Adding HID interface

Now I have a composite device in my STM32F4 Discovery board. It contains a USB Audio 1.0 interface (speaker) and a MIDI (in&out) interface. I need a convenient way to send the speed, direction from the Tascam unit, and other debug data for the mouse application to my laptop than MIDI. I can write my own Windows program for HID communication easier than one for MIDI. And on the other side, for the future, HID will be a better way of communication with DJ programs. So let’s move on to add HID in and out.

Continue reading

Upgrading STM32Cube USB Audio Class driver – More advanced playback

I got back to the audio part of the project for a post. I heard annoying pops and crackles during the playback, and after about 3-4 seconds, a complete distorted sound. I know that I left this part unfinished before.

At last, I routed my 1&2 channels (out of 4 channels) to the audio DAC of the Discovery board with a simple software loop that splits my audio buffer into two separate buffers after the samples came in. My audio buffer stored 16 packets, which means 8ms latency and about 6KByte buffer. The original Audio Class implementation uses 80 samples, and has some other strange thing that I mentioned earlier.

Continue reading

Reverse engineering an optical mouse

I promised to write a post about how this optical mouse and the sensor works. I disassambled the mouse and connected the USBee logical analizyer to the SCLK, SDIO, MOTSWK pins. As I mentioned, it contains a PAW3205DB sensor chip.


The chip uses a half-dupex SPI bus to communicate with the integrated Nordic 2.4 GHz transciever chip. The SPI clock frequency is 166.6 KHz. Further details and timings of the communication can be seen in the datasheet, as well as the schematic for wireless mice.

startup without receiver

First I captured the startup sequence and decoded what happens. There is a configuration process, before the mouse starts to send the motion data.

00 30    read product ID1    default
01 50    read product ID2    default
09 00    read write_protect    enabled
89 A5    write_protect disable?
09 A5    read write_protect    disabled
01 50    read product ID2    default
89 00    enable write_protect
06 04    read configuration    MOTSWK level sensitive, 1000 CPI
86 00    write configuration    set CPI to 400
06 04    read configuration    CPI 1000
86 04    write configuration    CPI 1000
1F 3A    unknown
85 BC    write operation mode    enable sleep1 and sleep2 mode, force enter sleep2, LED shutter enable


86 08    write configuration    power down mode

—550 ms

86 80    write configuration    full chip reset
— 8ms

85 B9    write operation mode    force wake up
86 80    write configuration     full chip reset
86 06   write configuration      CPI 1600
06 06   read cinfiguration    CPI 1600


00 30   read product ID1    default
02 86   read motion status    motion, no Y owerflow no x verflow, 1600 CPI
03 FF   read DeltaX        +127
04 00   read DeltaY        0


00 30
02 86
03 FF                +127
04 FB                +123

00 30
02 86
03 FB                +123
04 FE                +126

There are some strange things for me. I won’t do so much config in my code. Some of them seems to be useless.

One important thing is, when the receiver is not connected to a computer, the startup sequence stops after the power down command.

Motion is queried each 8ms. Which is strange again, because the HID descriptor says, the polling interval is 4ms. It seems to be that this mouse is not a well engineered thing 🙂 The query consists of a Product ID read, which is for checking if the controller and the sensor chip is in synch. (If not, there is a re-sync method on the clock line). The motion status is read after. If there was motion, DATAX and DATAY is read, otherwise not.

The MOTSWK pin is a signal, it stays low while there is valid data in DATAX or DATAY registers. I think I wont need this signal for my application.

That’s it. It seems to be fairly simple for the first glance. Next I’m going to hook up the STM32F4 DISCOVERY board to the optical sensor chip, and figure out an optimal way to communicate with it.

Reverse engineering Tascam TT-M1 unit

Here is the simplified schematic of Tascam TT-M1. And the connecting part of the CD player, how it seems to work.


There is a KE-204 optical encoder with a 360 tick encoder wheel. The 5V power is provided by the CD player for the unit. The push button generates a signal for the CD player to send the power I think.

Here are some pictures of the disassambled unit.

IMG_0872 IMG_0877 IMG_0879 IMG_0880

The Channel A and Channel B signals are 5V square wave signals. The phase shift should be 90 degrees according to the datasheet, but it seems to be incorrect.

tek00009 tek00010 tek00013 tek00017

Some crosstalk can be seen in the scope, but It is perhaps because of the measurement conditions, and the lack of chassis grounding.

The Tascam wheel turns 8-9 while the vinyl turns 1 rotation. It means that the base frequency is about 1660 Hz, but it is only an estimation. It is close to the time code vinyl base frequency fortunatelly, so similar range could be used for both applications. 0Hz – 4 KHz roughly.