Philips 46PFL9706 - random stripes and blocks in image - defect TCON resonator X200

This Philips has a unique backlight with more than 200 LEDs in a tight matrix. I generally like the high-end Philipses from the early 2010s. The good panels, decent sound, and Ambilight on three sides make them attractive products. The seller mentioned random stripes when it started cold, and after warm-up, the device worked ok.

When I fired it up, the image I got made me go "Ah, crap, panel fault or backlight is broken".

Not so quick! This backlight is capable of sharp local dimming! So, the mainboard was producing information and the dimming reacted to it. After a while, the patterns changed fundamentally:

Now, I was convinced that the TCON board was to blame. When pixels are in the wrong place and there is no constant pattern, the TCON is the go-to board.

After a search in the Iwenzo repair forum, where I am active, it appeared to be a standard fault with this model. The X200 resonator is faulty. Not quite broken, but mechanically unstable. The exact name is C25M000000S001. I bought it from Farnell's branch develektro.com, which is for private customers. Farnell only accepts business customers.

With a preheater plate and hot air, the replacement is a matter of seconds without stressing the board.

The problem here is that the resonator is specified for 70°. It gets roasted by the chip and after a number of years, it is going to give up.

And here we are:

The backlight has a minor problem caused by aging, however. In some situations, blocks of LEDs shine through slightly. This is also a known issue and the reason is the warped plane that carries the LEDs. They get a little too close to the diffusor foil. I'll fix that later, as I need to take apart the panel for this.

Update

I ruined the moth-eye screen surface. To remove some fingerprints I used a soft microfiber cloth and a mild glass cleaner. That left a grey residue on the surface. After researching a little, the original Philips cleaning liquid is "alcohol-based". So, I put some Isopropanol on the cloth and wiped it again. That did even more damage.

Philips does not want you to clean the screen! They only supplied a small special cloth with a cleaner to remove single prints. The previous owner just dusted it off and never touched it.

I was able to get rid of the grey smear with Armor All and meticulous polishing. It is pitch black again, but it has none of the anti-glare properties anymore.

All I know about the Philips QFU mainboard problems

I have had my share of experiments and frustration with the Philips QFU mainboards from the xxx7 (QFU 1.1, 2.1 for some 6xx7) and xxx8 (QFU 1.2) series. I am going to continuously collect everything I know here in this post.

General architecture

The main Fusion CPU is actually two CPUs in one plus the Trident graphics device and therefore also called a system on a chip (SOC):

• The boot processor, which runs on 3.3v standby voltage. It reads its bootscript (the standby software) from the SPI EEPROM 7CT3, which is a M25P05 512kBit type.

• The main processor requires the 12V supply to be up and is fed by a number of DCDC converters. Its software is stored in the 8 GBit NAND flash rom. This flash does not only contain the main software (the linux file system with the apps on it), but also the model-specific security keys and the MAC address. This is why a binary image from one board might not work properly on another.
• There are two types of Fusion. The 120 and the 240. The exact difference I do not know. The 240 seems to be used in the higher models (7xxx and up).

The original sins

Undersized cooling

Philips dramatically undersized the cooling of the Fusion processor. They stuffed too many functions onto the chip and did not take care of sufficient cooling. The Fusion 240 seem to have a larger heat sink with proper spring-loaded mounting posts, which stick through the board. The 120ies have sloppy small sinks glued with a heat pad. I am not 100% sure about the sink sizes though, so far I've seen larger sinks on QFU1.1 mainly.

The back cover is so close to the heat sink, it almost sits on it. The engineers thought that a little convection cooling would do the job. Absolutely ridiculous. 

Cases have been reported where the sink fell off by itself because the pad glue failed. This indicates that there were temperatures of at least 80°C. When I remove the sinks I use a heat gun and gloves. The pad glue gives up and goes soft at about 80°.

In a proper PC architecture, such a chip would sport a large cooler with a fan on it.

The larger sinks seem to have the side effect of grilling the SPI boot EEPROM, which might lose its first data block and render the TV dead. More about that further down.

Warped QFU1.1 boards

The boards of the QFU1.1 series are so thin that they warp around the CPU. Under the CPU the board is flat and around the CPU it bends up and down.

This makes any attempt of reflowing or reballing futile. The chip will never sit flat. I recently reflowed a QFU1.1. When the chip settled, it touched the board at one corner and lifted up a little on the opposite corner. Of course this was a total failure and the board is toast now.

Sometimes during my reflow experiments, the chip even jumped off the board with a snap due to the tension.

The QFU2.1 are better in that respect, but they also tend not to be flat around the CPU.

Known failures

• TV does not start and blinks 2x red after a couple of minutes. This is the classic. The 2x blink is reported by the boot processor, which observed that the main processor failed to boot. CPU or NAND failure.
• TV randomly crashes after some time. CPU failure.
• TV produces distorted image with striping or noise. Image freezes. CPU failure.
• TV does nothing at all, not even blink. This can be a case of a corrupted SPI EEPROM.

The infamous 2x blinks - the "K" fault

I've seen many of those. When reading the log through the UART service port (see this post how to do that), the log abruptly ends with the letter K. I described this fault in this post.

My suspicion is that the CPU loses communication with the NAND flash. This makes the diagnose, whether the CPU or the NAND is to blame, difficult. In most cases though, the CPU is the culprit.

The only feasible attempt for a "fix" (hack)

The Fusion CPU needs to be heated up to 180°C max in a controlled fashion. The solder must not melt! As explained above, this can ruin the board due to the warping and tension under the CPU. 

I use an IR6500 reflow workstation for it, which allows me to use a controlled temperature curve. 

The next best method is a pre-heated oven and a digital thermometer with a type K remote sensor, which can be attached to the CPU. Those devices only cost a few bucks. This allows for proper monitoring of the temperature since ovens made for households are not precise. 

With any method, cover the plastic parts and electrolytic capacitors in tin foil. It is not strictly necessary to cover the other parts. They can handle it. The temperature is kept below the solder melting point, therefore there is no danger of dropping parts from the bottom side. With the rework station I only use a square tin foil mask around the CPU, just enough to cover the CI-slot.

The solder balls under the CPU do not fully melt until 235° is reached on the top of the CPU. This chip is thick and needs plenty of heating to come off the board.

I would rate the success rate of the baking technique at 50:50. It is like a coin toss. I have had a few successes in a row, but also losing streaks.

The mysterious NAND flash

I tried a to swap the NAND a few times and never succeeded. In this post I documented the tools I use.

In a recent case I copied the original NAND image onto a new chip, soldered it in, and the UART log was gone. After putting back the original NAND, the log still was silent. Something must have happened in between the two actions and I never found out what. The NANDs behaved perfectly fine on the programmer tool and the verification against the image file succeeded. I have not damaged them. My suspicion is that the heat from the bottom preheater had triggered a defect in the CPU or on the board, which brings us back to square one.

I experienced this twice. Only worked on the NAND, and yet, something else broke down. The UART lines are fed directly from the CPU. There is nothing in between. Thus, if nothing is put out there, the CPU is to blame. The service manual says that if there is no log, a communication problem with the NAND could be the reason. I don't understand that, why would the boot processor require the NAND? However, it fits the observation.

There were reports that the NAND image from an identical QFU platform can work. I cannot confirm that as I even failed with the image from the same device. Also, the board-specific parameters and security keys will not match. You might not have network access, and the CI slot might not work after that. The service manuals describe in detail how to reconfigure a generic service board. The necessary tools and software are not available to normal people.

All that brings me to the conclusion that tampering with the NAND is also futile and not worth the time.

The boot SPI EEPROM

This memory chip holds the boot software for the boot (stand-by) processor.

I had only one case where the boot SPI EEPROM was corrupted. I've programmed a few of those for other people. It seems that this is more common in the QFU1.1 boards where the heat sink is covering the chip. It probably doesn't take too much heat, either.

The fix is very easy if you have a programmer yourself or know someone who has. Go to this link for a collection of my tested boot images.

How to check if an AS15 chip is working ok

An AS15 is nothing but a 14 + 1 channel buffer. 15 reference voltages at the inputs are buffered for higher currents on the outputs. A resistor ladder is connected to a reference voltage source and the AS15 picks up each of the ladder voltages and presents it at the outputs.

The typical image symptoms of a defect AS15 chip on TCON boards are:

• solarization - colors, especially darker ones are pink or green, for example
• faded colors

Many TVs with AUO panels built around 2009 have this defect.

First quick test: does it get hot? It must not. According to the datasheet, its idle current is 10-20 mA. That's not enough to heat up a chip. The last TCON I fixed reduced its total idle current by 150mA with a new chip.

Besides apparent overheating, there is a technique to verify the chip's performance.
Locate testpoints named VGA or VGMA, numbered 1 to 14 or up to 22. Measure those against ground. They must produce a consecutive sequence of decreasing voltage of around 15 down to 0. If there are "holes" or big jumps in between, the chip is broken.

However, the exact values vary between panels. There is no rule.

Also, locate the VGMAREF test point of the reference voltage. A typical voltage level there is 15.6V. I had a couple of defect TCONs where VGMA0 measured slightly higher than 15.6V. Apart from that everything looked ok. This is not possible in a working configuration! The reason is the AS15 leaking voltage to the inputs from its power supply rail.

Note that some TCONs have 0V holes in the testpoint sequence because they only produce 14 or 18 voltages for 22 channels. Those TCONs have solder pads for up to two 4xOPAs, which are the buffers for voltages #15 to #22. Those are not always populated. The panels are wired to pick the active outputs accordingly. You must trace the origin of the testpoint voltages whether they lead to the AS15 or to the missing OPAs.

Onkyo TX-NR 5009 - defect main relay STD-S-109DMR2 - switching itself off - no sound - no image

I have already fixed an 809 and a 515 recently. The 809 had the famous DSP problem and a reflow of the chip fixed it. The 515 had a defect main relay.

I have been using the 809 for a while. It replaced the Marantz SR7007, because its spacial sound representation was much more impressive.

When I saw the former top range 5009 on eBay I just had to have it. The seller said that it did not produce any sound. Thus, I was confident to find a familiar fault. I was wrong.

When I plugged it in cold straight from the box it started with a strange rattling noise from one of the relay. That couldn't be right. A check of the software versions showed that the DSP was ok. Good.

A few moments later - KLACK - the mains fuse triggered. This was reproducible. I unplugged the huge analog transformer and the fuse stayed on. A relay was acting up though. So, this relay switched the transformer on and off in a too quick succession. This triggered the fuse due to the inrush current.

First I suspected a defect relay. However, with time and warm-up the problem disappeared. I went ahead, connected the TV and got no image. Not even the Onkyo logo. Sound from analog and optical inputs was basically ok, albeit a little too silent. The HDMI input and output seemed to be completely dead. My PC did not recognize it as a sound device via HDMI.

So it had to be the HDMI board, which controls and digitally processes everything in this device. That's intimidating to begin with. So let's focus on the basics first. What improves with increasing temperatures? Capacitors! Although the measurements of the various DC supplies looked fine, I pulled off one of the SMD electrolytics and its ESR was abysmal!

All of those suckers had to go. Seven super low ESR Nichicon HD took their place. I have plenty of them in stock specifically for Onkyo HDMI board rework.

On the top side I mounted two heatsinks on the DSP (right corner) and on one image processor to keep those two under better working conditions. Five caps had to be replaced there.

After putting the board back in the image was still missing. What the heck? A factory reset and the monster was good to go!

The 5009 is a huge piece of hardware and on a much higher level than the cheaper ones. The sound compared to the 809 is a lot smoother and more natural. Onkyo has put more effort into the digital domain, obviously, because the analog amplifiers are identical, with a little more juice in the power section.

Update - Relay Trouble

The receiver worked fine for a while and one evening it went pop! and the sound was gone. Everything else was normal. I noticed that it cooled down and my immediate suspicion was that the main transformer had switched off.

The main relay died. Its coil was open. What is it with those Onkyos that their relays die like flies?

Finding a replacement turned out to be difficult. The original part in the 5009 is a STD-S10DMR2. Notice the 2 at the end! Smaller Onkyos use the SDT-S-109LMR2.

Both types are designed with a reduced power consumption in mind. Let's look at the data sheet:

In forums I read that the voltage is too high. I soldered in a resistor with the specified value of the coil and measured more than 10V until the speaker relays clicked. Then it went down to a little more than 9V.

It was impossible to find the original DMR2 part, only the DMR. Also, the 9V types were unobtainable except from Aliexpress. On eBay I ordered 12V STD-DMR. In the meantime I found a spare 10A 12V relay for testing. After adjusting R9109 it worked fine, the receiver is back alive. The voltage is now between 11.5 and 10.5 volts.

So, the relays are not plug and play when you replace the low power with the normal types! You must adjust R9109 to bring the voltage to the proper range. Also, take notice if it is a LMR (5A) or DMR (10A) type! The size is the same, so, if you are planning to put some on stock, the DMR will fit all receivers.

The DMRs have a higher inrush current rating of TV-8. In that sense, they are quite unique. During my search for a replacement I only found TV-5 ratings.

I think that the low-power DMR2 / LMR2 relays were garbage and Onkyo hit them with a little too much voltage. It does not surprise me that I could not find any of those types. Only the normal ones.

Surprisingly, only the main relay got too much voltage. The ones for the secondary transformers were all inside the spec.

Update Dec 2019

Still running almost every day without problems. I love this machine! The sound is smooth, colorful and detailed. The distance to the 809 that I've used for a while before is substantial.
I have sourced relais with the TV-8 inrush current rating in the meantime. So far my replacement relais is working fine, so no hurry there.

Update August 2021

Still running perfectly fine. Besides the 55 inch Panasonic plasma TV this repair is giving me the most joy.

More IR6500 tweaks - silencing fan - fixing flipped polarity of thermocouple socket - adjusting temperature offset - run bottom heater independently

Silence the fan

The fan is annoyingly loud. It is a line voltage fan, so you cannot just put some PC fan in there. The remedy is simple. I used four rubber mounts I had left over from my last PC build. I dumped the grill. It is unnecessary.

What a relief!

Non-standard K-Type socket polarity

This device is full of surprises. I damaged the original thermocouple recently and plugged in another K-Type I had lying around. Surprise! The temperature figures were going down instead of up when I heated it.

Why was that? For what reason ever, they managed to flip the polarity of the K-Type socket. It is non-standard! The original sensor also had the polarity wrong. Dafug?

It is easy to fix though. Just open the bottom cover, unscrew the wires and put them back on in reverse.

To make positioning of the sensor possible without fiddling with tape, I bough an adjustable holder HERE. The integrated magnet is too weak. I glued a powerful neodym on top of it. This thing sticks!

Very nice, sensitive, yet a little fragile sensors are THESE. They need a readjustment of the controller, which I will address next.

My sensor setup looks like this:

Adjusting temperature offset

The new sensors were off by a few degrees and I investigated possibilities to fix this. Thankfully there is a decent manual available for the controller. The manual that came with the IR6500 is utter useless.

It works like this:

• Measure the temperature in boiling water to get the difference to a reference  My new sensor was 6°C off in reference to 100°C.
• Press PAR/SET and hold until the controller switches to configuration mode. You will see some text instead of the usual temperature reading.
• Press PAR/SET until OFSt appears.
• Use the arrow keys to offset the difference.
• Press PAR/SET until the normal display returns.

Run bottom heater independently

It always annoyed me that it wasn't possible to use the preheater alone, without running a program. I like to have the bottom heater at its max temperature and the board pre-heated before I even start the reflow process.

It is easy. All you need is three wires and a toggle switch.

The bottom controller's terminals 4 and 5 output the control voltage for the heater power relay. Terminal 5 goes straight to the relay. Terminal 4 is looped through the main controller's terminal 7, which gets connected to terminal 6 when a program starts. Terminal 6 goes to the heater relay.

• Remove the wire between main controller terminal 6 and the bottom heater switch.
• Wire the toggle switch to choose between terminal 4 of the bottom controller and terminal 6 on the main controller. The common wire goes to the heater relay.

In ON position the bottom heater controller works independent from the main controller. With the temp set to 300 I get around 110°C on the upside of the boards.

Pimping the IR6500 with an Elstein RFS80 top heater

I have tried to solder the CPU of Philips QFU TV boards twice and failed, because the temperature distribution of the top heater was so bad that the chip sank in at one edge and got lifted up at the diagonally opposite edge. All the tedious reballing work in vain! My suspicion is that the top heater of the IR6500 is rubbish.

On eBay I found a seller who offers a Made in Germany Elstein RFS80 heater: https://www.ebay.de/itm/ELSTEIN-RFS80-400w-230v-IR-TOP-HEATER-WITH-REFLECTOR/330764961659

It also comes with a reflector, which will help to concentrate the heat even better.

So I set off to mount this thing into my station.

You can tell already from the way the heating wires are positioned that Elstein had put more thought into this. Everything is arranged around the center whereas in the original heater the energy is wasted in places where you never need it. Moreover, the surface is not even.

The new heater fits perfectly well into the original holder bracket. The one angled side with the screw holes needs to be bent to stand upright (right side on the image).

Next, I drilled four holes at the sides of the head and reused the original screws with no problem.

The silly fan, which is now even more useless than it already was, had to go. With the reflector and the mounting bracket there will not be much heat going into the head. Besides, the air has no place to escape at the bottom, anyway.

Done. Besides a slightly off center, everything turned out pretty good. With the new heater, centering needs to be more precise than with the old one because of its shape.

Unfortunately I broke the temperature sensor recently. As this one has the reverse polarity than the usual ones (they will yield negative temps), I had to order a bunch from China. So, no testing right now. I'll post a followup when the next reballing session takes place.

Building an EDS LeakSeeker 89!

The EDS LeakSeeker is a unique device for finding shorts. Watch the videos on YouTube by EDS or check the description on the EDS website. Unfortunately, EDS stopped selling them a few years ago. But there is a way to build one yourself!

During a routine search after a used LeakSeekers (which don't exist, everybody is keeping them!), I came across THIS PAGE.

I wrote a mail to Dave Miga of EDS, who designed this cool device, and after he had confirmed that shipping to Germany is possible, I ordered a board from the above source and a parts kit from Dave.

This wasn't exactly cheap, but this thing is so unique and useful that I just had to build it! I will enjoy it until the end of my days as I don't think that anybody will design something similar anytime soon.

And here it is, the assembled LeakSeeker on my bench in a prototype stage. I have yet to find a nice case for it. The original case has no space for 9V battery blocks. I like portable testing tools. The thingy draws less than 100mA when it is testing and 30mA idle.

It is not difficult to build, yet there are two things I (almost) messed up:

• Make sure that the resistors left to the gain switch are all the way in, otherwise, they might short with the metal case of the switch.
• Handle the 0.05 ohms wire carefully and don't bend its legs. The legs are welded to the wire and can break off.

During my first tests, I thought it didn't work because it can take quite a while until it moves from the green LEDs to the yellow and produces a deeper chirping sound.

Here I am playing around with a testboard that has a 10 Ohms resistor to simulate a defect component. The sensitivity of the LeakSeeker is astounding. I can hear the tonal difference of 1cm distance on a trace in the low gain setting.

Update 2024: Finally a Home for the LeakSeeker

After a whopping four years, I finally got around and built a case for the LeakSeeker. While browsing through my drawers I also found a long-forgotten 2x9V battery compartment, which fits perfectly.

With a slide switch, I can choose the power source. Cool, now it's a no-fuss portable testing device.

The case can be found on Aliexpress

This is the answer I got from Dave to my inquiry. I think he won't mind me showing it here.

The LeakSeeker and CapAnalyzer parts listed below are available. 
Purchase includes all data required to build your own CapAnalyzer and LeakSeeker; the list is shown below.
 LeakSeeker 89 is unique in the world and nothing can do what it does. Check out the eds-inc website for more info.

All prices in US Dollars:
EDS-89 or EDS-88A kit of all pcb parts (including programmed mcu) to mount to pcb (pcb not included) $89
Programmed MCUs ONLY:  IC set for CapAnalyzer88A $25, mcu for LeakSeeker89 $18.
3-piece gold-plated test lead set for LeakSeeker $18
Special tweezer probe assy for CapAnalyzer $29.
No other parts in stock, however the sources below show where to buy or fabricate the pc board, overlays and cabinet.
FEDEX or DHL shipping to Germany 81371   $49.45
Payments are in US Dollars via Paypal to semianalyzer@gmail.com. 
Or we can send you a pro-forma invoice that you can pay with a credit card or PayPal. Just email us with your list, your name, address, and phone number. FEDEX and DHL will not ship without a phone number.

This data list will be emailed to you with your purchase:
Eds88ar1 BOM  Complete bill of materials for EDS-88A CapAnalyzer series II
Eds88ar1.zip PCB and Drill files for EDS-88A.
eds88As2fp.pdf  Front panel for CapAnalyzer 88a series II
EDS-89 BOM bill of materials for EDS-89 Leakseeker
EDS-89 OVERLAYS.zip overlay graphics for Leakseeker, includes drill and mill dimensions for OKW case
EDS-89 pcb.pdf Parts layout for EDS-89. Don't really need it as pcb will have silkscreen anyway...
EDS-89 TOP LAYOUT.jpg Just another graphic of main panel in EDS-89
EDS-89.zip pcb gerber and drill files for EDS-89
All EDS products use pc boards fabricated by andy.yu@fastechcircuit.com 
These pcb makers will have a small minimum of boards that must be made so there will be extras;
There are also many people selling these extra spare pc boards on eBay; do a Google search or see email list below.
Or anyone advertising in magazines like Elektor or Nuts and Volts. Or get spare boards from other kit builders. Try these, most have purchased parts kits and may have spares...

sales@tristatesound.com
ml19554@gmail.com
hugh@mercedelectronics.com
mpeter1604@gmail.com
billmcdonald80@gmail.com
aardvark301@gmail.com
andy.thompson@moviehouse.co.uk
jrobinson@aerotecusa.com
amtate@gmail.com
jason.panrucker@odysseygaming.com
chrisiaforbes@hotmail.com
kenjensam@bellsouth.net
clint.thomas@att.net
kdchau71@gmail.com
amusementservice@bigpond.com.au
munthernahleh@gmail.com
sajidmkhi@gmail.com
amtate@gmail.com

Cabinet for EDS-88A is the 36TDB from Simco https://www.simcobox.com/
Cabinet for EDS-89 is the OKW Teko TENCLOS PULPIT 590.9 order from martyr@okwusa.com or travisr@okwusa.com or rayt@okwusa.com

User manuals (and alignment instructions for EDS-88A) on the eds website http://eds-inc.com/index.html