Repairing my TV

Edit: Unfortunately I’ve lost all pictures for this blogpost.

A few months ago the HTPC (with my Showtime installation) refused to start. Power LED were lit, but nothing else happened. After quite some troubleshooting I realised that the machine would hang if connected to my TV. The TV did not even have to be powered in order to block the system boot. My initial thought was that somehow the DDC bus had been damaged in one way or another (ESD, short circuit, some weird ground loop or whatever). Fortunately the TV has two HDMI connectors so I just switched to the other one and everything was fine and dandy. Until a few days ago…

The same problem was now exhibited on the other HDMI port. This definitely called for some deeper analysis. I didn’t want to buy a new TV just because of this. All other parts of it worked just fine.

First approach – Open the thing and do some measurements. For some reason beyond my understanding LG had been kind enough to bundle printed schematics with the TV. This picture shows one of the HDMI connectors and the I2C EEPROM holding the EDID information for it. The only thing powered by the computer are those EDID EEPROMs.

So our prime suspects where IC1201 and IC1202 (outside of the image above), but both highlighted in this photograph of the PCB:

Initially I thought that the I2C bus was somehow locked due to either SDL or SDC constantly being pulled low. I’ve prior experience with I2C bus lockups like this due to malfunctioning hardware. So I did some measurements with my multimeter. Everything seemed OK. I had also realised that if I plugged in the HDMI cable after boot the system would not hang. It just was just not able detect the monitor even though I explicitly asked it to reprobe all monitors. So next idea was to actually try to see what was going on over the I2C bus…

I decided to sacrifice an HDMI cable and build an I2C bus snooper using the parallel port. Perhaps not the most beautiful thing I’ve made, but hey, it worked just fine.

Now, things started to get interesting. I also found some snooping code on this page. Surprisingly the snooper worked at first attempt. I didn’t even care to check that I didn’t mixed up SDA and SCL. Apparently Murphy had other things to mess up that day.

 0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef 00: ff ff ff ff ff ff ff ff 1e 6d 6c 75 7f d1 02 00 ........?mlu???. 10: 0b 10 01 03 80 46 27 78 ea d9 b0 a3 57 49 9c 25 ?????F'x????WI?% 20: 11 49 4b a5 6e 80 31 40 01 01 01 01 45 40 01 01 ?IK?n?1@????E@?? 30: 61 40 01 01 01 01 1b 21 50 a0 51 00 1e 30 48 88 a@?????!P?Q.?0H? 40: 35 00 bc 88 21 00 00 1c 4e 1f 00 80 51 00 1e 30 5.??!..?N?.?Q.?0 50: 40 80 37 00 bc 88 21 00 00 18 00 00 00 fc 00 33 @?7.??!..?...?.3 60: 37 4c 43 32 52 2d 5a 48 0a 20 20 20 00 00 00 fd 7LC2R-ZH? ...? 70: 00 38 4b 1f 3d 09 00 0a 20 20 20 20 20 20 01 c1 .8K?=?.? ?? 

If you spend some time reading more about EDID, it says that byte 00–07 is Header information “00h FFh FFh FFh FFh FFh FFh 00h”. This is clearly not what’s in my EDID ROM. Also the last byte of the EDID is a checksum byte which should be written such that if you sum all 128 bytes the sum should be zero. When I summed the bytes it ended up being 0xFE. Another evidence that the first and last byte in the EDID header has been changed from 00 to FF. The obvious strategy now was to rewrite those bytes back to zero again. So I had to build a full blown I2C interface:

This is based on the Linux kernel parport interface. I loaded the i2c_parport kernel module and run the i2cdetect tool. Nothing was found.

Well, after a fixing a few incorrect solderings I finally got it running (It’s so much easier to write software than to build hardware, that’s for sure). It did detect something at address 0×50, just where the EDID EEPROM is supposed to be located. And even when clocking out the bits myself I could confirm that the two bytes in the header were corrupted.

So now, all that was left was to modify those bytes back. Or? Not really, the EEPROM is write protected (Pin 7 is pulled low, just look at the schematics) so this is not possible. But what the heck, at least I could try it.

 root@htpc:~/nvidia# i2cset 3 0x50 0x00 0x00 No size specified (using byte-data access) WARNING! This program can confuse your I2C bus, cause data loss and worse! DANGEROUS! Writing to a serial EEPROM on a memory DIMM may render your memory USELESS and make your system UNBOOTABLE! I will write to device file /dev/i2c-3, chip address 0x50, data address 0x00, data 0x00, mode byte. Continue? [y/N] y Value 0x00 written, readback matched 

Wait? What’s that: ”readback matched”. It actually succeeded to write the byte?!

 root@htpc:~/nvidia# i2cset 3 0x50 0x07 0x00 No size specified (using byte-data access) WARNING! This program can confuse your I2C bus, cause data loss and worse! DANGEROUS! Writing to a serial EEPROM on a memory DIMM may render your memory USELESS and make your system UNBOOTABLE! I will write to device file /dev/i2c-3, chip address 0x50, data address 0x07, data 0x00, mode byte. Continue? [y/N] y Value 0x00 written, readback matched root@htpc:~/nvidia# i2cdump -r 0-127 -y 3 0x50 c 0 1 2 3 4 5 6 7 8 9 a b c d e f 0123456789abcdef 00: 00 ff ff ff ff ff ff 00 1e 6d 6c 75 7f d1 02 00 ........?mlu???. 10: 0b 10 01 03 80 46 27 78 ea d9 b0 a3 57 49 9c 25 ?????F'x????WI?% 20: 11 49 4b a5 6e 80 31 40 01 01 01 01 45 40 01 01 ?IK?n?1@????E@?? 30: 61 40 01 01 01 01 1b 21 50 a0 51 00 1e 30 48 88 a@?????!P?Q.?0H? 40: 35 00 bc 88 21 00 00 1c 4e 1f 00 80 51 00 1e 30 5.??!..?N?.?Q.?0 50: 40 80 37 00 bc 88 21 00 00 18 00 00 00 fc 00 33 @?7.??!..?...?.3 60: 37 4c 43 32 52 2d 5a 48 0a 20 20 20 00 00 00 fd 7LC2R-ZH? ...? 70: 00 38 4b 1f 3d 09 00 0a 20 20 20 20 20 20 01 c1 .8K?=?.? ?? 

Yep, the other address seemed to play along nice too.

Next I Connected it all back together again as it is supposed to be and it worked again :-)

Having initially been bothered by the fact that the bytes somehow changed even though the EEPROM is write protected I now rather believe that the write protect pin is not correctly hooked up. Either it’s left floating or the “Don’t mount” optional resistor is actually mounted. But right now I don’t care to open the TV once again just to check that. Perhaps I’ll look into it if this happens again.

24 Responses to “Repairing my TV”

  1. matwad says:

    Interesting, nice work

  2. That’s just insane, I wouldn’t even now where to begin to debug my TV. I’m pretty sure this isn’t a solution that would have come up by calling LG customer service ;)

    Nicely done!

  3. Cool story! I really like how you actually tried to write to the EEPROM even though it was supposed to be write protected.

  4. Jonas A says:

    Well done! Now if your software developer career fails you can always become a tv repair guy! :)

  5. Anders Lowinger says:

    Andreas, you are crazy :)
    Well done!

  6. Cian Hughes says:

    Nice solution. I have seen this problem with other monitors before, it seems to stem from the very fact that the EEPROM is NOT write protected, allowing noise/bad drivers/leprechauns to accidentally destroy the EDID info.

    FYI, you can often get away without destroying a perfectly good HDMI cable as it is possible to send I2C info directly over the video card’s bus. See http://www.paintyourdragon.com/?p=43

    Out of interest, what model is your TV? Where did you find the correct EDID info to put back on, or did you guess it?

  7. Right, I also found out that it’s possible to query the I2C bus directly using the GFX card on-board controllers. The nVidia kernel driver exposes all three busses via the I2C kernel infrastructure. However, it does not allow writing.

    The TV was an LG 37″ -something. Can’t exactly remember.

  8. [...] Read more here: Repairing my TV – The Lonely Coder [...]

  9. josh says:

    You must be very lonely.

  10. [...] found that his home theater PC would not boot one day. Oddly, if he disconnected his HDMI cable from his TV, it would boot fine.  While most of us would [...]

  11. Jonas Jacobsson says:

    Really impressive! And fun to read too. :)

  12. Emmanuel says:

    Interresting article, Could you give me more information about the Hardware that you use for your HTPC?
    Thanks by advance.

  13. Chris says:

    Excelent analysis and solution, congratulations! I have found that, in some TV sets, the data in the EDID EEPROMs sometimes gets corrupted. The usual solution is to dismount and reprogram de EEPROM, but your solution is elegant.

  14. m20120 says:

    Your EEPROM was not write protected. Pin 7 is the Write Control line and it is active low. Pulling it to ground allows the EEPROM to be written to. Pulling it high would write protect it.

  15. Tarnic says:

    What case did you use for your system?

  16. Shadyman says:

    I want to know what TV this is that came with schematics!

  17. The TV is a LG 37LC2R to be exact.

  18. NeoLojik says:

    Greetings from hackaday! I wanted to comment here as I’ve had a similar experience in the past. Not long after buying my Samsung SyncMaster 2343BW monitor I found that the screen wouldn’t awaken from standby and Windows would come to a complete halt when booting.

    The monitor contains 2 EDIDs, 1 for DVI and 1 for VGA. Turned out to be a similar issue to the one you’ve had, the first byte of the DVI EDID had been changed. After much searching I discovered that it’s been known to happen when using an nvidia GFX card. I used the VGA port on the monitor, and a DOS boot disk with a utility whose name escapes me, to correct the DVI EDID and it’d been fine ever since.

  19. GCL says:

    (Again) Greetings from Hackaday.
    I wanted to comment here before there.
    Amazing work. Ideally my question is one of, who does make your HTPC? Other then that people back there have reported that this site seems to be sometimes not here.

  20. Tim Green says:

    Thanks to hackaday for the link here. I hate bad EDID too, but never thought to try to correct them! Luckily writing the first 128 bytes worked for you – HDMI screens often use extended EDID with another 128 bytes of mode information. See http://en.wikipedia.org/wiki/Extended_display_identification_data#CEA_EDID_Timing_Extension_Version_3_data_format

  21. Luffie says:

    just curious if this is a true..can a virus crash your computer to the point it won’t even turn on? santoramaa

  22. YNH says:

    A second call for the name of that most awesome case that you used for the HTPC!

  23. NIKITAKTAK says:

    Good design blog. Author fellow, will be your constant visitor. I learned many interesting thanks.

  24. [...] people, after have read my last post, have asked what kind of HTPC, etc I use. So, here is a quick [...]