Journal · Building in the open

The full specification, published

The PHYLAX board on the bench with its OLED panel and SWD programmer attached, on top of handwritten design notes
The board, the programmer and the notes it came from. All of it is now written down in one place.

Eighteen updates in, the parts list has been scattered across eighteen posts. It is now in one place: a specification page listing every component in the prototype, with part numbers, and with the three things we have already decided to replace marked as such.

Most hardware wallet specification pages tell you the processor and the screen size and stop there. Ours lists the polyfuse, the ESD array, the series resistors on the data lines and the resistor that sets the display current, because on an open hardware project those are not trade secrets — they are in the schematic anyway, and a bill of materials you cannot see is not much of an open design.

What is on the page

Core, display, power, USB, input and debug. The microcontroller is an STM32F205RET6 — Cortex-M3, 120 MHz, 1 MB Flash — clocked from an 8 MHz crystal that feeds the 48 MHz USB clock through the PLL. The screen is a 2.42-inch SSD1309 OLED, 128 × 64 over SPI, with its logic on 3.3 V and its panel on 12 V from the boost converter we spent Update 14 listening to. The firmware is stock Trezor Model One, unmodified.

Three rows say "planned"

This is the part we thought about longest. The USB-C receptacle currently fitted brings out one data pair, which is the fault Update 16 traced; the sixteen-pin replacement is chosen but not on the board yet. The boost inductor is still the bare wirewound part; the moulded one is chosen but not fitted. And the MCU is the RET6, with the automotive-grade RET7 as an upgrade we will make if the temperature range earns its cost. We could have listed the parts we intend to ship and let you assume they were already there. Marking them instead is the whole point of publishing a specification while the thing is still being built.

Why publish it now

Because a hardware wallet asks for a particular kind of trust, and the only honest way to earn it before anyone can hold the device is to make the design checkable. A part number is falsifiable in a way that an adjective is not: "industrial-grade microcontroller" is marketing, STM32F205RET6 is a datasheet somebody can go and read. The specification will change as the prototype does, and the changes will show up there and here.

The page lives at /specs and is linked from the navigation in both languages. If something on it looks wrong to you, that is exactly the reaction we published it for.

← All updates Subscribe for updates