[SOLVED] Forced "toggle" to repair bricked TV?

This forum is for information related with D series hardware.

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

We also have some informations in the micom firmware to reduce the number of pins to look at :
A few instructions after reset, the Port Mode registers are initialized (0 to configure a pin as an ouput, 1 for an input) :

Code: Select all

PM0=0xf7;
PM1=0x93;
PM2=0x40;
PM3=0xf7;
PM4=0xfc;
PM6=0xfc;
PM7=0x84;	
PM12=0xee;
PM13=0xff;
// PM14 not initialized here
Once we remove the inputs, the non-existent pins (P03, P44, P45, P64, P65) and the known ones (P12-SO, P13-TXD, P60-SCL0, P61-SDA0, P124-XT2), we only have 18 or 19 pins left :
P15-TOH0, P16-TOH1, P20 to P25, P27, P33, P40, P41, P70 to P73, P75, P120, and maybe P140 :)

I will try to put the scope on them tomorrow; Being given that the partition signal should be steady during normal operation, if some pins are toggling, we can also remove them from the list...

User avatar
juusso
SamyGO Moderator
Posts: 10124
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

hey, some news , micom commands:
Command List

toggle : 0x35
shutdown : 0x12
reboot : 0x1d
rollback : 0x34
ffff101a is menue
ffff35 is toogle
if i send ffff1d to tv, reboot
Now the question is: can we send the code ffff35 to micom via IR (wav way or other), or direct access to micom pins for tx/rx. Oga, how about IR, just need to make proper IR signal ? For testing purpose, pls reboot only :)
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

juuso wrote:how about IR, just need to make proper IR signal ?
When I was looking for the KEY_FACTORY IR code, I have scanned all the possible codes with Ethernet multi-function Interface : with a script running for 3 days, I was sending codes while automatically checking the feedback on the debug console. This is how I got the BD Key Codes.
If a code was rebooting the unit, or switching partitions, I think I would have catched it.
However, I am pretty confident that this code exists, but I'm afraid it's a key combination :(
I will have a look at the micom firmware...

User avatar
juusso
SamyGO Moderator
Posts: 10124
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

If not IR, then perhaps worth to try connect exlink right to
viewtopic.php?f=23&t=5042&start=10#p37089
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

juuso wrote:If not IR, then perhaps worth to try connect exlink right to
viewtopic.php?f=23&t=5042&start=10#p37089
I had a look at micom with my scope this afternoon :)

I'm afraid exlink will not work... :(

:o if I'm not wrong, there is no uart between Soc And Micom, rather I2C or SPI, I don't know yet.
There is no frame on RX/TX while pressing a key on the remote. I guess these lines are only used for micom firmware programming (as described in datasheet).
We already know that the front panel infos are sent by the Soc to the front panel (through micom) with I2C. I guess that when a key is pressed, it's code is also read by I2C (why would they implement 2 dialog lines ?).

I have measured the level of all pins and taken a snapshot of live signals.
In brief :
P25 : I2C Clock
P24 : I2C Data (talking all the time)
P22 : permanent square signal at 1.35kHz
P21 : constant bursts of data ? (talking all the time)
P20 : Data (talking all the time)
P120 : demodulated IR signal (when a key is pressed)
P121 : look like spikes (all the time)

We still have 12 candidates for the partition toggle pin ;)

Here are the levels (arrow in blue for outputs, level 0 or 1 in blue, green sine means 'live signal') :
micom.jpg
And here are the snapshots :
scope.jpg
You do not have the required permissions to view the files attached to this post.

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

oga83 wrote:We also have some informations in the micom firmware to reduce the number of pins to look at :
A few instructions after reset, the Port Mode registers are initialized (0 to configure a pin as an ouput, 1 for an input) :

Code: Select all

PM0=0xf7;
PM1=0x93;
PM2=0x40;
PM3=0xf7;
PM4=0xfc;
PM6=0xfc;
PM7=0x84;	
PM12=0xee;
PM13=0xff;
// PM14 not initialized here
Once we remove the inputs, the non-existent pins (P03, P44, P45, P64, P65) and the known ones (P12-SO, P13-TXD, P60-SCL0, P61-SDA0, P124-XT2), we only have 18 or 19 pins left :
P15-TOH0, P16-TOH1, P20 to P25, P27, P33, P40, P41, P70 to P73, P75, P120, and maybe P140 :)
Wait - do we have a firmware dump for Weltrend Micom (from Genoa-based D-series TVs) :?
Or is this code from Renesas/NEC Micom firmware (BD-D8XXX, BD-E*XXX models) ??

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

All I wrote is for Renesas, BD-D8900 and BD-E8300
No spec for Welltrend, no pinout and even if we had the firmware we couldn't do much :(
I hope that understanding how it works on Renesas will probably help on Welltrend

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

@juuso, @oga83: Guys, I think there is a misunderstanding here going on (???). I'm under the impression juuso is talking about Weltrend Micom (used in B/C/D/E-Series Chelsea/Valencia/Genoa/Echo-P TVs), while Olivier is talking about Renesas/NEC Micom (used in top-tier D/E-Series Firenze/Echo-B BD-players). And those two micoms are quite different animals!!!

User avatar
juusso
SamyGO Moderator
Posts: 10124
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

Yes, i`m talking about Weltrend and C/D/E series TV`s, because bricked one is Genoa.S (D6750).

But to be honest, i agree to oga:
oga83 wrote:I hope that understanding how it works on Renesas will probably help on Welltrend
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

sbav1 wrote:Guys, I think there is a misunderstanding here going on (???)
Sorry for this. my fault. I'll be more clear in the future.
sbav1 wrote:And those two micoms are quite different animals!!!
For sure there must be significant design differences between Welltrend and Renesas micom architectures, but I guess that the general way of working is similar (I2C for front pannel, power management, ... and maybe partition toggle IO).
But for sure, one must not take the pinout of Renesas for the one of Weltrend.

And we could also have a bricked BD to save in the future...

Post Reply

Return to “[D] Hardware”