Repair attempt of Epson ELPDC21 Document Camera [SUCCESS!]

[pandrew]

Hello,

I got a non-working Epson ELPDC21 Document Camera from ebay.
When pressing the power button, the light keeps blinking and never stops.
I opened it up, it has this mainboard called "H757MA_R2" "2176136". (See attached images top, bottom.jpg)
It has Freescale (/NXP) MXIMX6D5EYM10AD applications processor,
a small microcontroller that is always on, to handle at least the power-on of the main CPU. (Epson S1C17W04),
a THP7312 image signal processor between the camera cable and the application processor, and
and MDIN-325 chip, I'm guessin this is to handle VGA input.

Unfortunately I can't find any schematics.

I measured various DC-DC converters, and linear regulators (5.15V, 3.3V, 1.2V, 1.8V, 1.35V, 1.42V, 3.0V)
I don't quite know if all of these are right, but the DC-DC converters (TPS62140) all seem to have their powergood pins high.
Even the ones with the slightly weird numbers.

I probed around and I found a UART signal with a baud rate of 460800 bps. (see attached yellow_wire_is_uart.jpg)
It's running UBoot + some embedded linux, see attached term.log for what it spits out.
It looks like it tries to download firmware into the thp7312 via SPI, and it fails.
Unfortunately I can't find a datasheet for the thp7312, so I don't know anything about it, not even pinout.

I have went searching for an SPI signal, and I found the following: (see attached spi_pins_found.jpg)
The SPI CLK has a nice 20MHz CPOL=1 type SPI clock on it, and I found one via that looks like there's data transfer
happening on it, I think it's probably MOSI. (see attached sck_and_mosi_waveform.jpg)
I have also found what I believe is SS, a signal that stays low for the entire length of the transaction.
Interestingly I have also found a second signal like that, which is wider, if I were to guess, I think the wider
signal is probably a reset pin for the mission mode portion of the chip, and the chip must be held is reset while
uploading firmware to it. I do see activity on some other pins, that begins just as the supposed reset signal goes
high, so I don't think this chip is fully dead at the very least.

See attached images: sck_ss_waveform.jpg, ss_and_reset_waveform.jpg, ss_and_reset_location.jpg
Note that SPI bursts like these only happen 3 times during boot.

I did not find MISO. This could be because it's just not in the area in which I have probed vias, or it could
be that the MISO line is non-functional. I certainly haven't found any other lines that would be correlated to SS,
and normally the MISO should go floating while SS is not asserted, so I think I should have noticed something.

Since I don't have a schematic, or a datasheet for the "THP7312", I'm not sure how else to scientifically attack this.
Any advice would be appreciated.
If I don't get any advice my next step would be to hit it with hot air, and try to reflow the THP7312, but my hot air reflow
station is a little old, and I'm afraid I'll damage it.

Thanks!

Note, some tips for anyone who might find this post via search and are debugging their own board:
* You can short Pin 2 of connector CN2001 to ground, to simulate a press of the power button if you have the interface board disconnected.
* You can short Pin 4 of IC1600 to ground, to reset the applications processor. Note that IC1600 is probably "S-80928C" voltage detector (with G8Y SMD marking),
and Pin 4 is the open drain output that is connected directly to the reset of the applications processor, so you can cause a reboot by shorting this pin to GND.
The reboot that you cause this way won't turn off power, so you won't have to press the power button, it will just immediately try to reboot.

[pandrew]

The waveform attachements didn't fit in the first post so adding them here

[physicsonion]

I got two elpdc21 from eBay, just like you. Now both are showing the same symptoms you describe.
How much further did you get? Any luck with heat?

I am thinking about buying elpdc11 and putting its internals into elpdc21 housing.

[pandrew]

@physicsonion -- did you also check the UART output? Are you receiving the same error message as I am?

Did you do a physical inspection of the motherboard, do you see anything blown?

Reflowing the THP7312 didn't help.

I ordered a new THP7312 from aliexpress, I'll try replacing it when it arrives.

You're thinking of moving the motherboard of the ELPDC11 to ELPDC21? Did you find some source saying they're compatible?

[pandrew]

Success!

TLDR: It was (most likely) not the THP7312 chip's fault. It was caused by a not-well-seated connector in the camera head!

I replaced the THP7312, but I don't think I needed to, since it was initially behaving exactly the same as before.
However as I was testing the new THP7312 I noticed an extra error message that was there only when the camera was connected to the mainboard saying (I could have noticed this error message with the old THP7312 too, I just wasn't testing the UART output with the camera connected, which was my mistake):

Code: [Select]

thp7312_mipi 0-0060: 0xf001 read failed

That was weird, that register that it failed to read is clearly a thp7312 i2c register.
(We still don't have a datasheet but here there's some free software code that someone's been recently trying to add to the linux kernel: https://git.uk.ideasonboard.com/THine/linux/src/branch/epaul/v6.5-rc1/rc/thine/thp7312/drivers/media/i2c/thp7312.c#L73 , and f001 seems to be a CAMERA_STATUS register)

So if connecting the camera makes i2c inaccessible, one explanation would be that the same i2c bus goes to the camera too, and it gets screwed up somehow. So with my attention now directed to the camera head, I opened it and found the big connector half-unplugged. After plugging that back fully, everything works fine, and the firmware download retries and fails are also gone.

Opening up the camera head was a bit painful, I removed the screws from the ring light, I disconnected the ring light wires, I removed the two white pads from the front, where I found two screws, and I removed the other two screws as well from the camera head. And I also had to remove two screws to open up the first joint cover. Then I had to cut a cable strap that was tieing the cable to a metal piece, without cutting the actual cable, and then I had to massage the cable upwards a bit, so I could successfully extract the camera assembly from the front case. (This was the most painful part). Then removed 4 more screws to look at the back of the PCB, and there is where I found the half-disconnected big connector. Be careful, there's two metal inserts that act like nuts for the screws that were under the white pads, those can fall out easily, and also the white button used to set the ring light brightness can fall out. I re-seated the connector, and I added some tape to the big cable cause the joint started to tear up the insulation, and then I reassembled everything in the opposite order.

I wiki-fied some of the information I now know, in order to help people trying to repair the same device in the future: https://repair.wiki/w/EPSON_ELPDC21

@physicsonion I hope you have the same problem and my experience will help you too.