Thread Tools
Jul 09, 2010, 09:48 AM
Registered User
Hi, I just bought an Imax B6 (not genuine, from ebay), and I havenīt the menu 1, but menu 2 exists.

Iīm verifying that measure arenīt very good, or I donīt know if they are normal.

I balance a 2200mah or 900mah 3s battery and stop at 12.60V and 4.20 for each cell. If I measure with voltimeter I get a perfect balance, but they are about 4.16-4.17 and total voltage is 12.50-12.52.

can i expect more precision of this charger, or itīs ok?

I have an old skyrc that have exactly the same measures (to get 4.20 on each cell, I must select 4.25 to charge and leave cells at 4.20-4.21), about 0.04 from indicated.

thanks
Sign up now
to remove ads between posts
Jul 10, 2010, 12:06 AM
Crashing on a budget.
dusk's Avatar
Thread OP
Quote:
Originally Posted by walko
If I measure with voltimeter I get a perfect balance, but they are about 4.16-4.17 and total voltage is 12.50-12.52.

can i expect more precision of this charger, or itīs ok?
The difference in charge levels between 4.17V and 4.20V is minimal. Only a few percent. In fact, some chargers actually charge to this slightly lower level, to extend the life of the battery.

If you are getting good balance results, then I would say that you should leave it as is. For all you know, it could be your multimeter that is out by 0.03V.
Jul 10, 2010, 04:08 PM
Registered User
Thanks for answer, Dusk
Jul 10, 2010, 06:32 PM
Registered User
Hi, one more question: MENU #2 (TOTAL VOLTAGE) can only be used once, or it can be used every time that we want...

thanks.
Jul 10, 2010, 07:47 PM
Crashing on a budget.
dusk's Avatar
Thread OP
Quote:
Originally Posted by walko
Hi, one more question: MENU #2 (TOTAL VOLTAGE) can only be used once, or it can be used every time that we want...

thanks.
On the model I have, you can use it as many times as you want.
Aug 28, 2010, 04:57 PM
Registered User
I registered just to get in on this!! lol.. I just bought a Imax B6 and from the start I was getting voltage input errors! I opened up the case and this is what I saw!! I have menu 1 & 2.

Wonder why??



Last edited by Imax6ShouldBFree; Aug 28, 2010 at 05:03 PM.
Aug 30, 2010, 01:15 PM
Registered User
The shorts are no problem, these pins and components are connected to eachother anyway on the board.

Ben.
Nov 05, 2010, 10:18 AM
Registered User
I have the Imax b6. I was lucky. I have not used the service menu 1. I tried to read the firmware and I did it! I think I can remove the restriction on single Using the service menu 1.
Last edited by tolyan23; Nov 07, 2010 at 08:25 AM.
Nov 05, 2010, 11:41 PM
Registered User
Sorry? You want someone to pay you $40 for the "revised" firmware?

I don't quite understand what it is exactly you want.

chewy
Nov 06, 2010, 02:44 AM
sp5
sp5
Registered User
Quote:
Originally Posted by tolyan23
I have the Imax b6. I was lucky. I have not used the service menu 1. I tried to read the firmware and I did it! I do not like middleman, but do not want to miss a chance. I want the firmware for $ 40 and I'll put it into the public (this forum). I understand that if I tried to sell it piecemeal it sooner or later would have happened. I also want to upgrade your Imax B6 and I need the resistors. I would be happy to get $30 +resistor kit. For one person it is a pretty big number, but I do not mind if 4-6 people to chip. I think I can remove the restriction on single Using the service menu 1. And add this modernized firmware as a bonus. Say what?
First, if you want to impress your potential customers...you may want to improve your presentation.

Second, I have the firmware. It sounds like they aren't protecting the firmware any more. I was waiting for confirmation that I wasn't alone in obtaining access to the firmware.

I see no reason why someone should pay you.
Nov 06, 2010, 02:54 AM
sp5
sp5
Registered User
I'll one up you, tolyan23. I've completely reverse engineered the firmware. Here's what you need to "undo" the calibration (menu 1, the one-shot menu):

You need a copy of the firmware. You need an ISP adapter. (Hint: that link is for the "official" one. There are many that are cheaper.)

WARNING: This process will reflash your charger. This information is provided without any warranty, express or implied. When you brick your device, your only recourse is the ISP adapter.

Here's what I did:
  1. Download the current contents of flash and eeprom. The flash image will be larger. Open the flash contents in a hex editor. Look for english messages inside. Open the eeprom contents in a hex editor. Look for lots of FF's but a few values that are not.
  2. Carefully write down your existing calibration values. These are stored in the eeprom, at the following addresses:

    0x390: .word 0x1377
    0x392: .word 0x2644
    0x394: .word 0x1366
    0x396: .word 0x1338
    0x398: .word 0x1344
    0x39A: .word 0x12FB

    (Technically, they are stored big-endian while the entire system is little-endian. It's a bug.)
  3. Erase your flash and eeprom. Yup, you just bricked your device.
  4. Write a new flash image. If you write nothing to the eeprom, the device returns to its "factory" state, and you can recalibrate everything.
  5. Generate a new eeprom image with the values at 0x390 - 0x39B reset to 0xFF. (An empty eeprom is filled with 0xFF.) If you leave everything else in the eeprom untouched, you have successfully undone menu 1 calibration.
Nov 06, 2010, 02:58 AM
sp5
sp5
Registered User
If you don't want to purchase an ISP Adapter and trace the pins on your charger to its ISP header, locate someone you know who is into Arduinos, AVRs, Microcontrollers, etc. You may have luck asking around at an Amateur Radio gathering -- or even a fly-in.
Nov 06, 2010, 03:51 AM
Registered User
Quote:
I'll one up you, tolyan23. I've completely reverse engineered the firmware. Here's what you need to "undo" the calibration (menu 1, the one-shot menu)
It's good to know someone did it finally.

Quote:
You need a copy of the firmware. You need an ISP adapter. (Hint: that link is for the "official" one. There are many that are cheaper.)
If I understood you correctly every ISP programmer should work. Now I'm, using USBAsp for programming my Turnigy 9x radio. Is it possible to see photo of your ISP header connections? What type of AVR is used in this charger? I'd like to buy IMAX B6 if I'll have possibility to tweak it.

Quote:
WARNING: This process will reflash your charger. This information is provided without any warranty, express or implied. When you brick your device, your only recourse is the ISP adapter.
Most important is not to accidentally change fuse bits.

Quote:
Here's what I did:
  1. Download the current contents of flash and eeprom. The flash image will be larger. Open the flash contents in a hex editor. Look for english messages inside. Open the eeprom contents in a hex editor. Look for lots of FF's but a few values that are not.
  2. Carefully write down your existing calibration values. These are stored in the eeprom, at the following addresses:

    0x390: .word 0x1377
    0x392: .word 0x2644
    0x394: .word 0x1366
    0x396: .word 0x1338
    0x398: .word 0x1344
    0x39A: .word 0x12FB

    (Technically, they are stored big-endian while the entire system is little-endian. It's a bug.)
  3. Erase your flash and eeprom. Yup, you just bricked your device.
  4. Write a new flash image. If you write nothing to the eeprom, the device returns to its "factory" state, and you can recalibrate everything.
  5. Generate a new eeprom image with the values at 0x390 - 0x39B reset to 0xFF. (An empty eeprom is filled with 0xFF.) If you leave everything else in the eeprom untouched, you have successfully undone menu 1 calibration.
It looks like after writing flash eeprom is erased. So what is the reason of generating new eeprom and writing it to the device? Does it lose any other settings?

P.S. Are we speaking about this particular charger?
Nov 06, 2010, 07:52 AM
Registered User
Quote:
Originally Posted by sp5
I have the firmware.
What you wait? Upload firmware in forum. I thought it there is only beside me.

Quote:
Originally Posted by darzur
It looks like after writing flash eeprom is erased. So what is the reason of generating new eeprom and writing it to the device? Does it lose any other settings?
This not quite faithfully EEPROM erase together with flash command "erase chip" does not exist way to wipe flash without EEPROM. Before write flash, flash mast be erased.
Last edited by tolyan23; Nov 06, 2010 at 11:04 AM.
Nov 06, 2010, 12:12 PM
sp5
sp5
Registered User
Quote:
Originally Posted by darzur
If I understood you correctly every ISP programmer should work. Now I'm, using USBAsp for programming my Turnigy 9x radio. Is it possible to see photo of your ISP header connections? What type of AVR is used in this charger? I'd like to buy IMAX B6 if I'll have possibility to tweak it.
I'd get an iCharger. They publish the firmware, so I'm thinking it will be my next purchase. A USBAsp will work fine.

If you do get an imax charger, you'll have calibration problems. (The reason for this whole thread.) That's not just the B6, that's a lot of their chargers.

Quote:
Originally Posted by darzur
Most important is not to accidentally change fuse bits.
Yeah -- you have an ISP, so you know the danger:

If the fuse bits are set wrong, the chip can become nearly impossible to update (because of incorrect clock settings).

Quote:
Originally Posted by darzur
It looks like after writing flash eeprom is erased. So what is the reason of generating new eeprom and writing it to the device? Does it lose any other settings?
Yes, other settings you will want to preserve include the menu 2 calibration values and basically anything else the charger saves to eeprom. By downloading the eeprom before flashing, you have a backup. Like you say, when you write the flash, the eeprom will be erased.

Quote:
P.S. Are we speaking about this particular charger?
Yes, that's the one I have. However, there is no guarantee that the board layout is the same, even on the same model, so I'm not going to post a diagram saying "hook this pin up here." (probably leads to all kinds of trouble)

Instead, I can help you trace the pins if you have a photo of your board somewhere.

Edit: I missed one question in there. The chip markings are: ATMega32 16AU.
Nov 06, 2010, 12:16 PM
sp5
sp5
Registered User
Quote:
Originally Posted by tolyan23
What you wait? Upload firmware in forum. I thought it there is only beside me.
I agree. Are more people able to download their firmware from their charger? If so, I don't need to upload it.

I want to know what people find set in their lock bits, so I'm not going to post binary images yet.
Nov 06, 2010, 07:49 PM
Registered User
I can remove the restriction on single Using the service menu 1. It means, if you reprogram your ImaxB6 you can used menu 1, many times. It interesting somebody?
P.S. Sorry of my English
Nov 07, 2010, 01:40 AM
Registered User
Quote:
Originally Posted by sp5
If you do get an imax charger, you'll have calibration problems. (The reason for this whole thread.) That's not just the B6, that's a lot of their chargers.
Yes, I know. But it's extremely cheap and after a bit of tweaking it seems like a good charger. Resistor tweak is very simple, and with access to calibration menu it can be perfectly calibrated so why bother?

Quote:
Yes, that's the one I have. However, there is no guarantee that the board layout is the same, even on the same model, so I'm not going to post a diagram saying "hook this pin up here." (probably leads to all kinds of trouble)
Instead, I can help you trace the pins if you have a photo of your board somewhere. I missed one question in there. The chip markings are: ATMega32 16AU.
Then connection are identical to other ATMegas: RST, SCK, MISO, MOSI, VCC and GND. The only problem is to find appropriate solder pads on the board.
Nov 07, 2010, 07:39 AM
Registered User
My charge contains 6pin place for connection programmer. Location conclusion commencing from square place SCK MISO MOSI RESET GND V+. This corresponds to pin Mega32 numbered as 3, 2, 1, 4, 6, 5.
Nov 07, 2010, 12:05 PM
Registered User
http://s016.radikal.ru/i334/1011/49/bd97e3bd1477.jpg
This is my board. Square pin mark white. LCD temporarily unsolder.
Nov 08, 2010, 11:11 AM
sp5
sp5
Registered User
Quote:
Originally Posted by tolyan23 View Post
I can remove the restriction on single Using the service menu 1. It means, if you reprogram your ImaxB6 you can used menu 1, many times. It interesting somebody?
P.S. Sorry of my English
If you want to remove the restriction on menu 1, change the 2 bytes at address 0x574A (in the flash). The instruction there jumps past the calibration code when the current calibrated value is within acceptable bounds. Replace it with a "nop" instruction to force the menu 1 calibration no matter what the previous calibration was.

IMHO this is a lot harder (and it "breaks" your charger in a sense -- you are then provably out of warranty) -- better to tweak the eeprom values. You can examine them after calibration if you're curious.
Nov 08, 2010, 11:12 AM
sp5
sp5
Registered User
Quote:
Originally Posted by tolyan23 View Post
http://s016.radikal.ru/i334/1011/49/bd97e3bd1477.jpg
This is my board. Square pin mark white. LCD temporarily unsolder.
Sorry, that page reports server errors for me. Can you post somewhere else?
Nov 08, 2010, 12:38 PM
Registered User
Quote:
Originally Posted by sp5 View Post
IMHO this is a lot harder (and it "breaks" your charger in a sense -- you are then provably out of warranty)

I do not know how much is not known is the company Imax, but I think I have a copy of the device. Firmware is not locked, the calibration is not carried out, I buy it DX, what warranty is there?
Last edited by tolyan23; Nov 08, 2010 at 01:00 PM.
Nov 17, 2010, 11:31 AM
sp5
sp5
Registered User
Quote:
Originally Posted by darzur View Post
It's good to know someone did it finally.

If I understood you correctly every ISP programmer should work. Now I'm, using USBAsp for programming my Turnigy 9x radio. Is it possible to see photo of your ISP header connections? What type of AVR is used in this charger? I'd like to buy IMAX B6 if I'll have possibility to tweak it.

...

P.S. Are we speaking about this particular charger?
I'm just curious if it worked out for you. Did you try connecting to the ISP header? Are your fuse bits unlocked?
Dec 05, 2010, 05:50 AM
Crashing on a budget.
dusk's Avatar
Thread OP

Firmware tests


Quote:
Originally Posted by sp5
I'm just curious if it worked out for you. Did you try connecting to the ISP header? Are your fuse bits unlocked?
I went through the process of re-flashing my firmware with the one available from the batch of unlocked iMax chargers sold on DealExtreme.

The ISP connections on the header were as noted: "SCK MISO MOSI RESET GND V+".

My original fuses were all locked/protected.

After initial re-flashing, the charger worked fine, but the calibration menu was still not available.

I then re-flashed it with the EEPROM cleared to all FF. This re-enabled the calibration menu.

I then set addresses 0x574A and 0x574B in the flash image to 00 (NOP) and flashed the modified firmware.

Bingo, the calibration menu does not disappear anymore.

Thanks guys.
Dec 06, 2010, 01:36 PM
sp5
sp5
Registered User
Quote:
Originally Posted by dusk View Post
I went through the process of re-flashing my firmware with the one available from the batch of unlocked iMax chargers sold on DealExtreme.

The ISP connections on the header were as noted: "SCK MISO MOSI RESET GND V+".

My original fuses were all locked/protected.

After initial re-flashing, the charger worked fine, but the calibration menu was still not available.

I then re-flashed it with the EEPROM cleared to all FF. This re-enabled the calibration menu.

I then set addresses 0x574A and 0x574B in the flash image to 00 (NOP) and flashed the modified firmware.

Bingo, the calibration menu does not disappear anymore.

Thanks guys.
Awesome!
Dec 17, 2010, 10:57 AM
Registered User
nysom's Avatar
Quote:
Originally Posted by dusk View Post
I went through the process of re-flashing my firmware with the one available from the batch of unlocked iMax chargers sold on DealExtreme.

The ISP connections on the header were as noted: "SCK MISO MOSI RESET GND V+".

My original fuses were all locked/protected.

After initial re-flashing, the charger worked fine, but the calibration menu was still not available.

I then re-flashed it with the EEPROM cleared to all FF. This re-enabled the calibration menu.

I then set addresses 0x574A and 0x574B in the flash image to 00 (NOP) and flashed the modified firmware.

Bingo, the calibration menu does not disappear anymore.

Thanks guys.
Hey dusk, where did you get the code to reflash if the chip was locked and could not be dumped?
Dec 17, 2010, 07:25 PM
sp5
sp5
Registered User
Hi nysom,

You've got the charger - do you have the in-system programmer (ISP)? Some people use an ISP to upgrade the firmware on their turnigy radios, so you might have one from there.

If you don't have one, do you know someone who has one?

(I'm only asking because if you don't, you can't modify your firmware...)
Dec 17, 2010, 09:16 PM
Crashing on a budget.
dusk's Avatar
Thread OP
Quote:
Originally Posted by nysom View Post
Hey dusk, where did you get the code to reflash if the chip was locked and could not be dumped?
I received it from one of the forum members (who expressed his wish not to be named). I believe that he managed to download it from an unlocked iMax B6 charger.

So as to avoid any copyright implications, I would rather not upload it here.
Dec 18, 2010, 06:16 PM
Registered User
nysom's Avatar
Quote:
Originally Posted by sp5 View Post
Hi nysom,

You've got the charger - do you have the in-system programmer (ISP)? Some people use an ISP to upgrade the firmware on their turnigy radios, so you might have one from there.

If you don't have one, do you know someone who has one?

(I'm only asking because if you don't, you can't modify your firmware...)
Hi sp5, I have a mystery b6 and there is no isp on the board. I was going to build a small header and solder direct to pins 1 to 6 on the atmel. I have a USBasp on order. I'm not sure if the chip is locked or not. I do not have the the 1 cal menu so it must of been used at the factory.
Dec 18, 2010, 06:17 PM
Registered User
nysom's Avatar
Quote:
Originally Posted by dusk View Post
I received it from one of the forum members (who expressed his wish not to be named). I believe that he managed to download it from an unlocked iMax B6 charger.

So as to avoid any copyright implications, I would rather not upload it here.
Hi dusk, I noticed you said you had an unlocked B6 after I had posted but was to lazy to edit my post. I guess if mine is locked I could beg someone to pm me a copy.
Dec 18, 2010, 06:42 PM
sp5
sp5
Registered User
Quote:
Originally Posted by nysom View Post
Hi sp5, I have a mystery b6 and there is no isp on the board. I was going to build a small header and solder direct to pins 1 to 6 on the atmel. I have a USBasp on order. I'm not sure if the chip is locked or not. I do not have the the 1 cal menu so it must of been used at the factory.
I'm betting that you do actually have ISP holes on the board (but no header soldered into them).

Can you post a pic of the circuit board? I'd be happy to help you identify the ISP "points".
Dec 18, 2010, 07:07 PM
Registered User
nysom's Avatar
Quote:
Originally Posted by sp5 View Post
I'm betting that you do actually have ISP holes on the board (but no header soldered into them).

Can you post a pic of the circuit board? I'd be happy to help you identify the ISP "points".
I have a photo from some one else here and I'll try to attach it The mystery charger has resistors for cell 1 & 2 balance in the spot where the SPI header was. Also, I don’t think pins 4 to 6 on the atmel are even connected.
Dec 19, 2010, 02:29 PM
sp5
sp5
Registered User
Quote:
Originally Posted by nysom View Post
I have a photo from some one else here and I'll try to attach it The mystery charger has resistors for cell 1 & 2 balance in the spot where the SPI header was. Also, I don’t think pins 4 to 6 on the atmel are even connected.
The pins you need to connect to are pins 1-3 (MOSI, MISO, SCK), pin 4 (negative-asserted reset), GND and 5V.

Pins 1-3 are clearly routed to the analog mux near the edge of the board. Personally, I'd solder to them there.

Pin 4 appears to be left floating, so there's no other way except to solder directly to the chip.

I suggest using a voltmeter to trace the 5V VCC and GND sources supplying the chip -- GND is probably the whole back plane of the board, and there are some easy places to solder a connection for 5V.

If after all that work, you find that the lock bits prevent downloading the firmware, you are faced with a bad dilemma: does the firmware from a completely different charger work on yours? I'd guess it has a 50/50 chance of working.
Dec 19, 2010, 10:39 PM
Registered User
nysom's Avatar
Yea, hope the lock bits where not set on this. I could just calibrate the cell balance resistors if the ic is locked. Guess that would be better then not working at all but I bet it is an exact copy of the imax firmware. Have to wait till the USBasp arrives sometime after Christmas.
Dec 27, 2010, 12:54 PM
Registered User
Hello dusk

Please could you send me a copy of the software, my email is [email protected]
Thank you very much
Dec 29, 2010, 04:11 AM
hacker
I soldered part of an old 80 pin IDE cable to pins 1-6 on the ATMEGA32L 8AU chip directly, and ran the wires out to a prototyping board. Those ribbon cables have almost the right spacing, and so this was really easy (especially compared to removing the screen above it :P). I powered Vcc-GND (pins 5-6) from an external 5V source, and then just wired the rest and GND to a parallel port to make a DAPA connection, with no other parts. avrdude and uisp both report that they are unhappy with the chip signature (reads as 0xffffff), but I can read and write the flash and eeprom without issue (with avrdude -c dapa -p m32 -F -U flash:rrig.rom:r).

Original ROM in my case has md5sum 8be620dd730e5b964991209edba07dd3 and EEPROM bytes:

0x390: .word 0x1371
0x392: .word 0x262e
0x394: .word 0x1355
0x396: .word 0x133e
0x398: .word 0x133e
0x39A: .word 0x137d

Flash offset 0x574a and 0x574b were 0x5f 0xc0; setting them to 0x0000 enabled the Stop+Inc service menu 1. Note that flashing also clears the eeprom, so I had to restore that again to get back my usual settings.

So, this is pretty easy if you have a parallel port and wires, at least for the Mystery Charger variant! Thanks for your work, sp5!
Dec 29, 2010, 12:21 PM
sp5
sp5
Registered User
Quote:
Originally Posted by simonk
I soldered part of an old 80 pin IDE cable to pins 1-6 on the ATMEGA32L 8AU chip directly, and ran the wires out to a prototyping board. Those ribbon cables have almost the right spacing, and so this was really easy (especially compared to removing the screen above it :P). I powered Vcc-GND (pins 5-6) from an external 5V source, and then just wired the rest and GND to a parallel port to make a DAPA connection, with no other parts. avrdude and uisp both report that they are unhappy with the chip signature (reads as 0xffffff), but I can read and write the flash and eeprom without issue (with avrdude -c dapa -p m32 -F -U flash:rrig.rom:r).

Original ROM in my case has md5sum 8be620dd730e5b964991209edba07dd3 and EEPROM bytes:

0x390: .word 0x1371
0x392: .word 0x262e
0x394: .word 0x1355
0x396: .word 0x133e
0x398: .word 0x133e
0x39A: .word 0x137d

Flash offset 0x574a and 0x574b were 0x5f 0xc0; setting them to 0x0000 enabled the Stop+Inc service menu 1. Note that flashing also clears the eeprom, so I had to restore that again to get back my usual settings.

So, this is pretty easy if you have a parallel port and wires, at least for the Mystery Charger variant! Thanks for your work, sp5!
That's great news! I am really glad your chip was unlocked.

I am almost 100% sure your flash and mine are the same in all places except the startup text - you know, it says the manufacturer and model. Cloners don't want to show their sources! Hey, pm me please! I'd really like to take a look at your flash image.
Dec 30, 2010, 02:21 PM
hacker
Sent you a PM re the flash image. What software were you using for disassembly? In Linux, avra seems to do assembly only.

I built a resistor bank of 6 100-Ohm metal film resistors, binned manually to within .1%, wired each fake cell to the balance connector and the main battery connector, and hooked it up to 25.2V. The Stop+Inc menu actually has quite a few steps, where it starts automatically, then shows all cell voltages converging to 4.2V, then goes through some test where it reports OK for each cell, with some final number. No button seems to exit at this point, but the values seem to be saved, and my charger is now perfectly charging to 4.2V on every cell.

I had to replace a few resistors previously, since the total voltage was so far off that +20 was not a large enough correction, but now it's finally balanced as well! Yay!
Jan 02, 2011, 03:58 PM
throw new IOPilotException();
IceWind's Avatar
Hi,

Does the resistors upgrade make the total A's usage of the charger correct?
Because this is what I see with mine.

When trying to charge a 2200mah 3S pack I proceed as so:

Set:
2.2A -> 11.1v

When I start it starts to ramp up the amps up to 3.0A ( it would probably go much higher but my power supply cuts and shuts down at this amps)
I have other chargers and none does that, If I set 2.2A they go up to 2.2A max and never above.

Can this happen on the Imax B6 due to the improper cell readings?
I already did the voltage check using menu 2 and it's ok.
Thanks.
Jan 02, 2011, 06:18 PM
Crashing on a budget.
dusk's Avatar
Thread OP
Quote:
Originally Posted by IceWind
When trying to charge a 2200mah 3S pack I proceed as so:

Set:
2.2A -> 11.1v

When I start it starts to ramp up the amps up to 3.0A ( it would probably go much higher but my power supply cuts and shuts down at this amps)
I have other chargers and none does that, If I set 2.2A they go up to 2.2A max and never above.
I've never had mine do that. During the constant current stage it should stay at whatever you have set it. The only time I have seen mine do something similar, is when I have it set to charge Nicad batteries.
Jan 02, 2011, 07:44 PM
throw new IOPilotException();
IceWind's Avatar
I knew this wasn't good.
I have now set to charge at <1.0A and it seems to hold.

I'll try to change the resistors and if someone releases a new firmware I'll try and flash it.
It just can't get any worse.
Jan 04, 2011, 12:12 PM
Registered User
Hello

Could someone please send me a copy of the software unlocked?
My email is [email protected]

Thank you very much
Jan 05, 2011, 02:04 AM
Registered User
Quote:
Originally Posted by benavide
Hello

Could someone please send me a copy of the software unlocked?
My email is [email protected]

Thank you very much
I would be very happy to get a copy too, please

[email protected]

chewy
Jan 05, 2011, 02:04 PM
sp5
sp5
Registered User
chewytm, benavide,

That is against copyright laws. The iCharger is a good charger to purchase if you would like to be able to download firmware updates.

Sorry!
Jan 06, 2011, 06:29 AM
Registered User
Hello

I have a charger original Imax, which already have this software, I was wrong calibration and now charge to 4.13 4.06 4.17 4.20 4.19 4.15 send the charger to be repaired, but the shipping charges are greater than the price of the charger. Since I have already paid for the software when I buy the charger does not think it's anything bad that someone would send me if possible.

Thank you very much.
Jan 06, 2011, 09:03 AM
Crashing on a budget.
dusk's Avatar
Thread OP
I think that I saw a torrent of it floating around the net.
Jan 06, 2011, 09:25 AM
Registered User
My Imax is just sitting around to charge NiMH and Pb batts now. I do not trust it to charge my lipos. Btw, I have an iCharger 106B+ also which is my main charger. They send out updates for their firmwares.

So, no big deal if you won't send it. The Imax will continue doing its limited duties.

chewy
Jan 06, 2011, 10:45 AM
sp5
sp5
Registered User
If someone wrote a new firmware from scratch that functioned exactly the same -- that would be ideal.
Jan 06, 2011, 12:07 PM
Registered User
Quote:
Originally Posted by dusk
I think that I saw a torrent of it floating around the net.
Hello

I can not find anything, what name search?
Jan 06, 2011, 12:16 PM
throw new IOPilotException();
IceWind's Avatar
The piracy issue could be arguable.

But I'd like to see this shared exactly for what it was referred on the last post.
If someone would change the FW to allow a easier setting correction values for the individual cells readings for example, it would transform a brick into a useful charger.
Myself I gave up on this charger and order a new one.

Btw the file is called "Imax B6 firmware.zip or .rar" but has no seeds.
Mine is so far off that I wouldn't even mind flashing a crazy FW if it would make it work better. Last time I tried it would detect cells as 4.20v while I was measuring 4.03v.
Jan 06, 2011, 02:58 PM
sp5
sp5
Registered User
If anyone reading this has experience in AVR assembly -- especially for the ATMega32 (I am) -- then we could work together to produce a new firmware. Please PM me.
Jan 07, 2011, 01:39 PM
sp5
sp5
Registered User
simonk's mystery charger has an identical firmware. Well, almost. (So the MD5's don't match, but check this out: )
Code:
 000067d0  54 20 20 00 20 41 74 00  20 4d 6e 00 20 41 75 74  |T  . At. Mn. Aut|
-000067e0  00 20 4d 61 6e 00 44 49  53 43 48 41 52 47 45 00  |. Man.DISCHARGE.|
+000067e0  00 20 4d 61 78 00 44 49  53 43 48 41 52 47 45 00  |. Max.DISCHARGE.|
 000067f0  20 20 20 4e 4f 2d 55 53  45 00 20 20 20 20 20 41  |   NO-USE.     A|
 00006800  55 54 4f 00 53 54 4f 52  41 47 45 00 46 41 53 54  |UTO.STORAGE.FAST|
 00006810  20 43 48 47 00 42 41 4c  41 4e 43 45 00 43 48 41  | CHG.BALANCE.CHA|

 00006a90  4f 57 20 56 4f 4c 54 41  47 45 00 42 41 54 54 45  |OW VOLTAGE.BATTE|
-00006aa0  52 59 20 43 48 45 43 4b  2e 2e 2e 00 20 20 20 20  |RY CHECK....    |
+00006aa0  52 59 20 43 48 45 43 4b  2e 2e 2e 00 20 20 20 44  |RY CHECK....   D|
-00006ab0  20 20 42 36 20 20 20 20  20 00 69 6d 61 78 52 43  |  B6     .imaxRC|
+00006ab0  69 73 63 68 61 72 67 65  20 00 43 68 61 72 67 65  |ischarge .Charge|
 00006ac0  00 43 41 4e 43 45 4c 28  53 54 4f 50 29 00 53 41  |.CANCEL(STOP).SA|
 00006ad0  56 45 28 45 4e 54 45 52  29 20 00 56 4f 4c 3a 00  |VE(ENTER) .VOL:.|
If you really want to flash a firmware from a no-name clone that displays "Discharge" "Charge" when you boot it up -- because that's all they did to the firmware: replace the brand name with some generic words -- well, I'd be fine posting it somewhere. simonk, I'm waiting a couple days if you have any reservations you can PM me or post here. Otherwise I'll post the firmware.
Jan 07, 2011, 01:50 PM
throw new IOPilotException();
IceWind's Avatar
That's what I thought they did.
Simply changed the display name and that's it, the HW is basically it's almost or even the same.

Thanks for sharing.


What's you plan, do a FW from scratch or change the existing one?
Jan 07, 2011, 02:33 PM
sp5
sp5
Registered User
I can probably release simonk's (assuming I don't hear from him first) because they didn't protect his charger and as far as anyone knows they are not claiming copyright on the firmware. (And it should be legally supportable to claim they don't have a valid copyright on their firmware.)

I'd much prefer to use a GPL firmware. I can think of a hundred improvements off the top of my head - first of all, a better PC link. But I don't want to do it all by myself, so anyone who wants to work on it, please brush up on ATMega32 assembly.
Jan 07, 2011, 03:43 PM
throw new IOPilotException();
IceWind's Avatar
I started working on the AVR ASM for the Quads but I'm very far from mastering it.
But I can try and help, still I'd much prefer AVR C instead.
What's the code size that you have, does it fill the ATmega32?
Jan 07, 2011, 03:46 PM
Registered User
Quote:
Originally Posted by dusk
I think that I saw a torrent of it floating around the net.
Hello

I've found, but has no seeds or peers, only 14.7 kb but impossible to download.

Thanks
Jan 08, 2011, 03:59 PM
hacker
Quote:
Originally Posted by sp5
simonk's mystery charger has an identical firmware. Well, almost. (So the MD5's don't match, but check this out: )
Code:
 000067d0  54 20 20 00 20 41 74 00  20 4d 6e 00 20 41 75 74  |T  . At. Mn. Aut|
-000067e0  00 20 4d 61 6e 00 44 49  53 43 48 41 52 47 45 00  |. Man.DISCHARGE.|
+000067e0  00 20 4d 61 78 00 44 49  53 43 48 41 52 47 45 00  |. Max.DISCHARGE.|
 000067f0  20 20 20 4e 4f 2d 55 53  45 00 20 20 20 20 20 41  |   NO-USE.     A|
 00006800  55 54 4f 00 53 54 4f 52  41 47 45 00 46 41 53 54  |UTO.STORAGE.FAST|
 00006810  20 43 48 47 00 42 41 4c  41 4e 43 45 00 43 48 41  | CHG.BALANCE.CHA|

 00006a90  4f 57 20 56 4f 4c 54 41  47 45 00 42 41 54 54 45  |OW VOLTAGE.BATTE|
-00006aa0  52 59 20 43 48 45 43 4b  2e 2e 2e 00 20 20 20 20  |RY CHECK....    |
+00006aa0  52 59 20 43 48 45 43 4b  2e 2e 2e 00 20 20 20 44  |RY CHECK....   D|
-00006ab0  20 20 42 36 20 20 20 20  20 00 69 6d 61 78 52 43  |  B6     .imaxRC|
+00006ab0  69 73 63 68 61 72 67 65  20 00 43 68 61 72 67 65  |ischarge .Charge|
 00006ac0  00 43 41 4e 43 45 4c 28  53 54 4f 50 29 00 53 41  |.CANCEL(STOP).SA|
 00006ad0  56 45 28 45 4e 54 45 52  29 20 00 56 4f 4c 3a 00  |VE(ENTER) .VOL:.|
If you really want to flash a firmware from a no-name clone that displays "Discharge" "Charge" when you boot it up -- because that's all they did to the firmware: replace the brand name with some generic words -- well, I'd be fine posting it somewhere. simonk, I'm waiting a couple days if you have any reservations you can PM me or post here. Otherwise I'll post the firmware.
I don't mind you posting it, and I saw no copyrights in the binary either, but I wonder why everybody is interested in getting a copy. If yours and mine was unlocked, surely everybody else who wants to mess with it can just download and modify their own version, which is probably safer than randomly putting another version on.

I haven't seen any bugs with mine yet. I've never seen the current go beyond what I specify. In fact, I've been really happy with this thing, now that it is finally calibrated.

Yeah, I'd like to make some improvements as well, like reducing the start button wait time, start to skip wait time during cycling, temperature monitoring enabled with lipos, etc., etc... I worry that if posted, though, somebody's charger might have inverted balancer pins and shipped firmware to match, and so just throwing some other firmware might look to be working, but then blow up a lipo in somebody's face. That would kind of suck. Note this if you post it.

My copy is 27788 bytes on a 32768 byte flash chip, so there is some room for more than a copyright notice. The iCharger firmwares seem to be in the 64kB territory, unless it's just that they're encoded in some way, so they're probably quite different. Some screens look similar, though, so maybe they were originally based on this firmware? Anyway, I'd also be interested in a disassembly, if somebody has the tools. Cheers
Jan 08, 2011, 06:12 PM
sp5
sp5
Registered User
I totally agree. If you go to the risk of replacing your "working" (I know, they don't work very well) charger's firmware with a firmware from the *wrong* brand of charger, with absolutely no guarantee that it will do anything except crash, ...

Don't hook LiPos up to this sort of Frankenstein! Please!
Jan 08, 2011, 11:31 PM
hacker
Then again, uncalibrated-from-the-factory chargers are probably more dangerous, since people who have little idea what is going on will just trust the display, and that would be worse. The reason I bothered to solder the ISP was to enable the calibration menu.

I'd be interested to see if anybody else with a Mystery charger like mine has the same eeprom values. I suspect the factory just set the flash and eeprom to something they copied from another charger for all builds, since there is no way they would have shipped it with it so far out of calibration.

So, what sort of features are you interested in?
Jan 09, 2011, 12:58 AM
Crashing on a budget.
dusk's Avatar
Thread OP
Quote:
Originally Posted by simonk
So, what sort of features are you interested in?
How about calculating a battery's internal resistance?

Also, a mode where you can get the charger to act as an adjustable power supply to drive things such as hot wire cutters.
Jan 09, 2011, 09:10 AM
throw new IOPilotException();
IceWind's Avatar
And have the calibration menu accessible at all time.
Jan 10, 2011, 07:09 PM
Registered User
nysom's Avatar
Well my USBasp came in today and guess what? Yep, its locked. I give up...
Jan 10, 2011, 10:37 PM
hacker
Quote:
Originally Posted by nysom
Well my USBasp came in today and guess what? Yep, its locked. I give up...
If it's locked, you can still try flashing another firmware, assuming they didn't modify it in an incompatible way. If you don't mind giving up to the extent of possibly having to write your own modifications to make it useful again, you could try flashing over it. Or, maybe it would let you clear just the eeprom, which would let you enable the calibration menu (not sure on if that is possible when it is locked). Also, how do you know it is locked? Does it read back as 00 00 01 01 02 02 etc, or does it just not identify the part signature? Mine had a messed up signature, but everything else still worked.
Jan 11, 2011, 01:13 AM
Registered User
nysom's Avatar
Well the Lock Fuse is set to 0xF8 (11111000) and I think it would take a full erase to reset those bits so I would loose everything. This is one of those mystery b6 like dealextreme was selling.
Jan 11, 2011, 11:18 AM
Registered User
nysom's Avatar
simonk, what are your fuses set to on the mystery b6. Mine are

Low Fuse 0x3F
High Fuse 0xC9
Lock Fuse 0xF8


I guess I just use the same Low and High fuse but set the Lock fuse to FF so it would no longer be protected.
Last edited by nysom; Jan 11, 2011 at 02:16 PM.
Jan 11, 2011, 03:21 PM
sp5
sp5
Registered User
Here are some binary files -- FOR RESEARCH PURPOSES ONLY.

Please also note:

THERE IS NO WARRANTY FOR THESE BINARY FILES, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND ALL OTHER PARTIES PROVIDE THE BINARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE BINARY IS WITH YOU. SHOULD THE BINARY DIFFER OR CONTAIN ANY DEFECT, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
Jan 11, 2011, 04:20 PM
Registered User
nysom's Avatar
Well, I have both menus now so it looks like I need to build a precision resistor bridge for calibration. Also, I used eXtreme Burner software with the USBasp and it recognized the Atmega32 IC fine. Thanks to those that helped!
Jan 11, 2011, 04:51 PM
hacker
Quote:
Originally Posted by nysom
Well, I have both menus now so it looks like I need to build a precision resistor bridge for calibration. Also, I used eXtreme Burner software with the USBasp and it recognized the Atmega32 IC fine. Thanks to those that helped!
Hehe..I was going to make the screen socketed like that, with a halved DIP socket, but I didn't have any big enough. Or did yours come that way? My board looks the same, but my power resistors at the bottom still have visible bands, for some reason...

Regarding the fuses, it seems I did not capture their values at all, and I have since cut off the ISP wires. I can hook them back up again if you'd like. (I was trying to read the non-reversible software off of a Dynam 25A ESC w/Atmega8, but it was locked, so no go there.)

Regarding the calibration, I used 6 100-ohm 1% metal film resistors (a pack of them costs $1 at Active Components here). They easilly binned manually to .1%, and I just soldered them in a circle off of the back of a deans connector which I hooked up to the output, and then wires on each resistor leg to the 7-pin balance connector. Hooked up to 25.2V from two isolated bench supplies in series, and powered up with the first+third buttons pressed. It starts automatically if the input voltage is OK, then you can press the right-most button, and it will go through and check all cells. I can't find a way to go any further than that, but eeprom values are updated and everything is calibrated perfectly on reboot. 100 ohms seemed perfectly fine against the input measurement impedance, and that's about the power limit for 4.2V per resistor at 4.2^2/100 == .1764 Watts.

Good luck!
Jan 11, 2011, 05:51 PM
Registered User
nysom's Avatar
I just used half of a 32 pin dip socket and soldered a single straight header to the display, plug and play I have tons of precision resistors around here and I was going to solder them to a XH plug but cannot find the 7 pin one I bought for this calibration. So I’ll go to plan B and use individual ones.

As far as the fuses I look them up in the atmega manual and had no reason to change anything but the lock fuse, I changed that to FF. I’m sure your high and low fuses are the same as mine. I was concerned at first because I was not getting what I was supposed to after reading the locked ic but the fuse and lock bits where reading correctly.

Now if someone can rewrite the firmware so it works more like my IntelliPeak ICE I would be happy
Jan 11, 2011, 07:10 PM
hacker
I just dremelled one pin off of an 8-pin JST-XH plug I had laying around. Looks like that is a pretty fancy charger you have there! You'd have to do some pretty crafty character font replacement to get graphs like that.

Sp5, have you or has anybody else mapped the pins roughly yet? It might not be hard to bang out the basics of something in C or asm. It sounds like it could be worthwhile to prod at this thing a bit more and maybe actually make an open firmware, since they are so common. I see the board variants that still have the ISP header actually connect under the analog chip in the same way. I wonder if there actually are any variants with a different pinout, or if they are all actually compatible.
Jan 11, 2011, 11:37 PM
sp5
sp5
Registered User
Quote:
Originally Posted by simonk
I can't find a way to go any further than that...
The code has no exit path. It just stays in an endless loop. Rebooting is the right way to end calibration.
Quote:
Originally Posted by simonk
Sp5, have you or has anybody else mapped the pins roughly yet?
Yup. Click here to go to a new thread for that.

It's a very popular board layout. But as soon as we start writing an open firmware, we'll find boards that are not compatible -- statistical certainty (99.99% probability or better).

Edit: added a link to the new thread
Last edited by sp5; Jan 11, 2011 at 11:44 PM.
Jan 12, 2011, 12:52 AM
hacker
Quote:
Originally Posted by sp5
It's a very popular board layout. But as soon as we start writing an open firmware, we'll find boards that are not compatible -- statistical certainty (99.99% probability or better).
But if they're all copies of the IMAX B6, I would bet that it would be more work to redesign the board layout _and_ modify the software than it would just to leave it the same or start from scratch. So, other than extensions and minor hacks, I would be surprised to find ones that are completely incompatible.

Schematics seem to be posted here: https://www.rcgroups.com/forums/show....php?t=1362933
Jan 12, 2011, 11:48 AM
Registered User
nysom's Avatar
Well I built the voltage divider and ran it through the cal cycle and it seem to work fine. I am seeing about 10 to 20mv difference between what the charger is computing and what my fluke is seeing. So far cell differences are about 10mv from each other.

I am concerned that the voltage divider gets quite warm using 100 ohm resistors. Their values could be changing while heating.

I don’t have any 6S packs so I ordered a y splitter to connect 2 3S packs and I’ll try the cal cycle again. Not sure is this thing can be calibrated to less the 10mv or not.

Gotta go shovel snow now
Jan 12, 2011, 01:33 PM
hacker
Glad to hear that the firmware worked in any event! I used 1/4 watt 100 ohm resistors, but they should all heat at pretty much the same rate since they're in series, so I don't think it matters, but maybe it does. You could always read your eeprom values and tweak them by hand, I guess. Maybe calibrate with the voltage slightly lower and slightly higher, and see how they change. The calibration values are 6 16-bit words starting at 0x390, but they seem to be around 12-bit values, so depending on how they are applied, you should be able to get to within 1mV with them. I don't have a meter precise enough to check since it's a 4,000 count and drops the last digit higher than 3.999V, but my charger is a lot better than the 120mV off that it used to be!
Jan 15, 2011, 04:15 PM
Registered User
nysom's Avatar
Well, I build a better divider and re-calibrated my B6. I am happy with the results this time.
I am seeing 10mv or less between what the charger is seeing and my fluke. The resistors I used where Vishay/Dale .1% 1/2 watt Metal film (CMF100HBCT) wired to a JST 7 pin XH plug. I powered the 25.2 volt input using an old Tektronix PS503A dual power supply.

I drew a quick schematic for those who want to build one and snapped a photo of the old and new divider. The old one has the deans connector.
Jan 15, 2011, 04:37 PM
Registered User
I do not see any sense to force every user to download firmware to manually change the 10 bytes of the firmware to get the normal version of the firmware for ImaxB6. This is a modified firmware ImaxB6 (it is written). The modification is that the Stop + inc menu is not blocked after the calibration. I checked it on my device and it works. Of course, I'm not able to test all of the features but I'm sure everything will work correctly. Although it is possible firmware used in the clones has errors that are corrected in newer versions ImaxB6 (which are locked)
Password - thanks
))))

THERE IS NO WARRANTY FOR THESE BINARY FILES, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND ALL OTHER PARTIES PROVIDE THE BINARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE BINARY IS WITH YOU. SHOULD THE BINARY DIFFER OR CONTAIN ANY DEFECT, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
Jan 15, 2011, 07:06 PM
Registered User
Well I have compared the firmware that tolyan23 has posted against sp5's and aside from two differences in some text fields (startup text and a spelling error) there is one code change.
Starting at address 0x5724 ImaxMod.hex reads 13 c0
Starting at address 0x5724 flash.bin reads 02 e0

Anyone have any idea's on the effect of this? I have a SKYRC IMAX B6AC+ that shares the same PCB layout that tolyan23 has shown pictures of and have a programmer ordered and will be trying to dump and flash my own as well but if it's locked I may have to flash one of the firmwares listed here in the thread and want to use the best one.
Jan 16, 2011, 09:11 AM
Registered User
Quote:
Originally Posted by OrBy
Well I have compared the firmware that tolyan23 has posted against sp5's and aside from two differences in some text fields (startup text and a spelling error) there is one code change.
Starting at address 0x5724 ImaxMod.hex reads 13 c0
Starting at address 0x5724 flash.bin reads 02 e0

Anyone have any idea's on the effect of this?
I write in before post "Stop + inc menu is not blocked after the calibration"
Jan 16, 2011, 10:36 AM
Registered User
Oh - I though that the bytes that did that were located at 0x574A, 0x574B as sp5, dusk, and simonk have tested. Or I guess they both valid locations for this modification?
Jan 16, 2011, 11:43 AM
Registered User
For blocking the call menu 1 corresponds to not one bit a piece of code. You can skip it 10 different ways.
Jan 16, 2011, 04:03 PM
Registered User
Ahhh that makes sense! Cant wait for my USBtinyISP kit to arrive. I love messing with this stuff
Jan 18, 2011, 12:38 AM
Registered User
Thank you both tolyan23 and sp5! I was able to flash my SkyRC IMAX B6 AC+ charger tonight and unlock the calibration menu. Due to the firmware being protected I was unable to dump it but using the files and instructions here it was a snap to update/over write it. Charger is functioning as it had before with both menu's usable on boot! I even edited the bin file to reflect the correct charger name when it start's up Cheers!
Jan 18, 2011, 01:36 AM
sp5
sp5
Registered User
Quote:
Originally Posted by OrBy
Thank you both tolyan23 and sp5! I was able to flash my SkyRC IMAX B6 AC+ charger tonight and unlock the calibration menu. Due to the firmware being protected I was unable to dump it but using the files and instructions here it was a snap to update/over write it. Charger is functioning as it had before with both menu's usable on boot! I even edited the bin file to reflect the correct charger name when it start's up Cheers!
Wonderful! Glad the firmware worked. That's an important test point, and you ran a risk if it didn't work, there was no way back.

Thanks!
Jan 20, 2011, 12:26 PM
Registered User
Did anyone have the Imax B8 software? flash and eeprom.
Jan 20, 2011, 12:59 PM
sp5
sp5
Registered User
Quote:
Originally Posted by Anzelmi
Did anyone have the Imax B8 software? flash and eeprom.
No, no one has mentioned an Imax B8 at all. If you have the hardware, you should see if the firmware is protected or unprotected.
Jan 20, 2011, 02:13 PM
Registered User
Quote:
Originally Posted by sp5
No, no one has mentioned an Imax B8 at all. If you have the hardware, you should see if the firmware is protected or unprotected.
I made probably a big mistake during programming. Now the charger is then a source of running anymore.
Jan 20, 2011, 02:19 PM
throw new IOPilotException();
IceWind's Avatar
I just got a new Turnigy Accucel-6 and "lucky" the thing comes unbalanced.
The total voltage detection is quite ok, but cell voltage detection is totally nuts.
I tried going to the menu 1 but had no luck.

Now the question, I noticed on the board that it is differnte from the Imax B6.
Firsts it has the fan connector and I can see several rows of aligned holes where it could fit a ICSP pin headers.
I haven't traced them yet to the ic so I was wondering if anyone else has one as well and if those are trully icsp connections. If so it would make really easy re-program the charger or at least clean the settings so I could go into the menu 1.

I'll post some pics later on.
Jan 20, 2011, 05:28 PM
Registered User
MoFl's Avatar
It's curious what HK says in the accucel 6 description (underlined):

ATTENTION.
There are several chargers now entering the China market that look similar to the Accucel. These chargers are produced with cheaper FETs and are unfortunately much less accurate and very unsafe. There has been reports of the copied chargers over-charging packs and not balancing correctly.
The Accucel-6 is the first charger in the market with this PCB layout Circuit design. Any charger with the same circuit diagram is most definitely a copy. We have tested the copied chargers ourselves, their componentry is of a very low quality and the manufacturing company that has produced the copy has used a process of duplicating our CPU(MCU)s hex file and flashed a similar chip(MCU) to produce a similar product. This means they do not have the original code and therefore cannot bug-test(QC) or update the charger at any point.


So this supports the theory that most of these chargers have all the same FW...
Jan 20, 2011, 11:12 PM
hacker
Quote:
Originally Posted by IceWind
I just got a new Turnigy Accucel-6 and "lucky" the thing comes unbalanced.
The total voltage detection is quite ok, but cell voltage detection is totally nuts.
I tried going to the menu 1 but had no luck.

Now the question, I noticed on the board that it is differnte from the Imax B6.
Firsts it has the fan connector and I can see several rows of aligned holes where it could fit a ICSP pin headers.
I haven't traced them yet to the ic so I was wondering if anyone else has one as well and if those are trully icsp connections. If so it would make really easy re-program the charger or at least clean the settings so I could go into the menu 1.

I'll post some pics later on.
I've noticed that the board layouts with the ISP headers usually have them off to the upper right from the microcontroller. They run to and then under the analog mux chip, and then up to where they instead put a bunch of resistors on the Mystery PCB variant. The 6 ISP pins on the TQFP/MLF ATmega32 are all in a row, which is nice. See 2503S.pdf for the pinout.
Jan 22, 2011, 06:36 PM
throw new IOPilotException();
IceWind's Avatar
Here goes the pic.



So you say the ICSP should be ones on the right 2x 5pins, making a normal 10pin ICSP plug connection.



The connections I can see match line the linked GND pins (4,6,8,10) and the (3) not connected to anything.
I'll solder some pin headers here and give it a try.

Any idea what might be the ones on the left ( 5 holes single row) for?
Last edited by IceWind; Jan 22, 2011 at 06:42 PM.
Jan 22, 2011, 10:22 PM
sp5
sp5
Registered User
I'm pretty certain that's an ISP header, but the pins need to be traced back to the chip. For that, we'd need a good look at the top of the board.

Up above, darzur identified his as RST, SCK, MISO, MOSI, VCC and GND. Your pins should be very similar to that.
Jan 23, 2011, 05:53 AM
Registered User
Quote:
Originally Posted by tolyan23
I do not see any sense to force every user to download firmware to manually change the 10 bytes of the firmware to get the normal version of the firmware for ImaxB6. This is a modified firmware ImaxB6 (it is written). The modification is that the Stop + inc menu is not blocked after the calibration. I checked it on my device and it works. Of course, I'm not able to test all of the features but I'm sure everything will work correctly. Although it is possible firmware used in the clones has errors that are corrected in newer versions ImaxB6 (which are locked
Hello
What format is the file? How is that its size is 90Kb instead 27Kb?

Thanks
Jan 23, 2011, 11:35 AM
Registered User
.hex plain text format with service information. Its known to many programmers like AVR studio and programmer of cvavr (Code vision avr)
Jan 23, 2011, 03:41 PM
throw new IOPilotException();
IceWind's Avatar
Had no luck mine was locked.
Just picked the mod version posted here and flashed it and it's working.
If I start feeling that I'm missing the "Turnigy" letters on start I'll edit the hex file.

I'm considering exposing the ICSP pins to the outside to make it easier to flash in the future.
Jan 23, 2011, 05:08 PM
Registered User
Quote:
Originally Posted by tolyan23
.hex plain text format with service information. Its known to many programmers like AVR studio and programmer of cvavr (Code vision avr)
Hello
With that program I can compile the file? can anyone generate a valid binary file AVRDUDE?

Thank you very much
Jan 24, 2011, 12:28 PM
Registered User
Quote:
Originally Posted by benavide
Hello
With that program I can compile the file? can anyone generate a valid binary file AVRDUDE?

Thank you very much
This file does not need to compile. Simply open your program and writes to the microcontroller
Jan 26, 2011, 10:49 AM
Registered User
nysom's Avatar
Quote:
Originally Posted by benavide
Hello
With that program I can compile the file? can anyone generate a valid binary file AVRDUDE?

Thank you very much
Does AVRDUDE require hex or bin? Here is the hex version of the firmware. I know eXtreme Burner requires hex.
Last edited by nysom; Jan 26, 2011 at 10:58 AM.
Jan 27, 2011, 10:57 AM
throw new IOPilotException();
IceWind's Avatar
Anyone wants a toasted charger?

Tested mine in storage a lipo and it almost melted down... :S



Does look better now as I removed part of the melted resin that was accumulated all around the resistor. Btw the fan did a great job spreading the burn smell all around the house.

On the positive side, I was able to get 2x 3S packs all cells charges up to 4.18v and run menu one. I got the Ok on all cells, I need to test now how evenly is it charging the lipos.
Jan 27, 2011, 11:17 PM
Registered User
nysom's Avatar
They should of left the 3 watt resistors in there instead of going surface mount...


Quick Reply
Message:

Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Service Menu for JR 9303 / JR PCM9XII Annette38 Radios 18 Apr 10, 2019 06:59 PM
FAQ Accessing the JR XP6102 Service Menu hilgert Volenti Non Fit Injuria Extrema 68 Jan 26, 2009 06:03 PM
Futaba 7C Service Menu Pete K Radios 2 Oct 16, 2005 06:42 PM
JR X347 service menu query aduncan Radios 0 Sep 09, 2005 06:39 PM