View previous topic :: View next topic |
Author |
Message |
digital_silence
Joined: 22 May 2004 Posts: 257
|
Posted: Thu Jul 27, 2017 2:37 am Post subject: Remote bricked after connecting to the wrong JP1 interface ? |
|
|
Hi all,
I am using two types of JP1 remotes in my home workshop: JP1 (collection of URC8811s and 8910s) and JP1.3 (these are all Comcast 1067Bx3 remotes)
To interface to JP1.3s I am using the Serial Interface Cable (Serial-to-JP1.3) cable, and if I need to i/face with JP1s, I am just adding on the top of it the JP1.3-to-JP1 adapter based on the PIC microcontroller (all designs are published on this website).
Everything works fine. Both interfaces use 6 pin 2x3 box headers for connection, but I am usually very careful to connect the right cable to the right interface.
However, yesterday I goofed and connected the JP1 Cable into JP1.3 remote.
The connection diagram was as follows:
(PC)<->(USB-Serial adapter)<-Serial-to-JP1.3cable->(JP1.3-to-JP1adapter)->(JP1.3 Remote: Comcast URC1067Bx3)
So, essentially, there was a JP1.3-to-JP1adapter present, which shouldn't have been there. I definitely connected the plug the right way around (pin1 to pin1), but the interface was wrong.
I ran the RMIR, then tried to "Download from Remote" and received "No Remote Found" message. I then realise my mistake, and removed the redundant (JP1.3-to-JP1) adapter, but I am still getting "No Remote Found" message after that.
All other hardware works fine, because I can communicate without a problem with the other Comcast URC1067Bx3 JP1.3 devices using this setup.
Furthermore, not only I can't communicate with that remote, but the remote doesn't show any signs of life anymore - the device buttons don't blink as they normally would when I press any keys, and the IR LED is not transmitting anything (that mobile phone camera trick).
So, the question is: Did I brick that URC1067 by connecting it to a JP1 iface? Is there any way to bring it back to life?
Just before you ask: no I haven't forgotten to insert the batteries into remote.
Don't be afraid to go into as much technical details as you need.
Thanks.
DS |
|
Back to top |
|
|
vickyg2003 Site Admin
Joined: 20 Mar 2004 Posts: 7073 Location: Florida |
Posted: Thu Jul 27, 2017 7:57 am Post subject: |
|
|
Is it still blinking when you insert remove batteries? _________________ Remember to provide feedback to let us know how the problem was solved and share your upgrades.
Tip: When creating an upgrade, always include ALL functions from the oem remote, even if you never plan on assigning them to a button. Complete function lists makes an upgrade more helpful to others.
|
|
Back to top |
|
|
The Robman Site Owner
Joined: 01 Aug 2003 Posts: 21248 Location: Chicago, IL |
Posted: Thu Jul 27, 2017 9:23 am Post subject: |
|
|
You've probably corrupted a byte or two in the flash memory, which can be fixed but you'll need one of the experts to walk you through it. However, there is one quick thing you can try. Try removing the batteries, then press a few buttons, then re-insert the batteries to see if that resets the remote. _________________ Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help! |
|
Back to top |
|
|
The Robman Site Owner
Joined: 01 Aug 2003 Posts: 21248 Location: Chicago, IL |
Posted: Thu Jul 27, 2017 11:23 am Post subject: |
|
|
The best I could find by doing some searching was this old thread where 3FG suggested using JP2Sniffer to see if that program can communicate with the remote. It is able to communicate in cases where RMIR cannot. _________________ Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help! |
|
Back to top |
|
|
unclemiltie Expert
Joined: 21 Jan 2004 Posts: 1795 Location: Pittsburgh, PA |
Posted: Thu Jul 27, 2017 12:09 pm Post subject: |
|
|
The S3F80 remotes in the JP1.3 versions has a "tool mode" that if you get into it the remote can corrupt things. Depending on what got corrupted it can be fixable or catastrophic. There are sparse reports of people bricking the JP1.3 remotes by doing things like this.
I've fixed a few of them while writing the JP1.3 extenders and doing things I should not have done, but I've also bricked a few. But if you can't communicate with it and none of the buttons are working then it's probably beyond repair. If you can communicate with it there are some ways to fix it but they involve a lot of work. Replacement or upgrade may be in your future _________________ this JP1 stuff is a sickness! |
|
Back to top |
|
|
unclemiltie Expert
Joined: 21 Jan 2004 Posts: 1795 Location: Pittsburgh, PA |
Posted: Thu Jul 27, 2017 6:49 pm Post subject: |
|
|
BTW, I looked in my remote "stash" and I have two unopened of this remote (the JP1.3 remote) including batteries. I think I did take one out to debug the extender when I wrote it but both are certainly completely functional
PM me if you're interested, we can work out some kind of deal. _________________ this JP1 stuff is a sickness! |
|
Back to top |
|
|
digital_silence
Joined: 22 May 2004 Posts: 257
|
Posted: Fri Jul 28, 2017 2:58 am Post subject: |
|
|
OK, the answers are below:
Vicky: No, there is no LED flash when inserting/removing batteries.
Rob: Tried pressing buttons when no batteries, then reinserting the batteries - no effect, still a dead unit.
I'll try sniffer, thanks, although, from general experience with micros, if bootloader is corrupted, there's not much you can do, apart from re-flashing the micro (see below).
unclemiltie: All modern micros have "reflash" mode where you are not using bootloader, but communicate with the hardware stock code to load something into the micro's NV memory in the first place, normally via JTAG or Serial. Normally, that "reflashing"mode is invoked by strapping certain pins low or high while powering up the micro.
The S/W tool to do that is usually manufacturer-specific, though I've seen some generic tools.
I'll have to study the datasheet for S3F80 and see how (and if) this can be done. And for that, I also will need an image of bootloader to load into micro, which is also I don't know where to get from...
I'll post the update here when there is one.
I will PM you soon wrt your remotes.
Thanks everyone.
---------------
Upd:
Tried sniffer. Not much joy, I am afraid - can't low-level communicate with remote. Operations time out.
However, it can't communicate with known good remote (same model), although on the good remote, the "Cable" LED blinks twice on the communication attempt, whereas on the suspect remote it remains dark all the time.
Tried the trick with connecting the comms cable before inserting the batteries - all to no avail.
I guess, I'll have to read the datasheet for the micro to see if I can re-flash it...
Later update: noticed that the "sick" remote blinks the "TV" button once, approximately 10 seconds after inserting the batteries while having the serial cable connected. To me, that points out more to an embedded software issue.
Last edited by digital_silence on Fri Jul 28, 2017 9:24 am; edited 1 time in total |
|
Back to top |
|
|
unclemiltie Expert
Joined: 21 Jan 2004 Posts: 1795 Location: Pittsburgh, PA |
Posted: Fri Jul 28, 2017 8:52 am Post subject: |
|
|
There is this "tool mode" on the S3F8 processors, there are several references to this in the users manual but that chapter in the public users manual is not there. A number of us have looked for it and tried to find it to no avail.
I'm sure that is how they load the firmware during manufacdture, but we have no idea how it works.
If you find it, with a little work you could probably recover the remote.
Good luck! _________________ this JP1 stuff is a sickness! |
|
Back to top |
|
|
yaworski
Joined: 22 Jun 2014 Posts: 454 Location: Warsaw, Poland |
Posted: Fri Jul 28, 2017 10:12 am Post subject: |
|
|
There's a background debug mode in S3F8 which uses a single wire. It is described in the public datasheet but it requires an extra hardware.
There are some open source hardware solutions:
http://usbdm.sourceforge.net/USBDM_V4.12/html/index.html
HW design files are here:
https://github.com/podonoghue/usbdm-hcs08
I don't know if it's possible to connect to BDM in case of your specific remote. Also according to datasheet BDM can be disabled by the program running on the micro, but I think this only applies to debugging, not the flashing. _________________ Marcin |
|
Back to top |
|
|
digital_silence
Joined: 22 May 2004 Posts: 257
|
Posted: Fri Jul 28, 2017 5:52 pm Post subject: |
|
|
yaworski, I had a quick look at the BDM, thanks, and your first link says specifically that BDM is targeted for Freescale (read: Motorola) microcontrollers.
S3F8x/S3S8x is a Samsung micro family.
Are they compatible or do you know for sure that BDM will also work for those? Thanx.
I opened my sick remote (slight correction: it is 1167, not 1067) and there is a 32pin soic micro footprint with the chip-on-board micro (that black epoxy blob) wired to it. So, it appears to be S3F80KB, which comes in 32 pin version when cased. (I may be wrong here though).
The datasheet tells you how to enter the tool mode (TEST pin high when powering up), so, I can wire up the hardware easily, but I now need a reflashing software, and most importantly, the specific image to load into the flash that would restore the ISP functionally.
Are those available from anywhere? Thanks.
I could try to read the image from the good remote, but I first need a reading s/w tool and second, there's a high chance that it is protected... OK, one step at a time...
Last edited by digital_silence on Sat Jul 29, 2017 12:15 am; edited 1 time in total |
|
Back to top |
|
|
unclemiltie Expert
Joined: 21 Jan 2004 Posts: 1795 Location: Pittsburgh, PA |
Posted: Fri Jul 28, 2017 6:25 pm Post subject: |
|
|
If you can make the software work you could certainly pull all of the software out of a good one and then load it into the bad one.
the challenge is doing anything with Tool mode since no one has ever been able to find any documentation on it. _________________ this JP1 stuff is a sickness! |
|
Back to top |
|
|
dude
Joined: 07 Nov 2017 Posts: 31
|
|
Back to top |
|
|
dude
Joined: 07 Nov 2017 Posts: 31
|
Posted: Thu Nov 16, 2017 7:08 pm Post subject: Hardware Connection Needed |
|
|
Ok, so I may be up for the challenge to write a SAM8 tool mode recovery program... BUT, I will need a little info first: I am not 100% sure on the pinout and how to set the hardware up beforehand. I have a ATT Uverse S30 remote I can tinker with. It has the 4 pin (odd) connector on it and I am fairly sure that maps with the necessary TEST/RESET/SDC/SDA lines needed to talk with the S3F80 chip inside. So the question I have is: can anyone confirm this? I thought about using a FT232RL USB dongle to talk to the remote. The dongle has a 6 pin i2c connection header on it I can use. I'm not really a hardware guy so any input, advice, or feedback is welcome. |
|
Back to top |
|
|
mdavej Expert
Joined: 08 Oct 2003 Posts: 4502
|
|
Back to top |
|
|
dude
Joined: 07 Nov 2017 Posts: 31
|
Posted: Sat Nov 18, 2017 8:38 pm Post subject: |
|
|
Thanks for the link. That is helpful! That looks solely as UART/serial mode... which might be ok (not sure yet) but I suspect the need will be more in a bit-bang mode. Thoughts?
Before I jump down this rabbit hole... I should ask, has anyone already done this? (written an entire flash recovery program targeted at say jp1.4 remotes?) If there is anything already out there anyone is aware of (short of multi thousand dollar hardware programmers/debuggers) it would be great to know. I've not seen anything open source or mentioned but my Google searches may have just been slack. |
|
Back to top |
|
|
|