-
Take the DMM and find these connections, takes a minute
-
Take the DMM and find these connections, takes a minute
Hello DavidAlfa, thank you for the schematic, it's very helpful actually since I had not much clue on what PICkit header pin I have to pair to which PIC16lf1847.
Having your picture in front of me I will certainly help me find the right pinheader on the PCB much faster. Looking forward for the amazon delivery, it looks like it's going to be today, cannot wait to get back home.
Tinfever already gave some details about the software, I hope I will get the settings right.
Cheers -
Take the DMM and find these connections, takes a minute
Hello DavidAlfa, thank you for the schematic, it's very helpful actually since I had not much clue on what PICkit header pin I have to pair to which PIC16lf1847.
Having your picture in front of me I will certainly help me find the right pinheader on the PCB much faster. Looking forward for the amazon delivery, it looks like it's going to be today, cannot wait to get back home.
Tinfever already gave some details about the software, I hope I will get the settings right.
Cheers
I've essentially completed the reverse engineering of the SV09 V6 BMS board. I've attached a copy of the schematic, as well as an image showing the connections on the physical board (if anyone is desperate enough to want to see through the mess). The programming pinout is in the upper-right on the schematic, although it is upside down compared to your photo.
I've also done some more testing on how to program the EEPROM without wiping the protected program memory. It appears this is not possible with the latest MPLABX IPE tool with any combination of settings I've tried. BUT, it is possible with the older PicKit 3 programmer software. This is "PICkit 3 Programmer App and Scripting Tool v3.10" which you can download here: https://www.microchip.com/en-us/tools-resources/archives/mplab-ecosystem. You'll probably still need the latest MPLABX for other things though.
Here is the process to (I think) program the EEPROM without wiping the protected program memory:- Install and start the PicKit 3 program linked previously
- Download the bootloader when prompted (if needed)
- Connect and read the PIC to make sure things are working right. If you have removed the BMS board from the battery pack, you'll need to configure the PICKit 3 program to provide 3.3V power to the target to power the PIC.
- To attempt to load my EEPROM dump of a working PIC, go to File > Import Hex, and select the hex dump I've attached. It's empty for all the program memory but it still contains the EEPROM data.
- UNCHECK the "Enabled" box under Program Memory. Leave the "Enabled" box checked for EEPROM data (which should now some actual data from the imported hex file.)
- Click "Write" and hope for the best
Edit: if anyone knows what U6 could be, I'm all ears. It is a SOT23-5 (I think), 5-pins, with the markings "AATJ". It's got me stumped.
-
Hello tinfever,
Edit: if anyone knows what U6 could be, I'm all ears. It is a SOT23-5 (I think), 5-pins, with the markings "AATJ". It's got me stumped.
I have run into some issues, I received the Pickit 2 and used with the pikkit2 app, see the picture. Problem is that I cannot find the right device - 16lf1847 and i tried couple of them.
I cannot find any dropdown menu that gives me that device to select.
While selecting random chips, the voltage was going from 3.3 to 5 v by itself.. forgot to turn off the target vdd. This is because i am working on the board that I pulled out so I have to put power.
I can still read the chip, that means the 5V was not killing-it yet. Even in this case, it gets the read protection bits and the device model I chose does not have the EEprom data availble.
Edit: loaded MPLAB IDE 8.92 to be able to use pickit 2 and I can find the chip there but if I select it does not work with PICkit 2.
So I have to wait for the PICkit 3 to arrive, I could have bought the PICkit 3 in the first place but something made me thought let's have both... crapy logic, we'll see.
-
Hello tinfever,
Edit: if anyone knows what U6 could be, I'm all ears. It is a SOT23-5 (I think), 5-pins, with the markings "AATJ". It's got me stumped.
I have run into some issues, I received the Pickit 2 and used with the pikkit2 app, see the picture. Problem is that I cannot find the right device - 16lf1847 and i tried couple of them.
I cannot find any dropdown menu that gives me that device to select.
While selecting random chips, the voltage was going from 3.3 to 5 v by itself.. forgot to turn off the target vdd. This is because i am working on the board that I pulled out so I have to put power.
I can still read the chip, that means the 5V was not killing-it yet. Even in this case, it gets the read protection bits and the device model I chose does not have the EEprom data availble.
Are you using a PicKit2 or 3? I can only speak for my PicKit 3, so I'd first make sure the PicKit 2 supports this PIC. You'll have to do some Googling to find the supported part document from Microchip.
Also, you may need to pick the correct device family inside the program. I believe this 16LF1847 is in the midrange 1.8V family.
I'd also suggest installing MPLABX and seeing if you get different results with the IPE included with that. I've at least seen the MPLABX IPE is pretty good at auto detecting the chip correctly. -
Hello again,
Thanks for the reply, it's not supported by PICkit 2, so I will have to wait until I receive the ali one 16$CAN compare to min 30$ on amazonn.
Question, is the one you have able to go from MPLAB mode and standalone mode ok?
I mean, it's no problem to load on yours the original microchip FW and also converted back to MPlab mode.
I just want to make sure my clone will be usable in both modes, before I do something to ruin-it.
The PICkit 2 I have since yesterday did not gave me any error messages, with all the MPLAB versions, it seems to be always detected and works fine to generate power to the PIC chip, I verified.
It really itches me to buy the ceapest kit3 from amazonn with tomorrow delivery, but it's too much money spent on this project. Better wait a little bit.
Also today I had a chance to use the microchip software and get familiarized - never used before. -
With mplab X IDE / IPE you don't need to switch pickit 3 mode.
IPE provides a similar standalone tool experience. -
Hello again,
Thanks for the reply, it's not supported by PICkit 2, so I will have to wait until I receive the ali one 16$CAN compare to min 30$ on amazonn.
Question, is the one you have able to go from MPLAB mode and standalone mode ok?
I mean, it's no problem to load on yours the original microchip FW and also converted back to MPlab mode.
I just want to make sure my clone will be usable in both modes, before I do something to ruin-it.
The PICkit 2 I have since yesterday did not gave me any error messages, with all the MPLAB versions, it seems to be always detected and works fine to generate power to the PIC chip, I verified.
It really itches me to buy the ceapest kit3 from amazonn with tomorrow delivery, but it's too much money spent on this project. Better wait a little bit.
Also today I had a chance to use the microchip software and get familiarized - never used before.
I've had no issues switching between PicKit 3 mode and MPLAB mode. I wish I could just stay in MPLAB mode but I haven't found a setting combo that lets you write to the EEPROM on a PIC with the CP bit set, without it automatically wiping the program memory. You can do that from the PicKit 3 program tool though. -
That's part of the security.
If you wipe the CP bits, internal erase is automatically triggered.
Otherwise it would be plain easy to unprotect them.
Although probably there's some glitch hack, ex. Removing power 10us after clearing the CP bit, you might be able to prevent the erasing.
Anyways that would require a lot of testing and sending the CP sequence using a mcu, not the pickit. -
Hello tinfever,- To attempt to load my EEPROM dump of a working PIC, go to File > Import Hex, and select the hex dump I've attached. It's empty for all the program memory but it still contains the EEPROM data.
I got the PICkit 3 and read the chip, without battery, just powered by the PICkit. looking at the eeprom values I saw mine was V15 while yours is V11.
Then try to read just the eeprom, couple of times, some values are keep changing after each read, like a timer of some sort.
Did you took a reading after you have locked-it with the 32 red lights?
Comparing different versions may not be relevant, I do not want to try right now to write, until I understand a bit more.
Since you had the working values and I hope you have the locked values too, would you mind first comparing those?
I see a lot of differences between your values and mine, thus the hesitation to just write your hex file.
From the datasheet page it seems that if we can read the eeprom then it is not protected, I am getting confident we can alter just the eeprom data, as you said.
"The entire data EEPROM is protected from external reads and writes by the CPD bit. When CPD = 0, external reads and writes of data EEPROM are inhibited.
The CPU can continue to read and write data EEPROM regardless of the protection bit settings."
I have to figure out what is the bit to change.
Thanks
-
Strange... My eeprom area reads all 0s when CP /CPD bits are set!
-
Strange... My eeprom area reads all 0s when CP /CPD bits are set!
Hello DavidAlfa,
CP and CPD have different bits in 16LF1847, I spent a lot of time at work to read some of that datasheet.
Luckily the dyson one has not enabled the CPD bit, meaning we can write eeprom directly.
I just did the overwrite directly in the PICkit app, in the bottom window, overwriting the existing locations of the eeprom data.
I just wrote "here I am" - 48 65 72 65 20 49 20 61 6D - in the first row and after reading the pic again, it's there, the same data...
I wish I know what I am doing...
but I accomplished writing the eeprom like that...
What bit to change, I do not know, I have to try them one by one? No idea what that unlocked bit should be...
Here tinfever could have been of great help with both of the hex dumps before lock and after lock, so we can compare what changed, in which location.
Imagine, I just type there 00 or FF click write and bang, the bms is back to work.
-
Another posibility:
Probably the Pic isn't supossed to reset during the whole battery lifetime, so who knows what's happening inside when doing so, the pickit resets it during reading.
It might initialize some new data in the EEPROM ...
Now you changed something, maybe it broke some kind of checksum, locking it, that's why it no longer changes?
Try filling it with FF, that's what a virgin EEPROM reads.
Anyways, there're also programable (non-volatile) user flags in the ISL94208 controller, it could use them to prevent hard resetting like this. -
Well...
It's almost there! I applied around 3.7 V per cell ( using the resistor divider ) and programming different eeprom locations. I begin to think I got-it right.
I just need to piggyback-it on another battery so I can plug the charger and see how it's doing.
Then I can see further if everything goes as planned.
While the lock is off, remove and re-apply the power does not lock-it back. I believe that if the PIC has no power it will not do the cells check.
It has to be powered ( awake by the other chip) to perform checks.
I messed up completely the eeprom so I have to start over by restoring the older values, start to modify one by one, so I know which ones are important.
Great tool the PICkit 3 app, I just write something in the eeprom map and hit the write button, then click the Dyson BMS switch and see what color the light comes on.
Imagine my jaw dropping when at one point after clicking the switch the light came on blue... holly s*it, it's happening...
Edit: charging it seems to work, blue light turns on steady blue.
Keep you posted.
-
Hi dvd4me, sorry for the delay. I've attached a copy of what I believe was my dump of the SV09 V6 EEPROM while it was in the 32 red blinks state. Unfortunately while I was working on that board, I tried to solder wires on to the I2C connections, accidentally broke off the resistors, and then after soldering on new pull-up resistors, I think the heat or something caused damage to the ISL94208 since, again it is no longer regulating 3.3V.
I think started work on a second SV04 V6 battery (essentially identical to SV09) and in the process of soldering on the programming headers, I saw a spark and now the ISL94208 seems to have a short to GND on the 3.3V line. I'm getting the impression that the 3.3V regulation section on the ISL94208 is very fragile. I'm not sure if the flux I was using caused a short or what exactly happened since the spark seemed to be near the PIC, not the ISL. Working on a powered circuit board probably doesn't help either. Most of these issues seem to occur after I'm soldering on the board for some reason.
Anyways, I'm on a third SV04 now and am now being extremely careful with them. I've got the headers soldered on and am in the process of charging it up so I can then cause an imbalance and cause the 32x red blinks issue. Then I'll see if I can load an earlier copy of the EEPROM and unlock it.
FYI, the charging overcurrent protection seems to kick in around 1.4A. It will stop charging and will give 8 yellow (I think) LED blinks. Disconnecting the charger and reconnecting it at a lower current works fine so this doesn't appear to cause permanent lockout.
Edit: the PIC is powered automatically by the 3.3V regulated from the ISL94208 controlling a transistor. As soon as the ISL94208 wakes up when you *release* the button, it will power up the PIC. The PIC is definitely designed to lose power. Normally the 3.3V rail will remain until you repress the button (pulling the trigger on the vacuum actually releases the button from being pressed) but if it detects no load or an error condition it will turn it off after a certain timeout I think.
-
Woo! I can confirm that I was able to bring a locked out battery back to life by reloading it with old EEPROM data!
Here's what I did to create the 32x red LED flashes error and then recover from it:- Started with a SV04 battery that was sold as not working, which I have lovingly named SV04 Unit 3. The battery initially presented the 10x blue LED flashes error and would not discharge. As usual, connecting the battery to the charger cleared this error and the battery seemed to function normally. All cells were very closely balanced to start with, with a delta of 40mV and a range of 4.0131V to 4.0531V. I'm still not entirely sure why this battery was sold as not working.
- The battery pack wasn't fully charged to start with but I discharged it until the BMS cutout with cell voltages between 3.4-3.5V (I should have noted the actual cell voltages). Pack voltage at the end was 20.97V. Capacity discharged was 1160mAh
- I then charged the pack to completion when the BMS turned off charging. Pack voltage was 24.858V with a min-max cell delta of 38.3mV. Cell range was 4.1654V to 4.1271V. Before doing anything else with the pack, I dumped the entire PIC including EEPROM and program memory (all zeros on program memory due to CP bit. CPD bit was not set.)
- The battery pack was then discharged with 1A drawn from cell 2, and simultaneously 50mA from the entire pack so I could monitor when the BMS cut out due to cell imbalance. This ended when the BMS cut out with the 10x blue LED flashes error. Pack voltage was 24.555V with a min-max cell delta of 199.5mV. Cell range was 4.1435V to 3.9440V
- The error was cleared by placing the pack briefing on the charger. Discharging was then continued with 50mA from the entire pack and simultaneously 500mA from cell 2. This ended when the BMS cut out again with the 10x blue LED flashes error. Pack voltage was 24.464V with a min-max delta of 243.7mV. Cell range was 4.1356V to 3.8919V
- I then continued discharging just cell 2 in CC+CV mode with a max current of 1A and a target voltage of 3.80V. Discharging was stopped at 67mA discharge current @ 3.8V. Pack voltage was 24.388V with a min-max delta of 318.4mV. Cell range was 4.1354V to 3.8170V. I immediate placed the pack on the charger without pressing the button and I received what I believe was a solid yellow or red light that stayed lit for a few seconds and went out. The pack would not charge at all and from that point didn't respond to the charger. Removing the charger and pressing the button presented the 32x red LED light error code which could not be cleared.
- The battery pack was then rebalanced by charging cell 2 in CC+CV mode up to a target 4.13V. Current limit of 1A and charging stopped at 100mA. Pack voltage was 24.682V with a min-max delta of 37.7mV. Cell range was 4.1354V to 4.0977V (Cell 2 wasn't the lowest but was 4.1120V)
- Connecting the charger again still produced no response and pressing the button without the charger still produced the 32x red LED flashes error. Thus, the BMS was permanently locked out despite the cells being rebalanced. I made a complete dump of the PIC at this point as well.
- I connected the BMS to the PicKit 3 and using the old standalone programmer software v3.10, I imported the hex dump from step 3, unchecked the box for programming program memory so it would only program the EEPROM and clicked program.
- The battery pack immediately changed to a solid blue LED until it did the green or yellow flash and turned off due to no load, as usual. It worked! I just did a complete discharge of the pack at 3A until the BMS cut out at the discharge limit. Pack voltage at the end was 20.640V with a min-max delta of 178.4mV. Cell range was 3.4981V to 3.3197V. It appears one of the cells is weaker than the others because they were all around 3.45V-3.5V except for cell 1 at 3.3197V. The discharged capacity was 1395mAh, so perhaps this battery was disposed of due to reduced capacity. It has 66.4% of the rated 2100mAh capacity. Either way, it works!
I've attached both the initial working PIC dump and the PIC dump after entering 32x red LED flash lockout.
-
Woo! I can confirm that I was able to bring a locked out battery back to life by reloading it with old EEPROM data!
Hey tinfever, congrats! I have accomplished also unlocking on the trials from yesterday and today I just finished making a video about the whole process, while recovering the last V6 (SV03), never touched, locked battery pack.
I've attached both the initial working PIC dump and the PIC dump after entering 32x red LED flash lockout.
I am not sure if restoring the same unlocked hex file to all the packs will work. They are so different. It may not work.
I found by many trials the 2 eeprom data locations that need to be changed, and the pack will unlock.
I unlocked all the 3 original BMS that I had, including the last SV03 I had, untouched one. Just writing those 2 locations and not the whole eeprom.
Similar, for your V7, how do you know if the unlocked V6 data will work on the V7 version of the pcb?
If you want to see the video I posted, it's here:
Video description is pointing back to this thread, for others to see the complete details.
Cheers -
Have you tried the simplest method I said earlier?
Just filling it with FFs, simulating an unprogrammed EEPROM. -
Have you tried the simplest method I said earlier?
Hello DavidAlfa,
Just filling it with FFs, simulating an unprogrammed EEPROM.
No, since it would have lead me to nothing to try to enter 00 or FF in all those locations, too much work, since there are other values that needs to be put, not 00 or FF.
I cannot edit the hex dump generated by the app directly to modify the eeprom data, maybe i have to use the MPLAB to export that, with the configuration bits, too complicated for me.
I rather spend the time to alter specific locations and see the result directly in the PICkit app.
The reason is that there might be some pack data I do not want to be lost, in case there is future development on this.
I have seen locations that reflect each cell status, I assume there were intended for debug/fail analysis for the factory techs, when they had to analyse the warranty returns.
Reading the pack statistics make sense to see what is going on. I rather let that be there, make the least invasive reset possible.
I spend some time today to redirect here some of the obviously unanswered questions about the 32 red light flashes that I could found on some forums and youtube " fixing" videos.
-
Normally you can select/copy/paste the hex values, also fill ranges.
-
Woo! I can confirm that I was able to bring a locked out battery back to life by reloading it with old EEPROM data!
Hey tinfever, congrats! I have accomplished also unlocking on the trials from yesterday and today I just finished making a video about the whole process, while recovering the last V6 (SV03), never touched, locked battery pack.
I've attached both the initial working PIC dump and the PIC dump after entering 32x red LED flash lockout.
I am not sure if restoring the same unlocked hex file to all the packs will work. They are so different. It may not work.
I found by many trials the 2 eeprom data locations that need to be changed, and the pack will unlock.
I unlocked all the 3 original BMS that I had, including the last SV03 I had, untouched one. Just writing those 2 locations and not the whole eeprom.
Similar, for your V7, how do you know if the unlocked V6 data will work on the V7 version of the pcb?
If you want to see the video I posted, it's here:
https://youtu.be/7t9yA3_KUI0
Video description is pointing back to this thread, for others to see the complete details.
Cheers
That's awesome that you found the specific bytes in the EEPROM that need to be changed! That's way better than my method of just rewriting the entire EEPROM with a working published copy. You're right that I hadn't really considered EEPROM differences between versions. The hardware is nearly identical so I believe they can all run the same firmware, but if they have different firmware versions then they might be using the EEPROM differently.Normally you can select/copy/paste the hex values, also fill ranges.
The old PicKit 3 standalone programmer doesn't seem to let you copy and paste the EEPROM data. The only method I've found is to import a previously exported hex file dump of the entire device like I've published (which you could edit in a text editor if desired), and that will include the EEPROM data. Unfortunately the PICKit 3 standalone software is required because I don't believe there is a functional way in MPLABX IPE or IDE to program the EEPROM of a device with the CP bit set, but CPD bit clear, without erasing the program memory.
I'm still going to try to make my own firmware for these. Maybe I can even add some features like an LED indicator that tells you how out of balance your cells are and doesn't go in to permanent lockout in the first place. I'm also planning on adding cell balancing routines, even if they won't work unless you add your own balancing resistors. Side note on adding your own balancing resistors, since Dyson used 1k resistors on the VCELLn lines, and the ISL balancing FETS short across CBn and VCELL(n-1), I think you could easily use 20 Ohm resistors for balancing, and possibly no resistors at all since the 1k resistors should limit the current. I haven't tested this though. This would mean balancing will be very slow with the 1k resistors already on the board though. I think it'll still work since these vacuums hang on the wall charging 99.9% of their life. -
Why do you keep using such old and outdated utility?
-
Why do you keep using such old and outdated utility?
As I mentioned in my post:... Unfortunately the PICKit 3 standalone software is required because I don't believe there is a functional way in MPLABX IPE or IDE to program the EEPROM of a device with the CP bit set, but CPD bit clear, without erasing the program memory.
I'd be happy to be corrected. -
Oh, sorry, didn't read that. Will make a test.
Edit: Meh, doesn't seem to work. IPE is newer, but buggy and slow as hell.
It seems the programmer reads the memory first to preserve it when told so, and of course that won't work with CP set.
Maybe the programming algorithm changes between standard and standalone firmwares. -
Hello again,
I also made a video about locking and unlocking an SV10 battery pack, the only one I have and I was keeping it to experiment capacity testing and other things.
The battery pack was working fine, just that I do not have a vacuum for it and the chances to find one are slim to none so I opened again and unbalance the pack by discharging one cell.
At one point I got the fail lock lights, the pattern was different, is 2 red blinks on blue, not the 32... The software on this model seems to be different.
Once the pack fail it does not charge anymore. It does not restore to working conditions after the cell is balanced back.
After balancing the cells, changing those 2 eeprom locations restores the pack functionality.
I posted the video here:
Cheers