The first thing to do is to start the emergency software installation. For that, you need an infrared remote, which does not come with the TV. You can get one for around 10€. The reason being that the software, which manages the original radio remote control will not be loaded under such circumstances. Silly Philips!
- Disconnect the TV from the mains
- Press OK or DOWN on the remote and hold it
- Plug in the mains.
I did that and the recovery program came up. Good! This means that the screen, the backlight, and the main processor are doing fine. It can only be a problem with the software or the devices that store it, respectively.
The QFU main software, which I downloaded from Philips, installed fine. The TV went to standby - and did still not start.
Next up: logfile reading. I plugged in my adapter (see this post) and realized that the device is looping. It did not stop randomly while booting, rather it happened at more or less the same moment. The last log message was truncated, no indication that the loop was intended by the software.
This means that the processor always crashed for the same reason. Processors crash due to corrupted software. As I had installed the software previously, I came to the conclusion that the NVRAM chip must be faulty.
In the schematics, the chip is a MT29F8G08ABACAWP. In reality though, it is a MT29F8G08ABABAWP.
It is a 8GB NAND chip.
I was able to to find the binary image of the software. Now I needed a programmer with which to load the software onto the chip, and a supplier from where to buy it.
I got the chips from Aliexpress HERE. It worked fine.
The programmer I chose was THIS MODEL. It also worked flawlessly.
In case you search for programmes yourself, make sure the exact name of the chip is on the compatibility list. The letter soup is confusing and I got it wrong once and bought a non-suitable programmer first.
Swapping the chip was surprisingly easy with my preheater plate and a large nozzle on the hot air gun. In about 15 seconds the chip already floated.
With a new programmed chip soldered in (use lots of flux and a good magnifier glass!) the TV behaved differently. I was able to start it with the remote and everything seemed fine. However I was not successful each time from standby. It would not listen to the remote everytime.
So I checked the log again and spotted yet another form of boot loop, this time initiated by the software in a consistent and regular manner. The crash was gone, but the TV would refuse to go to standby properly. Instead it first attempts to stop, ambilight goes off, standby LED switches off - and then it reboots into some semi-standby. This repeats forever.
The standby LED actually has three states, which it goes through:
- Dimmed. The TV is not listening. Any command from the remote gives me a quick flickering.
- Off. The TV is not listening. Any command from the remote gives a slow, bright blinking.
- On. The TV will only start in this state.
...repeat from top
A reinstall of the software did not change anything. I also read the boot EEPROM and it was 100% identical to the binary that I have on disc.
I have no idea what to try to fix the loop. The hardware is working. WiFi, ambilight, radio remote, all good.
My only guess is that there needs to be some extra software on the NVRAM chip. Yet, the binary image I got from the Russians was a dump of the chip. I am not even sure anymore whether it is necessary to burn the software onto the chip, because the emergency recovery software will program it, anyway.
So here I am. A TV which is basically working fine, but won't switch itself off to standby. At least I have learned yet another QFU fix, sort of.
Update
I soldered in another NAND with the working software from a 55PFL6158 and now the thing does not even write a log anymore. The CPU gets a little warm and then cools off. This cannot have anything to do with the NAND. It is not even trying to boot. The SPI is good, too.
I tried a reflow of the CPU with no luck.
As it turns out, there is a short on one of the power supply lines for the Fusion processor. This CPU needs a reball and if that's not helping, it is probably toast.
Hi, bin gerade dabei meine nand zu flashen mit ihrer dump vom 55pfl6158k. Das Problem was ich habe mit meinen Tl866ii plus (Adapter für tsop48 sind alle vorhanden)es dauert Ewigkeiten bist etwas geschrieben wird. Sind mittlerweile schon über 12 Stunden für ein Paar Prozent. Lesen und die ganzen Checks gehen in Sekunden von statten. Ich hoffe Sie haben einen Tipp für mich.
ReplyDeleteDas klingt nicht gut. Meine NANDs haben einige Minuten gebraucht. Was da nicht stimmt weiß ich nicht.
DeleteIch habe die QFU Board Reparatur aufgegeben. Die NAND-Flasherei hat nie zu einem Ergebnis geführt, wenn es nicht das Original-Binary war. Eine Kopie von einem anderen TV funktioniert nicht.
Danke für deine Antwort, da ich noch den Original flash habe würde ich es gerne weiter probieren. Wenn ich denn irgendwann mal den alten Auslesen kann würde ich mit ne bissle Fleißarbeit die Hex Daten vergleichen mit deinen binary vom 55pfl6158k. Hast du vllt eine Empfehlung für einen guten und preiswerten nand programmer außer den verlinkten von dir?
ReplyDeleteIch denke, dass mein Programmer schon der preiswerteste für diesen Zweck ist. Ich hatte bei meiner Recherche nur teurere gefunden. Kenne deshalb auch nur den aus Erfahrung.
DeleteThis comment has been removed by the author.
ReplyDeleteAlpengeist, the heat of your solderstation triggered an anti-repairdot. Only QFU 1.2 has them. Those are the 2/3 little black tar-like dots on the bottomside. They contain a sort of flux and solderpellets that melt when you heat up the board. This causes a short on the +1V5 of UMAC 1 (DDR Bank 1) Am i right? In that case you can remove both the smallest dots (and the componetns underneath it) and replace the components. The big dot under the processor has a lot of components under it, so it's more work. Your NAND's are ok and has nothing to do with no logging. In your case, it's a DDR memory problem.
ReplyDeleteHey,
Deletethat's great information! I knew about the dots and that there can be shorts under them, but I never realized that they are anti-repair. Bastards!
Now I understand why heating the boards just below the melting point does work often, yet a proper reflow fails.
The Philips are dying in droves these days. eBay classifieds is full of them. Not sure if I jump in again, it's just too much work.
Soon i take a few board to work so i can X-Ray them. Curious what to see in those dots...
DeleteAnyway, i reballed QFU1.1 and 2.1 as hell, and also 1.2 with only 2 dots that i cover with capton tape (with lots of air underneath it to protect the dots from too much heat) and never go a tv back. The fusion processors do not seem to break down if you're very carefull with temperature. Too much heat can cause the +1v2 of the core to short out and that's the end of the chip.
Great discussion. How high do you drive the temperature? I noticed that the chip won't come off below about 225°C. Also I had trouble with warped boards, the chip won't sit straight after reballing. They were literally bent around the CPU.
DeleteInstead of a 4k euro reball machine, i've build an adjustable aluminum frame where i can place the board in. Under the frame 30cm lower is a big old 2kW heater with a much bigger surface which heats up the whole board. On top i use a digital temperature-controlled paintstripper. It takes indeed a longer time and more heat to melt the old lead-free solder, but once you use lead solder the melting point drops. Cannot post a picture of the setop, but it works perfectly. Not a single faillure after 25 reballs, unless an anti-repairdot was activated...
DeleteTo answer your question: I use just enough heat to melt the solder and keep that setting, height of the paintstripper and time of the preheater. Regularly feel if the solder is melted and immediately remove the BGA and switch the heaters off. After some boards you get a feel of how much heat and time is enough
ReplyDeleteAlpengeist, were you able to copy a defective flash to a new one and use it again in the original MB flawlessly? (You can answer in German, i live in Belgium so i understand it :) )
ReplyDeleteEnglish, because more readers understand it :) Nope, I failed. I don't know why. The chips seemed fine and the copy verified ok. Yet the device didn't even boot. I tried a copy of a good original flash with no success. Once the original flash was back in place, the TV was fine. Weird.
DeleteNo logging saved?
DeleteNo. Dead quiet. Not even the SPI boot started. There is something I don't know nor understand :-D
DeleteSomething fishy, others reported a starting set, but strange behaviour... Maybe it's during factory flash that they read the unique flash number and copy it on other placed in the flash. If they couple the unique numer to the factory flashed numbers a 1/1 copy or a bin file won't work...
DeleteYup, something along those lines. Panasonic does those pairing things, too. I know about the board-specific security keys for the network and the Ci slot. Some people know how to extract them from the original and place them in the new image.
DeleteI've read that the NAND-coupling is done in the CPU even. There are so many myths and speculations flying around about these boards. Most of the hardcore stuff comes from the Russians.
That it's fusion coupled i already examined, it is. Without the matching fusion you'll get error 16 when you insert a CI+ card
DeleteManaged to copy the image of a corrupted NAND to a brand new NAND. Same faillure. After reading an image from a healthy TV, same model, copied it to the corrupted flash (tested it first, no bad blocks and verification 100% ok after programming) and placed it on the TV. The TV played fine for a few hours. It suddenly rebooted... after 30 minutes again, and it got worse.. So bad that it went back to bootlooping, just like it did before.
DeleteAfter that i copied the good image to a new NAND. The TV works fine, no issues anymore except the CI+ error 16 issue (keybag invalid because the processor does not match the keys in this image) Going to standby works, logging looks good... working for 3 days now. So the aparently good originel NAND was crappy, even with zero bad blocks.
I have 2 TV's now with the same MAC address :p
I am not even sure whether the NANDs I got from Aliexpress are junk or not. They program fine, but I've never seen one working in the TV. For personal use it may be ok without CI and with a MAC clone, but selling such a hacked thingy is unfeasible. Ah well, selling 10y-old repaired TVs is hopeless, anyway.
DeleteI assume those mainboard-specific keys fly around somewhere on the file system. Some experts seem to have the means to extract them. I suppose one needs a special Linux hardware with a socket for the NAND and then mount that thing. Same goes for the eMMC chips in later models.
This comment has been removed by the author.
ReplyDelete