Sky and Sky+ remotes - Easy (or not) to JP1?

[Capn Trips]

Might these help anybody help me?

[The Robman]

The EEPROM pad looks valid. If you look closely at the top of an EEPROM, there will usually be a spot in one of the corners, this marks pin 1. The rest of the pins are numbered counter-clockwise. If the dot was in the lower righthand corner, the pins would be numbered like this...


5 4
6 3
7 2
8 1

The 6-pin numbering (when viewed from the top) is like this...

2 4 6
1 3 5

I learned how to do this sort of thing by reading the various documents that Tommy Tyler put together that detail how to add 6-pin connectors to remotes that weren't designed to have them, such as the URC-7200, REM400 and 15-1918. These can all be found in the old Hardware folder over at Yahoo. The best of the three to look at is the URC-7200 doc.

One essential tool that you will need to undertake this sort of assignment is a multi-meter. You would use this to determine if there is connectivity between certain points on the PCB and the test the connectivity of any wires that you might add to the remote.

For all the remotes that don't have holes for the 6-pin, you will need to mount it on a piece of perf board, which you will glue to the PCB.

Here's how you would connect the wires.

Pin 1 (MCU Vdd) should be connected to the positive pin of the big capacitor (see below)
Pin 2 (EEPROM Vdd) should be connected to EEPROM pin 8
Pin 3 (ground) should be connected to EEPROM pins 1 thru 4
Pin 4 (SDA - system data) should be connected to EEPROM pin 5
Pin 5 (reset) should be connected to pin 24 of the MCU (see below)
Pin 6 (SCL - system clock) should be connected to EEPROM pin 6

For pin 1, if you look on the barren side of the remote you'll see one fairly large capacitor (it's the blue one in the top right corner of this pic), you should attach pin 1 to the positive leg of this capacitor.

For pin 5, this pic clearly shows that you have a 28-pin MCU chip, and the RDF for the other Sky remote shows that it uses a 6805 processor, therefore looking at the datasheets for the 6805 chips, I see that this one is a match. It shows the chip on page 21 where it states that the RESET line is pin 24, so you should connect JP1 pin 5 to MCU pin 24.

As a general note, while you can connect the wires to the exact locations that I've listed, you don't need to. I have given you the locations that are the ultimate destination of where the pins should be conencted, but there might be easier locations on the PCB that you can actually solder the wires to, but you would fist need to use your multi-meter to verify that these spots have connectivity with the destination spot (and zero resistance).

Does that help?

[Capn Trips]

Thanks Robman. There's plenty of information here and it's up to me now to roll up my sleeves and do this (or not).

Thank you for all of the help and pointers. If and when I get to/through this, the forum will be informed (and called upon to help me make an RDF)

[Mike-C]

I've taken another look at my Sky+ remote with the SC50189P device fitted. Unless I'm doing something daft, I don't think that it's pin compatible with the SC501018P device in my standard remote as, comparing the two, I found it has some pins tied high rather than low and vice versa. I cut pins 19 and 20 that were grounded and then pulled them high via two 103 resistors (like in the standard remote circuit). As the Sky+ remote then refused to work I didn't bother going any further and adding an EEPROM. Luckily undoing the mod didn't appear to have damaged the remote. I guess I'll need to spend more time looking at the remote control and find out what I'm doing wrong.

From the photos that Capn Trips posted of his New regular Sky remote (RC 1600/00U) with the SC516513PE device, I wonder if this too has a different pin out? If I'm looking at the photos correctly, it seems that the 4MHz crystal is connected to pins 21 and 22 where as the MC68HC05RCxx PDF datasheet in the link posted by Rob shows it connected to pins 27 and 28.

However, unlike my Sky+ remote, at least Capn Trips' remote control has footprints and tracks for the EEPROM/JP1 connector so we may well be able to glean enough information from this to add a JP1 connector to the Sky+ remote that has the same device fitted but doesn't have holes for the 6 pin connector.

I've also taken another look my Sky Open QWERTY keyboard and now got the JP1 hardware mod working. It needed a 24AA16 EEPROM, two 103 resistors and one 102 resistor fitted. If anyone is interested, I can post some photos. The main device fitted is a 44 pin TQFP marked "UEIC99-CC" which appears to have a different pin out to the PLCC device detailed in the 6805 datasheet.

The keyboard can initialise itself when I do the "981" reset and the IR.EXE program can read raw data from it. I'm struggling a bit with making an .RDF file. I'm starting with an .RDF for the standard Sky remote and trying to modify it. My first problem is that the two checksum bytes appear to be reversed eg finds AB/CD but wants CD/AB.

[mr_d_p_gumby]

I'm struggling a bit with making an .RDF file. I'm starting with an .RDF for the standard Sky remote and trying to modify it. My first problem is that the two checksum bytes appear to be reversed eg finds AB/CD but wants CD/AB.

The two checksum bytes are compliments of each other. You often get this effect when the end point of the checksum range is not correct (and the end of the EEPROM is full of FF bytes). Try moving it up or down one byte for now.

[mr_d_p_gumby]

From the photos that Capn Trips posted of his New regular Sky remote (RC 1600/00U) with the SC516513PE device, I wonder if this too has a different pin out? If I'm looking at the photos correctly, it seems that the 4MHz crystal is connected to pins 21 and 22 where as the MC68HC05RCxx PDF datasheet in the link posted by Rob shows it connected to pins 27 and 28.

Interesting. You can clearly see the Freescale logo on the chip in the picture that Capn posted. All of the 28-pin RCxx chips we've seen so far have the oscillator on pins 27 & 28, so this is puzzling. Note also that the Vdd & Vss appears to be on pins 7 & 8.

The only chip I know of that UEI uses that has that pinout would be the newer MC9S08RCxx series, which would mean that this is the first remote we've encountered that uses the newer flash-based processor (as in JP1.2) in an external-EEPROM configuration. Take alook at this data sheet and see if it makes sense to you: http://www.hifi-remote.com/files/chip-m ... 08RG60.pdf

(Edited to correct link to data sheet)

[Capn Trips]

Well, as I monitor this discussion, I understand that I am COMPLETELY out of my depth.

I have concluded that for me to embark upon cutting and soldering and so on, on such an unknown quantity as these Sky/Sky+ remotes are, is really not worth my time and effort, particularly when I am likely to damage the remotes in question, and (as far as I know) the only "practical" benefit might be to allow me to program the Sky/Sky+ remote(s) with a setup code for a device not in its library.

The remote itself, however, will still be only capable of controlling the Sky box plus only ONE additional component - and for that device only four buttons - Power, Vol+, Vol-, and mute - although I'd be able to program any function I wanted to them.

So, as previously stated, I am happy to mail any or all of these three remotes to whichever of you is capable/willing/interested in using them for research - as I AM a big supporter of the quest for knowledge - with the only caveat being you try to return them withiin, say, 6 months or so. If they come back JP1-capable, that's cool. If they don't, that's fine too. If they're really trashed - I won't moan TOO much about it, although of course, that's not my FIRST option

[Mike-C]

The two checksum bytes are compliments of each other. You often get this effect when the end point of the checksum range is not correct (and the end of the EEPROM is full of FF bytes). Try moving it up or down one byte for now.

Thanks for the advice. I'll have a play and see how it goes.

The only chip I know of that UEI uses that has that pinout would be the newer MC9S08RCxx series, which would mean that this is the first remote we've encountered that uses the newer flash-based processor (as in JP1.2) in an external-EEPROM configuration. Take alook at this data sheet and see if it makes sense to you: http://www.hifi-remote.com/files/chip-m ... 08GB60.pdf

I've taken a look at the datasheet - interesting reading - although the DIL/SDIP version is listed as having 42 pins rather than the 28 pins shown in the photo so, hopefully, we are still dealing with a JP1 device, rather than JP1.2

[mr_d_p_gumby]

Sorry, linked to the wrong data sheet. Try this one: http://www.freescale.com/files/microcon ... 08RG60.pdf

[Mike-C]

Well, as I monitor this discussion, I understand that I am COMPLETELY out of my depth.

So, as previously stated, I am happy to mail any or all of these three remotes to whichever of you is capable/willing/interested in using them for research - as I AM a big supporter of the quest for knowledge - with the only caveat being you try to return them withiin, say, 6 months or so. If they come back JP1-capable, that's cool. If they don't, that's fine too. If they're really trashed - I won't moan TOO much about it, although of course, that's not my FIRST option

If you like, I'm happy to have a bash at the standard Sky remote as I think that

1) it has the best chance of being successfully modified
2) it has a space in the case for the JP1 connector to be fitted neatly

If I can get the EEPROM working with it, it's then a case of whether one of the existing .RDF files works with it or if it needs one modified/written. If nothing else, at least the hardware can be tested standalone with the "981" reset key sequence and checking how many times the LED flashes.

At least this remote has a footprint for an EEPROM and partial tracks to it, so it may give us some clues as to how to modify the Sky+ remote which has the same device fitted but no EEPROM footprint.

If you are interested, let me know and I can PM you my details.

[Capn Trips]

At least this remote has a footprint for an EEPROM and partial tracks to it, so it may give us some clues as to how to modify the Sky+ remote which has the same device fitted but no EEPROM footprint.

If you are interested, let me know and I can PM you my details.

Yeah, why not. PM me your details and I'll ship you the Sky (and one of the Sky+) remote(s).

As far as I can tell, they ALL have footprints for the EEPROM, although in widely differing locations, and ONE of the Sky+ remotes appears (to my untrained eye) to have a "footprint" of sorts for a 6-pipn header, although it's in a weird place. Happy to support the research effort.

(Although one caveat, I'm leaving the country for about a week tomorrow, so it wouldn't get mailed until after Christmas)

[The Robman]

(Although one caveat, I'm leaving the country for about a week tomorrow, so it wouldn't get mailed until after Christmas)

Why not try and mail them on your way out of town, then who knows, Mike might even have finished with them by the time you get back.

[Capn Trips]

(Although one caveat, I'm leaving the country for about a week tomorrow, so it wouldn't get mailed until after Christmas)

Why not try and mail them on your way out of town, then who knows, Mike might even have finished with them by the time you get back.

Happy to try tomorrow, but need an address.

[Mike-C]

For anyone interested, here is a progress report on how I'm getting on adding JP1 to the Sky remotes that Capn Trips sent me.

All three remotes have the same controller fitted and Mike England's suggested datasheet appears to tie up with the pin outs on the remotes - thanks Mike

The one that I though would be the easiest was the normal Sky remote. Adding in the EEPROM memory and attempting a 981 reset on the remote did not work. Often the remote would lock up needing the batteries to be removed.

One of the Sky+ remotes could program the EEPROM added whilst the second Sky+ one locked up when the EEPROM was accessed.

As the controllers in all three remote were identical, I tried swapping over the one in the Sky+ remote with the normal remote. Nothing changed, the Sky+ remote was still happy with the EEPROM, whilst the normal remote wasn't. The cause of the problem had to be some difference in the circuits that stopped the EEPROM from working.

Tracing out schematics for all three remotes was a slow job but worthwhile as we now know the pinout functions for this remote. Pin 3 appears to be tied high to put the remote in Sky+ mode, or tied low to put the remote in normal mode (jumpers 3 and 4 in the photos previously posted by Capn Trips). Pin 10 is tied low but there is an option to tie it high (jumpers 1 and 2 in the photos). I couldn't see any difference to the remote when I tied it high.

All three schematics (which I can post here if anyone is interested) looked similar and like the EEPROM should work - except they weren't!

After more searching, I found the problems and the following need to be added to the remotes :

a wire link between pin 8 of the EEPROM and pin 7 of the main controller to provide constant power to the EEPROM

a 10k pull up resistor added to the clock line of the EEPROM (add between pins 6 and 7 of the controller)

a wire link between pin 5 of the JP1 connector and pin 20 of the main controller to provide the Reset line.

Having done this, performing a 981 reset results in the LED flashing four times and a successfully configured EEPROM.

The normal Sky remote is easy to add the JP1 connector to as it already has a space for it in the case. The Sky+ ones don't and will need some modification to make space.

The newer Sky remotes have an ident of "BS03BS30" which is different to the "BSKY" and "SKYAO" idents already known.

I can use the IR program to read data from the remotes but the RDF file still needs some work - writing back to the remote trashes the data.

Mike

[mr_d_p_gumby]

Tracing out schematics for all three remotes was a slow job but worthwhile as we now know the pinout functions for this remote. Pin 3 appears to be tied high to put the remote in Sky+ mode, or tied low to put the remote in normal mode (jumpers 3 and 4 in the photos previously posted by Capn Trips). Pin 10 is tied low but there is an option to tie it high (jumpers 1 and 2 in the photos). I couldn't see any difference to the remote when I tied it high.

Do I understand correctly that when pin 3 is tied low, the remote does not communicate with the EEPROM? I'm wondering if this is some sort of mode-switch between JP1 and JP1.2.

All three schematics (which I can post here if anyone is interested) looked similar and like the EEPROM should work - except they weren't!

Yes, please post them. A good place would be here.

Having done this, performing a 981 reset results in the LED flashing four times and a successfully configured EEPROM.

Congratulations!

I can use the IR program to read data from the remotes but the RDF file still needs some work - writing back to the remote trashes the data.

That's to be expected. The existing RDFs are set for use with the 6805RC CPUs and I expect this remote will be quite different. For example, back when UEI was using those CPUs, they stored the assigned setup code for each device button differently than they do now in the newer S3C8-based remotes. Keymaps, button numbers, etc., will all be different.

You might need to work without an RDF (putting IR in "raw" mode) until you can establish some basic info. Try assigning different setup codes to the TV device, saving a raw download each time. Then post the files in the diagnostic section, along with notes indicating which setup code was assigned in each file. Rob, myself, or some other expert can probably create a starter RDF of some sort from that info. It would be helpful if you could do the same with each device button, but I don't know if this remote will let you change the Sky box setup code.