Ruark Vita Audio R2i DAB/FM radio faulty no response to power button or remote

[rh100605]

Ruark Vita R2i repair Sept 2022

The symptoms were at power up the display would halt displaying either Ruark R2i or Vita R2i on the display.
The radio was not responsive to the remote or power button which is a software button.

The DAB module (Gyro 1128) could be extracted by taking out the 4 screws in the base and the 4 screws in the back plate and then sliding the metal frame out of the radio.
The DAB module can then pulled up from its 40 pin socket and the aerial removed from the back plate by using a socket spanner

The Gyro 1128 DAB module has a customer vAN number 1.4 (Vita) or 2.3 (Ruark).
Desoldering the metal "can" I saw that the processor is marked N488225-1223 and the 8 pin 2MByte flash is MX251606E M2I-12G or TS25L16AP-SCT which is an equivalent part.
It also has probe points marked reset and TMS TDO TCK Dgnd 3V3

I used the CH341a flash spi programmer and the "Flashrom" software under Linux (Raspian on a laptop) to read the flash.
You can also use ASprogrammer for Windows.

I also had to modify the CH341a programmer board by lifting the 5V supply to the ch341a chip (pin28) and connecting the pin(28) to the 3.3v regulator and pin 9 .
See the EEVBLOG for CH341a modification details.

Before I did this reading the flash chip was sometimes unreliable and writing/verifying very unreliable as the sclk/sda/cs line were driven at 5Volts.

I removed the Gyro 1128 DAB module Flash rom using low temperature solder and re-soldered it to a smt to dip pcb for reading and writing.
If you use a hot air iron, the smaller resistors are 0402 33 ohm. Measure them beforehand they fly away easily!

Flash memory tends to fail at locations rewritten often so I examined the flash image using a binary editor. Hex editor Neo or the Linux visual hex editor.
As an act of desperation I erased (set to 0xFF) all the tuning settings from location 1900602 (decimal) 0x001D 003A (hex) to the end of the ROM and then flashed the resulting image into a new device.

This forced a reset by the code and a scan when powered up so...
Fixed by replacing flash memory IC with a new one and programming it with the old image with all the settings set to 0xFF.

I made a copy of the working flash and saved the contents for future sharing, I now have vAN 1.4 and 2.3 working images for the Ruark Vita R2 to share below. These will need to have the file type changed to .bin for most Flash programmers.

I found an R1 Mk3 that had the same symptoms but with no display information. The Tuscany FS2230DAB/Bluetooth board flash chip (AT45DB081 D/E in 262 byte mode) was also corrupted. Also the R4i has similar flash corruption. The working flash images are all in my other eevblog entries

[pej]

You deserve a big thanks for this.  I have been looking into this fault and you have beaten me to it!  It must have taken ages.

I refer to your attached .hex file for Vita Audio 1.4. 

You indicated the contents of the memory was set to 0xFF from 1900602 (d?) (1D003Ah) to the end.

But from 1D0100h there appears to be Somerset and Bristol DAB multiplex data.

And from 1D1A00h there appears to be individual station data Heart, etc.

Grateful if you could clarify if tuning data was set to 0xFF to the end.  I believe the other .hex file for Ruark is similar.
Many thanks.

[rh100605]

Pej,
My pleasure to help.
The Flash binary images are working images . They have been tested in radios which have been factory reset and therefore autotuned.
There is no need to clean the tuning information these images will work immediately when installed
Regards
Rob

[pej]

Rob
I purchased an R2i stuck on the bootscreen to try and learn about these sets. We had a faulty one ourselves (different, easier fault).

I found the Gyro 1128 module controlled the whole set and was at fault, but Gyro Signal who make the module have vanished.  I found a brief datasheet for the module and began to realise it had a customised OEM interface, hence the label the screen.  I removed the screen from the module and wondered whether the MX25L1605D flash RAM was responsible.

Then Google found your excellent post describing this fault.  The genius thinking was to erase the tuning data.  I was not brave enough to take another working set apart to copy the ROM.

So what I did -

1. Ordered more MX25L1605D flash roms.

2. Found the lastest Bullseye 64-bit operating system for Raspberry PI had Flashrom already installed - all that had to be done was to enable the SPI interface on the header.

3. I successfully read a new blank MX25L1605D and saved the blank image for later unexpected use.

4. I realised the required pins to program the flashrom appeared underneath the Gyro 1128 as follows:

TP1 SS -> pin 1 of flash chip
TP2 MISO -> pin 2 of flash chip
TP3 MOSI -> pin 5 of flash chip
TP4 CLK -> pin 6 of flash chip
TP5 reset -> pin 21 of the Gyro 1128 header (later used as a ground for programming as is it active low)

5. I took a brass rubbing of the underneath of the Gyro 1128 and pin pointed the above test points which I transferred to a PCB shown in the attached photos.  The PCB was cut to precisely fit between the motherboard header connectors as photo attached.  I purchased some spring connectors and made a complete jig.  Simple concept - but the accuracy was hard.

6 Here is perhaps the best bit!  The reset/header pin 21 is not used by the R2i motherboard and it is active low.  I grounded header pin 21 by connecting it to the outer body of the RF input outer as per photo.  TP5/reset is also now the ground connection for the purpose of connecting a programmer and I ALWAYS check TP5 is shown as grounded at the programmer before powering.  Switching on the R2i with the reset to ground short did not even show the boot up screen - good.  And even better all the required pins on the flash rom were high impedance when checked - excellent.

7. To be extra safe, Vita Audio R2i was powered by batteries for programming.  I downloaded the faulty ROM for later examination.

8. I sent the command:
flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=2000 -c MX25L1605D/MX25L1608D/MX25L1673E --layout lay --image tuningda -w blank.hex

This updates/resets only the tuning data without touching anything else.

9. It worked.  First there was a full scan and I think it unusually said 'Services N/A' when finished.  FM was working.  I went back to DAB and it did another full scan - all working this time. I did a factory reset afterwards.

10. I purchased a TIBO 161-DAB50-000 BOARD DAB MAIN BOARD/DAB TUNNER PCB REPLACEMENT because it had a Gyro 1128.  Unfortunately the flash rom was faulty and would not read.  I replaced the ROM with a new one and tried both Rob's images above to program it.  Both images worked showing either Ruark or Vita on the boot screen.  That was the only difference I could see.

And so that leaves the question what was wrong. I cannot fault anyone for replacing the flash rom.  That is the logical answer and quicker than building this jig.  But when I looked at the tuning data of the faulty ROM (attached for info only) there are large patterns of numbers spread over the tuning data suggesting the system may have crashed.  Was it the flash rom or a power glitch? - I don't know but the set is still working months later with a lot of use.

I hope you found the above interesting and I was certainly thrilled to see the set working again and now have a spare DAB module with thanks.
Peter

[rh100605]

Pej,
Excellent post, I too have tried to understand the exact damage to the flash memory. Your jig allows many more detailed experiments.
I thought that I would share what I know.

First I found that deleting just the tuning data does not reset the radio.

Second I used vbindiff to compare the flash image with the tuning data to end set to 0xFF and the same image after running in a radio.
There is a difference in the main body of code. A repeated two byte (pointer?) . No new information is written after the tuning data.

My guess is that the original image contains upgrade code sectors which when deleted make the code revert to a lower level
Normally I would use a saleae logic analyser in SPI mode on the flash memory to find out what is read just before it halts. However getting a clip inside the frame of an r2i with all other connections on proved very difficult. Your jig allows this.

Thanks again for the post maybe you can isolate the exact sectors that need deleting or correcting