As no electronic item is safe in my house from being taken apart, I decided to look inside the belly of my HP 2600N color laserjet printer. For those of you who play Name that Ware, well, here we are–time to figure out what these boards do in a real-world scenario.
The board pictured above connects to the outside world (USB, Ethernet) and straps over to the board below via a flat-flex cable.
What do these boards do? Well, I can only guess. Here’s my take.
The first board pictured–the one that connects to the outside world–I call the front-end board. Prominent features include an Agilent ASIC that presumably contains the ColdFire V4e 264 MHz processor advertised by HP as the “brains” of the printer, and its companion 128 Mbit EDS1216AATA memory chip (no, the memory is definitely not upgradeable on this printer). The Broadcom part is presumably the Ethernet PHY device. U9, the ST Micro 25P16 part, is a serial code ROM (16 Mbit, 50 MHz). It contains the firmware. Next to it, U10, is a serial EEPROM, a 24C64 which is a 64 kbit (8kbytes x 8) device. If you were to ask me, I’d say that the total cost of this board, fabbed and tested, in volume is well under $35.
An interesting exercise to consider is the datarate generated by this board. At 8ppm and 600×600 dpi printing resolution, assuming 8.5×11 inch coverage and four colors, each of which are printed as binary dots, the board has to output a peak datarate of 17.9 Mbits/s. That’s an astoundingly low datarate. From the looks of the on-board routing, I see four differential pairs routing into the flex connector, so that means it’s running at something on the order of 40 MHz. It would be interesting to drop a scope probe on there to see if my estimates are correct.
Now before we get too excited about pulling the Firmware chip off and reversing the firmware code to try and find the watermarking subroutines, let’s look at the other board. This board sits between the front-end board and the print engine itself. The printer has an array of four scanning lasers–one each for CMYK toner colors–that have to be driven by this board.
Salient features of this board–I call it the engine board–are two motor driver chips (distinguishable by the wide metal sheets near the middle of the chip body, used as heat sinks for the high power handling requirements of a motor driver) near the center. Below these chips is a Fujitsu proprietary-architecture 16-bit microcontroller, the MB90F487. I estimate this contains 192 kbytes of ROM and 10 kbytes of RAM, and it runs at 25 MHz. The chip to the right of the Fujitsu controller…is mysterious. It is labelled RK2-0581-3. From its connectivity, you can guess it talks to the lasers. There’s also a very attractive button on the left labelled “TEST” and some debug headers, very inviting. And finally, there is an 8-pin SOIC labelled “L56” near the lower right corner. This part reeks of a serial EEPROM, although the number L56 isn’t one I recognize off the top of my head. A google search and hunching about leads to a Rohm part number for a 128×16 bit SEEPROM.
Okay, another salient feature of this engine board is that it looks nothing at all like the front-end board. The soldermasks are from different processes; the design and layout styles are vastly different; the assembly solder process shows a different fillet on the resistors. The front-end board reeks of large American company design, and the engine board reeks of large Japanese company design. But wait, isn’t this an HP printer?
On a hunch, I investigate an OEM possibility for HP…and lo! Canon seems to be making HP’s print engines. Canon has beautiful documentation on their printer technology at this link. The schematic printer shown on Canon’s webpage is almost exactly HP’s 2600N. The final piece of evidence is this link to a photo of Canon’s print engine board. Look familiar? Yes, the chips aren’t exactly the same–they have what looks to be a development prototype–but the manufacturing process and board layout style is a match with the engine board in the 2600N.
Now, things are starting to make sense. Laserjet printers are probably crazy hard to develop–there are four scanning lasers in this thing, for heaven’s sake–and it doesn’t make sense in a $400/unit market to invest tons of money into R&D. So it’s quite likely that Canon OEM’s the majority of the entry-level color laserjet engines…and…we now see a single point of weakness. Want to put a watermark into every printed page coming out of color laserjet printers? Just pull the right strings in Japan and viola, the world market is watermarked. Gotta love consolidation and outsourcing. (This also leads to the interesting question of just what value is HP bringing to the market, but get me a beer to talk about that one). And the fact that Tektronix Phaser printers do not have watermarks is consistent with this hypothesis, as the Phaser printer line pre-dates this Canon engine by quite a bit. I’m guessing that Tek probably does their own print engines…
So–assuming we’re looking for a watermarking mechanism–what do we need? We need something to inject the watermark, and something to store the watermark. We have the following injection points for the watermark:
- Front-end processor
- Engine control processor
- Engine rendering ASIC (according to the Canon website it is a Super L/S Rendering ASIC)
We have the following storage points for the watermark:
- Code ROM on fron-end board
- 64kbit Serial EEPROM on front-end board
- Buried within ColdFire processor ASIC on front-end board
- Buried within Fujitsu microcontroller on engine board
- 128 x 16 bit serial EEPROM on engine board
- Within rendering ASIC on engine board
Well, going by the hypothesis that the single point of weakness for a goverment body trying to get watermarks in every printer would be Canon, and not HP (yay outsourcing), we can discard anything on the front-end board. Thus, where would one put a watermark on the engine board?
Well…there’s one excellent spot. The rendering ASIC. If you want to drop in a watermark, how much easier could it be than a set of OR gates on the back-end pixel pipe plus a couple address counters and some registers to hold the watermark data…and some small serial EEPROM to hold that data when the printer is turned off.
It’s compelling to think that perhaps the watermark is just stored in that EEPROM, and just disabling, wiping, or otherwise mangling that device would lead to watermark removal. Then again, that would be just too easy…if someone’s going to go through the trouble of going to Japan to enforce US secret policies across American citizens, surely they would make it more difficult to hack? Something to do on another lazy day…right now, it’s time for bed for this tired soul. Stay tuned! and thanks for reading.
[follow-on note] — shorting the DO pin to ground on the EEPROM (the simplest solution should always be tested first!) yielded a printer engine error. Interestingly, the EEPROM is interacted with both at power-on and before every page printed, but not during a page print (I tried shorting the DO pin at various points in the printing process). Currently getting some spare EEPROMs and adapters to make short work of mucking around with these devices…
Wow! I love how you just take things apart and think about everything possible on the circuit boards. I can’t wait unitl I have enough knowledge to figure some of these things out on my own.
About that “As no electronic item is safe in my house from being taken apart” same here.
Some interesting (and educational) reasoning; thanks!
Re: your remark, “Canon seems to be making HP’s print engines,” I believe that’s actually been true since the first LaserJet I was designed. See http://www.hp.com/hpinfo/newsroom/feature_stories/2004/04jetset.html (found via the excellent collection of links at http://www.hpalumni.org/links.htm ). I don’t know how widespread Canon print engines are; they might well own the entire OEM market by now.
I worked for a company which built an integrated print controller / front end processor for entry-level color laser printers (not this one). There were several different 4-color engines we targeted (Minolta and two others I forget), so I know that there’s not quite a single point of control in that space.
If you have access to the signals between the engine and the controller, you should be able to print a blank (or black) page and use an analyzer to see if any dots have been inserted upstream of there.
If you’re going to pull strings, I guess a viola is as good an instrument as anything else. :)
I think the watermark issue has been discussed in this document.
http://www.eff.org/Privacy/printers/wp.php
Hope it helps.
oops, wrong thread
Have you checked the FCC ID ?
It will tell you who was the original manufacturer.
At least it will tell you who was first to bring the thing to the north american market and what is the basic model.
One good lead for reconizing boards and other components of thesesystems, is http://www.printerworks.com, a seller of parts and refurbished systems.
Look here and note that they began by supporting Canon based print engines, ie. HP LaserJet.
Maybe you read that EEPROM out ?
I only have OKI (i know why *g*) printers, and one old AcuLaser C2000 that has been more or less given to me. I shall see. But its an entirely different board with larger CPUs and DIMMs etc..
I might not want to take it that much apart as to get to the I/O Controller board :(
OEM: Canon was the FIRST large laser engine manufacturer. The Apple LaserWriter and ~Plus and LaserWriter II are all Canon machines.
HP Laserjet and old Apple laser writer are based on Canon laser engines (As well as one or two old Brother laser printers)
Also, Dell and Samsung are based on Lexmark laser engines.
Brother, Panasonic, and Pitney Bowes also show similer engine types, though I could not tell you who the parent manufacturer is.
Sharp and Xerox have similer engines as well.
One of the easiest ways I have found is to look at the toner cartridges, similer engines have similer looking cartridges.
While you’re at it, here’s a confirmation I’d love to see. Check this 2600N review: http://www.epinions.com/content_196413001348
The reviewer alleges that the HP 2600N maintains a print counter that, when it reaches 2000 or so prints, arbitrarily tells you to replace color cartidges. So while the purchaser thought he could print black for the majority of work to save money and avoid having to replace CYM cartridges as often, the printer is using overall print count as a metric for telling you to replace toner, rather than the actual amount of toner remaining in each cartridge. Chips in the cartriges themselves meant he couldn’t just shake the cartridge to get more life out if it, as the printer refuses to even try to print when it reaches this state.
The writer noted that an HP rep confirmed for him that a Yellow toner cartidge that the machine said needed to be replaced still had 80% of its charge left.
I would not have believed that HP would engineer things like this, but then again, this is not the HP that existed 10 years ago. If it is true, this is wasteful, cost ineffective, and environmentally irresponsible beyond belief.
Of course, if this is true, perhaps the hacker community has an answer to this. A way of resetting the world so the unit thinks its got new cartidges would be great.
No need for a hacker to get around the print counter.
Page 94 of the User Guide has the following instructions for those who would like to use the toner beyond their replacement time:
Configuration
Cartridge Out Override can only be enabled from the printer’s control panel menu.
1. From the main menu, press (RIGHT ARROW) to System setup and press (SELECT).
2. Press (RIGHT ARROW) to Print quality and press (SELECT).
3. Press (RIGHT ARROW) to Replace supplies and press (SELECT).
4. Press (RIGHT ARROW) to Override out and press (SELECT).
5. Press (SELECT).
If Stop at out is selected, the printer will stop printing when a cartridge reaches the
recommended replacement point. If Override out is selected, the printer will continue
printing when a cartridge reaches the recommended replacement point. The factory default
setting is Stop at out.
Thanks for the instructions M. So would the printer still print when i run out of tonner (0%) and refill the cartridges with replacement tonner? I was thinking of getting toner that the 2550n uses and see what happends.
First off, I am an HP tech support guy. There is no real reason I am aware of that the toner from a 2550 won’t work in a 2600. If you, as M pointed out, set the printer to Override out the printer will keep running even if the cartridges are completely dry. What your print quality will be like is something else entirely. The 2600 does keep track of pages printed but does not turn off the cartridges at 2000 pages. The 2000 pages is an estimate based on 5% paper coverage.
If the coverage is less the toner lasts longer, heavier its shorter. Simple as that and because of that you can’t lay down a set number of pages because HP can’t predict how people are gonna use the printer. The problem with refilling a cartridge is the OPC in the cartridge. Its only rated for so many charge/discharge cycles and revolutions. That is where your point of failure will be if you refill the cartridge. Of course that may be aways done the road.
As to Canon making HP stuff. HP does own a big chunk of Canon after all.
Bunnie: Keep ripping, its interesting reading
j’ai un probléme avec ma hp 2600n laserjet le panneau info me marque
no string in rom et elle n’imprime plus rien et lorsque j’envois une page test
je l’entends recevoir l’odre elle demarre et apres plus rien
quelqu’un peu m’aider ou existe t’il un soft pour la reprogrammer
I think there is an arbitrary page counter (the chip on the cartridge) and also a LED for toner-out detection.
If you print pages with heavy coverage you will run out of toner first, so you change the “stop at out” setting to “override out” and keep printing until the image quality degrades.
If you print pages with light coverage (as I have been doing) the counter will run out first, and the printer will refuse to print (apparently, it thinks the life of the drum has been reached, or perhaps it just wants you to buy more consumables from HP).
If you did run out of toner first, you can refill the toner with some difficulty, read this:
http://www.uninetimaging.com/newsletter/HP2600RemanEng.pdf
but then you will soon run afoul of the page counter, so you have to replace with a compatible chip on the cartridge. Somebody suggested there is no page counting, but if so, why is there a chip on the cartridge, and why do companies sell replacement chips??
One strange thing I noticed is that covering the LED toner-out detector doesn’t seem to give the same effect as “override out”, I guess this must be because HP is storing the historical toner-out status somewhere to avoid “flicker” of the toner-out measurement.
I plan to have a good look at the canon documentation for the engine to see if I can figure out how to make the drum chips. If I find anything I’ll write it up here. Cheers
Thanks for the “override” method. I was at my wits end with trying to get the printer to work again what with replacing all the cartridges. One didn’t work because of “incorrect cyan”. Could that be solved with another tweak?
Bunny – how are you getting on with the original point of this post – DISABLING THE YELLOW DOT FINGERPRINT / WATERMARK of every page printed out by the 2600n. After searching on google i found this message and your site (which is excellent by the way) but there’s no conclusion to your project – whats the latest?? And I emailed you with my own ideas how to get around this watermarking about 3 days ago – and still received no reply from you? Did you get my email? Does anyone else have any ideas about this? HP are violating our rights by not informing us about this watermarking in the manual – i mean, 2600n owners were not aware of this before buying a 2600n were they? NO. And most still don’t know! After I personally scanned in a printed out page of my own at 1200dpi i could CLEARLY see yellow dots all over the page! Clearly in a pattern too.
Hi bunnie, I stumbled across your website and I must say this is an interesting article. I look forward to reading more of your site.
I am very interested because I am actually an asic design engineer at canon, working on the next generation print rendering asic (known as SURF – http://www.canon.com/technology/interview/irc/irc_p6.html), and i can assure you we don’t insert any watermarks during the rendering stage.
Hello all, I was hoping someone could help me out- I have just replaced two cartridges in my laserjet 2600n (magenta/black) yet the display continues to say “Replace Supplies” & wont print. I’ve tried the override option, but still nothing. The printer was running strong all year long, and I’ve replaced cartridges before, but now it seems stuck.. Any suggestions would be great..
Thanks
Hello,
I’m looking for a web site whose bookmark has been lost because of recent theft of my laptop (AND x-harddrive too…). Maybe you know of it or one similar. It consisted of photos and captions of lab experiments gone bad–many pcb-related but not exclusively. The captions & short blurbs were pretty funny paired with the photos. Would you know of such a site? I miss it, and my engineer customers are wanting me to send it to them. Thank you! I enjoyed looking at your blog for the first time today–very interesting!
Regards,
Nancy
Thanks for the tip on the toner override – well hidden HP ;-))
That extra output is very welcome
Cheers
Dave
I found this site while searching for a solution to the “Order Supplies” message which was surprising since the browser interface indicated 9% toner remaining for the three color cartridges and 56% for black (already replaced). Thanks, M – the fix was simple beyond belief (wow – RTFM!)
Bunnie – very interesting site and topic (I had no idea about the watermarks but am not the slightest bit surprised)
Another Dave, another 2 cents
Well that was a fun read, I enjoy the added touch of the pictures from the belly of the beast. Circuitry is an amazing technology don’t you think? It’s come so far.
I’ve got a yellow line pinting right down the left hand side of my printouts ARRRG!! I think it may just be a bad refill , but thought I ‘d add my 2600n 2 cents worth.
when i have the override on when it tells me to replace the toner cartridge it will stop printing color correctly. It outlines letters and fills in with dots instead of full block of color as usual. It will do it on all three colors even if only one says it is low. will return to normal if you replace cartridge. Good one HP.
Has anyone used the override and it prints out wonderful till the toner is out…I’m thinking of getting one and would like to know.
Dee
Thanks for the info on how to override the HP2600n toner chips. The toner is expensive and I hate to replace them before I have to. :-)
Dee mine is still printing out just as it did when I first bought it. As you can see it’s been 9 months since I last posted and I have 2 teenage kids doing all their homework through it.
Still on the original cartridges
Dave
Interesting Site. Very useful. I like the tips and tricks being shared. Page 94 of the manual is probably the most popular. I actually love this BEAST of a printer regardless of price of toner. Just does everything I need it for.
I’ve had this printer a year and umm, couple of months I guess. I have gone through a set of colors and 2 black toners. Currently on my 3rd black installed on Oct 31st with 30% remaining. Lot of printing these past 2 months. Colors installed same date with 80% remaining.
Supplies status page is as follows: Black 1139, estimated remaining 488 based on 8% coverage. Colors 190, estimated remaining 760 based on 11% coverage. Exactly what is the rated 5% coverage according to HP? I don’t know. Five sentence paragraph in a business letter? Does that include addresses and the SINCERELY closing? RESPECTFULLY YOURS?
Anywho, considering I know what I have been printing in the past 2 months, I know my average has jumped to 8% according to the counter. At 1139 pages thus far, it would cost $79.73 to have them copied at 7 cents a copy, respectfully. I have 488 pages to go, that’s another $34.16. So I am pleased to pay 70-75 bucks for a BLACK cartridge.
Side note: Since new, the printer read out states 2,599 pages have printed in color. At 35 cents (respectively), that is $909.65.
So here come the goodies. I may be repeating info and I hope I am offering new ones so here goes, NOBODY MAKES A CARTRIDGE LIKE HP, NOBODY! Setting the toner out at or below 30-35% remaining sometimes does not work. You must also remember to set the toner out every time you replace the toner(s).
Also, all pages print a mix of black & white & color. When printing in black & white, the color toners will also decrease in remaining percentage. When printing just B&W, be sure to find and click GRAYSCALE. For me it’s PRINT, then a screen comes up, click PROPERTIES, then click the COLOR tab and select PRINT IN GRAYSCALE. It will still use some color but not as much. (When printing, print from the FILE tab up top and select PRINT, that usually pops up a screen to change things.)
There is also an OPTIONS button when ready to print. I once heard selecting DRAFT OUTPUT reduces amount of ink used, but I have not been able to test. I always forget about that one. The only thing that is selected on mine is allow paper resizing. You can also click and unclick drawing objects & background printing accordingly.
Lastly, wow this is lengthy, sorry, when you remove the toners, look towards the left side where the toner would touch some black plastic stuff. IE: when removing the black toner, you will see some type of domed glass eye. A “hinge” of some sort, and a tube to the right of that. I believe the tube to the right is a photo sensor. If you cover all 4 with electrical tape, that should reduce photos from internet pages and be able to print just the text. Be VERY careful with that, the “hinge” slides and you don’t want the tape to interfere. Be sure to keep the tape FLAT and TIGHT so that the bottom of the “hinge” can slide over it. I of course, have not tried this yet.
OK!!! That’s about it people. Hope this helps. Perhaps a bonus round? Sure why not!!?? The 1600 comes with “starter toners”. The 2600 comes with FULL toners. People in certain auction places sell new oem genuine toners but be advised, 9 times out of 10, they are the 1600 starter toners. Think about it, 1600 series on sale and they sell the toners for 45-60 bucks plus shipping. Don’t even get me started on refurbs and replicas from China. Ever notice how HP is helping the environment and HELPS you by sending your old toner back to them for FREE??? How nice of them. Yet people are always spending money buying empty toners. Hmm. Here is the kicker…Buy a 2600 printer, take the toners out, put your old toners in and take it back. Once or twice a year won’t hurt. Will make them to refigure things out. Power of the people can cause mayhem. Hope you enjoyed all this jibberish. Again, NOBODY MAKES A CARTRIDGE LIKE HP, NOBODY!!!
Very wordy yet helpful. Thank you
Hey INK, if you are still around and checking this board, can you leave your email or email me. I have ome questions about the ink supply and settings. Thanks, John
Hello Wow, I was wondering how you got my email and now I noticed how. Last message leaves email up for who knows how long.
ANYWAY, I responded to your email. Hope it helped. Quick update, I printed 186 pages in B&W and 10 were counted towards the color remaining but the percentage didn’t budge. Reamianing pages jumped to 804. I guess my total color pages isn’t completely accurate. Down to 8% on black with 116 pages to go with an average of 9% coverage. I’m sure the pages will be getting smeared soon due to page count and imaging drum will act up.
[…] … findet man sowas eigentlich immer erst, wenn man (für 75€) einen neen druckertoner gekauft und v.a. schon eingebaut hat? ich war eigentlich nur auf der suche nach einem neuen chip (auf dem die seitenzahl und damit die lebensdauer gespeichert ist)… […]
We can holp you with quality fast turn boards both commercial and Mil spec. Low volume or high volume.
Thanks
I just bought a Xerox Phaser 7400. Any way to override the counters?
My last Cyan Imaging Unit lasted 3 days. Rediculous. I thought my Lanier lp332 was bad but at least it doesn’t shut down the printer.
Remanufactured printer cartridges are essentially recycled inkjet cartridges. They have been inspected, cleaned, and refilled with ink. They are typically print tested before they are sold to ensure that they are in excellent working condition. Remanufactured cartridges are usually less expensive than compatible print cartridges, which in turn are less expensive than OEM brand name ink cartridges.
Thanks for your pictures!!
My printer is CLJ1600N and my formatter board was broken. I found a formatter for 2600N but I need to check DC controller broad is the same.
Your pictures let me confirm it.
Sorry for broken English haha~
Hi,
I am looking for ink cartridges for the Epson RX610. I have bought compatibles in the past but the ink quality is not so great or the chips dont recognise. Any help would be appreciated :)
I think I have finally found the right guy, after hundreds or internet hours searching google.
I own this lovely printer – GCC Elite XL20/600. The engine can be found in the IBM Infoprint 20, Xerox P880 and I think Apple 8500.
All these guys have done is either limit the resolution to 600, 800 or 1200 or add fancy software so the user can play with the resolution and toner usage(using toner miser).
I would like to know how do I get my 600 to 800 or 1200dpi? GCC Does 3 models all the same engine with 3 different resolutions. I can’t find a software to use to backup and flash the rom, they are flashable intels products, I checked this out on the net. I also need the firmware.
Any pointers please?
Wow, this is crazy talk for me.
sorry
s.
The instructions below are not on my HP “600n computer when I go into “printers and faxes”, or do I go in somewhere else to look for system setup. I have just had to change all 4 cartridges even though only one seemed to be “out of ink”.
I have windows 2007 if that makes a difference
Des
Cartridge Out Override can only be enabled from the printer’s control panel menu.
1. From the main menu, press (RIGHT ARROW) to System setup and press (SELECT).
2. Press (RIGHT ARROW) to Print quality and press (SELECT).
3. Press (RIGHT ARROW) to Replace supplies and press (SELECT).
4. Press (RIGHT ARROW) to Override out and press (SELECT).
5. Press (SELECT).
If Stop at out is selected, the printer will stop printing when a cartridge reaches the
recommended replacement point. If Override out is selected, the printer will continue
printing when a cartridge reaches the recommended replacement point. The factory default
setting is Stop at out.
Great post – many thanks.
I replaced my Hp2600n with a Xerox 6130 because the toners are much easier and cheaper to refill. It does seem a shame to discard it completely.
I note that Canon’s 707 printer seems to use the same engine (LBP5000). I would assume that Canon cartridges can be used in the HP ?!? – they are certainly a bit cheaper.
Thanks a lot Des, i have just done our 4 HP2600N, they cost a fortune to run a year! Hopefully we should get some extra life out of them now.
Greetings. 1st I would like to say that I definitely like your web site, just identified it the past week but I have been following it since then.
I seem to agree with most of the ideas and opinions and this submit is no different.
Thank you for any wonderful web site and I hope you maintain up the beneficial work. If you do I will keep on to read it.
Have a great evening.
Really like your comment. Maybe inkjet cartridges source could assist someone there.
I am glad to find so a lot of constructive information now into the article, we need enlarge additional approaches inside this regard, thanks for sharing