• State TI Thinks Resolved
  • Locked Locked
  • Replies 2 replies
  • Answers 1 answer
  • Subscribers 64 subscribers
  • Views 1693 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

BQ28Z610: unseal the Gas Gauge for configuration

Alexander Niskorodnov
Prodigy 10 points
Part Number: BQ28Z610
Other Parts Discussed in Thread: BQ24725A, BQSTUDIO, EV2400

Hi, team!

I use the BQ28Z610 in the control board of the 2S Li-ON battery(mini-UPS) and the chip is in a sealed state. I do not have neither EVM or i2c BQ programmer - only my microcontroller (atmega328 with the Arduino bootloader).

When I reading the data block for the unseal key(0x0035), the data is returned from the previous successful MAC read (e.g. OperationStatus 0x0054) and it means that I can not read the unseal key in sealed mode.

I successfully read from standard registers and MACdata, but I can not normally configure the chip because it is sealed. I learned this forum on similar topics of unlocking BQs and I find out that I need default unseal keys for transferring the chip to unseal mode. I saw in some topics that many who encountered this problem were recieve a key by email.

Can you also send me a default unseal key?

My email: niskorodnov@lanit.ru

As I understand it is necessary to write a unseal key (4 bytes) to the register 3E with the command 0x0035 with a checksum, or another procedure? I write the program in the Arduino IDE environment on a C ++ similar language using the standard Wire library.

For MACdata block read, I do this:

- Open connection with BQ i2c address and send 0x3E(allManAcces) and command bytes(LSB, MSB) - first transaction with closing connection.

- Open connection with BQ i2c address and send 0x3E(allManAcces) and read MAC block(36 bytes) - second transaction with closing connection.

What transfer procedure should be used to transfer the chip from SEALED to UNSEALED mode and UNSEALED to FULL ACCESS?

Unfortunately, the manual(SLUUA65B) does not very clearly explain what specific operations you need to perform, and there is nowhere in the datasheets an understandable structure for data transmission (for example, for the BQ24725A that I use in the project - there the query structure is shown superbly). I read it across and in the part of the security modes, but still the procedure is incomprehensible for transferring to UNSEALED mode, there is only an example for replacing the keys, which only works if the chip works in unseal mode.

PS: Why do we need such big difficulties with unlocking the device and all these keys? Why not specify a default keys in datasheet/tech guide?

  • 0
    TI__Mastermind 42535 points

    your thread's been assigned to me, I'll reply back in a few days.

  • 0 in reply to Batt
    TI__Genius 14985 points

    Hi Alexander,

    Unfortunately you will not be able to complete development of a pack based on bq28z610 without using an EV2400 and bqStudio during the process.  You will need to use it to program the chemID (battery profile) and can then extract the dataflash image in a .df.fs format which you can then program with your MCU.  You will also be able to use the Unseal and Full Access command buttons which will send the default unseal keys first.  If those don't work it will pop up a window to ask you to type in your custom unseal keys.  I'm not sure why the default unseal keys aren't documented in the multi-cell gauge documents, but you will easily be able to find them out as well as the command sequence to send them using bqStudio and EV2400.