Dell 4210X DLP projector bulb has some i2C sensor or chip?

[vanarebane]

Hello good fellas!

New to this forum, been watching EEVBlog for long time.

I ran into a problem and thought maybe some people have experience on that hand to share.

So I was retrofitting an Dell 4210X projector (I got it without an bulb module) to work with a LED. I guess I did bypass the lamp ballast already, tried different pins also just in case. So next I was looking at some strange board I found in the lamp module hole. It reads "LAMP TRANSFERRING BOARD". There are 4 pins that read GND, SCL, SDA and 5VSBY (standby?). There is no components and wires run back to mainboard.

So my fair guess it, that basically, it seems that the lamp module as some sort of a chip that is connected to the mainboard via i2C interface. Maybe it's temperature sensor? Not so likely as there is one already. Probably a chip that stores hours that the lamp has worked? So when lamp is changed the counter is reset.

Now, buying a lamp is expensive and I would not like to go that way. It would be great if I had a broken lamp or even just the chip to probe it and somehow bypass that also.

Does anyone have experience with that lamp chip?
Could you please help me bypass it?

Thank you!

[ve7xen]

It's my understanding that these high intensity lamps can become quite dangerous when they age, so most consumer products with them will have some sort of running hours limit. Chances are the chip is a simple EEPROM, and probably doesn't contain anything too mysterious. With something like a Bus Pirate you can probably ready it out and fiddle with the values until you figure out how it works.

[vanarebane]

Thanks for confirming ve7xen! Yep, you understand these bulbs quite well. They are dangerous. This chip is most likely for memory as chips are for printer cartridges.

I still can't find answers for following questions:

• What type of chip toes this bulb memory use? Just guessing it is hard and trying many different - expensive and time consuming.
• And what if something is pre-stored there and without reading it, the projector counts it as a error?
• I don't know the address of the I2C memory chip. Can you reverse-engineer this with something like bus pirate?

[Paul Price]

The board clearly has no parts just wires going to two different connector areas. It looks like a to convert to a bed of nails pressure contact on the bottom. It is just a connection adapter/interface board.

[vanarebane]

Paul Price, yes you are correct! The thing is, that I'm missing the board this interface is connected to. That is the mystery. Only thing that this interface board shows us, is that the pins have labels and it seems to be I2C interface. I want to bypass the lamp check somehow or reverse engineer something I haven't seen. That's why I ask in this forums, as if someone has this board and can lighten me what that board does and how to to maybe bypass/replicate it.

[ve7xen]

• What type of chip toes this bulb memory use? Just guessing it is hard and trying many different - expensive and time consuming.
• And what if something is pre-stored there and without reading it, the projector counts it as a error?
• I don't know the address of the I2C memory chip. Can you reverse-engineer this with something like bus pirate?

I2C EEPROMs are fairly standard. There are a few different ways to address them and whatnot depending on size, but if you have a working board it wouldn't be hard to figure out. Just go look at some datasheets for I2C EEPROM from Atmel or Microchip.

The address should be easy to find, Bus Pirate etc. have address scanning scripts, or you can just look at the datasheet and which pins are strapped where.

[David_AVD]

Not having a lamp assembly (with the EEPROM in it) makes it difficult.  I guess you could try hooking up a small blank EEPROM (1K or so) and see what happens?

[philpem]

Hook up an I2C sniffer and see what addresses it's trying to access?

It'll probably be something in the 0xA0 block (if memory serves) -- I'd try something like a 24C02 or 04 as a starting point. Your problem will be finding out what it's expecting the  contents to be... for that you're going to need a lamp (dead or otherwise).

[amyk]

for that you're going to need a lamp (dead or otherwise).

This is certainly one of those times when "one man's junk is another's treasure"... you could try looking around at recycling places, etc. to see if you can find a dead one for free.

[vanarebane]

for that you're going to need a lamp (dead or otherwise).

This is certainly one of those times when "one man's junk is another's treasure"... you could try looking around at recycling places, etc. to see if you can find a dead one for free.

This is one reason I started this thread. Hoping that someone had this "junk" around or has found this in trash. I'll try the IC EEPROM once I get more hobby-time.

Thanks everyone for your effort. This shows that that this forum is strong

[DougWHolt]

I happen to have seen your post when I was looking for other info for the same projector. I figured since I had mine apart to help find the info that might help out. Keep us informed on your outcome. When my bulb burns out I may end up using some of your led conversion info. I'd love to see the picture results.

As for the lamp hours, Im not certain that this lamp module board has a limiter to shut down the bulb after a certain amount of hours. in the 4210X projector menu it is a way to reset the lamp hours.

The board has printed a part number
P/N : 00.8CE08G001
The 8 pin IC chip
24LC32A1
Pins 1 and 4 on the ic chip go to J1 connector pin 4 and IC pin 5 goes to connector 1 the other two pins on the J1 connector 2 and 3 Im at a loss, their tied to the circuit on the other side of the board. That consists of 4 resistors, 2 capacitors and 2 transistors.

Perhaps with this general info you can find a basic circuit diagram online using the 24LC32A1 or similar chip. Good luck

[David_AVD]

Those 3 pin "transistors" are likely to be diodes given the D1 and D2 designators.

[ElektroQuark]

Yes, they are dual BAW92 diodes.

[ve7xen]

24LC32 is an I2C EEPROM as suspected. What's on it is probably important.

I guess the diodes are clamping the I2C bus voltages. Not sure why they're using 4 resistors, maybe a pair in series for some reason.

Pin 1 is Vdd, Pin 4 is Vss, Pins 2 and 3 are SCL/SDA, can't easily tell which is which.

[vanarebane]

Wow, I was starting to loose hope in this project but thanks DougWHolt for sending the pictures of the Lamp Module Board. It's quite helpful that I know now what IC they use. Thank you for that, I will let you know once I get my LED upgrade done

Here is the datasheet for the 24LC32A, the I in the end means this is Industrial version: http://ww1.microchip.com/downloads/en/DeviceDoc/21713H.pdf

ve7xen, if you look at the first post, then you see that on the transfer board, there is marked the pins:
1 5VSBY
2 SDA
3 SCL
4 GND

and ve7xen. you are probably right on that what's on the IC is important. Most logical would be to just write hours left on the bulb to the IC and count them down to zero and then request replacement for the lamp. But as the Dell had build the projector so complicated to open, I guess they did some jazz on that IC just to make sure that it's foolproof

The 24LC32A is connected to 5V directly and the schema would only be explained by something going on on SDA and SCL.
According to the datasheet, all input signals should be 2.5V ? VCC ? 5.5V
So there seems to be no reason why the schema is there on the other side.
Because the IC operating temperature is in range of -40°C to +85°C and there is a IC version for Automotive with -40°C to +125°C temperature range, I don't even see that there has to compensate for the Lamp temperature in any way, because they would just go for better IC rather than just throwing more components on the board.
Or are they doing anything secondary via the I2C bus? Like measure the temperature? But is there a thermistor I2C chip there?

So I ordered my BusPirate v4 and it would be in mail for a 1-3 weeks or so. So I can continue this project and sniff what is sent to the IC, or what is requested from there.

Thanks everyone!

PS. Looking at the large C1 on the back of the board, I am thinking that just maybe this schema is some sort of fail-safe if the power is cut off suddenly in middle of writing to the IC memory? So not to corrupt the IC and get the consumer a faulty lamp suddenly, they made this failsafe schema?

[PaulMakesThings]

Hi,
I see this is an old topic, but I'm at the same point with the same projector. It has no lamp module and when I turn it on it waits a few seconds then the temperature indicator turns on. I saw the SDA and SCL markings on the board and did a google search for "Dell 4210X I2C" and found this thread.

I'm a professional microcontroller developer and am planning to tap into the I2C bus, see what it says and try sending it some values to see if I can trick it into running. I'm expecting to see something sent as a request, then I'll have it ping back 128, or 1000 or whatever might be a good temperature or time left on bulb rating until it works or I get another message. If the response is supposed to be a code that means "status ok" I might be out of luck since I have to get it exactly right.

Just wondering if anyone else has made progress with this since it was posted 2 years ago. If it's some special code the only way to find it would be to listen to a system with a good lamp module.

Alternatively, I'm thinking I can look and see if there is a micro upstream that takes the I2C data and just flips a Go/NoGo bit on one of it's outputs and jumper it, but so far I haven't found such a point.

Thanks for reading, and please let me know if anything new has been found or if you're interested in my results.

[PaulMakesThings]

I suspect this thread is abandoned, but I'll post my progress here in case anyone else finds it interesting.

I got my logic analyzer to capture the signal from the projector. There are 4 bursts. I'm not sure if they're correct.

Here's what it sees

"
START
0xA2 Control Byte: Slave Address 51 Write
 ACK
0x C
 ACK
0x10
 ACK

START
0xA3 Control Byte: Slave Address 51 Read
 ACK
0x 2

STOP

START
0x42 Control Byte: Slave Address 21 Write
 ACK
0x98
 ACK

STOP

START
0x98 Control Byte: Slave Address 4C Write
 ACK
0x 0
 ACK
0x69
 ACK

STOP

START
0x42 Control Byte: Slave Address 21 Write
 ACK
0x98
 ACK

STOP
"

Then 2 seconds later (when it shuts down)

"START
0x98 Control Byte: Slave Address 4C Write
 ACK
0x 0
 ACK
0x 0
 ACK

STOP
"

The frequency appears to be 25kHz.

It's pretty hard to guess what it might expect as a reply. It's mostly write commands. I'm guessing that turns on the lamp or sets it up in some way. It's the read request that needs to return something. I'll start by just trying to respond with an ACK to the write commands and return numbers that look like an ok temperature range to the read request.

I just read over the thread again and saw the helpful post about what kind of EEPROM is being used. I wouldn't be surprised if this is reading the usage time of the bulb, writing a time, then writing updated usage times. Both times it writes to address 21 are the same, but the first write to 4C is 00 69 while the second is 00 00. I don't know what to make of that yet.

[vanarebane]

Hi!

Thanks for even replying to my topic. It seems that it's hard to get help here. People only seem to be mostly interested in criticizing others

I don't know if you are still with the project, but this seems pretty abandoned for me.

Did you test with a fresh bulb also?
I was thinking that the bulb chip is like the ink cartridge one. That if you manage to re-write the "time used" or perhaps the other way around, "time left" parameter to EEPROM, the projector will think that the bulb is good. It would be good to know what is the zero-usage bulb code

[viperidae]

I suspect this thread is abandoned, but I'll post my progress here in case anyone else finds it interesting.

I got my logic analyzer to capture the signal from the projector. There are 4 bursts. I'm not sure if they're correct.

Here's what it sees

"
START
0xA2 Control Byte: Slave Address 51 Write
 ACK
0x C
 ACK
0x10
 ACK

START
0xA3 Control Byte: Slave Address 51 Read
 ACK
0x 2

STOP

That looks like it's reading address 0x0C10
You could try attaching a 24LC32 eprom to the bus and try different values at that address until the protector does something different.
You'd need to set the eprom address to 0b001 so it responds to the 0xA2 write command.


There's only 256 combinations to try...

The whole sequence looks like it's trying to find some sort of ID number at different addresses of various kinds of eproms.

[abyrvalg]

viperidae, something is wrong there: who sends ACK and 02 value if there is no eeprom attached yet? The transaction directed to this missing part should be NACKed.