D5100Hardware

From Nikon Hacker
Jump to: navigation, search

Introduction

By just observing a D5100 motherboard, we were able to extract valuable information regarding connections between chips and their roles. Below is a log of all information retrieved, in no particular order.

Mainboard Layout

Side A

D5100BoardSideA.jpg

Known chips

Chip Number Manufacturer Connected to Description
K4T1G164QF-BCE7 4 Samsung Expeed (External Bus) SDRAM, DDR2-800 or DDR2-667, 4x 64Mx16=512 MB
MX29GL128EHXFI-90G 1 MXIC Expeed (External Bus) Flash memory, 8Mx16=16 MB
TMP19A44FEXBG 1 Toshiba Expeed (serial) MIPS Microcontroller, operating Buttons/dials, Lens interface, viewfinder, flash popup, IR receiver
EI-154 1051 Z05 1 Nikon - Expeed-2: FR80 RISC controller, image processor, FR-V Fujitsu DSP
EI-155 M4L1BA00 00151044 1 Nikon Expeed CMOS Sensor Timing Generator / LVDS Decoder
NHHS-2 049M8 1 Nikon  ? Flash charge controller
µPD168807 1 Renesas - Power management IC (PMIC)
9795A 1024 1 Rohm Semiconductor TMP19A44FEXBG (serial) BU9795Axxx LCD segment driver for viewfinder
ST 504RP K047 1 ST Microelectronics TMP19A44FEXBG (serial) EEPROM compatible with ST95040
X0. a 1  ? TMP19A44FEXBG X1,X2 clock 10MHz
CA040 1  ? S35393 Crystal Oscillator 32768 Hz
S35393 1 Seiko XT1 of TMP19A44FEXBG, I2C - ? Real-time clock (I2C device code=6), low-speed clock (32KHz) source for TMP19A44FEXBG
12.28S 1  ? Expeed X0A,X1A sub clock 12.28MHz ?
B48.000 1  ? Expeed X0,X1 main clock 48 MHz
WM8946E 1 Wolfson Microelectronic Expeed Stereo Audio-Codec controlling microphone, speaker and A/V Line out. Expeed uses digital sound output/input for record/playback and I2C as control interface.
BD6736 1 Rohm Semiconductor  ? Mirror charge driver
MS518SE 1 Seiko Expeed Backup battery for Real-time clock operation
LB1938FA 1 ON Semi  ? Drives aperture lock solenoid

Power lines

There several power sources, power lines and different power modes utilized by camera.

Name Source Value Description
Vclk Seiko MS518SE 2..3 V supply power to real-time clock and other components when Power switch is Off
Vbat Nikon EN-EL14 7.3...8.3V main power source. Used directly to power lens motor, loading flash capacitor and throw voltage regulator/reducer for other electronic components (also loading Seiko battery).

Voltage regulators and downstream power supplies

Voltage Source Converter Destinations ICs
VCC3.3 uPD168807 CH4 EI-154 / EI-155 / TMP19 AVCC / BU9795 / MX29GL128EHXFI / 12.28/48 Oscillators / AE/AF CCD / Viewfinder Focus Dots
VCC1.8 uPD168807 CH2 EI-154 / EI-155 / DDR2 SDRAM / WM8946 Core
VCC1.25 uPD168807 CH1 EI-154 / EI-155
VCC5V uPD168807 CH3 AE/AF CCD / Lens CPU / Viewfinder LCD / Motor Driver ICs
6V 6 Pin Large Regulator under SD Slot. Step down from Vbat 6V intermediate power rail
VCC3.3 Digital (Always On) P4SB Regulator (SOT23-5 next to clock battery) step down from 6V TMP19 DVCC / S35393 Real time clock
VCC12 Boost Converter from VCC5 (QFN20 under SD slot) AE/AF CCD
26V Boost Converter from Vbat (8Pin ELG/FO/MHL) TFT LCD (probably back light)

Top Button/Dials/Hot-Shoe Connector

If we define the pinout as follows:

Top Panel Connector.jpg

1~19 are related to buttons on top panel. 20~31 controls the flash and hot shoe. Pins were traced on the motherboard and here are the connections:

Pin Connected to Notes
1 N/C
2 Toshiba's T17 pin "P57/A7/TB3OUT/KEY29"
3 Toshiba's U16 pin "P56/A6/TB2OUT/KEY28"
4 Toshiba's A8 pin "PE1/KEY09"
5 Toshiba's B13 pin "PA0/INT0/PHC0IN0", and to a discrete component (resistor, capacitor) just above the Toshiba.
6 Toshiba's E14 pin "PH2/INT1A/TBAIN0"
7~8 reaches a thicker track that goes to a 3-pin component also connected to pin T10 "P26/A22/A6/TB5IN0" of the Toshiba and to the 6-pin chip between the QR code and the Nikon NHHS-2. Also to programming/JTAG connector on the back side Probably a power supply.
9 one pin of the top 235 SE chip (or 235 X2 depending on the motherboard) and TMP10 L17 Same logic as pin 11.
10 to one pin of the middle 235 SE chip (or 235 X2 depending on the motherboard) and TMP19 Pin A2 (P84/AINC4) Same logic as pin 20.
11 Toshiba's J15 pin "PG6/KEY06"
12 Through a resistor/capacitor delay circuit then to TMP E7
13~15 GND
16 Toshiba's E6 pin "PF7/KEY23/TCOUT7" Shooting mode switch.
17 Toshiba's B6 pin "PF4/KEY20/TCOUT4"
18 Toshiba's D6 pin "PF6/KEY22/TCOUT6"
19 Toshiba's C6 pin "PF5/KEY21/TCOUT5"
20~21 VCC5 Power Supplies 5V to multiple connectors
22 Toshiba's D15 pin "PH3/INT1B/TBAIN1" (plus a large via that doesn't seem to go anywhere)
23 Toshiba's T12 pin "P44/SCOUT"
24 Flash controller (NHHS-2) On FPC: Flash pop up transistor
25 Flash controller (NHHS-2), through a discrete component (resistor, capacitor)
26 one of the 2 terminals of the component marked "121" next to the Nikon chip above, then to two of its pins
27 Flash controller (NHHS-2), as well as to 2 discrete components (one 2-pin, one 3-pin)
28 the Flash controller (Nikon chip marked NHHS-2 close to the card reader)
29 Flash controller (NHHS-2)
30 Toshiba's J16 pin "PG5/KEY05" (through a discrete component, possibly a decoupling capacitor) but also to some pads next to the connector (pull-up resistor ?)
31 Toshiba's K3 pin "PB3/TB7OUT" On the top FPC: 1k Ohm -> Transistor -> AF Assist Lamp ON

AE CCD/Focusing Screen Connector

If we define the pinout as follows:

AE-SI-Unit-Connector.jpg

The left 13 pins (pins 13-25) are linked to focus screen (Super Impose Display Plate), 11 of which connect each to a focus dot.

The right 12 pins (pins 1-12) are responsible for the AE CCD.

Here are the traced pins:

Pins Connected to Notes
1 Toshiba's U15 pin (P54/A4/TB0OUT) AE CCD master clock (CLK) at 3.33MHz 33.3% duty cycle
2 Connected to AF Sensor connector Pin 8, VCC 5V
3 Toshiba's D7 pin (PF1/KEY17/DACK0) AE CCD pixel gain control 4x
4 Toshiba's D10 pin (PD3/TBBOUT) AE CCD exposure timing control
5 Toshiba's G14 pin (PI4/ADTRGC) A/D sampling trigger (SYNC)
6 Toshiba's D8 pin (PE4/KEY12) AE CCD voltage gain control 2x
7 ~ 9 GND, linked to AF Sensor connector Pin 5/6 GND
10 To a resistor, then to TX19 B4 pin P80/AINC0 AE CCD Vout
11 VREF 3.3V Connect to AF Sensor connector Pin 3
12 12V Power
13 & 14 Drain of transistor "X1" at the bottom right of the connector, Gate through a resistor, to Toshiba's F16 (PI5/TB10OUT) Common GND switch
15 to Toshiba's R4 (P02/D2/AD2) Controlling 1 focus dot in the viewfinder through the drain of transistor labelled "36".
24 & 25 to Toshiba's L4 - A9 pins (PB0/PHC3IN0 - PD4/TBCOUT) Controlling 2 focus dots in the viewfinder through drains of a dual transistor labelled "S3".
22 & 23 to Toshiba's R8 - K1 pins (P20/A16/A0/TB1IN0 - PB2/TB6OUT) Controlling 2 focus dots in the viewfinder through drains of a dual transistor labelled "S3".
20 & 21 to Toshiba's R7 - T8 pins (P14/D12/AD12/A12 - P17/D15/AD15/A15) Controlling 2 focus dots in the viewfinder through drains of a dual transistor labelled "S3".
18 & 19 to Toshiba's R6 - T7 pins (P10/D8/AD8/A8 - P13/D11/AD11/A11) Controlling 2 focus dots in the viewfinder through drains of a dual transistor labelled "S3".
16 & 17 to Toshiba's R5 - T6 pins (P05/D5/AD5 - P07/D7/AD7) Controlling 2 focus dots in the viewfinder through drains of a dual transistor labelled "S3".

AF Sensor

This connector is responsible for MultiCAM-1000 AF CCD.

AF.png


Pins Connected to Notes
1 TMP19 Pin T3 (P36/RW/TC2IN) AF CCD output state
2 Resistor -> X1 Transistor -> TMP19 Pin C9 (PD6/KEY31/ADTRGA) ADC sampling trigger
3 VREF VCC3.3 ADC/CCD Analog Reference
4 Resistor -> TMP19 Pin D3 (P70/AINA0) AF CCD VOUT
5, 6 GND - Shared by TMP19 VREFLA/B/C Analog/Digital Ground and ADC Low Reference
7 VCC 12V Power
8 VCC 5V
9 Shared with AE CCD master clock, fed from TB0OUT CLK 3.33MHz 33.3% duty cycle
10 TMP19 Pin C13 (PH7)
11 TMP19 Pin D9 STBY On during operation
12 TMP19 Pin E9 (PE0)
13 TMP19 Pin M16 (PJ2)
14 TMP19 Pin M15 (PJ3)
15 TMP19 Pin M14 (PJ4)

Lens CPU Pins/Front Body Switch

This connector links the front body flexible circuit board with button and lens mount.

Lens.jpg


Pins Connected to Notes
1, 2, 6, 7 GND
3 TX19 G16 Pin PI2/PHC5IN0 Lens Release Button
4 TX19 B8 Pin PE2/KEY10 Fn Button
5 TX19 B9 Pin PD5/TBDOUT Min Aperture Switch
8, 9, 10 VCC 5V Lens CPU Logic Power. Lens mount Pin 1
11 Connect to 8-pin-chip Lens mount Pin 2
F-mount pin 2 read/write selection to TX19A pin PJ7/INT7 Used for sampling this signal by firmware
F-mount pin 2 read/write selection through inverter on mainboard to TX19A pin PI3/PHC5IN1 Used for driving this signal by firmware
12 F-mount pin 3 serial clock through inverter on mainboard to TX19A pin P66/A14/SCLK1 Serial Clock. Lens mount Pin 3
13 F-mount pin 4 serial data through invertor on mainboard to TX19A pin P64/A12/TXD1 Serial Data. Lens mount Pin 4
14 Through a resistor and a capacitor, to TX19A P9 Pin P24/A20/A4/TB3IN0 AF-S lens GMR wave output. Lens mount Pin 5
15 TX19 B7 Pin PE7/KEY15 Flash Pop Up Button

Mirror/Aperture Module/Power PCB/Battery connector

If we define the pinout as follows:

D5100 MOBO APERT BATT CONNECTOR PINOUT.png

Pin 1~18 controls the SQ Base Plate for all the electromechanical systems including the mirror, aperture and shutter. All other pins controls the components on Power Plate and battery authentication. Here are the traced pins:

Pin From (Main Board) To (Periphery Component) Notes
1 TMP19 E2 (P74/AINB0) Aperture PI Pulse Signal
2 TMP19 T5 (P04/D4/AD4) Aperture PI Enable
3 TMP19 R2 (P33/WAIT/RDY) LB1938 (Aperture Solenoid Driver) IN1 Release Aperture
4 TMP19 J4 (P97/TBAOUT) LB1938 IN2 Lock Aperture
5 TMP19 E15 (PH1/INT19/TB9IN1) Mirror Gray Code 3
6 TMP19 E16 (PH0/INT18/TB9IN0) Mirror Gray Code 2
7 TMP19 B11 (PA5/INT5/TB6IN1) Mirror Gray Code 1
8 TMP19 P6 (P11/D9/AD9/A9) BD6736 (Motor Drive) INB
9 TMP19 P16 (P63/A11/TB4OUT) BD6736 INA
10 TMP19 P7 (P15/D13/AD13/A13) BD6736 PS & PWM
11 Unplaced Pad Only
12 VCC3.3
13, 14 GND GND
15, 16 VCC5
17 TMP19 P1 (P30/RD) Switch Transistor - Rear Curtain Release hold solenoid on falling edge
18 TMP19 P2 (P31/WR) Switch Transistor - Front Curtain Release hold solenoid on falling edge
19 TMP19 C7
20 TMP19 L16
21 TMP19 Pin F1 (P77/AINB3/INT13) Possibly flash light main condenser voltage meter
22 NHHS-2
23 NHHS-2
24 NHHS-2
25 NHHS-2
26 Resistor/Inverter NHHS-2
27 TMP19 Pin K4
28 TMP19 Pin R1 / Transitor
29 TMP19 Pin F2 (P76/AINB2/INT12), through a resistor to VCC3 Not used, might be for test purpose
30 NC NC
31 TMP19 Pin N1 / Pin 7 (SDA) of the S35393 real-time clock
32 TMP19 Pin N2 / Pin 6 (SCL) of the S35393 real-time clock
33 TMP19 Pin N3
34, 35, 36 GND
37, 38, 39 6.2V

Toshiba TMP19

Serial-related pins

Pin# Pin name Description Connects to...
SIO0 (a):
C17 TDI/RXD0 Receiving serial data 0 (a) the "Unknown" connector on the Toshiba side, just under the Toshiba chip
D17 TDO/TXD0 Sending serial data 0 (a) the same connector
SIO0 (b):
R16 P61/A9/RXD0/INTA Receiving serial data 0 (b) one of the 3 identical 6-pin chips near the HDMI port (marked 235 SE or 235 X2 depending on the motherboard)
R17 P60/A8/TXD0 Sending serial data 0 (b) a 3-pin chip next to one above
SIO1:
P15 P64/A12/TXD1 Sending serial data 1 a small 3-pin chip on the Expeed side
N17 P65/A13/RXD1/INTB Receiving serial data 1 the 8-pin chip just below. I fail to decode what's written on that chip. Somehing like "V08 02 604 13" ?
SIO2:
J1 P94/TXD2 Sending serial data 2 not connected (goes nowhere)...
J2 P95/RXD2 Receiving serial data 2 not connected (goes nowhere)...
HSIO0:
G4 P90/HTXD0 Hi-speed Sending serial data 0 a via which traverses a few layers, but reaches a dead-end in layer 6 (?)
H2 P91/HRXD0 Hi-speed Receiving serial data 0 a via which traverses a few layers, but reaches a dead-end in layer 6 (?)
HSIO1:
K2 PB4/HTXD1 Hi-speed Sending serial data 1 the Flash controller (the Nikon chip marked NHHS-2 close to the card reader)
L1 PB5/HRXD1 Hi-speed Receiving serial data 1 the next pin of the Flash controller
HSIO2 <-> Serial eeprom:
A10 PD0/HTXD2 Hi-speed Sending serial data 2 pin 5 (D) of the 8-pin ST eeprom next to the Toshiba, as well as pin B3 (SD) of the viewfinder LCD driver
B10 PD2/HSCLK2/HCTS2 High-speed serial clock input/output 2 pin 6 (C) of the ST eeprom, then continues to pin A3 (SCL) of the viewfinder LCD driver
C10 PD1/HRXD2 Hi-speed Receiving serial data 2 pin 2 (Q) of the ST eeprom
U13 P46/ENDIAN P4.bit6 used as ~SELECT for the eeprom pin 1 (!S) of the ST eeprom
A7 PE6/KEY14 PE.bit6 used as ~SELECT for the LCD driver pin C4 (CSB) of the viewfinder LCD driver
Serial bus interface:
N1 PC4/SO/SDA Sending in SIO mode a via which traverses a few layers, but reaches a dead-end in layer 6 (?)
N2 PC5/SI/SCL Receiving in SIO mode a via which traverses a few layers, but reaches a dead-end in layer 6 (?)

Interfaces

So after more investigation, interfaces are connected as follows :

TMP19A44FEXBG
Channel Parameters Connected to Notes
SC0 UART: 4807 Bps, 8 bit, 1 stop bit, no CTS, no parity, LSB MC-DC2 connector GPS, sometimes for debug
SC1  ? Lens
SC2 - - unused
HSC0 Serial I/O: 1 MBps, 8 bit, no start/stop/parity bits, no CTS, MSB FR80 Interchip communication
HSC1 ? Flash controller (NHHS-2) iTTL Flash
HSC2 Serial I/O: 1 MBps, 8 bit, no start/stop/parity bits, no CTS, LSB Serial EEPROM, Viewfinder LCD driver
I2C ? ?

Buttons connections

Pin# Pin name Connects to button...
R9 P23/A19/A3/TB2IN1 "right"
U11 P40/CS0/KEY24 "AE/AF" Lock
B13 PA0/INT0/PHC0IN0 Power "On"
B12 PA1/INT1/PHC0IN1 "up"
C12 PA2/INT2/PHC1IN0 "down"
D12 PA3/INT3/PHC1IN1 "left"
A8 PE1/KEY09 "+/-"
B8 PE2/KEY10 "Fn"
C8 PE3/KEY11 "flash"
E7 PF2/KEY18/DREQ4 "record"
L14 PG0/KEY00 "ok"
K17 PG1/KEY01 "+"
K16 PG2/KEY02 "-"
K15 PG3/KEY03 "menu"
K14 PG4/KEY04 "play"
J16 PG5/KEY05 "LiveView"
J15 PG6/KEY06 "info"
J14 PG7/KEY07 "del"
L17 PJ5/INT17 "Shutter half-pressed"
M1 PC0/TBTIN/KEY30 "i"
A2 P84/AINC4 "Shutter full-pressed"

Port PF7:4 are connected to the mode dial on the top of the camera. Here are the values for the different positions:

Position PF7:4
Auto 1111
NoFlash 1101
Scene 0101
Portrait 0111
Landscape 0011
Children 0001
Sport 1001
Macro 1011
Effects 1010
M 0010
A 0110
S 0100
P 1100

P57:6 are connected the multi-purpose dial on the back of the camera. Each time you turn the wheel to the right one "stop", those two input pins have their value rotated to the left by 4 positions : 11 > 10 > 00 > 01 > 11.

Other pins

Pin# Pin name Description Connects to...
A11 PA4 IR remote input front
A12 BVCC3 Power a pad just next to the pin (probably a filtering capacitor) then to the smaller 8-pin chip just next to the Toshiba
E14 PH2 IR remote input rear
P17 P62/A10/SCLK0/CTS0 Port 6 bit 2 output dead end in layer 6, close to metering/battery connector

Expeed 2

Pinout

Connections

Pin# Description Connects to...
R7  ? pin F6 of the WM8946E Stereo Audio-Codec, through two discrete components (R/C)
S7  ? pin E6 of the WM8946E Stereo Audio-Codec, through one discrete component (capacitor ?)

Interfaces

FR80
Channel Parameters Connected to Notes
UART0 4.17 Mbps, 8 bit, no start/stop/parity bits, no CTS, MSB Sensor Bridge EI-155
UART1 4.17 Mbps, 8 bit, no start/stop/parity bits, no CTS, LSB IMX071 photo CMOS sensor
UART2 - - not used
UART3 - - not used
UART4 - - not used
UART5 1 MBps, 8 bit, no start/stop/parity bits, no CTS, LSB TMP19A44FEXBG HSC0 InterChip communication
UART6 - - not used

S35393 RTC

Pin# Pin name Description Connects to...
1 32KO Pin for constant output of 32.768 kHz TMP19 pin A14 (signal XT1)
2 XOUT Connection pin for crystal oscillator Crystal
3 XIN Connection pin for crystal oscillator Crystal
4 VSS GND pin GND
5 ~INT2 Output pin for interrupt signal 2 N/C
6 SCL Input pin for serial clock pin 32 of aperture module/battery connector
7 SDA I/O pin for serial data pin 31 of aperture module/battery connector
8 VDD Pin for positive power supply Vclk, power line from MS518SE battery

Reference

EEPROM datasheet (ST95040): http://www.st.com/st-web-ui/static/active/en/resource/technical/document/datasheet/CD00001755.pdf

LCD Driver datasheet (BU9795A): http://rohmfs.rohm.com/en/products/databook/datasheet/ic/driver/lcd_segment/bu9795afv-e.pdf

K4T1G164QF-BCE7: http://www.samsung.com/global/business/semiconductor/file/2011/product/2011/7/18/565798ds_k4t1gxx4qf_rev12.pdf

MX29GL128EHXFI-90G: http://www.zlgmcu.com/mxic/pdf/NOR_Flash_b/MX29GL128EHL_MX29GL128EUD_DS_EN.pdf

WM8946E: http://www.wolfsonmicro.com/documents/uploads/data_sheets/en/WM8946.pdf

BD6736 http://photo-parts.com.ua/parts/Datasheets/BD6736bd6736fv-e.pdf

MS518SE http://www.sii.co.jp/components/battery/productSpecBatEN.jsp?recordID=73

S35393 http://datasheet.sii-ic.com/en/real_time_clock/S35392A_E.pdf

Image Sensor: IMX071