Friday, July 15, 2016

Unbrick Samsung SPF-85H Photo Frame

I've had a Samsung SPF-85H Photo Frame ( for about 8 years that was loaded with lots of photos (scaled down). One day I added about 200 photos and suddenly the auto slideshow feature locked up. When I rebooted the frame it went into auto slideshow and had frozen (I only got the blue Samsung logo). When I connected the frame via USB nothing would show up (the mass-storage mode did not initialize).

At this point, the frame was pretty much bricked - I could not access the menu nor delete photos from the internal storage. So, I talked to the official Samsung service centers in my country but their response was that they can't fix Photo Frames, they only replace them.

So, Samsung's plan is to force their past technology into obsolescence. That's something I strongly disagree with, so I set out to fix it myself.

If you look on the back of the frame there is a small round opening close to the power plug that is labeled "Service Port" in the manual. So, I assumed it was some sort of serial port connector. But to see what it was I had to open the case. This looks problematic because the back plate is not screwed on - it looks like it's fused plastic.  There are two small depressions on the bottom of the case where you can use a straight screwdriver to pry open the case. There are plastic clips holding it in. If you use the screwdriver genlty you can open the back without breaking anything.

Inside you will find a metal backplate. If you disconnect the side connectors for the buttons and LCD power you can flip the backplate (gently) and see the motherboard. The motherboard is connected via two ribbons to the LCD. It's not necessary to disconnect those, but be careful not to break them.

The side of the PCB which has the ribbon connectors going to the LCD we'll call side A, and the back (which holds the CPU) will be side B. To fix the brick you only need access to side A, but I looked at side B as well. You can unscrew the 4 screws connecting the PCB to the metal backside.

On side B you can see a few large ICs:
  • Novatek nt39703fg-3 - LCD Timing Circuit
  • HY825DC256163CE-4 - which appears to be the DRAM
  • MP600BUCG - MagicPixel CPU
  • MX29LV320CBTC-70G (IC302) - 4MB Boot flash (
    The interesting part is that the firmware for the Photo Frame is stored in a different chip than the pictures in the internal storage. If you brick your photo frame with a bad update/firmware then the  MX29LV320CBTC-70G is the chip you need to look into, but this guide will not be useful for you. I played a bit with this chip and I found the "Chip Enable" pin and tried to short it (with a screwdriver) to GND on boot (The Chip Enable pin is located in the lower right side of the image below, next to a GND pin). The result was the frame would not display the Samsung logo anymore on boot and would just display colored stripes of noise. 

It's also interesting to see that the motherboard has unsoldered points for headphones and speakers, as well as a battery connector. So, in theory you could add a few components and upgrade your frame's capabilities :)

Now, after I looked over the motherboard I couldn't find anything that looked like a serial port, but there are a few I2C ports. I haven't looked into those. Also, on this model the "Service Port" hole in the back doesn't lead to anything. It may be equipped on different SPF models.

If you look on Side A there is one chip that deserves our attention (IC304). Mine had a sticker on top that I removed but unfortunately the writing on the chip was deleted when I used alcohol to remove the sticker's residue. I managed to make out "Samsung SM843", but Google says it's an Enterprise SSD which looks nothing like this IC. Long story short - I couldn't find a datasheet for it so I couldn't find the Chip Enable pin. 

My plan was to short out the Chip Enable pin during boot-up, so that hopefully the Frame's OS would detect a problem reading from internal storage and hopefully abort the automatic SlideShow setting. I used a screwdriver head and shorted some pins (randomly) until I found the soft spot (marked in red above). I shorted around those pins during startup and I got errors via the USB (I had it connected via the USB port) and the Photo Frame booted into its menu. At this point I changed the setting so that it wouldn't start automatic SlideShow on startup and restarted it. This time the Photo Frame started correctly in the menu. If I tried to start slideshow it would lock up again, but I could access the internal storage and delete the new files I added.

I did some tests and the images were OK (small 800x600) but the problem still happens when the images are read from internal storage. If I place the same images on a USB they play just fine. Most likely I hit some limit with how many files I have on the frame (I have 2637 files).

Anyway, in conclusion - you can fix your broken photo frame even if your service center says it can't be fixed. Of course, there's a risk of burning out the internal flash, but in this case the frame would still work off USB. But if you're reading this you are desperate and the frame is already bricked, so you may have more chances fixing it than breaking it even further. Good luck and let me know if it worked for you!


George Dicu said...
This comment has been removed by the author.
George Dicu said...

I have an SPF 85H with the same problem: it froze on a menu.
The chip on IC304:

RicardoNSilva said...

Thanks for the tutorial and repair tips!

I just found the service manual, for anyone interested:
(tip: click the "Get Manual" link)

It covers these Samsung digital photo frame models:
SPF-75H / SPF-76H / SPF-85H / SPF-86H / SPF-85P / SPF-86P

Adrian Popa said...

I've looked over the service manual and I found the following:
1. IC303 has a /CE signal on pin 9 which is always pulled down (logic 0). /CE means "Non Chip Enable" and when it's 1, CE=0. So to disable the chip you have to connect it to Vcc (pin 12), taking care not to touch pin 13 which is Gnd!
2. The CPU exposes a UART (serial) port in connector CN201 which is connected to the keys. I doubt you can see any meaningfull boot messages, but who knows? I'll take a look next time I get the frame...
There's a boot select signal there indicating that the frame might boot from external storage or usb if certain keys are pressed. Nothing is documented though...