JP1 Remotes Forum Index JP1 Remotes


FAQFAQ SearchSearch 7 days of topics7 Days MemberlistMemberlist UsergroupsUsergroups RegisterRegister
ProfileProfile Log in to check your private messagesLog in to check your private messages Log inLog in

Remote bricked after connecting to the wrong JP1 interface ?
Goto page 1, 2  Next
 
Post new topic   Reply to topic    JP1 Remotes Forum Index -> JP1 - Hardware
View previous topic :: View next topic  
Author Message
digital_silence



Joined: 22 May 2004
Posts: 237

PostPosted: Thu Jul 27, 2017 2:37 am    Post subject: Remote bricked after connecting to the wrong JP1 interface ? Reply with quote

Hi all,

I am using two types of JP1 remotes in my home workshop: JP1 (collection of URC8811s and 8910s) and JP1.3 (these are all Comcast 1067Bx3 remotes)

To interface to JP1.3s I am using the Serial Interface Cable (Serial-to-JP1.3) cable, and if I need to i/face with JP1s, I am just adding on the top of it the JP1.3-to-JP1 adapter based on the PIC microcontroller (all designs are published on this website).

Everything works fine. Both interfaces use 6 pin 2x3 box headers for connection, but I am usually very careful to connect the right cable to the right interface.

However, yesterday I goofed and connected the JP1 Cable into JP1.3 remote.

The connection diagram was as follows:

(PC)<->(USB-Serial adapter)<-Serial-to-JP1.3cable->(JP1.3-to-JP1adapter)->(JP1.3 Remote: Comcast URC1067Bx3)

So, essentially, there was a JP1.3-to-JP1adapter present, which shouldn't have been there. I definitely connected the plug the right way around (pin1 to pin1), but the interface was wrong.

I ran the RMIR, then tried to "Download from Remote" and received "No Remote Found" message. I then realise my mistake, and removed the redundant (JP1.3-to-JP1) adapter, but I am still getting "No Remote Found" message after that.
All other hardware works fine, because I can communicate without a problem with the other Comcast URC1067Bx3 JP1.3 devices using this setup.

Furthermore, not only I can't communicate with that remote, but the remote doesn't show any signs of life anymore - the device buttons don't blink as they normally would when I press any keys, and the IR LED is not transmitting anything (that mobile phone camera trick).

So, the question is: Did I brick that URC1067 by connecting it to a JP1 iface? Is there any way to bring it back to life?

Just before you ask: no I haven't forgotten to insert the batteries into remote.

Don't be afraid to go into as much technical details as you need.

Thanks.
DS
Back to top
View user's profile Send private message
vickyg2003
Site Admin


Joined: 20 Mar 2004
Posts: 6953
Location: Florida

PostPosted: Thu Jul 27, 2017 7:57 am    Post subject: Reply with quote

Is it still blinking when you insert remove batteries?
_________________
Remember to provide feedback to let us know how the problem was solved and share your upgrades.

Tip: When creating an upgrade, always include ALL functions from the oem remote, even if you never plan on assigning them to a button. Complete function lists makes an upgrade more helpful to others.
Back to top
View user's profile Send private message Visit poster's website
The Robman
Site Owner


Joined: 01 Aug 2003
Posts: 18349
Location: Chicago, IL

PostPosted: Thu Jul 27, 2017 9:23 am    Post subject: Reply with quote

You've probably corrupted a byte or two in the flash memory, which can be fixed but you'll need one of the experts to walk you through it. However, there is one quick thing you can try. Try removing the batteries, then press a few buttons, then re-insert the batteries to see if that resets the remote.
_________________
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
Back to top
View user's profile Send private message Visit poster's website
The Robman
Site Owner


Joined: 01 Aug 2003
Posts: 18349
Location: Chicago, IL

PostPosted: Thu Jul 27, 2017 11:23 am    Post subject: Reply with quote

The best I could find by doing some searching was this old thread where 3FG suggested using JP2Sniffer to see if that program can communicate with the remote. It is able to communicate in cases where RMIR cannot.
_________________
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!
Back to top
View user's profile Send private message Visit poster's website
unclemiltie
Expert


Joined: 21 Jan 2004
Posts: 1743
Location: Pittsburgh, PA

PostPosted: Thu Jul 27, 2017 12:09 pm    Post subject: Reply with quote

The S3F80 remotes in the JP1.3 versions has a "tool mode" that if you get into it the remote can corrupt things. Depending on what got corrupted it can be fixable or catastrophic. There are sparse reports of people bricking the JP1.3 remotes by doing things like this.

I've fixed a few of them while writing the JP1.3 extenders and doing things I should not have done, but I've also bricked a few. But if you can't communicate with it and none of the buttons are working then it's probably beyond repair. If you can communicate with it there are some ways to fix it but they involve a lot of work. Replacement or upgrade may be in your future
_________________
this JP1 stuff is a sickness!
Back to top
View user's profile Send private message
unclemiltie
Expert


Joined: 21 Jan 2004
Posts: 1743
Location: Pittsburgh, PA

PostPosted: Thu Jul 27, 2017 6:49 pm    Post subject: Reply with quote

BTW, I looked in my remote "stash" and I have two unopened of this remote (the JP1.3 remote) including batteries. I think I did take one out to debug the extender when I wrote it but both are certainly completely functional

PM me if you're interested, we can work out some kind of deal.
_________________
this JP1 stuff is a sickness!
Back to top
View user's profile Send private message
digital_silence



Joined: 22 May 2004
Posts: 237

PostPosted: Fri Jul 28, 2017 2:58 am    Post subject: Reply with quote

OK, the answers are below:

Vicky: No, there is no LED flash when inserting/removing batteries.

Rob: Tried pressing buttons when no batteries, then reinserting the batteries - no effect, still a dead unit.
I'll try sniffer, thanks, although, from general experience with micros, if bootloader is corrupted, there's not much you can do, apart from re-flashing the micro (see below).

unclemiltie: All modern micros have "reflash" mode where you are not using bootloader, but communicate with the hardware stock code to load something into the micro's NV memory in the first place, normally via JTAG or Serial. Normally, that "reflashing"mode is invoked by strapping certain pins low or high while powering up the micro.
The S/W tool to do that is usually manufacturer-specific, though I've seen some generic tools.
I'll have to study the datasheet for S3F80 and see how (and if) this can be done. And for that, I also will need an image of bootloader to load into micro, which is also I don't know where to get from...

I'll post the update here when there is one.

I will PM you soon wrt your remotes.

Thanks everyone.

---------------

Upd:
Tried sniffer. Not much joy, I am afraid - can't low-level communicate with remote. Operations time out.

However, it can't communicate with known good remote (same model), although on the good remote, the "Cable" LED blinks twice on the communication attempt, whereas on the suspect remote it remains dark all the time.

Tried the trick with connecting the comms cable before inserting the batteries - all to no avail.

I guess, I'll have to read the datasheet for the micro to see if I can re-flash it...

Later update: noticed that the "sick" remote blinks the "TV" button once, approximately 10 seconds after inserting the batteries while having the serial cable connected. To me, that points out more to an embedded software issue.


Last edited by digital_silence on Fri Jul 28, 2017 9:24 am; edited 1 time in total
Back to top
View user's profile Send private message
unclemiltie
Expert


Joined: 21 Jan 2004
Posts: 1743
Location: Pittsburgh, PA

PostPosted: Fri Jul 28, 2017 8:52 am    Post subject: Reply with quote

There is this "tool mode" on the S3F8 processors, there are several references to this in the users manual but that chapter in the public users manual is not there. A number of us have looked for it and tried to find it to no avail.

I'm sure that is how they load the firmware during manufacdture, but we have no idea how it works.

If you find it, with a little work you could probably recover the remote.

Good luck!
_________________
this JP1 stuff is a sickness!
Back to top
View user's profile Send private message
yaworski



Joined: 22 Jun 2014
Posts: 415
Location: Warsaw, Poland

PostPosted: Fri Jul 28, 2017 10:12 am    Post subject: Reply with quote

There's a background debug mode in S3F8 which uses a single wire. It is described in the public datasheet but it requires an extra hardware.

There are some open source hardware solutions:
http://usbdm.sourceforge.net/USBDM_V4.12/html/index.html

HW design files are here:
https://github.com/podonoghue/usbdm-hcs08

I don't know if it's possible to connect to BDM in case of your specific remote. Also according to datasheet BDM can be disabled by the program running on the micro, but I think this only applies to debugging, not the flashing.
_________________
Marcin
Back to top
View user's profile Send private message
digital_silence



Joined: 22 May 2004
Posts: 237

PostPosted: Fri Jul 28, 2017 5:52 pm    Post subject: Reply with quote

yaworski, I had a quick look at the BDM, thanks, and your first link says specifically that BDM is targeted for Freescale (read: Motorola) microcontrollers.
S3F8x/S3S8x is a Samsung micro family.
Are they compatible or do you know for sure that BDM will also work for those? Thanx.

I opened my sick remote (slight correction: it is 1167, not 1067) and there is a 32pin soic micro footprint with the chip-on-board micro (that black epoxy blob) wired to it. So, it appears to be S3F80KB, which comes in 32 pin version when cased. (I may be wrong here though).
The datasheet tells you how to enter the tool mode (TEST pin high when powering up), so, I can wire up the hardware easily, but I now need a reflashing software, and most importantly, the specific image to load into the flash that would restore the ISP functionally.

Are those available from anywhere? Thanks.

I could try to read the image from the good remote, but I first need a reading s/w tool and second, there's a high chance that it is protected... OK, one step at a time...


Last edited by digital_silence on Sat Jul 29, 2017 12:15 am; edited 1 time in total
Back to top
View user's profile Send private message
unclemiltie
Expert


Joined: 21 Jan 2004
Posts: 1743
Location: Pittsburgh, PA

PostPosted: Fri Jul 28, 2017 6:25 pm    Post subject: Reply with quote

If you can make the software work you could certainly pull all of the software out of a good one and then load it into the bad one.

the challenge is doing anything with Tool mode since no one has ever been able to find any documentation on it.
_________________
this JP1 stuff is a sickness!
Back to top
View user's profile Send private message
dude



Joined: 07 Nov 2017
Posts: 31

PostPosted: Wed Nov 15, 2017 4:49 pm    Post subject: S3 Tool Mode Programming Reply with quote

I *think* this is what you are looking for...
https://static.arantius.com/misc/S3%20Embedded%20Flash%20Serial%20Programming.pdf

It describes Tool Mode programming for the S3 / SAM8 protocol.

Let me know if this is helpful or I am off base. Very Happy
Back to top
View user's profile Send private message
dude



Joined: 07 Nov 2017
Posts: 31

PostPosted: Thu Nov 16, 2017 7:08 pm    Post subject: Hardware Connection Needed Reply with quote

Ok, so I may be up for the challenge to write a SAM8 tool mode recovery program... BUT, I will need a little info first: I am not 100% sure on the pinout and how to set the hardware up beforehand. I have a ATT Uverse S30 remote I can tinker with. It has the 4 pin (odd) connector on it and I am fairly sure that maps with the necessary TEST/RESET/SDC/SDA lines needed to talk with the S3F80 chip inside. So the question I have is: can anyone confirm this? I thought about using a FT232RL USB dongle to talk to the remote. The dongle has a 6 pin i2c connection header on it I can use. I'm not really a hardware guy so any input, advice, or feedback is welcome.
Back to top
View user's profile Send private message
mdavej
Expert


Joined: 08 Oct 2003
Posts: 3716

PostPosted: Thu Nov 16, 2017 7:41 pm    Post subject: Reply with quote

Yep. Works fine. Here's how to connect:
http://www.hifi-remote.com/forums/viewtopic.php?p=127948#127948
Back to top
View user's profile Send private message
dude



Joined: 07 Nov 2017
Posts: 31

PostPosted: Sat Nov 18, 2017 8:38 pm    Post subject: Reply with quote

mdavej wrote:
Yep. Works fine. Here's how to connect:
http://www.hifi-remote.com/forums/viewtopic.php?p=127948#127948

Thanks for the link. That is helpful! That looks solely as UART/serial mode... which might be ok (not sure yet) but I suspect the need will be more in a bit-bang mode. Thoughts?

Before I jump down this rabbit hole... I should ask, has anyone already done this? (written an entire flash recovery program targeted at say jp1.4 remotes?) If there is anything already out there anyone is aware of (short of multi thousand dollar hardware programmers/debuggers) it would be great to know. I've not seen anything open source or mentioned but my Google searches may have just been slack.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       JP1 Remotes Forum Index -> JP1 - Hardware All times are GMT - 5 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


 

Powered by phpBB © 2001, 2005 phpBB Group
Get Smart! the band's official homepage Rockabilly Central