Announcement

**Maalobs** · 04-05-2019, 05:16 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Here's a picture of the top side of the board before I soldered on the bodge wires on the SDM and the debug-connector:

Here is the sticker:

Does anyone have memory dumps of the EEPROM, SPI Flash and NAND Flash of this TV model?
I'd really like to try that that route before I attempt to reflow the Fusion processor.

**Diah** · 04-05-2019, 05:38 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

with yours Philips plat forum you can always downgrade or upgrade firmware, boot within autorun.upg

**Maalobs** · 04-05-2019, 07:55 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Hi,

Thanks for replying!

The autorun.upg is encrypted, how do I unpack all the various memory dumps from it?
I read through this old comment thread about cracking the autorun.upg, but it involves security weaknesses in the main software that Philips has consequently fixed:
https://web.archive.org/web/20160421...ilips-pfl9703/
It's no use in my case anyway, because the TV doesn't boot the main software, it just goes into protection mode with a black screen and with error code 53 blinking on the LED.

If you know of a way to flash an autorun.upg on the TV while in this error 53 state, then please let me know how!
That would be really helpful to my situation.

I have already tried the obvious; to have a USB-stick plugged in with autorun.upg in the root of the FAT32 filesystem and then boot the TV both with and without SDM enabled, but nothing happened, the TV just failed into the protection mode as usual.

PS:
What is "Philips plat forum"?

**Diah** · 04-06-2019, 04:45 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Originally posted by Maalobs View Post

Here's a picture of the top side of the board before I soldered on the bodge wires on the SDM and the debug-connector:

Here is the sticker:

Does anyone have memory dumps of the EEPROM, SPI Flash and NAND Flash of this TV model?
I'd really like to try that that route before I attempt to reflow the Fusion processor.

the fault caused while TV working, its much BGA issue not SW.
reflow the Fusion processor a good start. even could be one of the DDR

**Davi.p** · 04-06-2019, 04:33 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I have a 2014 vintage Philips

THe things from 80s are vintage not 2014...
I don't understand this people's hunger for brand new things...
Heart would be better if people would be happy without changing electronics and gadgets every 2-3 years...

error 53 problem could be caused by corruption in either the SPI Flash, in the NAND Flash, the EEPROM , or it could be caused by the Fusion chip itself needing a BGA reflow.

Yes, this is the list that i have isolated in my similar model, even if it's not short, apart the eeprom that read well by programmer.

they have added a thick piece of some sort of EMC foam that is glued with a very strong adhesive right underneath the Fusion chip

How much thick is it? 6-7mm? Its colour? Reddish/purpleish dark grey? Is it gelly? If yes thah is the same silicone bumper like mine, it's enough to pullp it up.

Anyway, reading the logs seems to be possible a software problem, but unless i will not spend that 35 euro for an upgrade to my RT809F programmer i will never know..!
Anyway hoping to find flash contents in internet for free or even paid is out question.. very rare like white fly..

**diif** · 04-06-2019, 04:51 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

The nand contents aren't that hard to find.

https://www.sahy.cz/Philips-QFU1-2E-...BABA-d4318.htm

**Davi.p** · 04-06-2019, 06:01 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

That is not the content, is the programmed chip to buy..

**diif** · 04-06-2019, 09:36 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Originally posted by Davi.p View Post

That is not the content, is the programmed chip to buy..

Yes. Just as a car with a shopping in the boot is a car and shopping.
You said you couldn't find the content and I'm showing it can be found.

**Maalobs** · 04-07-2019, 04:06 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Well, it looks like I have managed to answer a few of my own questions.

4.
Der Alpengeist actually explains the remote control trick in another blogpost:

The first thing to do is to start the emergency software installation.
For that, you need an infrared remote, which does not come with the TV.
You can get one for around 10€.
The reason being that the software, which manages the original radio remote control will not be loaded under such circumstances.

Disconnect the TV from the mains
Press OK or DOWN on the remote and hold it
Plug in the mains.

I did that and the recovery program came up.
Good!
This means that the screen, the backlight, and the main processor are doing fine.

I interpret that as a software feature executing in the main processor, not in the standby processor, so again it's not useful in my case.
I still tried it with every IR remote control in my house, but nothing happened.
Now that I had more details, I found a description of this in the service manual, in a flowchart on page 36.
Maybe there is room here to investigate this further with a verified Philips IR remote control.

7.
Your talk about the foam gave me the confidence to try again to lift the SSB.
The sticky foam covers a 5x5cm section right under the center of the SSB, and if you try to lift the PCB by the edges it goes all U-shaped in the profile.
But I eventually managed to dislodge the PCB, even without damaging the underlying foam!
Thanks for the encouragement!

Now I have full access to all the memory chips:

Some of the solder joints seem to have been covered with a nail polish-like conformal coating of some kind:

The NAND Flash is not the exact same part number as was specified in the service manual:

This is MT29F8G08ABABA, but it seems the same datasheet covers both.

Finally the EEPROM is accessible too:

I don't know what those two round epoxy blobs are good for.
There is nothing significant there according to the bottom layout schematic in the service manual.

One piece remains;
If anyone is able to help me out with memory dumps for this TV model, then please post them here.

I really want to try that route before I start butchering the Fusion chip with my totally inadequate hot air gun.
If I mess up that BGA reflow, it's finito for this SSB.

**Davi.p** · 04-07-2019, 08:44 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

For the point 4:
I have already tried some times ago this method but even if the RC is ok (led blinks) the tv makes no output on video, the usb pen lights up the light for some sec. then back off, then on and off several times until the led error code.I have done another try and for now i have done it with the file named software.upg and placed on to UPGRADES directory, no other files in. You have explained very few, how it does exactly? If it doesn't work it will appear something about error... not?

**Diah** · 04-07-2019, 09:34 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

well i found out Reflow the CPU enough to make it boot, with out change NAND or do BGA ball for CPU too, easy way. folow this English version of German side

**Maalobs** · 04-10-2019, 08:48 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Originally posted by Davi.p View Post

For the point 4:
I have already tried some times ago this method but even if the RC is ok (led blinks) the tv makes no output on video, the usb pen lights up the light for some sec. then back off, then on and off several times until the led error code.

Yes, that's because it does 7 boot attempts before it falls into Protection Mode, and only when it has arrived there will it blink the error code.
I saw some cyclic changes in measurements in power readings too before I started reading the UART output, then later I realized that the measurements were just side channel noise from the ongoing reboot cycle.

Originally posted by Davi.p View Post

For the point 4:
I have done another try and for now i have done it with the file named software.upg and placed on to UPGRADES directory, no other files in. You have explained very few, how it does exactly? If it doesn't work it will appear something about error... not?

I didn't have any other Philips remote controls and the TV was completely unresponsive to those I had.
But I went out and bought a Philips IR remote and when I use the new remote, there is actually response from the TV.

I plugged in the USB-stick again with autorun.upg in the root folder.

First I booted the TV in SDM while reading TXD-SERVICE, and holding down OK on the IR-remote when I plugged in the mains power.
Now I got new output:

Code:

0xF98A30E2 cycle now
Jump to 0xB5034100 02 key is used
Getting Hash...
0xBFC00000 01 10 00 00 52 55 00 0F 36 74 B3 80 00 00 00 00
Hash:
0xB5034570 1D 86 AE FF E3 71 65 8F 13 61 12 66 C4 5F 8D B0
Buffer for BIG NUM is at B5034E2C, size is 0440.
nand.c:nand_readwithinpage
0x00000000 page is reading
0x00000004 0x00000007 0x00000000 StartUnit/EndUnit/offset
Reading out data:
 04 unit:


waiting ECC result ready
 00 bits error in the unit.
 05 unit:


waiting ECC result ready
 00 bits error in the unit.
 06 unit:


waiting ECC result ready
 00 bits error in the unit.
 07 unit:


waiting ECC result ready
 00 bits error in the unit.

nand.c:nand_readwithinpage
0x00000001 page is reading
0x00000000 0x00000003 0x00000000 StartUnit/EndUnit/offset
Reading out data:
 00 unit:


waiting ECC result ready
 00 bits error in the unit.
 01 unit:


waiting ECC result ready
 00 bits error in the unit.
 02 unit:


waiting ECC result ready
 00 bits error in the unit.
 03 unit:


waiting ECC result ready
 00 bits error in the unit.

nand.c:nand_readwithinpage
0x00000001 page is reading
0x00000004 0x00000007 0x00000000 StartUnit/EndUnit/offset
Reading out data:
 04 unit:


waiting ECC result ready
 00 bits error in the unit.
 05 unit:


waiting ECC result ready
 00 bits error in the unit.
 06 unit:


waiting ECC result ready
 00 bits error in the unit.
 07 unit:


waiting ECC result ready
 00 bits error in the unit.

nand.c:nand_readwithinpage
0x00000002 page is reading
0x00000000 0x00000000 0x00000000 StartUnit/EndUnit/offset
Reading out data:
 00 unit:


waiting ECC result ready
 00 bits error in the unit.


{preboot}
 <000>
 <010>
 <020>KKG0G1                                           <------------ This is the line where it would previously stop!
 <030>DDDDDDDDDDDDDD
 <040>secure
      Load uboot


U-Boot 2009.01_Production (Jun 11 2013 - 10:29:06)

UNAND: NAND, size:1024MB, Micron(ID:0x2c,0x38), block size:512KB
1024 MiB
Env:  NAND @ 0x01800000
bootcmd4
BOOTREASON=upgrade
APP CPU==>1GHz
Found: /boot
Found: /bootenv
Found: /systemA
Found: /systemB
Found: /rwboot
Found: /rwdata
Found: /bbt
Found 7 partitions
Creating 1 MTD partitions on "NAND 1GMiB 3,3V 8-bit":
0x02e00000-0x0fd00000 : "mtd=2"
UBI: attaching mtd0 to ubi0
UBI: physical eraseblock size:  524288 bytes (512 KiB)
UBI: logical eraseblock size:  516096 bytes
UBI: smallest flash I/O unit:  4096
UBI: VID header offset:     4096 (aligned 4096)
UBI: data offset:        8192
UBI: fixable bit-flip detected at PEB 88
UBI: fixable bit-flip detected at PEB 269
UBI: fixable bit-flip detected at PEB 302
UBI warning: ubi_eba_init_scan: cannot reserve enough PEBs for bad PEB handling, reserved 4, need 40
UBI: attached mtd0 to ubi0
UBI: MTD device name:      "mtd=2"
UBI: MTD device size:      0 MiB
UBI: number of good PEBs:    414
UBI: number of bad PEBs:     0
UBI: max. allowed volumes:    128
UBI: wear-leveling threshold:  4096
UBI: number of internal volumes: 1
UBI: number of user volumes:   2
UBI: available PEBs:       0
UBI: total number of reserved PEBs: 414
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 21/5
simple_strtoul
simple_strtoul ret
Authenticating ubootenvaddon.tdf....offset: 0x288 (648)
pld->payloadSize: 0x8c4 (2244)
sizeof(TdfSignedPayload_t): 0x104 (260)
sizeof(TdfPayloadHeader_t): 0x8 (8)
pData=82400000 count=0x7b8 (1976)
bucket=0x7b8 (1976)
suceeds
## Executing script at 82400000
U-boot script: %version: blr18mgr#42.1.5 % -- %created_by: rp_int % -- %date_created: Thu Jul 4 11:18:12 2013 % -- addon=%version: 31 % /// creator!= the helpdesk
simple_strtoul
simple_strtoul ret
Authenticating appmipsauth.tdf....offset: 0x288 (648)
pld->payloadSize: 0x2c04 (11268)
sizeof(TdfSignedPayload_t): 0x104 (260)
sizeof(TdfPayloadHeader_t): 0x8 (8)
pData=a5c00000 count=0x2af8 (11000)
bucket=0xd78 (3448)
suceeds
## Starting application at 0xA5C00000 ...
999simple_strtoul
simple_strtoul ret
Authenticating vmlinux_plf.tdf....offset: 0x288 (648)
UBI: fixable bit-flip detected at PEB 132
UBI: schedule PEB 132 for scrubbing
UBI: fixable bit-flip detected at PEB 134
UBI: schedule PEB 134 for scrubbing
suceeds
simple_strtoul
simple_strtoul ret
Authenticating vmlinux_app.tdf....offset: 0x288 (648)
UBI: fixable bit-flip detected at PEB 135
UBI: schedule PEB 135 for scrubbing
UBI: fixable bit-flip detected at PEB 135
UBI: schedule PEB 135 for scrubbing
UBI: fixable bit-flip detected at PEB 135
UBI: schedule PEB 135 for scrubbing
UBI: fixable bit-flip detected at PEB 136
UBI: schedule PEB 136 for scrubbing
suceeds
simple_strtoul
simple_strtoul ret
Authenticating display.tdf....offset: 0x288 (648)
UBI: fixable bit-flip detected at PEB 144
UBI: schedule PEB 144 for scrubbing
suceeds
simple_strtoul
simple_strtoul ret
Authenticating avdecoder.tdf....offset: 0x288 (648)
UBI: fixable bit-flip detected at PEB 138
UBI: schedule PEB 138 for scrubbing
UBI: fixable bit-flip detected at PEB 139
UBI: schedule PEB 139 for scrubbing
UBI: fixable bit-flip detected at PEB 140
UBI: schedule PEB 140 for scrubbing
UBI: fixable bit-flip detected at PEB 141
UBI: schedule PEB 141 for scrubbing
UBI: fixable bit-flip detected at PEB 143
UBI: schedule PEB 143 for scrubbing
suceeds
commandline passed to kernel is = mem=40m@72m mem=354m@2206m vecaddr=2m@70m loglevel=3 lpj=1949696 ipcfg_preopen_dly=0 ipcfg_postopen_dly=0 BOOTREASON=upgrade ip=172.21.1.2::172.21.1.1:255.255.0.0::vec0:off root=/dev/nfs rw nfsroot=172.21.1.1:/,udp,rsize=32768,wsize=32768,timeo=600,retrans=2,nfsvers=3 ph_debug=none ph_sys=A ph_def=A ph_alt=B
## Starting application at 0x80100800 ...
flush cache do_go 82
commandline passed to kernel is = console=ttyS0,115200n8 mtdparts=NAND:24m(/boot),22m(/bootenv),207m(/systemA),207m(/systemB),72m(/rwboot),468m(/rwdata),24m(/bbt) mem=70m@0k mem=80m@2126m vecaddr=2m@70m loglevel=3 lpj=1363968 lockd.nlm_grace_period=1 mm_ra_disable=1 BOOTREASON=upgrade ubi.mtd=3 secureblock.hook=31:9 root=f900 rootfstype=squashfs ip=none ph_debug=none ph_sys=A ph_def=A ph_alt=B
 address of cmdlineparam = 80f34b24
[  0.328630] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(249,0)

It's reading the Micron NAND Flash and detecting a bunch of "fixable bit-flips", before ending in a kernel panic because of a filesystem error on the last line.
Nothing else happened after this line.
The screen remained black, and the LED started blinking error code 53.

After a few minutes I unplugged the mains power and disabled SDM.
Still reading TXD-SERVICE, I booted the TV again with the IR remote trick.
There was no change in the output from my original reading which I have described in the original post.
The screen remained black, and the TV was cycling through the boot attempts as before.

I switched to reading TXD-STANDBY and repeated the boot again, both with and without SDM, but again there was no change in the output compared to what I have described in my original post.
There was one difference in that each time I pressed a key on the IR remote, it was reflected in the UART output.
Pressing "OK" on the IR remote resulted in "TV_OK" being printed on the screen, etc.
The screen again remained black.

Now I switched back to the first mode again where I had the new output; reading TXD-SERVICE with SDM enabled.
But again, I am only getting the output of the original post, where it stops mid sentence on the "<020>K" line.
I can't reproduce the new output anymore, it only worked once, and therefore maybe it was just a coincidence?

And anyway, the TV never got so far as to enter any kind of software upgrade mode.

I was off this problem for a few days because to add insult to injury, my notebook died as well with what I eventually concluded was a system board error.
But I have ordered a new computer now and the old hunk o' junk is shelved until the day I find schematics and a boardview for it.

I'm thinking that now when I have the back of the SSB exposed, I should find and measure the power rails on that side, just to be 100% sure that there is no fundamental problem on the board, even though everything was 100% functional on the top side.

**Maalobs** · 04-10-2019, 08:49 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Maybe there are two problems here:
1.
Something is causing the TV to freeze mid boot, but after I had pulled the SSB off the glue I managed to glitch it into booting past the freeze once.
Possible causes; bad power or reflow required?

2.
That one successful boot exposed another possible problem with corrupt data in the NAND Flash.
Still haven't found a dumpfile of the NAND memory, so this is untestable at the moment.

**mmartell** · 04-11-2019, 08:04 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

You say you don't want to reflow the processsor but have you heated it ? This is a common failure point in all kinds of sets and will no doubt give different errors sending you down a possible rabbit hole that isn't there.

I would recommend to heat it good with a hair dryer so any iffy joint expands enough to allow the set to boot properly, if that's the problem.

**Davi.p** · 04-11-2019, 01:08 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Sorry, i've misunderstanded and thought that you had bought the remote and got an output, but that was a quoting of a blog.. just for information i've used a remote from a little older Philips TV.
I want to thank you very much because you're doing the big work and save me to move my fat ass and do the tests you done, after reading the last log i'm pretty convinced that the fault is at the nand flash, i was hard suspecting that after the previous post and i had already contacted an ebay seller for a replacement NAND flash W/program stored, but me too i want to do read the logs from mine, even because it's the first time.
I ask you because i have some trouble reading well all posts, then you have succesfully booted the tv once before?

**diif** · 04-11-2019, 06:10 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Originally posted by Maalobs View Post

Maybe there are two problems here:
1.
Something is causing the TV to freeze mid boot, but after I had pulled the SSB off the glue I managed to glitch it into booting past the freeze once.
Possible causes; bad power or reflow required?

2.
That one successful boot exposed another possible problem with corrupt data in the NAND Flash.
Still haven't found a dumpfile of the NAND memory, so this is untestable at the moment.

The readout shows the NAND is worn out and clearly struggling. It needs replacing.

**Davi.p** · 04-15-2019, 12:21 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

OK hear well me.. in this link:
-- LINK --
You can easily register and in 3 minutes you can download NAND dump for 46PFL8008S, then you can flash a memory and put it on the board, i guess there's no problem of compatibility high enough to prevent boot up, as an user of a forum told me, that has swapped 2 boards of different model same chassis.. then you don't boot first normally but you force an update for the right model, then you can boot up and go service mode (SAM) and do a full reset, if tv doesn't boot or boot with no image then try to clean the eeprom memory with a short on pin 5,6 or a eeprom programmer job, then try to boot. I hope you'll find it useful, if it will work i will soon order a PEB-1 expansion for my RT809F programmer and do the same job.. bye..

PS: after SAM reset don't forget to edit in SAM the Option codes on the rear label..

**Maalobs** · 04-17-2019, 10:37 AM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

I have investigated every single regulator and mosfet on the underside of the SSB, and they are all OK.
So there are no other complicating factors, besides what the NAND complains about and the possible BGA problem.

I pulled off the heatsink from the Fusion chip, these are the markings on it:

I guess I need a stencil for that chip if I'm doing a proper reflow, and there are stencils to buy online.
But what's the name of that chip form factor?
I couldn't find a datasheet for the chip, the company is going tits up:
https://www.sigmadesigns.com/
Just generally heating the chip and hoping to reball, is that a good idea?

I have downloaded that rar-file from the Romanian forum, but apparently it's a multi-volume archive, and there is no second part offered in the thread:

Code:

C:\temp>rar x PHILIP_1-electronicforum.ro.RAR

RAR 5.70 x64  Copyright (c) 1993-2019 Alexander Roshal  25 Feb 2019

Extracting from PHILIP_1-electronicforum.ro.RAR

Extracting Philips_46PFL8008S12_QFU1.2E LA_NAND.bin         99%
Cannot find volume PHILIP_2-electronicforum.ro.RAR
Philips_46PFL8008S12_QFU1.2E LA_NAND.bin - checksum error
Total errors: 1

C:\temp>

Did you manage to download an intact archive?
If you did, I must have been given a corrupt file.

If I start flashing in firmware for the wrong TV model here, I need to understand what I'm getting myself into.
From the block diagram on page 57 in the service manual, I can deduce that there are NVM settings stored both in the EEPROM and in the SPI Flash, so maybe it's safe to replace the NAND, unless the linux-system detects that it is in a new system and resets the NVM-values.
I guess I should take copies of these memories if I want to make sure I don't lose factory calibration against this particular panel?

The "Option codes", are they the eight sets of five-digit codes on the rear label?
I attached a photo of the label in my original post.

If I don't get anywhere with this, I guess I'll have to buy a NAND-chip from that Czech webshop, and to be safe, let some local repair shop with reflow tools do the BGA reflow.
Worst case, I'd have to replace the SSB, and I don't know how to deal with the alignments in that case since I can't boot the current linux-system and backup the current settings.

**Davi.p** · 04-17-2019, 04:16 PM

Re: Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

but apparently it's a multi-volume archive

Sob! not good.. there's another site that offers all the .rar parts of the same dump:
https://www.elektroda.pl/rtvforum/to....html#15969068
I don't know if the registering is easy..

The "Option codes", are they the eight sets of five-digit codes on the rear label?

Yes, i think that the firmwares of different models of the same chassis is about the same, after there are different settings stored in eeprom.. and spi if you say right.. maybe if you write the different model's nand memory you don't lost the RF remote's settings but after an update maybe yes...
For the czech site i remember that it lists the wrong models for the chassis type, therefore QFU1.2E_LA have nothing to deal with 47pfl6007 and others.. i have emailed them but no responses after many days..

Announcement

Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Philips 60PFL8708S/12 - QFU1.2E LA - Error code 53

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment