Easytouch V1 to V2 brain transplant

[ogdento]

Ever since I read Jerryt's firmware update post back in 2015 I've wanted to swap the micro-controller chip on a "V1" Easytouch with one that will make a "V2" Easytouch... I finally did it tonight and it works! Figured I'd document the process in case anybody else felt like tinkering...

Background: the V1 and V2 boards are identical except for the microcontroller used. The V1 microcontroller only has 64k of flash which can only fit firmware up to 1.060, and the V2 boards have a 128k flash chip. I wrote a more detailed post about it here: What's the deal with Easytouch versions 1 and 2?

To do the swap, the first step was to get a microcontroller with 128k flash... I had an Easytouch V2 remote with a bad keypad, so I cut it open to grab a donor microcontroller. The indoor, outdoor and wireless controllers all use the same chip but I'll have to update the firmware since the wireless controller firmware is different than the outdoor.

The main benefit to using a donor chip was that I didn't know if the bootloader was part of Pentair's firmware file, and the thing won't run without a bootloader! Another user (Xulan) in Jerry's thread swapped the chips on their Suntouch? but I never got a reply on whether they had to write the bootloader separately. My guess is they did not, and the bootloader is contained in the firmware file... because the firmware update routines appear write to ALL flash locations on the chip, I figure it must contain the bootloader code. I can verify this if I do another transplant with a new blank chip.

To pull the chip, I first added some lead solder (lower melting point than the lead free stuff) and lots of flux to all the pins. I then used my hot air gun with this QFP tip to remove the chip:


Here's my V1 board with the chip pulled off. just gotta go around with some solder wick and clean up the pads:


Here's the old chip... see the 9S12A64 marking (the "64" indicates the flash size). Pretend you don't see the capacitor that came off with the chip... I used a heat shield!


Getting ready to scavenge the donor chip. Not really sure why I used the heat shield again since this is now a donor board:


Donor chip fitted on the old V1 board (still have to clean up the flux a bit):


After re-fitting the LCD and updating the firmware to an Easytouch V2 Outdoor 2.190... it lives! Guess I gotta pull off that "V1" sticker now/


For my next transplant I'll use a fresh chip rather than a donor... I've got an Easytouch V1 indoor controller with a bad comm chip, so I figure I might as well convert this one to a V2 when I pull the LCD and replace the comms. If all goes well I can use it for testing on my bench.

 

[DrewLG]

The main benefit to using a donor chip was that I didn't know if the bootloader was part of Pentair's firmware file, and the thing won't run without a bootloader!

When I updated my ET to the latest v2.190 firmware, I had to use a Background Debug Mode programmer. The "bootloader" that makes BDM flash programming possible is stored in the HCS12's ROM (when enabled, it appears at $FF00-$FFFF), so even a blank chip has it.

 

[ogdento]

Hey Drew, thanks for the note... you're right about having to use a BDM programmer - I still use an old PE-Micro parallel port programmer that I got pretty cheap.

I don't think the bootloader I'm talking about is the same as the built-in BDM code you mentioned that lives at $FF00:


I'm talking about what you see from "Menu > Diagnostics > Bootloader Rev" (it's right after "Software Rev"):

That's got to be Pentair code, and I'm not sure what it's for... my guess would be that it's got to do with the "Flash Update" option (Menu > Diagnostics > Flash Update) which I've never used.

After checking out the prog12z algorithm and the .cfg file being used, I'm pretty sure the code for whatever "Bootloader Rev" refers to is in the "Easytouch_Outdoor_2190.s19" file, since a full erase happens before programming. So I think I was worried about nothing, but I'll know for sure after my new blank chips arrive!

 

[DrewLG]

I'm talking about what you see from "Menu > Diagnostics > Bootloader Rev" (it's right after "Software Rev")

Oh, I see. Didn't remember ever seeing that screen.

That's got to be Pentair code, and I'm not sure what it's for... my guess would be that it's got to do with the "Flash Update" option (Menu > Diagnostics > Flash Update) which I've never used.

Interesting. That's the usual way to update firmware -- load a bootloader and initial version of the application at the factory using a specialized interface like BDM, then later use the bootloader for app updates over some common PC interface that every laptop has. So I wonder why Pentair's 520957 programmer seems to be a full-blown PEmicro Multilink rather than just something like a USB-to-TTL-serial cable. Maybe the bootloader was never reliable?

I didn't take photos when I had my ET opened up. There isn't anything like an empty 3- or 4-pin header on the board, is there? Possibly wired to the HCS12's UART?

 

[ogdento]

So I wonder why Pentair's 520957 programmer seems to be a full-blown PEmicro Multilink rather than just something like a USB-to-TTL-serial cable. Maybe the bootloader was never reliable?

Hey Drew, that's exactly what I was thinking! As you said... a bootloader usually lets you initiate a firmware upload when do something like press a button at power-up, or even select a "Firmware Update" option from a diagnostics menu I could see them trying to add a "no-bdm-programmer-required" update method - and then abandon the idea. Heck, the Intellitouch has a connector for 6 aux inputs that as far as I can tell aren't used for anything.

I also wondered if the "Firmware Update" option did something to keep the chip powered when doing an update... so you would enable that instead of having to hold the menu/power button down when updating a wireless remote, but it had no effect when I tried it.

Here's a shot of the back side of a board:


The only header specific to the microcontroller is the 6-pin connecter for the BDM programmer... but there's an unpopulated 2-pin "Ext Ctrl" header (also has no parts fitted on the top-side), and a 4-pin "Mod-telspa" header (2 of those pins are used for identifying "lite" models). Maybe the micro's rx/tx or spi pins went somewhere, and were "enabled" by selecting the "Firmware update" option. The I2C SCL pin, and the SPI0 pins 72 and 73 are unconnected so they're out, but the pins for SCI (0 and 1) and SPI1 are all connected... could just be configured for general I/O or pwm, but I'll check.

 

[ogdento]

Well, I followed up on @DrewLG s note to see if any microcontroller pins were brought out to any of the physical connections on the board, and I didn't find any.

But I did two more "tests" that showed that the firmware file we use to do the update has the bootloader code...

1. I had an Easytouch V1 indoor controller so I did a second transplant on it to try and make it a V2, but I used a new blank chip this time... after updating the firmware it identified as a V2 - SUCCESS!
2. I also had an Easytouch V2 outdoor controller that had been in a storm which killed the micro-controller (and the comms too)... the board was drawing a lot of power, and my IR camera showed the micro-controller was getting way too hot. I replaced that chip with a blank one, re-flashed, and now it's working fine - SUCCESS!

The take-away is that you can start with a blank chip and flash with the latest firmware... which also means you can replace a dead micro-controller. The chips have 112 pins so it takes some time and is a bit fiddly, but it's definitely doable

 

[ogdento]

Here's the outdoor board with the new micro...


Here's the new 128k micro on the formerly "V1" indoor controller... It's got a keypad from a lite because I was messing with that too.