Hi,
I've recently acquired a ZP100 however it looks to be stuck in the boot process with a single white light flashing endlessly.
It doesn't appear responsive to holding the mute button on bootup. On powerup all of the network port light flash briefly and the connection lights are solid if wired to bridge via ethernet.
I know this is an old product and I know it is my fault for purchasing it, but is there any other reset tricks or way to update the firmware to get out of this loop?
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
Page 3 / 8
Userlevel 2
First - thanks to everyone for leading the way and helping others figure out how to revive these zp100's.
I have a few of these with the diag firmware and will be receiving a bus pirate tomorrow. My confidence level coming into this is mildly enthusiastic 😮 but I want to clear some things up if possible.
Firmware files - do I need to download a new fw for each individual box, or can I just rename the file to the appropriate s/n per box?
UART - any specific tips or things to watch out for when using the bus pirate? I haven't used anything like this for at least 10yrs, and even then it was a prebuilt JTAG device which was idiot proof. Don't be shy - the clearer and easier to follow the better :D
Box cleaning - I've seen some have had good luck cleaning up the boards and internals, and reconnecting the cables. Are you taking everything possible apart? Concentrating on the main board/network area? Specific things I should be looking for? Any thoughts on pulling the main board and attempting to reflow the solder with a heatgun or oven (some hardware faulty devices do well with this like video game consoles)?
Once again great thread and thanks to those pioneering the way! I'll be sure to update how things go, and try to snap a pic or screenshot along the way to help those in the future.
I have a few of these with the diag firmware and will be receiving a bus pirate tomorrow. My confidence level coming into this is mildly enthusiastic 😮 but I want to clear some things up if possible.
Firmware files - do I need to download a new fw for each individual box, or can I just rename the file to the appropriate s/n per box?
UART - any specific tips or things to watch out for when using the bus pirate? I haven't used anything like this for at least 10yrs, and even then it was a prebuilt JTAG device which was idiot proof. Don't be shy - the clearer and easier to follow the better :D
Box cleaning - I've seen some have had good luck cleaning up the boards and internals, and reconnecting the cables. Are you taking everything possible apart? Concentrating on the main board/network area? Specific things I should be looking for? Any thoughts on pulling the main board and attempting to reflow the solder with a heatgun or oven (some hardware faulty devices do well with this like video game consoles)?
Once again great thread and thanks to those pioneering the way! I'll be sure to update how things go, and try to snap a pic or screenshot along the way to help those in the future.
Userlevel 2
It does the same thing even without speakers plugged into the device.
Userlevel 2
Huh. I hadn't noticed there was a second ISSI SDRAM chip on the bottom of the board. How about that.
I only changed the one on the top (ie. immediately adjacent to the large square microcontroller about 1.25" square).
This unit seems to be behaving now, so perhaps I got lucky. It was reporting its failures only at a single address, regardless of being warm or cold, so I suspect the RAM chip had gone bad at one particular address (on one of the two chips) and it seems I guessed correctly.
My other unit boots fine from a cold start, but when its warm it starts having RAM errors at a large number of seemingly random addresses. I should try reflowing the solder on all the pins of the two SDRAM chips and maybe that problem goes away.
This is the ebay part I purchased: http://www.ebay.ca/itm/271853110458?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT
It seems that there are a number of compatible chips (I have two ZP100s and they had different chips in them from the factory, one had ISSI IS42S16800A-7TL, and the other had ISSI IS42S16800B-7TL).
Looking around online, it seems both of these have been obsoleted for some time. ISSI still sells a IS42S16800F-7TL which appears to have the same or very similar specs and is easily obtained from your favourite electronics suppliers. Mouser and Digikey both show stock for around $5/chip. I suspect it is a pin compatible upgrade, but YMMV.
I only changed the one on the top (ie. immediately adjacent to the large square microcontroller about 1.25" square).
This unit seems to be behaving now, so perhaps I got lucky. It was reporting its failures only at a single address, regardless of being warm or cold, so I suspect the RAM chip had gone bad at one particular address (on one of the two chips) and it seems I guessed correctly.
My other unit boots fine from a cold start, but when its warm it starts having RAM errors at a large number of seemingly random addresses. I should try reflowing the solder on all the pins of the two SDRAM chips and maybe that problem goes away.
This is the ebay part I purchased: http://www.ebay.ca/itm/271853110458?_trksid=p2057872.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT
It seems that there are a number of compatible chips (I have two ZP100s and they had different chips in them from the factory, one had ISSI IS42S16800A-7TL, and the other had ISSI IS42S16800B-7TL).
Looking around online, it seems both of these have been obsoleted for some time. ISSI still sells a IS42S16800F-7TL which appears to have the same or very similar specs and is easily obtained from your favourite electronics suppliers. Mouser and Digikey both show stock for around $5/chip. I suspect it is a pin compatible upgrade, but YMMV.
Userlevel 2
Thanks for the tip on using X-acto blade.
so you replace both SDRAM chips that is mounted on both side of the boards?
Which chip did you get from e-bay? I see a lot but can't find one with exact match on the spec.
so you replace both SDRAM chips that is mounted on both side of the boards?
Which chip did you get from e-bay? I see a lot but can't find one with exact match on the spec.
Userlevel 2
So I finally received my RAM chip from China. Brought it in to the office where I have access to decently high-end solder rework gear.
As far as technique for replacing the RAM chip, I did the following:
Start with a new X-Acto blade, and carefully cut the 54 legs off of the RAM chip on the board. I tried to cut mostly in a plane parallel to the PCB, to avoid damaging the board, the pads, or the other nearby components. Once all 54 pins have been carefully cut, the body of the RAM chip (the ISSI IS42S16800A-7TL chip, in my case) will simply lift off the board, leaving behind its legs soldered to the pads.
Then, using a desoldering wick, carefully remove the pins and solder from the pads, taking great caution to not apply too much heat or force and delaminate the pads from the PCB.
Then, apply some flux to the pads, and carefully solder in the new chip.
I have never soldered SMT components this large before, but I do have a reasonable amount of experience with a soldering iron.
The unit I repaired was exhibiting prior to the repair with a symptom of fail to boot, flashing white light forever. Not responsive to factory resetting. The UART port was showing that it was failing the SDRAM check at the same address every time. Prior to the repair, I was able to get the unit to boot by manually issuing the command from the bootloader to ignore the SDRAM failure and boot anyway. The unit was otherwise operational.
I have not yet returned home to where I can test for full operation, but powering the unit up at the office seems to show it successfully autobooting and searching for my household to connect itself to.
As far as technique for replacing the RAM chip, I did the following:
Start with a new X-Acto blade, and carefully cut the 54 legs off of the RAM chip on the board. I tried to cut mostly in a plane parallel to the PCB, to avoid damaging the board, the pads, or the other nearby components. Once all 54 pins have been carefully cut, the body of the RAM chip (the ISSI IS42S16800A-7TL chip, in my case) will simply lift off the board, leaving behind its legs soldered to the pads.
Then, using a desoldering wick, carefully remove the pins and solder from the pads, taking great caution to not apply too much heat or force and delaminate the pads from the PCB.
Then, apply some flux to the pads, and carefully solder in the new chip.
I have never soldered SMT components this large before, but I do have a reasonable amount of experience with a soldering iron.
The unit I repaired was exhibiting prior to the repair with a symptom of fail to boot, flashing white light forever. Not responsive to factory resetting. The UART port was showing that it was failing the SDRAM check at the same address every time. Prior to the repair, I was able to get the unit to boot by manually issuing the command from the bootloader to ignore the SDRAM failure and boot anyway. The unit was otherwise operational.
I have not yet returned home to where I can test for full operation, but powering the unit up at the office seems to show it successfully autobooting and searching for my household to connect itself to.
@johnBCW: You are correct that those light patterns signal a fault. Unfortunately tracking down the fault is really tricky. Do you get the fault when playing music with no speakers attached? How about when attached to powered speakers?
@mrmom: I don't really have a good suggestion for you on that one. Make sure that the update command is correct, and that the image you are flashing is valid. Sorry.
@mrmom: I don't really have a good suggestion for you on that one. Make sure that the update command is correct, and that the image you are flashing is valid. Sorry.
@mrmom: Do you get any errors during the attempted update, or does it just silently fail?
@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.
@ poshul: I am getting silent fails on all the devices I have left to convert.
Userlevel 2
Nobody has any idea's? I am going to take the one with faults completely down and reassemble this weekend. We will see if that makes any difference.
Userlevel 2
Ok. So the one that I repaired is still going strong without issue. A buddy of mine bought two of them and one had a diag firmware.....got the newest firmware on that one easy. The second already was on the network. The one with Diag firmware will pair with the system but upon playing music will go orange light then white then orange. If you continue to hit the mute music will play for a second. The light means fault......is there a way to find the fault or clear it? The second unit will not pair at all. Any ideas?
Userlevel 2
Well, I have a couple of these ZP100s that do exactly as this thread describes... At first I was oh well, but after searching I found this forum. I now have a bus pirate on the way and I have a great hope that I'll get the ZPs working... Thanks to all that have made this information available... Hopefully, with a this great information The ZPs will be up running in short time once the bus pirate is received...
Wish me luck...
😉
Wish me luck...
😉
Userlevel 2
upon further inspection, the chip, IS42S16800B-7T is a 16MB capacity only...and UART console show a 32M SDRAM config which mean there must be 2 chips. And this confirm by inspecting the board, there are 2 chips mount top/bottom joining together onto the board. So that mean we have to remove/replace both chips on top and bottom board!!!
Userlevel 2
thanks.
indeed, soldering the new nand would be the easiest part.
eventhough i would feel comfortable working with JTAG, getting the kernel stored in the new chip will be tricky since noone has it.
Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.
But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.
Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
indeed, soldering the new nand would be the easiest part.
eventhough i would feel comfortable working with JTAG, getting the kernel stored in the new chip will be tricky since noone has it.
But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.
Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
Userlevel 2
code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable
verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable
both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>
Replacing the NAND chip may be the easy part provided that you know how to work in removing and replacing chip on circuit board.
But the more challenging part is how to transfter/push firmware/software from/to the NAND chip.
Unless you have actual console device that Sonos Engineer use to do their internal development, re-programming the chips, it will be arduous task. Some have look into JTAG. But I don't know how successful/easy that can be
Userlevel 2
i made it again to some kind of menu. tried to load sonos fw from flash and this is what i got:
code:
=> sonosboot
nand_read_sonos: flash read error -74, retlen 16384
Error reading partition table from flash, using default
both sections readable, bootgen-0 3, bootgen-1 2
section 0 selected
verifying section 0...check: page2048 (logicalBlock 11, physicalBlock 40 )is not readable
verification error with section 0, trying other section...check: page28672 (logicalBlock C41, physicalBlock 380 )is not readable
both sections are bad, abort
problem reading sections...attempting to boot section 0 anyway
booting section 0
nand_read_sonos: flash read error -74, retlen 16384
Error reading kernel from flash, abort
=>
=>
Userlevel 2
ok. got somewhere else after hitting the h key:
EDIT
ok. after spending a lot of time today, i think the NAND is fried since it will always gets stuck when doing some NAND work.
ive searched and that NAND is comercially saleable. is it worth it to try and replace it? if so, how do i program it?
code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)
Reset Status:
CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND: 64 MiB
Using default environment
In: serial
Out: serial
Err: serial
Net: eTSEC1
Hit any key to stop autoboot: 0
=> hhhhhhhhhhhhhhhhhhhh
Unknown command 'hhhhhhhhhhhhhhhhhhhh' - try 'help'
=>
=>
=>
=> help
? - alias for 'help'
audio - Manage Audio Modulators
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootgen - display partition's bootgen
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
buttons - Button monitoring
clocks - print clock configuration
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
ddputil - Diagnostic Data Page utility
diag - perform board diagnostics
echo - echo args to console
exit - exit script
format - erases a partition and frees all physical blocks
go - start application at address 'addr'
gpio - GPIO initialization and register access
gtm - GTM initialization and register access
help - print online help
i2s - Manage TDM/DMAC blocks
icrc32 - checksum calculation
iloop - infinite loop on address range
imd - i2c memory display
iminfo - print header information for application image
imm - i2c memory modify (auto-incrementing)
imw - memory write (fill)
inm - memory modify (constant address)
iprobe - probe to discover valid I2C chip addresses
itest - return true/false on integer compare
jffs - translates a logical offset to a physical offset
junctemp - display CPU's die temp
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loady - load binary file over serial line (ymodem mode)
loop - infinite loop on address range
map - translates a logical block number to a physical
md - memory display
mii - MII utility commands
mm - memory modify (auto-incrementing)
motion - Accelerometer monitoring
mtest - simple RAM test
mw - memory write (fill)
nand - NAND sub-system
nboot - boot from NAND device
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuration Space
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
ptable - partition table commands
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
sonosboot - Boot the freshest section (or optionally the least fresh)
temp - display current temperature
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
upgrade - Upgrade a partition from a raw file
vcxo - Sweep VCXO and monitor modulator PLL lock
version - print monitor version
EDIT
ok. after spending a lot of time today, i think the NAND is fried since it will always gets stuck when doing some NAND work.
ive searched and that NAND is comercially saleable. is it worth it to try and replace it? if so, how do i program it?
code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)
Reset Status: Check Stop, External/Internal Soft, External/Internal Hard
CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
DRAM 32-bit Data Pattern Test AA ------------- PASSED
DRAM 32-bit Data Pattern Test 55 ------------- PASSED
DRAM Address Line Test ----------------------- PASSED
DRAM tests complete.
===================================================
PCIE0: Link
NAND:
Userlevel 2
Hello all.
I received my play3 today. I finally got to the uart connector which is very small to solder.
i know play3 is much different than older zp units...still, kinda works similar.
i have been struggling trying to access any diags menu. it boots up so fast that i cant get it to stop.
this is what i get so far. everytime i power it up, it will get to a different point. still, non responsive with any keyboard commands.
I received my play3 today. I finally got to the uart connector which is very small to solder.
i know play3 is much different than older zp units...still, kinda works similar.
i have been struggling trying to access any diags menu. it boots up so fast that i cant get it to stop.
this is what i get so far. everytime i power it up, it will get to a different point. still, non responsive with any keyboard commands.
code:
U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:05) Fenway128 (DDR CL=4 AL=1 No AP)
Reset Status:
CPU: e300c3, MPC8314, Rev: 12 at 250 MHz, CSB: 125 MHz
Board: Sonos Fenway
I2C: ready
DRAM: (not initializing)128 MB
===================================================
Testing DRAM from 0x00000000 to 0x00010000
Press CTRL-C to skip memory tests.
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : ..
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND :
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Relocate failed
NAND SPL - U-Boot 1.3.0-rc2 (Nov 18 2013 - 13:01:17) Fenway128 (DDR CL=4 AL=1 No AP)
Loading from NAND : .........
Userlevel 2
yes. also electronic contacts cleaner and disconnecting/re-connecting all cables.
Userlevel 2
What kind of cleaning are talking about hear? is just a matter of blowing compress air to rid of all the dust behind all the crevices?
Userlevel 2
Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is EC:75
32M NAND flash (Samsung K9F5608U0C) detected
Section 0 is provisionally good, kernel on partition 1, generation 15
Section 1 is provisionally good, kernel on partition 4, generation 14
Attempting to boot kernel from partition 1
(946756120)VFS: Mounted root (cramfs filesystem) readonly.
(946756120)Mounted devfs on /dev
I don't remember ever seeing above BOLD message before.
Do these messages appear after it booted with the updated firmware?
Userlevel 2
great to hear that. indeed, cleaning the house helps! it did for me too 🙂
n/m...
Userlevel 2
andresmorago: I got it working 100%. So after the unit was freezing I took it apart and completely cleaned the inside. Everything now working 100%. Doing a little burn in on the system. Hopefully it all holds. Thanks for all of the help.
Userlevel 2
I used a bus pirate connected to the zp100 which was booting in diag firmware. Setup the bus pirate to run uart mode. Setup Apache on my local workstion windows 8 and downloaded the 28.1-83040-1-1.upd file. Ran update http://169.254.1.2/28.1-83040-1-1.upd. Found that you had to kill anacapa service. Once that was killed the system updated. It booted with local ip address. I had to reboot holding the mute to reset the system then Sonos software would see it. Right now I get no audio and the box appears to freeze often........the timer will begin and then the box goes unresponsive. Where are the audio amplifies on the boards?
John
My revived used to freeze a lot. I ended up cleaning everthing with contact cleaner and marking sure every wire was connected tight. After doing that, it came back from death and is been running for almost a month now.
Apms are located on the right side of the unit.
Userlevel 2
Sure.
I used a bus pirate connected to the zp100 which was booting in diag firmware. Setup the bus pirate to run uart mode. Setup Apache on my local workstion windows 8 and downloaded the 28.1-83040-1-1.upd file. Ran update http://169.254.1.2/28.1-83040-1-1.upd. Found that you had to kill anacapa service. Once that was killed the system updated. It booted with local ip address. I had to reboot holding the mute to reset the system then Sonos software would see it. Right now I get no audio and the box appears to freeze often........the timer will begin and then the box goes unresponsive. Where are the audio amplifies on the boards?
I used a bus pirate connected to the zp100 which was booting in diag firmware. Setup the bus pirate to run uart mode. Setup Apache on my local workstion windows 8 and downloaded the 28.1-83040-1-1.upd file. Ran update http://169.254.1.2/28.1-83040-1-1.upd. Found that you had to kill anacapa service. Once that was killed the system updated. It booted with local ip address. I had to reboot holding the mute to reset the system then Sonos software would see it. Right now I get no audio and the box appears to freeze often........the timer will begin and then the box goes unresponsive. Where are the audio amplifies on the boards?
Userlevel 2
could you please tell us, for reference, how did you revive it? just to keep records in the forum for future people who might need it.
regarding your other issue, check the circuit boards. do a complete cleanup and make sure the audio amplifiers arent fried.
regarding your other issue, check the circuit boards. do a complete cleanup and make sure the audio amplifiers arent fried.
Page 3 / 8
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.