Salvaging a Samsung DVD-M101 Player

22 min readAug 31, 2016

Samsung DVD-M101 DVD Player, circa 2001. Optical discs, a long lost technology largely obsolete today. Anything salvageable?

Decades ago, discarded VCRs offered a wealth of reusable components for salvaging by electronic enthusiasts and hobbyists. Nowadays as the technology life cycle marches on, DVD players are being discarded in large quantities, an opportunity for reuse before recycling. As for the DVD-M101, its heyday was 5 years after the first DVD player, around 2001, and this particular unit made its way to me in 2016, 15 years later. Reference materials for the M101:

Opening up the unit shows two circuit boards, on the left a brown PCB low density which the AC mains power is directly wired into, including the power supply with a component labeled “DANGER PART”:

On the right side a green PCB higher-density labeled “COMP SIDE” with several integrated circuits. In the middle, of course, is the DVD tray itself:

The unit is functional, powering it on shows “HELLO” on the display:

and pressing the eject button ejects the ejectable tray (this player is so old, it isn’t even slot-loaded).

Interconnects

From the brown PCB (jack, with the power supply) to green PCB (main):

CN1 to CN8, 35-pin ribbon cable
PNCS1 to unlabeled, 10-pin cable white wires, black pin 1
N2-S to FCN8, 3-pin white wires, black pin 1

From the green PCB to the DVD unit:

DCN1 to “Milleno 1LD deck PCB”, another 35-pin ribbon cable
some other cables

Searching for “Milleno 1LD deck PCB” finds the service manual 113938.pdf for: DVD Player, Chassis: Milleno, models:

DVD-M101/M103/M104G/M105/M105B
DVD-M107/M107G/M108/M109
DVD-M201/M203/M205/M205G/M207/M207G, DVD-M300
DVD-M403/M405/M407/M407G/M409

73 pages, including disassembly instructions, comprehensive parts list, nice. On page 49 of this service manual we find the block diagram for the M101:

The font is a little hard to read, but notable parts include:

SIC3(KA3017) Actuator & Motor Driver
RIC1 (KS1462) RF Amp & DPD
SIC24M DRAM
SIC1 (KS1454) Servo + DSP
MIC2 8M EPROM [SEC DVD-M101, 32-pin DIP chip, socketed]
MIC4 2K EEPROM [C21SC C315, 8-pin SMT]
MIC1 (TMP91C219F) Main Controller
FIC1 (uPD780232) Front Controller, Remote Control + FLT Display
MIC3 1M SDRAM
ZIC2 SDRAM
ZIC1 (ZiVA-4.1) A/V Decoder: CSS, audio, MPEG5.1, 4DAC
AIC1 (AK4382) 2-CH Audio DAC, connected to audio DSP, Down-L/R
IC1 (MM1540), 4 x Post Filters from Video Encoder (4DAC)

There are even PCB diagrams and schematics. Transcribing pinouts top down from page 56 (by hand since the text from this page wasn’t selectable):

PCNS2 on JACK PCB: AC mains input

CN1 on JACK PCB / CN8 on MAIN PCB:

35: DGND, 34: IEC958, 33: DGND, 32: DA-LRCK, 31: DA-DATA2, 30: DA-BCK, 29: DGND, 28: DA-XCK, 27: DGND, 26: DA-DATA1, 25: DA-DATA3, 24: DA-DATA0, 23: DGND, 22: DGND, 21: AGND-ADC, 20: MICR+, 19: AGND-ADC, 18: MICL+, 17: AGND-ADC, 16: CVBS+Sync, 15: VSS-VIDEO, 14: CVBS/G/Y, 13: VSS-VIDEO, 12: Y/B/U, 11: VSS-VIDEO, 10: C/R/V, 9: VSS-VIDEO, 8: DGND, 7: DGND
6: RRQ
5: MRST
4: SQR
3: TXD
2: RXD
1: SCLK

PCNS1 on JACK PCB / PCN1 on MAIN PCB:

1: 3.3VCC
2: 3.3GND
3: D3.3VCC
4: D3.3GND
5: D5VCC
6: D5GND
7: A5VCC
8: A5GND
9: M8VCC
10: M8GND

DCN1 on DECK PCB / DCN1 on MAIN PCB:

1: VCC, 2: PDDVD, 3: LDDVD, 4: GND, 5: PDCD, 6: LDCD, 7: GND, 8: GND, 9: GND, 10: VREF, 11: VCC, 12: F, 13: B, 14: C, 15: RF, 16: D, 17: A, 18: E, 19: GND, 20: T-, 21: T+, 22: F+, 23: F-, 24: PICK_SEL, 25: SL+, 26: SL-, 27: W, 28: V, 29: U, 30: HW+, 31: HU-, 32: HU+, 33: HV-, 34: HV+, 35: HW-

HCN1 on HOUSING PCB on DECK PCB / DCN2 on MAIN PCB:

1: GND
2: OPSW
3: CLSW
4: TM+
5: TM-

CN2 on JACK PCB / FCN1 on MAIN PCB:

1: FGND
2: ANI2
3: ANI3

Power

Page 59 of the service manual includes a schematic of the 120V supply:

The mains voltage is magnetically and optically isolated, with several output voltages for various subsystems:

-8V: audio, from 7908 3-terminal negative voltage regulator (PICS3)
12V: audio
5V (audio): A5V and AVCC
8V: audio, 8VMT, video
5V (digital): +5D, DVCC, video
3.3V: PCNS1 pins #1, #3 (ground #2, #3)
5V (Micom): “AL5V”
-28V (Micom)
VF+, VF- (Micom)

TODO: power without mains, from lower voltage for safer experimentation

Main board

The main board (that is, the smaller green PCB, not the brown “jack” PCB) contains mostly application-specific components, not too is salvageable here.

Some discrete components, various electrolytic capacitors 100 µF and 10 µF, two crystals: SD33.8688 (why 33.8688 MHz? = 768 x 44.1 kHz, allows integer division) and SUNNY 20, 27.000(10) (27.000 MHz = exact multiple of PAL and NTSC line frequencies), five pushbuttons, a couple nice 34-pin ribbon connectors with DIP footprints, a 32-pin DIP IC socket, but mostly surface-mount discretes and highly-integrated chips.

Probably not worth it to desolder these components, but I happened to be low on electrolytic capacitors and needed desoldering practice so I did:

The haul:

3 x 4.7 µF 16V electrolytic capacitors
14 x 10 µF 16V electrolytic capacitors
2 x 22 µF 16V electrolytic capacitors
2 x 47 µF 16V electrolytic capacitors
8 x 100 µF 16V electrolytic capacitors
27.000 MHz crystal (SUNNY 20, 27.000(10), 01–40(E))
33.8688 MHz crystal (SD33.8668) TODO: build a crystal oscillator tester
20 MHz ceramic resonator ±0.5% (“200G” label, MY1 designator)
3-pin SIP connector
5-pin SIP connector
32-pin DIP socket

The power supply (jack PCB) has more through-hole discrete components (inductors, high-wattage resistors, transformers, power transistors with heat sinks; whereas the main PCB is nearly all surface-mount), but I kept it intact for now for the VFD.

There are several memory chips on the main PCB board:

MIC2 8M EPROM [SEC DVD-M101, 32-pin DIP chip, socketed]
MIC4 2K EEPROM [C21SC C315, 8-pin SMT]
MIC3 1M SDRAM
ZIC2 SDRAM

Reading the MIC2 8MBit SEC DVDM101 parallel EPROM

The socketed “SEC” chip:

Tearing off the “DVD-M101 VER:5.02E TS 0.1.10.16” sticker reveals underneath, silkscreened on the IC:

SEC DVDM101XAA
VER5.02E
1D5180A1
G013649

Removing the chip causes pressing the “eject” button to run the tray motor indefinitely, showing “OPEN” on the display. Reinserting the chip restores normal function, allowing the tray to be opened and closed (shows “CLOSE” on the display, then “LOAD”). Even without the chip, the display shows the hello greeting when powered on.

This 8MBit EPROM connects to the Toshiba TMP91C219F MIC1 “Main Controller”, a 16-bit microcontroller TLCS-900/L1 series, for memory expansion. Nearby is a W24257A 32Kx8 CMOS Static RAM.

Allegedly an EPROM, and the sticker would suggest it, but scraping it off does not reveal any window for UV light erasure. Could be a mask ROM. The service manual shows MIC2 as a 27C08, an 8-Megabit UV Erasable CMOS EPROM, erasable at 2537 Å = 253.7 nm. Service manual resembles the datasheet, except pin #1 is VPP not A19, pin #24 is only /OE not /OE and VPP, and the outputs are DQ instead of O. But otherwise the same. Page 62 from the service manual:

With all these address and data lines, this isn’t serial, but it is a parallel memory. Power Vcc with +5V, ground Vss, set all the address lines A0–A18 (or to A19=VPP?), then bring /CS chip select and /OE output enable low, and read the bits of the output byte on DQ0-DQ7.

Wiring up to address 0, reading the individual bits using a voltmeter (using the built-in ADC probe of Bus Pirate, but could use a multimeter too):

By rewiring the address lines, read the first couple bytes of the memory:

0: 0000_0110 = 0x06
1: 0000_0111 = 0x07
2: 0100_0111 = 0x47
3: 0000_0000 = 0x00

Can we disassemble this? Toshiba TLCS closed source. Found the Victorious3/TLCS-900 disassembler. Executed in Python 2.7.12, failed with a print function error, added future import, but failed iterating float; installed Python 3.5.2 instead and it disassembled without error:

brew install python3
python dis.py -i /tmp/in -o /tmp/out

And the disassembly:
0: 06 07 | EI 7

What is the EI instruction? Not the EIEIO instruction. Toshiba 3 TLCS-900/H1 CPU documentation (900H1_CPU_BOOK_CP3_CPU_en.pdf) page 23 says EI imm enables interrupts, looks about right for a first instruction. The argument specifies what interrupts to enable, from page 7, only non-maskable interrupts are enabled:

Analogous to x86 bootloaders which may clear interrupts using cli.

dis.py doesn’t decode 0x47 0x00, but page 81 shows it is LD R, #:

zzz = 100 (register size: long word, page 34), and R = 111 (register code: XSP, the 32-bit stack pointer). Four additional bytes would need to be read to get the initial stack pointer register value. More data.

Reading the bits by hand with a voltmeter is not scalable, especially considering this chip can hold 8,388,608 bits. Unfortunately, tools like the Bus Pirate by themselves cannot automate reading parallel interfaces, as they are focused on serial interfaces like I²C and SPI. How about a Raspberry Pi? The EPROM datasheet claims 5.0V ± 10% supply voltage is required, but 5V is incompatible with the logic levels of the Pi’s GPIO — fortunately, I tried powering the chip with 3.3V and it seemed to work fine, was able to read back the same bits as with 5V.

The Raspberry Pi 3 just happens to have 24 GPIO pins, enough for 16 address lines + 8 data lines. But I am using 4 inputs and 4 outputs for Raspberry Pi 3 GPIO: pushbuttons, LEDs for RC and BARR, and the I2C alternate function in I2C interfacing on the Bus Pirate and Raspberry Pi to serial EEPROMs for a HAT, leaving 14 pins. GPIO expanders, shift registers, latches, or removing the other devices are possible solutions. But for now I’ll only read with a 5-bit address, the higher bits grounded, and read the 8-bit data output:

And the parallel-eprom-dump.py script in Python using RPi.GPIO:

With parallel there is no clocking, the datasheet says a minimum 2.0 µs is needed for address setup time, but I gave it 100 ms, and read the data output multiple times. Possibly due to the undervolting, the data is noisy, but it is somewhat recognizable, matching what was measured using the multimeter. My best reconstruction of the first 32 bytes of the EPROM:

06 07 47 00
12 c2 00 42
80 00 80 00
41 24 48 ff
80 07 47 66
12 c2 00 42
80 00 80 ff
41 24 ff 00

which disassembles to:

0 : 06 07 …………| EI 7
2 : 47 00 12 C2 00 | LD XSP, 12718592
7 : 42 80 00 80 00 | LD XDE, 8388736
12: 41 24 48 FF 80 | LD XBC, 2164213796
17: 07 ……………| RETI

XDE and XBC are general-purpose registers, RETI returns from interrupt. There may be some decode errors here; in principle it ought to be possible to dump this entire 8MBit ROM, likely using a proper +5V supply with a level shifter, and setting /OE output enable only after the address is completely set, possibly shift registers to convert parallel/serial etc., if you really want to dump this DVD player’s firmware for some reason. Could be an interesting project, but not for now.

Since it appears this chip is either factory programmed or one-time programmable, repurposing it is probably not the most practical idea. Let’s move on to another chip.

Dumping the MIC4 2K EEPROM via I²C

Labeled “C21SC C315”, this is an 8-pin surface mount chip. No datasheets found from these identifying markings. However, a reasonable assumption to test is whether it supports I²C, which I experimented with in I2C interfacing on the Bus Pirate and Raspberry Pi to serial EEPROMs for a HAT. The answer is yes, and it has a compatible pinout with 24LC512!

Pin #4 is ground (connect to Bus Pirate brown), 5 is serial data SDA/MOSI (gray), 6 is serial clock CLK (purple), leave 7 floating (write protect?), and 8 is +3.3V (red, also wire to green VPU pull-up on Bus Pirate). In order to get a solid connection, I had to gently left up the right side of the chip from the board, but I left the left side soldered in. Connect the Bus Pirate and setup:

HiZ>m4
(1)>3
Ready
I2C>W
Power supplies ON
I2C>P
Pull-up resistors ON
I2C>(1)
Searching I2C address space. Found devices at:
0xA0(0x50 W) 0xA1(0x50 R)

The EEPROM is found, at the standard device address. Now we can dump it with [0xa0 0][0xa1 r:256]. Dumping beyond 256 wraps around with the same data, confirming it isa 256-byte = 2048-bit memory. This repetition can also be used to confirm the dump had no bit errors. Anyways, the data is:

Nothing too exciting here, likely contains various configuration settings. The words “en” and “es” may be ISO-639–1 language codes for English and Spanish. Ignoring the first byte, the third 32-bit number, 0x5082225d, could be a Unix timestamp, for 2012/10/20, 4:02:37. Or the 6th 32-bit number, if little endian, 0x506a7994 to 2012/10/02, 5:20:20. Another timestamp 0x54a0b0c2 = 2014/12/29, 1:39:14? There are some unusual patterns, but making sense of them would require more reverse-engineering.

One more thing, can we write to this EEPROM? Testing writing 0xde at 0:

I2C>[0xa0 0 0xde]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
WRITE: 0xDE ACK
I2C STOP BIT
I2C>[0xa0 0][0xa1 r:1]
I2C START BIT
WRITE: 0xA0 ACK
WRITE: 0x00 ACK
I2C STOP BIT
I2C START BIT
WRITE: 0xA1 ACK
READ: 0xDE

It works. Also I accidentally overwrote the first byte of the EEPROM with 0x00, attempted to read it as a 16-bit device first, oops (where the second byte written to 0xa0 is the other half of the 16-bit memory address, but on 8-bit memories, it is the data to write). This 8-bit I²C EEPROM can be removed and repurposed, although with a 256-byte capacity, use is limited.

Mechanical deck

Tray motor

The 5-pin DCN2 cable controls the tray motor; the 35-pin DCN1 deck ribbon cable does not need to be connected (presumably used for optical disc data). DCN2 connects to a small PCB with two switches to detect when the tray is opened or closed, to turn off the motor appropriately:

From this functional analysis, the meaning of the silkscreen labels is clear:

1: GND: ground, common for OPSW and CLSW
2: OPSW: open switch, shorts to GND when tray fully open
3: CLSW: close switch, shorts to GND when tray fully closed
4: TM+: tray motor positive
5: TM-: tray motor negative

What voltage across TM+/-? Testing with a multimeter reads about 4.5V, powering 5V with the Raspberry Pi power supply TM- to GND, TM+ to +5V turns on the motor successfully, closing the tray. Reversing the polarity opens the tray. Current drawn with the motor running is about 15 mA.

This motor can now be removed and used independently in another circuit. Or you can leave it in for ejecting the tray. The tray open/close detection switch is kinda neat. Connect to the Raspberry Pi GPIO:

GND to GND
OPSW to G25 (board pin #22)
CLSW to G26 (board pin #37)

The inputs will be active low, requiring a pull-up resistor for 1 when inactive, then pulled low to 0 when the switch closes, meaning the tray is completely open or closed. Writing a script to read the GPIO input and toggle the yellow and blue LEDs using interrupts as wired up in Interrupt-driven I/O on Raspberry Pi 3 with LEDs and pushbuttons: rising/falling edge-detection using RPi.GPIO is straightforward, gptray.py:

When closed, the blue LED lights up, when open, the yellow LED:

First tested by powering the motor in each direction by plugging in wires by hand; driving with the Raspberry Pi via GPIO is more complex, due to higher voltage and current requirements. Control via GPIO through a transistor, diode, resistor circuit as detailed in Controlling a DC Motor with the Raspberry Pi:

Used GPIO board pin #18, G24, to control the tray motor as in the above circuit, except substituted: 3 x 330 Ω series resistors (= 990 Ω) for the 1 kΩ, a 2N2222 for the MPS2222A, and a 1N4001 for the 1N4148. Driving the output high will turn on the tray motor, and the script can turn it off when it is fully extended (or a timer expired, as a safety measure), gpeject.py:

For now, this only runs the tray motor in one direction (ejecting), it has to be pushed back in by hand.

TODO: interface to an H-bridge to allow easily reversing current direction programmatically, and detect opened/closed to automatically reverse direction, making the tray open & close repeatedly like those old Windows trojan pranks

Update 2016/09/06: built an H-bridge to run the motor in reverse, see: Building an H-Bridge from a salvaged Uninterruptible Power Supply

Sled motor

There are multiple motors in this DVD player, the sled motor (controlling the gears moving the laser assembly back and forth) is on the other side:

it can also be powered by +5V, as you might expect. Removing the sled motor (unscrewing the two tiny mounting screws, note: they were very tight, required an inordinate amount of force to unscrew) reveals the markings:

RF-300C-11440
D/V5.9

Searching for the part number finds the RF-300CA-11440 datasheet, operating range 0.7–5.0 V, nominal 2V, 2200 rpm and other stats:

This motor is now also ready to be removed and repurposed elsewhere:

Wired up this motor to the Raspberry Pi GPIO using the same circuit:

with a very simple script to turn it off or on from the command-line:

Spindle motor

There is a third spinning mechanism, used for rotating the optical disc. It is mounted with allen bolts fastened with springs, requiring a hex key for removal, on a larger frame with rubber pads. Split out from the DCN1 connector on the 1LD DECK PCB, to DCN3: SLED+, SLED-, W, V, U, H3+, H-, H+, H1-, H1+, H2-, H2+, H3. SLED+/- is clearly the sled motor, but what about the others?

The spindle is driven by the KA3017 Spindle + 4-CH Motor Driver:

A3 (3-Phase Output 3) to W
A2 (3-Phase Output 2) to V
A1 (3-Phase Output 1) to U
H* to hall1/3 +/- inputs, rotating direction detection, page 16 datasheet:

3-phase power, not simple DC power? Haven’t tried powering this spindle motor yet, due to the complexity (KA3017 driver on the main board), but at least we got two DC motors out of this DVD player.

Laser diode

How could a teardown of a DVD player be complete without salvaging the laser diode? CDs used 780 nm infrared (experimented with infrared in Receiving IR signals with RTL-SDR dongles), DVDs used 650 nm red, HD DVD and Blu-Ray (neither supported) use even a shorter wavelength/higher frequency, from Wikipedia:

There are four wires connecting to the laser (enclosed in a plastic housing, snapping it off reveals very small wires strung out two on each side), using a brown ribbon cable which connects to a PCB and then to a larger, white ribbon cable which also includes signals from the pick-up sensor:

The larger ribbon connects to the 1LD deck using through-hole, a more plausible test point than on the laser assembly itself. The pins on DCN2 are labeled, and also documented in the service manual page 72:

1: VCC, connects to DCN1.1 (VCC)
2: DVDPD>, connects directly to DCN1.2 (DVDPD)
3: VOL-DVD>, connected through 680Ω resistor DR1 to GND-DVD
4: DVDLD<, connected to DCN1.3 (DCN1.3) after diode/cap
5: GND-DVD, connected to 1N418 diode, 104 cap to GND-DLD (DCN1.4)
6: GND-BODY, connected to DCN1.8 (GND-BODY)
7: F-<, 8: F+<, 9: T+<, 10: T-<
11: GND-PD, 12: VREF>, 13: VCC
14: F>, 15: B>, 16: C>, 17: RF>, D: 18>, 19: A>, 20: E>

The pick-up and I/V amp are driven by the “RIC1 (KS1462X) FF Amp & DPD”, appears to be a specialized part. PDDVD connects to PDDVD on the KS1462X, with an arrow going into the KS1462X (from the block diagram, it appears this device is connecting to the I²C bus, along with the EEPROM, servo + DSP, and A/V decoder, all to the main controller). LDDVD has an arrow going the other way, connecting through a KSA1182 transistor RQ2 into LDODVD on the chip. There are PDCD and LDCD as well, connects from DCN1 to the KS1462X chip, but not connected on the 1LD DECK PCB. Only the 2LD, presumably a more expensive model that supports CDs in addition to DVDs.

It would help to know the meaning of PD and LD. Compare this laser diode datasheet, from PD-LD Inc., P-Type has LD (-) cathode and PD (+) anode but there are variations:

Watched PD-LD’s 3 minute about video, well-produced but did not explain the meaning of PD and LD. Found some insight in a question, StackExchange How to connect laser with common LD-Anode and PD-Cathode, tied to laser case. The laser diode has a built-in “monitor diode”, with a common cathode or anode. Found in the answer on /r/askelectronics How do I use this laser diode?: LD = laser diode, PD = photodiode. The LASER COMPONENTS 2008368 Laser Diode, Visible, 650 nm, 3 Pins, 7 mW / ADL-65075TL appears to be comparable to the laser used here (“ideal for DVD optical pick-up head”). Runs about £7.01/ea from Farnell.

Anyways I’m going to go ahead and solder:

Applied +5V to DVDLD (label on the PCB, the service manual calls it LDDVD, but it is pin #3 either way), ground to DVDPD (PDDVD, pin #2) of the DCN.1 connector… important: this goes through the 680 Ω resistor, 1N418 diode, and 0.1 µF capacitor on the deck PCB, not on DCN2 which would likely burn out the diode without any current limiting resistor. Turned on the power, and… it works, witness the red laser:

it is more visible in the dark:

The circuit on the deck PCB could be replicated on another board, or you can keep the existing PCB and power through DCN1 pin #2–3. Here is the schematic for reference (pg 72 service manual):

Applications? Certainly not for an indicator light, LEDs or VFDs (coming up) are more appropriate for that purpose. Observing the monitor diode could be an interesting project. @TingaWinga5’s how to make a DVD burner laser pen video looks fun, but this unit is a DVD player not a DVD burner. Either way, this laser diode is a novel component definitely worth keeping (or not — I haven’t found a practical use for it yet, not as bright as the burners.)

Micom Vacuum-fluorescent Display

The front panel is a vacuum fluorescent display (VFD) built by Micom, controlled by the FIC1 (uPD780232) Front Controller. Examining the reverse side of the jack board:

Zooming in on the display pins, labeled VFD1:

All of the daughterboards and cables can be removed from the jack board (except the mains power), and the VFD will still function. I removed the disc unit as described in the previous section, and also the main (green) board with lots of integrated circuits. When plugged in, the red standby LED will light. Press the button next to it to turn on the DVD player, and it will greet you with “HELLO”:

then (with no other cables attach) show “LOAD”, until turned off, departing with “GOODBYE”.

On the front side there is a plastic mechanical support attached to the VFD, it can be snapped off, revealing the reverse side of the 33-pin VFD:

The label reads: 1–8 1 SAMSUNG, HNV-11SS27. Searching finds a page on radiomuseum.org for HNV11SS27, tube type: VFD — Vacuum Fluorescent Display, from Jacky Parmentier’s vacuum tube collection:

It’s a nice collection. Unfortunately, appears to be still wired to the PCB, no information on how to wire it up. But the uPD780232 controller chip is documented: datasheet. Manufactured by NEC, part of the 8-bit single-chip microcontroller family 78K/0 series, the 80-pin µPD780232 is “For panel control. On-chip VFD C/D. Display output total: 53”:

16–24KByte ROM capacity, 3-channel timer, 4-channel 8-bit ADC, 2-channel serial interface, 40 I/O, minimum Vdd 4.5V, other specs for the ‘780232.

User’s Manual for NEC 78K/0 Series, details on the instruction set architecture. Renesas 78K Family: “The extensive 78K series lineup provides the ideal product for almost any application. For a compact, low-power MCU, choose one of the products in the 8-bit 78K0 and 78K0S series”. The uPD780232’s machine code can be disassembled by IDA, 78k0. But what I really want to know about is the VFD driver.

Not the same, but the uPD16315 1/4- to 1/12-duty FIP (VFD) microcontroller datasheet may be illuminating. Is it the discrete version of the VFD driver integrated within the uPD780232 microcontroller? Datasheet block diagram:

This looks promising, the example circuit application:

Other possible useful references: A Guide to Fundamental VFD Operation, PCBHeaven Reverse-engineering an LCD Display. But then found page 69 of service manual shows the VFD pinout:

1–2: F+
3: NP
4–14: G1-G11
15–32: P18-P1
33: NP
34–35: F-

F+/F- connect to power, the other pins to the uPD780232 controller, FIP0-FIP27 (FIP= Fluorescent Indicator Panel, NEC trademark for VFD). Measuring DC voltage across F+/F- while in operation shows 3.3V.

According to EEVblog #717 How To Hack Vacuum Fluorescent Displays, if you want to drive a VFD yourself you’ve got your work cut out for you: building a high-voltage alternating current power supply, multiplexing — so it is preferable to use an existing VFD driver if you can.

The Front-Micom/VFD schematic shows the uPD780232 connects “to/from video”, through 100 Ω resistors (FR10, FR12, FR24, FR13, FR26). The resistor leads are easily accessible on the front of the PCB, or from the CN1 connector (1: SCLK, 2: RXD, 3: TXD, 4: SRQ, 5: MRST, 6: RRQ, 7: DGND). Connects to the main PCB’s TMP91C219’s main controller (pg 62):

From the TMP91C219 main controller to the µPD780232 VFD controller:

SCLK< to P82/SCLK0/*CTS0 (TMP) from P27/*SCK1 (µPD),FR10
RXD> to P80/TxD0 from P26/SI1, FR11
TXD< to P81/RxD0 from P25/SO1, FR12
SRQ< to P70/TA0IN/INT1/LIN0 from P24/BUSY, FR24
MRST< to *RESET from FIP29/P35, FR26, FR74
RRQ> to P71/TA1OUT/LIN1 from P01/INTP1, FR13
AT> from P50, VSW1 video out select switch on back
PS1< from PS1 on VIC1 MM1540 chip by RCA jack

from the TMP91C219 manual, TXD0/RXD0/SCLK0 are “serial I/O”. TA0IN/INT1 and TA1OUT are the 8-bit timers TIMER0, TIMER1. This serial interface is used to connect the main controller andVFD controller.

Digital ground can be conveniently accessed by unplugging the 3-pin CN2 connector and inserting a wire into the connector for the black wire. Shorting the FR26 resistor (FIP29/P35 of the µPD, then to MRST<) to ground slightly dims the VFD display (resets the controller?)

TMP91C219’s serial I/O channel according to page 114 of the manual can be configured in “I/O Interface Mode” using the synchronizing clock signal SCLK, or UART modes (7-bit, 8-bit, or 9-bit data). Since SCLK is wired up, synchronous I/O Interface Mode is plausible. Handshaking (page 122):

since the VFD functions with the TMP main controller removed, it may be possible to send/receive data over this serial interface to the µPD controller ourselves. 3-wire protocol, could it be compatible with SPI?

TODO: try sending/receiving data on this serial bus to the VFD micro

But not this time, this article is getting too long it’ll have to wait, more investigation and analysis is needed to properly utilize this VFD. It is in my humble opinion the most desirable component to salvage from this device, but it’ll take some more work. Of course, you could unsolder the VFD but then you have the problem of how to drive it, so for now I am saving the jack PCB intact (without the main PCB and deck, not needed).

Conclusions

Salvaging discarded electronics isn’t what it used to be, the race towards tighter integration and smaller physical scale renders most of the components infeasible to extract and repurpose, especially with application-specific silicon, nonetheless, some attractive components are to be found.

Finding the service manual with its comprehensive PCB layout diagrams, part lists, wiring maps, and schematics was a big help towards understanding the function and specifications of the device and its subsystems.

Several more discrete could be salvaged from the power supply jack board, at the expense of a known-working VFD circuit, so I’m holding off on that for now. Successfully salvaged were two DC motors, a laser diode/photodiode, capacitors and crystals, memory chips, miscellaneous connectors, but not yet the fabled vacuum-fluourescent display. Was it worth it? I may not necessarily specifically seek out another Samsung DVD-M101 player to salvage for parts, but it’s hard to beat free!