Skip to main content

Unbrick Samsung SPF-85H Photo Frame

I've had a Samsung SPF-85H Photo Frame (http://www.samsung.com/au/support/model/LP08MNLSBT/XY) for about 8 years that was loaded with lots of photos (scaled down). One day I added about 200 photos and suddenly the auto slideshow feature locked up. When I rebooted the frame it went into auto slideshow and had frozen (I only got the blue Samsung logo). When I connected the frame via USB nothing would show up (the mass-storage mode did not initialize).

At this point, the frame was pretty much bricked - I could not access the menu nor delete photos from the internal storage. So, I talked to the official Samsung service centers in my country but their response was that they can't fix Photo Frames, they only replace them.

So, Samsung's plan is to force their past technology into obsolescence. That's something I strongly disagree with, so I set out to fix it myself.

If you look on the back of the frame there is a small round opening close to the power plug that is labeled "Service Port" in the manual. So, I assumed it was some sort of serial port connector. But to see what it was I had to open the case. This looks problematic because the back plate is not screwed on - it looks like it's fused plastic.  There are two small depressions on the bottom of the case where you can use a straight screwdriver to pry open the case. There are plastic clips holding it in. If you use the screwdriver genlty you can open the back without breaking anything.


Inside you will find a metal backplate. If you disconnect the side connectors for the buttons and LCD power you can flip the backplate (gently) and see the motherboard. The motherboard is connected via two ribbons to the LCD. It's not necessary to disconnect those, but be careful not to break them.

The side of the PCB which has the ribbon connectors going to the LCD we'll call side A, and the back (which holds the CPU) will be side B. To fix the brick you only need access to side A, but I looked at side B as well. You can unscrew the 4 screws connecting the PCB to the metal backside.

On side B you can see a few large ICs:
  • Novatek nt39703fg-3 - LCD Timing Circuit www.datasheetspdf.com/datasheet/NT39703-5.html
  • HY825DC256163CE-4 - which appears to be the DRAM
  • MP600BUCG - MagicPixel CPU
  • MX29LV320CBTC-70G (IC302) - 4MB Boot flash (http://pdf1.alldatasheet.com/datasheet-pdf/view/143143/MCNIX/MX29LV320CBTC-70G.html)
     
    The interesting part is that the firmware for the Photo Frame is stored in a different chip than the pictures in the internal storage. If you brick your photo frame with a bad update/firmware then the  MX29LV320CBTC-70G is the chip you need to look into, but this guide will not be useful for you. I played a bit with this chip and I found the "Chip Enable" pin and tried to short it (with a screwdriver) to GND on boot (The Chip Enable pin is located in the lower right side of the image below, next to a GND pin). The result was the frame would not display the Samsung logo anymore on boot and would just display colored stripes of noise. 

It's also interesting to see that the motherboard has unsoldered points for headphones and speakers, as well as a battery connector. So, in theory you could add a few components and upgrade your frame's capabilities :)

Now, after I looked over the motherboard I couldn't find anything that looked like a serial port, but there are a few I2C ports. I haven't looked into those. Also, on this model the "Service Port" hole in the back doesn't lead to anything. It may be equipped on different SPF models.

If you look on Side A there is one chip that deserves our attention (IC304). Mine had a sticker on top that I removed but unfortunately the writing on the chip was deleted when I used alcohol to remove the sticker's residue. I managed to make out "Samsung SM843", but Google says it's an Enterprise SSD which looks nothing like this IC. Long story short - I couldn't find a datasheet for it so I couldn't find the Chip Enable pin. 

My plan was to short out the Chip Enable pin during boot-up, so that hopefully the Frame's OS would detect a problem reading from internal storage and hopefully abort the automatic SlideShow setting. I used a screwdriver head and shorted some pins (randomly) until I found the soft spot (marked in red above). I shorted around those pins during startup and I got errors via the USB (I had it connected via the USB port) and the Photo Frame booted into its menu. At this point I changed the setting so that it wouldn't start automatic SlideShow on startup and restarted it. This time the Photo Frame started correctly in the menu. If I tried to start slideshow it would lock up again, but I could access the internal storage and delete the new files I added.

I did some tests and the images were OK (small 800x600) but the problem still happens when the images are read from internal storage. If I place the same images on a USB they play just fine. Most likely I hit some limit with how many files I have on the frame (I have 2637 files).

Anyway, in conclusion - you can fix your broken photo frame even if your service center says it can't be fixed. Of course, there's a risk of burning out the internal flash, but in this case the frame would still work off USB. But if you're reading this you are desperate and the frame is already bricked, so you may have more chances fixing it than breaking it even further. Good luck and let me know if it worked for you!

Comments

Unknown said…
This comment has been removed by the author.
Unknown said…
I have an SPF 85H with the same problem: it froze on a menu.
The chip on IC304: http://www.datasheetspdf.com/PDF/K9G8G08U0A/772969/1
RicardoNSilva said…
Thanks for the tutorial and repair tips!

I just found the service manual, for anyone interested:
https://elektrotanya.com/samsung_spf-85h_spf-86h_digital-photo-frame_sm.pdf/download.html
(tip: click the "Get Manual" link)

It covers these Samsung digital photo frame models:
SPF-75H / SPF-76H / SPF-85H / SPF-86H / SPF-85P / SPF-86P
Adrian Popa said…
I've looked over the service manual and I found the following:
1. IC303 has a /CE signal on pin 9 which is always pulled down (logic 0). /CE means "Non Chip Enable" and when it's 1, CE=0. So to disable the chip you have to connect it to Vcc (pin 12), taking care not to touch pin 13 which is Gnd!
https://imgur.com/07bXTLQ.png
2. The CPU exposes a UART (serial) port in connector CN201 which is connected to the keys. I doubt you can see any meaningfull boot messages, but who knows? I'll take a look next time I get the frame...
https://i.imgur.com/FXSaqNI.png
There's a boot select signal there indicating that the frame might boot from external storage or usb if certain keys are pressed. Nothing is documented though...
ptsash said…
The info in this post was critical in helping me unbrick my SPF-85H, using exactly the steps describe. To give more details:
1) I bridged pins 8(/LE), 9 (/CE), 10 (NC), 11(NC), 12(VCC) while connected to a PC using the USB cable, and then powered up. The photo frame boots up to the screen where it is connected to the PC.
2) At this point, simply unplug the USB cable, and the photo frame will switch to the "home" screen. At this screen, navigate to "Settings" and set the Start Mode to "home", then power it down.
3) Upon powering up, the photo frame will boot to the "home" screen, where you can now clean up the frame memory (it will freeze if there are too many photos -- I need to find out how many by trial and error). Or you can hook up to the PC via USB and do it more easily.

Popular posts from this blog

Home Assistant + Android TV = fun

Here's a quick setup guide for controlling your Android TV from within Home Assistant. I've used it to control a genuine Android TV (Philips 7304) and an Odroid N2 running Android TV. For this to work you need ADB access. It can usually be enabled from within Developer Settings. The great part is - you don't need root access! The most important things are described in the androidtv component for Home Assistant: https://www.home-assistant.io/integrations/androidtv/ Make sure you go through the adb setup. My configuration is simple (inside configuration.yaml): media_player:   - platform: androidtv     name: TV Bedroom ATV     host: 192.168.1.61     device_class: androidtv Once Home Assistant restarts, your TV might require you to accept the connection (adb authentication). This happens only once (or until you reset your ATV to factory settings). Once running the integration will show you the current ATV state (on or off) and allows you to turn it on or off.

SmokePing + InfluxDB export + docker + slaves + Grafana = fun

I've been working for a while on this project - with the purpose of getting SmokePing measurements from different hosts (slaves) into InfluxDB so that we can better graph them with Grafana. The slaves run multiple Smokeping instances inside Docker so that they have separate networking (measure through different uplinks, independently). This will not be a comprehensive configuration guide, but a quick "how to" to handle setup and basic troubleshooting. It assumes you already know how to set up and operate a regular Smokeping install with or without slaves and that you are fluent in Smokeping configuration syntax, know your way around Docker and aren't a stranger from InfluxDB and Grafana (sorry, there's a lot of information to take in). 1. Getting Smokeping with InfluxDB support - you can get it either from the official page (most changes have been merged) - https://github.com/oetiker/SmokePing (PR discussion here: https://github.com/oetiker/SmokePing/issues/

Installing Home Assistant Supervised on an old 32bit HP laptop

 I've received a challenge from my former boss: an old HP laptop that was born in 2005:  an HP-Compaq NC6220 ( https://www.pocket-lint.com/laptops/reviews/hp/68181-hp-compaq-nc6220-notebook-laptop/ ). The specs are abysmal: So, i386, 1.7GHz single-core CPU (remember those?), 1G of DDR2 RAM (2x512M) and a 40GB ATA (not SATA!) drive. But hey, at least it has a serial port!  The challenge is to install HomeAssistant ( https://www.home-assistant.io/ ) on it so that he can monitor some Zigbee temperature sensors and relays (via a gateway). The first hurdle was to remove the BIOS password - following this nice guide: https://www.youtube.com/watch?v=ZaGKyb0ntSg Next-up - install HASSOS. Unfortunately, it doesn't support i386, but only x86_64... So, I went the Home Assistant Supervised route, and installed Debian 11 i386 edition from a netinstall USB ( https://cdimage.debian.org/debian-cd/current/i386/iso-cd/debian-11.6.0-i386-netinst.iso ).   Once Debian was up and running (didn't