HOME

            daVinci Hardware Guide by Jesús Arias.

(updated: 1999-10-25)

Versión Española.


The information contained in this document is the result from a lot of reverse engineering hours into a 2Mb daVinci PDA. This analysis begins with the opening of the PDA to look what's inside, continues with a hardware hack in order to make the serial boot loader of the dragonball processor possible, and concludes with the execution of simple test programs.

Some information comes from the disassembled O.S. code. Following this way Mark Tillotson found the NEXUS chip commands for touch panel and buttons. The O.S. boot section is also very interesting in order to identify general pourpose I/O pins and memory mapping.

Other data like cradle connector pins and schematic is freely available on Internet.

This documentation may be erroneous and/or inaccurate. Use with care.

The "MC68EZ328 Integrated Processor User's Manual" from Motorola is mandatory in order to understand this document.


Contents:

News.

General daVinci schematic.

Memory The LCD. The Nexus Chip. Serial & Cradle Miscellaneous. Contributions.


News

(2000-06-23) Experimenrtal OS for dragonball daVinci's. (Spanish only)

(1999-10-25) Nexus Power Down. Power Measurements.

(1999-10-24) PF0 & PD1 pin functions.


Memory 


256K vs 2Mb.

Two daVinci models are known to this date: The 256K and the 2Mb. The total amount of memory of each model is:

256K: 256 Kb RAM, 1MB Flash.

2Mb: 256 Kb RAM, 2MB Flash.

As you can note the first model is named by RAM and the second by Flash. This is obviously a marketing strategy, but i personally think it's just a lie.

Memory mapping.

The daVinci O.S. maps it's memory via 68ez328 programmable chip selects. The particular memory address are the same used in the Palm Pilot. What do you think about it?

PRIMARY FLASH $10C00000 (1 Mb)

SECONDARY FLASH $10400000 (1 Mb)

RAM $00000000 (Only the first 64 Kb) $10000000 (The whole 256 Kb)

RAM.

The RAM memory is implemented by two Hyundai HY62V8100A chips. Each Chip has 128K, 8 bit wide, memory cells. The 68ez328 is configured to use a 16 bit data bus, so each RAM chip fills half data bus. One chip is connected to D0-D7, while the other is connected to D8-D15.

One interesting aspect of the RAM is the double mapping. This is possible thanks to the use of two 68ez328 chip select outputs that are or'ed together by means of one external 74hc08 gate. The Chip Select outputs are:

CSB0: Base=$10000000 Size=256Kb Wait_States=0 Read_Only=NO Supervisor_Only=NO Bus_Width=16 bits

CSC0: Base=$00000000 Size=64Kb Wait_States=0 Read_Only=NO Supervisor_Only=NO Bus_Width=16 bits.

Flash.

There are two 1Mb flash chips in the 2Mb daVinci version or only one in the 256K. These chips have their part number intentionally erased, but the pin count shows that they mush be 16 bits wide. Anyway, all the modern memory chips can be identified by software, and the daVinci Flash yields the following ID numbers:

Manufacturer ID: $0004 (Fujitsu)

Device ID: $225B (MBM29LV800BA)

These Flash can protect each sector individually. When protected, one sector cannot be programmed or erased without the application of high voltage (12 V) at the reset pin, and executing a previous unprotect command, while unprotected sectors can be erased or programed at only 3.3 volts. The primary Flash has it's first 3 sectors protected (32 Kb). This memory area contains the daVinci boot code. The rest of the primary flash (O.S.), and the whole secondary flash (App's) are unprotected.

The primary Flash is selected via CSA0, the default boot chip select. The Secondary Flash is selected via CSD0. The programming of these chip selects are:

CSA0: Base=$10C00000 Size=1Mb Wait_States=1 Read_Only=NO Supervisor_Only=NO Bus_Width=16 bits Flash_Timming=NO

CSD0: Base=$10400000 Size=1Mb Wait_States=1 Read_Only=NO Supervisor_Only=NO Bus_Width=16 bits Flash_Timming=NO

Notes:


The LCD

LCD connection.

The LCD controller has a direct connection to the 68ez328. The main aspects are:

Grayscale modes.

The LCD screen can display grayscale images with 2 & 4 bit/pixel. These modes are programed via "LCD Panel Interface Configuration Register". The only problem with grayscale modes is the flickering, that can be eliminated programing a faster pixel clock in the "LCD Pixel Clock Divider Register". The default divider value is 6, that is good for Black&White images. For 2 & 4 bit/pixel modes the divider must be 3 and 1 respectively.


The Nexus Chip

SPI connection.

The daVinci includes a custom chip that handles the touch panel and buttons. This chip is labeled "NEXUS rev 1.0", and connects to the 68ez328 via the Serial Peripheral Interface (SPI).

The SPI is a bi-directional interface. While one bit is shifted out trough SPIMTXD, another bit is shifted in from SPIMRXD. The timing is controlled with SPIMCLK. From the NEXUS chip this means that you can send commands to the NEXUS while reading previous data.

The SPI clock is programed to a very low rate (sysclock/512 = 32384 Hz). This provides time enough to perform A/D conversions while moving data. The Phase & Polarity of the clock are programmed to the default value "00". The transfers are 10 bits long. Before any transfer the select pin of the NEXUS chip must be driven low via the general pourpose i/o pin PD0. A delay of more than 50 usec between PD0 assertion and SPI data transfer must be done by software for proper operation.

The PD1 I/O pin is probably connected to NEXUS reset, because it must be high for proper operation.

Reading touch panel coordinates.
 
TRANSFER SPI WRITE SPI READ
$0 
---- 
$40 
$0 

X & Y coordinates are obtained from a 10 bit A/D converter, so they are in the [0-1023] range.

Reading button status.
 
TRANSFER 
SPI WRITE 
SPI READ
$200 
---- 
$200 
BUTTONS

BUTTONS is a 10 bit word. The pressed buttons are read as 0. The button mapping is:
 
BIT 
9
BUTTON 
DOWN 
TIME 
FIND 
UP 
RIGHT 
LEFT 
ON 

Reading battery voltage.
 
TRANSFER 
SPI WRITE 
SPI READ 
$80 
---- 
$80 
Vbat 

The actual voltage is Vbat*3.3/1024

Nexus Power Down.

The Nexus chip allows a command to reduce power requirements when the daVinci is sleeping. For proper power-down a delay between the last valid Nexus command and the actual power-down command is required.
 
TRANSFER SPI WRITE SPI READ
1
$100
----

Event interrupts.

The NEXUS chip post an interrupt to the 68ez328 when a button is pressed or a tap is done on the touch panel:


Serial & Cradle

Cradle connector pins.

The daVinci cradle connector is a PCB edge type with 12 signals. 4 lines are intended for serial communications, 3 for the external keyboard, 1 for a reserved interrupt input, 2 for power, and 2 are unconnected. All the signals uses CMOS logic levels (0 volt for FALSE, 3.3 volt for TRUE)


 
Pin 

Number

Signal 

Name

Description Direction 

with 

respect to 

daVinci

Functionality
1 RxD Data 

Receive

Input Serial data in. Up to 115200 baud.
2 TxD Data 

Transmit

Output Serial data out. Up to 115200 baud.
3 RTS Request to 

Send

Output daVinci asserts RTS when it is 

ready for host data. 

(not connected to PC)

4 CTS Clear to 

Send

Input Host asserts CTS when it is 

ready for daVinci data. 

(not connected to PC)

5 GND 

(Vss)

Ground Power 0 Volts
6 PD3 Keyboard Input Data input from keyboard
7 PD2 Keyboard ? Clock for keyboard
8 IRQ6 Reserved Input Reserved Interrupt input
9 IRQ1 Keyboard Input Keyboard Interrupt
10 Vcc 

(Vdd)

Power Power 3.3 Volts
11 NC - - Not connected (reserved)
12 NC - - Not connected (reserved)

Cradle Schematic. (postscript version).

Level conversion.

As one can see from the above schematic, the PC must provide the power for logic level conversion via DTR & RTS pins. For proper operation DTR must be high (1 in 16550 MCR) and RTS low (0 in 16550 MCR). With this circuit the actual RS232 levels are +3.3 and -12 Volts. A little low H level, but still high enough for proper operation. Note that no current is drawn from the daVinci side, so serial communications only have a little impact on battery lifetime. The daVinci TXD pin can be configured as OPEN DRAIN output with PULL-UP or TOTEM POLE output.


Miscellaneous

Sound.

The only way to produce sound in the daVinci is it's piezoelectric speaker. This speaker is connected to PWMO output, probably trough a single transistor voltage amplifier. The quality of this sound system is so poor that it can only be intended to produce beeps.

The poor characteristics of the sound system are due to the resonant nature of the piezoelectric speaker, the absence of anti-alias filters, and probably to the non-linearity of the amplifier. Although the PWMO output of the 68ez328 can play 8 bit samples at rates up to 8, 16 or 32 KHz, the big distortions makes this potential feature useless, as the following test shows:

A synthesized 1500 Hz sine wave was played trough the PWMO output at 32384 Hz sampling rate with 4 times sample repeating. This makes an effective 8096 Hz sampling rate while the PWM carrier is at 32 KHz. The sampled & quantized wave is:

The low sampling rate makes the wave a little irregular, but looking at the spectrum we can see that this wave is a very "monochromatic" sound:

The sound that actually emits the daVinci has the following spectrum:

In this graph we remark the fundamental 1500 Hz frequency (f0), it's harmonics (2f0, 3f0,...), the 8096 Hz sampling frequency (fs) and some alias frequencies (fs-f0, fs-2f0,...). As we can see, the spectrum of the played sample is very different from the expected single tone output. We can also note that the third harmonic is the strongest signal. The conclusion is:

The daVinci is unable to play sampled waves. It can only play simple square or rectangular waves. This limitation is due to the sound amplifier and speaker, not to the dragonball processor.

Battery cover switch.

The daVinci has a little switch on it's rear that locks the battery cover. This switch must be pulled-up in order to replace the batteries. One usually don't suspect that this switch has software implications. But a simple test shows that this switch pulls PD5 low when unlocked. This pin has interrupt capabilities, so, when you unlock the battery cover a level 2 interrupt is posted to the core and the O.S. can do some "urgent" processing before the battery removal.

Power requirements.

The following table shows the magnitude of the power requirements for some different daVinci conditions. The measurements were taken while the CPU executes a do_nothing_loop().
 
Measurement CONDITIONS
Battery Current (mA)
CPU Full Speed (16.5 MHz), LCD ON, BACKLIGHT ON
87.5
CPU Full Speed (16.5 MHz), LCD ON
55
CPU Full Speed (16.5 MHz), LCD OFF
46.1
CPU doze mode 1/32, LCD OFF
8.7
CPU doze mode 0/32 (stopped), LCD OFF
7.3
PLL OFF, LCD OFF
2.1
PLL OFF, LCD OFF, Nexus Power-Down
0.1

From the above table we can derive the current needed for each subsystem:
 
daVinci Subsystem
Current (mA)
Nexus Chip
2
LCD
8.9
Backlight
32.5
CPU at Full Speed (16.5MHz)
44
CPU, doze mode: N/32
5.2+1.2*N
CPU Peripherals & PLL system
5.2


Contributions