Help- hacking is my only option; need to talk to a washing machine via serial TTL to reverse self-destruct booby-trap
Help- hacking is my only option; need to talk to a washing machine via serial TTL to reverse self-destruct booby-trap
cross-posted from: https://lemmy.dbzer0.com/post/42322761
My broken 15 y/o w/m has a serial port tracing to an atmega32L chip. I have a USB to TTL adapter which is set for 5v (as opposed to 3.3v) using a jumper. The TX, RX pins are connected to the RX, TX pins of the w/m, respectively. The power supply pins (0v & 5v) are left disconnected.
I ran
minicom -D /dev/ttyUSB0 -b 9600on the PC with the w/m powered off. Minicom seems to default to an “8,N,1” configuration. When I power on the w/m, minicom flashes a popup saying something like “no connection to /dev/ttyUSB0”. This is a bit bizarre because if powering the w/m triggers that popup, obviously there is a connection of some kind.I do not have the service manual for the Beko WMD 26125 T and the mfr “lost” their copy. I have only scraps of service docs for a similar model that were leaked to a shitty manual jailing service. The circuit diagram of these docs label the serial port as “EEPROM” (as pictured). I suspect the ISP port is strictly for flashing (programming) the machine while the serial port is apparently for accessing the storage (to see the error state that is stored and perhaps clear it if I am lucky).
The goal is to confirm that the error code is “5” (my guesswork based on LEDs lit in binary [101]). The ultimate goal is to clear this fucking error off so I can use the machine. All components work when hotwired (motor, pump, inlet valves). I believe the error state is the machine caught in a lie. Normally the error states are cleared by pressing a secret button sequence, which the mfr witholds from the owners so they can charge us hundreds to do simple repairs.
What can I do without help from the manufacturer? Am I left with trying different baud rates and configs? What should I try? The w/m software is obviously a closed source, thus the serial config is kept secret from w/m “owners”.
Anti-repair rumor: manufacturers disable serial ports before shipping to block repair. But that practice may have started after my w/m was made ~15 yrs ago.
If no luck, you can get universal washing machine boards now - just hook up your bits and it's right to go.
Thanks for the suggestion. I’ve seen them in Indian YT videos. I’m half tempted but online shopping is mostly a non-starter for me and I don’t suppose I would find that locally. I bought an Arduino clone and some relays, which might be my nuclear option.
https://www.ebay.com.au/itm/405441142984 as a possible example. Dirt cheap.
Best of luck with resetting your current one.
That's some dedication. You checked all the actuators, but did you check the sensors as well? A speculation might be that, if one of them is busted, the controller stalls in error. I'm not sure what the story is with minicom reporting the serial being unavailable but if you have another microcontroller on which you could enable serial, you might be able to see more details. From my own experience, I would wire up a Raspberry Pi Pico, let it run Micropython REPL via USB to see if it catches anything at all. This way you are monitoring the serial before it goes through USB and the OS.
Since the error code possibly implies a drain pump issue, the pressure fill switch would be related. There is continuity across the two pins that are not taking voltage input. When I blow into the hose, the resistence make no change. But I guess it's not a proper test. I think I need to buy a multimeter that has a frequency (Hz) function to see if the frequency changes as the water level fills.
I tested the USB to TTL adapter itself by jumping the TX and RX pins. When I type something into Minicom the character echoes back. I could perhaps try to talk to an Arduino clone (which I have on hand).
You will absolutely need gnd to be hooked up to get anything out of it. If the baud rate was incorrect, you would probably receive garbage characters rather than nothing at all.
When I connect the ground pin of the adapter to the ground pin of the w/m, the TX and RX LEDs light up (either solid or rapid fire). That must be wrong, no? The tx and rx LEDs should flash when data traverses the circuit. If we could imagine that the w/m is transmitting data nonstop, certainly Minicom is not, so at least the TX LED should have stayed unlit. I could have something dodgy going on with my ground line.
Do you have a scope? Can you look at it's TX pin when you try to talk to it? If you can see any response on the pin you should be able to figure out the baud rate from looking at that.
i don’t have one. I’ll keep my eye out for a 2nd-hand handheld one in the local street markets.
Have you searched YouTube? They sometimes have tutorials on how to do hard resets.
For example claims you can try opening and closing the door six times for a hard reset.
I spent a lot of time on YT even to the point of watching Arabic videos of my model just to see what actions were taken. I tried the door latch-unlatch trick and unplugging for a long time.. holding the cancel button. Holding the 1st auxillary button. Not sure what else there is to try apart from serial comms.
AVCC is the supply voltage pin for the A/D Converter, PC3:0, and ADC7:6. It should be externally connected to VCC, even if the ADC is not used. If the ADC is used, it should be connected to VCC through a low-pass filter. Note that PC6..4 use digital supply voltage,
https://www.alldatasheet.com/datasheet-pdf/pdf/77391/ATMEL/ATMEGA32L.html
Check for VCC and AVCC voltage when the washing machine is on. I expect it to use it's internal clock, so it will be wired through a low pass filter on the board.
I’m trying to get a handle on what VCC and AVCC is. This thread gives some chatter on it but I’m still not correlating this to the TTL port.
They are talking about digital analog conversions with port C (and I think the eeprom serial port i am trying to talk to is port D).
Linux and UART is my weekness, but I wondered why you added a Baud Rate and did some digging.
This thread might be helpful.
Scrap the Baud rate and make sure you got the right permissions on /dev/ttyUSB0
I think they mean C for the clock (SCL) and D for the data (SDA) pin of the eeprom.
VCC is the power input of the microcontroller. Without Power, it wont work. AVCC is the power input of the ADC of the microcontroller. You still want to power it, even when unsused. You're connecting it directly to the VCC because it is desired to be exactly the same voltage. If not, the microcontroller likely wont work or act up.
In your case it's very likely the ADC is used as an internal clock, so you definitely need AVCC, but it's 99% likely that it's already connected as you need.
RX and TX are serial/uart interface. Without knowing what protocol / settings / encoding the embedded firmware actually uses it might be pretty difficult to get any data in or out. With a debugger/isp (e.g. bus pirate) you might be able to extract the firmware from the embedded micro and then disassemble it
A Bus Pirate would probably be ideal. But I don’t do cloud shopping. Guess I need to see if I can find that sold in a physical shop.
Absolutely try brute forcing with bad rates.