BQ40Z80: Locked out of writing to flash

Hi Chet,

Is this on a custom design or is the bq40z80 EVM being used?

Is the gauge attempting to be communicated with using EV2400 or a custom MCU?

If a custom MCU is being used, can you tell me what is being written to the gauge?

Regards,

Anthony Baldino

This is a custom design.  It's a custom MCU.  I am attempting to write a 32 byte block of flash memory.  The exact packet that I am attempting to write is as follows:

0x44, 0x22, 0xC0, 0x48, 0x87, 0x51, 0x5E, 0x10, 0x25, 0x10, 0xFD, 0x0F, 0xF4, 0x0F, 0xEC, 0x0F, 0xE8, 0x0F, 
0xE2, 0x0F, 0xCA, 0x0F, 0xBB, 0x0F, 0x8C, 0x0F, 0x75, 0x0F, 0x58, 0x0F, 0x42, 0x0F, 0x30, 0x0F, 0x10, 0x0F, 0xE5

The point is that I get a nack on the first byte after the 0x44.  I don't even get to the address part of the
packet because I get a nack.  So What are some things that would cause the BQ40Z80 to always nack?  Its responding
(aacking) the SMBUS address and the 0x44.  It's rejecting me for any manufacturing access.

The device has never been sealed.  I can connect it to BQStudio and read some registers.  But as soon as BQStudio
attempts to do a manufacturing access read.  It gets nacked forever.  So it looks to me like its locking me out
from any manufacturing access.

Below is an example of a successful read.  Using BQStudio and an EV2400



But below is a failed manufacturing access read using BQStudio.  I have broken it into three pictures so you can see
details after the clock stretch is over and so you can see that it just nacks forever.  BQStudio never gives up 
and I have to close BQStudio then unplug the EV2400 to stop if from infinitely waiting for the 0xFF nacks to end.







It does not matter if it's my custom MCU or BQStudio with an EV2400.  All manufacturing access fails.

I am using BQStudio 1.3.124 

Hi Chet,

Thank you for the details, I believe that if we can debug this on bqStudio, then it will make debugging the MCU issue clearer.

Regarding how this is being communicated in bqStudio, can you please tell me the process that you are using for the write? Below is an example I did writing to 0x4000.

Command 44 is being used, along with addressing the register in the beginning of the data as 00 40, then the rest of the data that is looking to be written.

Please ensure that while doing this, the Auto-Refresh in bqStudio is turned off.

Can you also please tell me what register you are attempting to write to in the example above?

Regards,

Anthony Baldino

OK no problem using bqStudio to trouble shoot.  Please see below a successful write with a chip that is in a good state.

Here are my results on a chip that is in a bad state for a read transaction

So back to my original question when we started this thread "Any suggestions on what would cause the chip to refuse any access to flash?"  What would cause a bq40z80 to just refuse any manufacturing access read or writes?

Hi Chet,

I see that on the unit that is in a bad state, there is a "Timeout or unexpected response communicating with the device" error. Below is another E2E thread where someone using bq40z80 was able to mitigate the same error.

https://e2e.ti.com/support/power-management-group/power-management/f/power-management-forum/836311/bq40z80evm-020-timeout-or-unexpected-response-communicating-with-device 

If this solution does not help, please let me know and we can look further into it.

Regards,

Anthony Baldino

I am able to use bqstudio and reprogram the firmware in the bricked boards now.  It's a bit quirky on how I have to do it.  If I attempt to just program it always gets rejected with a CRC error.  If I attempt to do a read block at 0x44 it gets into an eternal loop of NACK but then when it is in this eternal loop of NACK I can then hit the program button and it will figure things out and program the firmware.  I found this solution by trial and error.  

Any thoughts on what's up with this being the magic combination to get this thing to reprogram?

Do you have documentation on how to program the BQ40Z80 independent of bqstudio and the EV2400?  Its not realistic to use bqstudio and an EV2400 in mass production.

Hi Chet,

I have not seen this solution before for getting the bricked boards to program, I will look into this.

Regarding programming the bq40z80 units without bqStudio or EV2400, this is possible using the Flashstream files. This will allow the gauges firmware and configuration files to be programmed via a .bq.fs file. More information can be found in the Gauge Communication document below:

https://www.ti.com/lit/pdf/slua801

Regards,

Anthony Baldino

the slua801 document has one page that does not go into detail on the flash stream file format.  Do you have a document that documents all the commands found in the .bq.fs file?  I found similar things here  and here .  These links have further helpful information, but don't seem like they have the latest info.  I have a golden .bq.fs file here is a snippet from it below:

;--------------------------------------------------------
;Go To ROM Mode
;--------------------------------------------------------
SWB: 16 44 00 0F
X: 1000
;Clear Tokens by poking 00 to both locations
;Set Address to 0x0000
SWW: 16 09 00 00
;Read Value at address 0x0000
;SCW: 16 0B
;Clear bit 3 and write value to address 0
;dataUpdate = (dataRead & 0xff) | 0x8;Instead setting hardcoded value that works
SWW: 16 0A 02 00
;Set Address to 0x0002
SWW: 16 09 02 00
;Write Value 00 to 0x0002 
SWW: 16 0A 00 00
SWW: 16 00 00 00
SWW: 16 1A DE 83
SWW: 16 06 00 00
X: 250
SWW: 16 00 80 00
SWW: 16 1A DE 83
SWW: 16 06 80 00
X: 250
;Set Field Updater tokens by poking 08 to 0000 and B8 to 0002
;Set Address to 0x0000
SWW: 16 09 00 00
;Read Value at address 0x0000
;SCW: 16 0B
;Set bit 3 and write value to address 0
;dataUpdate = (dataRead & 0xff) | 0x8; Instead setting hardcoded value that works
SWW: 16 0A 0A 00
;Set Address to 0x0002
SWW: 16 09 02 00
;Write Value B8 to 0x0002 
SWW: 16 0A B8 00
SWW: 16 00 80 01
SWW: 16 1A DE 83
SWW: 16 06 80 01
X: 250
;Clear Tokens by poking 00 to both locations
;Set Address to 0x0000
SWW: 16 09 00 00
;Read Value at address 0x0000
;SCW: 16 0B
;Clear bit 3 and write value to address 0
;dataUpdate = (dataRead & 0xff) | 0x8;Instead setting hardcoded value that works
SWW: 16 0A 02 00
;Set Address to 0x0002
SWW: 16 09 02 00
;Write Value 00 to 0x0002 
SWW: 16 0A 00 00
SWW: 16 11 DE 83
X: 400
SWW: 16 07 DE 83
X: 250
SWB: 16 0F 00 40 76 2F 76 A9 C8 90 0B 7E ED 3F 53 1B 07 49 00 00 40 00 00 00 00 00 00 00 00 BC A2 FF FF FF FF FF
X: 3
SWB: 16 0F 20 40 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
X: 3
SWB: 16 0F 40 40 20 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 7A 78 79 30 31 32 33 34
X: 3
SWB: 16 0F 60 40 35 20 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 7A 78 79 30 31 32 33
X: 3

I am writing a parser for a production test fixture that can read this file and do a firmware update.  Can you find me the definitive document about the flash stream file format?  I have captured with my saleae logic analyzer this file being written to a BQ40Z80.  Can you provide me the definitive document so I don't have to reverse engineer from the logic analyzer capture and the .bq.fs file what each command means?  Thanks.

Hi Chet,

I believe that the two documents and threads sent in that message are for gauges that use I2C/HDQ. Below is the .bq.fs command breakdown list for gauges that use SMBus, which should match more correctly to the .bq.fs above.

https://e2e.ti.com/support/power-management-group/power-management/f/power-management-forum/1107256/faq-bqstudio-how-do-i-interpret-the-lines-in-a-bq-fs-file-for-use-with-my-smbus-gauge 

I do not believe we have a designated document of each individual command for the flashstream format, but I will keep looking on our side and can answer any questions that come up.

Regards,

Anthony Baldino

I am still trying to figure out why the flash get randomly corrupted and its necessary for me to refresh the firmware to recover the chip.  I am doing calibration on the device.  When I do calibration I write to the calibration data flash area that starts at address 0x4000.  is there any problem with writing to that area one register at a time?  For example I do a write of 2 bytes of payload to the cell gain register that starts at 0x4000.  How about if I write two registers at a time for the case of current calibration?  I do a write of 8 bytes of payload starting at address 0x4006 and I write the ccgain and capacity gain in the same write.  Does that raise any red flags?  

Hi Chet,

The device should not have any issue writing to a single register, or multiple registers as long as it fits the formatting seen below:

The only issue I could see if the registers you are trying to write to are not in order, such as 0x4000 to 0x4002, and so on.

Regards,

Anthony Baldino