Tempo/Greenlee TS90

[cocus]

Hi all,
I've acquired one of these devices (https://tedevco.com/wp-content/uploads/2016/10/MA5770-TS90-Data-Sheet.pdf). Seems to be some kind of TDR for telcos/CATV.

It has a beautiful (and dangerous) EL backlight, and that's it. My unit doesn't start anything. I see "lines" on the LCD, which I considered that it was a problem with the zebra strip on the LCD or the plastic flex. However, I tried to push some buttons, and NO feedback at all: for instance, the button for the backlight didn't have any effect, neither a beep was heard.

I took it apart, nothing blown up. LCD didn't have zebra strips, but rather plastic flex. Tried to push them while the unit was apart, but no change. Figured I'd look for a serial port, found some 3.3 pins on some of the headers, but they weren't changing at all (tested with a logic analyzer and cold boots). Same with the "logic" pins that should go to the LCD (the ones at 5v, not a -14v), they didn't change (also tested with a logical analyzer and cold boots).
There's a freescale mcu (MC908AZ32ACF), and its XT is oscillating when the unit is "on".
The unit seems to run on WinCE .net 4.2 core, and the main SoC is a Marvell PXA255, for flash it has two Intel JS28F128, and for ram you have two 48LC16M16.

Some help or advice on how to repair this piece of kit would be welcome.

My theory is that the EL backlight (which is on a flex-like plastic material) might have arced to one of the flash chips and killed it. Other theory might be shorted tantalums or leaky caps, but there aren't many, and I can see steady voltages (5v, 1v, 2v5).

Thank you!

[cocus]

Well, I've received ANOTHER of these, and this unit actually does something! When it powers up, it beeps, shows "POWER UP SELFTEST" and beeps again and nothing!
However, I was able to figure that there was an UART running on one of the unpopulated headers. Have a look at the attached picture. J101 has 3v3 on its pin#1, TX, RX and GND on the other ones.
Here's the dump, and sorry for it being so crappy (last week was fine, but this week I get garbled text all over the place, and looking on the logic analyzer, I see high frequency noise on some characters, causing them to corrupt):

Code: [Select]

*******Beginning8System<Initialization*******


         CPU ID     = A0 PXA255

         SDcLK[1]<>>= MemClk

         MemClk     = 99.53 MHz

         Run Mode   = 28*<Memclk\x8A\x8D8        Turbo Mode = Run Mode

Mode:    RUN



Beginning SDRAM Scrur...\x8A\xCDSDRAM Scrub Complete



\t SDRAM SUCCESSFULLY TESTED
\x8D
******************************************************

Microsoft Windows CE Ethernet Bootloader8Common<Library Version 1.0 Built Nov 19 2008 11:52:54
Microsoft Windows CE8Etlernev<bootloader 3.3 for the TS/TV90 PXA255 Platform (Built Nov 19 2008)
EbOOVLcDInt             

 ERROR:: OEMReadACQByte returns as no data \xFF .


8-cleqrFrameBuffer 
Blcommon - System ready!
Preparing for download...
jum|ing>to8the image directly
Blcommon - ROMHDR at Address 00000044h
OEMLauncl\xCD\x8AOEMNyunch: Before Fash Read
OEMLaunch
Windows CE Kernel for ARM (Thumb Enabled) Built<on<Mqr813 2003 at 22:52:56
ProcessorType=02d0  Revision=6
sp_abt=ffff5008<s|_irq=ffff2800 sp_undef=ffffc800 OEMAddressTable = 800ba20c
Sp=ffffc7cc
FMD_Init: SUCCESS\x8D\x8AFMd_Init: Reading Flash memory location from Registry 0x610ec
INFO: FMD_Init:<Flqsh Address=0xb9300000  Length=0xa00000.
 
 DAG_MANAGER DLL_PROCESS_ATTACH entered

 +DAG_Init\x8D\x8A+Diqgnostic managerInitialiseAddress


Diagnostic manager Successfully<iniviqlized
 Build test IOCTL DIaGNOSTIcS<MANAGER 

...Waiting for Keypad Interrupt IN KeypadIntrThread...
RasEntry8'|USb'<created
RegistryEntry '`USB' Created.
CTS90App::InitInstance
DIRECTORY xrofiles<\x8D\x8ADIRECTORY My Documents
DIRECTORY Program Files
DIRECTORY Temp
\x8ADIREcVORY Windows
TS90 board
TS90_SPA.DLL LOADED
POWER BUTTON Interrupt Service RoutineThe last line is printed ONLY when I hit the power button again; in which case, consumption drops to about 30mA (where as it was hovering 130mA beforehand). Nothing gets spewed besides that, nothing I send gets received, absolutely any interaction.

HOWEVER, and feeling that this is a lost cause, I analyzed the pinout of the LCD, because it's a big one and looks cool. Since this unit "does something", I just probed with a voltmeter to figure out the pinout. I come to the conclusion that it must be something like this:
* logic signal 0
* logic signal 1
* logic signal 2
* logic signal 3
* -15v
* 5v
* gnd
* -15v
* logic signal 4
* logic signal 5
* logic signal 6
* logic signal 7

Jumping to my saleae clone, I've got the following capture (attached).
Seems like the last four signals are the pixel data, whereas the first 4 are syncs and clocks.
Being somewhat familiar with these signals, I figured the fast one is the pixel clock, the intermediate one is the HSYNC and the slow one is VSYNC. By counting pulses, I gathered it's 200 lines by 640 (because the 4 pixel data are arranged on 4 columns of the display on each clock pulse, and there were 160 clock pulses in between 2 HSYNC pulses; 160*4=640).

Attached is the pinout I figured out.

By that, I found a compatible LCD module from Kyocera: "DMF-50036ZNBU-FW-BAN" (which I also attached).

I'll be using that LCD with an esp32 (with the I2S in "LCD" mode) for some other stuff, until I can figure out how to fix this board .