Mini Vu+ Duo repair trip.

Discussion in 'Other satellite receivers.' started by Johnny B., Jul 1, 2016.

  1. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    minivuplusduo.png

    The beginning..

    Mini-VuPlus-Duo-repair.jpg
    Image shows the motherboard before I was working on it.

    I had received this box from someone to see if it was repairable.
    And there was still a little life, red light and nothing else.
    Rs232 no output, but the cpu could be reached with Jtag (I2c), only the repair to the flashrom refused, the well known 'offset 0x00000000 detected as bad block' problem.
    Not that it was useful, because also if it worked it was not possible to bring it to life because I noticed that someone had drilled four holes through the motherboard.
    Presumably to mount the jtag (I2C) pins, but it was a bad choice.
    Since the system board consists of several layers, the risk of damage internal print tracks is very high.
    Thus, also in this case, a variety of printed circuit board tracks were interrupt to the cpu, and a short circuit to ground with one line.

    Mini-VuPlus-Duo-with-drille-holes-closeup.jpg
    Image of were you can see the drill holes.

    Later...

    After a while I started a new project, researching or trying to fix the security mcu chips.
    More about this project, see this topic, Vu Duo V3 security chip repair project..
    This to make an attempt to read the data from it, I had collected these chips as much as possible, as well from this board.
    After a while I discovered that there was something strange about this chip from this board.
    It concerns the ST 8S103K3 type chip UFQFPN-32 which shows a whole different pin connection according the datasheet than I had measured on the motherboard.
    Or the datasheet is incorrect, or I am mistaken in the type of chip, or the chip is replaced by an incorrect mcu chip by the previous owner.

    STM8S103K3-vuduomini.jpg
    Image shows a good overview of the security chip pins description. on the datasheet you can see that the chip is not suitable for this type motherboard.

    In any case, it is not corresponding with the connections on the motherboard and may also explain why the motherboard has a red led.

    Repair attempt...

    With this discovery I wanted to see if I could bring some life to this motherboard.
    First thing I did was investigate if I could solve the short-circuit, and it did, with drilling the holes slightly larger with a very sharp drill.
    Now the short circuit was resolved, but the next task was to track down the actual print lines who were now interrupted.
    By comparing some measurements from a vu+ Duo motherboard with these mini board, I discovered the real sources.
    These I had again repaired with very thin copper wire coming from a coil.
    After this I had again the proper voltages to the cpu, but did still not receive any data from the serial connection.
    This was because the Rs232 ic was faulty, after I had replace it, I get the data reception in the terminal.
    Obviously not from the security chip because it was removed from the motherboard.

    Software installation...

    Then it was time to load the new software, because the terminal rs232 output data from the box has errors.
    I knew the nand flash rom had a problem, so I removed it and fixed it with a nand programmer by several times to erase the flash rom.
    I also mounted a nand flash ROM socket, just in case it still goes wrong with the nand chip.
    But this turned out not to need, I could upload the loader with the Jtag/Bbs software and after that the box loads fine from the usb stick and load it fine to the nand flash rom.
    Obviously I got afterwards the known epc error in the terminal screen, because the security chip was removed.
    Then, as a test I had loaded a OpenPLI version (because it just load without a security chip), so that I could at least see that the motherboard is working, of course, the tuners did not work because it only works if there is a working security chip is present.

    Security chip problem...

    Okay, now I know that the motherboard works I had to solve the problem of the security chip.
    And of course I did not have this, and I wanted to spend no money to fix it.
    After all, it is a low cost-board and this board has too many repair scars.
    Basically not really repaired to use it daily, it's just a fun project to learn from.

    Okay, now what ... I had a few working Ferrari security chips like the v2 and v3, but I wanted not to rebuild it for this board, so too it was not certain whether it would work.
    So the plan was to make the same connection socket as the normal Ferrari duo motherboards has so that I can connect the security chips easily to the motherboard.
    I knew the connections of the security chip, and also from this mini vu+ duo board.
    Only the Scl / Sda was not sure, but that was just a matter of swapping the two wires if it was not good.
    So, I used coil wires for the connections, because in some places the connection are very small.
    And I did not want to damage the original mcu chip solder connections of the security chip.
    This to have the possibility to place the correct chip back if needed.

    Wiring the security chip connections...

    First, the Rx / Tx which is most easiest because these can be taken directly from the rs232 chip.
    Then the Vcc wire, for this I decided to scratch off a protective layer of the print line, and solder the copper wire on it.
    Same with the Sda / Scl, more difficult, but to do fine, I've decided not soldered them next to each other on the board to prevent short circuits.
    Alternative connections were not there, these Sda / Scl lines go directly to the cpu.
    Further was the ground connection no problem, it can be taken anywhere.
    The crystal connection were not needed, because Ferrari security modules has them self.

    Mini-VuPlus-Duo-JtagandSecuritychip-info.jpg
    Image shows a good overview of the security chip wiring, and the jtag places

    For convenience, I made an extension cable, just because it was easier.

    And now the test, will the security chip working on this type motherboard, or not...

    Little surprised, but the motherboard and the tuners had no problems with this Ferrari security chips.
    After connecting it to the motherboard it works flawless, tuners, both give good reception.
    So, nice to know that at least this works fine with a different security chip, with (maybe) other data in it than the original.
    In this case, tested on the v2 and v3 Ferrari security chips.
    Maybe is the data on it usable for most of the receivers which has a security chip.
    Seems logic, but maybe it isn't.

    Mini-VuPlus-Duo-Securitychip-info.jpg
    Image shows how the security chip has been connected.
    Notes the wiring, mobo Rx pin goes to the sec-chip Tx etc..


    Finally…

    And so this project is done, the board is working again, and it was very educational.
    Especially that it also works with a different security chip.
    The defects of this board were..
    1. Holes in the pcb.
    2. Rs232 ic.
    3. Nand flash chip.
    4. Security chip.

    Thanks for reading this repair trip, hopefully it was worth it to read, and no wasted time.
     
    andyros and toysoft like this.
  2. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Nice work, Very tidy soldering.

    I have 2 mini duo that need jtagging and need to find SCL and SDA. Is SCL connected to r835 and SDA connected to r840.
     
  3. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    Hi, Brain.

    Yes indeed, as for the Jtag you need to add the Scl/Sda wires to these two resistors, as the picture shows.
    Marking on the smd resistors: 103, ohm value is 10kΩ
    Better is to use thinner wires than I have used in this picture, later i've replaced it for thinner wires.
    As for the ground you can take it from everywhere, and the 3.3v vcc connection is normally not needed.

    Scl-Sda-Snap.jpg
     
  4. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Thanks for your help.

    I have some 40 awg wire that should be ok.

    What boot loader did you upload?

     
  5. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    Same process as for Vu+ Duo, and so the same jtag (Broadband Studio 3 Bcm97335) and cfe files.
    Only the Nand flash chip is different, the mini has a Toshiba chip, probably the TC58NVG0S3ETA00.

    See the zipped file, it includes..
    The Vu+ Duo 750_cfe_3_0_111012_release.bin file

    And for the Broadband Studio 3 the Flashes files,
    Toshiba nand flash...
    TC58DVG3S0ETA00.xml
    TC58NVG0S3ETA00.xml
    TC58NVG1S3ETA00.xml
    And as xtra the Winbond files, but this you do not need for this box.
    W25Q32BV.xml
    W25X40BL.xml
     

    Attached Files:

  6. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Thanks Johnny you have really helped.

    Hope you figure out a way to read the security chips.

     
  7. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    As for reading/cloning the security chip..
    Yeah, I'm still working on it, i've also sent a message to the guy who wrote the files in the hope he will give it.
    But unfortunately so far received no reply back.
    Furthermore to open the chip for reading is difficult, for that I need more information from someone who has experience with it, or the password.
    But still, I haven't given up yet.

    But good luck with the jtag task.

     
  8. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Hi Johnny,

    1st one had Samsung K9F2G08U0D, can't seem to find XML for this flash but it flashed using K9F2G08U0A no problem.

    Just flashing image now.

    The second has the Toshiba but getting disconnected in bbs. When this is powered on both Ethernet lights are lot solid. I think this is maybe a hardware issue. Just going to check fuses.
     
  9. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    1st box image loading up on but getting tune failed on both tuners is this dead?
     
    Last edited: Jul 30, 2016
  10. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    I think you have a security chip issue, check it with the serial port.

    The mini rs232 pins are different, to see the response from the security chip you need to use the 1 and 6 pin.
    This is different than the vu boxes which use the 4 and 6 pins.
    For the normal output you need I think to use the 2 and 3 pins which is the same as the vu boxes.
     
  11. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    I have a cable I made up that was used on my vu duo with i think the the correct pinout.

    pin 4 goes to pin 3
    pin 5 goes to pin 5
    pin 6 goes to pin 2

    I only have usb to serial port and getting no output in putty and it won't upload on renewaes.



     
    Last edited: Jul 30, 2016
  12. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    The mini has other pin connections on the rs232 connector than the vu duo...
    To get a (if working UPDS) output from the security chip it is pin 1 and 6 on the box side.
    This is not the same as the Vu duo, that uses 4 and 6.

    Pc side Pin2 goes to the mini box Pin 1
    Pc side Pin3 goes to the mini box Pin 6

    When using a cross linked cable (0 modem rs232 cable) it needs to be,
    Pc side Pin2 goes to the mini box Pin 6
    Pc side Pin3 goes to the mini box Pin 1

    Bps is 19200

    As for the Usb to Rs232 method with renewaes.
    This mostly works fine for reading from the box, but can mostly not be used to write to the box.
    At least with my own usb to Rs232 cable it doesn't work for writing to the box.
    Nevertheless, it's always better to use a real pc or notebook serial port and a wxp system.
    But, it may also have to do with the chosen rs232 pins on the box side, because the mini use other pins than the vu duo/solo/uno box.
     
  13. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Hi Johnny I'm getting ... From putty. Tried wiring both ways you said but nothing.

    I might remove the security chip from the dead one and try it on the good one and see what I get.

    Thanks for your help
     
  14. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    I have an old ibox 1 that has a blown motherboard and possibly good security chip. If the swap on these two don't work I will give that one a try.
     
  15. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    Hi Brian,

    If these security chips are the same that it may work, that is, if the ibox chip works well.
    If it's not the same than you need to download the datasheets, and compare the pins.
    And maybe also use the crystal from the Ibox if it has another Hz value.
    By the way what security chip has your mini box, I'm curious what it had originally.

    But also, keep in mind that a crystal may become defective, this could also be the case of the mini box.
    Without a good working crystal, the security chip fails also.
     
  16. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Swapped the security chips over from the dead mini to the working mini and the tuners are now working ok. Thanks for your help on this.

    The dead mini when powered on is red light stays on and the green light flashes for a second. There is no response from jtag or rs232. The Ethernet lights are also on. Could it be one of the caps that's failed?
     
  17. Johnny B.

    Johnny B. Technical Support Staff Member Moderator

    Messages:
    2,822
    Likes Received:
    1,504
    Trophy Points:
    113
    Gender:
    Male
    Location:
    Netherlands
    Home Page:
    Could be, but I think more of a 3v issue because as for jtag it will fail when the cpu has some issue with this voltage.
    I think check this main voltage, also after the inductors of the 3.3v circuits.
     
  18. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Hi Johnny I have got the second box to flash I reversed the scl and sda connections and it connected.

    The second problem I had was bad block offset. I have read bbs cannot write to these but i got it to flash.

    Got the box to say connected, went to file explorer and selected the Toshiba chip I then clicked refresh and all info came up.

    I select the file to flash and press start it will then say bad block offset.

    Powered off the box then back on pressed refresh until it came up with info then hit start and it started to flash.
     
  19. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    Just flashed openpli and working great, just need a security chip to work with it now.
     
  20. Brianmullen8

    Brianmullen8 New Member

    Messages:
    27
    Likes Received:
    5
    Trophy Points:
    3
    Gender:
    Male
    This is the working security chip I removed and put in the other box.

     

    Attached Files: