Dobrica Pavlinušić's random unstructured stuff
IMAX B6: Revision 31
{image: M051-LQFP-pins-800.png}

{file: RC-Power_BC6_Charger.pdf}

{toc: }

^ MCU

Nuvoton M0517LBN ARM Cortex M0

Nuvoton don’t guarantee the deviation of HIRC(22.1184MHz) for M0517.
M0517 is a special part number of M051 series.

^ Open source firmware

* https://github.com/stawel/cheali-charger
* https://groups.google.com/forum/#!forum/cheali-charger
* http://www.rcgroups.com/forums/showthread.php?t=1951734

^^ Flashing

https://groups.google.com/forum/#!msg/cheali-charger/2Rz-dtwZ5Is/zUGr3PzX9bcJ

pinout:

.pre
CHARGER -------------DONGLE
ICE_DATA <---------> SWDIO
ICE_CLK <---------> SWCLK
ICE_RST <---------> RST (on SWIM header on my programmer)
GND <---------> GND
VCC <---------> 5V
.pre

{image: isp_imaxB6_M0517.jpeg}

.pre
dpavlin@x200:/rest/cvs/cheali-charger$ cat .gitmodules
[submodule "utils/M0517_flash_tools"]
path = utils/M0517_flash_tools
url = https://github.com/sasam/M0517_flash_tools.git


dpavlin@x200:/rest/cvs/cheali-charger/utils/M0517_flash_tools/tcl$ openocd \
-f /usr/share/openocd/scripts/interface/stlink-v2.cfg \
-f target_MO517_linux.cfg \
-f M0517_flash.tcl -f M0517_unlock.tcl
.pre

If you get following error:

.pre
Error: init mode failed (unable to connect to the target)
.pre

Connect RST pin to GND while plugging in ST-Link v2 into computer. This will start M0517 in reset mode (you might see squares in first line of display).

Then, unplug RST pin from GND and connect it to RST and restart openocd. Your IMAX B6 is probably protected, so follow instructions below to unlock it.

Open telnet connection to openocd in other terminal:

.pre
dpavlin@x200:/rest/cvs/cheali-charger$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> FlashAprom /rest/cvs/cheali-charger/hex/unstable/cheali-charger-imaxB6-clone_1.99-20150727_nuvoton-M0517.hex
.pre

Output from openocd after successful flash:

.pre
Open On-Chip Debugger 0.9.0 (2015-05-28-17:08)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : The selected transport took over low-level target control.
The results might differ compared to plain JTAG/SWD
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
FlashAprom
EraseChip
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : clock speed 950 kHz
Info : STLINK v2 JTAG v23 API v2 SWIM v4 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.339130
Info : M0517.cpu: hardware has 4 breakpoints, 2 watchpoints
Info : accepting 'telnet' connection on tcp/4444
Image: /rest/cvs/cheali-charger/./src/hardware/nuvoton-M0517/targets/imaxB6-clone/cheali-charger-imaxB6-clone_1.00-20150617_nuvoton-M0517.bin; Size=34840; Sectors:69; FlashProces:(34840;3584,9;2584,1)
>>>> Load FlashPgm to SRAM: NU_M051x.bin => 0x20000000
target state: halted
target halted due to debug-request, current mode: Thread
xPSR: 0xc1000000 pc: 0xfffffffe msp: 0xfffffffc
276 bytes written at address 0x20000000
downloaded 276 bytes in 0.008215s (32.810 KiB/s)
>>>> FlashInit:
sp (/32): 0x20001000
pc (/32): 0x20000000
Error: timed out while waiting for target halted

Flash is locked!
Chip erase...
.
.
.
.
.
APROM: Erased!: (0x00000000):0xFFFFFFFF
LDROM: Erased!: (0x00100000):0xFFFFFFFF
Config: Erased!: (0x0030000):0xFFFFFFFF
Image: /rest/cvs/cheali-charger/./src/hardware/nuvoton-M0517/targets/imaxB6-clone/cheali-charger-imaxB6-clone_1.00-20150617_nuvoton-M0517.bin; Size=34840; Sectors:69; FlashProces:(34840;3584,9;2584,1)
>>>> Load FlashPgm to SRAM: NU_M051x.bin => 0x20000000
target state: halted
target halted due to debug-request, current mode: Thread
xPSR: 0xc1000000 pc: 0xfffffffe msp: 0xfffffffc
276 bytes written at address 0x20000000
downloaded 276 bytes in 0.008211s (32.826 KiB/s)
>>>> FlashInit:
sp (/32): 0x20001000
pc (/32): 0x20000000
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x41000000 pc: 0x20000048 msp: 0x20001000
r0 (/32): 0x00000000
>>>> FlashInit stop:
>>>> EreaseFlash: start
FLASH sector addr: 0x00000000
sectors to erease: 0x00000045
r0 (/32): 0x00000000
r1 (/32): 0x00000045
sp (/32): 0x20001000
pc (/32): 0x20000058
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x200000a2 msp: 0x20000fec
r0 (/32): 0x00000000
>>>> FlashErease: stop
>>>> FLASH image: /rest/cvs/cheali-charger/./src/hardware/nuvoton-M0517/targets/imaxB6-clone/cheali-charger-imaxB6-clone_1.00-20150617_nuvoton-M0517.bin to 0x00000000
>> Flash Sector: 0-6 => 0x00000000 (3584)
SRAM load : tmp/fl.00 => 0x20000120
FLASH addr: reg r0 0x00000000
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069231s (50.555 KiB/s)
r0 (/32): 0x00000000
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 7-13 => 0x00000e00 (3584)
SRAM load : tmp/fl.01 => 0x20000120
FLASH addr: reg r0 0x00000e00
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.068563s (51.048 KiB/s)
r0 (/32): 0x00000E00
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 14-20 => 0x00001c00 (3584)
SRAM load : tmp/fl.02 => 0x20000120
FLASH addr: reg r0 0x00001c00
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.068231s (51.296 KiB/s)
r0 (/32): 0x00001C00
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 21-27 => 0x00002a00 (3584)
SRAM load : tmp/fl.03 => 0x20000120
FLASH addr: reg r0 0x00002a00
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069227s (50.558 KiB/s)
r0 (/32): 0x00002A00
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 28-34 => 0x00003800 (3584)
SRAM load : tmp/fl.04 => 0x20000120
FLASH addr: reg r0 0x00003800
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069238s (50.550 KiB/s)
r0 (/32): 0x00003800
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 35-41 => 0x00004600 (3584)
SRAM load : tmp/fl.05 => 0x20000120
FLASH addr: reg r0 0x00004600
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069181s (50.592 KiB/s)
r0 (/32): 0x00004600
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 42-48 => 0x00005400 (3584)
SRAM load : tmp/fl.06 => 0x20000120
FLASH addr: reg r0 0x00005400
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069107s (50.646 KiB/s)
r0 (/32): 0x00005400
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 49-55 => 0x00006200 (3584)
SRAM load : tmp/fl.07 => 0x20000120
FLASH addr: reg r0 0x00006200
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.069117s (50.639 KiB/s)
r0 (/32): 0x00006200
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 56-62 => 0x00007000 (3584)
SRAM load : tmp/fl.08 => 0x20000120
FLASH addr: reg r0 0x00007000
SIZE addr: reg r1 0x00000e00
BUFFR addr: reg r2 0x20000120
3584 bytes written at address 0x20000120
downloaded 3584 bytes in 0.068143s (51.363 KiB/s)
r0 (/32): 0x00007000
r1 (/32): 0x00000E00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>> Flash Sector: 63-68 => 0x00007e00 (2584)
SRAM load : tmp/fl.09 => 0x20000120
FLASH addr: reg r0 0x00007e00
SIZE addr: reg r1 0x00000c00
BUFFR addr: reg r2 0x20000120
2584 bytes written at address 0x20000120
downloaded 2584 bytes in 0.050122s (50.346 KiB/s)
r0 (/32): 0x00007E00
r1 (/32): 0x00000C00
r2 (/32): 0x20000120
sp (/32): 0x20001000
pc (/32): 0x200000AE
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000010c msp: 0x20000ff4
r0 (/32): 0x00000000
>>>> FLASH image: stop
>>>> Verify: verify_image /rest/cvs/cheali-charger/./src/hardware/nuvoton-M0517/targets/imaxB6-clone/cheali-charger-imaxB6-clone_1.00-20150617_nuvoton-M0517.bin 0
target state: halted
target halted due to breakpoint, current mode: Thread
xPSR: 0x61000000 pc: 0x2000002e msp: 0x20000ff4
verified 34840 bytes in 0.226838s (149.990 KiB/s)
Trajanje init: 0 sec
Trajanje brisi: 2 sec
Trajanje pisi: 2 sec
Trajanje ukupno: 4 sec
.pre

^^ Update

.pre
dpavlin@x200:/rest/cvs/cheali-charger/utils/M0517_flash_tools/tcl$ openocd -f interface/stlink-v2.cfg -f target_MO517_linux.cfg
Open On-Chip Debugger 0.9.0 (2015-05-28-17:08)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : clock speed 950 kHz
Info : STLINK v2 JTAG v23 API v2 SWIM v4 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.239563
Info : M0517.cpu: hardware has 4 breakpoints, 2 watchpoints


# in other terminal

dpavlin@x200:/rest/cvs/cheali-charger/utils/M0517_flash_tools$ telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> source M0517_flash.tcl
FlashAprom

> FlashAprom /rest/cvs/cheali-charger/hex/unstable/cheali-charger-imaxB6-clone_1.99-20150727_nuvoton-M0517.hex

.pre

^ Serial port

* http://www.rcgroups.com/forums/showthread.php?t=1046318
* https://groups.google.com/forum/#!topic/cheali-charger/VATJQ4-GpVE%5B1-25%5D

.pre
1 2 3

1 - +5V
2 - TTL TX serial / Vout of LM35
3 - GND
.pre

^^ LogView

^^^ tsv

.pre
grep '$1' cheali.log | sed 's/;/\t/g' | xclip -selection clipboard -i
.pre

^ temperature sensor

cheali-charger version 1.99:

The "Hard way" (any temp probe):
1. connect external temp probe
2. check if there is 5V on temp. connector (between pin 1 (GND) and pin 3)
3. go to: "options"-> "calibrate"->"temp extern"
(first calibration point: point 0)
4. set "temp:" to your room temperature (~20°C)
(second calibration point: point 1)
5. set "calib. p.:" to 1
6. heat temp. sensor to 60°C
7. set "temp:" to 60°C (the temperature sensor should be at 60°C at this moment)

The "easy way" (LM35, LM35DZ):
1. connect external temp probe
2. check if there is 5V on temp. connector (between pin 1 (GND) and pin 3)
2. check sensor output voltage, should be: ~0.20V (between pin 1 (GND) and pin 2)
3. go to: "options"-> "calibrate"->"temp extern"
(first calibration point: point 0)
4. set "temp:" to your room temperature (~20°C)
(second calibration point: point 1)
5. set "calib. p.:" to 1
6. disconnect temperature probe
7. make a shortcut between pin 1 (GND) and pin 2 on the temperature connector (simulate sensor output voltage = 0V)
8. set "temp:" to 0°C

^ backup calibration

^^ memory map

Table 6.13-1 Memory Address Map

| Block Name | Size | Start Address | End Address |
| AP-ROM | 8/16/32/64KB | 0x0000_0000 | 0x0000_1FFF (8KB) |
| | | | 0x0000_3FFF (16KB) |
| | | | 0x0000_7FFF (32KB) |
| | | | 0x0000_FFFF (64KB) |
| Data Flash | 4KB | 0x0001_F000 | 0x0001_FFFF |
| LD-ROM | 4KB | 0x0010_0000 | 0x0010_0FFF |
| User Configuration | 1 Words | 0x0030_0000 | 0x0030_0000 |

^^ backup

.pre
> init
> dump_image aprom.bin 0x0 0x10000
dumped 65536 bytes in 0.638086s (100.300 KiB/s)

> dump_image flash_data.bin 0x1f000 0x1000
dumped 4096 bytes in 0.042080s (95.057 KiB/s)

> dump_image ldrom.bin 0x100000 0x1000
SWD DPIDR 0x0bb11477
Failed to read memory at 0x00100000

> dump_image config.bin 0x300000 0x1000
SWD DPIDR 0x0bb11477
Failed to read memory at 0x00300000
.pre

^ serial tx and rx on chip pins

* pin 5 - P3.0 RX
* pin 7 - P3.1 TX

{image: M051-LQFP-pins.png}