PEN Hardware Details
(measured on Revision B6 (2GB) if not indicated differently)
Chomptech ZC3202N (in version A4: ZC3201); ChipID: "1090"
64-pin LQFP, an SoC provided by Anyka based on AK1050 with ARM926EJ-S core
http://www.anyka.com/en/productInfo.aspx?id=77
- Boots from external flash memory and executes code from there (paging by MMU?)
- Power supply is controlled by the on-board circuitry (auto-hold)
- The ID of the NAND flash is output at the start of the boot process with 115200 bps on GPIO13 (pin 39):
(IMPORTANT: All information shown in this section was compiled from information freely available on the Internet and confirmed by own experiments. It is provided without any guarantee and may be erroneous!)
GPIO13 (pin 39) pulled to low (eg. by a 1 kOhm resistor) during power-up:
- The string "Snowbird2_Massboot>" and some other bytes are sent via GPIO13 in UART protocol with 38400 bps immediately after start-up
- Ready for firmware update via USB
- The TT is powered down as soon as the power button is released!
(IMPORTANT: All information shown in this section was compiled from information freely available on the Internet and confirmed by own experiments. It is provided without any guarantee and may be erroneous!)
GPIO9 (pin 37, accessible on Revision B6 between R66 and R67) pulled to low (eg. by a 1 kOhm resistor) during power-up:
- The string "SNOWBIRD2-BIOS>#" is sent via GPIO13 (pin 39) in UART protocol with 38400 bps immediately after start-up
- Commands can be sent to the SOC via GPIO12 (pin 36): "download", "setvalue", "go", "dump"
Remark: Cut the connection between GPIO12 and the power button module for this purpose! - Commands need to be terminated with a carriage return character('\r')
- Input should be sent character by character and not all at once, otherwise this may lead to "communication errors"
- The data transmitted over UART is usually echoed back
- Addresses need to be given as hexadecimal numbers without "0x" prefix
- BIOS: 0x00000000 - 0x0000FFFF, Registers: 0x04000000 - 0x040AFFFF, RAM: 0x08000000 - 0802FFFF
- Check out Realterm for communicating with the SOC (also for downloading of dumps and uploading of ARM code into RAM)
- The TT is powered down as soon as the power button is released!
| Contact locations in Rev. B6 | Circle |
|---|---|
 |
green: RESET (pin 29) red: GPIO13/TXD (pin 39) blue: GND |
 |
red: GPIO9 (pin 37) |
 |
red: GPIO12/RXD (pin 36) |
The WE signal is clocked with about 7.24 MHz from pin 60 of the main controller. The name of the NAND chip is output during normal operation and USB drive mode on GPIO13 repeatedly with 115.200 bps 8N1 (e.g. "Hynix H27UAG8T2B").
-
Hynix HY27UF084G2B
NAND 512 MB (512 Mbit x 8)
Package: TSOP-48 -
Hynix H27UAG8T2BTR
NAND 2 MB (2 Gbit x 8)
Package: TSOP-48 http://www.farnell.com/datasheets/1641691.pdf -
Micron 29F32G08CBACA
NAND 32 Gbit (32 Gbit x 8)
Sonix SNM9S102C2200A (not yet confirmed by IC marking)
- CMOS digital image sensor IC Sonix SN9S102CE: 3.0 - 3.6V
- 12 mA (typ)., standby current: 50 µA (typ.)
- runs with up to 8 MHz
- 12-pin sensor module interface
- Programmable exposure/gain control through serial bus
- 2-bit nibble format for data output
- 8-bit ADC resolution
- built-in IR LEDs
http://www.sonix.com.tw/article-cn-1664-7097 SNM9S102C2200A Spec v1.0 (pdf)
Same as found in Revision R5:
Sonix SN9P601FG-301
LQFP48, crystal/RC, LVD & LDO built in, 2-wire interface V2 data output
http://www.sonix.com.cn/article-tw-1639-6656
7 test vias next to Sonix SN9P601FG-301:
(via 1 = located next to the tip of the pen)
Via 1: 3.4 V when powered on; very slowly discharging from about 300 mV after power-off
Via 2: 3.4 V spikes of 7.6 ms in 1.0 s period; 900 ms high after power-on
Via 3: I²C data to EEPROM (SDA)
Via 4: I²C clock to EEPROM (SCL)
Via 5: GND
Via 6: 2.0 V when powered on
Via 7: 3.4 V when powered on
Shanghai Fudan Microelectronics FM24C02B
2 Kbit (256 x 8 bit)
http://www.fmsh.com/xqitadmin/uploadFiles/20120306113321.pdf
The first 48 bytes of the EEPROM content are read once about 2 s after power-on (probably for reading of OID configuration data).
As the EEPROM is connected directly to the OID decoder and only control codes and OID codes are transmitted between OID decoder and SOC, the EEPROM seems not to be used for storing SOC relevant information.
Content of EEPROM from Rev B6(4GB):
00: 06 07 01 50 06 08 01 2c 04 73 01 2c 04 b8 00 00 ???P???,?s?,??..
10: 04 b9 01 f4 04 ba 46 50 04 bb 48 44 04 bc 01 f3 ??????FP??HD????
20: 04 bd 03 e7 04 be 48 43 04 bf 4a 37 aa cc ac ac ??????HC??J7????
30: aa cc ac ac aa cc ac ac aa cc ac ac 01 80 01 00 ???????????????.
40: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
50: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
60: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
70: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
90: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
a0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
b0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
c0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
d0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
e0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
f0: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
Chomptech ZC90B (in version sold in 2010: ZC90)
unknown spec
Pin 1: VDD (3.3 V)
Pin 2: constant low
Pin 3: constant low
Pin 4: data transmission after power-on and when LED is flashing
Pin 5: analog spike after power-on
Pin 6: constant low
Pin 7: data transmission after power-on and when LED is flashing
Pin 8: constant low, probably GND
left: pin 4, right: pin 7
8891UL
1.0 Watt
similar to Kingstate KDMG20008
(see for example https://ch.farnell.com/kingstate/kdmg20008/lautsprecher-micro/dp/1502730?Ntt=1502730)
12.000 MHz
36-ms flashes with a period of 10.34 s
(measured at the via next to the green cable on the switch PCB)
Testpoints T2 and T3 can be used to add an extra On/Off Switch (Version 2 Pen)
This fuse protects the internal circuitry against overcurrent. It should have a resistance of 0 Ohm. If it's blown for example because lines were shortcut during measurements, it has an extremely high resistance. In this case the pen is dead because it is not supplied by the battery voltage.
The fuse can be replaced for example by a Bourns SingleFuse SF-0603F100 (1 A) which is available from Voelkner.de.
