Can not write word (A2168 chip)

[menjic]

If I for example read 0x17 I get 3 cycles, if I want to write this to be zero I think I need to write 00 00, but on next read I get 00 16, and what ever I try to do I van write just first byte. This is from GUI, when I click word to write word in upper window it sais for example 00 00 is data writen or sent and 2 bytes writen but when I read again it is always
xx 16

[laszlodaniel]

I can't reproduce the problem but have you tried changing the word byte-order?
What fuel gauge IC are you trying to communicate with?
Please paste the Communication textbox content here so I can see every step you take.

[menjic]

I am trying to write to A2168 which is pretty much copy of BQ20Zxx, it may be Arduino board or win10 or 7 other things I looked into your code in visual studio I can not see anything wrong, I will set breakpoint before write and send you that or suggest me where else would be more useful.

Yes I did try to reverse write and read it is strange like always 00 becomes what ever I want and 16 stays 16.

Last night I tried 0x18 battery capacity, there was value 08 98 which is translated as 2200 mAH, I sent 08 99 just for test and got back 08 16

Here is code:

`[INFO] Connecting to COM4

[<-TX] Handshake request (COM4)
3D 00 02 01 00 03

[INFO] Device is not responding at COM4

[INFO] Connecting to COM4

[<-TX] Handshake request (COM4)
3D 00 02 01 00 03

[RX->] Handshake response
3D 00 08 81 00 53 42 48 41 43 4B 35

[INFO] Handshake OK: SBHACK

[INFO] Device connected (COM4)

[RX->] Device settings
3D 00 0B 83 01 03 1C E8 08 16 00 00 00 00 B4

[INFO] Word byte-order: reverse read/write

[INFO] Design voltage: 7.4 V Design capacity: 2070 mAH

[INFO] Chip: 0x0000 Firmware ver 0.0`

second part:
`[INFO] Reg.: 17
Data: 16

[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 16 B8

[INFO] Reg.: 17
Data: 00 16

[<-TX] SMBus register dump request
3D 00 04 02 03 17 19 39

[RX->] SMBus register dump (17-19)
3D 00 0D 82 03 17 19 17 00 16 18 08 16 19 1C E8 42

[INFO] SMBus register dump details (17-19):
[17]: 00 16 // CycleCount: 22 Cycles
[18]: 08 16 // DesignCapacity: 2070 mAh
[19]: 1C E8 // DesignVoltage: 7400 mV`

Third part:
`[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 16 B8

[INFO] Reg.: 17
Data: 00 16

[<-TX] Write word data
3D 00 05 05 02 17 00 00 23

[RX->] Word data write response
3D 00 06 85 02 17 00 00 02 A6

[INFO] Reg.: 17
Data: 00 00
# of bytes written: 02

[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 16 B8

[INFO] Reg.: 17
Data: 00 16

[<-TX] SMBus register dump request
3D 00 04 02 03 17 19 39

[RX->] SMBus register dump (17-19)
3D 00 0D 82 03 17 19 17 00 16 18 08 16 19 1C E8 42

[INFO] SMBus register dump details (17-19):
[17]: 00 16 // CycleCount: 22 Cycles
[18]: 08 16 // DesignCapacity: 2070 mAh
[19]: 1C E8 // DesignVoltage: 7400 mV

[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 16 B8

[INFO] Reg.: 17
Data: 00 16

[<-TX] Write word data
3D 00 05 05 02 17 00 00 23

[RX->] Word data write response
3D 00 06 85 02 17 00 00 02 A6

[INFO] Reg.: 17
Data: 00 00
# of bytes written: 02

[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 16 B8

[INFO] Reg.: 17
Data: 00 16`

80% I am doing something wrong but don't see it, 19% it is something in hardware, 1% it is something in code but my problem is I don't know where to even start troubleshooting so I started here in hope someone would recognize the problem and help me. Thank you.

[laszlodaniel]

Oh I see what you want to do: you want to clear the cycle count. That won't work until you first unseal the battery controller. Now it's in sealed mode and you can't do anything that changes the memory. I'm not familiar with the unsealing this controller but it goes like writing the unseal key to the manufacturer access register. Look it up.

Edit: check out the Documentation folder too, there's a write up about resetting the controller which includes the unsealing procedure.

[menjic]

Well I did think about that, but how I am able to write one part and not other, If I understand protection if it is in seal state write is forbiden it is not half forbiden.

For example my cycle count was 2, now it is 22 I wrote that, my capacity was 2200 now it is 2070 ?

value of 0x18 was 08 98, I tried to write 08 99, now I read 0x18 and it is 08 16 so you see I can write first half of number is that how protection works ?

In documentation is stated if chip is in sealed state that it is read only that is what is strange to me how come I can write half of the word ?

[menjic]

You can see in log I am sending "xx yy" and it writes only "xx" part of word ?

[laszlodaniel]

Strange indeed. You should send the unseal key in two parts. There's a timeout in the controller that expects another message within seconds. You should be able to do it using the clipboard.

You can see in log I am sending "xx yy" and it writes only "xx" part of word ?

I see both bytes are written.
Are your referring to this line?
# of bytes written: 02
This is just a counter, 2 bytes for a word write and n-bytes for block write.

Proper sealed mode shouldn't behave like this. Perhaps there's some difference in your A2168 after all.

[menjic]

Yes but it is literaly using BQ firmware see this :

[INFO] SMBus register dump details (20-30):
[20]: 59 58 58 4D // ManufacturerName: YXXM
[21]: 30 36 31 33 38 34 // DeviceName: 061384
[22]: 4C 49 4F 4E // DeviceChemisty: LION
[23]: 42 34 31 // ManufacturerData: 42 34 31
[24]: FF FF // Reserved: 65535
[25]: FF FF // Reserved: 65535
[26]: FF FF // Reserved: 65535
[27]: FF FF // Reserved: 65535
[28]: FF FF // Reserved: 65535
[29]: FF FF // Reserved: 65535
[2A]: FF FF // Reserved: 65535
[2B]: FF FF // Reserved: 65535
[2C]: FF FF // Reserved: 65535
[2D]: FF FF // Reserved: 65535
[2E]: 00 00 // Reserved: 0
[2F]: 00 14 // OptionalMfgFunction5: HEX_0014 BIN_00000000_00010100 DEC_20 Or a 20-byte block. BQ20ZXX: Authenticate. Read 20-byte-block manually.
[30]: D4 0A // Reserved: 54282

[<-TX] SMBus register dump request
3D 00 04 02 03 30 40 79

[RX->] SMBus register dump (30-40)
3D 00 37 82 03 30 40 30 D4 0A 31 D4 0A 32 00 00 33 00 00 34 00 00 35 00 08 36 00 00 37 04 08 38
04 08 39 04 08 3A 04 08 3B 0B C5 3C 00 00 3D 00 00 3E 0B E4 3F 0A 79 40 FF FF 18

[INFO] SMBus register dump details (30-40):
--CAUTIOUS! Lookup datasheet for details of Ext Reg. Value 0x1717 maybe an error when reading reg. Read it individually and dump reg 0x16 to view error code--
[30]: D4 0A // Reserved: 54282
[31]: D4 0A // Reserved: 54282
[32]: 00 00 // Reserved: 0
[33]: 00 00 // Reserved: 0
[34]: 00 00 // Reserved: 0
[35]: 00 08 // Reserved: 8
[36]: 00 00 // Reserved: 0
[37]: 04 08 // Reserved: 1032
[38]: 04 08 // Reserved: 1032
[39]: 04 08 // Reserved: 1032
[3A]: 04 08 // Reserved: 1032
[3B]: 0B C5 // Reserved: 3013
[3C]: 00 00 // OptionalMfgFunction4 (VCell4 for BQ): 0 mV
[3D]: 00 00 // OptionalMfgFunction3 (VCell3 for BQ): 0 mV
[3E]: 0B E4 // OptionalMfgFunction2 (VCell2 for BQ): 3044 mV
[3F]: 0A 79 // OptionalMfgFunction1 (VCell1 for BQ): 2681 mV
[40]: FF FF // Ext_CMD: HEX_ffff BIN_11111111_11111111 DEC_65535 Or a 255-byte block.

[laszlodaniel]

I can't help you with this specific problem. This part of the code is a contribution from another member and is harder to understand than my original attempt at the BQ8050 Sanyo-firmware.

I only created an interface between computer and battery. Actual data transfer and behavior is different among controllers and is rarely discussed.

[menjic]

Ok I will continue to experiment when I have time and will report back my findings, but that could take some time, should I close this and make new one when I find something or leave it opet if someone else finds this and has something to say.

And other question, probably I have things to add to your c# program do you want to include them or how would I continue with this, I am interested in improving and extending this project do I fork and continue or send you requests when I have something useful or new to add ?
It would be shame for this to stop by my opinion, what do you think ?

[laszlodaniel]

Feel free to leave this issue open, no pressure.
Fork the repository, make your changes at your side, send a pull request to me later and I'll merge the changes.
Thanks for taking your time for improvements!

[menjic]

No thank you, you did all the work When and if I do close to your part than you can thank me :)

[youxiaojie]

wait ,wait,what is problem? is there some bug?

[youxiaojie]

I try to test with my bettery to confirm. the read write code is the same as before, I just touched the dump function.

[laszlodaniel]

It's cool, his fuel gauge IC is acting strange and now he's investigating.

[youxiaojie]

I have tested again , it is ok, 17 can be changed.

[INFO] Connecting to COM22

[<-TX] Handshake request (COM22)
3D 00 02 01 00 03

[RX->] Handshake response
3D 00 08 81 00 53 42 48 41 43 4B 35

[INFO] Handshake OK: SBHACK

[INFO] Device connected (COM22)

[RX->] Device settings
3D 00 0B 83 01 03 2B 5C 12 C0 08 24 01 33 4B

[INFO] Word byte-order: reverse read/write

[INFO] Design voltage: 11.1 V Design capacity: 4800 mAH

[INFO] Chip: BQ2084 Firmware ver 1.33

[<-TX] Scan SMBus
3D 00 02 02 02 06

[RX->] Scan SMBus address result
3D 00 03 82 02 0B 92

[INFO] SMBus device(s): 0B

[<-TX] SMBus register dump request
3D 00 04 02 03 00 FF 08

[RX->] Error: not enough MCU RAM
3D 00 03 8F FD FF 8E

[<-TX] SMBus register dump request
3D 00 04 02 03 00 3F 48

[RX->] SMBus register dump (00-3F)
3D 00 DA 82 03 00 3F 00 01 33 01 01 E0 02 00 0A 03 60 81 04 00 00 05 FF FF 06 FF FF 07 00 01 08 
0B D0 09 2D AD 0A 00 00 0B 00 00 0C 00 08 0D 00 64 0E 00 64 0F 12 C0 10 12 C0 11 FF FF 12 FF FF 
13 FF FF 14 03 20 15 31 38 16 40 E0 17 00 00 18 12 C0 19 2B 5C 1A 00 31 1B 35 50 1C 06 9B 1D 06 
9B 1E 06 9B 1F 06 9B 20 03 45 43 53 21 06 33 32 30 43 31 32 22 04 4C 49 4F 4E 23 0D 06 58 1B B8 
67 01 00 11 00 C8 00 63 2A 24 00 00 25 00 00 26 00 00 27 00 00 28 00 00 29 00 00 2A 00 00 2B 00 
00 2C 00 00 2D 00 00 2E 00 00 2F 06 90 30 06 90 31 06 90 32 06 90 33 06 90 34 06 90 35 06 90 36 
06 90 37 06 90 38 06 90 39 06 90 3A 06 90 3B 06 90 3C 00 00 3D 0F 0F 3E 0F 4A 3F 0F 55 B7

[INFO] SMBus register dump details (00-3F):
[00]: 01 33 // ManufacturerAccess: 01 33
[01]: 01 E0 // RemainingCapacityAlarm: 480 mAh
[02]: 00 0A // RemainingTimeAlarm: 10 minuets
[03]: 60 81 // BatteryMode: Report in mA or mAh (default). Disable ChargingVoltage and ChargingCurrent broadcasts to Charger. Disable AlarmWarning broadcasts to Host and Charger. Capacity Re-Learn Cycle Requested. Primary or Secondary Battery Not Supported. Internal Charge Control Disabled (default).
[04]: 00 00 // AtRate: 0 mAh
[05]: FF FF // AtRateTimeToFull: 65535 minuets
[06]: FF FF // AtRateTimeToEmpty: 65535 minuets
[07]: 00 01 // AtRateOK: True
[08]: 0B D0 // Temperature: 29.4 °C
[09]: 2D AD // Voltage: 11693 mV
[0A]: 00 00 // Current: 0 mA
[0B]: 00 00 // AverageCurrent: 0 mA
[0C]: 00 08 // MaxError: 8%
[0D]: 00 64 // RelativeStateOfCharge: 100%
[0E]: 00 64 // AbsoluteStateOfCharge: 100%
[0F]: 12 C0 // RemainingCapacity: 4800 mAh
[10]: 12 C0 // FullChargeCapacity: 4800 mAh
[11]: FF FF // RunTimeToEmpty: 65535 minuets
[12]: FF FF // AverageTimeToEmpty: 65535 minuets
[13]: FF FF // AverageTimeToFull: 65535 minuets
[14]: 03 20 // ChargingCurrent: 800 mA
[15]: 31 38 // ChargingVoltage: 12600 mV
[16]: 40 E0 // BatteryStatus: ALARMS: TERMINATE_CHARGE STATUS: INITIALIZED DISCHARGING FULLY_CHARGED 
[17]: 00 00 // CycleCount: 0 Cycles
[18]: 12 C0 // DesignCapacity: 4800 mAh
[19]: 2B 5C // DesignVoltage: 11100 mV
[1A]: 00 31 // SpecificationInfo: Smart Battery Spec 1.1 with PEC
[1B]: 35 50 // ManufactureDate: Y2006M10D16
[1C]: 06 9B // SerialNumber: 1691
[1D]: 06 9B // Reserved: 1691
[1E]: 06 9B // Reserved: 1691
[1F]: 06 9B // Reserved: 1691
[20]: 45 43 53 // ManufacturerName: ECS
[21]: 33 32 30 43 31 32 // DeviceName: 320C12
[22]: 4C 49 4F 4E // DeviceChemisty: LION
[23]: 06 58 1B B8 67 01 00 11 00 C8 00 63 2A // ManufacturerData: 06 58 1B B8 67 01 00 11 00 C8 00 63 2A
[24]: 00 00 // Reserved: 0
[25]: 00 00 // Reserved: 0
[26]: 00 00 // Reserved: 0
[27]: 00 00 // Reserved: 0
[28]: 00 00 // Reserved: 0
[29]: 00 00 // Reserved: 0
[2A]: 00 00 // Reserved: 0
[2B]: 00 00 // Reserved: 0
[2C]: 00 00 // Reserved: 0
[2D]: 00 00 // Reserved: 0
[2E]: 00 00 // Reserved: 0
[2F]: 06 90 // OptionalMfgFunction5: HEX_0690 BIN_00000110_10010000 DEC_1680 Or a 144-byte block. BQ208X: Pack Status and Pack Configuration: System present. V>EndDischargeVoltage2. Unsealed. Discharge cycle valid for an FCC update.AFE com OK. PF Flag clear. CellVoltage OK. 
[30]: 06 90 // Reserved: 1680
[31]: 06 90 // Reserved: 1680
[32]: 06 90 // Reserved: 1680
[33]: 06 90 // Reserved: 1680
[34]: 06 90 // Reserved: 1680
[35]: 06 90 // Reserved: 1680
[36]: 06 90 // Reserved: 1680
[37]: 06 90 // Reserved: 1680
[38]: 06 90 // Reserved: 1680
[39]: 06 90 // Reserved: 1680
[3A]: 06 90 // Reserved: 1680
[3B]: 06 90 // Reserved: 1680
[3C]: 00 00 // OptionalMfgFunction4 (VCell4 for BQ): 0 mV
[3D]: 0F 0F // OptionalMfgFunction3 (VCell3 for BQ): 3855 mV
[3E]: 0F 4A // OptionalMfgFunction2 (VCell2 for BQ): 3914 mV
[3F]: 0F 55 // OptionalMfgFunction1 (VCell1 for BQ): 3925 mV

[<-TX] Write word data
3D 00 05 05 02 17 00 01 24

[RX->] Word data write response
3D 00 06 85 02 17 00 01 02 A7

[INFO] Reg.: 17
       Data: 00 01
       # of bytes written: 02

[<-TX] Read word data
3D 00 03 04 02 17 20

[RX->] Word data received
3D 00 05 84 02 17 00 01 A3

[INFO] Reg.: 17
       Data: 00 01