse-control 5V, 320 kHz PWM. Probably focus? 45 - 48 COIL x4 Spindle brushless motor Connected to TPIC1356 49 COIL Eject solenoid, active high Connected to TPIC1356 50 BUTTON Eject button, active low, weak pull-up 51 LED Front panel LED, active high - Routes to a resistor way over by the xtal, the one alone near the edge of the board. Connects to the side facing toward the front of the drive, away from the board edge with the connector. - Then, it comes ALL the way back to pin 1 of the TPIC1391. Is this a layout mistake, or is there some alternate I/O option perhaps that needs the LED signal on that end of the board? - Still open-drain with weak pull-up at pin 1 of the TPIC1391 - Clean square wave input at pin 10 of TPIC1391 (3.3v), opposite polarity (active low, matches GPIO). 52 GND 53 - 56 COIL x4 Sled stepper motor Connected to TPIC1356 --- 57 GND - Tray PCB - Some passive components. Capacitors, at least one resistor. - Mostly just a breakout for the 56 pin cable (soldered to the back) - 8 pin flex cable - 4 pins to sled stepper motor - 1 pin common for eject solenoid, eject button, LED - 1 pin to eject solenoid coil - 2 pins to front bezel PCB - 5 pin flex cable to spindle motor - 45 pin flex cable to optical module - Front bezel PCB - 3 pin flex cable (soldered) - Common, LED, Button - Very bright blue LED! - Optical module - Very thin and delicate 45-pin flex cable, usually hidden under a metal shield. Probably no PCB involved, just flex cable origami. - Components inside are obscured, haven't tried disassembling yet. Only internal connections visible are on one of the optical modules. One large ground or mounting pin, four small electrical pins. Soldered to part of the large folded FPC. - Because the copper is so thin, the traces vary greatly in width according to the current capacity. So we have some clues about how the components might be connected. Starting from the labeled pin 1 arrow on the tray PCB: 1 - 4 HS DATA These look like high speed serial data pairs. Pins 1/2 and 3/4 seem to be arranged as matched pairs in the cable's routing. 5 GND? Probably ground? This seems to be routing as a pour. 6 POWER? A power rail? This is a little thicker than average. 7 POWER? A power rail? This is a little thicker than average. 8 DATA Regular thickness. 9 POWER? A power rail? This is a little thicker than average. 10 - 13 DATA Group of four data lines routed as normal traces 14 POWER? A power rail? This is a little thicker than average. 15 SHIELD? Looks a little thin, and there's a large gap after this. 16 - 17 COIL? Heavy traces close together with gaps on both sides 18 - 25 DATA x8 Might be voice coils, more likely an 8-lane data bus maybe 26 BIG POWER Thicker power trace than above. Probably a +V rail? 27 N/C No connect to this pin. No trace on the FPC. 28 - 29 GND Two pins ganged together, connected to a ground pour. This pour becomes the thickest trace on the whole cable. This likely becomes a ground plane somewhere inside the module where there would need to be an amplifier/driver chip for the laser and photodiode modules. 30 - 32 DATA 3 normal thickness traces 33 GND? As thick as earlier power traces. Could be common for 30-32, headed directly to some piece of hardware on the sled. 34 GND? Seems to be just like 33, but not related to 33 so much as to the next few traces below. 35 - 39 DATA Another 5 normal traces. 40 - 45 VCM A set of six enormous traces. Verified that these connect directly to the voice coil motor on the lens assembly. Tray Mechanism ============== The tray is the thing that holds the disc and all optical/mechanical parts. In this section we're talking about the stuff that's specific to how the tray moves in and out for disc loading and eject. The tray mechanism consists of: - Two tray position sensor switches (almost-closed and closed). The almost-closed switch seems to get the ARM processor into gear, whereas the actually-closed switch seems to be more about power interlock. Both switches can be read by the ARM, but the fully-closed switch seems more indirect. - A spring-loaded mechanism that pushes a core into the solenoid when the tray closes. You can trigger this by hand when the tray is open by pushing a small white plastic lever until it locks. - A eject solenoid, powered by 5V, uni-polar. Terminal nearest the edge is ground, the other switches to +5 when activated. Measured in-circuit at 11 ohms. This ground is shared by the tray LED. Mapped to ARM GPIO, driven directly by TPIC1356 chip. (TPIC1356 pins 5 & 17 show this signal but without visible ringing) - An LED and button, both attached to ARM GPIO. Button generates a TBD interrupt. All tray hardware is directly attached to the ARM core as GPIO. Power Consumption ================= Totals: 50 mA Minimum observed 90 mA Idle at cmshell 200 mA Initial current when booting 220 mA After %eject (tray powered still?) 400 mA Disc spinning, otherwise idle 410 mA Reading blu-ray 580 mA Tray solenoid on 620 mA Burning blu-ray at 1x 650 mA Reading CD-ROM at high speed 700 mA Reading BD-R at high speed 850 mA Bringing spindle up to speed, looking for disc 1220 mA Writing BD-R while accelerating spindle Components: 360 mA Tray solenoid Spindle Motor ============= Brushless motor, highest power draw in system. Driven by TPIC1356 chip. Power cutoff controlled by tray switch #2. With ARM wedged in bitbang_backdoor: - motor still starts/stops when tray switch opened/closed - can detect disc / no-disc. With no-disc, stops rotation. Could be these smarts are in the TPIC1356. Also could be in the DSP code?