The Neo900 Open A platform with new security features neo900.org

Werner Almesberger [email protected], J¨orgReisenweber [email protected] The Neo900 project

Tired of closed mobile platforms ? veterans, still hungry Open hardware Designed for Free New security features Inspired by N900

Linux-friendly platform Active community Has a real keyboard Making a smartphone in three easy steps

Electronics (lots of them) Mechanical design (case) User-visible software Smartphone

The Openmoko experience: 2007.1: Gaudy, obese, unmaintainable, confusing 2007.2: Lighter, cryptic Let’s try something new: Qtopia Let’s try something else, too: Android 2008: Post-Openmoko: QtMoko, SHR Lession learned. Let’s not do this again. Software evolution (simplified)

Nokia Intel Foundation LiMo

Nokia+Intel MeeGo

Hildon Community Maemo 5 Mer (Fremantle) Intel+Samsung+LF Community Nemo Mobile Sailfish OS Software choices

Neo900 is a Linux platform. Maemo (Fremantle) Hardware compatibility goal / Devuan Board Support Package Replicant (Android) MeeGo ... whatever you choose to install or port Hardware evolution

Openmoko Golden Delicious Neo900 Nokia Linux

2006

2007 GTA01 (Neo1973) N800−810 (Tablet) N95 Case, LCD 2008 GTA02 (Freerunner) N96 Case, Maemo 2009 GTA03 N900 (Phone) N97 (Keyboard)

2010

2011 GTA04A3 N9 (no keyboard)

2012 GTA04A4 Know−how 2013 Neo900v0 Influence &D 2014 Neo900v1 Product Prototype design 2015 GTA04A5 Neo900v2 Reusing the case

N900 case is nice Making own would be too expensive N900 case is still available Problem: We need more space

Original component heights Modem (PLS8) Top

2.3 mm max. 2.0 mm

PCB 0.8 mm

max. 1.5−2.0 mm

Bottom Solution: Add another board Top

max. 2.0 mm

UPPER 0.8 mm

Modem Board−to−board 2.5 mm +3.3 mm (PLS8) connector

LOWER 0.8 mm

max. 1.5−2.0 mm

Bottom Original mechanical stacking Case bottom

Case bottom Display PCB

Display opening

Keyboard frame

Keyboard

Dome sheet Keyboard frame Key mat The Spacer Frame Case bottom

Spacer frame Display PCBs

Display opening

Keyboard

Spacer frame Key mat Drawing not to scale

Your smartphone, in theory

Modem Application (GSM, ...) Environment (Linux)

Closed Open In practice

Modem Application (GSM, ...) Environment (Linux)

Closed Open Keep them separated

Application Modem Environment (GSM, ...) (Linux) Data

Power Closed Open However, ...

Radio

Application Modem Environment (GSM, ...) (Linux) Audio Data

Power Closed Open Oops !

Radio

Application Modem Environment (GSM, ...) (Linux) Audio Data ? Power Closed Open Oops !

Radio

ROGUEApplication MODEM Modem NOT DETECTEDEnvironment (GSM, ...) (Linux) Audio Data ? Power Closed Open Sensory deprivation

Radio

Application Modem Environment (GSM, ...) (Linux) Audio Data STOP

Power Closed Open ... and monitor

Radio

Application Modem Environment (GSM, ...) (Linux) Audio Data

Power Closed Open Just in case ...

Radio

Application Modem Environment (GSM, ...) (Linux) Audio Data

Power Closed Open Prototype V0/V1

Modem, some switches No CPU Goal: Test mechanical compatibility and modem Produced early in the project Prototype V2

Most components present External CPU (BeagleBoard) Refined mechanical design Goal: Test subsystems Working on this now Prototype V3

Complete system, with CPU Goal: Certification Goal: Finalize design before production Expected around end of 2015 CPU, Neo900 Block Diagram (Work in progress) power (3x) Comp. Modem TX (a) = EMERG_OFF, RING, Modem monitor monitor Connection through PCB contact(s) I2C#2 pcm[4] Modem+Navigation cell PWR_IND, LC_IND, CPU STATUS, 3G_WOE, Junction with branch 2 3 x INA231, TPS22963 PHS8/PLS8−E,US/PXS8 1 CPU MODEM_IGT eMMC (64 GB) GPS/GLONASS Crossing of separate connections VGNSS (b) = rst, clk, io, cd, power, MMC2_{CLK,CMD,DAT[8]} 2 LNA swp (a) 5 3 D+, D−, VBUS N signals on connection/branch ??? uart[4] gps BGM 1034N7 SIM switch N 5 GPS kill blue: I2C bus 10 44 USB PHY PE4259 ALERT, EN (b) 6 ULPI[12], RESETB USB3322 SIM #1 RAM_{CTRL[17],DA[32],AD[19]} 68 MMC#2 13 rst, io, clk, cd, power RAM (1 GB), SF7W006S4E BSP#4 3 int, en, strobe antenna (b) UART#1 USB#1 8 NAND (512 MB) NAND_{CTRL[9],ADDA[16]} 25 Flash LED driver CPU 3 cd 6 2 Flash LEDs SIM #2 I2C#2 data,ctrl CPU 1 KCE00E00CA I2C#2 ADP1653 2 x L130−5780002011001 NFC swp,control 101−00271−82 rst,int I2C#2 TRF7970A, KL16 uSD card MMC1_{CLK, 7 2 I2C#3 Audio, BTFM CPU 2 I2C#3 MMC#1 I2C#3 ST1W008S4B CMD,DAT[4]}, CD B2B UPPER−LOWER 2 cam_d3, CAM_XCLKA 2 x DF40HC(2.5)−60DS−0.4V, 2 x DF40C−60DP−0.4V 1 CAM_B_EN Batt. lid mag. BAT_LID 1 CPU CMOS camera (rear) B2B LOWER−BOB MLX90248ESE 4 CSI_A_B[4] 4 DF9−21P−1V, DF9−21S−1V 5 GHz Cam switch Main cam conn N97 cam, DF37NB−20DS−0.4V conn. 2.4 GHz ??? sdio[6] MMC#3 CAM_CLKB WLAN_{EN,IRQ} 1 WLAN/BT 2 x TS3DS26227

Baro, CSI_B[4] Accel BMX055 BME280

9−Axis CMOS camera (front) LIS302DL Tap uart[4] humidity RF UART#2 RGB.R 4 VS6555AC pcm[4] 1 INT1 () INT2/4/5 Diplexer 0R BSP#3 I2C#3 1 ??? BT_EN 1 INT2 (to cam, proxy, ambient) TBD WL1837MODGI (c) INT1/3, DRDY 1 PROXY Reflective switch (proximity)

M50−3151042 DPX2012LL85R2455A Hackerbus 1 ALS_INT FM_nINT Ambient light sensor FM TX/RX TSL2563 FM TX I2C#2 LCD_LEDS Backlight LED driver SETCURR1, LCDLEDS_{1,2}, CABC 4 Si4721 CPU Compan Speakers 2 1 TPS61041 17 LCD_{RST,CDP[8],SPI[4]} 17 LCD SPI#3 ACX565AKM−7 FM_ANT FM_AUDIO[4] B2B 2 audio 2 1 4 Main flex connector Resistive Speaker 2 TSC_RST, PEN_INT I2C#2 Touch scrn ctrl X/Y 4 CRTOUCHB10 touch screen amplifier I2S 4 3 audio 2 Stereo NRST[2], RGB_INT, RGB_CTRL_EN audio BSP#2 18 Kbd LEDs RGB TPA2012 1 4 audio codec CODEC_RST 1 6 x MSL0201RGB 2 1 Basic RGB Earpiece 2 x TINY control(s) IR LED LED drivers 3 Privacy EAR 2 RX DM3730CBP IR Logic VSMB2948SL ? SMLP36RGB2W3 Flex IR ? 2 x LP55281 3

1 UART[4] EAR 5000246471 From GTA04A4 3 bias, clk, data 3 UART#3 1 IR sense Mod LEDs 4 LTST−C190KRKT, audio PMIC_INT, I2C#4USB#0 I2C#1 RX VEMD10940F I2C#3 LTST−C190TBKT, Codec From GTA04b7v2 Digital nRESPWRON, Codec 3 LTST−C190KFKT 2 x SPK0415HM4H 4 TLV320AIC34 2 2 1 NCX2200, UART[4] Fancy RGB 6 (pre−reorg) NSLEEP1, Fuel TBD LED driver Aux LEDs ... 1 NX3V1G66 4 3 2 x MSL0201RGB 3 I2C_SR[2] ULPI I2C_CNTL[2] Other origin Mic Itf. 3 line[2], bias I2C#2 12 LP55231 CPU 2 4 VBUS, D+, D−, ID VBUS, D+, D− 3 EMIF02−MIC07F3 Headphone amplifer 5 CHRG_IND Companion 4 Privacy.B Being discussed 2 1 HEADPH_EN LCD_LEDS Batt charger 1 CPU BL Battery (contact) I2C#2 1 USB AB 47590−0001 BQ24297 CPU BSI_HDQ Keep/same TPA6130 2 BKBAT CPU, Compan ECI Mic/TV Backup 1 BTEMP 2 1 ??? TLV1702 TS5A22366 ? battery Add / change Ring switch 1 present "TWL4030" 1 POWERON Fuel gauge CPU GPO 3 1 TVOUT, 2 I2C#2 PAS3225P 3R3113 TPS65950 IR BQ27200 Future development CPU 1 TVOUT_EN TS3A225 2 2 I2C#2 Kbd scan ECI[3] VIBRA_{P,M} CPU Batt. CPU CPU CPU CPU I2C#2CPU I2C#3 CPU 2 TCA8418 mic temp. 1 SCREEN_LCK 1 SLIDE_SW 2 CAM_CAP[2] 1 cam_d11 1 stylus ECI_AD Vibra motor KEYIRQ, RESET 2 2 CPU 18 Compan Slide mag. 3.5 mm 3 Power Lock Capture Cam cover 2 Stylus 2 HEADPH_IND ROW[8], COL[10] 18 sensor CPU CPU Vol +/− EVQ−P42B3M ESE16 MLX90248ESE EVQQ0G03K TMD26713 TMD26713 1 5469246 304−106 2 x EVQ−P42B3M ??? 2016−04−25 20:47:19 −0300 Feature comparison (1/2) N900 → Neo900 CPU TI OMAP3xxx, 600 MHz → 1 GHz RAM 256 MB → 1 GB eMMC 32 GB → 64 GB Modem GSM, UMTS → Various options Touch Resistive + Dual-touch Sensors Accel, light + Add compass, gyro, baro Infrared Consumer IR (TX only) → CIR (TX/RX), IrDA Positioning GPS + GLONASS

Modem Bands PHS8 4×GSM, 5×UMTS PLS8-E 2×GSM, 3×UMTS, 5×LTE PLS8-US 4×GSM, 3×UMTS, 4×LTE PXS8 4×GSM, 5×UMTS, 3×CDMA2000 Feature comparison (2/2)

New features: Neo900 NFC TRF7970A Expansion Hackerbus

What we keep: Neo900 Screen 3.5”, 800 x 480, Transflective Front camera VGA Main camera 5.0 MP Products

NeoN: Upgrade kit (boards, parts) Bring your own N900 No soldering required Neo900: Complete device Built from N900 still in the market More information

Web: neo900.org Village: see us at the Neo village