[SOLVED] Forced "toggle" to repair bricked TV?

This forum is for information related with D series hardware.
Post Reply

E3V3A
Posts: 247
Joined: Wed Oct 31, 2012 2:31 am
Location: /dev/zero

Re: Forced "toggle" to repair bricked TV?

Post by E3V3A »

sbav1 wrote:... while E3V3A is probably referencing different kind of partition setting address (the START1111END, START2222END strings stored in eMMC/OneNand flash memory - in BD-players).
Yes. I was talking about the value defined by:

Code: Select all

tempReadPage = PARTITION_FLAG_ADDR;
which surely must be located in the same code base...probably in a header file...
HW: UE40ES5700SXXH
FW: T-MST10PDEUC-1029.0 Onboot: 1003

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

E3V3A wrote:

Code: Select all

tempReadPage = PARTITION_FLAG_ADDR;
which surely must be located in the same code base...probably in a header file...
Looks like Samsung is using simple hard-coded eMMC/oneNAND block offset value for partition switch string location in their BD-players; that means, after eMMC flash repartitioning (I've not tested such procedure yet - but I'm planning to), onboot will no longer be able to find the partition setting string in the "right" place..

I see Samsung already removed "onboot_Firenze_2011.tgz" file from http://opensource.samsung.com/ - honestly, I don't understand their policy regarding onboot source releases.. I'm starting to think they may be ashamed of their own code :?. Yep, it is a little bit ugly, but come on - it's not that bad - I've seen a lot, lot worse ;).

Anyway - please PM me for "onboot_Firenze_2011.tgz" sources if you want it, I'm fairly sure it was originally released by Samsung under GPL license, so I think we can redistribute it freely (?). I'll be grateful for any comments/corrections regarding this subject from our legal team ;)

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

juuso wrote: ffff35 is toogle
I'vd found my old notes from Valencia/C-series, and partition toggle micom command is the same as above (CMD: 0x35, ACK: 0x35) in C-series, too.

So, for partition #0 set-select, full (9 bytes - last byte is checksum) Weltrend Micom UART command should be:

Code: Select all

0xFF 0xFF 0x35 0x00 0x00 0x00 0x00 0x00 0x35
and for partition #1 set/select:

Code: Select all

0xFF 0xFF 0x35 0x01 0x00 0x00 0x00 0x00 0x36
Proper UART settings for SoC<->Weltrend Micom communications are (at least in B & C-series models): 9600, 8, N, 1 (9600; data bits: 8; parity: none; stop bits: 1; flow control: none).
Now, you simply ;) have to confirm Weltrend Micom UART2 RX pin location, and figure out how to safely connect to it - with (for example ) 3.3V CA-42 cable TX wire. Personally, I'd include an additional in-series 470 ohm (???) resistor, as an quick-and-dirty safety measure, and hopefully (fingers crossed), it will be reasonably enough to be on the safe (???) side.
Now the question is: can we send the code ffff35 to micom via IR (wav way or other),
I rather doubt we can switch partitions using IR remote codes in C/D/E-Series TVs - but who knows, it is theoretically possible..

User avatar
juusso
SamyGO Moderator
Posts: 10124
Joined: Sun Mar 07, 2010 6:20 pm

Re: Forced "toggle" to repair bricked TV?

Post by juusso »

sbav1,

do you still think i have to start from those pins at first? :)

EDIT: just checked, the blue circled tracks have holes to another side of mainboard, soldering on other side is much acceptable than on surface chip. But i`m not sure are these pads ok or not.
You do not have the required permissions to view the files attached to this post.
LE40B653T5W,UE40D6750,UE65Q8C
Have questions? Read SamyGO Wiki, Search on forum first!
FFB (v0.8), FFB for CI+ . Get root on: C series, D series, E series, F series, H series. rooting K series, exeDSP/exeTV patches[C/D/E/F/H]

DO NOT EVER INSTALL FIRMWARE UPGRADE

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

juuso wrote:sbav1,
do you still think i have to start from those pins at first? :)
This is my best guess - it's just a guess, because we don't have a pinout for QPF48 Weltrend chip version, only for older QPF44 variant.

Scope (even the toy scope) or 3.3V logic analyzer will be really handy in this moment :(. But OK - being scopeless, we will need to improvise a little..

First, let's try to measure Micom pin 16 (or blue-circled pad on the "north") with a voltometer. Don't forget in-serial ~500ohm resistor as Q & D safety measure, you will need it later anyway. Turn on the TV, press-and-hold some remote key which is self-repeating (e.g., volume up key). If the micom pin 16 is indeed UART TX, you should see some voltage fluctuations on the meter when you are holding the remote key. And, the measured voltage should be relatively steady while you are NOT pressing/holding any remote keys. In case you don't have thin enough probe for your voltometer, use a sawing needle or something like that.

With ^^ that confirmed, I think we could reasonably assume that UART RX will be on Micom pin 17, and then we can go to the next level ;). Hopefully, no soldering will be required for unbricking procedure, only the thin probe..

oga83
Posts: 268
Joined: Sun Mar 18, 2012 10:11 pm
Location: France

Re: Forced "toggle" to repair bricked TV?

Post by oga83 »

sbav1 wrote:you should see some voltage fluctuations on the meter when you are holding the remote key
On the Renesas, I've seen that the demodulated IR signal is connected to an I/O (called F.RMC by Samsung).
It is likely to be the same on the Weltrend and the behaviour of this pin on a voltmeter will be almost the same than TX.
juuso : to distinguish between TX and F.RMC, make a continuity check between the suspected pin (but on the other side of the resistor) and the IR led (I assume that there is nothing in the middle as they are probably using a very common 3-pin IR receiver with internal filtering). If there's continuity, it is F.RMC, otherwise there is a chance that it is TX :)

E3V3A
Posts: 247
Joined: Wed Oct 31, 2012 2:31 am
Location: /dev/zero

Re: Forced "toggle" to repair bricked TV?

Post by E3V3A »

I'd suggest (without warranty) that you should try to find Tx/Rx on the 2nd and 3rd pin from the top, on the right hand side of the picture above. Those PCB traces (directly under the text "IC1203") goes up and out of the picture... (To where?) Which would make more sense, if they were truly UART Tx/Rx.

Maybe this can help?
WT61P8-RN440WT.jpg
Not exactly the same chip, but nevertheless could be helpful in understanding the chip.
I found that in the 42LG6000 Service Manual. LG are always helpful, unlike Samsung...
You do not have the required permissions to view the files attached to this post.
Last edited by E3V3A on Fri Dec 14, 2012 4:11 am, edited 5 times in total.
HW: UE40ES5700SXXH
FW: T-MST10PDEUC-1029.0 Onboot: 1003

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

E3V3A wrote:I'd suggest (without warranty) that you should try to find Tx/Rx on the 2nd and 3rd pin from the top, on the right hand side of the picture above. Those PCB traces (directly under the text "IC1203") goes up and out of the picture... (To where?)
Pins 22,23? I think this is I2C bus for VGA DDC2/EDID.. On C650 mainboard, those traces go to the VGA connector (12, 15), and to the 24C02 VGA EDID EEPROM SDA/SCL pins (on C7000 mainboard, VGA EDID EEPROM is not soldered - instead they use SIL9389 internal NVRAM for providing VGA EDID).

sbav1
Official SamyGO Developer
Posts: 374
Joined: Fri Jan 15, 2010 10:20 am

Re: Forced "toggle" to repair bricked TV?

Post by sbav1 »

Here are some Q & D findings for LExxC650 mainboard (Weltrend Micom: WT61P802 - not the WT61P805 used in D-series, but at least it is 48-pin version):

Code: Select all

1,2: VCC/VDD 3.3V
3: GND
4,5: OSC0,1 (to 12Mhz crystal)
25: to K&F (key and function connector) SDA
26: K&F SCL
10: K&F IR (infrared remote signal, demodulated)
11: HDMI CEC (looks like, I'm not 100% sure)
20: K&F KEY2
21: K&F KEY1
16, 17: UART1 TX/RX (???) - to Valencia SoC !!!
40: to HC4052 pin 9 (UART multiplexer control S0)
41: to HC4052 pin 10 (UART multiplexer control S1)
31: UART2 RX - to HC4052 pin 14
32: UART2 TX - to HC4052 pin 5
27: to micom EEPROM pin 5
28: to micom EEPROM pin 6
14: to micom EEPROM pin 7 (WE/WP)
29: VGA EDID EEPROM WE/WP
46 (??? unable to decipher my own notes): NRST - to power-up reset circuit, "master reset switch" is somehow connected to this circuit, too
33: to Valencia SoC; test pad TP1506 !!!
22,23: to VGA connector (12, 15) & VGA EDID EEPROM SDA/SCL

E3V3A
Posts: 247
Joined: Wed Oct 31, 2012 2:31 am
Location: /dev/zero

Re: Forced "toggle" to repair bricked TV?

Post by E3V3A »

Do you have a link to the Service Manual or schematics for that?

The only thing I've found so far is this "phantom IC" (As described by LG parts list for the Micom IC):

Code: Select all

IC3000,SAB34922201,S/W Package,S/W Package,GP4 MTK Micom SAB SW Phantom Assy. -
LG-47LM6700_Micom_ic3000.jpg
Found in an LG 47LM6700.
I have no idea if this is actually WT61P805 or what, since I could not find an internal picture of that PCB, but notice that the reset switch and many other features are very similar to those found around the Micom's on Samsung TV's...
You do not have the required permissions to view the files attached to this post.
Last edited by E3V3A on Fri Dec 14, 2012 4:14 am, edited 1 time in total.
HW: UE40ES5700SXXH
FW: T-MST10PDEUC-1029.0 Onboot: 1003

Post Reply

Return to “[D] Hardware”