BQ4050: unsealing gauge using i2ctool issue

Marek Belisko1

Part Number: BQ4050
Other Parts Discussed in Thread: BQSTUDIO

Hello,

I have in my design bq4050 which is sealed and I would like to unseal it and update some valued in data flash.

I know that battery is sealed because read operation status register is shown as:

root@dev:~#i2cset -f -y 0 0xb 0x44 0x54 0x00 s
root@dev:~# i2cget -f -y 0 0xb 0x44 i 7
7: 0x06 0x54 0x00 0x87 0x03 0x00 0x00

so status of ENC0 and ENC1 is 1 - 1 which is sealed.

I didn't change keys so I should be able to unseal with default key with following:

i2cset -f -y 0 0xb 0x00 0x14 0x04 s;i2cset -f -y 0 0xb 0x44 0x00 0x00 0x72 0x36 s; i2cset -f -y 0 0xb 0x44 0x54 0x00 s; i2cget -f -y 0 0xb 0x44 i 7

but it still shows that device is sealed. Anything I'm doing wrong to achieve it? Thanks.

over 5 years ago

0 Andy Liu (BMS) over 5 years ago

TI__Guru 52115 points

Hi Marek,

One thing you can do is to unseal the device in the bqStudio and in the meanwhile capture all the smbus communication with a digital anaylor / i2c protocol analyzer. Implement the same sequence with your script or code.

Andy

0 Marek Belisko1 over 5 years ago in reply to Andy Liu (BMS)

Intellectual 440 points

Hi Andy,

well yes but I think I'm doing it right and according TRM manual. This was the last thing I plan to do if all attempts fails ;).

Marek

0 Igor Elremont over 5 years ago in reply to Marek Belisko1

Intellectual 845 points

Hi Marek!

Have noticed that you are sending unseal codes through different MAC() registers.

1 i2cset -f -y 0 0xb 0x00 0x14 0x04 s;i2cset -f -y 0 0xb 0x44 0x00 0x00 0x72 0x36 s;

While the first word 0x0414 is sent to [0x00] Word Read/Write command, the other 0x3672 sent to [0x44] Block Read/Write command.

Why not to use the same register for both unseal words?

Another point is that second word 0x3672 was sent in wrong format.

MAC[0x44] is Block read/write register so it should be provided with block_length byte as the first parameter according to SMBUS specification.

So correct way to unseal bq4050 is one of the following

using MAC[0x00]

1 i2cset -f -y 0 0xb 0x00 0x14 0x04 s; i2cset -f -y 0 0xb 0x00 0x72 0x36 s;

alternatively using MAC[0x44]

1 i2cset -f -y 0 0xb 0x44 0x02 0x14 0x04 s; i2cset -f -y 0 0xb 0x44 0x02 0x72 0x36 s;

Hope it helps!

Best regards!

0 Marek Belisko1 over 5 years ago in reply to Igor Elremont

Intellectual 440 points

Hi Igor,

thanks. You were right I overlooked wrong i2c command. I've tried also yours and have same results:

root@dev-:~# i2cset -f -y 0 0xb 0x44 0x02 0x14 0x04 s; i2cset -f -y 0 0xb 0x44 0x02 0x72 0x36 s
root@dev-:~# i2cset -f -y 0 0xb 0x44 0x2 0x54 0x00 s
root@dev-:~# i2cget -f -y 0 0xb 0x44 i 7
7: 0x06 0x54 0x00 0x87 0x03 0x00 0x00

and using MAC[0] I got write error when issue command.

Thanks and BR,

marek

0 Igor Elremont over 5 years ago in reply to Marek Belisko1

Intellectual 845 points

Try once again with PEC byte.

using MAC[0x00]

1 i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c s; i2cset -f -y 0 0xb 0x00 0x72 0x36 0x19 s;

using MAC[0x44] with byte-swap no PEC

1 i2cset -f -y 0 0xb 0x44 0x02 0x04 0x14 s; i2cset -f -y 0 0xb 0x44 0x02 0x36 0x72 s;

Also consider minimum 4s delay from last SMBUS activity before unseal sequence.

Best regards

0 Marek Belisko1 over 5 years ago in reply to Igor Elremont

Intellectual 440 points

Hi,

I've tried both methods and non of them is working:

root@dev-:~# i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c s
Error: Write failed
root@dev-:~# i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c s
Error: Write failed
root@dev-:~# i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c s
Error: Write failed
root@dev-:~# i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c s
Error: Write failed




root@dev-:~# i2cset -f -y 0 0xb 0x44 0x02 0x04 0x14 s; sleep 2; i2cset -f -y 0 0xb 0x44 0x02 0x36 0x72 s
# read operational status
root@dev-:~# i2cset -f -y 0 0xb 0x44 0x54 0x00 s
root@dev-:~# i2cget -f -y 0 0xb 0x44 i 7
7: 0x06 0x54 0x00 0x87 0x03 0x00 0x00
                        ^^^ still sealed
root@dev-:~# i2cset -f -y 0 0xb 0x44 0x2 0x54 0x00 s                                                                                                                                                                                        
root@dev-:~# i2cget -f -y 0 0xb 0x44 i 7
7: 0x06 0x54 0x00 0x87 0x03 0x00 0x00

Method with MAC(0) doesn't work at all (return Write error), while using MAC(0x44) looks like pass but if I'm reading operational status correctly then ENC[0],ENC[1] is still 1 1 which is sealed.

Thanks,

marek

0 Igor Elremont over 5 years ago in reply to Marek Belisko1

Intellectual 845 points

Could you upload your SREC?

To check which Unseal Key preprogrammed in device.

0 Marek Belisko1 over 5 years ago in reply to Igor Elremont

Intellectual 440 points

Hi,

Unseal Key was same I just use wrong i2c commands.

This is working combination:

i2cset -f -y 0 0xb 0x00 0x14 0x04 0x0c i
sleep 1
i2cset -f -y 0 0xb 0x00 0x72 0x36 0x19 i

Power management

Power management forum

BQ4050: unsealing gauge using i2ctool issue