Hacking the HP 60 Inkjet Carrier

[ezrec]

<p>Current known information about the flex cable pinout to a HP F4480’s HP 60 printhead carrier, part no CB605-80042-A or CB605-60085</p>

<p>The diode measurement <b>d XXXX</b> values are from positive-on-ground, negative on test point.</p>

Pin Nominal Dir Name    Comment
1   0.0v    Out ENC_A   Encoder A Output
2   0.0v    Out ENC_B   Encoder B Output
3   0.0v    Gnd GND Ground
4   1.6v     ?      d 640
5   0.0v     ?      d 640
6   0.0v    Gnd GND Ground
7   0.0v     ?      d 640
8   0.0v     ?      d 640
9   0.0v    Gnd GND Ground
10  1.6v    In      d 640
11  1.1v    In      d 640
12  0.0v    Gnd GND Ground
13  0.0v            d 693
14  0.0v            d 540
15  3.3v    Vcc VCC 3.3v for logic
16  0.0v     ?      d 693
17  16v In  VINK_A  Voltage for ink jets
18  0.0v     ?      d 540
19  0.0v     ?      d 540
20  16v In  VINK_B  Voltage for ink jets

<p>This is just from observed steady-state levels and the diode tester feature of my multimeter.</p>

<p>More to come…</p>

[ezrec]

<p>More data from a 2nd printer (that didn’t have burned out 16v supply on two channels):</p>

Pin Voltages    Dir Name    Comment
1   0.0v    Out ENC_A   Encoder A Output
2   0.0v    Out ENC_B   Encoder B Output
3   0.0v    Gnd GND Ground
4   1.6v    In      d 640
5   0.0v / 0.9v / 1.1v   ?      d 640
6   0.0v    Gnd GND Ground
7   0.0v / 1.5v  ?      d 640
8   0.0v / 1.5v  ?      d 640
9   0.0v    Gnd GND Ground
10  1.6v    In      d 640
11  1.1v / 0.9v / 0.0v  Out     d 640
12  0.0v    Gnd GND Ground
13  0.0v            d 693
14  0.0v            d 540
15  3.3v    Vcc VCC 3.3v for logic
16  0.0v     ?      d 693
17  16v In  VINK_A  Voltage for ink jets
18  16v In  VINK_B  Voltage for ink jets
19  16v In  VINK_C  Voltage for ink jets
20  16v In  VINK_D  Voltage for ink jets

<p>At this point, it’s very likely that:</p>

<p>4/5 and 10/11 are the same protocol (one for black, the other for color)</p>

<p>7/8 and 13/14 may be the same protocol, or different. But both probably use 1.5v signalling.</p>

<p>16 is either an enable or a clock.</p>

<p>More to come…</p>

[ezrec]

<p>Using a 4mhz resolution logic analyzer, I can’t tell much more than the fact that 4/5 and 6/7 all wiggle.</p>

<p>I’ll need to get a faster scope than my Arduino to determine the protocols used.</p>

<p>However, I think much progress can be made.</p>

[ezrec]

<p>More info. According to the HP white paper on the HP 60/901 ink heads, there are 416 jets per CYM color, and 336 on the black head.</p>

<p>Each of those heads can print at 10M drops/second.</p>

<p>I would expect that the shift register operates on an 10Mhz clock, and the CYM channels get 52 bytes of on/off data, and the K channel gets 42 bytes.</p>

<p>If they were smart about it, the printhead controller would have a couple of Kb shift buffer, and watermark signal to indicate when there is more room in the shift buffer.</p>

<p>That way, the printhead controller could shift-out the jet patterns as it detects an optical encoder signal, and the shift buffer would automatically shift out the bits for that encoder line.</p>

<p>I think this is probably how they do it, since there are only ~5000 marks on the encoder strip – only 600dpi if you use standard quadrature encoding.</p>

<p>However, if the shift-buffer ejects ink on every <b>transistion</b> (white or black of the encoder strip) then 1200dpi is easily achieved.</p>

<p>Given that analysis, I suspect the following signals would be needed:</p>

• One clock signal for all 4 printhead buffers
• One watermark signal for the fullness of the printhead buffer
• One shift data in signal for each printhead buffer
• One shift data out signal for the CYM cart (EEPROM serial)
• One shift data out signal for the K cart (EEPROM serial)

<p>If I did my math right, that should be 8 I/O signals, and would completely cover all the functionality of the printhead controller.</p>

<p>This also can explain the initial head movement – the head moves to the wiper area, the controller sends ‘fire all jets’ to the printheads until the watermark signal occurs, then runs the head back and forth over the wiper area until the watermark clears, then goes to the suction cap area. By the time the head is at the suction cap area, it’s pretty much guaranteed that the shift registers will be completely empty, and ready for the next scan lines.</p>

<p>Now that I know what to look for, it should be pretty easy to use the ‘mask off a signal with tape’ method to determine the function of each of the signal lines.</p>

[dragonator]

That was a bit of an overwhelming amount of information. You are measuring the ribbon cable running to the carrier if I am not mistaken. This buffer you speak of is on the carrier itself, not in the printhead? This is a huge amount of information an I think that if it is correct it is very useful. Maybe this will be the stepping stone to how the printheads themselves are controlled. It is the last step before the signal goes to the printhead.

Do you use an ordinary Arduino for measuring or an Arduino based logic analyzer. Have you ever heard of the teensy? It is Arduino compatible (though also bare metal programmable) and it runs at 72Mhz (overclockable to 96Mhz). It has 256kB of RAM and is perhaps fast enough for analyzing the signal going to the carrier.

I can’t wait to see more. This printhead also has CISS system cartridges and is therefore interesting for 3DP printing. It should also be similar, so knowing how this works might help decoding other printheads.

[ezrec]

<p>Ok, this project is stalled a bit until I can get my 20-pin flex breakout adapters built.</p>

<p>I should be able to resume around Oct 23.</p>

[ezrec]

Finally made my breakout cable, and got the following results:

Pin	Voltages	Dir	Name	Comment
1	0.0v	Out	ENC_A	Encoder A Output
2	0.0v	Out	ENC_B	Encoder B Output
3	0.0v	Gnd	GND	Ground
4	1.6v	In		CYM Ink Control
5	0.0v / 0.9v / 1.1v	 ?		CYM Ink Control
6	0.0v	Gnd	GND	Ground
7	0.0v / 1.5v	 ?		Disconnect - No effect
8	0.0v / 1.5v	 ?		Disconnect - Immediate stop of printing
9	0.0v	Gnd	GND	Ground
10	1.6v	In		Black Ink Control
11	1.1v / 0.9v / 0.0v	Out		Black Ink Control
12	0.0v	Gnd	GND	Ground
13	0.0v			Disconnect - print continues, no ink output
14	0.0v			Disconnect - immediate stop of print, E - Ink
15	3.3v	Vcc	VCC	3.3v for logic
16	0.0v	 ?		Disconnect - immediate stop of print, no error
17	16v	In	VINK	Voltage for ink jet
18	16v	In	VINK	Voltage for ink jets
19	16v	In	VINK	Voltage for ink jets
20	16v	In	VINK	Voltage for ink jets

So, interestingly, looks like all the CYM ink control is on just one shift register.

Next, need to set up some LEDs to see if I can figure out which signals are used when, until I can get a good logic analyzer attached.

For now, investigation will focus on pins 4,5 and 10,11.

Hopefully the LED test will reveal which of the other pins is the ink shift register clock.

[ezrec]

Did some more investigation, and looks like the controller is using HSTL logic levels (0v/1.5v)

This won’t directly interface with an Arduino (or any other TTL/CMOS logic) without a level converter.

I’ll see if I can find a cheap 1.5v IO FPGA eval board somewhere to use to analyze these signals…

[wonko]

Wow. Great information. ezrec, in which country are you?

[ezrec]

I live in Pittsburgh, Pennsylvania, United States – UCT-5 (Americas/New_York)

I got a Lattice MachXO2 eval board on loan from a friend. It appears to have the right logic level support, a 400Mhz (max) internal PLL, a SPI slave model, and 30Kbytes of internal ram – I should be able to combine that into a SPI accessible logic probe.

We shall see if my FPGA design skills are up to the task!

[wonko]

Ah, if you would have been in the EU, I could have sent you a logic analyzer for testing at higher frequencies. Bummer.

[JohnDoe]

Something like the 74ALVC164245 level shifter should also work if you want to interface it with an arduino.

[ezrec]

Got a Seleae Logic16 on loan from a friend at work, and already discovered some novel things.

The Pin 14/16 is a LVCMOS3.3 signal set. Pin 14 appears to be bi-directional, and Pin 16 is a 4Mhz clock.

Pin 16 is only active during a data transaction. Pin 14 changes at the middle of a Pin 16 clock cycle, and appears to be a dual-data rate (valid on both high and low clock edge) signal.

The Pin 13 seems to be involved in ink ejection. I need to count the # of cycles and do some math on it.

Ping 4/5, 7/8, and 10/11 are just plain weird. I need to get an oscilloscope on them, as the Seleae sees them at 3.3v logic as flatlines (as expected from my voltage readings) but at 1.8v logic sees them as high with weird glitches (ie, if I sample at 100Mhz, I see 10ns glitches, if I sample at 50mhz, I see 20ns glitches, etc).

I am having the troubling suspicion that 4/5, 7/8, and 10/11 are SSTL or HSTL waveforms, not LVCMOS1.8, and that the Seleae just can’t handle them properly.

I might be able borrow an oscilloscope from a friend at work to see if I can identify the waveform….

[wonko]

Hmm, if you like, just post the Saleae files. The host software is free, so anyone can look at the waveform and maybe give hints. The Epson system uses an analog signal to fire different drop sizes at different times. Maybe something like that?

[ezrec]

I’ll post the CSVs exports once I have a chance to get some oscilloscope measurements of the remaining pins – I’m doing that tonight.

By the way, the following HP Journal articles (about the HP 820C) from 1997 seem to still be relevant to today’s HP printers. Worth a read.

[Author]

Posts