For fun, and as an exercise in reverse engineering junk hardware, I am trying to understand the internals of an HP DeskJet 840c printer from 2001.

Specifically I am trying to understand how the motor controller works, with the goal of being able to send my own signals to its input pins and drive the 2 brushed DC motors and the stepper inside the printer.

The motor controller is made by TI, but googling the identification codes yields nothing useful, so I suspect this chip was made specifically for HP. I also tried to find similar parts on the TI site, but nothing came up.

motor driver IC

By following the traces on the main PCB I identified the output pins by working backwards from the motors, then I identified the input pins by working backwards from the CPU.

  • MC1 to MC9 connect to CPU pins.
  • X1 to X4 connect to a stepper motor.
  • M1A and M2A connect to different DC motors.
  • All the pins near any corner connect to GND.

Using a logic analyzer I capture the signals exchanged between the drivers and the CPU when one of the DC motors is running. The CPU seems to send a constant stream of "packets" with 1000ns period (even when the motor is not running). Each packet is divided in 8 intervals of 125ns each, which I tried to attempt to interpret as byte values. There are patterns, for example most packets start with 11 and end with 01 but apart of that I could not make any more sense of the protocol, other than identifying which sequences seems to tell the motor to move left or right, or stay still.

My next step would be to inject my own copy of the input from a separate microcontroller, to see if the driver accepts it.

But before going ahead with that I would prefer to understand the protocol, so I know for sure what I'm asking the driver to do, instead of just having to copy what I get from the analyzer.

Can anyone help identify the motor driver and find a datasheet for it, or at least understand if the control protocol is something standard that I can learn ?

  • 1
    \$\begingroup\$ HP (like some other US suppliers) used to order specially marked components with their own 8-digit code instead of the original part number. If you can get a service manual for the device, you may be able to look up 1821-4319 in its parts list. (However, the R2.5 suggests it may be a custom part such as a mask programmed MCU with firmware revision 2.5. In which case that info may not be much good to you) \$\endgroup\$ – Brian Drummond May 20 '18 at 11:34
  • \$\begingroup\$ I tried looking for the service manual, but this being a device from more than 15 years ago I didn't have much luck. \$\endgroup\$ – feralgeometry May 20 '18 at 12:05
  • \$\begingroup\$ It's probably easier for their more industrial gear, like my 35-year old spectrum analyser. \$\endgroup\$ – Brian Drummond May 20 '18 at 12:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.