[SOLVED] Forced "toggle" to repair bricked TV?

[E3V3A]

... while E3V3A is probably referencing different kind of partition setting address (the START1111END, START2222END strings stored in eMMC/OneNand flash memory - in BD-players).

Yes. I was talking about the value defined by:

Code: Select all

tempReadPage = PARTITION_FLAG_ADDR;

which surely must be located in the same code base...probably in a header file...

[sbav1]

Code: Select all

tempReadPage = PARTITION_FLAG_ADDR;

which surely must be located in the same code base...probably in a header file...

Looks like Samsung is using simple hard-coded eMMC/oneNAND block offset value for partition switch string location in their BD-players; that means, after eMMC flash repartitioning (I've not tested such procedure yet - but I'm planning to), onboot will no longer be able to find the partition setting string in the "right" place..

I see Samsung already removed "onboot_Firenze_2011.tgz" file from http://opensource.samsung.com/ - honestly, I don't understand their policy regarding onboot source releases.. I'm starting to think they may be ashamed of their own code . Yep, it is a little bit ugly, but come on - it's not that bad - I've seen a lot, lot worse .

Anyway - please PM me for "onboot_Firenze_2011.tgz" sources if you want it, I'm fairly sure it was originally released by Samsung under GPL license, so I think we can redistribute it freely (?). I'll be grateful for any comments/corrections regarding this subject from our legal team

[sbav1]

ffff35 is toogle

I'vd found my old notes from Valencia/C-series, and partition toggle micom command is the same as above (CMD: 0x35, ACK: 0x35) in C-series, too.

So, for partition #0 set-select, full (9 bytes - last byte is checksum) Weltrend Micom UART command should be:

Code: Select all

0xFF 0xFF 0x35 0x00 0x00 0x00 0x00 0x00 0x35

and for partition #1 set/select:

Code: Select all

0xFF 0xFF 0x35 0x01 0x00 0x00 0x00 0x00 0x36

Proper UART settings for SoC<->Weltrend Micom communications are (at least in B & C-series models): 9600, 8, N, 1 (9600; data bits: 8; parity: none; stop bits: 1; flow control: none).
Now, you simply have to confirm Weltrend Micom UART2 RX pin location, and figure out how to safely connect to it - with (for example ) 3.3V CA-42 cable TX wire. Personally, I'd include an additional in-series 470 ohm (???) resistor, as an quick-and-dirty safety measure, and hopefully (fingers crossed), it will be reasonably enough to be on the safe (???) side.

Now the question is: can we send the code ffff35 to micom via IR (wav way or other),

I rather doubt we can switch partitions using IR remote codes in C/D/E-Series TVs - but who knows, it is theoretically possible..

[juusso]

sbav1,

do you still think i have to start from those pins at first?

EDIT: just checked, the blue circled tracks have holes to another side of mainboard, soldering on other side is much acceptable than on surface chip. But i`m not sure are these pads ok or not.

[sbav1]

sbav1,
do you still think i have to start from those pins at first?

This is my best guess - it's just a guess, because we don't have a pinout for QPF48 Weltrend chip version, only for older QPF44 variant.

Scope (even the toy scope) or 3.3V logic analyzer will be really handy in this moment . But OK - being scopeless, we will need to improvise a little..

First, let's try to measure Micom pin 16 (or blue-circled pad on the "north") with a voltometer. Don't forget in-serial ~500ohm resistor as Q & D safety measure, you will need it later anyway. Turn on the TV, press-and-hold some remote key which is self-repeating (e.g., volume up key). If the micom pin 16 is indeed UART TX, you should see some voltage fluctuations on the meter when you are holding the remote key. And, the measured voltage should be relatively steady while you are NOT pressing/holding any remote keys. In case you don't have thin enough probe for your voltometer, use a sawing needle or something like that.

With ^^ that confirmed, I think we could reasonably assume that UART RX will be on Micom pin 17, and then we can go to the next level . Hopefully, no soldering will be required for unbricking procedure, only the thin probe..

[oga83]

you should see some voltage fluctuations on the meter when you are holding the remote key

On the Renesas, I've seen that the demodulated IR signal is connected to an I/O (called F.RMC by Samsung).
It is likely to be the same on the Weltrend and the behaviour of this pin on a voltmeter will be almost the same than TX.
juuso : to distinguish between TX and F.RMC, make a continuity check between the suspected pin (but on the other side of the resistor) and the IR led (I assume that there is nothing in the middle as they are probably using a very common 3-pin IR receiver with internal filtering). If there's continuity, it is F.RMC, otherwise there is a chance that it is TX

[E3V3A]

I'd suggest (without warranty) that you should try to find Tx/Rx on the 2nd and 3rd pin from the top, on the right hand side of the picture above. Those PCB traces (directly under the text "IC1203") goes up and out of the picture... (To where?) Which would make more sense, if they were truly UART Tx/Rx.

Maybe this can help?

WT61P8-RN440WT.jpg

Not exactly the same chip, but nevertheless could be helpful in understanding the chip.
I found that in the 42LG6000 Service Manual. LG are always helpful, unlike Samsung...

[sbav1]

I'd suggest (without warranty) that you should try to find Tx/Rx on the 2nd and 3rd pin from the top, on the right hand side of the picture above. Those PCB traces (directly under the text "IC1203") goes up and out of the picture... (To where?)

Pins 22,23? I think this is I2C bus for VGA DDC2/EDID.. On C650 mainboard, those traces go to the VGA connector (12, 15), and to the 24C02 VGA EDID EEPROM SDA/SCL pins (on C7000 mainboard, VGA EDID EEPROM is not soldered - instead they use SIL9389 internal NVRAM for providing VGA EDID).

[sbav1]

Here are some Q & D findings for LExxC650 mainboard (Weltrend Micom: WT61P802 - not the WT61P805 used in D-series, but at least it is 48-pin version):

Code: Select all

1,2: VCC/VDD 3.3V
3: GND
4,5: OSC0,1 (to 12Mhz crystal)
25: to K&F (key and function connector) SDA
26: K&F SCL
10: K&F IR (infrared remote signal, demodulated)
11: HDMI CEC (looks like, I'm not 100% sure)
20: K&F KEY2
21: K&F KEY1
16, 17: UART1 TX/RX (???) - to Valencia SoC !!!
40: to HC4052 pin 9 (UART multiplexer control S0)
41: to HC4052 pin 10 (UART multiplexer control S1)
31: UART2 RX - to HC4052 pin 14
32: UART2 TX - to HC4052 pin 5
27: to micom EEPROM pin 5
28: to micom EEPROM pin 6
14: to micom EEPROM pin 7 (WE/WP)
29: VGA EDID EEPROM WE/WP
46 (??? unable to decipher my own notes): NRST - to power-up reset circuit, "master reset switch" is somehow connected to this circuit, too
33: to Valencia SoC; test pad TP1506 !!!
22,23: to VGA connector (12, 15) & VGA EDID EEPROM SDA/SCL

[E3V3A]

Do you have a link to the Service Manual or schematics for that?

The only thing I've found so far is this "phantom IC" (As described by LG parts list for the Micom IC):

Code: Select all

IC3000,SAB34922201,S/W Package,S/W Package,GP4 MTK Micom SAB SW Phantom Assy. -

LG-47LM6700_Micom_ic3000.jpg

Found in an LG 47LM6700.
I have no idea if this is actually WT61P805 or what, since I could not find an internal picture of that PCB, but notice that the reset switch and many other features are very similar to those found around the Micom's on Samsung TV's...