1
\$\begingroup\$

I own a device that has faulty 256 x 64 dot matrix display (flat cable damage + some bug infestation). After a disassembly I discovered that display is connected via 20-pin connect (soldered pins).

I connected the logic analyzer and got the signals from 12 pins. Every four seconds signal from picture 1 is appearing with the new data. Highest frequency is 200 kHz. When I touch sensors pin I am able to switch the menu to get more and different data. Every touch create communication from picture 1. No more, no less. Only different data.

Picture - zoom level 1: Zoom level 1

Picture - zoom level 2 - beginning of the signal: Zoom level 2

  • Signals on 1,2,3,4,8,9,10,11 look like data (8-bit)

  1. Could you point me to some reading material or video that shows professional approaches to reverse engineering where signal is present but LCD is faulty and there is no info about the COG drivers.

  2. Could you recommend any display controller simulator (that uses popular communication protocols with matrix LCD/TFT displays) that could run on the computer? I would like to test the data and pixel output before soldering the real replacement device... (For this case I figured out that the easiest solution is to write the D0-D8 directly as a matrix of characters with any programming language - e.g. python)

I've used DSView with DS Logic Analyzer. I posted the data from this measuring to the github (can be opened with DSView tool):

DSLogic View Data

Additional information

  • Display manufacturer: Truly
  • Model: mgg2257b2-e
  • Display driver NOT present at PCB (has two COG present)
  • MCU: Motorola's MC9S08GB60A

Update

After a bit of investigation I discovered that this is a LCD direct drive (MCU command to COG driver/controller - not to think that MCU drives multiplexing).

Two drivers are COG type and those are directly connected to MCU (HCS08) via 13 pins (I traced the connector pins via resistors to cogs) of which 12 are having updated signals. COGs are also sharing 11 pins. This device is at least 10 years old and it seems that manufacturer has selected the cheapest way at that time to create a GUI (without controllers).

I would definitely like to learn more about this approach so maybe this question could be useful for others as well.

Idea is to get the info about the COG. Not sure could this be custom made COG.

Update 2:

I assembled fragments from D0-7 data. However, sometimes through the communication sequences only partial data is being sent or this could be due to bad captured data with the decoder I created for Sigrok decoder lib - need to double-check. I assumed that it is sometimes full display refresh, sometimes parts of it, not certain.. Now I will try to detect commands from other lines in combination with data lines. Maybe I will be able to discover the chip by commands that are sent (addresses, etc).

This communication is sending data right away after CS1 or CS2 is enabled and an short burst on PIN 7 (15 us later from 835 us of enabled state). Bit time is 6 us. 835/6 = ~139. 4 times this for CS1 and 4 for CS2. Let's say it is 128 columns x 8bits x 4 "pages" per chip. 256x64 could be confirmed.

CS1 gives one page 128x8, then CS2 gives another 128x8. This repeats 4 times.

Another useful info: bits big-endian and whole image is mirrored.

signal before data sending sequence

enter image description here

So, the question would be that from the title.

I would like either to replace it with another display of same kind or to replace it with any 256x64 and put the translator MCU in between (would write the code to convert this parallel to SPI/I2C one.

\$\endgroup\$
6

2 Answers 2

Reset to default
2
\$\begingroup\$

Every four seconds signal from picture 1 is appearing with the new data.
3. What could be the reason behind the frequency change (pic1 vs pic2)?

Possibility:
a) Data update was needed only four seconds interval.
b) Data was updated incremental, thus it takes short.
c) The processor is check the LCD status every four seconds.

I am trying to compare it with 8080 and 6800 but I cannot notice the pattern.

It likely is not directly (Motorola/Intel) CPU bus compatible, due to the bus speed of less than 2KHz (your screen capture).

  1. I would like to discover which protocol this could be but it is kind of confusing to me. How to be sure which one is it?

To find the protocols, you need to identify the chipset/module used first. From there, finding pinout will be not dificult. The protocols are in the chipset/module datasheet like this that was found from adafruit web.

  1. Could you recommend any display controller simulator (that uses popular parallel protocols) that could run on the computer (I would like to test the data and pixel output before soldering the real replacement device?

Some of the display chipset/module manufacturer provides extensive design and simulations applications. However, those are limited to the input command/data (the soft protocols) to screen display. If you have is a long term project that needs complete verification as much, then a hardware layer simulator helps. It could be simpler than running often into probing and co-debugging. (It is an advice from my experience in developing printers and simulators).

\$\endgroup\$
1
  • \$\begingroup\$ Desoldered the display. No display controller on PCB. Motorola's MC9S08GB60A is the MCU. So I guess it is handled by the MCU directly via software? Could it be that it is direct MCU>COG connection... Display manufacturer: Truly; Model: mgg2257b2-e. Will investigate more, of course :) \$\endgroup\$ Commented Aug 21, 2021 at 19:15
2
\$\begingroup\$

I ran additional capture with 20 MHz sample rate and discovered that there is a stable clk data (pin 6).

Also, there are 132 rising edges for each side of display. Resolution of the LCD is 264x64. I don't believe chip is actually made for that resolution (actually it is - see update below). At the beginning of each CS1/CS2 there are three CLK rising edges.

CS1 [176, 0, 16] CS2 [176, 0, 16] CS1 [177, 0, 16] CS2 [177, 0, 16] CS1 [178, 0, 16] CS2 [178, 0, 16] CS1 [179, 0, 16] CS2 [179, 0, 16] CS1 [180, 0, 16] CS2 [180, 0, 16] CS1 [181, 0, 16] CS2 [181, 0, 16] CS1 [182, 0, 16] CS2 [182, 0, 16] CS1 [183, 0, 16] CS2 [183, 0, 16]

So, for each side numbers are coming from 176-183, second rising edge always zero, and third is 16. I wonder if this could mean that 16 is used for offset? NO: 0001-0000 It is column set command: 0001-xxxx; set starting column to 0

And those 0-index list elements maybe some address/command? Yes: it is 4 bits for command and other 4 for address; 10110000-10110111 >>> 1011 (command to set a page) and 0000 - 0111 an address (0-7).

Anyway, I managed to create code that will be used for MCU for translation purpose (from captured parallel to SPI or I2C).

Also, created a decoder for Sigrok and used sdl2 to draw pixels after every CS1/CS2 command.

Code for this decoder and also the capture data are available at the github's link: Code and capture

Still have no idea which display I can use directly as a replacement. Searched for 5" (or similar size) 264x64 - no luck. However, satisfied with the solution that will work with alternative approach with the help of additional cheap MCU as a translator.

Screenshots of LCD SDL2 modals:

LCD1 LCD2 LCD3

To re-cap, approach was:

  1. Discover as much as possible about known and often used glcd drivers and controllers
  2. Use what's discovered to notice patterns or similar techniques that are used to send data to graphical display from a MCU
  3. Write decoder to make experimenting easier and more fun
  4. Use SDL2 to draw pixels after each successful decoding

Update:

Driver chip is ST7567 - 132x65 (64 common + 1 icon common). This completes the answer.

Material that helped me to move in right direction: https://www.petervis.com/C/128x64/ks0108%20geometry.html

\$\endgroup\$
4
  • \$\begingroup\$ Other potential COG that can be used: SPLC502B, Epson SED1565 \$\endgroup\$ Commented Oct 2, 2021 at 17:35
  • 1
    \$\begingroup\$ Impressive work! How did you get that monochrome LCD decoder in DSview? Are there 7-segment decoders available too? \$\endgroup\$ Commented Oct 7, 2021 at 10:49
  • \$\begingroup\$ @winny thx. I can see "Segment-7" decoder on the decoder list in DSView. And for the LCD Decoder - I created this decoder to help me out with overall decoding. Link to the working code is available in the answer. \$\endgroup\$ Commented Oct 7, 2021 at 11:37
  • \$\begingroup\$ @winny And re 7-seg decoder - if you'd like to have display output, just use sdl2 to draw segments (maybe there's some sdl2 solution already for this somewhere out there) \$\endgroup\$ Commented Oct 7, 2021 at 11:44

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.