==================================
Hardware reverse engineering notes
==================================


Identifying data
================

Samsung SE-506CB

    S-506CB/RSBD       F/W=TS00
    S15E6YMF200GRS     FEBRUARY 2014
    H/W:A              Ver.CB
    Portable BD Writer Model SE-506

    Designed by Toshiba Samsung Storage Technology

    5V 1.3A
    Class 1 laser product

    Factory ID : T
    MADE IN PHILIPPINES
    BG68-02024A  Rev.00


Components
==========

- USB Mini-B Connector
- 25 MHz main XTAL
- (2x) Sled closed switch
- Eject button
- Sled stepper motor
- Front panel LED (blue)
- Eject latch solenoid
- Probably NO sled homing sensor. Seems designed to slam the sled into the edge to zero it.
- Lens focus/tracking voice coils
- Spindle brushless (also coreless?) motor

- System on a Chip
    - Direct connection to USB port
    - Includes 4MB DRAM, 2MB Flash, several small SRAMs
    - Includes "DSP" and servo control
    - Encode/decode hardware
    - "RF"
    - "MICOM"
    - Runs quite hot!

    MEDIATEK
    MT1956UWDN
    1352-BCSL
    DKWP2N
    01XAP34HJ
    03XB3N87630001
    D7FY1

- Switching power supply controller

    ST Microelectronics logo

    ST e3
    ODD03
    MYS403

- Motor control chipset

    Texas Instruments logo

    TPIC1391
    3CTG4
    ADPR

      (Smaller & on the right in mainboard-fpc-pins.jpg)

      - LED
      - VCM fine control

    2CAJELTG4
    TPIC1356

      (Bigger & on the left in mainboard-fpc-pins.jpg)

      - Eject solenoid
      - Stepper motor (sled)
      - Brushless motor (spindle)
      - VCM coarse control


Test Points
===========

Top side:

- Fiducial markers in corners, look like test points but no connection.
- Most test points are obscured by solder balls. Some of these may be vias
  that are intentionally or accidentally untented. Some may be intentional
  test points.

Bottom side:

- Two normal test-points near the motor controllers.
- Five vias that have been enlarged into test points. Could be motor control
  or power related.
- Test points near PCB trace inductors under the power supply. These are
- probably different grounds (analog, digital, shield).
- Threee normal test-points near the SoC
- Two via test points near the SoC
- Three via test points are especially elongated and form a row adjacent to
  the SoC thermal pad. These seem most likely to be a factory programming
  interface.
    - Viewed with USB connector in top-right corner, from left to right,
      numbering these pads 1, 2, 3.
    - Pads 1 and 2 float near 0v
    - Pad 3 is at 3.3v
    - Possibly a serial interface?


Wiring Harness
==============

- Main PCB
    - SoC
    - USB Mini-B connector soldered on
    - Tray closed switch soldered on
    - 56 pin flex cable leading to tray PCB

--- 1 - 4    PD DATA      High speed serial signals, probably two differential
                          pairs 1:2 and 3:4. These are amplified but otherwise
                          unprocessed outputs from the photodiode detectors.

                          They're routed as differential pairs on the FPC, then
                          they go straight into the SoC on the main PCB.

                          Both pairs are active when reading from a CD-ROM.
                          Seeing a signal with ~350 mV peak-to-peak. Signal
                          rate is about ~16 MHz when spinning at normal rates,
                          but I can slow down the signal by pressing on the
                          spindle.
                          
                          Both signals are read. They might be quadrants from
                          the photodetector. Haven't tried sampling multiple
                          signals concurrently yet.

    5        GND

    6 - 7    PD DATA      A little thicker than usual, capacitively coupled to SoC.
                          Looks like another differential or AC photodiode signal.
                          Speed proportional to disc rotation rate.

    8        ANALOG       Regular thickness, levels suggest an AC signal, no
                          discernable signal when reading a CD-ROM
                          1.68v when burning BD-R.

    9        5V_a         Switched 5V power

    10 - 13  ANALOG       ~1.7v during BD-R burn
    
    14       GND

    15 - 17  ANALOG       Seem to be high speed analog or data signals,
                          riding on ~1.5-2v DC bias +/- 80mv or so.

    18       5V_a         Switched 5V power (same as 9)

    19       DATA         0v during BD-R burn
    20       DATA         3.3v during BD-R burn
    21       DATA         0v during BD-R burn

    22 - 23  DATA         High-speed (>= 40 MHz), 300 mV p-p, probably differential
                          Laser burn data? Active during BD-R burn.
    
    24       5V_a         Switched 5V power (same as 9)

    25 - 26  DATA         High-speed (>= 40 MHz), 300 mV p-p, probably differential
                          Laser burn data? Active during BD-R burn.

--- 27       GND          (This may represent the point where this FPC splits,
--- 28       GND           tray electronics below and pickup electronics above.)

    29       ANALOG?      130mV during BD-R burn
    30       ANALOG?      670mV during BD-R burn
    31       ENABLE?      3.3v during BD-R burn, thin trace
    32       5V           Switched 5V power

    33       5V           Switched 5V power

    34       ENABLE       3.3v signal, to SoC

    35 - 38  COIL x4      4x, to TPIC1391, VCM fine-control
                          ~50mV, fine tracking waveforms

    39 - 44  COIL x6      6x, to TPIC1356, VCM coarse-control
                          5V, 320 kHz PWM. Probably focus?

    45 - 48  COIL x4      Spindle brushless motor
                          Connected to TPIC1356

    49       COIL         Eject solenoid, active high
                          Connected to TPIC1356

    50       BUTTON       Eject button, active low, weak pull-up
    51       LED          Front panel LED, active high
                          - Routes to a resistor way over by the xtal, the one
                            alone near the edge of the board. Connects to the
                            side facing toward the front of the drive, away from
                            the board edge with the connector.
                          - Then, it comes ALL the way back to pin 1 of
                            the TPIC1391. Is this a layout mistake, or is there
                            some alternate I/O option perhaps that needs the
                            LED signal on that end of the board?
                          - Still open-drain with weak pull-up at pin 1 of the TPIC1391
                          - Clean square wave input at pin 10 of TPIC1391 (3.3v),
                            opposite polarity (active low, matches GPIO).                     

    52       GND

    53 - 56  COIL x4      Sled stepper motor
                          Connected to TPIC1356

--- 57       GND


- Tray PCB
    - Some passive components. Capacitors, at least one resistor.
    - Mostly just a breakout for the 56 pin cable (soldered to the back)
    - 8 pin flex cable
        - 4 pins to sled stepper motor
        - 1 pin common for eject solenoid, eject button, LED
        - 1 pin to eject solenoid coil
        - 2 pins to front bezel PCB
    - 5 pin flex cable to spindle motor
    - 45 pin flex cable to optical module

- Front bezel PCB
    - 3 pin flex cable (soldered)
    - Common, LED, Button
    - Very bright blue LED!

- Optical module
    - Very thin and delicate 45-pin flex cable, usually hidden under
      a metal shield. Probably no PCB involved, just flex cable origami.

    - Components inside are obscured, haven't tried disassembling yet.
      Only internal connections visible are on one of the optical modules.
      One large ground or mounting pin, four small electrical pins. Soldered
      to part of the large folded FPC.

    - Because the copper is so thin, the traces vary greatly in width
      according to the current capacity. So we have some clues about
      how the components might be connected. Starting from the labeled
      pin 1 arrow on the tray PCB:

    1 - 4    HS DATA      These look like high speed serial data pairs.
                          Pins 1/2 and 3/4 seem to be arranged as matched pairs in
                          the cable's routing.
    
    5        GND?         Probably ground? This seems to be routing as a pour.
    
    6        POWER?       A power rail? This is a little thicker than average.
    7        POWER?       A power rail? This is a little thicker than average.
    8        DATA         Regular thickness.
    9        POWER?       A power rail? This is a little thicker than average.
    10 - 13  DATA         Group of four data lines routed as normal traces
    14       POWER?       A power rail? This is a little thicker than average.
    15       SHIELD?      Looks a little thin, and there's a large gap after this.

    16 - 17  COIL?        Heavy traces close together with gaps on both sides
    18 - 25  DATA x8      Might be voice coils, more likely an 8-lane data bus maybe
    26       BIG POWER    Thicker power trace than above. Probably a +V rail?
    27       N/C          No connect to this pin. No trace on the FPC.
    28 - 29  GND          Two pins ganged together, connected to a ground pour.
                          This pour becomes the thickest trace on the whole cable.
                          This likely becomes a ground plane somewhere inside the
                          module where there would need to be an amplifier/driver
                          chip for the laser and photodiode modules.
    30 - 32  DATA         3 normal thickness traces
    33       GND?         As thick as earlier power traces. Could be common for
                          30-32, headed directly to some piece of hardware on the sled.
    34       GND?         Seems to be just like 33, but not related to 33 so much
                          as to the next few traces below.
    35 - 39  DATA         Another 5 normal traces.

    40 - 45  VCM          A set of six enormous traces. Verified that these connect
                          directly to the voice coil motor on the lens assembly.


Tray Mechanism
==============

The tray is the thing that holds the disc and all optical/mechanical parts. In
this section we're talking about the stuff that's specific to how the tray
moves in and out for disc loading and eject. The tray mechanism consists of:

- Two tray position sensor switches (almost-closed and closed).

  The almost-closed switch seems to get the ARM processor into gear, whereas
  the actually-closed switch seems to be more about power interlock. Both
  switches can be read by the ARM, but the fully-closed switch seems more
  indirect.

- A spring-loaded mechanism that pushes a core into the solenoid when the
  tray closes. You can trigger this by hand when the tray is open by pushing
  a small white plastic lever until it locks.

- A eject solenoid, powered by 5V, uni-polar. Terminal nearest the edge is
  ground, the other switches to +5 when activated. Measured in-circuit at 11
  ohms. This ground is shared by the tray LED. Mapped to ARM GPIO, driven
  directly by TPIC1356 chip. (TPIC1356 pins 5 & 17 show this signal but without
  visible ringing)

- An LED and button,
  both attached to ARM GPIO. Button generates a TBD interrupt.

All tray hardware is directly attached to the ARM core as GPIO.


Power Consumption
=================

Totals:

   50 mA    Minimum observed
   90 mA    Idle at cmshell
  200 mA    Initial current when booting
  220 mA    After %eject (tray powered still?)
  400 mA    Disc spinning, otherwise idle
  410 mA    Reading blu-ray
  580 mA    Tray solenoid on
  620 mA    Burning blu-ray at 1x
  650 mA    Reading CD-ROM at high speed
  700 mA    Reading BD-R at high speed
  850 mA    Bringing spindle up to speed, looking for disc
 1220 mA    Writing BD-R while accelerating spindle

Components:

  360 mA    Tray solenoid


Spindle Motor
=============

Brushless motor, highest power draw in system. Driven by TPIC1356 chip.
Power cutoff controlled by tray switch #2.

With ARM wedged in bitbang_backdoor:
- motor still starts/stops when tray switch opened/closed
- can detect disc / no-disc. With no-disc, stops rotation.

Could be these smarts are in the TPIC1356. Also could be in the DSP code?

