[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Mikeapollo:
Possible mini-fix for nearly dead hermes radios.

Ok... bit more information coming to light when drilling into this.

My thinking is if there is a bug in this radio it will be something to do with the PIC16LF72 chip with the D/A and A/D stuff that drives and measures outputs from the phyiscal hardware radio chips (the Qualcomm ones and the Anadigics amplifiers) on the main mobo and stores/executes the radio firmware.

A small firmware bug affecting values returned from D/A and A/D measurements

This bug or whatever causes either false return values or bad data

This causes radio to work harder

This then either causes wear or heat based issues on the PIC effecting the storage area and causing bad blocks (death) or causes damage to the rest of the radio chipset (qualcomm and anadigics amps).

SOME users who have nearly dead radios after an encounter with 1.5x radio are reporting lots of bad blocks when testing with the radio bootloader before their radio completely snuffed it. These radios accept either a full flash or part of a flash but still have "NO GSM", imei etc, or same problem as before flash (intermittent issues etc).

The potential fixes to try are at the bottom of this post for the people not technically interested and want hands on only. for the rest of us who are interested in the technicals of this problem please use your knowledge to either add to this theory or rip it apart publically. - It is one of a number of possible scenarios for this issue and is a long shot but you'll know sort-of what I'm getting at if you've dealt with temperamental or old programmable logic arrays or field programmable proms etc.

To define nearly dead radio :

Accepts radio flash with no errors but still has "NO GSM"

OR

Has GSM but no network lock - Can SOMETIMES after a long time or many *many* reboots "regain" a signal for a short period BUT the moment the device is attempted to be used for anything radio-based it vanishes again into never-ending loop of searching for network for hours/days.

OR

Accepts part of a flash and gets stuck - radio bootloader reports BAD blocks when queried.

With nearly dead radios a problem therefore could (potentially) be one of three things :

Seriously corrupt PLA storage (bad blocks causing errors - possbily recoverable)

Fried physical radio hardware (possibly from running corrupted radio) - Unfixable

Or a combination of both (one causing the other so to speak).

I'm thinking of two scenarios (and accompanying theories) that I've seen in another device (which, OK was a telecoms router but hey - you've seen one programmable chip you've seen them all!)

Scenario 1.

Bug in firmware somewhere within radio

Bug "overdrives" hardware by whatever means generating a heat/wear issue (actual overdrive or "invisible" restart(RTE)/re-connects/disconnects stressing hardware)

Heat/wear issue (due to proximetry) starts cooking the PLA where firmware is held

This causes intermittent "false" bad blocks leading to unpredictable radio behaviour/drop outs/etc

A rest period resolves issues temporarily but they will return

The now already unstable radio behaves even more erratically driving the radio hardware more (as it keeps loosing signal lock due to false bad blocks in radio and it therefore "crashing" and restarting the radio hardware) thus generating more heat and wear

PLA chip over time in this condition now has *real* bad blocks as is damaged OR radio hardware burns out (whichever effectively wears out first)

Scenario 2.

Logical bad block appears in PLA (bad addressing by bootloader passing ROM image to radio bootloader for writing / maybe just old age / whatever)

--branch--

2a --> Bad block appears in critical area (imei/etc) --> kills GSM but accepts flash

2b --> Bad block appears in critical CODE area

eg. 1 Radio bootloader - GSM no longer flashable as SPL can't parse instruction and code to write to IPL and vice versa)

eg. 2 Stored environment "variable" in rom image (physical radio driver properties - ie. clock rate/power output/etc - a variable that may change from rom to rom but not (obviously) a variable that is changed by firmware, OS or anything else :D - You know what I mean )

eg. 3 Multiple bad blocks​

In Scenario 1 - We have the classic software bug killing hardware. Symptoms are intermittent grow with age. As they become more frequent and unless action is taken real damage is then done until it reaches a point where massive hardware failure occurs (radio hardware) or PLA is damaged or a critical block goes bad therefore killing the radio bootloader and killing GSM. If this is therefore caught early enough and rectified it is possible that the device may be recoverable.

In Scenario 2 - We have a small hardware issue caused by whatever means which introduces ONE bad block leading to a 2a or 2b situation.

in 2a - Bad block appears in an area where code is stored that is critical to the operation of the radio but NOT critical some parts of the radio bootloader, therefore a flash appears to be accepted but radio won't work because block is bad. This may possibly be recoverable.

in 2b - eg.1 GSM now unable to accept flash - Radio unable to be written to PLA therefore module killed. No fix

in 2b - eg.2 GSM hardware could be fried by incorrect driving over time (causes scenario 1) - Possible limited recovery if dealt with when symptoms first start - not fixable once fully died.

in 2b - eg.3 - speaks for itself - bad blocks developed all over - Nothing will work. Radio dead.

Potential fix for not /quite/ dead hermes

IN ALL 3 OF THE FIXES BELOW - COOL THE DEVICE DOWN SLIGHTLY (removing the battery first!) BY PUTTING IT IN THE FRIDGE FOR 10-15mins -

DO NOT FREEZE IT

(your radio is already frozen anyway - ho ho ho:D )

Pot. Fix 1 : Users who still "HAVE GSM" but don't signal lock for hours or only remain locked for short periods and while locked find the signal they have is useless. (ie - not quite dead hermes - symptom of a brewing problem)

Take battery out of your phone for a few mins - then boot it up again

Get the PC ready to flash either radio 1.43 or 1.47 (any flavour)

DO NOT USE ANY 1.5x.xx RADIOS

!

Connect it up (let it sync etc)

Watch your phone carefully for when it gets a signal (this could be a long time) - do NOT attempt to use your phone when signal pops up.

The

MOMENT

it gets a signal, start the radio flash.

Wait for signal again and flash it again IMMEDIATELY without restarting it

Disconnect, power off, disconnect battery and soft reset.

Pot. Fix 2 : Users who have NO GSM who's device accepts radio flash without errors.

Flash radio 1.43 OR 1.47 *three times* without manually rebooting (if possible)

Power off, disconnect battery and soft reset.

Pot. Fix 3 : Users who have NO GSM who's device is

UNABLE

to radio flash without errors past the first few %.

Flash radio 1.43 OR 1.47

On error - flash radio again (avoid restarting if possible but you may have to)

Try a further 2 times - it will now either accept flash on last attempt or will not accept flash. If it accepts flash, flash it again then Power off, disconnect battery and restart it.

Sounds crazy - worth a shot. Give it a try - and let us know what it does. If this works please let me know ASAP (PM me if necessary) - I'll also then send you my paypal address for a donation to my current "I'm unemployed again cos Barclays were <insert expletive here>" fund :D If we can get one device working from someone trying this then it's a good use of my vast quantities of free time :o

Quick note about the logic behind this : All programmable function chips can develop "logical marked bad blocks" - some /can/ (and are!) recovered by rewriting them once or twice in quick succession with an identical image preferably without hard power cycling inbetween writes. "False" bad blocks therefore may be recovered. "HARD" bad blocks sadly won't be.

The fridge thing

- well cooled PGAs generally "accept" a state change in each "pocket" more efficiently at low temperatures than warm ones. The opposite to write-only PROMS which used to like being blown straight out of the lab oven (or at least 15 mins under a 100w bulb!)

Good luck - PS. If any tech support desk needs a bum on seat in either North-West or the South East of the UK - I am now OFFICIALLY AVAILABLE FOR HIRE as I'm officially unemployed from tomorrow morning! I don't have a degree so never get through the paper sift (hence unemployed) but do have the experience and skills and plenty of developers certificates..I-thank-you.