JP1 Remotes

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592

Dismantled the URC-2060 and if i did this correct pin 2 goes to the processor
and the common connection for the transport keys.
_________________
Randy

mathdon · Posted: Thu May 23, 2024 12:27 pm Post subject:

The only info I have found about the internals of a JP1.4 remote is this from Tommy Tyler about the OARI06G. He gives the processor as an S3F80KB and lists the JP1.4 pin connections to it as pin 1 to Vdd, pin 2 to RESET, pin 3 to Vss, pin 4 to SDAT, pin 5 to TEST, pin 6 to SCLK. The KB in the processor type is not KiloByte as there is also an S3F80JB, which appears to have a somewhat different pinout. So Randy, is the processor type identifiable in your disassembled URC2060? Can you post any pics of the internals? Can you tell what processor pin the connector pin 2 goes to? As I said in a PM to you, connector pin 2 which we identify as RTS does not appear to be a processor RESET pin as a reset by removing and replacing a battery does give 2 flashes but using RealTerm to change RTS from Set to Clear does not do so. For that matter, I suppose we can't be sure what ANY connector pin goes to on the processor.

I have been doing some tests with RealTerm on a URC3680, which is also JP1.4, viewing the signals with a logic analyzer and don't understand what I find even with that remote. I can see with the analyzer exactly what RMIR sends when starting a raw download and what the responses are, and can send exactly the same with RealTerm, but with RealTerm there is no response at all. I cannot find any interaction between RMIR (or jp12serial) and the remote that I am missing that might explain the difference. Is there anyone with a better understanding of RealTerm who can help? I feel if I could understand this difference then it might help also with the URC2060.
_________________
Graham

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592

Unfortunately I have no idea what processor connector pin 2 goes to

_________________
Randy

WagonMaster · Joined: 16 Apr 2009 Posts: 363

3FG · Expert Joined: 19 May 2009 Posts: 3371

JP1.4 and JP2 remotes don't use the "break" mechanism to initate programming mode. Instead after reset, the processor listens for 4 specific characters, and if they are received the remote enters programming mode. If the specific characters are not received, the remote begins normal operation.

The 4 characters need to be sent within about 100msec, but this time duration varies depending on processor type. There also needs to be a short delay after exiting reset before the characters can be sent.

IIRC, I could get these timings by messing around using scripts in RealTerm, but I quickly decided to write standalone utility programs like JP2Dumper, anong others, so that I could easily find the acceptable timing range.

I think it is possible that this timing for this remote is somewhat different than we currently assume in JP12Serial.dll.

WagonMaster · Joined: 16 Apr 2009 Posts: 363

mathdon · Posted: Sat May 25, 2024 9:52 am Post subject:

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592

My URC2060 appears to do the 9xx command 968 2 blinks then enter 4 digit s
to make the backup segments and 977 to restore
so that part appears to be JP1.4
Although 9xx command 974 does activate/deactivate the back light which is different from JP1.4 remotes
Im not sure you should try it on yours yet and actually set the backup segments
since i have already done it on mine my remote can be a guinea pig for tests
I still have mine apart and still wonder if the pin assignment is different
_________________
Randy

mathdon · Posted: Sat May 25, 2024 1:26 pm Post subject:

Counting the wires going to the processor in Randy's image, I see 23 with gaps that suggest the number of processor pins might be 24, 25 or 26. There appears to be an S3F80P5X which has a 24-pin package. So this is one possibility for the processor.
_________________
Graham

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592

Thank You Graham for the Processor Idea
I downloaded the data sheet and added it here
http://www.hifi-remote.com/forums/dload.php?action=file&file_id=26879
From what i thought that they have the pins different
i plugged my jp1 cable in backwards so that the cables pin 1 is on the opposite side of what the remote says is pin 1
Real term is a little finicky and had to click to place curser in the terminal window but the clear/set sequence gives me a response of 2 blinks on the remote cable button and then the backlight turns on then off right away RMIR also gave me the same results of 2 blinks and backlight on then instantly off but no raw download and download remote RMIR message is "preparing"
I hope this means some progress maybe other pins are wrong too?
_________________
Randy

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592

Somehow I suspect that with the backlight turning back off instantly
is that it is disconnecting the connection
_________________
Randy

mathdon · Posted: Sun May 26, 2024 12:20 pm Post subject:

Hi Randy, this post of mine has overlapped with yours so I haven't tried to relate our findings.

As far as I can tell from Randy's pictures, they seem to be consistent with the processor being the S3F80P5X 24-pin chip. Here is a link to the datasheet. The black blob covering the chip seems a bit small to cover it, but the connections seem to work OK. Looking at the black blob on Randy's image, the chip pin numbering is anticlockwise. The three wires on the right that exit the blob horizontally, upward from the lowest of these pins, seem to be pins 4, 5, 6. The first two above these that exit vertically upward are then 7 and 8. These pins are 4=TEST, 5=SDAT/P0.0/INT0, 6=SCLK/P0.1/INT1, 7=nRESET/P0.2/INT2, 8=P0.3/INT3 from the user manual.

I take it that in Randy's image we are looking at the underside of the 6-pin connector, so pin 1 is at the top left. There appear to be connections to all six pins. It appears to me that pin 1 goes to processor pin 8 (P0.3/INT3), pin 2 to 7 (nRESET/P0.2)), pin 3 to the wire that runs upwards, off the top of the image, pin 4 to 5 (SDAT/P0.0/INT0), 5 to 4 (TEST), 6 to 6 (SCLK/P0.1/INT1). The connections to connector pins 2, 4, 5, 6 agree with the identifications by Tommy Tyler for an OARI06G JP1.4 remote. It was this agreement that I used to make my identification of the pin numbering for this chip. SDAT and SCLK are uses of pins 4 and 6 in Tool mode. For us those are general purpose input/output pins P0.0 and P0.1 used as TXD and RXD. Pin 5 we leave disconnected. Pin 2, our RTS, is nRESET in JP1.4 remotes. So 2, 4, 5, 6 are as expected. This leaves 1 and 3. Pin 3 is the one that is not connected directly to the processor. We have it as GND (Vss), and as the negative battery terminal is at the top end in the remote, it is not surprising that this is off the top of the image.

This leaves pin 1. We normally identify this as Vdd, the 5v or 3.3v power output, and leave it disconnected but here it appears to go to processor pin 8 (P0.3/INT3). So is it possible that UEI have repurposed pin 1 since as far as I know there has been no use for it as output power for a long time. We might not even have noticed such as change as we leave it disconnected. So is this now used for some as yet unknown purpose that is causing the change of behaviour from other JP1.4 remotes?
_________________
Graham

mathdon · Posted: Sun May 26, 2024 12:29 pm Post subject:

Randy, beware of reversing the connector as you did, as that makes RTS connect to pin 5 rather than 2, which we believe to be the processor TEST pin. I am not surprised if this causes a reset as it is changing the mode of operation of the remote, but we know nothing about what TEST mode is, so it could cause damage if you do anything further in this mode.
_________________
Graham

HamburgerHelper1 · Joined: 22 Feb 2014 Posts: 592