Compiler/BQ40Z80: BQ40Z80: Reset permanent failure status

James Mei

Part Number: BQ40Z80

Tool/software: TI C/C++ Compiler

Hi All

We are using BQ40Z80 as battery management. When a permanent failure is detected (18.50 0x52 PFAlert(), or 18.51 0x53 PFStatus() = 0x00000004, which is SOCC (Bit 2): Safety overcurrent in charge), the status read from the "Battery Management Studio" indicates the corresponding PF bits were set. After disconnected the charger and replaced the batteries, the following commands were sent via our firmware in smbus to clear the PF:

18.1.26 ManufacturerAccess() 0x0029 Permanent Fail Data Reset

18.1.25 ManufacturerAccess() 0x0028 Lifetime Data Reset

18.1.27 ManufacturerAccess() 0x002A Black Box Recorder Reset

18.1.36 ManufacturerAccess() 0x0041 Device Reset

The status read from the "Battery Management Studio" indicates the PF bits were cleared as expected, but PFAlert() and PFStatus() remains the same and did not clear reading from 18.50 0x52 PFAlert(), or 18.51 0x53 PFStatus().

Did we do something wrong or missing a few steps?

Thanks.

over 5 years ago

0 Damian Lewis over 5 years ago

TI__Mastermind 34775 points

Hello James,

Try the following sequence:

18.1.21 ManufacturerAccess() 0x0024 Permanent Failure => [PF_EN] = 0

18.1.26 ManufacturerAccess() 0x0029 Permanent Fail Data Reset

18.1.25 ManufacturerAccess() 0x0028 Lifetime Data Reset

18.1.27 ManufacturerAccess() 0x002A Black Box Recorder Reset

18.1.36 ManufacturerAccess() 0x0041 Device Reset

18.1.21 ManufacturerAccess() 0x0024 Permanent Failure => [PF_EN] = 1

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

Thanks for the help. We found out the problem with the ManufactureAccess seal code not in the right order.

After reading via the logic analyzer, we found out that when we tried to unlock the access level, we had a NAK, both the seal access keys were in the wrong order and CRC8 bytes were wrong.

Fixing that, the Permanent fail flags clearing works now.

However, we have difficulty setting a different access code, even we are following the example:

Data = MAC command + New UNSEAL key + New FULL ACCESS KEY
= 35 00 34 12 78 56 FF FF FF FF

Once its set, and reset the chip, it still uses the default code.

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

Hello James,

Thanks for letting us know.

Here's how to change the Seal Key

Setup Write to [0x16] + ACK

0x44 + ACK

0x0A + ACK

0x35 + ACK

0x00 + ACK

0x34 + ACK

0x12 + ACK

0x78 + ACK

0x56 + ACK

0xFF + ACK

0x6C + ACK

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

Hi Damian

That is exactly how I wrote the key after the chip is enabled full access. After the successful write, the chip was reset.

When it prompts for the unseal code, non of the combination works,

12 34 56 78,

34 12 78 56,

78 56 34 12,

56 78 12 34

Best Regards,

James

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

Hi James,

Did you read block 0x44 after writing to ensure the keys were written as intended before sealing and resetting the gauge?

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

Hi Damian

May I know how to read the block in address 0x0035? The read Block command does not take parameters.

Also, it reports successful write even the chip is sealed.

Regards,

James

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

Hi James,

Did you include the number of bytes to be written? 10 byte (0x0A). Here's the read. Note from 0x0A and onwards is the data sent by the gauge.

Setup Write to [0x16] + ACK

0x44 + ACK

Setup Read to [0x17] + ACK

0x0A + ACK

0x35 + ACK

0x00 + ACK

0x34 + ACK

0x12 + ACK

0x78 + ACK

0x56 + ACK

0xFF + ACK

0xE4 + NAK

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

I was using Battery Management Studio to write the access code, it will automatically prepend the size.

If the following data is written to 0x44, "35 00 14 04 72 36 FF FF FF FF", then I can use the default access code.

Note that. I can write 0x44, "35 00 14 04 72 36 FF FF FF FF" even when the chip is sealed. Does that mean the access code can be overwritten?

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

Was the gauge already sealed before you decided to change the seal key? If so that might be your issue. The keys need to be set before sealing the gauge. No you can't overwrite the seal key once the gauge is sealed. Hence the importance to read back before resetting gauge.

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

Yes, the gauge was sealed when I put a new seal key. That was how I default back the gauge to regain access.

Can I read back via Battery Management Studio? The read block command on the Battery Management Studio does not take parameters for the address and size to read.

Regards,

James

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

0 Damian Lewis over 5 years ago in reply to Damian Lewis

TI__Mastermind 34775 points

Note that my gauge has not been sealed. If you want to start over unseal gauge with full access export your gg.csv file, reprogram gauge with unsealed srec then import chemistry then import your gg.csv file.

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

As you can see the screen capture, I can write the 0x44, cmd 0x0035, but when I read it back, I cannot specify any parameter to point the result to 0x0035 and size.

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

I can't see your screen shot unless you attach it. Pasting doesn't show it in your post. As you can see I don't specify it either on the read because it was already set by the previous write block and based on the command the FW already knows it's 8 bytes to return.

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

As shown below, after writing the access code, the read command did not read back the same address.

0 Damian Lewis over 5 years ago in reply to James Mei

TI__Mastermind 34775 points

James,

As I mentioned before, since your gauge has been sealed before, this command to write or read the security is no longer available to you. I explained how to get a fresh start. Even if the write block communication shows successful, the FW would not allow the keys to be overwritten because the gauge was sealed prior. Likewise it would not give you access to read the keys for the same reason.

See table 18-1 on page 104 of the TRM for commands accessibility https://www.ti.com/lit/ug/sluubt5b/sluubt5b.pdf

Please follow my instructions for fresh start and close this post thread

0 James Mei over 5 years ago in reply to Damian Lewis

Prodigy 110 points

Thanks for the help. That resolves the issue.

Power management

Power management forum

Compiler/BQ40Z80: BQ40Z80: Reset permanent failure status