BQ34Z100: bq34z100 g1 - no longer able to enter full access mode after mass erase

Hi Batt,

Thanks for your response.

I know it should return to rom mode and it did but I think at some point the gauge was sealed so it is no longer programmable by bqstudio either - full access mode cannot be entered anymore.

I found a post stating this is expected behavior, see the first response (by  ThomasCosby).

The production procedure we had in mind was to update both the data flash as well as the firmware flash of the BQ chip on newly produced boards from the golden image.

The reason we want to update the firmware of the chip as well is that the data flash apparently depends on the firmware version (see a comment in the exported *.df.fs fle from bqstudio).

As far as I can tell, updating the firmware part is not described anywhere and the update procedure for the data flash is only described in pseudo code in SLAU665.

So for now we will update the data flash only and log the DEVICE_TYPE, FW_VERSION and HW_VERSION for future reference.

Sanne

Hi Steven,

Thanks for your response.

I was not having the same issue as in the post I linked above, I just thought the response from TI also explained my issue.

I am still having the issue, it is exactly the same as described in this thread.

The exact steps as performed on a newly soldered chip (next step only on success of previous one):

1. enter unsealed mode
2. enter rom mode
3. erase data flash
4. blank check data flash
5. program golden image data as exported with studio
6. verify data
7. exit rom mode
8. seal it

When the chip is reset after the mass erase, the chip will still be accessible but only if it has never been sealed before!

If it was a sealed chip to begin with, the chip will need to be replaced in order to reprogram it in rom mode again.

I have added a log file of the sequence trying to enter full access mode after an erase of the data flash followed by a reset.

The sequence is:

1. Read status - 0x620D = sealed
2. Unseal using the default key 0x0414 0x3672
3. Read status - 0x620D = still sealed
4. Try unsealing using 0xFFFF 0xFFFF
5. Read status - 0x420D = unsealed!
6. Enter full access using 0xFFFF 0xFFFF
7. Read status - 0x420D = still unsealed
8. Chip cannot enter rom mode anymore

Note that after a failed key the chip apparently needs a long time to be able to accept a valid key at all again.

When erasing the firmware flash, the chip will remain in the bootloader indefinitely - also through any sort of reset.

So the following sequence should be full proof independent of a chip having ever been sealed:

1. erase firmware flash
2. blank check firmware flash
   1. Any reset from this point on will cause the chip to be in the rom mode
3. erase data flash
4. blank check
5. program data flash
6. verify data flash
7. program firmware flash
   1. note that there is no documentation on how to do this!
8. verify firmware flash
9. exit loader

Hope this helps someone.

I know this has been asked in other threads but is there any way to get in depth documentation on the bootloader (commands, timing, etc)?

I am only aware of the pseudo code in SLAU665 and this only describes reading / writing data flash.

Thanks,

Sanne

"Analysis Type","SerialBus(I2C)"
"Model Name","DLM2000"
"Model Version","5.10"
"History No.","Trig'd Time"
0,22:59:17.265 240
No.,Time(ms),1st,2nd,R/W,Data,Information,
      0, 0.0062,55*,, W,00*,7-bit,
      1, 0.3066,55*,, R,0D* 62,7-bit,
      2, 1.4574,55*,, W,00* 14* 04*,7-bit,
      3, 3.0506,55*,, W,00* 72* 36*,7-bit,
      4, 104.0402,55*,, W,00*,7-bit,
      5, 104.4293,55*,, R,0D* 62,7-bit,
      6, 5106.7734,55*,, W,00* FF* FF*,7-bit,
      7, 5113.2352,55*,, W,00* FF* FF*,7-bit,
      8, 5213.8776,55*,, W,00*,7-bit,
      9, 5214.1806,55*,, R,0D* 42,7-bit,
     10, 5214.9256,55*,, W,00* FF* FF*,7-bit,
     11, 5215.8819,55*,, W,00* FF* FF*,7-bit,
     12, 5316.8755,55*,, W,00*,7-bit,
     13, 5317.1968,55*,, R,0D* 42,7-bit,