BQ27220: Why can't I read CC Gain and CC Delta from Data Memory?

Hello Sauli,

If you can read the data at the address before that, then simply read a longer block. The data bytes are returned as per the address. Let me know if you get good results with this method.

The problem actually applies to all addresses 0x918x. Reading a single parameter in that area or all 4 parameters as a single 12 byte block return the data from the address previously read. Looks like writing address 0x918x to 3E/3F has no effect. The previous address written there is used.

Address 0x9180 is the lowest address in use in the 0x9xxx range of addresses, so I cannot start a block read from a lower address than that?

I think 0x9xxx is the OTP address. The procedure to write OTP requires a specific voltage

I am not trying to write into OTP.

Correct me if I am wrong, but this is my understanding of how it works:

Upon gauge reset - that is when the battery is connected - default parameters are read to Data Memory (RAM) from ROM / OTP. That data can be read from Data Memory using the addresses listed in chapter 3.4 of the TRM (sluubd4.pdf). Since the OTP has never been programmed, all those parameters are 0 when read. Parameters from ROM do have their default value when read.

The Data Memory Table in chapter 3.4 has columns 'Class', 'Subclass', 'Address' and so on. All parameters that have a note (Present OTP) in the 'Class' column return the value 0 when read.  These have address range 0x40xx and 0x41xx.  All parameters that have a note (ROM Default) in the 'Class' column return the listed default value when read.   These have address range 0x48xx and 0x49xx. The rest of the parameters are in address range 0x91xx and 0x92xx. I guess these are the parameters actually used when gauging.

So, the problem is I can read all parameters except those at address 0x918x. I can even write at least some of the parameters (have tried just a few). For instance I can write the parameter at address 0x9274 (Smoothing Delta Voltage). And the changed value is returned when I read it back. Even when I read some other parameters before reading from 0x9274.  If I write to address 0x918x, the written value is returned if I immediately read it back. But not if I read some other address first. In that case the data from that other address is returned. My conclusion is that in reality I cannot read or write to address 0x918x.

Hello Sauli,

Your understanding is correct. I don't have an EVM right now. I will try the steps when i i can get my hands on an EVM.

Hello Sauli,

I think you may not have fully unsealed the bq27220. I tried it and here are the results

Unsealed state confirmation - check SEC0, SEC1

Read data memory for reference (crosscheck with data to be read)

Transaction log - also reading 0x91b4 inbetween to make sure that the values are not stuck

I see that bqStudio does read different data from 0x9184, though that does not seem to be the default value CC Gain should have. However this does not solve my issue. I cannot integrate a bqStudio in the device! So the question is what does bqStudio do differently?

I added some logging to my code. According to that the gauge is unsealed when I read it. What do you mean by 'fully unsealed'? I hope not 'full access' because that should not be necessary (unless addresses 0x918x are some kind of an exception).

// The device has a debug interface to execute debug commands.
// One of the commands is 'GAUGE' and it reads / modifies the
// given gauge Data Memory address.
//
// The sequence:
// 1. Read two bytes from 0x91D4
// 2. Read four bytes from 0x9184
// 3. Read two bytes from 0x9232
// 4. Read four bytes from 0x9184
//
// A <GAUGE> line is a response from the debug task that it started executing the GAUGE command.
// A line starting with a Data Memory address is the result of the GAUGE command.
// All other lines are I2C transactions as seen by the I2C driver.
// -> means write
// <- means read
// -> AA xx AB means write xx/repeated Start for read
// ; is a comment added by me

<GAUGE>
-> AA 3A AB <- B6 00	; Check current security status: Sealed
-> AA 00 14 04 			; Unseal 1st write
-> AA 00 72 36 			; Unseal 2nd write
-> AA 3A AB <- B4 00 	; Check if Unsealed: Yes
-> AA 3E D4 91 			; Set address 0x91D4
-> AA 40 AB <- 1C 98 	; Read 2 bytes
0x91D4: Voltage Comp Coefficient 1 = 7320 (0x00001C98)	; Yes, this is the default value of 0x91D4
-> AA 3A AB <- B4 00	; Check current security status: Unsealed
-> AA 00 30 00 			; Seal
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
<GAUGE>
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
-> AA 00 14 04 			; Unseal 1st write
-> AA 00 72 36 			; Unseal 2nd write
-> AA 3A AB <- B4 00 	; Check if Unsealed: Yes
-> AA 3E 84 91 			; Set address 0x9184
-> AA 40 AB <- 1C 98 02 D3 	; Read 4 bytes
0x9184: CC Gain = 0x1C9802D3 ; Wrong, the first two bytes are the same as in the previous read.
-> AA 3A AB <- B4 00 	; Check current security status: Unsealed
-> AA 00 30 00 			; Seal
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
<GAUGE>
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
-> AA 00 14 04 			; Unseal 1st write
-> AA 00 72 36 			; Unseal 2nd write
-> AA 3A AB <- B4 00 	; Check if Unsealed: Yes
-> AA 3E 32 92 			; Set address 0x9232
-> AA 40 AB <- 02 26 	; Read 2 bytes
0x9232: OT Chg = 550 (0x00000226) * 0.1°C  ; Yes, this is the default value of 0x9232
-> AA 3A AB <- B4 00 	; Check current security status: Unsealed
-> AA 00 30 00 			; Seal
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
<GAUGE>
-> AA 3A AB <- B6 00 	; Check current security status: Sealed
-> AA 00 14 04 			; Unseal 1st write
-> AA 00 72 36 			; Unseal 2nd write
-> AA 3A AB <- B4 00 	; Check if Unsealed: Yes
-> AA 3E 84 91 			; Set address 0x9184
-> AA 40 AB <- 02 26 02 01 	; Read 4 bytes
0x9184: CC Gain = 0x02260201 ; Wrong, the first two bytes are the same as in the previous read.
-> AA 3A AB <- B4 00 	; Check current security status: Unsealed
-> AA 00 30 00 			; Seal
-> AA 3A AB <- B6 00 	; Check current security status: Sealed

If it is any clue, I also noticed that after reading from 0x9184 the gauge won't unseal for the next read until after an up to 4-5 second delay.