Toon 2 hardware.

Forum about Toon hardware, both versions 1 and 2 of Toon

Moderators: marcelr, TheHogNL, Toonz

marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Toon 2 hardware.

Post by marcelr »

Recently, I received a toon 2 from Quby, to have a look at it in terms of security. Not that I am a security expert (far from it). It was sent to me following a visit TheHogNL, TerrorSource and I paid to Quby, we were invited for a mini hackathon. With our track record on rooting toon and extending and replacing core software on Toon, we were probably good candidates for intrusion testing.

Toon 2 has been designed to be hard to open, and hard to root.

Opening toon 2 is a lot harder than opening toon 1. While for toon 1 you can do everything with your bare hands, for toon 2 you will need the right tools to open it. The reason is twofold: the touchscreen, with PCB attached at the back, is sunk into a recess of the casing, making access to the clips that hold both together hard. You cannot easily lift the screen out of the backing. If you try to open it in the wrong way, the screen is irreparably damaged. The second reason is that access to the clips is hampered by a set of bridges cast into the backing. With tools that are too wide, you cannot easily loosen the clips holding backing and screen together.

Anyway, with a bit of juggling and sweating, I got the screen out, in one piece.

The construction of the screen + PCB assembly is much cleaner than in Toon 1. Both parts (screen and PCB), are mounted back-to-back on a single frame, which clicks into the backing. No more fuss with wifi and zwave antenna wires, or screen-to-PCB flatcables.

The touchscreen is connected to the PCB by two very short flatcables. If you want to remove the PCB completely, you will need specific tools or very agile and small fingers.

The following picture shows the parts on the PCB:
Image

The numbers indicate the following parts:

Code: Select all

#	   part			          manufacturer	  type number	

1:  	Processor              Freescale (NXP)  iMX6SX
2:  	RAM                    Samsung       	K4B2G1646F BCK0 (2x)
3:  	z-wave chipset         Sigma designs 	SD3502
4:  	WiFi/Bluetooth chipset Murata 		    1LN 
5:  	Power control          Freescale 	    PF3000
6:  	Zigbee chipset		   GreenPeak 	    GP711
7:  	Realtime clock		   Ambiq micro      AM0805
8:  	Ultrasonic sensor	   Murata	        A6Z
9:  	Reset button		     OEM
10: 	USB A connector		  OEM
11: 	Buzzer			        OEM		        SFM-1224B03
12: 	Light sensor		     Lite-on		    LTR-303ALS-01
13: 	Power connector		  OEM
14: 	Air quality sensor	  CCS (now Ams)	 CCS801
15: 	Humidity/temp sensor	Ams 	 	      ENS210 (2x)
16: 	Flash			         Samsung 	      KLM4G1FEPD (4GiB)
Some parts are the same as on the first toon (connector, buzzer). Processor, memory, flash are major upgrades, as is the screen (from 800*480 to 1024*600 resolution). Extensions: zigbee support, humidity detection, air quality detection, ambient light detection, and ultrasound proximity detection. The wifi/bluetooth chipset is a bit disappointing, in the sense that it only supports 2.4 GHz networks, whereas 5GHz is omnipresent today. If anyone's interested, I'll make data sheets available for each of these components on the forum file server.

Quby said during our visit that, unlike for toon 1, no development package for toon 2 will be made available to the public. Most code on toon 2 (bootloader, kernel, OS, services) are open source, and readily available from the internet. Not sure if this is entirely compliant with the (L)GPL, but without root access, these packages are quite useless anyway. During our visit, we had a peek inside, the machine runs a linux kernel version 4.9, and boots from u-boot 2014. The processor has fuse support, and this is used for signing the boot software, according to one of the hardware engineers.

I will add some more pictures later, will need to take them first :-)
Toonz
Forum Moderator
Forum Moderator
Posts: 1873
Joined: Mon Dec 19, 2016 1:58 pm

Re: Toon 2 hardware.

Post by Toonz »

Any clue where the serial port and JTAG connectors are located?
member of the Toon Software Collective
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon 2 hardware.

Post by marcelr »

According to the hardware engineer we discussed with, there's no JTAG access, but there is a serial port. The 10 soldering pads (just below item 6) allegedly were meant for a homekit chipset, but apparently, after the PCB design was finished they realized that homekit support can be done in software. Hmmm... I haven't been able to find a homekit chipset that fits the pads on the PCB.

This part fits the soldering pads perfectly:
Image

I think I'll order a bunch of those and solder them onto the PCB. See what's going on there ...
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Toon 2 hardware.

Post by TheHogNL »

Just thinking .. could they have used the power connectors for the serial com port connections?
They already use this towards the ketelmodule so maybe they have added a serial com port to this depening on what device is connected to it?
Member of the Toon Software Collective
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon 2 hardware.

Post by marcelr »

Hmmm... interesting thought. RS485 is a 2-wire protocol. Not sure how this interferes with the boiler module communication (also 2-wire serial, 4800 baud IIRC).
michel30
Member
Member
Posts: 286
Joined: Fri Aug 25, 2017 4:42 pm

Re: Toon 2 hardware.

Post by michel30 »

I think you need an USB stick that will boot up.
After that you can access the Toon with an special password and after that you can edit everything.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Toon 2 hardware.

Post by TheHogNL »

michel30 wrote:I think you need an USB stick that will boot up.
After that you can access the Toon with an special password and after that you can edit everything.
You have any information that adds to your thoughts? Or is it just a wild guess?

I did insert a USB stick into my toon2 during boot recently but no activity whatsoever on the stick itself. So if your story is true, than they also only allow one specific kind of usb stick.
Member of the Toon Software Collective
michel30
Member
Member
Posts: 286
Joined: Fri Aug 25, 2017 4:42 pm

Re: Toon 2 hardware.

Post by michel30 »

it just a wild guess.
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon 2 hardware.

Post by marcelr »

Thought so, it's a bit more complicated than that I'm afraid, and BTW this topic is about hardware, not about rooting.
Niwla
Starting Member
Starting Member
Posts: 2
Joined: Sat May 05, 2018 7:33 pm

Re: Toon 2 hardware.

Post by Niwla »

Would love to see more pictures! :arrow: interface with new resolution, front of the screen.
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon 2 hardware.

Post by marcelr »

Toon 2 comes in a cardboard box, sealed with PE film:

Image

The box itself looks a bit cheaper than the original one used for Toon1. Not that it matters, packaging material is discarded by most people anyway, for a good reason.
It contains three items:
Image

A brief manual, a box containing the display and mounting bracket, and a box containing peripherals.

While the outer box looks a bit basic, the inner two boxes have a much better design than the original Toon 1 box:

Image

Note that toon 2 does not come with the optical sensors for ferraris meters, and in the left box, the rim protruding over the display's edge is clearly visible. Intrusion protection number 1.
The meter adapter no longer has the Eneco logo printed on it, indicating the international aspirations of Quby.

The shape of the mounting bracket has slightly changed: It now features a slab of plastic, to reflect the ultrasound (US) coming from the US detector towards the room where toon is mounted. By having this slab of plastic, the functionality of the ultrasound sensor becomes independent of the surface features of the wall that toon is mounted on:

Image

The rear view of the new toon is not very spectacular: Essentially the same as the old one, only the backwards facing US sensor is a real novelty here:

Image

When you take this Toon (carefully) apart, the second intrusion protection shows, the bridges in each of the eight clip connectors (two on each side) really make loosening the display from the backing difficult:

Image

(but nevertheless, it can be done, as you see ;-) ).

When you switch it on, you will get the very same user interface as on the older Toon, which is not really surprising. Quby haven't rewritten their entire codebase for this device:

Image

Oh, by the way, this last picture is from a toon2 with the backing removed, I will reassemble it when my analysis of the hardware is finished, and there's still a long way to go ...
Niwla
Starting Member
Starting Member
Posts: 2
Joined: Sat May 05, 2018 7:33 pm

Re: Toon 2 hardware.

Post by Niwla »

Thanx for the update. Somehow I find the new display a bit more boring than the current one.

"Beschikbaar vanaf september 2018 / Available from september 2018" :D
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon 2 hardware.

Post by marcelr »

Niwla wrote: "Beschikbaar vanaf september 2018 / Available from september 2018" :D
Says who?
It's been on the market since last april ...
TerrorSource
Administrator
Administrator
Posts: 494
Joined: Thu May 04, 2017 9:28 pm

Re: Toon 2 hardware.

Post by TerrorSource »

Meteradapter is not for international use. There’s a squared shaped meter adapter for boxxx for example.

Oh. And there are no analog sensors since mid-2015 in the box. If needed, Eneco will send them afterwards.
TheHogNL
Forum Moderator
Forum Moderator
Posts: 2125
Joined: Sun Aug 20, 2017 8:53 pm

Re: Toon 2 hardware.

Post by TheHogNL »

If someone else wants to join the toon2 game, there is now a toon2 on marktplaats: https://www.marktplaats.nl/a/doe-het-ze ... ousPage=lr
Member of the Toon Software Collective
Post Reply

Return to “Toon Hardware”