Intro #
So after I managed to fix the vacuum cleaner and contacted the family member to write about the status, he said that he had another broken device that i might be able to fix. Its a Philips tv that was from his son that had a no-power issue. So after he came and took the vacuum cleaner, he dropped of the dead tv.
External problem diagnosis #
So a no-power fault could mean anything, but most of the time it has to do with the powersupply off the device, that converts AC 230v 50hz mains to low voltage DC for all the electronic components inside to work with. He tried another cable and it had the same fault so it was definitely the tv itself was broken.
Teardown #
So I opened it up by undoing 6 screws on the back and 3 underneath.
And here is the pcb itself
The important chips on the board #
Normally a TV has 2 boards, a powersupply board and a main processing board, but in this case they merged both into 1. That white patterned area is the isolation between the high voltage spicy stuff and the low voltage processing stuff. Under the grey metal radiator (called a heatsink) is the main cpu, which i think is a mediatek SOC (System on chip). The fact its an SOC means it also must have RAM built in. The square chip in the top right above the heatsink is a kingston emmc chip. EMMC stands for “Embedded-MultiMedia-Card” and its closer to a sort of “soldered on sdcard” as normally you have a single NOR or NAND flash chip and then the main SOC talks directly to it due to a flash controller built into the SOC, but in the case of EMMC, it has that flash controller inside off the same package. Also EMMC is often very cheap. This EMMC likely stores the bootloader and the Linux OS off the TV. Fun fact: In Linux it often mounts EMMC as /dev/mmcblk0p1, the same type as an sdcard.
The powersupply #
So as i already have said, often when a device does not power on, its a fault with the power board. The powerboard converts the AC 230V 50hz mains (120V in America) into lower voltages. This powersupply is typically off the SMPS (Switch-mode-powersupply) type and its a very efficient type. In the past we used to have those bulky iron hunks of a adaptor. Thats actually a Linear powersupply and its much simpeler. Its basically just a transformer that converts the 230v to low voltage 50hz AC (eg 12v) and then at the output off that big transformer is a rectifier circuit that rectifies the AC into DC. And sometimes there is a linear regulator to get lower voltage but not always. That big transformer is heavy and also very inefficient. SMPS powersupplies solve those issues of heavy and inefficient.
How a SMPS works #
So a SMPS works a whole lot different than a old style Linear powersupply. The SMPS works in this fashion: Ac230v comes in, goes through a fuse, then it gets rectified bny a fullbridge-rectifier into somewhere arround 340V (peak) DC. This DC voltage then gets stord in a large capacitor. Then this 340V goes into a switching circuitry (this is where the switching in the name comes from). This switching circuitry consists off an IC chip that generates pulses and a MOSFET (Basically a super fast electronic switch). The MOSFET’s job is to switch the 340V into the transformer and the task of the IC is to generate the pulses for that MOSFET as transformers only work with AC or pulsed voltage. The transformer is very small and often works at a much higher frequency than the big bulky iron core transformers. These also often have a ferrite core. These are called flyback transformers and work through some principle i am not bothered with to explain but you can search it up here. They run often at a few hundred KiloHertz instead of the 50/60Hz of a typical iron core transformer. After it gets pulsed into the transformer, the output off the transformer will be a much lower voltage. The transformer also provides a galvanic isolation (although the same is for a iron core transformer which also provides isolation). After it went through the flyback and came out the other side, it gets rectified by some diodes and capacitors into low voltage stable DC. The primary side of a SMPS is the side with the higher voltage and the switching components and the secondary side is the lower voltage side that comes after the transformer and is safe to touch. In a good SMPS, the primary is isolated from the secondary so you wont get a shock and its safe!
There is also often a feedback circuitry in the form off a voltage reference and a optocoupler. The optocoupler is basically a led that is pointed towards a photo sensor and thus provides galvanic isolation, while still alowing a signal to flow from side to side. The voltage reference controls this optocoupler when a set voltage is reached. This way the low voltage side can safely talk to the higher voltage side with the switcher IC and MOSFET and basically control it depending on the output voltage and or load, without any potential high voltage that can go to the secondary side and either fry components or shock you. When for example the SMPS is designed to output 12v constantly, you want it to constantly output 12v. When a smps is unloaded, it often creates a bit more voltage, so then the voltage reference can control the led inside the optocoupler and this way tell the switcher IC on the primary side, to decrease its frequency and thus decrease the output voltage. When a SMPS is loaded, it often drops in voltage a bit. Then the voltage reference and optocoupler can tell the switcher IC on the primary side to increase the frequency and thus create the extra needed power for the load.
In reality, its a bit more complex than this simplified explanation here, but the most important upsides a smps are that it can be very small, lightweight and very efficient. Thats also why laptop chargers and phone chargers and a million other devices use it.
Power factor correction #
In some powersupplies (often those of computers and laptops), there is something called “Power-Factor-Correction”. Explained in simple terms, it increases the efficiency of an SMPS even more, by lowering the current draw from the source and also it lowers distortion on the line. It does this by basically boosting the normall 340V peak off the AC sinewave to arround 390-400V. It does this using a circuit called a Boost-converter, as the name applies, it boosts the voltage that you put in and puts that at the output. Normally you have the mains 240v going directly into the full-bridge rectifier and then comming out as pulsed High voltage DC which then gets stored in those big capacitors and then goes to the switching circuitry. In a SMPS with PFC, It first goes into the Boost converter before going to the switching circuitry. In our case our SMPS does not have PFC as the mains after the rectifier goes directly into the capacitor and switching circuitry.
Safety considerations when repairing a product that plugs into the mains. #
Because it stores the full rectified mains voltage into a large capacitor, Repairing a powersupply is not for the beginner and CAN BE VERY DANGEROUS Capacitors are kind of like water towers. They store and can keep energy inside for some time. So you must ALWAYS discharge such capacitors before repairing a product. Some products have bleeder resistors that when the device is unplugged, bleed the remaining energy away and turn it into heat. This safely discharges the capacitor in a few seconds to a few minutes, alternatively some products have circuitry that keeps running and bleeds away the remainig energy in the capacitor when unplugged. Not all products have these and you should NEVER assume things. At my engineering study, i have learned “Assumption is the mother off all f*ckups”. As a kid i have once touched such capacitor and it was not fun and gave me quite a zap and scare! I survived, but thats because i touched both pins with my hand thus the voltage travled through my fingers and hand and not through my chest, but there are people who have touched both pins and they almost died. Electroboom is a youtuber who is a profesiona; electrical engineer and does stunts with high voltage, mains and capacitorsm, mostly for laughs and entertainment while secretly filling your rbain with knowledge. Almost all his stunts are planned and staged and he does it in a way thats both safe for him and entertaining for the viewer, but he did have a near death experience when he accidentally touched the output of a microwave oven transformers and he got saved due to loose wires which disconnected just in time. So beware, electricity can bite you when you least expect it. Luckily i know all the rules and am very safe and steady near electricity and capacitors. ALWAYS MEASURE the capacitors before working on electronics. And if the capacitors hold charge, discharge them with a resistor or discharge tool. DONT SHORT THE TERMINALs as that can create a big spark and can damage the capacitor or the tool you short the pins with.
Finding the fault #
Measuring and discharging the big capacitor on the primary side. #
As you can see in the picture below, the capacitor is still charged to arround 300V, so still in danger teritory. And because I want to work on it without getting a surprise, i will discharge it.
Microscope work and inspection #
So next i started looking arround the board for any failed components. I also did a sniff/smell test cause sometimes when a component fails, it burns up and can cause a nasty smoke or smell to occur, but that was not the case here. Because the psu board is not external and is instead merged into the main board, i cant simply do any easy power injection, so I have to look arround for posibel clues on why it does not power on. Usually the powersupply circuitry generates an auxilairy voltage rail that is alays active and basically powers up some critical chips. This voltage is also why on a lot of TV’s when you turn it off, it does not fully turn off and you see the standby led. This is also the voltage that allows the tv to respond to a remote control wakeup call. And it often makes sure that the OS off the tv is booted up in the background and ready so you dont have to wait ages for it to come out of standby. The fact that not even the power led lights up and thus no auxilairy voltage is available means its definitely the smps that is at fault. But thats not the only symptom. Remember that that large capacitor was still charged to nearly the peak off the AC voltage (340v)? That means that no active circuitry draws anything from the capacitor and also because there are no bleeder resistors, it stays charged. This means the Switching circuitry is not running/working, so i narrowed my focus on that section.
Switching IC fault diagnosis #
So in my case this package with 6 pins and a gap between the first and 2nd pin is the switching ic. Because i dont see any aditional components that look like power MOSFETS and because it has a gap between pin1 and pin2 means that it has the MOSFET built into the same package. This is cheaper for the vendors that use these components as they will have less BOM (Bill of materials) costs and dont have to integrate a MOSFET location in their pcb schematic. Some powersupplies have the MOSFET external, but some have it integrated. Some phone chargers also have an all-in-one IC doing everything.
I did measure the CS pin on the ic (normally meant to hold it into reset/disable it) and that measures normally. The IC gets all voltages and all components read fine, so the IC itself might have failed. I dont see any burn marks or marks of overheating, but sometimes components fail in a non exciting way and from the outside might look totally fine but internally are dead. So I will attempt to replace this IC.
Repair #
So first i went and desoldered the old IC. This IC is in a SPAK-6L package. This means its a power package meant for lets say, a MOSFET or regulator or in this case, a primary switching IC. The 6L bit means it has 6 legs and the SPAK means its a smd mounted Power package. A power package means it has a large metal pad on the back/underside off the IC, which is meant to be sodlered to a alrge copper area on a pcb to act like a heatsink. This means you cant just desolder the pins, you need to first heat up that massive heatsink pad to get it detached from the board and then desolder the pins. SO i started by applying flux. This liquid helps the solder flow and also cleans up the pins from any oxidation and is often used to (de)solder stuff.
Putting in the new IC chip #
So for me it is 2 weeks further and the ICS from both sellers came in the mail. Now i will solder the new ones in and see if it works. Here are some photos of the IC’s. I did some off-camera testing anfd verifying they are real and not rebranded fakes and indeed, they are real! Although i put the one that came in the reel-strip as i trusted that one more as it seems direct out of production, as many components straight out of production are put in those tape-reels.
And here i put one under the microscope
And here i soldered it in. I use a ton of flux and it does not look that clean but i’ll clean it up later.
Testing & Dim-bulb-tester #
So The repair is done and its time to test. Will i let the magic smoke out or will it work? We shall see! To Limit any catastrophic failures, I will plug the TV into whats called a “Dim-bulb-tester”, this basically is a very simple circuit. Its just a incadescent lightbulb thats put in series with the output, so incase the output goes shortcircuit, it will light up the lamp and limit any big pops or surprises. The bulb i will use is rated for 60Watts which is quite standard and using the formula of Power (P=U/I), We get that 60Watts divided by 230v (I=60w/230v) is around 0.26Amps so the circuit will allow 0.26Amps to flow, which should be enough to atleast get to see the standby light turn on, but should be limiting any major surprises. Below you can see the circuit. Its really easy. Its a socket, plug and a bulb put in series. The Earth/Ground wire is connected straight thru, but the live is put through the lamp and goes to the socket. I soldered the wires backwards but it should not really matter as much and i can always plug it in reversed. Put some heatshrink over the soldered ends so i dont get a shock when i touch them, but always be carefull around mains voltage and handle it with care and respec as it can get you when you least expect it. Because these incadescent lamps are not really being made anymore due to them being replaced with led and incadescent being considered old wastefull inefficient technology, it was hard to find a lamp that did not cost a lot. Luckily we had one laying in a garden shed that was unused and luckily still worked, so i used that. But they are pretty much unobtainium these days, which is sad as, cause a dim bulb tester is handy for testing devices you are working on that run on mains without getting nasty surprises.
On the back of the TV is a UART service port. This is a serial port that allows access to the underlying firmware/os and you can view bootlogs and other stuff rom it. I decided to use it so i can see what it does on boot and see if the processor section boots up.
Below i’ll post a small snippet off the bootlog and what it spits out at boot on that serial port. This will be the bootloader stage, but you can view a full snippet here if interested.
UART_115200
AC_ON
01-2L-SM-01-20190815
MIU0_DQS-OK
BIST0-OK
optee teeloader entry
CusConfig
eMMC_RPMB_Check_Program_Key
*ree_opt=0000007B
Auth reeloader...
Decrypt reeloader...
Check reeloader magic ID...
Version check on reeloader...
Auth CKB...
Decrypt CKB...
Check CKB magic ID...
reeloader_addr=20100000
NOTICE: BL3-1: v1.1(debug):73b46b69
NOTICE: BL3-1: Built : 23:06:25, Nov 28 2023
INFO: warmboot return address : 7dcc1c00
INFO: BL3-1: Initializing runtime services
NOTICE: From args : boot_mbx = 2002808c
INFO: [0;32;31m [Booting] mstar_send_magic_ATF 479 [m
INFO: BL3-1: Initializing BL3-2
[Ramlog] ramlog_init init success
INFO: BL3-1: Preparing for EL3 exit to normal world
INFO: BL3-1: Next image address = 0x20100000
INFO: BL3-1: Next image spsr = 0x1d3
INFO: BIN1_32bit mode Nov 28 2023 23:06:25
INFO: R1 0
INFO: R2 0
INFO: R3 0
ree_entry
U
Relocation Offset is: 01A00000
[AT][MB][start ub][592]
U-Boot 2011.06-00004-gf9d2e460385-dirty (Nov 30 2023 - 19:04:45)
[Mboot] ===== sw IR Config Register =====
[Mboot] ===== Attach IR Interrupt ======
[Utopia][SYS]: [35mFunction = SYSOpen, Line = 3585, current resource pri_shm content is: 0[m
[Utopia][SYS]: [35mFunction = SYSOpen, Line = 3604, [SYS INFO] OPEN INSTANCE...[m
create instance at 287F19E0 with private size 108 bytes at 287F1A30
[Utopia][MIU]: [MIU INFO] miu opencreate instance at 287F1AA0 with private size 168 bytes at 287F1AF0
create instance at 287F1BA0 with private size 60 bytes at 287F1BF0
Uboot Relocation: 152 MiB
eMMC: HS400 200MHz
eMMC 3.68 GB
eMMC: used life: 0~10%
CID:0x004822DE
0x164D0234
0x30373236
0x4D000170
uboot held at [285DDF60~29800000],size=012220A0
Now running in RAM - U-Boot at: 28E00000
DRAM : 1536MB
SAR5=ON
Enable UART
In: serial
Out: serial
Err: serial
Net: No ethernet found.
Blk = 0x34, Offset = 0x1D0
, DramAddr = 0x250001D0
=>cmd: mmc read.p.continue 0x25000000 eeprom_a 0x34 0x200
[ eMMC_FCIE_PollingEvents() ] eMMC Err: 100000 us, Reg.0000h: 0002h, but wanted: 0001h
[ eMMC_CMD17_MIU() ] eMMC WARN: CMD17 Reg.12: FF08h, Err: 80000005h, Retry: 1, Arg: 1F234h
eMMC Warn: slow clk to 200.0MHz, 90h
[MAC] 0x68: 0x7: 0xA: 0x9F: 0xA1: 0x4A
create instance at 28802068 with private size 44 bytes at 288020B8
[AT][MBoot][Driver Init][888]
mmc change mount : tvconfig
** File not found model.info
[0;31m[ERROR] vfs_getsize:420: [0mext4filesize mmc fail, try again!
** File not found model.info
[0;31m[ERROR] vfs_getsize:424: [0mext4filesize mmc fail
No enough buffer or path fail(model.info) :
[src/MsUtility.c] [loadscript]
model.info not find !! Clean model_info env
Writing to MMC(0)... 128 blocks written: OK
128 blocks written: OK
done
Boost PCBNVM_UARTControl do nothing, 0x38F0 = 0xA0, prestate = Off
Panel Path:/config/panel/TPV_Pnl_18.ini
0:MCP_N_D3_2133_8G_4x
1:MCP_N_D3_2133_4G_4x
DRAM Channel 0 Size = [2048MB]
Changelist: 24543697
============= set bootargs ===============
Hit any key to stop autoboot: 0
bootcheck: Security Version: Yes
enable dont overwrite function
AC on
POWER ONThe bootloader is Uboot and the tv also has something called Optee, which is a sort of “secure lowlevel Operating System” that allows non-security-critical software/Operating Systems to boot up (eg: Embedded Linux or Android). This is needed to comply with DRM (Digital rights media) and other anti-piracy laws and also is needed or else the product cant be sold. I wont mess with this further as i dont want to cause any other damage/harm. I do know how to safely navigate UBOOT due to my hardware hacking experiences, but i wont do anything here. From these logs, its good to know the processor section is alive and well.
The digital section is alive, but what about the screen? #
Sadly i dont see any screen activity. I also dont notice any backlight being lit. Normally it would show the philips logo in the bootloader stage but it does not seem to show that either. I did not break anything and i handled it with care, so either it must have been like this when i got it, or there was a chain of multiple faults and the PSU was only the tip of the iceberg. I am glad the PSu works, but without a functioning screen/display, it wil not be able to do its job as a tv. I’ll look into this furhter.
So i opened it up and found that the bakclight had a wire that disconnected, so i soldere that back again. (it broke luckily outside of the display assembly so i did not have to tear down the display and risk more damage). After that, the backlight funcitoned again! Sadly i do see a red, green, blue, white, black flash pattern. I read this could mean the display either does not get the correct signals/does not get any signals, or the T-CON is abd. The T-CON is what sits between the main motherboard and the LCD panel. It takes in the video signals from the motherboard and directly drives the LCD panel. The T-CON uses laminated ribbon-cabels to connect to the display and they are laminated/soldered on. It could be that one of these cables is lose/broken or the T-CON itself is broken. If thats the case, the repair ends here as i wont replace the T-CON and display, as they are married together.And if i where to buy a whole scren replacement, the cost would probably be at the level that you could rather buy a new tv.
One last attempt to fix it #
In the boot logs, I did notice that it failed to access some files. Below is a snippet of what it says.
** File not found model.info
[0;31m[ERROR] vfs_getsize:420: [0mext4filesize mmc fail, try again!
** File not found model.info
[0;31m[ERROR] vfs_getsize:424: [0mext4filesize mmc fail
No enough buffer or path fail(model.info) :
[src/MsUtility.c] [loadscript]
model.info not find !! Clean model_info env Maybe this missing model.info could be causing a initialisatio issue with the panel. Maybe it is getting initalised, but the bootloader does not know how to drive the panel correctly and thus causes the T-CON to flash the R, G, B, W pattern as its not being fed (the correct) information. And maybe the kernel also expects this file to exist. So i wil update the firmware and see if that maybe fixes things. Maybe the PSU was on its last legs, then a firmware update happened, it did not complete and after that the PSU died and left the tv in a no-power state and after i fixed the no-power state and after that it still was in the corrupted-firmware state. This is just a guess and i am not fuly sure. SO next was updating the firmware. I gone to the philips official site and downloaded the NL firmware as this tv wil be used in the Netherlands. The file came in a zip and after unzipping it, i had a Autorun.upg file. I dont know what it contains, but its probably a Kernel image, backup kernel, rootfs, backup rootfs and the other stuff it needs. Formatted a 8GB USB drive to fat32 and put the Autorun.upg file on it. Then plugged it into the tv and powered it up. I did check with the UART to see if it could read/access the file and if it is what it expects. Sadly it seems the update utility in UBOOT did not accept it. But i did see that it said that it was searching for Upgrade_loader.pkg so i renamed the file to that. After doing that, the bootloade rdid seem to accept my update file and it did a CRC hash check to make sure its legit/signed and to make sure it is what it expects. It did and after that it started reading the file. After reading the contents, it wrote the partitions to the EMMC storage and after 10 minutesd it was done! Below is a picture of the UART while updating.
Sadly after updating it still had the error. My sister has a similar tv so i hooked up UART to that and found it also has that error. That tv did work fine, so the error must be related to some missing non-critical/non-important factory calibration/setup file that i dont need to worry about and thats not relevant to why the tv wont turn on the display. I did measure the signals and all connections are connected, but still shows this color pattern. So i think our repair ends here unfortunately :(. Also i dont know if i somehow caused it, or if its an effect of a failing T-CON board or failing connection between display panel and T-CON, but i did notice that the screen had some artifacts, so i do really believe its a bad panel/T-CON. I did handle the tv with a lot of care so i dont think its my fault either (or not on purpose).
Conclusion #
So unfortunately a no-fix, no-repair! I spoke with my client and he said that it was unfortunate that i could not fix the tv for him, but that it did not matter that much, but he still wanted to pay me for the research and repair attempt, so i am gratefull for that! I did not charge him for the components, as i can use them myself and it just does not really feel good when i do charge someone for components that did not end up fixing the issue. This is just my morals and moral compass coming in clutch.
You cant fix everything unfotunately and some repairs are not economically worth it. And we are living in a disposable society. Appliances are simply not built like they used to be. Nowadays its built down to cost and sometimes vendors purposely engineer it to break after X years so they can keep getting more money and they can get richer. Its not about the consumer much anymore these days, its about the companies and the rich corporate CEO’s.
Nowadays the consumer is mostly the product, paying with their data or money. I always will keep in my head “Nothing i life is free”, “if its cheap or free, the consumer is the product”. Louis Rossman owns a repair group and he actively reminds people off thee anti-consumer things. He is an advocate for right-to-repair and i really like what he is doing and i like how he protests against all these things. He is the one who made me realise that products are built down to cost and are purposely locked down/paywalled behind subscriptions and engineered to fail in a manner of time. Rossman is who inspired me to also fight for right-to-repair and to fight for consumer rights and step away from as much bigtech as i can/am comfortable with.
Apple is a great example. They purposely make macbooks and apple devices harder to repair by either soldering on memory and storage or by putting glue and vendor locked/serialised parts in their products.
HP is another example. Their printers are built really cheaply, but the ink costs a fortune. And they pulled an apple moment, becasue they now serialise ink, so only HP verified ink works in their printer.
I did howeverr really enjoy this repair and faultfinding stuff and its also education value! I usually watch channels like “My Mate Vince” and “Buy it fix it” who do repairs. I also learn much from their videos but the best education for me is when i get to do stuff. I also learn better by just doing, failing, standing back up, trying again and so on. I did enjoy using the dim bulb tester which i got as an idea from “Buy it fix it”, he also uses it whe testing a mains powered device he just repaired. And i enjoyed discharging that fat capacitor too! I found it a bit scary but also gave me adrenaline and after i discharged it safely without spark or shock to <12v it felt great! I am always scared of mains voltage and big capacitors, but this way i do learn to be more comfortable around them. But you should still hold your guard up as it can stil get you unexpectedly. I do know the safety rules so the chance is minimal.
Dangers asside, i did also enjoy working on the SMPS and i could apply my youtbe gathered knowledge here as i knew how flyback based SMPS worked.