DEM-3000X

The DEM series are prototype models used by Sony for development (hence why D in DEM) before the PDEL series (which resembles more closely to the production PCH-1XXX series).

Internal versus External units

Between all DEM units exists 2 families: internal and external.

External

These units were provided to big video game studios before PSVita launch so they had time to develop games for release on PSVita launch date.

These units use External keys, which are common with PDEL, PTEL and PCH units. However most DEM-3000 were not having NPDRM keys, preventing these units from playing finalized games.

Internal

These units were made for internal usage by Sony engineers. They had to be destroyed once a more recent revision was made.

These units use Internal keys. This way Sony can compile unstable FWs while preventing External units from installing them.

By luck PSVita scene got access to one of these units (a DEM-3000H System Debugger) and dumped its content.

Short description

Unknown white prototype model

• See [1].

It seems running FW 0.995.

DEM-3000G

• certainly IRT-001
• certainly GCP-001
• SGX543MP4+(ES2)

DEM-3000H

• IRT-001
• GCP-001
• Kermit Revision=3.2
• CP board id 3

DEM-3000JEC

• Not much info about this model is known.

DEM-3000K

• certainly IRT-002
• certainly GCP-002

DEM-3000L

• IRT-002
• GCP-002
• SoC Revision=4.0
• CP board id 4

DEM-3000P

Exact same hardware as PDEL-100x.

• IRT-002
• GCP-002
• SoC Revision=4.0
• CP board id 4

Analysis

DEM-3000H

User Jerry Yin of AssemblerGames found a couple of working DEM-3000H units and gave a teardown with photos of the process.

Map

Front.

Back.

CP daughterboard.

The following is an attempt to map key areas of interest on the DEM-3000X device. All items appear in PCH units (in different locations) unless otherwise specified.

1. Wifi/BT module. There exists an ANATEL filing but nothing with the FCC since Sony decided to certify the entire PCH motherboard instead.
2. Power distribution network. Ceramic chip, analog logic assumed.
3. Decoupling network for Kermit as well as P1P40167 clock synthesizer IC and a 27MHz crystal.
4. Back camera connector.
5. eMMC storage, 4GiB.
6. Syscon and related crystals. Chip is labeled "D79F0109 ES1.0 10301M001 MALAYSIA" and is likely a Renesas IC with a custom RISC based CPU core.
7. Accelerometer. Kionix KXTC9
8. Top: ST32F100B6 microcontroller. On PCH units it's a slightly different model (ST32P10S0E, undocumented). Likely used to interface with the sensors and/or controller. Left: unknown, probably some sensor. Right: Gyroscope, ST 3GA51H model.
9. MAX11615EEE analog to digital converter? Maybe connected to #18 connector on the backside. Not found on PCH models but found in PDEL.
10. Front panel connector. Slightly longer than PCH models likely due to different panels. Probably also contains front camera interface as well.
11. Start/Select buttons. Not found on PCH models (it's on the side-board).
12. Power management. Same network found on PCH units with extra chips for charging/battery fuel gague.
13. Boot-up LEDs. Same as in PDEL units. Connected to GPIO.
14. Kermit SoC, pre-production version. Labeled "Toshiba T9ML6TLxxxx JAPAN 105xxxx A29590" (xxxx are unclear from picture). Earlier model than the FCC filing for PDEL which had a "T9ML7MBG-S".
15. MIPI DSI 3 lanes for front panel.
16. MIPI DSI 4 lanes for HDMI conversion IC (to #24). Only found on VitaTV and PDEL units.
17. Unknown IC, cannot find mapping to PCH unit.
18. Connector to back touchpad.
19. Audio codec IC. Labeled "WM1803E 06ABRT4". On top right (outside box) is an IC related to the antennas.
20. Unknown connector pads.
21. Battery for CP.
22. mini PCIe connector for CP daughterboard. Does not follow PCIe signal interface.
23. Unknown transistor/logic network.
24. MIPI DSI to HDMI translation chip. ADV7533 model.
25. HDMI connector
26. mini-USB connector from the CP.
27. DRAM for CP. 256MB. Labeled "Samsung K4X2G323PC-8GD8"
28. Left: EPSON RX-4581NB real-time clock (labeled "R4581 EK416C"). Right: PIC16F724-I/ML microcontroller (low power). Both likely powered by battery (#21) and are used to ensure CP RTC is never reset.
29. Unknown IC
30. Unknown network
31. eMMC storage for CP
32. CP processor. Labeled "... 1028KU603 JAPAN ARM". PDEL units are labeled "KD77630AF1 EM1-S 1141KU601 JAPAN ARM". Both are likely the same chip from Renesas.
33. Left: USB transceiver. SMSC USB3315 model. Right: USB hub. SMSC USB2512B model. Above that: crystal for USB. Allows CP USB port to export an interface to CP processor as well as Kermit.
34. Unknown. Connected to USB hub IC.