357902 URC-625000-04R00 OSN JP1.4

[mathdon]

I think it is possible that this timing for this remote is somewhat different than we currently assume in JP12Serial.dll.

It seems to me that the problem is more than one of timing. With RealTerm, changing the RTS setting from Set to Clear does not produce 2 flashes, as it does with other JP1.4 remotes. Instead it turns the backlight on. A reset caused by removing and replacing a battery DOES give 2 flashes, so RTS appears not to be connected to a reset pin. In fact, we don't even know whether this is a JP1.4 remote or even what the processor is, as Randy's internal pics show that UEI has put black blobs on the processor and another LSI chip. As far as I know, the only reason we say this is JP1.4 is that it has a 6-digit signature beginning with 3, as with other JP1.4 remotes. (Blinking back the signature gives 5 values, but with 5-value blinkbacks the 5th value encodes TWO digits as a version number that can be greater than 9, although we have never seen that.)

Any ideas you have on how to proceed would be very welcome. At the moment I am baffled by it.

[HamburgerHelper1]

My URC2060 appears to do the 9xx command 968 2 blinks then enter 4 digit s
to make the backup segments and 977 to restore
so that part appears to be JP1.4
Although 9xx command 974 does activate/deactivate the back light which is different from JP1.4 remotes
Im not sure you should try it on yours yet and actually set the backup segments
since i have already done it on mine my remote can be a guinea pig for tests
I still have mine apart and still wonder if the pin assignment is different

[mathdon]

Counting the wires going to the processor in Randy's image, I see 23 with gaps that suggest the number of processor pins might be 24, 25 or 26. There appears to be an S3F80P5X which has a 24-pin package. So this is one possibility for the processor.

[HamburgerHelper1]

Thank You Graham for the Processor Idea
I downloaded the data sheet and added it here
http://www.hifi-remote.com/forums/dload ... e_id=26879
From what i thought that they have the pins different
i plugged my jp1 cable in backwards so that the cables pin 1 is on the opposite side of what the remote says is pin 1
Real term is a little finicky and had to click to place curser in the terminal window but the clear/set sequence gives me a response of 2 blinks on the remote cable button and then the backlight turns on then off right away RMIR also gave me the same results of 2 blinks and backlight on then instantly off but no raw download and download remote RMIR message is "preparing"
I hope this means some progress maybe other pins are wrong too?

[HamburgerHelper1]

Somehow I suspect that with the backlight turning back off instantly
is that it is disconnecting the connection

[mathdon]

Hi Randy, this post of mine has overlapped with yours so I haven't tried to relate our findings.

As far as I can tell from Randy's pictures, they seem to be consistent with the processor being the S3F80P5X 24-pin chip. Here is a link to the datasheet. The black blob covering the chip seems a bit small to cover it, but the connections seem to work OK. Looking at the black blob on Randy's image, the chip pin numbering is anticlockwise. The three wires on the right that exit the blob horizontally, upward from the lowest of these pins, seem to be pins 4, 5, 6. The first two above these that exit vertically upward are then 7 and 8. These pins are 4=TEST, 5=SDAT/P0.0/INT0, 6=SCLK/P0.1/INT1, 7=nRESET/P0.2/INT2, 8=P0.3/INT3 from the user manual.

I take it that in Randy's image we are looking at the underside of the 6-pin connector, so pin 1 is at the top left. There appear to be connections to all six pins. It appears to me that pin 1 goes to processor pin 8 (P0.3/INT3), pin 2 to 7 (nRESET/P0.2)), pin 3 to the wire that runs upwards, off the top of the image, pin 4 to 5 (SDAT/P0.0/INT0), 5 to 4 (TEST), 6 to 6 (SCLK/P0.1/INT1). The connections to connector pins 2, 4, 5, 6 agree with the identifications by Tommy Tyler for an OARI06G JP1.4 remote. It was this agreement that I used to make my identification of the pin numbering for this chip. SDAT and SCLK are uses of pins 4 and 6 in Tool mode. For us those are general purpose input/output pins P0.0 and P0.1 used as TXD and RXD. Pin 5 we leave disconnected. Pin 2, our RTS, is nRESET in JP1.4 remotes. So 2, 4, 5, 6 are as expected. This leaves 1 and 3. Pin 3 is the one that is not connected directly to the processor. We have it as GND (Vss), and as the negative battery terminal is at the top end in the remote, it is not surprising that this is off the top of the image.

This leaves pin 1. We normally identify this as Vdd, the 5v or 3.3v power output, and leave it disconnected but here it appears to go to processor pin 8 (P0.3/INT3). So is it possible that UEI have repurposed pin 1 since as far as I know there has been no use for it as output power for a long time. We might not even have noticed such as change as we leave it disconnected. So is this now used for some as yet unknown purpose that is causing the change of behaviour from other JP1.4 remotes?

[mathdon]

Randy, beware of reversing the connector as you did, as that makes RTS connect to pin 5 rather than 2, which we believe to be the processor TEST pin. I am not surprised if this causes a reset as it is changing the mode of operation of the remote, but we know nothing about what TEST mode is, so it could cause damage if you do anything further in this mode.

[HamburgerHelper1]

Randy, beware of reversing the connector as you did, as that makes RTS connect to pin 5 rather than 2, which we believe to be the processor TEST pin. I am not surprised if this causes a reset as it is changing the mode of operation of the remote, but we know nothing about what TEST mode is, so it could cause damage if you do anything further in this mode.

I figured the connections where wrong and the chance of zapping the remote
It was my hope to at least see some form of life from the connector
It sure is weird how they did this remote though

[HamburgerHelper1]

Since pin 2 goes to the processor and the common connection for the transport keys
I have the cable connected the correct direction I held down rew,play ffd and pause
and attempted raw download
Remote responded with the 2 blinks and back light on/off just like when i had the cable reversed

[3FG]

Since pin 2 goes to the processor and the common connection for the transport keys

I don't understand what you mean, but I suppose that you are looking at more than we can see in the uploaded image. Can you take images of the whole board (both sides) and also of the hole in the case where you are attaching the cable? Many JPx remotes have a key slot to ensure that UEI folks insert the cable correctly.

[HamburgerHelper1]

Since Graham is getting the same results as I am I assume i am connecting the cable correctly
Hard to see in these pics but in the pic showing circuit trace the lower left pin that i am calling pin 2 connects to processor and to transport keys
that is why i thought UEI might have a secret key press for programming

[HamburgerHelper1]

I did have my cable on wrong when holding buttons so it does not respond when holding keys after all

[mathdon]

Since pin 2 goes to the processor and the common connection for the transport keys

Could you photograph the board in sections, with sufficient detail visible to enable us to trace the connection that you refer to here? The full-board photo that you have posted is too bright at the top and too dark at the bottom to see anything clearly. I would like to be able to trace the connections of all keypads back to the processor. Photographing the board in sections would also improve the definition. The first picture you posted, around the processor and 6-pin connector only, is really clear.

[HamburgerHelper1]

I zipped up some pics and put them in Diagnosis section
Hopefully these are clear enough I had more pics but it was over file size limit
when I attempted upload


http://www.hifi-remote.com/forums/dload ... e_id=26882

[3FG]

The picture of the brown side of the PCB has pin 1 labeled. It is top right in that picture, so it will be top left in the green side pictures, just as mathdon had deduced.