Program Data (PIC) verschiedene DeLonghi Maschinen - Diskussionsthread

[Ano]

So 4408 is 8 blinks - 0 blinks - 4 blinks - 4 blinks - 0 blinks?
So then you probably should look for 8 0 4 4 0. I see something similar / close to that: 00 08 44 00.
Just try as I said. And then figure out some sort of checksum.

 

[Poppa]

So 4408 is 8 blinks - 0 blinks - 4 blinks - 4 blinks - 0 blinks?

That is correct.
I can not find 00 08 44 00 but 00 08 00 44
It's kind of breaking the enigma code
I don't believe that there is a checksum. They have redundant data. It's probably much easier.

Have you ever been able to change the counter to any desired number?

 

[Ano]

I once changed the cups of coffee in my machine, just making it 1 cup higher - but that didn't work. So there must be something else.

Or maybe the numbers are related: a fixed ration between the sum of all cups and the amount of water, that's possible. Could also be the reason it didn't work, instead of a checksum.

 

[Poppa]

a fixed ration between the sum of all cups and the amount of water

No. That wouldn't work. I have got two identical machines. One is of 2012 and the other of 2017

The 2012 has counted:
# Coffee: 8721
Water: 1129
# descaling: 14

The 2017 has counted:
# Coffee: 4408
Water: 2253
# descaling: 7

So even though the number of coffees is doubled on the 2012 machine the amount of water is only half of that compared to the 2017 machine. So it might be that somebody used the 2017 machine just to boil water for tea.

My machine, the ESAM3000.B EX:1, is quite simple. So if we figure out how data is stored here, we might be able to transfer this knowledge to other machines.
If you look at the memory table, only half of the memory is used, and the memory used is stored twice. So it is just 68 byte we need to worry about.
What needs to stored in a non volatile memory?

Setting as:
Waterhardness (four stages) 1 = 0-7°DH ~ 250L, 2 = 7-14°DH ~ 130L, 3 = 14-21°DH ~ 80L, 4 > 21°HD ~ 40L
Shut down time (five stages) 1 = 900sec, 2=1.800sec, 3=3.600sec, 4=7.200sec, 5=10.800sec
Eco Mode (toggle) Yes/No

Counters:
Number of coffee pucks in the container since it was emptied the last time.
Total Number of coffees drawn. Does a two cup draw count as 1 or as 2? It is just one draw.
Total Amount of water used. What would be the unit here? Number of counter impulses? Got an idea how the flow meter works?
Amount of water used since last descaling
Number of descalings
Number of washings. (my machine can not do that)

If you were a software engineer. What else would you store there?
Machine type
Serial #
Software Version and Revision
Total POWER ON time (the microprocessor is powered as soon as the main switch is ON)
- That is unlikely. The Processor has got no time to put that into memory if mains power is switched off.
Total machine ON time
Your girlfriends telephone number (who knows ;-))

Have you managed to read data from a powered up machine or will this always result in an short circuit?
We only need to establish a data transmission. Can this be done in an electrically isolated way? It is just the three connections: Program Data, Program Clock an MCLR. Maybe with an opto coupler? I am not the electronic guy.

Regards, Poppa

 

[Ano]

Total Amount of water used. What would be the unit here? Number of counter impulses? Got an idea how the flow meter works?

Look here: Program Data (PIC) verschiedene DeLonghi Maschinen - Diskussionsthread (post #332).
So in my case it was "TOT. WATER: 2872".

 

[Poppa]

Leider habe ich die nächsten Tage keine Zeit mich hier weiter zu kümmern. Eventuell geht es am Wochenende weiter.
Unfortunatelly I haven't got time to investigate further into this issue, within the next days. Maybe I find some spare time on the weekend.

Kindest regards,
Viele Grüße,
Poppa

 

[Achimle]

Kann aus auslesen der Hex Dateien auch jemand bei den WMF Maschinen 1000/800 ?

 

[Poppa]

Kann aus auslesen der Hex Dateien auch jemand bei den WMF Maschinen 1000/800 ?

Doch. Ich denke schon das das jemand kann.

Gruß, Poppa

 

[Poppa]

Ano

I did some systematic changes to my machine and read the EEPROM data in between.
My intention was, to find out which setting effects which byte. It is not as easy as we thought it would be.
I think, just turning mains ON increases a counter. Whatever setting is changed, it seems that the addresses 11 12 are always involved. I stored the EEPROM window as JPG because it might be helpful to flick through the pictures in order to see what has changed.
If you like riddles, open the adjacent zip file and read the Test_order.txt. It describes what I have done in which order.
I haven't found the decipher key yet. Maybe you have got more luck.

regards, Poppa

 

[Achimle]

Auslesen wird wohl gehen, aber die Hexfiles aus der Maschine speichern wird nicht so einfach sein ?

 

[Poppa]

Ich hatte gestern einmal kurz geschaut. Deine Maschine hat nicht nur einen ganz anderen Prozessor als unsere, auch über die Schnittstellen deiner Platine ist hier nichts bekannt.
Ich denke da müsstest Du in dem Forum für Deine Maschine suchen. Evtl hast Dort Glück.

Gruß, Poppa

 

[Achimle]

Über die Schnittstelle gibt es genug Infos.Wir reden hier von der WMF 1000 und die geht über seriell.Kabel hab ich sogar Kabellose Verbindung wenn du das meintest.
Hexfiles hab ich auch ein paar alte.

 

[Achimle]

Und ein anderes Forum wo Infos rausrückt gibt es nicht.Das hier ist das beste Forum seit Jahren.

 

[Poppa]

Ich bin mir sicher, dass die Schnittstelle und der Prozessor ausführlich dokumentiert sind. Nur befürchte ich, dass das hier niemand kennt.

Du weißt schon, dass du hier im DeLonghi Forum bist?

Gruß, Poppa

 

[Achimle]

Weiss ich.Es geht mir rein ums das Programmieren flashen.Gibt es da schon ein Thread ?

 

[Poppa]

In Program Data (PIC) verschiedene DeLonghi Maschinen - Diskussionsthread I identified 6 data blocks in the EEPROM memory. Each block is mirrored once so the there are only 3 different blocks of data.

Block 1 - address 00 to 12 / block 2 (mirror of 1) - address 13 to 25
Block 3 - address 26 to 3E / block 4 (mirror of 1) - address 3F to 57
Block 5 - address 58 to 6E / block 2 (mirror of 1) - address 6F to 85

EEPROMs are used to store non volatile data such as settings and counter data. They have to remain, even if the machine is powered off.
With some systematic testing I detected that the setting for water hardness is stored block 1, in address 00 and auto shut off setting is stored in 0D.
I haven't figured out how the checksum of data blocks are calculated yet. The checksum seems to be a two byte word on the end of each block.
Block 3 is not effected by changing settings.
Block 5 seems to store some timer data. As the content changes just by powering the machine up (not turning it on).

If you would like to know more details, please read the adjacent txt files.

regards, Poppa

 

[Poppa]

The amount of water for my machine is stored in the addresses 63 64 65

44EB88 (hex) = 4516744 (dec) divided by 2000 = 2258,372 Litre (flow meter gives 2000 pulses per liter)
counter showed 2258
44F12A (hex) = 4518186 (dec) divided by 2000 = 2259,093 Litre
counter showed 2259

The content of block 3 and it's mirror block 4 is neither effected by changing settings nor by drawing coffee and/or water. I believe these blocks are used to store some machine data such as serial number and/or software version and revision.
It could as well be that these blocks hold a key to calculate the checksum.

I haven't found where the number of coffee draws is stored yet. I started with 4414 draws +2cups +2cups and read the EEPROM data in between. But I couldn't find data which relates to that number.
What happens when a coffee is drawn?

• coffee counter goes up
• water counter goes up
• number of trester in bucket goes up
  
• remaining water to next descaling goes down
• machine "on time" goes up
• if there is a timer for the coffee grinder, it would go up
• what else?

I am helpless. Not only that I don't find the counter data but I don't know how the checksum is calculated either.

Has anybody got an idea?

 

[Ano]

serial number

I don't think so. Would be far to mcuh effort to hard-program the serial number into the machine. I assume the only place where it is present is on the sticker at the bottom of the machine. (Furthermore, if you buy a new power pcb this data would be lost anyway)

Maybe you can post two hex files before and after making 1 coffee (without making any changes to settings)?

 

[Ano]

Kann aus auslesen der Hex Dateien auch jemand bei den WMF Maschinen 1000/800 ?

Was fuer einen Mikroprozessor wird gebraucht in dese WMF Maschinen? Foto?
GIbt es einen separates EEPROM chip auf Platine? Foto?

 

[Achimle]