Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

[HermannS]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Hello folks, Herr Alpengeist speaking :-)

I found this thread while going through the visitor stats of my blog. Thanks for stopping by!

I gave up on the QFU boards. It is pure luck whether the CPU will wake up or not. I had reflowed and reballed the heck out of these things and never got any repeatable results. The QFU1.1 boards are so thin that they warp terribly. The QFU1.2 are a bit better in that respect. I am pretty sure that the CPU is to blame and not some balls. The infamous "K" error appears in both QFU1.1 and 1.2 models. Their board layout is different. It would be a big coincidence if the same balls broke. No, I think the CPU is to blame.

Only the case when the device is totally dead with a scrambled boot SPI has a 100% repair success rate. Alas, I only had that once. All others were CPU-related.

There are P120 CPUs (QFU1.1 and QFU1.2 6008 models) on eBay from Poland. They look legit. Unfortunately, the P240 CPU for the higher QFU1.2 models (7008, 8008) are not available.

I suggest that one reheat attempt (without full reflow because that's not the issue) at about 225°C can be done and if that doesn't fix it: dump it. Sad but true. A terrible TV series that was.

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I forgot to mention; I have posted the contents of the SPI Flash and I2C EEPROM in this sticky thread, in case anyone has use for them:
https://www.badcaps.net/forum/showpo...&postcount=533

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Yes, in fact It's a strange program, i can modify data and set write mode but i've realized the writing is not functional..

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

It's shareware so technically you should pay for it, but I'll agree to calling it "free".

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

The SW i've said is free...

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Sure, if you want to pay money for something that's free.
I don't normally use Linux but it's something I have needed to learn to be able to get things done.
In this case, I booted my laptop from a USB-stick with Knoppix, one of many different bootable live systems with Linux.
It's quite handy to have ready for occasions like this.

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

From Windows you can use MonInfo software from Entech to read/write EDID..

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I'm finished with everything on the TV now, hopefully it will have many more good years left in it.

The new heatsink is in place:



I also put a small heatsink on the NAND-chip, but it's on the underside of the board so it's not visible here.

The chassis got a classic redneck solution:







Say hello to my little friend:


Thanks for all your help guys!

I have squirreled away all the firmware images from this model, so let me know if you need a copy of anything.

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

While I was at it, I also took a backup of the EDID config in the TV.
The EDID is stored in this chip:


Apparently it's a huge hassle to get access to the datasheet for it from Lattice, who nowadays owns Silicon Image.
But it's not needed, there is just one detail there that is important to know; this particular chip does not support writing to EDID via HDMI, it must be done through the I2C-bus.
Once you know that, you can handle writing any corrupt bytes in the register with a BusPirate or a Raspberry Pi.

Reading the EDID works through HDMI of course, here is how it's done from a computer with Linux that has the HDMI-output connected to one of the inputs on the TV:

knoppix@Microknoppix:~$ su -
root@Microknoppix:~# modprobe i2c-dev
root@Microknoppix:~# apt-get update
root@Microknoppix:~# apt-get install i2c-tools

# List the available I2C-buses on your computer:
root@Microknoppix:~# i2cdetect -l | sort
i2c-0 smbus   SMBus I801 adapter at 3040   SMBus adapter
i2c-1 i2c     i915 gmbus ssc         I2C adapter
i2c-2 i2c     i915 gmbus vga         I2C adapter
i2c-3 i2c     i915 gmbus panel         I2C adapter
i2c-4 i2c     i915 gmbus dpc         I2C adapter
i2c-5 i2c     i915 gmbus dpb         I2C adapter
i2c-6 i2c     i915 gmbus dpd         I2C adapter
i2c-7 i2c     DPDDC-A             I2C adapter

# List all available device addresses on each I2C-bus, then look for any device address 0x50 in the output:

root@Microknoppix:~# perl -we 'system("i2cdetect -y $_") for 0..7'
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- 08 -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- 3a -- -- -- -- --
40: 40 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: 50 -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- <- 0x50 here
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     -- -- -- -- -- -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            
   0 1 2 3 4 5 6 7 8 9 a b c d e f
00:     03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f
10: 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
20: 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f
30: -- -- -- -- -- -- -- -- 38 39 3a 3b 3c 3d 3e 3f
40: 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --            

# Only one instance of address 0x50 on this computer, on the 5th I2C-bus, so dump the values of that device on that bus:

root@Microknoppix:~# i2cdump -y 5 0x50
   0 1 2 3 4 5 6 7 8 9 a b c d e f  0123456789abcdef
00: 00 ff ff ff ff ff ff 00 41 0c 00 00 01 01 01 01  ........A?..????
10: 2a 16 01 03 80 84 4a 78 0a e6 92 a3 54 4a 99 26  *?????Jx????TJ?&
20: 0f 4a 4c 21 08 00 b3 00 95 00 a9 40 90 40 81 00  ?JL!?.?.?.?@?@?.
30: 81 80 81 40 01 01 02 3a 80 18 71 38 2d 40 58 2c  ???@???:??q8-@X,
40: 45 00 00 d0 52 00 00 1e 02 3a 80 d0 72 38 2d 40  E..?R..??:??r8-@
50: 10 2c 45 80 00 d0 52 00 00 1e 00 00 00 fc 00 50  ?,E?.?R..?...?.P
60: 68 69 6c 69 70 73 20 46 54 56 0a 20 00 00 00 fd  hilips FTV? ...?
70: 00 30 3e 0f 46 11 00 0a 20 20 20 20 20 20 01 93  .0>?F?.?   ??
80: 02 03 3a f1 52 10 1f 20 22 21 05 14 04 13 12 03  ??:?R?? "!??????
90: 11 02 16 07 15 06 01 26 09 1f 07 15 07 50 83 01  ???????&?????P??
a0: 00 00 70 03 0c 00 10 00 38 2d af 4c 4c d0 04 01  ..p??.?.8-?LL???
b0: 40 01 ff e3 05 03 01 e2 00 49 01 1d 80 3e 73 38  @?.?????.I???>s8
c0: 2d 40 7e 2c 45 80 00 d0 52 00 00 1e 01 1d 80 d0  -@~,E?.?R..?????
d0: 72 1c 16 20 10 2c 25 80 00 d0 52 00 00 9e 01 1d  r?? ?,%?.?R..???
e0: 00 bc 52 d0 1e 20 b8 28 55 40 00 d0 52 00 00 1e  .?R?? ?(U@.?R..?
f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a  ...............J

# Save the results:

root@Microknoppix:~# i2cdump -y 5 0x50 > dump.txt
root@Microknoppix:~# mv dump.txt /home/knoppix/
root@Microknoppix:~# chown knoppix:knoppix /home/knoppix/dump.txt
root@Microknoppix:~# logout
knoppix@Microknoppix:~$ logout

Here are some references about reading the EDID:
https://www.youtube.com/watch?v=IGg1nyTY6oc
https://www.youtube.com/watch?v=8IMkGdeXcS4
https://en.wikipedia.org/wiki/Extend...ification_Data

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Ok thanks!

[diif]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

https://www.ebay.co.uk/itm/9x9-FNP10...-/273592452088

0.6mm balls.

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I cannot wait for the stencil to arrive to know which is the balls size to order and wait another month or two to begin the job.. i think i will spend half an hour or less to place the balls by hand so maybe i can do it so..

[diif]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Which stencil?? I have no stencil obviously.. I will not use it..
My reflow worsen the situation so i go for reballing and if does not work maybe a new chip ordered..

My mistake, they cost £10/$10/€10 and it saves having to manually place 788 balls. Why would you not buy one ?

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Which stencil?? I have no stencil obviously.. I will not use it..
My reflow worsen the situation so i go for reballing and if does not work maybe a new chip ordered..

[diif]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

You're correct Maalobs, the procedure your guy did was a reflow.

Davi.P The ball sizes are usually indicated on the stencil.

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

He did not do a "reball" or "reflow" with a stencil, all he did was to re-heat the BGA chip with a powerful hot air station, and then when the chip was "dancing" on the molten balls, he gently tapped a corner of the chip to make it break surface tension on any balls that were not in contact with the upper or lower pad.
I don't know what it's called so I just referred to it as "reflow", sorry for the confusion.

This is more art than science I guess, he explained how he had become quite proficient in this method on PS4 repairs over the years.

So I have no answer to your question, sorry.

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Hi Maalobs, can i ask you a pleasure? Can you ask to your repairer which is the size of the balls he used? So i can put hands on the board only one time... I have too many TVs to fix, it's a problem here! Bye!

[Davi.p]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I think you have understood the method, but the first erase is unuseful 'cause is done by the writing process..

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

The bad block management is apparently covered in one of the instruction videos from iFix, but I hadn't come that far in the videos yet.
I skipped ahead to this video:
https://www.youtube.com/watch?v=9DngDjI0KNU

The datasheet from Micron also had a brief introduction to the concept.

Based on the instruction video, I have done the following:
1. Desolder the new NAND-chip again so I can work on it in the RT809H.
2. Erase the memory of the NAND-chip.
3. Run Bad block detection. (no errors detected)
4. Click Setting (N) and change copy mode to Skip Bad Block and Rebuild BBT.
5. Write my original "Read 3" dump into the memory again.
6. Read out the memory to a new dump-file.

Have I correctly understood the basic theory of how to use the Bad Block feature in the software?

Here is the log from the iFix software:

004: The currently selected:MT29F8G08ABABA@TSOP48, capacity: 8640Mbits, 1080Mbytes.
005: Adapter model£ºRT-TSOP48-1, 0.5, 12*18, Pin to Pin
006: http://www.ifix.net.cn/thread-53859-1-2.html
007: Download device programming algorithm......
008: Algo update OK
009: >------------------------------------OK---------------------------------------<
**** Erase begins ****
012: Chip pins contact is detected OK.
013: TotalPageNum: 0x40000,PageNumInBlock: 128,PageSize: 4320
014: Chip ID verification OK.
015: Start erasing chip, please be patient......
016: Erase successful£¬Elapsed time£º1.743 seconds¡£
017: >------------------------------------OK---------------------------------------<
**** Bad block detection begins ****
018: Chip pins contact is detected OK.
019: TotalPageNum: 0x40000,PageNumInBlock: 128,PageSize: 4320
020: Chip ID verification OK.
021: TotalBlockNum: 2048
022: No bad blocks were found.
023: >------------------------------------OK---------------------------------------<
**** Write begins ****
024: Chip pins contact is detected OK.
025: TotalPageNum: 0x40000,PageNumInBlock: 128,PageSize: 4320
026: Chip ID verification OK.
027: Start writing chip......
028: Auto erasing...
029: Erase successful£¬Elapsed time£º1.18 seconds¡£
030: Start writing...
031: Algorithm equal to : Skip Bad Block and Rebuild BBT
032: Write and verify success.
033: Elapsed time: 687.9 seconds£¬average speed of 3292447 bytes/sec.
034: >------------------------------------OK---------------------------------------<
**** Read begins ****
035: Chip pins contact is detected OK.
036: TotalPageNum: 0x40000,PageNumInBlock: 128,PageSize: 4320
037: Chip ID verification OK.
038: F:\Philips\readbbt.bin
039: Start reading chip......
040: Buffer data checksum: 16bits_0xDD76 £¬32bits_0x8198DD76 :
041: Read successful£¬Elapsed time£º536.3 seconds¡£
042: Auto verifying...
043: All bytes verification is consistent.
044: Verification successful£¬Elapsed time£º536.3 seconds¡£
045: Elapsed time: 1073 seconds£¬average speed of 2111703 bytes/sec.
046: >------------------------------------OK---------------------------------------<

I then ran a comparison between the "Read 3" dumpfile and the new dumpfile:

cmp -l read3.bin readbbt.bin > 3_BBT.txt

Here is how the output of the cmp command works; on each row, the first column is the offset in decimal in the files at which a difference was detected.
The second column is the value in octal in the first file at that offset.
The third column is the value in octal in the second file at that same offset.

This is the output of the cmp command:

1131360260 61 377
1131360261 164 377
1131360262 142 377
1131360263 102 377
1131360264  1 377
1131360369 137 377
1131360370 251 377
1131360371 344 377
1131360372 264 377
1131360373 140 377
1131360374 163 377
1131360375 247 377
1131360376 52 377
1131360377 354 377
1131360378 207 377
1131360379 311 377
1131360380 32 377
1131360381 246 377
1131360382 141 377
1131360383 137 377
1131360384 251 377
1131360385 344 377
1131360386 264 377
1131360387 140 377
1131360388 163 377
1131360389 247 377
1131360390 52 377
1131360391 354 377
1131360392 207 377
1131360393 311 377
1131360394 32 377
1131360395 246 377
1131360396 141 377
1131360397 137 377
1131360398 251 377
1131360399 344 377
1131360400 264 377
1131360401 140 377
1131360402 163 377
1131360403 247 377
1131360404 52 377
1131360405 354 377
1131360406 207 377
1131360407 311 377
1131360408 32 377
1131360409 246 377
1131360410 141 377
1131360411 137 377
1131360412 251 377
1131360413 344 377
1131360414 264 377
1131360415 140 377
1131360416 163 377
1131360417 247 377
1131360418 52 377
1131360419 354 377
1131360420 207 377
1131360421 311 377
1131360422 32 377
1131360423 246 377
1131360424 141 377
1131360425 137 377
1131360426 251 377
1131360427 344 377
1131360428 264 377
1131360429 140 377
1131360430 163 377
1131360431 247 377
1131360432 52 377
1131360433 354 377
1131360434 207 377
1131360435 311 377
1131360436 32 377
1131360437 246 377
1131360438 141 377
1131360439 137 377
1131360440 251 377
1131360441 344 377
1131360442 264 377
1131360443 140 377
1131360444 163 377
1131360445 247 377
1131360446 52 377
1131360447 354 377
1131360448 207 377
1131360449 311 377
1131360450 32 377
1131360451 246 377
1131360452 141 377
1131360453 137 377
1131360454 251 377
1131360455 344 377
1131360456 264 377
1131360457 140 377
1131360458 163 377
1131360459 247 377
1131360460 52 377
1131360461 354 377
1131360462 207 377
1131360463 311 377
1131360464 32 377
1131360465 246 377
1131360466 141 377
1131360467 137 377
1131360468 251 377
1131360469 344 377
1131360470 264 377
1131360471 140 377
1131360472 163 377
1131360473 247 377
1131360474 52 377
1131360475 354 377
1131360476 207 377
1131360477 311 377
1131360478 32 377
1131360479 246 377
1131360480 141 377
1131913220 102 377
1131913221 142 377
1131913222 164 377
1131913223 60 377
1131913224  1 377
1131913329 137 377
1131913330 251 377
1131913331 344 377
1131913332 264 377
1131913333 140 377
1131913334 163 377
1131913335 247 377
1131913336 52 377
1131913337 354 377
1131913338 207 377
1131913339 311 377
1131913340 32 377
1131913341 246 377
1131913342 141 377
1131913343 137 377
1131913344 251 377
1131913345 344 377
1131913346 264 377
1131913347 140 377
1131913348 163 377
1131913349 247 377
1131913350 52 377
1131913351 354 377
1131913352 207 377
1131913353 311 377
1131913354 32 377
1131913355 246 377
1131913356 141 377
1131913357 137 377
1131913358 251 377
1131913359 344 377
1131913360 264 377
1131913361 140 377
1131913362 163 377
1131913363 247 377
1131913364 52 377
1131913365 354 377
1131913366 207 377
1131913367 311 377
1131913368 32 377
1131913369 246 377
1131913370 141 377
1131913371 137 377
1131913372 251 377
1131913373 344 377
1131913374 264 377
1131913375 140 377
1131913376 163 377
1131913377 247 377
1131913378 52 377
1131913379 354 377
1131913380 207 377
1131913381 311 377
1131913382 32 377
1131913383 246 377
1131913384 141 377
1131913385 137 377
1131913386 251 377
1131913387 344 377
1131913388 264 377
1131913389 140 377
1131913390 163 377
1131913391 247 377
1131913392 52 377
1131913393 354 377
1131913394 207 377
1131913395 311 377
1131913396 32 377
1131913397 246 377
1131913398 141 377
1131913399 137 377
1131913400 251 377
1131913401 344 377
1131913402 264 377
1131913403 140 377
1131913404 163 377
1131913405 247 377
1131913406 52 377
1131913407 354 377
1131913408 207 377
1131913409 311 377
1131913410 32 377
1131913411 246 377
1131913412 141 377
1131913413 137 377
1131913414 251 377
1131913415 344 377
1131913416 264 377
1131913417 140 377
1131913418 163 377
1131913419 247 377
1131913420 52 377
1131913421 354 377
1131913422 207 377
1131913423 311 377
1131913424 32 377
1131913425 246 377
1131913426 141 377
1131913427 137 377
1131913428 251 377
1131913429 344 377
1131913430 264 377
1131913431 140 377
1131913432 163 377
1131913433 247 377
1131913434 52 377
1131913435 354 377
1131913436 207 377
1131913437 311 377
1131913438 32 377
1131913439 246 377
1131913440 141 377

Looking at the output, what stands out is that there are two ranges of almost linear offsets, and that on every single line, the new value is 0377, which is the same as 0xFF.

The difference is more clearly visualised here in WinMerge, a graphical diff tool in which I am comparing the "Read 3" dumpfile on the left and the new dumpfile on the right:


And here again at the second range:


I wonder if that is perhaps the result of the Bad Block Table from the old and worn chip now having been cleared, when the dump was written into the new chip?

[Maalobs]

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Great, I've already soldered a new chip back onto the board.
Those things that you mentioned are not explained in the so-called documentation for the RT809H.
Can you post the link to that Youtube-video?