Changing code on a production board

Enhanced mid-range devices. PIC12F1xxx and PIC16F1xxx

Changing code on a production board

Postby john_arvid » Wed Dec 19, 2018 9:56 pm

Hello,

I have started with a "small" project that I fear is a bit to difficult just to get beginning.

In my home a have several Wifi floor heating thermostat devices. (From China)
The devices uses the PIC16F1947 chip and a Broadlink WT1SBSL.
These devices has a proprietary software that uses a cloud server and a app to control the device.
This is something I don't want, and I was looking into programming these myself and making something that could work with MQTT or something similar.


I got myself a PICkit3 (PG164130) and tried to connect to the device. (Since I found some pins that seemed to go to the correct pin on the PIC16F1947 I wanted to try)
But I always get a "Failed to get Device ID" or a "Target Device ID (0x0) is an Invalid Device ID".

So reading the http://microchipdeveloper.com/dtda:invalid-device-id about common causes it looks like it could be either or all.
I'm neither that steady or experienced with a soldering iron to remove the chip and then program it.

Of course I could get myself a device that is already capable of doing what I want, but that is not any fun for a tinkerer.

Pictures are uploaded here: https://imgur.com/a/GEQ2665

What would you guys/gals suggest?


\Jak
john_arvid
 
Posts: 7
Joined: Wed Dec 19, 2018 9:52 pm

Re: Changing code on a production board

Postby ric » Thu Dec 20, 2018 1:10 am

I assume you are connecting the PK3 to J2 on that board.
What exact pins on the PIC do the first five pins of J2 connect to? (Don't worry about the 6th pin, it's probably not connected to anything)
Try telling the PK3 to use "Low voltage mode" (LVP) to talk to the PIC. (The board may prevent MCLR being raised to 9V for HVP mode)

Have you traced out a schematic of this board? You will need to if you want to develop your own software.
Latest test project, an LED matrix display made from one reel of addressable LEDs. here
User avatar
ric
Verified identity
 
Posts: 471
Joined: Sat May 24, 2014 2:35 pm
Location: Melbourne, Australia
PIC experience: Professional 5+ years with MCHP products

Re: Changing code on a production board

Postby AussieSusan » Thu Dec 20, 2018 3:56 am

The chip could be code-protected in which case you are out of luck trying to read the code etc.
When you try to program it your self, the existing code will be automatically deleted.
Susan
AussieSusan
Verified identity
 
Posts: 97
Joined: Mon Jun 16, 2014 4:45 am
PIC experience: Experienced Hobbyist

Re: Changing code on a production board

Postby john_arvid » Thu Dec 20, 2018 9:55 am

Thank you for your replies.

Thanks for mentioning tracing the board, this made me check my earlier trace 5 times more to be sure of what when were from J2 to the PIC.
This is the result, 95% sure it is correct:
J2 -> PIC
pin1 -> pin7 MCLR and R1 (10K ohm)
pin2 -> pin38 VDD,pin57 VDD,pin10 VDD,pin19 AVDD,pin26 VDD and R1 (10K ohm)
pin3 -> Ground
pin4 -> pin37 ICDDAT
pin5 -> pin42 ICDCLK
pin6 -> nothing

I won't trace more of the board until I am able to program the chip.

AussieSusan wrote:The chip could be code-protected in which case you are out of luck trying to read the code etc.
When you try to program it your self, the existing code will be automatically deleted.
Susan

Does this also apply reading the memory and store it to hex?
Cause I want to make a backup of the chip before I erase it.
I would love to get the source code from the chip, but I don't know how to get that. (Except finding the people that programmed this)

I have tried to connect to the device again now that I have the correct layout of the pins.

Now I don't get the "Failed to get Device ID" anymore.
Now I get the "PICkit 3 is trying to supply 5,000000 volts from the USB port, but the target VDD is measured to be 4,625000 volts". This is when I don't use the external power supply that should be powering this device.
When I use the external power supply I get this error: "Too much current has been drawn on VDD. Please disconnect your circuit, check the CLK and DATA lines for shorts and then reconnect".

I have tried with LVP and with Power target circuit both with and without the external power supply.

What should I try next?

\Jak
john_arvid
 
Posts: 7
Joined: Wed Dec 19, 2018 9:52 pm

Re: Changing code on a production board

Postby ric » Thu Dec 20, 2018 10:18 am

Yes. If the chip is code protected you can NOT read the correct hex data from it.

You can't get the "source code" from the chip.
If it is not protected, you can get the assemble language, and there are various ways to try to disassemble it.
If the source code was in assembly, you might end up close, but without the correct label names or comments of course.
If it was written in C (which is highly likely), then your job is much harder.

Now I get the "PICkit 3 is trying to supply 5,000000 volts from the USB port, but the target VDD is measured to be 4,625000 volts".

Are you sure the PIC runs at 5V on this board, and not 3.3V?

If you connect external power, then make sure the PK3 is not also trying to supply power at the same time.
Latest test project, an LED matrix display made from one reel of addressable LEDs. here
User avatar
ric
Verified identity
 
Posts: 471
Joined: Sat May 24, 2014 2:35 pm
Location: Melbourne, Australia
PIC experience: Professional 5+ years with MCHP products

Re: Changing code on a production board

Postby john_arvid » Thu Dec 20, 2018 10:42 am

Ok, good to know about the protection. I will check when and if I get to talk to the PIC.

The boards is running on 3.3V when I connect the external power supply.
But I only get that message when I don't use the external power supply.

When I use the external power supply I get this. (Also when the Power target circuit from PICkit3 is not ticked)
Code: Select all
Too much current has been drawn on VDD. Please disconnect your circuit, check the CLK and DATA lines for shorts and then reconnect.
Programmer to target power is enabled - VDD = 5,000000 volts.
Too much current has been drawn on VDD. Please disconnect your circuit, check the CLK and DATA lines for shorts and then reconnect.
Unable to connect to the target device.
Failed to get Device ID


\Jak
john_arvid
 
Posts: 7
Joined: Wed Dec 19, 2018 9:52 pm

Re: Changing code on a production board

Postby ric » Thu Dec 20, 2018 11:28 am

The boards is running on 3.3V when I connect the external power supply.

In which case you must NOT try to supply 5V to it. Did you try to reduce the PK3 voltage to 3.3V?

When I use the external power supply I get this. (Also when the Power target circuit from PICkit3 is not ticked)

Something is wrong then. You would only get that message when the PK3 is trying to supply power.
Latest test project, an LED matrix display made from one reel of addressable LEDs. here
User avatar
ric
Verified identity
 
Posts: 471
Joined: Sat May 24, 2014 2:35 pm
Location: Melbourne, Australia
PIC experience: Professional 5+ years with MCHP products

Re: Changing code on a production board

Postby john_arvid » Thu Dec 20, 2018 11:49 am

In which case you must NOT try to supply 5V to it. Did you try to reduce the PK3 voltage to 3.3V?

Do you mean with Power target circuit from PICkit3 ticked? And then set the voltage to 3.3V?
If yes, then yes, I have tried that.
If no, then where would I set this?

I have tested a bit more with the power settings and it seems like the settings are not always applied.
I need to disconnect the PICkit3 and close the IDE and sometimes it works.
Is this a common problem?

Want to sort this out cause this causes unnecessary problems.

\Jak
john_arvid
 
Posts: 7
Joined: Wed Dec 19, 2018 9:52 pm

Re: Changing code on a production board

Postby john_arvid » Thu Dec 20, 2018 12:27 pm

Ok, by using the IPE instead I now am sure on what is turned on and off regarding power and LVP etc.

To summarize:
1. No external power, Power target circuit set to 3.3V and HVP (High Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
Programmer to target power is enabled - VDD = 3,300000 volts.
Target Device ID (0x0) is an Invalid Device ID. Please check your connections to the Target Device.


2. No external power, Power target circuit set to 3.3V and LVP (Low Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
MPLAB X has detected that the device’s low voltage configuration bit is set to OFF but the tool is set to low voltage programming and cannot program the device. To correct this:
1. Change the tool’s programming option to use High Voltage programming.
2. Change the device’s configuration bit to use low voltage (LVP=ON). Program the device using high voltage to reprogram the device’s configuration bit.
3. Change the tool’s programming option back to Low Voltage programming for subsequent programming of the device.


3. External power on, no Power target circuit and HVP (High Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
Target voltage detected
Target Device ID (0x0) is an Invalid Device ID. Please check your connections to the Target Device.


4. External power on, no Power target circuit and LVP (Low Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
MPLAB X has detected that the device’s low voltage configuration bit is set to OFF but the tool is set to low voltage programming and cannot program the device. To correct this:
1. Change the tool’s programming option to use High Voltage programming.
2. Change the device’s configuration bit to use low voltage (LVP=ON). Program the device using high voltage to reprogram the device’s configuration bit.
3. Change the tool’s programming option back to Low Voltage programming for subsequent programming of the device.


5. No external power, no Power target circuit and LVP (Low Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
MPLAB X has detected that the device’s low voltage configuration bit is set to OFF but the tool is set to low voltage programming and cannot program the device. To correct this:
1. Change the tool’s programming option to use High Voltage programming.
2. Change the device’s configuration bit to use low voltage (LVP=ON). Program the device using high voltage to reprogram the device’s configuration bit.
3. Change the tool’s programming option back to Low Voltage programming for subsequent programming of the device.


6. No external power, no Power target circuit and HVP (High Voltage program mode)

Code: Select all
Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.54.00
Firmware type..............Enhanced Midrange
Target device was not found (could not detect target voltage VDD). You must connect to a target device to use PICkit 3.


Must say that number 5 is a bit weird, but I guess that it expected since it is low voltage.

\Jak
john_arvid
 
Posts: 7
Joined: Wed Dec 19, 2018 9:52 pm

Re: Changing code on a production board

Postby ric » Thu Dec 20, 2018 12:46 pm

All those reports indicate that it is NEVER getting the chip into program mode.
The LVP messages are just it guessing why it can't talk to the PIC.
I'm surprised you did not get the same error for #5 that you did for #6. If there's not voltage on the Vdd pin, then it can't proceed.
"Low voltage" has nothing to do with the Vdd voltage. It just indicates that it won't try to pull MCLR up to 9V the way HVP mode does.
Latest test project, an LED matrix display made from one reel of addressable LEDs. here
User avatar
ric
Verified identity
 
Posts: 471
Joined: Sat May 24, 2014 2:35 pm
Location: Melbourne, Australia
PIC experience: Professional 5+ years with MCHP products

Next

Return to 14-Bit Core (enhanced)

Who is online

Users browsing this forum: No registered users and 0 guests