The sure way to mess up your Salora 28F8C

In 1997 i bought this used tv and got a resonable good deal on this widescreen television set that probabably is from around 1993. It was made by Nokia Consumer Electronics. Some time ago I decided to clean it up and vaccum many years of dust out of it. I opened it, cleaned it and noticed a SGS 27C2001 EPROM inside. My curious nature told me to pull it out of the socket, dump it and have a look. The 256 kb dump contains the program that controlls everything about how the TV works and operates. Nokia uses a micronas intermetall CCU-3000 (Central Control Unit) that has a MOS technology 65C02 core.

The 256k is banked. Bank 0 (32k) contains, RAM (1344 bytes), I/O and ROM where the banking controller, interrupt routines and common subroutines reside. The second 32k half of the address space (8000h to FFFFh) is banked.

It is apparent from the disassembly (by no way complete!) that the unit has a lot of debugging / service functions and an "easter egg" with credits to the devellopers. It has a CCU-3000 monitor (ver 2.0 from 1989) serial interface that allows you to display registers and memory content. Here is the list of commands (from the help function):

DR<register descriptor>..display register contents.
DM[$saddr],[$eaddr]..dump memory from $saddr to $eaddr.
DE[$saddr],[$eaddr]..dump eeprom from $saddr to $eaddr.
RI[$n]B[$imreg]...read imbus byte (with $n = 1 or 2).
RI[$n]W[$imreg]...read imbus word (with $n = 1 or 2).
WI[$n]B[$imreg],[$value].write imbus byte (with $n = 1 or 2).
WI[$n]W[$imreg],[$value].write imbus word (with $n = 1 or 2).
RP[$n]....read port-address (with $n = 1 ... 8).
WP[$n],[$value]...write port-address (with $n = 1 ... 8).
MR<register descriptor>..modify register contents.
MM[$addr]...modify memory address.
ME[$addr]...modify eeprom address.
S....toggle STOP-MODE.
G<pc>....go on with program execution at address in PC.
^C....terminate the interface prog

On usenet I got the keypad code for entering the service mode: Whithin 6 seconds from a cold-boot press [pause],[stop],[play] and [fast forward] quickly after each other. The TVwill then enter the setup mode by displaying "SA" in the LED display. The user interface for this is an absolute nightmare. You input via the remote control (the layout is in no way intuitive!) and all the feedback you get is via the small LED display. I started navigating the mode and quickly figured out that [+] and [-] are used to navigate between differnt entities. You always start in "SA" and can cycle through 15 differnt entities before you end back in "SA". There are some basic and some very hardcore functions. At the writing moment I have managed to mess my TV up really well, with the primary colours mis-aligned (which seems to affect the AFC somehow). [VolUp] and [VolDn] adjusts the "primary property" of the entity. Here are the ones I have identified so far:

"SA": Horizontal adjustment, [VolUp]/[VolDn]: position, "A0": "Vertical atjustment, [VolUp]/[VolDn]: position & "y0": Trapezoid adjustment, [VolUp]/[VolDn]: +/-

So, the configuration is mesed up. The CCU-3000 has no EEPROM (NVRAM) so the configuration is stored in an Xicor X24C16 serial EEPROM. It is even placed in a socket on the main board just below the multistandard audio card (8 pins, pin 1 towards the back of the set). I dumped the 2k and it clearly contains configuration data like the names assigned to each channel. I copied the EEPROM from an identical set (Luxor label). That set had firmware revision 4, whereas mine had revision 6. I was a bit concerned if the EEPROM memory map was the same, but after programming my set with the Luxor EEPROM it started up nicely. The only problem was the V position which I could correct. So the conclusion is that a ver. 4 EEPROM can be used with a ver 6 unit. I enclose a copy of my EEPROM here. If you use it you will have to restore all your preset channels again.If the EEPROM is defective or nbot present, the TV will not "boot" and give the failure code "IIC" in the LED display.

I will continue to add more as I discover.