[SOLVED] Forced "toggle" to repair bricked TV?

[oga83]

We also have some informations in the micom firmware to reduce the number of pins to look at :
A few instructions after reset, the Port Mode registers are initialized (0 to configure a pin as an ouput, 1 for an input) :

Code: Select all

PM0=0xf7;
PM1=0x93;
PM2=0x40;
PM3=0xf7;
PM4=0xfc;
PM6=0xfc;
PM7=0x84;	
PM12=0xee;
PM13=0xff;
// PM14 not initialized here

Once we remove the inputs, the non-existent pins (P03, P44, P45, P64, P65) and the known ones (P12-SO, P13-TXD, P60-SCL0, P61-SDA0, P124-XT2), we only have 18 or 19 pins left :
P15-TOH0, P16-TOH1, P20 to P25, P27, P33, P40, P41, P70 to P73, P75, P120, and maybe P140

I will try to put the scope on them tomorrow; Being given that the partition signal should be steady during normal operation, if some pins are toggling, we can also remove them from the list...

[juusso]

hey, some news , micom commands:

Command List

toggle : 0x35
shutdown : 0x12
reboot : 0x1d
rollback : 0x34

ffff101a is menue
ffff35 is toogle
if i send ffff1d to tv, reboot

Now the question is: can we send the code ffff35 to micom via IR (wav way or other), or direct access to micom pins for tx/rx. Oga, how about IR, just need to make proper IR signal ? For testing purpose, pls reboot only

[oga83]

how about IR, just need to make proper IR signal ?

When I was looking for the KEY_FACTORY IR code, I have scanned all the possible codes with Ethernet multi-function Interface : with a script running for 3 days, I was sending codes while automatically checking the feedback on the debug console. This is how I got the BD Key Codes.
If a code was rebooting the unit, or switching partitions, I think I would have catched it.
However, I am pretty confident that this code exists, but I'm afraid it's a key combination
I will have a look at the micom firmware...

[juusso]

If not IR, then perhaps worth to try connect exlink right to
viewtopic.php?f=23&t=5042&start=10#p37089

[oga83]

If not IR, then perhaps worth to try connect exlink right to
viewtopic.php?f=23&t=5042&start=10#p37089

I had a look at micom with my scope this afternoon

I'm afraid exlink will not work...

if I'm not wrong, there is no uart between Soc And Micom, rather I2C or SPI, I don't know yet.
There is no frame on RX/TX while pressing a key on the remote. I guess these lines are only used for micom firmware programming (as described in datasheet).
We already know that the front panel infos are sent by the Soc to the front panel (through micom) with I2C. I guess that when a key is pressed, it's code is also read by I2C (why would they implement 2 dialog lines ?).

I have measured the level of all pins and taken a snapshot of live signals.
In brief :
P25 : I2C Clock
P24 : I2C Data (talking all the time)
P22 : permanent square signal at 1.35kHz
P21 : constant bursts of data ? (talking all the time)
P20 : Data (talking all the time)
P120 : demodulated IR signal (when a key is pressed)
P121 : look like spikes (all the time)

We still have 12 candidates for the partition toggle pin

Here are the levels (arrow in blue for outputs, level 0 or 1 in blue, green sine means 'live signal') :

micom.jpg

And here are the snapshots :

scope.jpg

[sbav1]

We also have some informations in the micom firmware to reduce the number of pins to look at :
A few instructions after reset, the Port Mode registers are initialized (0 to configure a pin as an ouput, 1 for an input) :

Code: Select all

PM0=0xf7;
PM1=0x93;
PM2=0x40;
PM3=0xf7;
PM4=0xfc;
PM6=0xfc;
PM7=0x84;	
PM12=0xee;
PM13=0xff;
// PM14 not initialized here

Once we remove the inputs, the non-existent pins (P03, P44, P45, P64, P65) and the known ones (P12-SO, P13-TXD, P60-SCL0, P61-SDA0, P124-XT2), we only have 18 or 19 pins left :
P15-TOH0, P16-TOH1, P20 to P25, P27, P33, P40, P41, P70 to P73, P75, P120, and maybe P140

Wait - do we have a firmware dump for Weltrend Micom (from Genoa-based D-series TVs)
Or is this code from Renesas/NEC Micom firmware (BD-D8XXX, BD-E*XXX models) ??

[oga83]

All I wrote is for Renesas, BD-D8900 and BD-E8300
No spec for Welltrend, no pinout and even if we had the firmware we couldn't do much
I hope that understanding how it works on Renesas will probably help on Welltrend

[sbav1]

@juuso, @oga83: Guys, I think there is a misunderstanding here going on (???). I'm under the impression juuso is talking about Weltrend Micom (used in B/C/D/E-Series Chelsea/Valencia/Genoa/Echo-P TVs), while Olivier is talking about Renesas/NEC Micom (used in top-tier D/E-Series Firenze/Echo-B BD-players). And those two micoms are quite different animals!!!

[juusso]

Yes, i`m talking about Weltrend and C/D/E series TV`s, because bricked one is Genoa.S (D6750).

But to be honest, i agree to oga:

I hope that understanding how it works on Renesas will probably help on Welltrend

[oga83]

Guys, I think there is a misunderstanding here going on (???)

Sorry for this. my fault. I'll be more clear in the future.

And those two micoms are quite different animals!!!

For sure there must be significant design differences between Welltrend and Renesas micom architectures, but I guess that the general way of working is similar (I2C for front pannel, power management, ... and maybe partition toggle IO).
But for sure, one must not take the pinout of Renesas for the one of Weltrend.

And we could also have a bricked BD to save in the future...