Disposable Digital Camera Hardware

(Including SPCA504B internal registers)

[camera pic from pcworld.com article]
This is yet-incomplete documentation of the internals of the camera.

SPCA504B Internal Registers
The only register documented in the public SPCA504B datasheet is the mode register at 0x2000. All the rest have been reverse-engineered, figured out from USB snoops, or from gphoto data (some of which comes from official channels through mustek)

Register
 Description
 Parameters
 Source
0x2000
 Camera Mode
 Idle = 0, DSC = 1, VideoClip = 2, PcCamera = 3, Upload = 4
 Datasheet, gphoto
2019
 some sort of picture flash config
 see detailed flash-reading procedure
 code
2026
 some sort of picture flash config see detailed flash-reading procedure code
2035.7
 CS* for Holtek 1621
code
2036.0
 clock/WR* for Holtek 1621
code
2036.1
 unknown
code
2036.2
 unknown
code
20ff
 hardware revision level?
 Returned with software revision.
 code
21a7
 brightness
 default = 0x00 SPCA50x web cam driver
21a8
 contrast
 default = 0x20 SPCA50x web cam driver
21ad
 hue
 default = 0x00 SPCA50x web cam driver
21ac
 sat/hue
 default = 0x01 SPCA50x web cam driver
21ae
 saturation
 default = 0x20 SPCA50x web cam driver
21a3
 gamma
 default = 0x00
 SPCA50x web cam driver
2300
 USB fifo register?
 used in firmware update. code
2301
 SPCA50X_REG_PbSrc SPCA50X_DramUsb = 0x13 : direction dram->USB; needs Trigger to activate.
I'm not sure what "Pb" stands for, but it seems to be some sort of DMA transfer.
 gphoto
2306
 SPCA50X_REG_AutoPbSize
gphoto
2401.2
 data for Holtek 1621
code
2420
 Picture flash data register
 Read and write strobes are generated by hardware.
see detailed flash-reading procedure
 code
2423
 Picture flash control reg
 [0] [0] [0] [0] [CLE] [ALE] [WP*] [CE*]
see detailed flash-reading procedure
 code
2500
 USB FIFO I/O register, control pipe
code
2705
 SPCA50X_REG_DramType
3 = 64 Mbit, 4 = 128 Mbit gphoto
270c
 SPCA50X_REG_ImageType
gphoto
2710
 SPCA50X_REG_SdramSizeL SDRAM size [7:0]
 gphoto
2711
 SPCA50X_REG_SdramSizeM SDRAM size [15:8] gphoto
2712
 SPCA50X_REG_SdramSizeH SDRAM size [21:16] gphoto
2713
 SPCA50X_REG_VlcAddressL VLC Address [7:0]  (not sure what "VLC" stands for)
 gphoto
2714
 SPCA50X_REG_VlcAddressM VLC Address [15:8] gphoto
2715
 SPCA50X_REG_VlcAddressH VLC Address [21:16] gphoto
2716
 Something_L
 unknown 24-bit register, [7:0]
 code
2717
 Something_M
 unknown 24-bit register, [15:8] code
2718
 Something_H
 unknown 24-bit register, [21:16] code
2720
 SPCA50X_REG_MemWidthL
gphoto
2721
 SPCA50X_REG_MemWidthH Firmware sets this to 640 and other values.
 gphoto
2722
 SPCA50X_REG_MemHeightL
gphoto
2723
 SPCA50X_REG_MemHeightH Firmware sets this to 480 and other values.
 gphoto
27a1
 SPCA50X_REG_Trigger SPCA50X_TrigDramFifo = 2
 gphoto
27b0.0
 ?
 High means we can't read/write to 0x2700
 code
2884
 SPCA50X_REG_JFIF Set to 0 or 1.
 gphoto
2c07.0
 Program FLASH page register
 Controls what appears at external memory 0x8000-FFFF:
0 -> 0000-7FFF FLASH appears
1 -> 8000-FFFF FLASH appears
 code
2887
 SPCA50X_REG_CompSizeL
gphoto
2888
 SPCA50X_REG_CompSizeM
gphoto
2889
 SPCA50X_REG_CompSizeH
gphoto
2a08
 SPCA50X_REG_I2C_wIndex I2C control of image sensor?
 gphoto
2a10
 SPCA50X_REG_I2C_wValue I2C control of image sensor?
 gphoto
2a30
 SPCA50X_REG_I2C_rValue I2C control of image sensor? Not used in firmware.
 gphoto
2a06
 SPCA50X_REG_I2C_rStatus I2C control of image sensor? Not used in firmware. gphoto


External Connector pinout

Pin
 Signal Name
 Description
1
goes to R57 (unpopulated), to U2.79. Use unknown.
2
 Ground
3
R18 (4.7K) - U2.30 (P31) & delete button. Also through R68 (unpopulated) to JP1.2
4
R2 (unpopulated) - pin 6 of SST program memory FLASH. This is address bit 17, which isn't used by the size FLASH memory installed.
5
R5 (1K) - U2.33 (P13). Use unknown.
6
 USB +5V power
 Connects to red wire.
7
 USB Ground
 Connects to black wire (you can also use pin 2 or 10).
8
 USB Data +
 Connects to green wire.
9
 USB Data -
 Connects to white wire.
10
 Ground


SPCA504B pinout
Besides the program FLASH, picture FLASH, and SDRAM the SPCA504B connects to a number of other signals. The complete pinout can be found on the datasheet, but the usage of a number of general-purpose signals have been identified:

Pin
 Name
 Direction
 Description
30
 P1.0
 in
 Shutter button, active low
31
 P1.1
 in
 flash daughterboard connector pin 9
32
 P1.2
 out
 flash daughterboard connector pin 10 (through D5, anode at pin 32, cathode on connector)
33
 P1.3
 out
 J3.5 through R5 (1K)
34
 P1.4
 out
 flash daughterboard connector pin 6
35
 P1.5
 out
 SST (program flash) A16
36
 P1.6
 out
 flash daughterboard connector pin 5
37
 P1.7
 in
 power switch, active low (appears to be)
38
 P3.0
 in
 pulled low by R40 (100K). Goes somewhere, but unknown!
39
 P3.1
 in
 Timer button (S2), active low
40
 P3.4
 in
 Delete button (S1), active low
104
 GPIO15?
 out
 Holtek CS*
105
 GPIO16?
 out
 Holtek WR*
66
 ??
 out
 Holtek Data



Holtek 1621 LCD controller
The Holtek 1621 IC controls the custom LCD (indicating the pictures remaining) and also drives the buzzer. The 1621's memory is arranged as 0x20 words of four bits each. The Dakota builds a copy of this in its own external memory at 0x0e6d-0e8c, and then a routine copies this to the Holtek all at once. Only the lower 4 bits of each Dakota memory location are used. And, since the LCD has far fewer segments (22) than the 1621 is capable of driving (128), not all of the memory is used.
Holtek
address
 RAM
copy
 Bit
value
Description
0x00
 0x0e6d
 1
 next-to-lowest battery level segment
0x00 0x0e6d 2
 lowest battery level segment
0x00 0x0e6d 4
 topmost battery level segment
0x00 0x0e6d 8
 next-to-topmost battery level segment
0x01 0x0e6e 1
 not-permitted symbol (circle with slash)
0x01 0x0e6e 2
 battery outline
0x01 0x0e6e 4
 "return for prints"
0x01 0x0e6e 8
 "remaining"
0x02 0x0e6f 1
 question mark
0x02 0x0e6f 2
 "delete"
0x02 0x0e6f 4
 "timer"
0x02 0x0e6f 8
 "wait..."
0x03 0x0e70 1
 (not used)
0x03 0x0e70 2
 second digit, lower right
0x03 0x0e70 4
 second digit, middle
0x03 0x0e70 8
 second digit, upper right
0x04 0x0e71 1
 second digit, bottom
0x04 0x0e71 2
 second digit, lower left
0x04 0x0e71 4
 second digit, upper left
0x04 0x0e71 8
 second digit, top
0x05 0x0e72 1
 (not used)
0x05 0x0e72 2
 first digit, lower right
0x05 0x0e72 4
 first digit, middle
0x05 0x0e72 8
 first digit, upper right
0x06 0x0e73 1
 first digit, bottom
0x06 0x0e73 2
 first digit, lower left
0x06 0x0e73 4
 first digit, upper left
0x06 0x0e73 8
 first digit, top

The 1621 also provides a timer that can be used as a watch dog or a periodic interrupt; this feature is not used by the Dakota. The LCD operates in the "1/3 bias, 4 commons" mode.



back to my dakota page
my homepage