To save you the check: the going eBay close price for (non-broken) system boards for these models is $230-$270. Ugh.

Has now additional comments and labels for some tables, especially regarding scanning of the keyboard, including Fn key combinations.

The keyboard is wired as a 16x8 matrix with port G as input and ports E and F setting one pin at a time as output during a scan. A table is used to then assign each key its "standard" PS/2 key location number. Fn, Power, TrackPoint and touch pad buttons are not part of this matrix but Access, Volume-, Volume+ and Mute keys are. And Caps Lock is also (first thing to change to something more useful).

The ThinkLight is controlled by P13.

There won't be an update for several weeks at least unless you guys work on it...

Hi,

I'm interested to help with A31 Thinkpads if you can include its EC firmware in your study (also Renesas -
H8S/2169AV).. I have a (working) open A31 motherboard where I could look up connections that matter, and may give info for several thinkpads since they're same.. e.g. fan, etc.

E.g. I just tracked down all temperature sensors on the A31 using freeze spray and posted that on the Thinkwiki, here. The 0x7D temp sensor was hard to find because it doesn't heat up, and is hidden under the PCMCIA slots when machine is assembled, but the freeze spray finally gave it away.. anyway 0x7D isn't identified in the other thinkpads on that Thinkwiki page, but it may be the same since many thinkpads tend to be similar.. (the A31's a bit older).

I also have very high res photos of this A31 motherboard, and a list of some identified components, but didn't put them on the Thinkwiki for space reasons (6MB per side of motherboard for the pics..). If it would be of interest, I can make it available.

@Thinkerer: That price (~$200) is for a working used motherboard. I assume people can't sell broken MB's and they are usually bad because of only one chip, e.g. the GPU (in A31s.. ) - perhaps it would be possible to get a broken one for about $10-20 just to continuity test the connection.. by asking a few of the merchants on ebay that sell working used ones.. surely they've had faulty returns they don't know what to do with..

Very nice work on the EC.

Milos

Hey Milos, great work with these picture and sensor identification!

The A31 sensor mapping seems very different than the previously examined models. People using fan control tweaks need to take this into account.

Since it is possible to build working images, and a typo was found in the T43/p fan control (causing the annoying pulse) - has anyone contemplated to flash their T43s EC with the typo fixed? (Curious)

Just bought a T43, and while the fan can be controlled, the pulse is driving me crazy and nothing can stop it (including fan control software). I wish Lenovo would fix that stupid bug/typo, I wonder why there hasn't been more of an outcry over it?

Regards

Did you try the Linux fan control script (http://thinkwiki.org/wiki/ACPI_fan_control_script)?

BTW, it is said that the pulsing bug is not fixed in the T60 either.

I would try it - but I dont run Linux on this particular machine. Though I suppose I could install Linux on a second partition to test..

For all the non-Linux users however, it would probably be nice if that EC typo/bug was corrected, but I doubt it will ever get looked at, since Lenovo probably thinks that they "fixed" it..

I suppose it is also pretty much impossible for anyone to get this bug/typo reported to the Lenovo firmware maintainers, whoever they are..

Regards

1. The bug fix for the register typo works;
2. The fan still pulses, but the pulsing is now nearly inaudible, as expected from the algorithm without the bug. It is as bad as the other T4x models have it, instead the usual much worse of the T43 (without the fix, the fan kicks up like a jet engine every 30s on a 268x T43);
3. The fan still spins up a lot when changing fan levels, which makes some noise. But it does this once, not every 30s;

You can get all that from userspace fan control, so I'd suggest you try the various userspace fixes if you are not confortable with mucking with firmware, you can brick the T43 if you make a mistake changing the firmware. I believe there is an userspace fan control solution for Windows too.

By the way, the pulsing problem isn't a problem specific, or indirectly branched, off the T43s. It has been around on quite a few Thinkpads, including the latest T Series Thinkpads. Also, it can't quite be pinned down to a particular model/type pair or line as some models have it, some don't, some have symptoms similar to it but are actually indicators of something else, etc.

@hmh:

I have read through a large amount of this Forum, and as far as I can see, there is *no* userspace fix for the fan pulsing in Windows .

No suprise since the firmware of the T40-T42 has fixed this for a long time now (EC 3.03).

I can control my fan in Windows using software, but it always pulses, since the *buggy* EC is regulating the speed/level.

I don't mind that the fan spins up, or that it spins at all, but the fan accelerates and decellerates every 4.8 seconds producing the well known "pulsing" or "insect sound".

How did you test the register typo, did you flash your EC with unofficial firmware?

Of course it would be best if Lenovo just fixed that *****Expletives removed by Moderator***** typo. Will they ever do that? Maybe I should return this laptop and go back to my R32, I prefer its non-pulsing fan

@christopher_wolf:

I have quietly read many posts in this forum.. I see that the problem has intermittedly existed on many T4X and R5X, but I also see that a pulsing fix similar to what is employed in Linux, was implemented by Lenovo in *firmware* for the T40-T42!

And, this fix was broken on the T43 and R52 due to a *typo* - so what gives? Why is this being accepted - on the T43 the fan pulsing continues, due to the buggy EC firmware.

The ThinkWiki clearly explains it as a symptom of the EC fan control. Even if some batches of fans do not show this symptom, or some people are deaf to it, I am convinced that fixing the buggy fan control in the T43 EC might make for a massive improvement (since it's the same as the Linux anti-pulsing fix).

I don't want to post any "T43 fan noise" threads, but I think that plenty of T43 Windows users still get the pulsing, from what I've read..

I sure do...
I wonder what we can do to have Lenovo fix it...

Well, that's interesting; but through all the systems I have looked at, it really doesn't seem that it is a simple problem to either pulsing or fan noise as my T43 is up to date and is silent with no pulsing. Yet I have heard T42ps with fans that sound almost exactly like the louder T43s. From the beginning, when I started looking into all of this, it simply never turned out to be clear cut in any case.

Even though the "loudness" or the "duration" of the fan's running, is a subjective and possibly heat related issue, the fan pulsing occurs regardless of whether the machine is hot or not, due to the way that the T43 EC regulates the fan level, from what I've read.

But I imagine that some T43 fans do not make the pulsing as audible as others, though it still occurs, electronically.

The person who reverse engineered the T43 EC firmware found that there is a typo/bug in the firmware which if correct, would have dealt with the pulsing in a similar way to how Linux deals with it, or the latest EC firmware in the T40-T42 machines. It's all clearly discussed in one of the forums of this web site

In my opinion, it is therefore very clear that Lenovo implemented an improvement for the pulsing for all the T4X, and R5X. But they made a typo in the T43/R52, and the pulsing remains. Since they think that it's "fixed", it will never be really fixed. This leaves T43 owners with no hope of fixing their pulsing fan (if it occurs) - unless they run Linux or hack their EC firmware.

How does one bring the typo/bug to the attention of Lenovo?

People talk about "engineering contacts" and "support contacts" or "Gold support programs" but I have none of these, why has there been so little response to a very annoying EC bug? (For those that get the pulse noise)

Ehhh, not quite. Without a clear way to determine how the hardware actually responds to given portions of the code, an emulator would be a great tool here, one has to go off of what is apparent in the code itself. It may be that the typo itself is causing it or it is doing so in conjunction with something else, such as a slightly-off gain in a control loop that leads to an oscillation about steady state mechanically. Not all of the models of that can be readily ascertained from the code and quickly analyzed.

The pulsing, however, has remained more or less of an issue on a good deal of Thinkpads leading up to and including the T Series; I know this by both extensive experience and discussing it with users that have had such problems. From what I have seen, it isn't that one singular issue is to blame but it is most likely that a set of issues may be inherently manifest, given slight variations in the hardware itself, and therefore makes it far more difficult to track down as opposed to blaming it all on a single typo in the EC code. Knowing the code is a very important part, but that shouldn't redefine the whole scope so as one would miss other, important factors.

Ok, the typo is probably not a magic fix. But I am only interested in trying to reduce the "pulsing" in my T43. Loudness of the fan, or overheating does not concern me.

I accept that the pulsing could be some sort of highly complicated problem, but at the very least, how does one explain the existence of the Linux ACPI script with a special algorithm that is reported to reduce pulsing for some people? And how does one explain that Lenovo/IBM did implement a similar algorithm into the EC firmware, albeit it is broken on the T43? One cannot ignore that typo/bug can they?

If I install Linux on my T43, and the fan pulsing improves when using the special algorithm in the ACPI fan control scripts, then that will strongly suggest that an EC firmware without the typo/bug, as Lenovo/IBM had intended it, might have made the pulsing a little bit more bearable.

I don't want to install Linux on my T43, but perhaps I will have to, just to verify..

There is nothing magic about any of the fixes, if the user has a problem with the fan in Linux, the ACPI fix can help; yet, from experience, it doesn't entirely get rid of the pulsing in a way that one would expect should there be a single underlying bug in the EC code. It can do a great job of fixing the symptom, but not necessarily the underlying set of causes, which still remains hard to discern.

It should also be possible to implement a similar method on Windows given that the TP FCU can interface with the required hardware registers through the WinIO driver and the code is available for it.

To try and explain my position:

If your T43 had an obvious fan *pulsing* problem, which occurred every ~4.8s exactly as described on this site and ThinkWiki and you had found/read that:

- It is allegedly caused by the EC , but there is a script in Linux which supposedly makes a difference, by altering fan behaviour.

- The EC had a similar algorithm placed in it, but it never worked on the T43 due to a typo

- You want to try this algorithm, but you don't want to run Linux, and your EC cannot be easily fixed

You couldn't be blamed for wanting to at the least, try and see if this altered fan algorithm helps, especially if it was supposed to be in the EC

Regards..

@christopher_wolf

Yes, the underlying cause for the pulsing is probably something complicated and variable, but the "treatment" for the pulsing is worth trying, if it results in an improvement..

I agree that the treatment could be implemented via software, e.g in tpfancontrol, looks like it may come to this, time to re-install visual studio

It would save us all a lot of time though, if Lenovo could just fix that EC typo

Perhaps I should call support and complain about it, though I doubt they would believe me or want to listen..

LATEST NEWS:

I installed Linux, and did various test with and without the fan control script at different thresholds.

The fan-control script from Thinkerer definitely alleviates the fan pulsing, in fact, I can't nearly hear it anymore. It's a 99% improvement.

So a fix for the EC "typo/bug" may well provide a massive improvement for those that are affected by T43 fan pulsing and are running Windows.

Hi,

very interesting matter. I have a T60 and yes, the problem with the pulsating noise is present, among other high-frequency sounds emerging from the fan. I would resume an expose following points:

- Does the T60 have the same firmware (H8S/2161B)? I'm a electronics engineer. I can program in ASM reasonable well, but about hacking and decrypting I do not have much knowledgments.

- I would try to correct the firmware code. I think the 90% of the problem must reside in the code. The fan is controlled by the firmware, by a PWM signal in order to achieve a specific voltage level which determines the fan velocity. So, in my opinion the problems could be:
* The fan is really bad and makes noise. I don't think this, because the high pith is appearing regularly
* It's not really the fan but some kind of choke which is making the noise. Not probable, because its sound kind "of metallic".
* It's the fan because of the accelerating/deccelerating. I held this option as the most probable.

- Would it be possible to directly override the firmware by means of setting some kind of code in the RAM? It was commented here but it's not really clear

@mg,

- How could I obtain the source code of my T60 embedded controller? I would then change the code trying to correct this issue, because I can only say, for me it's the perfect notebook, but I cannot really work with this stupid noise.

ThinkMore

Anyone had any success with fixing the error in the code and flashing the firmware?

Each battery pack of the newer ThinkPads contains its own little computer to take care of its operation (monitoring/charging/discharging).

For example, a 3rd-party battery pack for a T4x/p from FLT consists of 3x2 Li-ion cells (ICR18650NH from HYB) and a smart battery pack module (with a GammaComm GC1318 controller IC, a Xicor X3101 monitor IC, and some power MOSFETs, thermistors, a fuse and other discrete components). The battery pack controller communicates via I²C/SMBus bus with the embedded controller of the ThinkPad (EC) as mentioned in the Smart Battery System (SBS) specs. This is done through the 5-pin connector of the battery that carries the P-, SFT, SDA, SCL and P+ signals (there is a large notch between SCL and P+).

LT has a nice introduction to smart batteries. There is also an application note for a newer controller from GammaComm.

Does anybody have information on what circuits are used in the original IBM/Lenovo battery packs for T4x/p? Possibly from Maxim/Dallas -- at least some older models or from other manufacturers are made with separate EEPROMs as can be seen on the datasheets page for AccPlus and on the old page of Smart Battery Workshop?

I don't have info on T4x batteries, but if it helps I can give you info on what's inside A31 batteries (e.g. in case it helps show what commonalities they all may have)? A31s are slightly older than T41s, but they may use similar hardware.

I ripped open an A31 battery because it shut itself off due to undervoltage (even though the cells are fine). So, I can tell you all the chips or send a picture. See this post.

Milos

Ha, interesting! It seems you figured out the same 5-pin-out I did.

It would certainly be interesting to know what circuits are used, although they are possibly not the same as for newer batteries (but who knows, apparently BatteryRefill are still able to reset them and since they still swallowed Smart Battery Workshop...). Looking at old Smart Battery Workshop docs it might use one of the AS3xxD controllers from Dallas (now Maxim). Pictures for ThinkWiki would be cool, too, if it's easy to do...

Actually, I cheated and just found them somewhere online first (maybe here, maybe it wasn't this one, but anyway there were no more than a couple of sites I could find that had the pinout listed). Then, once I opened up the battery I verified that the V+ and ground, and the thermistor pin are correct as listed there. I didn't follow the others, but it looks like the right pinout. Anyway, there's another data point.

I'll get back to you about the battery and charge cct info.

Milos

That seems to be for the UltraBay battery, with an additional pin... Actually, there is a nice drawing in the Hardware Maintenance Manual (around page 49, Checking the battery pack) but only terminals 1 (+) and 5 (-) are listed. So we have with that numbering (same as you used):

1. P+/Pack+/V+
2. SCL/CLK/Clock of I²C/SMBus
3. SDA/Data of I²C/SMBus
4. SFT/Safety Signal/Thermistor
5. P-/Pack-/GND/Ground

mg,

I think what they mean by the "additional pin", i.e. "2. Key", is the blank spot between pin 1 and 3 (i.e. between pin 1 and 2 in our terminology). I think by "key" they mean the protruding piece of plastic at that position that makes sure you plug the battery connector the correct way. For example, on the A31 systemboard (see here) the Ultrabay and main battery use identical connectors, neither having a 6th pin. I assume they have identical pinouts.

Anyway, so it seems that the pinout you found, the A31 pinout, and the pinout on that website, are consistent and seemingly identical. Probably a good think for tinkerers to know.

Milos

Yup, sounds right.

For those interested in how the internals of a 3rd-party battery look like, here is a high resolution picture of a 6-cell battery pack for the T40 series.

And another thread has a picture of the insides of a battery pack for a T23.

Well, as an ex-Lenovo employee and the owner of a T43p system, I tried to get something done about this from the inside. I sent an email which made some ripples in the water, but in the end it was more then likely buried. Part of the reason I think that is because I never heard back from the Engineer who the email was forwarded to before I left the company, despite requesting a status on the issue. This could be the case of that employee or someone he may have handed it off to being in one of the positions that has been slotted for elimination, so they don't really care anymore.

So, I would almost venture to say with certainty that this issue will never be fixed by Lenovo. I tried to push things through myself and had I been around there for a while longer, I may have gotten something done. But, the job market here was ripe and after 8 years with IBM/Lenovo, decided to call it a career there and be done with them.....

So for this fix, we are on our own. Just need someone here who is fluent in assembler to rip things apart and fix the typo.......

Thank you for trying! Well, it would possibly still take quite some time and effort... In the absence of circuit diagrams and schematics, it looks like the T43 Teardown Report from Portelligent could be interesting, even without the metrics at the end. If it just wouldn't cost more than a new notebook...

On a T40 system board, the motor of the fan is driven by a MOSFET that is driven by a transistor which is connected to P44/TMO1 (pin 3) of the H8S. There is probably some low-pass filtering there (smoothing/delay). The fan tacho is connected to a transistor that connects to P62/FTIA/TMIY (pin 80) of the H8S. TMO1 is controlled by the 8-bit timer 1 (TMR_1). FTIA can be used by the 16-bit free-running timer (FRT) and TMIY can be used by the 8-bit timer Y (TMR_Y).

The T43 has most likely the same discrete components connected to the same pins of the H8S. Looking at the timer configuration, including their interrupt configuration, as well as the configuration of ports P4 (bit 4) and P6 (bit 2) should help to figure out how the fan control system is programmed and configured...