Reference design and clones

MG35 is probably based on the EM8510 Portable Media Player Development Kit, which contains a reference design. Or maybe on DVD-8500 Reference Design.

We know some clones, and it looks like the firmware is interchangeable between these units (but if you are updating, you're doing it on your own risk!!! ):

• Network Media Player-35 by Freecom - firmware here.
• Movie Cowboy DC-MC35UL/N by Digital Cowboy - firmware here.
  • This is the model that comes with the USB host controller.

Main board chips

Note that some chips may be different to your MG-35, particularly flash and SDRAM, but the base configuration is the following:

Media processor: Sigma Designs - EM8511-Rev.A = Digital media processor with MPEG-2/4 and DVD decoding.

The heart of this board is the Sigma Designs EM8511, a digital media processor incorporating a 200MHz ARM CPU (specifically PT100, as seen in the cpuinfo below), an integrated IDE controller and the audio and video decoders. The system bus clock is 100MHz.

The CPU info, as in /proc/cpuinfo is:

Processor       : ARM pt110 rev 0 (v4l)
BogoMIPS        : 80.69
Hardware        : JASPER
Revision        : 0000
Serial          : 0000000000000000

According to product brochure, 8511 it's  the non-Macrovision version of EM8510. If you google for "em8510 datasheet", among a lot of useless sites you'll find a leaked datasheet (hint: it's on a wiki). On the same product brochure you can find the block diagram.

You may take a look at the documentation for the ARM7 core. 

Q: The source code is compiled with -mtune=arm7tdmi -march=armv4 options. Aren't they contradictory?

A: I think the confusion comes from the crazy ARM version numbers and names. The ARM architectures have different versions, and one of the "v4" implementations is the ARM7TDMI (which EM8510 is, I believe). So those switches seem more redundant than contradictory, as both of those switches select the same instruction set, 4T (which I'm told means that it is v4 with the additional "thumb" instructions). And then there are the marketing names, like "Cortex", in case it wasn't already confusing enough. The confusing part is that Arm7 is a "v4".

Flash Memory: 2x Samsung - K8D1716UTC or Spansion - MBM29LV160TM

16M Bit (2M x8/1M x16) Dual Bank NOR Flash Memory. Total 32Mbit = 4MB. PDF for Samsung and Spansion. The two flash chips are both in word mode with each handling 16-bits of the 32-bit bus. OE and We are fired to both chips no matter which word is accessed. This is fine for reads but requires care when writing - see the source of the mgnv utility for more information.

Notice the paint dots on the flash chips at the top right of the picture in the [JTAG section]. Both chips have a yellow dot and one has a dot of a different colour. These dots are to let the manufacturers track which chips are programmed and which are high word versus low word. This suggests that the manufacturers don't use in-circuit JTAG programming!

Host SDRAM: 2x Samsung - K4S641632H-TC60

8MB 166mHz SDRAM module. (16MB total).

Video SDRAM: 1x Hynix - HY57V643220DT-6

8MB 166mHz SDRAM module. Probably the video+overlay memory.

Stereo DAC: 1x Wolfson - WM8728S

WM8728 is an audio DAC, which is a 24-bit, 192 kHz DAC. It has a  software mode, but the MG35 doesn't use it. Instead, it uses the hard-wired mode. The WM8728 is hardwired as follows:

• 48 kHz sample rate
• 24-bits per channel
• I2S audio format
• De-emphasis turned OFF 

The WM8728 has a nice built-in volume control, but it is not accessible in hard-wired mode.  So the EM8511 has to control the volume by scaling the data that it sends to the DAC. The shortcoming with this approach is that, as you lower the volume, you also lower the dynamic range. On a scope, you can see the audio data shrink from 24-bits to 16-bits as you lower the volume. Fortunately, 16 bits is adaquate for most audio sources (CDs are only 16-bit).

The left and right outputs of the DAC go through the obligatory low-pass filter, and then to an MS6308 op-amp. The MS6308 is an integrated class AB stereo headphone driver. Although it was designed to drive headphones, the MG35 uses it to drive the audio line-out connectors (red and white). I don't know if this 're-purposing' is good or bad, but the specs seem plenty good enough.

Ethernet Controller: 1x Davicom - DM9000E

10/100 Mbps. One can consult the datasheet and some speed test results for  DM9000A and DM9000B.

CPLD: 1x Altera - EPM3032A

EPM3032A is a CMOS EEPROM-based CPLD with JTAG-ICD support. It has 32 macrocells, 2 logic array blocks, 34 I/O pins. PDF here. It can be programmed via J7 JTAG connector, but that's of no use for us.

USB2.0 to IDE bridge controller: 1x Prolific - PL-2507

Functional description here. It seems that the USB interface has direct access to the HDD, without passing through the firmware. We suspect the Prolific USB->IDE chip is wired directly onto the IDE bus and acts as sole master when USB is connected. It probably holds the EM8511 in reset at this time.

A small (16 MB !) Compact Flash can be mounted and accessed in the console, so we suspect that the 6GB minimum HD limitation (written in the MG35 specs) might be due to the Prolific chip.

Connectivity

Serial header J9

There are TWO console interfaces on connector J9. We don't know yet if the second serial port is supported by the firmware, but there is no reason why it couldn't be.

We can connect a RS232 level converter to this header, to have console access to the bootloader. For this purpose, use serial port 0 (pins 1 and 5, and probably 3 and 4 for power). This is important to de-brick a dead device, but only if the flash bootloader is still intact.

Pin 1 is the one with the silk screen arrow on the top, it's nearest the corner of the PCB, and it has a square pan on the bottom side. The other pins are then numbered alternatively, so pin 9 and 10 are the two on the far end of the connector.

Here is the pin order:

This is the pin assignment and the voltages on the header:

Note: different board revisions seem to have different layouts, search for a pin labeled J9 - it is the pin 1 of the header.

Since the serial interface on the MG35 uses 0/3.3V logic, you'll need a level converter to connect to a PC. DON NOT CONNECT J9 SIGNALS DIRECTLY TO THE SERIAL INTERFACE OF YOUR PC!!! YOU'LL PROBABLY DESTROY THE MG35! More details...

JTAG

Thanks to  heiko.berner's work, we now know a little more about JTAG on MG35. EM8511's pinout is the following:

TCK

B8

JTAG port clock input

B13 (Buffered crystal oscillator output) via R82

TDI

B6

JTAG port serial data input

GND

TDO

B7

JTAG port serial data output

TMS

A5

JTAG port test mode select

GND

RST#

B5 

JTAG port test reset input

GND

The last column shows that, unfortunately, most of the JTAG inputs are grounded. The serial output pin goes somewhere, but gets routed via an inner layer so it's difficult to find its destination. So the JTAG and scan-port have been disabled. JTAG can only be enabled by putting a carrier-card between the EM8511 chip and the PCB.

For those interested, below is the picture of the MG35 board, with the processor removed.

Old information follows (kept just for reference):

It is not yet sure we can de-brick the device using the JTAG connector. We don't know much about JTAG on this unit yet.

A wiggle cable can be built using the instructions found here. You can also try to use this one found on eBay (the link will eventually expire).

The plan is to use a JTAG wiggler to wiggle potential TCK and TMS pins while hunting for TDO. Once we find this, TDI should be easy. If we get the lot, we should be able to use openOCD and/or JTAG tools to explore the flash and (hopefully) reflash the bootloader.

J7 header

J7 is the JTAG interface for the Altera EPM3032A programmable logic device. Both TDI and TDO pins of CPLD connect directly to J7, so the processor is not on this scan chain. It's probably of no use for us, and I can't see why we would want to change the PLD, even if we had the source code. Here are the pinouts and voltages: 

3.05

Pin 1 is the one with the silk screen arrow on the top, it's nearest the corner of the PCB, and it has a square pan on the bottom side. The other pins are then numbered alternatively, so pin 9 and 10 are the two on the far end of the connector.):

Test points

Many thanks to Mark Hotchkiss who compiled the complete list of testpoints.

Many functions, like the Audio-Input port, are available through the test points. The "groups" (D and E) are only for the sake of labeling the test points, and not related to the functions on the test points. I have also traced all of the GPIO signals.

The vacuum-fluorescent display interface is available to anyone that can tack four wires onto test-points. Then again, the second serial port may be simpler for adding a display.

Front panel board - FIP

The FIP panel gets the keypreses from the device and remote buttons (it decodes the IR signals itself, through the INT0 pin) and sends them as commands to the main board over a I2C serial link.

Schematics

The circuit diagram is now available as PDF, thanks to Mark Hotchkiss. Below is a preview:

We don't know the exact type of U13, but it appears that many different IR receivers will work as long as they are 38 kHz, e.g. Sharp GP1UX511QS. We also don't know what Q1 is, but any NPN switching transistor should work. Except for the two electrolytic caps, all resistors and capacitors are 0603 size.

Microcontroller: 1x Samsung - S3C9454 = 8-bit single chip CMOS MCU

This MCU chip was found on a board with revision number P.1.3.5 Datasheet PDF here.

The MCU is ALWAYS powered on from the 5V supply on J2 pin 2. When the POWER button is pressed, or a POWER IR code is received, the MCU powers-up the rest of the MG35, through POWER_ON signal (J2 pin 9). While operating, the EM8511 will receive an interrupt request via IRQ (J2 pin 5) whenever a button has been pressed or an IR command has been decoded. The EM8511 then responds through I2C to read the code. 

J2 connector to the main board

Here are the signals on the J2 conector which connects the FIP panel to the main board:

Front panel LEDs

The PWR, NET and HDD LEDs are controlled directly from the main PCB by the EM8511, the Ethernet controller and the disk-drive, respectively. There are three pins in J2 for this purpose. The "blue ring" LEDs are controlled by the S3C9454 mcu.

Power supply control

The VCC_USB (5 volts from the USB connector) is brought in through J2 pin 3 so that the MCU knows when the MG35 is acting as a USB device. Nothing on the front-panel is powered from the USB.

The VCC_MAIN (5 volts on pin 4) is somehow controlled by the MCU  via POWER_ON signal (J2 pin 9).  MCU will turn on this signal under one of three conditions:

• The "Power" button is pressed on the front panel, or
• A "power on/off" IR code is received, or
• VCC_USB from the USB connector is detected.

However, the USB somehow shuts-down the 3.3 volt supply. I have not investigated why, but that will certainly also shut-down the EM8511 and most of the main board. Therefore:

• If the MG35 was powered-off, (both VCC_MAIN and VCC_3.3V are OFF), plugging in the USB will power-up the VCC_MAIN.
• If the MG35 was powered-on, (both VCC_MAIN and VCC_3.3V are ON), plugging in the USB will power-down the VCC_3.3V.

Unplugging the USB will power-down VCC_MAIN (VCC_3.3V volts will already be down), regardless of whether the MG35 was powered up or down prior to plugging the USB in.

IR interface

The IR signals handling is a little complicated: the signal from the front-panel internal sensor is sent to the main board on pin 11, where it is ORed with the signal from the remote-IR connector, using a 74LVC08 chip. The resulting signal is then routed back onto the front-panel (pin 6) and fed to the MCU for processing. They could have combined both signals on the front-panel board and saved a pin on the connector at the expense of adding a gate to the front-panel.

FIP commands to the main processor

The commands are two bytes binary, with the second byte being the ones-compliment of the first byte. Here are the command codes, as defined in the firmware:

// FIP keys

#define FIP_KEY_ENTER       0xEA15  

#define FIP_KEY_LEFT        0xEB14  

#define FIP_KEY_UP          0xED12  

#define FIP_KEY_DOWN        0xEC13  

#define FIP_KEY_RIGHT       0xE916  

#define FIP_KEY_POWER       0xFF00  

#define FIP_KEY_PLAY        0xB649  

#define FIP_KEY_STOP        0xB748  

#define FIP_KEY_MENU        0xA758  

#define FIP_KEY_TITLE       0xE817  

#define FIP_KEY_SETUP       0xEE11  

#define FIP_KEY_ANGLE       0xA659  

#define FIP_KEY_REPEAT      0xA857  

#define FIP_KEY_AB          0xF40B  

#define FIP_KEY_SLOW        0xB24D  

#define FIP_KEY_FILE_INFO   0xF609  

#define FIP_KEY_TIME_SEARCH 0xA55A  

#define FIP_KEY_BR_CONT     0xF30C  

#define FIP_KEY_MEDIA_TYPE  0xA35C  

#define FIP_KEY_MAIN_PAGE   0xE41B  

#define FIP_KEY_REW         0xEF10  

#define FIP_KEY_FF          0xB14E  

#define FIP_KEY_PREV        0xE01F  

#define FIP_KEY_NEXT        0xBc43  

#define FIP_KEY_VIDEO       0xF906  

#define FIP_KEY_AUDIO       0xF807  

#define FIP_KEY_SUBTITLE    0xFD02  

#define FIP_KEY_SCRSIZE     0xFC03  

#define FIP_KEY_1           0xE31C  

#define FIP_KEY_2           0xE21D  

#define FIP_KEY_3           0xE11E  

#define FIP_KEY_4           0xBF40  

#define FIP_KEY_5           0xBE41  

#define FIP_KEY_6           0xBD42  

#define FIP_KEY_7           0xBB44  

#define FIP_KEY_8           0xBa45  

#define FIP_KEY_9           0xB946  

#define FIP_KEY_0           0xB847  

#define FIP_KEY_VOL_UP      0xB54A  

#define FIP_KEY_VOL_DOWN    0xF708  

#define FIP_KEY_MUTE        0xA956  

#define FIP_KEY_CANCEL      0xFA05

Power supply

Specs: 5V 1.5A /12V 1.5A

The power connector type is Kycon KPP-4P and its spec sheet is here.

Replacement

There are some power supplies which similar specs, but nobody tried them yet. They are here and here.

As posted at the Altech Q and A forum by Simon_the St:

"After going through 3 power supplies (not bad for a problem that's supposed not to exist) and a dealer that no longer wants to discuss power supply problems with anybody I decided to track down a third party replacement. The Power supply to the Lacie D2 and D2 Bigdisk is an exact match for the MG-350HD/MG-35.  The Australian Part number is 710448A and a google search on that part number will show you the stock lists. I paid $46 which included same day delivery. After getting it home and checking the configuration one last time I plugged her in and everything works perfectly. I've been running it for over three weeks now without any problems. For those outside Australia I believe the corresponding part number is 710199 and a google search using that part number brings up retailer botn in North America and Europe."  Also, Rolf found the UK source.

Repairing

There are numerous reports that the power supply goes bad (but it doesn't break completely) and as a rasult the MG35 behaves odd. Usual signs: HDD not spinning, MG35 not booting, MG35 locking at boot. Sometimes the MG35 stops working when you change the harddrive, because the new one needs more power (usually, the new harddrives are more power efficient than the old ones, but this depends on the make and model). If you have basic electronic skills, you may try to measure the power supply voltages while MG35 is powered. As above, they should be +5V and +12V. Slight variations, under 5%, are probably OK. But if the voltages are outside this range, probably the PS is defective and it must be replaced. If this is not possible, you may be able to revive it, but don't even try this unless you are not an experienced electrician!

As PaulT says:

"The PSU supplied with the MGx5 suffers from the usual electrolytic capacitor drying out problem due to relatively high internal temperatures and lack of ventilation, especially when the unit is powered up and / or in use.

This problem is endemic amongst cheap far eastern SMPSU’s... many cheap small LCD TV’s suffer the same problem, and don’t forget all those laptop chargers, cable modems etc... same thing.

They are repairable with care and patience if you can’t source a new one. The usual culprits are the electrolytic capacitors with either dry out or swell up and partially burst leaving gunk all over the place. To repair, remove obviously faulty elcaps and replace them. If there’s no obviously physically faulty elcaps, you will have to test them all for ESR.. Google is your friend. If you’re not confident about DIY, find a local electronic repair technician / shop and ask if they will, some will and some won’t because of the hassle of opening them up and making safe after repairs.. The manufacturer didn’t intend any repairs which is why the PSU enclosure is glued or welded shut."

Car adapter

Somebody reported that the car adapter for the Modix HD-3510 works well, but we are not sure if it works for MG35.

This page has been viewed times.