Page 1 of 12

[SOLVED] Forced "toggle" to repair bricked TV?

Posted: Wed Nov 21, 2012 3:32 pm
by juusso
Due increasing count of bricks (few days ago - Denny`s ES series, today - mine D series once again) it is needed to have some "safe" and relative easy way to send "toggle" to the micom to switch boot flags. Last brick - due internal errors while flashing rootfs (squashfs errors of flashed partition, despite the bml.restore & sync procedure went without any error.)

Maybe it is possible to locate micom config eeprom and make short circuit during TV boot or maybe send there some voltage to some specific pin? Another thoughts?

According info here and here, knowing whole experience i got on the forum by reading and helping for users with different kind of bricks, i understand that chance for success are low.

Tried to make short circuit on every ( :oops: ) 8-pin chip on the mainboard, but as result i got some kind of "IC line pin nr blocked" on debug log, but no go further :x
Update 11/01/2013: Problem resolved, read:

Re: Forced "toggle" to repair bricked TV?

Posted: Wed Nov 21, 2012 9:07 pm
by sbav1
juuso wrote:Due increasing count of bricks (few days ago - Denny`s ES series, today - mine D series once again) it is needed to have some "safe" and relative easy way to send "toggle" to the micom to switch boot flags. Last brick - due internal errors while flashing rootfs (squashfs errors of flashed partition, despite the bml.restore & sync procedure went without any error.)

Maybe it is possible to locate micom config eeprom and make short circuit during TV boot or maybe send there some voltage to some specific pin? Another thoughts?
1) Micom EEPROM (should be easy to locate - small one, usually close to the Weltrend chip) reset/shorting may help, or not - you have only 50/50 chance default partition after reset will be the one you want to select (i.e the one still in working order). There is a good chance after micom reset you will lose serial console settings (not a biggest problem - console will be still available on 74HC4052D chip pins), and watchdog setting too.
2) Forcing partition select by SoC GPIO <-> Weltrend GPIO pins/trace shorting: in theory it should work (at least in Valencia/Genoa/Echo-P based TVs), but in reality the proper pin/track will be really hard to find - there are 30+ possible candidates on the Welltrend side, and I don't see any easy method to round them down by using the scope/voltometer etc.
3) Tap into serial/rs232 connection between main SoC and Micom (e.g with Arduino, Raspberry Pi etc. - beware of the rs232 voltage level, should be 3.3V or maybe even 2.5V in recent models) and try to issue raw partition toggle command directly to micom. With the scope those 2 serial connection traces should be relatively easy to locate, even on bricked TV. But after main SoC power-up, it will be a "live" connection, I'm not sure such solution may be possible without frying something on the SoC side.. And before SoC power-up (in standby mode), micom will probably refuse to accept any commands issued on this connection.
4) Samsung still includes "main reset switch" on all (?) their recent mainboards (switch is generally missing - not soldered, but the circuity it is connected to actually exists). I wonder if shorting this switch pads may be actually good for something - e.g., it may trigger the Micom configuration reset or something.. I guess it will have the same risks involved as 1), plus some additional unknown ones ;).
Tried to make short circuit on every ( :oops: ) 8-pin chip on the mainboard
Probably not a best possible idea - usually some of those "8-pin chips" are in fact transistors belonging to various voltage regulator circuits!

Re: Forced "toggle" to repair bricked TV?

Posted: Thu Nov 22, 2012 10:03 am
by juusso
Are we talking about IC1205 ?
For default partition set i have big chance, because bricked rootfs is on /dev/bml0/8, on second set. Naturally i think default must be 0, so if i block communication between micom and ..., then system must boot default partitions, /dev/bml0/5 and /dev/bml0/6, right...?).

about reset switch, perhaps it is sw1201 at the bottom... On ua40d6000 board this switch exists and all what it does iirc - initializes reboot. Does it afftect other settings, i don`t remember, won`t try to don`t lose rs232 setting. :(

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 9:26 am
by oga83
On my BD-E8300, it's a Renesas. I have located the rx/tx pins on it.
Theses pins are also used for programming (micom firmware).
I did not find the Weltrend datasheet so I cannot tell whether it's the same chip or not.

Maybe you could follow the switch signal (the one that goes through a via hole on your photo) to see where it goes.
I by chance (very little) it goes to the same pin than the Reset on the Renesas, that could mean that the Weltrend is pin-to-pin compatible with the Renesas (I know that Renesas gives licences to other foundries, so that's not so weird ;) ).

On my photo, the chip is up-side-down compared to yours; refer to the pin 1 marker.
Micom.jpg

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 9:50 am
by juusso
So if reset pin match, then reset procedure should be ...

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 10:36 am
by oga83
On my unit, the FRST pad is connected to the controller genuine RESET pin : it just resets the micom controller;
Same behaviour than during power-up. It does not perform any factory reset.

The pad TP605, close to FRST, is connected to pin #39, an I/O called 'P40' (on your photo, I cannot see any track connected to pin #39, but it could be under the chip)
Maybe it is used for a factory reset but, until now, I was not able to find where it is used in the micom firwmare code...

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 7:49 pm
by sbav1
juuso wrote:Are we talking about IC1403 ?
IC1403 (HC4052) is a multiplexer for internal UART ports -> external UART port (the one on VGA connector in D-series - ?). While not directly useful for unbricking in your case, it may be still somehow important: if rs232 "Debug" setting gets lost (after micom EEPROM reset, or perhaps after using "mater reset switch"), with some extra trouble, you should still be able to access Genoa SoC serial console - by soldering two RX/TX wires to appropriate HC4052 inputs/outputs, or by "shorting" HC4052 (9,10) pins to GND/VCC. HC4052 9,10 pins are controlled by 2 weltrend micom gipo pins; on B650 TV mainboard, HC4052 9/10 "pin shorting" is (relatively) safe - Samsung included some resistors to protect 2 aforementioned micom gpios. For D6XXX mainboard, HC4052 9,10 pin shorting may be still relatively safe, or NOT safe at all - YMMV!

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 9:17 pm
by sbav1
oga83 wrote: I did not find the Weltrend datasheet so I cannot tell whether it's the same chip or not.
Most likely not the same chip :(. Generally speaking, we don't know all that much about Weltrend WT61P8* controllers family - datasheets are virtually not obtainable. In comparison, Renesas/NEC micom (the one used in top-tier Samsung BD-players) documentation is actually pretty good.

WT61P8 general specs (this is for older 44pin version - WT61P805 used in D-series is revised variant, in QFP48 package): http://www.weltrend.com.tw/product-disp ... sp?t=4&s=1. Application circuits are not easy to find as well (sadly - no circuit diagrams at all in Samsung service manuals for their recent DTV/BD models!!). There are some detailed diagrams in LG TV service manuals, though - for example, they are using 44pin WT61P8 in this model http://www.supertvservis.cz/file/64/lg_ ... 0_-et-.pdf (page 31). While 48-pin version is obviously a little different, I believe general pinout should be somehow similar in both 44/48pin WT61P8* versions - may be (e.g.) somehow useful for locating micom UART1 port & UART2 port pins.

I wish you 'd have some Samsung C/D/E-series TV model, apart from D/E BD-series players - with your excellent electronics skills, I bet we will be so much closer to understanding how it ticks!

Re: Forced "toggle" to repair bricked TV?

Posted: Fri Nov 23, 2012 10:16 pm
by sbav1
oga83 wrote:On my BD-E8300, it's a Renesas. I have located the rx/tx pins on it.
BTW (on completely unrelated subject): I wonder if renesas/nec micom in BD-D8XXX/BD-E8XXX models are operating on 3.3V VCC, or 5V VCC?
Guessing from renesas micom datasheet: while equipped with 20MHz crystal, it may require 5V VCC to operate (!).

Just got myself a brand new Raspberry Pi board (512MB version - nice!) - I;d like to interface it with BD-D6900, but it didn't cross my mind to measure BD-D6900 renesas micom VCC/voltage levels while I have it disassembled :oops: . And Raspberry Pi GPIOs are apparently NOT 5V tolerant :(.

To keep it on the safe side, I think I will need 2+ pin bidirectional 3.3V <-> 5V voltage level conversion circuit of some kind (preferably as cheap and simple as possible) - any thoughts?

Re: Forced "toggle" to repair bricked TV?

Posted: Sat Nov 24, 2012 10:52 am
by oga83
sbav1 wrote:I wish you 'd have some Samsung C/D/E-series TV model
My next TV will be a Samsung one :)
sbav1 wrote: I wonder if renesas/nec micom in BD-D8XXX/BD-E8XXX models are operating on 3.3V VCC, or 5V VCC
I have 3.3v on my BD-E8300; F0514A has a wide power supply voltage range : 2.7 to 5.5 with 20MHz crystal used on BD-E8300)
renesas.jpg
sbav1 wrote:Just got myself a brand new Raspberry Pi board
Great ! I play a lot with it too (icing on the cake : ExLink cable can be used to get a console on GPIO)
sbav1 wrote:To keep it on the safe side, I think I will need 2+ pin bidirectional 3.3V <-> 5V voltage level conversion circuit of some kind (preferably as cheap and simple as possible) - any thoughts?
To interface 5v logic, I keep it simple (some would say "quick and dirty") : As 5v-TTL levels are compatible with 3.3v levels, the only need is a voltage protection.
The easiest way to do it is through a resistor with a 1N4148 rectifier tied to 3.3v (in many cases, the rectifier is already embedded in the chip for ESD protection, but it's worth the cost to add it anyway).
For a 5v output to a 3.3v input, a 100 ohms resistor is ok for an open collector (internal or external pull-up); for a push-pull, you can increase the value to 1k to prevent too much current to be sunk at high level (1.7v through R)
For a 3.3v output to a 5v input, you can simplify this and remove the rectifier.
interface.jpg