Ruark Vita audio R1 Mk3 radio will not power up- flash ROM corrupted

[rh100605]

The symptoms were with power applied , the blue led lit on the top but no display. A second example was stuck at "Connecting". The solution is to replace the DAB module flash contents with the binary image attached below.

Checking by pushing the power button pulled down one of the DAB module 2.4v a to d lines and supplied 5 volts to one of the dab module pins.

Checking the power voltages showed that the incoming 14volts was applied to an LM1117 variable regulator which supplied 7.5v until the on button was pushed and then 12v afterwards. Further 7.5v and 3.3v regulators were supposed to be activated by a dab module pin.

The incoming 14 volts also directly supplied a separate 5 volt ST switching regulator that supplied a 3.3v and 1.2v regulators all inside cans.

The OLED display power which should be 12volts was therefore 7.5volts until the DAB module changed the variable regulator and switched in the second 5V and 3.3V regulators.

I checked the OLED display (ERC12864-2 2.6 inch) by attaching it to a Pure Evoke Flow radio display connector via a small pcb adapter. This showed a left right inverted display ( SSD1305?)
I suspected now that this was a code problem in the FS2230 dab module as there was no sign of a blown Kino3 IC.
The FS2230 Tuscany dab module is also used in the Sangean DPR268T and Roberts PlayBT.
 
I extracted the SPI Flash chip AT45DB081E and read it using a CH341A usb spi flash programmer and Flashrom software under linux.

To do this successfully I had to modify the CH341A by lifting the 5V power pin on the corner of the CH341A IC and connecting it to the 3.3 volt regulator.
This was necessary as otherwise the clock and SO lines are 0 to 5V not 0to 3.3V which results in either damage or unreliable read/write.
See EEVBLOG on CH341A programmer.
I also had to make an adapter as the pin out of the AT45 series flash is NOT the same as the 25 series flash ROMs. I used a small 8 pin smt to dip pcb from Ebay.
which is connected to the marked side pins on the ch341a by jumper wires. I used the device AT45DB081D from the Flashrom library to read/write the roms.
Of course you may have your own flash programmer !

I  discovered that the AT45DB081D/E comes in two page sizes 256 and 264 bytes (default from manufacturer). The code I extracted was 264 bytes/page.
You cannot change the page size using the Flashrom program, so cannot use ROMs previously set to 256 page size.
Flash memory fails when too many write cycles have occurred in the same location, many flash manufacturers use complicated wear levelling logic to spread these locations
across the memory automatically.

I looked for the code areas that would be rewritten often such as retained volume/source /station settings.  I used Hex Editor Nero under windows
I tried to find how to force a software Reset of all the settings by erasing the current ones

I then installed the Rom back in the FS2230 and attached a Saleae logic analyser with SPI settings to the flash memory.
I could see the  flash being loaded to the KINO3 processor.
It read the first page at location zero 3 times with progressively larger sections 4 bytes 16 bytes, 144 bytes of the page.
Then started loading from 0x10A0               ( 0x102 or 258 pages of 264 decimal from start )
Taking in a page as two 128 bytes reads at a time and not reading the 8 bytes of 0x00 used as packing to 264 bytes. A total of 0x5280 21.12k bytes
It terminated at the page starting at 0x15C90. ( 0x152 or 338 pages of 264 decimal from start )
This entire process was repeated three times before halting.
The last page read contained tuning information, not code. At this point I changed course as I had no way of knowing what should be in the failing sector.

I copied the flashrom contents from another working Ruark R1 Mk3 into a new AT45DB081D/E installed it and voila the radio burst into life
I have attached the working flashrom copy for you all

NOTE:-
When looking at the address used by the KINO3 boot loader to load a page you need to convert it to find the address in the ROM image.
For example The command E8 02 A4 80 00 00 00 00 is a read command.
The last four 00 bytes are to activate automatic increment when 0x66 is later sent to the flash.
02 A4 is the page address and 0x80 (128 bytes) is the starting address within the page.
To convert the page address to ROM address involves a bit shift right by one(divide by 2) and a multiply by 264
0x02 A4 divided by decimal 2 and multiplied by decimal 264 gives 0x15C90
0x02 04 gives 0x10A10