Deeper dive into PipBoy 3000 Mk V hardware
To the surprise of absolutely nobody, the day I finally got my PipBoy 3000 Mk.V it was in pieces within an hour of me opening the box, so, maybe I can save everyone else the risk and satisfy some curiosity by describing what I found and a bit more information about how it works.
Dissasembly
Disassembly of the PipBoy 3000 was fairly straightfoward, the soft cuff parts pop straight out and then the plastic backing from behind it also just pops out. At this stage I opened the battery panel and took out the LiPo battery and set it aside. After that there are just 4 screws and the whole diecast from section comes away, being careful to not let it fall and pull on the cables!
To detach the diecast section I think uncoupled two of the JST connections, CN1 and USB, the main diecast section containing the mainboard now comes away and the rest of the model is set aside. Now we can see the back side of the mainboard, this side has the MicroSD card slot and all of the connectors to external inputs etc. At this point I noticed that there is a small loose metal panel on the back of the section that holds the LiPo, behind this is where the MicroSD card slot is, so I removed it, it’s held on by just a small plastic stub that I nicked off with a knife blade, this way I can get access to the MicroSD card without having to unscrew the main body, this does feel slightly intentional in its design, I’m sure the metal could have some thermal benefits to being adjacent to the LiPo but also it’s not really touching it, it’s on the other side of the plastic window area, so I got rid.
Now, to remove the mainboard itself. I started out be detatching all the JST connections and also carefully removing the 40 pin LCD ribbon to clear the board of all cables. The next thing blocking the way is the 10k pot used for volume control, this is held in by one screw but also requires the knob cap popping off from the other side. Now the tricker part, removing the board from the chassis, there are 4 screws holding it down but the main tricky part is the switches that are connected up to the front radio tune up/down knob, the trick I found to releasing this last part is carefully poke the plastic pins through from the back, locations shown below. Then carefully lift the whole board straight up and we’re free.
The Mainboard
To save my eyes and to make investigating the board easier, the first thing I did was to take high resolution images of the front and back of the board, each image is actually a handful of images stacked together to keep sharp focus across the board, this resulted in each image being approx 10,000px wide, plenty of resolution to work with.
Identifying the IC’s
The first thing I wanted to do is go over each of the major areas of the board, work out what is located where and then identify what the IC’s are in each area. The obvious one is the microcontroller itself, the STM32 right in the middle of the board, for each of the other ICs it was a combination of some logic about where it was located, any markings on the chip itself and then some trawling of datasheets, the result of that is below.
Points of interest
While I’m here I wanted to point out some of the interesting things that stood out to me at a first glance over this board:
Unpopulated footprints
At the bottom of the board just below the MCU there’s a footprint U2 that unpopulated, along with a couple of caps and resistors adjacent to it, likely some kind of last minute design change or something? At this stage, I wasn’t really sure, but I do come back to that and work it out later on.
Tuning switches
I was quite surprised by how the tuning dial was implemented, it’s really quite elegant. Rather than a dial switch there are just a couple of up and down microswitches that are sideways mounted on the mainboard and then a front facing switch for the push, it’s a really neat combination of electrical and mechanical engineering to solve a problem.
Antenna
The radio antenna is actually on the board! At the same time I was delving into this board, I’ve also been reversing the FM Radio upgrade for the PipBoy 2000, also by The Wand Company, and the radio there being much smaller has an external antenna in a curly cable, this wiggly antenna on the PCB itself isolated from the ground plane was really interesting to see and another elegant engineering solution.
Tracing the traces
At this point I had two things I wanted to achieve, I wanted to get more of an idea of what the missing U2 might have once destined to be, and I also wanted to know that for hackers like myself, is there anywhere I could tap into the i2c bus, or any other GPIO so that hardware modifications could be made to add functionality. To do this I started by overlaying pinouts for each of the IC’s from their respective datasheets and then highlighting the traces to work out some of the nets on the board. I achieved this by adding a bunch of layers and groups in Photoshop and then using the pen tool to follow the traces, some of the traces of course go through to the other side of the board, so under the assumption this is a 2 layer PCB I overlayed an inverted image of the back of the board and then aligned all of the screw holes so I could toggle the layers on and off and follow traces through each side of the board.
Now I’ll be the first to admit that it was at this stage I got a little bit carried away and found it somewhat therapeutic and educational, and as such ended up doing way more than was reasonable or necessary, but alas…
The results
The pinouts from the STM32 were achieved by using STM32CubeMX, selecting the MCU that’s on this board and then configuring all the pins based on a combination of what I could see on the PCB, what I could see in the firmware itself and then just some logic/guesswork. This was really important in helping work out which pins were used for i2c to the radio for example, which was one of my initial goals, i2c in the above image is the blue traces.
So who is U2?
And we’re not talking about the purveyors of pushy album releases. What is the missing IC likely to be? Well, the first pins that were easy to identify are the ones that are connected to the ground plane, so we know that pin 4 is GND. The second most strightforward to identify pins are anything connected to VCC, there are two missing caps C22 and C23 adjacent to the footprint, an educated guess would suggest these are decoupling caps and as such the traces between those and the IC are going to be connected to VCC, this turns out to be pins 3, 7 and 8. So this only leaves us with 4 pins to determine, and those 4 have traces that all lead back to the MCU, the visible ones at least connect to PB3, PB4 and PB5 which trace back to pins 2, 5 and 6. Pin 1 goes via the back of the board and then up behind the MCU somewhere behind PC11 but I couldn’t confirm where it’s connected, logic would state that it could be PC11 given where the via is?
Knowing now at least where the majority of the pins connected to the MCU I used a process of deduction to click around in STM32CubeMX and see what those pins have in common and the one thing that stands out is SPI, if it were to be SPI then that would make pin 6 CLK, pin 5 as MOSI and pin 2 as MISO, leaving only pin 1 which as a process of deduction if it is SPI would be NSS. So, what is an 8 pin SOIC, with SPI and a pinout like we have deduced? The only thing I could think of that would make sense is a flash memory chip, the first 8 pin SOIC flash memory chip that comes up when I google has a pinout that perfectly matches what we’ve deduced from the traces so it seems highly likely that U2 was at some point destined to be flash memory, was this replaced by the MicroSD, was it originally supposed to supplement the SD? Anyone’s guess.
So where can we expand?
I was hoping that there would at the least be some test points for i2c so there was somewhere I could hook up to, but alas there was not. For i2c if there were to be anything added, the best I can come up with is to attach wires on to the back of either R85 and R86 near the MCU, or if that’s a little to close together, also potentially off the back of the inductors at L10 and L7 over near the FM radio, or perhaps the nearby R77 and R84. None of those options are particularly clean or easy, but also not impossible.
For GPIO, given that U2 is missing, you could also hook up to the pads at 2, 5 and 6 of U2 and access them via B3, B4 and B5 in Espruino, STM32CubeMX suggests that they can be used for GPIO in, out and analog which provides a couple of useful options there too.
Obvious disclaimer
I should hope that this goes without saying, but please don’t pull apart and break the hardware of your PipBoys based on anything I have written here unless you know what you’re getting into and accept the risk that you could break everything.