search

stawel / cheali-charger

cheap lipo charger
824 stars 275 forks source link

Imax B6 with CMS32L051 status #340

Open diggit opened 1 year ago

diggit commented 1 year ago

This issue is tracking Imax B6 80W with CMS32L051 mcu, reverse engineering and possibly future support. Origin in #333

Progress

Basic info about charger:

Findings

Pinout

Number Name HW Fcn
1 P120 ANI14
2 P41
3 P40 SWDIO
4 RESETB
5 P124 XT2/EXCLKS
6 P123 XT1
7 P137 SWCLK1
8 P122 X2/EXCLK2
9 P121 X1
10 VSS
11 VDD
12 P136 INTP0/ANI36
13 P60 SCLA0
14 P61 SDAA0
15 P62 ANI27
16 P63 ANI28
17 P31 TI03/TO03/ANI22
18 P75 KR5/SCLK01/SCL01/ANI34
19 P74 KR4/SDI01/SDA01/ANI33
20 P73 KR3/SDO01//ANI32
21 P72 KR2//ANI31
22 P71 KR1/SDI21/SDA21/ANI30
23 P70 KR0/SCLK21/SCL21/ANI29
24 P30 INTP3/RTC1HZ/ANI21
25 P50 INTP1/ANI23
26 P51 INTP2//ANI24
27 P17 TI02/TO02/ANI20/EPWMO07
28 P16 TI01/TO01/ANI19/EPWMO06
29 P15 CLKBUZ1/ANI18/EPWMO05
30 P14 SDA20/ANI17/EPWMO04
31 P13 ANI16/EPWMO03
32 P12 SDO11/ANI13/EPWMO02
33 P11 SDI11/SDA11/ANI8/EPWMO01
34 P10 SCLK11/SCL11/ANI9/EPWMO00
35 P146 ANI15
36 P147 ANI12
37 P27 ANI7
38 P26 ANI6
39 P25 ANI5
40 P24 ANI4
41 P23 ANI3
42 P22 ANI2
43 P21 ANI1
44 P20 ANI0
45 P130 ANI35
46 P01 ANI10/TO00
47 P00 ANI11/TI00
48 P140
diggit commented 1 year ago

Hi @RadioControl, Charger arrived. I did quick check of HW and I am quite disappointed. Cell voltage measurement sucks, because there isn't single op amp for differential cell voltage measurement. Whole cell voltage measurement circuitry consists of dividers and direct connection to MCU with 12 bit ADC. Due to this fact, highest cell measurement has to be able to measure at least 26 V. Resolution is then 6 mV at best (26 / 4096 = 0.006).

I am more inclined to focus on #338 now, because for just a few more bucks, you can get better and smaller charger.

RadioControl commented 1 year ago

Hi @diggit ,

thank You for Your effort and toughts on that!...another B6 clone for a few €s more is on the way to me, but before i placed the order i asked what chip is in there, they answered Atmega32. We'll see...

RadioControl commented 1 year ago

Hi @diggit ,

did You found any calibration menu on it?... For me no button combination to get in a calibration menu, altough i found that the stock calibration is not that bad, at least with a 3s lipo in balance charging mode...

DSchndr commented 9 months ago

Hi, the hardware was already reverse engineered here here is its schematic

~As for flashing it, no idea, maybe someone with a JLink can get it to work since SWD seems to get disabled after boot My stlink does not want to work with it, even with hw reset it gets chipid 0~ Pinout for the connector on top is 5v gnd clk dio gnd p51 p50 Debugger access seems to work, use 3.3v for stlink clone

.\openocd.exe -f OpenOCD-20231002-0.12.0\share\openocd\scripts\interface\stlink-dap.cfg -c "transport select dapdirect_swd; adapter speed 100; swd newdap chip cppu -enable; dap create chip.dap -chain-position 0; target create chip.cpu cortex_m -dap chip.dap; init; dap info; "
Open On-Chip Debugger 0.12.0 (2023-10-02) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
libusb1 09e75e98b4d9ea7909e8837b7a3f00dda4589dc3
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Warn : Specify TAP 'chip.cppu' by name, not number 0
Info : STLINK V2J37S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 2.999260
Info : clock speed 100 kHz
Info : stlink_dap_op_connect(connect)
Info : SWD DPIDR 0x0bc11477
Info : [chip.cpu] Cortex-M0+ r0p1 processor detected
Info : [chip.cpu] target has 4 breakpoints, 2 watchpoints
Info : starting gdb server for chip.cpu on 3333
Info : Listening on port 3333 for gdb connections
AP # 0x0
                AP ID register 0x04770031
                Type is MEM-AP AHB3
MEM-AP BASE 0xe00ff003
                Valid ROM table present
                Component base address 0xe00ff000
                Peripheral ID 0x04000bb4c0
                Designer is 0x23b, ARM Ltd
                Part is 0x4c0, Cortex-M0+ ROM (ROM Table)
                Component class is 0x1, ROM table
                MEMTYPE system memory present on bus
        ROMTABLE[0x0] = 0xfff0f003
                Component base address 0xe000e000
                Peripheral ID 0x04000bb008
                Designer is 0x23b, ARM Ltd
                Part is 0x008, Cortex-M0 SCS (System Control Space)
                Component class is 0xe, Generic IP component
        ROMTABLE[0x4] = 0xfff02003
                Component base address 0xe0001000
                Peripheral ID 0x04000bb00a
                Designer is 0x23b, ARM Ltd
                Part is 0x00a, Cortex-M0 DWT (Data Watchpoint and Trace)
                Component class is 0xe, Generic IP component
        ROMTABLE[0x8] = 0xfff03003
                Component base address 0xe0002000
                Peripheral ID 0x04000bb00b
                Designer is 0x23b, ARM Ltd
                Part is 0x00b, Cortex-M0 BPU (Breakpoint Unit)
                Component class is 0xe, Generic IP component
        ROMTABLE[0xc] = 0x00000000
                End of ROM table

Even better, the firmware can be dumped with mdb 0x0 0xffff which (valid) results can be seen in the dump_flash.txt as for the stored variables, they are probably in the dump_data_flash.txt region

An SVD file for reverse engineering the code in ghidra is there too :) CMS32L051.txt

diggit commented 9 months ago

Sorry for lack of updates, but I am giving preference to other projects at this moment. Once I get back to cheali, I'll rather put my effort into #338, as this HW does not even have differential op amps for cell measurement, so it kinda sucks.

EDIT: typo fix

DSchndr commented 9 months ago

@RadioControl there is no calibration menu But there would be enough space to patch one in These are pretty much all menus image

DSchndr commented 9 months ago

@diggit how much accuracy do you want? For me at least the 6mv/step are fine considering the price... Analog mux is in the chip... so why an external one?

What is missing would be an adc linearity graph, to know how the adc measures across its voltage range. Someone with a programmable psu, some time and coding skills might do that.

As for writing code, an arm keil package exists from which the header files and HAL can be extracted. Flashing it works too over openocd, i've made some scripts for doing that: https://github.com/DSchndr/charge-me-up/

Btw: check the charge / discharge current of the device, on mine the current is halved which means that either someone forgot a *2 in the code or between developing and manufacturing it someone changed some components...

diggit commented 9 months ago

@DSchndr You have to subtract 2 ADC channels to get cell voltage so the worst case deviation is 12 mV. Probbly not that bad. external mux has no benefit, but diff amps do.

I am aware of HAL availability and everything. Feel free to work on porting cheali to this MCU.

Regarding wrong currents, did you calibrate your charger?

Barrel0Memes97 commented 7 months ago

Any update for this clone? (CMS32L051) Is it flashable with the current release?

agaletski commented 6 months ago

Buying china clones like this we never know what surprises will arrive this time. I haven't checked currently possible variants, just thought -who will spent time to design clone on different CPU while Atmega32 is so inexpensive. And now I'm one more disappointed owner of "Imax B6 80W" charger (B6-CMS V12 board, based on CMS32L051 cpu) Frankly, hardware is not bad and it looks like working but current software makes this device use inconvenient or even useless. The main function CHARGING works correctly (current and voltage are close to selected) but mAh counter become zeroed just after charge finished. In DISCHARGE mode there is surprise. Real discharge current is half of selected. When you set 0.1A current device will not discharge battery at all. Capacity counter in discharge mode counts correct values, it will show 200mAh after hour discharge on 0.4A discharge set on device (the real disch. current is about 0.2A). But the capacity counter become zeroed when discharge process ended.

Is any further progress making this device usable ? If no luck with porting software to CMS32L051, why not replacing this CPU with Atmega32 ? I just though if CPU replacing is possible solution?

Barrel0Memes97 commented 6 months ago

Is any further progress making this device usable ? If no luck with porting software to CMS32L051, why not replacing this CPU with Atmega32 ? I just though if CPU replacing is possible solution?

Replacing the CPU would be amazing if the shamanic supported it but I have no idea. Additionally this CPU seems to rarely have opamps integrated into the shamanic so its still less useful even with a CPU seap. Long-term I'll probably just buy a better charger instead of this but it would still be nice if cheap Chinese products like this were all identical.

greekuser commented 5 months ago

Hi there, i bought a b6 v3 charger from AliExpress without knowing anything about different versions of MCUs. So the title said Imax b6 but i received a Sevenchip b6 one with a CMS32L051. After searching i was disappointed to find out that i couldn't flash the cheali firmware. Anyway, i could return it but the charger is working, charging well, with a little deviation of 0.05-0.08mV lower. I can leave with that by adjusting the termination voltage just lower. But the main reason i bought the charger is for the storage function which i cant figure out how its working or if its working at all in this firmware. I know its all matter of code here. So when i choose storage mode(lipo,liion,lihv doesnt matter) with 0.3A, if the battery voltage is more than 3.65v, it starts to discharge with 100ma until 3.65v and then starts charging with 300ma untill full charge, not 3.85v. i have to say that i have only 1s batteries connected to main discharge port and not using any balance port. So either firmware is crappy or every function is supposed to work with the balance port connected and 1s charging/discharging/storage without balance lead is not implemented. Any hint on that? I will be perfectly happy with the charger if i solve the storage mode problem.

Omino870 commented 5 months ago

I have a trouble with charge/discharge current (uncorrect capacity counter too). For me discharge current meter resistor must to be 0,24Ohm, charge current meter resistor 0,047Ohm. Anybody have a simile problem ?

agaletski commented 5 months ago

I don't think the device has discharge|charge resistor issue but software is not tested and wrongly set discharge current. As I described in my earlier message, discharge current is only half in fact of value which you specify in setting. Capacity is measured according to real current (half of initialy set value) The worst thing is measurment become zeroed after process finished. You will not know needed values if not observe the end of process. Hardware is not bad in fact but software is completely shity. I hope some one find the way to compile alternative firmware for it.

Omino870 commented 5 months ago

In my device this two resistors was crosschanged. So you have 0,5R resistor in your device. If replace with 0,24R current will up to setted. I just ordered the new resistors, it need some days for delivery. Then i check real charge/discharge current to correspond with settings.

diggit commented 5 months ago

@agaletski @Omino870 @greekuser please stay on topic. This issue is here to track the progress on CMS32L052 support in cheali.

greekuser commented 5 months ago

@diggit Yes you are correct that it is off topic, however i would prefer that if you indeed know the answer to my question that you would first write it, and then of course write about not going off topic. Anyway, i wont make another post about it and in case anyone else seeking about the same as me, i decided to make a diy balance cable for my batteries. Well the voltage readings from the balance cable are EXACTLY as my multimeter and every function now works as it should. Storage mode finishes at 3.85v. So my Sevenchip CMS32L051 is spot on calibrated.