dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > IriverPort > IriverHardwareComponents

Hardware Components Overview of the iRiver H1xx

Datasheets and chip images

Motorola Integrated Microprocessor SCF5249


This is the CPU at the heart of the player. For more information, go to ColdFire.

Fairchild P22AD-LVX245 - Low Voltage Octal Bidirectional Transceiver


Probably used for buffering the data bus, we may find more of these on the back, underneath the ATA interface daughterboard.



K4S561632E-TL75 - 4M x 16bit x 4Banks Synchronous DRAM LVTTL (256Mbit/32MB)




39VF160 - 2 MB Flash ROM

16 Mbit (x16) Multi-Purpose Flash (SST39VF160)



Datasheet: rockbox

Driver Example:

UDA1380TT - Philips Stereo audio coder-decoder

The Philips UDA1380 can NOT decode MP3 (or any other codec format) - codec decoding is performed on the ColdFire CPU.


LucaBurelli: By checking the block diagram and the information on the pages above, it appears that the H1xx could be used for radio recording too! The "external input" on this IC (which is probably commuted by the analog muxes between radio and the line in jack) is connected to both the DAC and the line out via an amplifier. So it should work... anyone double check this idea, please?

DaveHooper: From analysis of the firmware, it seems there is an "recording source" option of "TUNER" (which is unavailable from the user interface). Also others have commented that the record from radio is technically feasible but some sources suggest iRiver disabled it in the firmware due to severe radio interference when running the HDD.

TXD - RXD connectors

Short description: serial send/receive port connected to SCF5249

The RXD/TXD pads on the board are definitely RS232. I just hooked up a line driver to TXD, and with the current iRiver firmware, the port is set to 38400 N-8-1. The info it's sending out isn't too interesting so far. When I hit track-forward it sends any of a few strings: "1134-1", "1279", "134-2A", "13589". None of the strings are terminated by whitespace/cr/nl. These are debug "putc()" calls that live in the file access routines. Unfortunately none of these reflect anything directly related to the ID3 info of the currently played track, which was what I was looking for... -- PaulS


TLV08341 - 3-Volt 8-Bit Analog-to-Digital Converters With Serial Control (Rev. B)

8-Bit 41 kSPS ADC Serial Out, Ratiometric Op or Vcc Ref, TTL/MOS Input & Output Compatible, 4 Ch.




The serial and chip select pins are attached to the Coldfire GPIO0 pins as follows: CS: bit 7 -- active when set to 0, CLK: bit 22, DI (data from CPU to ADC to set MUX value): bit 21, DO (sample data from ADC) bit 31. The iRiver battery is attached to channel 2 of the MUX for battery level readout. It's probably a good idea to average a few values in order to get a stable result. Channel 1 and channel 3 appear to be attached to the remote and built-in keyboards (respectively, maybe).

TEA5767 - Low-power FM stereo radio for handheld applications.




ISSI 401-3G - 1kbit EEPROM


An ISSI 4C01-3G , part no IS24C01-3G, a 1 Kbit 400KHz eeprom. Datasheet:

Probably used to store data such as user settings, last song played and FM presets.

Pins 1, 2 and 3 are used to set the LSBs of the address the 2-wire interface, and are not awfully important to understanding the H1xx. They are tied either to Gnd or Vcc. Pin 4 is Gnd, and pin 8 is Vcc, and these are usually quite obvious due to the thicker PCB traces that lead from them. Vcc should be around 5V and can be easily measured from the lead. Pin 7 is the Write Protect pin and I am sure that it is tied to Gnd, which allows the chip to be writable. If it is tied to Vcc, the chip will be write protected. The final 2 pins are the said 2-wire interface pins. Pin 5 is the Serial DAta (SDA) pin and pin 6 is the Serial CLock (SCL) pin. SCL should be at 400khz, and SDA is the pin used to read or write data.

ISSI IS25C02 - 2kbit EEPROM


An 2 Kbit EEPROM. Datasheet:

This is the ISD300 config eeprom is located on the USB/ATA daughterboard.

MEC-AL4A2 - 11.2896MHz oscillator


Side note:

Notice the TA (Transfer Acknowledged) connector right beside MEC-AL4A2.

3.1.10 TA Generation (from )

The processor starts a bus cycle by asserting -CSx with the other control signals. The processor then waits for a transfer acknowledgment (-TA) either from within (Auto acknowledge - AA mode) or from the externally addressed device before it can complete the bus cycle. -TA is used to indicate the completion of the bus cycle. It also allows devices with different access times to communicate with the processor properly (i.e. asynchronously) like the Ethernet controller (U4). The MCF5249 processor, as part of the chip-select logic, has a built-in mechanism to generate -TA for all external devices which do not have the capability to generate this signal. For example the Flash ROM cannot generate a -TA.signal. The chip-select logic is programmed by the dBUG ROM Monitor to generate -TA internally after a pre-programmed number of wait states. In order to support future expansion of the M5249C3 board, the -TA input of the processor is also connected to the Processor Expansion Bus (J5, pin 66). This allows any expansion boards to assert this line to provide a -TA signal to the processor. On the expansion boards this signal should be generated through an open collector buffer with no pull-up resistor; a pull-up resistor is included on this board. All -TA signals from expansion boards should be connected to this line.

LVCH16245A - 16-Bit Bus Transceiver With 3-State Outputs




LW052A - Dual 4-Channel Analog Multiplexer/Demultiplexer



This selects between the iriver dac and the internal FM radio for output.

AZU 3AW ZD5L (the 5 could be an S or even an 8)

AZU-3AW-ZD5L.jpg DanHollis: It's pretty clear it's AZU 3AW ZD8L azu_3aw_zd8l.jpg

Texas Instruments have now confirmed this to be a BQ24022 Li-Ion charger.

Micropower Synchronous Buck-Boost DC/DC Converter

Markings: LTNP

Voltage regulator.


This was identified in a topic at MisticRiver as an LTC3405. One forum member (Wacholek) has reported success with replacing the on-board component with an LTC3405 after damage due to a bad/wrong charger. Samples can be ordered from -- JustinHannigan - 2010-02-02

The LCD module

The LCD module has a few markings on it:

  • On the side: 0301W and 3ZA
  • On the plastic strip: S4E1 5002
  • On the COG chip itself: TF3X23
The LCD connector has 18 pins. Pinout:

Pin Function
3 D7
4 D6
5 D5
6 D4
7 D3
8 D2
9 D1
10 D0
11 Unknown (pulled down with 100k to GND)
12 Maybe CS2 (connected to GND)
13 OE
14 R/W
15 A0
17 CS
18 GND

Suggested chip candidates:
  • Solomon SSD1854 - The COF (chip-on-flex) drawing in Appendix A is very similar to the Iriver display.
  • Epson S1D15E06 (I picked this datasheet in particular because of the following features: 4-level grayscale; adjustable contrast; 160x128 resolution; hardware interface that supports 6800 mpu parallel data interface; minimum pin count required according to Section 11 (2) of the data sheet is 18 PINS: A0, CS1, CS2, RD, WR, RES, VSS, VDD, P/S, C86, and D0 thru D7. -- DaveHooper)
DanHollis: andilcd says it's not one of theirs.

PaulS: Here's a qualifier I think you can use to test whether the display is correct. The commands appear to be sent 8 bits at a time. The initialization sequence looks like a write of the following command bytes: 0xAF, 0xA0, 0xC5, 0xA6, 0xA4, 0xBF, 0xE5. To write pixels to the display, it switches between command mode and data mode by toggling an address line attached to a GPIO: (command) 0xB1 (data) XX (command) 0x13 (data) 0x00 (command) 0x1D (data) XX XX XX ....The Solomon-Systech almost looks reasonable here for the init bytes, with the 0xB1 mapping to "set page address" and 0x13 setting the column. However that's where the suitability ends, since the data write and 0x1D command don't make sense. On the other hand, the Andilcd datasheet matches the commands in a more precise manner, and the 0x1D maps exactly to what you'd expect which is a "data write start" command. So, I'm willing to believe that either a) it's one of these andilcd's and they don't know it or b) it's similar enough that we can use their datasheet to understand what's going on with the display, for the most part.

LinusNielsenFeltzing: The Epson data sheet seems to be it. The current LCD driver is based on it, and it works very well.

The Buttons


On the remote at least, the buttons are attached via a series of resistors in a similar manner to the circuit above. An ADC (see section above) is used to test the voltage at a point within the resistor network. Note that in this configuration, the buttons have an explicit priority order. If switch S1 closes, the state of S2, S3, etc don't matter -- we read back VP * RS / (R0+R1). That is, unless S0 is closed, in which case it wins. The setup I and others probed out of the remote for Rn/Sn pairs is as follows:

Resistor Value (Ohms) Switch Name
0 (short) Stop
270 Minus (-)
390 A-B
470 Plus (+)
680 Bitrate
820 Rec
1200 Source
2700 Forward (>>)
4700 Navi
15000 Back (<<)

It appears that the internal buttons are attached in a similar manner, attached to a different input on the same ADC.

Remote Control

rmtconn.jpg remote connector

The remote is connected via a composite connector. There are many signals which go back and forth from the unit to the remote. The connections appear to be as follows:

Pin Description Main Connection Remote Connection
AGND Analog ground for audio UDA1380TT Codec Headphone Jack
R Right audio channel UDA1380TT Codec Headphone Jack
L Left audio channel UDA1380TT Codec Headphone Jack
GND Digital Ground    
CS LCD display SPI chip select GPIO34? LCD Controller
HOLD HOLD switch GPIO?? HOLD Switch
START Play button 564 ohm resistor to ground GPIO37 or 38 Play Button
CLK LCD display SPI clock GPIO28? LCD Controller
RMC Remote control button resistor network Channel 1 of TLV08341 3-way Buttons
3V Power for the LCD display    
DATA LCD display SPI data GPIO50 LCD Controller
RS "Register Select", switches between control & data registers GPIO16 LCD Controller
EL Backlight (I believe I remember this being active-low. -- JacobRosenstein) GPIO11?? EL Controller

LCD Controller - TOMATO TL0324SF8


The serial interface to the LCD module appears to be wired as write-only, as the WR line doesn't make it out of the remote. The serial communication lines consist of a CLK, DATA, CS (chip select), and RS (register select). 'Register select' toggles whether the serial data is directed into a control register or data register.

Unknown electroluminescent driver chip

JacobRosenstein: I can't tell exactly what chip this is, and I'm not sure it's really necessary to know.

r58 - 02 Apr 2021 - 20:46:06 - UnknownUser

Parents: IriverPort
Copyright © by the contributing authors.