JP1 Remotes

[The Robman]

The folks at UEI think this is not one of their remotes. They have a lot of accounts where they just supply the chip so that the remote can use their codes, but where they don't make the remote itself.

This sounds like one of those cases, so the EEPROM chip is probably for some other non-JP1 type purpose.
_________________
Rob
www.hifi-remote.com
Please don't PM me with remote questions, post them in the forums so all the experts can help!

[Tommy Tyler]

It doesn't have the look and feel of a UEI design, and the logo on the board is "Godo", as you can see. So far I've looked at only the first 2K of EEPROM and it's blank, but of course I did a CLEAR operation using instructions in the manual Rob provided. After I've seen all the EEPROM I'll load a couple of "learns" and macros and look again to see where they put 'em.

[Tommy Tyler]

I've posted a complete download of the 256K EEPROM for the Yamaha RAV356 here. (Not sure if this is the right place to put it.) Before I found out that IR could handle the 2-byte address required by an EEPROM this large, I wrote a DOS utility to download it in four 8K byte increments. I've compared downloads from IR with those from my utility, and they agree 100% from end to end. So I don't think there can be much doubt that this is truly what's in the EEPROM.

The interesting thing about this remote is that the maker provides the 6-pin header, wired pin for pin as a JP1 header (except that there's nothing connected to pin 2, which is normally Vdd of the EEPROM), and conveniently located and accessible, like the connector in other JP1 remotes. But that's where the similarity ends. The SDA line from the EEPROM has a 2.7K pull-up resistor, and goes only to the JP1 header and a pin of the processor, pretty much normal. But the SCA line has no pull-up, and runs all over the board to places that make no sense (e.g., the LCD driver chip). The result is that the remote fights tooth and nail against trying to share this line for downloading. Something (probably the processor) pulls up strongly on the SCL signals from the interface whenever you try to address the EEPROM. I even built an interface with high powered drivers to try and override that, already one strike against the remote. If you use a 2-byte address it never responds, and its response to a 1-byte address (when you're lucky enough to get the resets just right so that it will respond at all) is unrecognizable. One of the worst problems is that there's a 20 second period following a reset during which, if it receives a second reset, it goes into some sort of 20-second shutdown during which you have no chance whatsoever to get any response from the EEPROM. Makes for some long days of testing. After trying every possible way to work around these problems I gave up in frustration and isolated the EEPROM from the other circuitry. Then it was easy to download with a standard JP1S serial interface.

My thoughts are that Yamaha must have a special lock-out sequence (such as pressing two buttons simultaneously as Rob mentioned) to get the processor to shut up and quit fighting the download. Otherwise it makes no sense that they would bother to put the JP1 connector there unless there's a way to use it. The isolation I did requires cutting traces in two places, and the cuts must be restored for normal operation, so that's not practical for our guys. Just opening the case on this remote is a bitch (or can I say that?). Until and unless we can learn the special lock-out sequence, I'm afraid it is not a good candidate for adding to our protocol repertoire.

I'll keep my setup for a few days in case anyone thinks of more constructive tests we should do, then I'll return the remote to its owner.

[Tommy Tyler]

A couple of followup thoughts. Yamaha would want to design the remote so that it would be nearly impossible to put it into I2C communication mode accidentally. That would suggest using buttons as far apart on the remote as possible, and better yet, using one button near the top and another one of the four recessed buttons along the bottom that require a ball point pen or other small tool to actuate. They love to hold buttons down for three seconds or longer to invoke an action, so this would probably be no different. But detecting multiple buttons in a scanned matrix arrangement is not easy, and they may do it another way. If I were the Yamaha engineer designing this I thing I would rely on inserting batteries while holding a certain button down, or releasing reset at pin 5 of the JP1 connector while holding a certain button down (same thing). They also love to use that LCD for messages to show when in LEARN mode, MACRO mode, CLEAR mode, etc., so I would expect that the magic combination might display some unique message to confirm when you've placed the remote in I2C mode. It might remain in this mode indefinitely until reset again (a la JP1.2) or it might have an inactivity timeout like Yamaha employs on the other user programming modes.

With all that in mind I set about trying as many combinations of things as I could, while watching for a special message, but none of the more intuitive and obvious combinations did anything. There are 67 buttons on that remote, and the possibilities for encrypting the setup sequence are astronomical. I only mention this in case someone who owns a Yamaha remote is sitting around with nothing to do after working all the Sudoku puzzles in the "difficult" section of his book, and is looking for a challenge.