3 Replies Latest reply on Oct 11, 2019 1:24 PM by NiMc_1688136

    Power fail and then module appears bricked

    NiMc_1688136

      During a battery discharge test, we let our product discharge until the battery cut off. At the moment we believe there is a hw issue with our battery controller that allows the battery to connecting and disconnecting as a source when it is at a low threshold but that is a different issue. During this rebounding behavior of the battery, i managed to catch one device entering a watchdog timeout in app code, somewhere in the wiced_init function. These watchdogs appears to have forced a factory image rollback. At this point, 3 of the devices would not recover with a power cycle and had to be reflashed through the JTAG port to recover them.

       

      I dumped the flash contents of these 3 devices:

      * The application spaces look good, no overwrites or partial writes

      * The DCT1 and DCT2 sections are mostly erased

      Here is the first 128 bytes of DCT1, from one device

      00 00 00 00 00 00 00 00 00 01 00 42 52 43 4D FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 14 BE 68 00 00 01 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

      Here is the first 128 bytes of DCT2, from one device

      00 00 00 00 00 00 00 00 01 01 00 42 52 43 4D FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 14 BE 68 00 00 01 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

       

      * The DCT Save area is not erased

      Here is the first 128 bytes of DCT Save area, from one device

      40 00 00 50 1F 00 00 00 01 01 00 42 52 43 4D 02 00 00 00 44 C0 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 14 BE 68 00 00 01 00 00 00 00 00 00 02 00 00 00 00 C0 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

       

      To me, it seems that the factory image was in progress of being extracted, the old DCT was pushed to the save area and then something happened while erasing or writing the DCT1/2 areas.

       

      What should happen if the DCT is corrupt?

       

      At this point, the boot process appears to have been corrupted.

       

      I looked a little further into the DCT, at the ota2 section, around offset 7972

      FF FF 02 01

      Update count = 0xFFFF

      Boot type = 0x02

      Force Factory Reset = 0x01

       

      Any ideas what happened? This does not seem completely fail safe.

       

       

      Proc: CYW43907

      SDK: 6.2.1

        • 1. Re: Power fail and then module appears bricked
          NiMc_1688136

          After a power cycle there was no serial output from the ota2 extraction app (enabled).

          The bootloader does not have stdio enabled

          The failsafe app did not print anything (enabled)

          • 3. Re: Power fail and then module appears bricked
            NiMc_1688136

            On the device from earlier in the week, during the watchdog events on boot, there is garbgage data for the DHCP CLIENT hostname line, which i think is from the DCT. Could there have been either a DCT corruption with this device too, or the voltage was too low to read from flash?

             

            "10/8/2019 1:25:02 PM",Starting WICED vWiced_006.002.001.0002

            "10/8/2019 1:25:02 PM",Initialising LwIP v2.0.3

             

             

            "10/8/2019 1:25:02 PM",Starting WICED vWiced_006.002.001.0002

            "10/8/2019 1:25:02 PM",Initialising LwIP v2.0.3

            "10/8/2019 1:25:02 PM",DHCP CLIENT hostname ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

            "10/8/2019 1:25:03 PM",Starting WICED vWiced_006.002.001.0002

            "10/8/2019 1:25:03 PM",Initialising LwIP v2.0.3

            "10/8/2019 1:25:03 PM",DHCP CLIENT hostname ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

             

             

            "10/8/2019 1:25:03 PM",Starting WICED vWiced_006.002.001.0002

            "10/8/2019 1:25:03 PM",Initialising LwIP v2.0.3

            "10/8/2019 1:25:03 PM",DHCP CLIENT hostname ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

            "10/8/2019 1:25:03 PM",Starting WICED vWiced_006.002.001.0002

            "10/8/2019 1:25:03 PM",Initialising LwIP v2.0.3

            "10/8/2019 1:25:03 PM",DHCP C