The Lenovo Mirage AR Headset (bundled with Star Wars: Jedi Challenges) was a huge disappointment, now I'm going to extract what entertainment I can from tearing it down. From a mechanical engineering perspective, I was very impressed by what I saw. Unfortunately, robust mechanical design could not overcome fundamental product weaknesses.

Before I started the teardown, though, I was curious how it would enumerate as a USB device. I plugged it into a computer running Ubuntu and here's what got dumped out via dmesg:

usb 3-1: new full-speed USB device number 3 using xhci_hcd
usb 3-1: New USB device found, idVendor=1f3b, idProduct=1000, bcdDevice= 2.00
usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 3-1: Product: AR Head Mounted Device
usb 3-1: Manufacturer: Lenovo
usb 3-1: SerialNumber: 101215-0073
hid: raw HID events driver (C) Jiri Kosina
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
hid-generic 0003:1F3B:1000.0001: hiddev1,hidraw0: USB HID v1.11 Device [Lenovo AR Head Mounted Device] on usb-0000:00:14.0-1/input0

Looks like it conforms to USB HID standards, but as a "raw" device not obligated to conform to any common peripheral. Since it doesn't try to pretend to be something common (say, a mouse) we have to know its raw USB communication format in order to communicate with this device. If I still had the app installed on my phone, I could peek at its control schema using a USB reverse engineering tool like Cynthion (formerly LUNA). But I had neither. With my skill level and what I have on hand, I can't do much except take it apart.

I started with the easiest removal: the head strap which was held by hook-and-loop fasteners.

Next was the phone caddy, the only other user-removable part in this system. Visible in this picture is the short USB cable for the headset electronics to communicate with the phone. I used this headset with a Google Pixel so this is the USB-C cable. The headset came with two other cables: micro-B for other Android phones, and a Lightning for Apple iPhones.

The caddy had to accommodate over a dozen different phones and thus had mechanisms to adjust for different width, height, and thickness.

Working to meet those requirements were a lot of intricate details in the design of these injection-molded parts. (Aided by a few inserts made of stamped sheet metal.)

Next to the caddy slot (and USB port) is a product information sticker.

Reaching the end of user-serviceable parts, I pulled out my iFixit Mako screwdriver kit and started removing fasteners visible on the bottom. (Center fastener was hidden under a sticker.) There were multiple different lengths of fasteners. Some were machine screws and some self-tap into plastic. But with one minor exception, I only needed a single screwdriver bit to drive them all. That must have been a conscientious decision by the mechanical engineering team and I appreciate their effort.

First plastic piece to be removed was the clear front piece, whose removal exposed several more fasteners.

Fasteners were also hidden under dark plastics on the sides, though these wouldn't be important until a little later.

After removing every fastener I could find, the headset remains stubbornly sturdy. Flexing it in my hands failed to highlight any promising seams to pry against, so I started prying at every seam between different materials. The first clips to release were next to the side buttons.

Following those clips around the perimeter allowed the top to be released and unveil a circuit board and a battery. The circuit board is labeled with Legend_HMD_MB_PCB_V05 2017.08.10. I interpret this to mean: Legend = project code name, HMD = head-mounted display,. MB = motherboard, PCB = printed circuit board, V05 = fifth revision. Followed by date of August 10th, 2017.

Biggest chip on the circuit board is an STM32F205RE microcontroller, built around an ARM Cortex-M3. The next biggest chip is a LFE5U-45F 6MG285C Lattice Semiconductor FPGA. I assume the camera-based object tracking algorithm is implemented in this FPGA. I couldn't find that specific part number on Lattice web site, perhaps it is an obsolete part? I was redirected to the page for Lattice ECP5 family so I guess it's one of those. Most of the left third of this board is unpopulated, with footprint for at least one nontrivial BGA part. I wonder what they had planned for that area? That is near the trio of side buttons, perhaps they had plans for other headset designs with different side controls? One possibility is a touchpad and if so that BGA footprint might be a capacitive touch processor.

The bottom of the phone tray caddy area turned out to be a sticker I needed to peel off in order to expose more fasteners.

Once released, we could remove the louvered bottom as well as dark smoke colored side pieces.

Optical reflector assembly fasteners are now accessible.

The optical reflector assembly (laying upside-down in this picture) consisted of three pieces of clear plastic with semi-reflective coatings. One flat sheet spans the entire width, and two curved half-width pieces one for each eye. Looking at the geometry, I now understand how this works and I'm not impressed. I don't know how much light the coating reflects and how much is transmitted, but using 50% as an example, this is what we would end up with:

  1. Image from phone screen shines down to the flat sheet. 50% of the light is transmitted straight through and lost out the louvers in the bottom of the headset.

  2. The remaining 50% is reflected to the two curved pieces. Of that original 50%, 25% is transmitted through and forwards, lost to the environment. The remaining 25% of that original light is reflected back towards the flat sheet.

  3. The flat sheet reflects 12.5% of original light right back into the phone, where we can't see it.

  4. That leaves 12.5% of original phone screen light transmitted through the flat sheet into our eyes.

Only a small fraction of light makes it all the way to our eyes, no wonder everything was so dim! This reflector assembly is part of a recurring theme: it is mechanically sound with sturdy mounting, but robust mechanical engineering could not overcome a fundamentally inefficient optical path design.

Now that I understand how it works, I'm not terribly interested in keeping this optical assembly for homebrew AR headset adventures. Also, for accurate projection I need to know the curvature of those two half-width pieces and I don't have that data. Reverse engineering that information takes knowledge of optics that I currently lack. Can I do something with this (or pieces of it) with the skills I have now? I'll set this reflector assembly aside for a little bit longer while I think.

Resuming the teardown, I couldn't find any fasteners holding down plastic pieces surrounding the camera. A little exploratory prying popped them loose: they were held with double-side tape.

Now I could remove the camera assembly. Two cameras are held at a precise distance apart by a metal frame, the only metal structure in the entire headset. Metal rigidity would be useful to maintain distance, but it also serves as heat sink for the pair of cameras.

A trio of Philips-head fasteners hold the camera to the frame. I had hoped for some identifying marks on the back of these cameras, but no luck. The only markers were on the thin ribbon cable. A QR code that scanned out to 8SSC28C19780AXYY7A55567 (no clue) and human readable text as follows:

MDG001-200
SUNNY
B1734
94V-0
2PE
E310562

Searching the web for that information, I learned 94V-0 is an UL standard for flame resistance and probably refers to the FPC (flexible printed circuit) substrate. "Sunny" probably refers to Sunny Optical, a Chinese company for camera modules. Lots of camera modules are listed on their website but I didn't find a match for any of these numbers. The site had a section for VR/AR products, but the only listing is for an eyepiece lens. Sunny E310562 got a few hits on eBay for camera modules corresponding to other Lenovo products, which makes me feel like I'm on the right track, but they look very different. Not sure what's going on there. I think I struck out.

The lens is removable. I don't know enough about small cameras to recognize if it this was a standardized lens mount form factor or something proprietary. I removed the lens hoping to see some identifying markers inside. I saw the imaging sensor array, but no identifiers. This camera was significantly larger than OV2640 popular with electronics hobbyist kits and much larger than what I've pulled from phones and tablets. I expect this to be a very capable camera and it's a shame I can't repurpose it for robot vision or something.

That was a fun teardown and I learned more than I had expected, including an understanding of this optical reflector's fundamentally flawed design. But I'm not done yet: this is part of Star Wars: Jedi Challenges and a Jedi needs a lightsaber.