Imax B6 with CMS32L051 status

[diggit]

This issue is tracking Imax B6 80W with CMS32L051 mcu, reverse engineering and possibly future support.
Origin in #333

Progress

• MCU pinout reverse engineering: 0 %

Basic info about charger:

• input voltage: 11-18 Vdc
• max charging power: 80 W
• max discharging power: ?
• charging current: 0.1-6.0 A
• discharging current: 0.1-2.0 A
• max balancing current: ?
• NiCd/NiMH cells: 1-16
• Lixx cells : 1-6
• Lead battery: 2V - 20V

Findings

• simple 2 layer PCB
• design is mostly the same as other Imax B6 chargers have
• CMS32L051 MCU (Cortex M0+, 64 MHz, 64 kB FLASH, 8 kB RAM, 1.5 kiB data FLASH?)
  • Datasheet
  • Ref. manual
• powerstage:
  • switching frequency somewhere between 53.4 kHz
  • horrible ringing on booster stage (slow diode?)
• no opamps ?!
• no external analog mux for ADC

Pinout

Number	Name	HW	Fcn
1	P120	ANI14
2	P41
3	P40	SWDIO
4	RESETB
5	P124	XT2/EXCLKS
6	P123	XT1
7	P137	SWCLK1
8	P122	X2/EXCLK2
9	P121	X1
10	VSS
11	VDD
12	P136	INTP0/ANI36
13	P60	SCLA0
14	P61	SDAA0
15	P62	ANI27
16	P63	ANI28
17	P31	TI03/TO03/ANI22
18	P75	KR5/SCLK01/SCL01/ANI34
19	P74	KR4/SDI01/SDA01/ANI33
20	P73	KR3/SDO01//ANI32
21	P72	KR2//ANI31
22	P71	KR1/SDI21/SDA21/ANI30
23	P70	KR0/SCLK21/SCL21/ANI29
24	P30	INTP3/RTC1HZ/ANI21
25	P50	INTP1/ANI23
26	P51	INTP2//ANI24
27	P17	TI02/TO02/ANI20/EPWMO07
28	P16	TI01/TO01/ANI19/EPWMO06
29	P15	CLKBUZ1/ANI18/EPWMO05
30	P14	SDA20/ANI17/EPWMO04
31	P13	ANI16/EPWMO03
32	P12	SDO11/ANI13/EPWMO02
33	P11	SDI11/SDA11/ANI8/EPWMO01
34	P10	SCLK11/SCL11/ANI9/EPWMO00
35	P146	ANI15
36	P147	ANI12
37	P27	ANI7
38	P26	ANI6
39	P25	ANI5
40	P24	ANI4
41	P23	ANI3
42	P22	ANI2
43	P21	ANI1
44	P20	ANI0
45	P130	ANI35
46	P01	ANI10/TO00
47	P00	ANI11/TI00
48	P140

[diggit]

Hi @RadioControl,
Charger arrived. I did quick check of HW and I am quite disappointed.
Cell voltage measurement sucks, because there isn't single op amp for differential cell voltage measurement. Whole cell voltage measurement circuitry consists of dividers and direct connection to MCU with 12 bit ADC. Due to this fact, highest cell measurement has to be able to measure at least 26 V. Resolution is then 6 mV at best (26 / 4096 = 0.006).

I am more inclined to focus on #338 now, because for just a few more bucks, you can get better and smaller charger.

[RadioControl]

Hi @diggit ,

thank You for Your effort and toughts on that!...another B6 clone for a few €s more is on the way to me, but before i placed the order i asked what chip is in there, they answered Atmega32. We'll see...

[RadioControl]

Hi @diggit ,

did You found any calibration menu on it?... For me no button combination to get in a calibration menu, altough i found that the stock calibration is not that bad, at least with a 3s lipo in balance charging mode...

[DSchndr]

Hi, the hardware was already reverse engineered here
here is its schematic

As for flashing it, no idea, maybe someone with a JLink can get it to work since SWD seems to get disabled after boot
My stlink does not want to work with it, even with hw reset it gets chipid 0
Pinout for the connector on top is 5v gnd clk dio gnd p51 p50
Debugger access seems to work, use 3.3v for stlink clone

.\openocd.exe -f OpenOCD-20231002-0.12.0\share\openocd\scripts\interface\stlink-dap.cfg -c "transport select dapdirect_swd; adapter speed 100; swd newdap chip cppu -enable; dap create chip.dap -chain-position 0; target create chip.cpu cortex_m -dap chip.dap; init; dap info; "
Open On-Chip Debugger 0.12.0 (2023-10-02) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
libusb1 09e75e98b4d9ea7909e8837b7a3f00dda4589dc3
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
Warn : Specify TAP 'chip.cppu' by name, not number 0
Info : STLINK V2J37S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 2.999260
Info : clock speed 100 kHz
Info : stlink_dap_op_connect(connect)
Info : SWD DPIDR 0x0bc11477
Info : [chip.cpu] Cortex-M0+ r0p1 processor detected
Info : [chip.cpu] target has 4 breakpoints, 2 watchpoints
Info : starting gdb server for chip.cpu on 3333
Info : Listening on port 3333 for gdb connections
AP # 0x0
                AP ID register 0x04770031
                Type is MEM-AP AHB3
MEM-AP BASE 0xe00ff003
                Valid ROM table present
                Component base address 0xe00ff000
                Peripheral ID 0x04000bb4c0
                Designer is 0x23b, ARM Ltd
                Part is 0x4c0, Cortex-M0+ ROM (ROM Table)
                Component class is 0x1, ROM table
                MEMTYPE system memory present on bus
        ROMTABLE[0x0] = 0xfff0f003
                Component base address 0xe000e000
                Peripheral ID 0x04000bb008
                Designer is 0x23b, ARM Ltd
                Part is 0x008, Cortex-M0 SCS (System Control Space)
                Component class is 0xe, Generic IP component
        ROMTABLE[0x4] = 0xfff02003
                Component base address 0xe0001000
                Peripheral ID 0x04000bb00a
                Designer is 0x23b, ARM Ltd
                Part is 0x00a, Cortex-M0 DWT (Data Watchpoint and Trace)
                Component class is 0xe, Generic IP component
        ROMTABLE[0x8] = 0xfff03003
                Component base address 0xe0002000
                Peripheral ID 0x04000bb00b
                Designer is 0x23b, ARM Ltd
                Part is 0x00b, Cortex-M0 BPU (Breakpoint Unit)
                Component class is 0xe, Generic IP component
        ROMTABLE[0xc] = 0x00000000
                End of ROM table

Even better, the firmware can be dumped with mdb 0x0 0xffff
which (valid) results can be seen in the dump_flash.txt
as for the stored variables, they are probably in the dump_data_flash.txt region

An SVD file for reverse engineering the code in ghidra is there too :)
CMS32L051.txt

[diggit]

Sorry for lack of updates, but I am giving preference to other projects at this moment. Once I get back to cheali, I'll rather put my effort into #338, as this HW does not even have differential op amps for cell measurement, so it kinda sucks.

EDIT: typo fix

[DSchndr]

@RadioControl there is no calibration menu
But there would be enough space to patch one in
These are pretty much all menus

[DSchndr]

@diggit how much accuracy do you want? For me at least the 6mv/step are fine considering the price...
Analog mux is in the chip... so why an external one?

What is missing would be an adc linearity graph, to know how the adc measures across its voltage range.
Someone with a programmable psu, some time and coding skills might do that.

As for writing code, an arm keil package exists from which the header files and HAL can be extracted.
Flashing it works too over openocd, i've made some scripts for doing that:
https://github.com/DSchndr/charge-me-up/

Btw: check the charge / discharge current of the device, on mine the current is halved which means that either someone forgot a *2 in the code or between developing and manufacturing it someone changed some components...

[diggit]

@DSchndr You have to subtract 2 ADC channels to get cell voltage so the worst case deviation is 12 mV. Probbly not that bad.
external mux has no benefit, but diff amps do.

I am aware of HAL availability and everything.
Feel free to work on porting cheali to this MCU.

Regarding wrong currents, did you calibrate your charger?

[Barrel0Memes97]

Any update for this clone? (CMS32L051) Is it flashable with the current release?

[agaletski]

Buying china clones like this we never know what surprises will arrive this time. I haven't checked currently possible variants, just thought -who will spent time to design clone on different CPU while Atmega32 is so inexpensive. And now I'm one more disappointed owner of "Imax B6 80W" charger (B6-CMS V12 board, based on CMS32L051 cpu)
Frankly, hardware is not bad and it looks like working but current software makes this device use inconvenient or even useless.
The main function CHARGING works correctly (current and voltage are close to selected) but mAh counter become zeroed just after charge finished. In DISCHARGE mode there is surprise. Real discharge current is half of selected. When you set 0.1A current device will not discharge battery at all. Capacity counter in discharge mode counts correct values, it will show 200mAh after hour discharge on 0.4A discharge set on device (the real disch. current is about 0.2A). But the capacity counter become zeroed when discharge process ended.

Is any further progress making this device usable ?
If no luck with porting software to CMS32L051, why not replacing this CPU with Atmega32 ?
I just though if CPU replacing is possible solution?

[Barrel0Memes97]

Is any further progress making this device usable ? If no luck with porting software to CMS32L051, why not replacing this CPU with Atmega32 ? I just though if CPU replacing is possible solution?

Replacing the CPU would be amazing if the shamanic supported it but I have no idea. Additionally this CPU seems to rarely have opamps integrated into the shamanic so its still less useful even with a CPU seap. Long-term I'll probably just buy a better charger instead of this but it would still be nice if cheap Chinese products like this were all identical.

[matiaschamu]

I recently acquired one of these chargers with a CMS32L051 and the truth is that the hardware doesn't seem that bad to me and the 12mv error is not very serious either.
I think we should try to integrate this CPU into this project because it is incredible how many chargers are on sale and people buy them for their good price vs their features. If you help me, I can spend some time trying to integrate this CPU into the project, I think it would be a fantastic idea. I received an STLink a week ago, I'm going to try connecting and trying to make a backup of the existing firmware to save it and start testing. I have a lot of experience in C++ with ESP32, Atmel and Microchip, but I never did anything with a CMS chip. That's why I tell you that if you help me get started I can help you a lot with the progress of the project.
Sorry my English is not very good :)