Announcement

Collapse
No announcement yet.

Bowflex nautilus firmware woes

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Bowflex nautilus firmware woes

    Hi Folks i dont post much but i have need today please read on and maybe we can get these things sorted.

    I am on a health drive and last week bought a Bowflex max M7 to push on with my desire to get fitter but it was bought with a none functional "console screen" though the screen is dead the machine still works fine you can adjust the resistance manually like a bicycle brake adjustment it is cable fed but i want the programs and heart rate/calorie functions for my health drive. A new console is available but im getting quoted £520 or thereabouts and Bowflex as of yet have not offered any other solution and i dont think they will since they filed for Bankruptcy last March!

    So, having some small skills in electronics I thought it would be a straightforward fix knowing the problem occurred when the previous owner decided to try powering it up with a laptop power supply of 19v when it really needed its own 9v DC supply. Doh! So these things are properly expensive new this model retailed at £1700? maybe, more to the point is Bowflex/Nautilus seem to have gone cheap on the power delivery providing just a standard 5mm socket that any old supply plug could fit into yet its rated strictly at 9v DC and no labels or warning marks on the unit at all. The wiring loom inside is a mess its been badly made in the factory with wire colours all mixed up at each junction so tracing it was a pain but whatever is plugged into the 5mm power socket feeds direct onto the console board there is no further protection other than a buk converter that feeds regulation on the board and thats why 19v seems to have damaged the BUK converter and destroyed a regulator fed off of it which in turn supplied the CPU among other things but gladly many parts where tolerant to 19v but defo not the PIC CPU which contains the firmware including separate boot loader as far as i can determine - this is my current theory anyway just waiting on new buk and sop23-5 regulator to restore power but not before i remove the CPU!!!. There is an additional 8Mbit flash chip for maybe user data not sure but it survived enough to have its content extracted so in a long winded way does anybody have the firmware for this equipment or does a fellow electronics enthusiast have this model by chance and also fancy deploying a PICkit3 programmer in order to extract cpu fw? The ICSP pin headers are present on the board i have, i would say they all got made the same so it would take just 5 minutes "he says".... :-)

    The fried chips on the board seem to be readily available other than the LCD driver chip which is a bit harder to find but its not on the end of the fried regulator so it may have survived so im ready to rebuild it soon and need to find the firmware, Nautulis/Bowlfex arent seeming to be interested being in receivership...

    #2
    Waah? 19v instead of 9v? I think your are getting a bit too far ahead of yourself. Fix what's broken (the buck converter and the regulator), maybe the main chip and the LCD still works. See what that result is first.

    Comment


      #3
      There is still a short somewhere after the voltage regulator (removed) that is fed by the BUK measured as 0.7 ohm to ground the smd cap smoothing the output to GND was open i was hoping short but hey ho and this line supplies cpu among others i think its supposed to be 2.85v with something like 3.3v coming into it from the BUK. Ive probed about and figured out the power distribution on this board and removed the odd cap for testing my guess is the short is in the CPU as it has the most connections to the regulator and ground and it has the lowest tolerance max voltage of all the components fed by the regulator many of those can stand 19v ok it seems but there may be some texas instrument chips to look at.

      The only thing i know to do now is remove the cpu and see if that cures the short to ground from the primary regulator, i could faf and lift up the 4 ground pads it has but the chip has a bit of a shine to it on one edge i suspect it got very hot and smoked out then the BUK current limit kicked in and saved the day but it got hot and hurt to as did the regulator. I intend to replace just the BUK first and see how that looks as it supplies other regulators including the lcd chip, cant do main cpu regulator till the short is located/solved

      Here is the cpu it doesnt look great do you think?

      Click image for larger version  Name:	S20240611_0001.jpg Views:	0 Size:	1.82 MB ID:	3288517

      Comment


        #4
        nothing obvious there
        usually with flat packs like that they blow a hole in the top or round a pin.
        it looks rubbed or maybe it has a coating on it of some sort.
        post a picture of the rest of the board

        Comment


          #5
          Apply power (2.5 - 3v) from the laboratory power supply to this bus and increase the current, see what will heat up...

          Comment


            #6
            Hi folks. I will post a board photo later tonight when i have time and maybe treat you to a diagram of my reverse engineering of the power distribution on this board...

            I was thinking about this situation last night in bed trying to get to sleep that i never measured the resistance between vcc and gnd of the pic32 icsp port headers that are soldered onto the board and i got up today its the first thing i did as the kettle boiled for morning coffee to see if there is a chance the 512KB integrated flash in the chip survived the over vault situation but sadly not this to is measuring 0.7ohm so i think its conclusive unless one of those pesky smd caps on the vcc into the cpu chip has gone short (or similiar on one of the other ic's which i doubt) and there are only 4 to remove to test so i might do that next rather than lift the chip prematurely but i dont think theres much in it...

            So regarding injecting current restricted voltage to go fault finding, i dont have a bench psu to do it but i do have a cheap old unregulated dc power supply the kind with a sliding switch to change the voltage from 4.5v upto 12v and its 400ma max so nicely suitable for the job. What i did was set it low at 6v and use that to find the regulator faults i found without topping out the BUK. I had the led's on the board semi lit like that but the BUK got very hot and eventually limited itself with small amounts of stench and i measured only 400mv on its ip the BUK was the only thing getting hot to the touch i could detect so i went up stream to find the short circuit and landed at U18 after a considerable effort to trace it all and U18 is the the main voltage regulator that feeds the PIC cpu it is in fact a sop23-5 marked "L1RC" - linear regulator ADP3309ARTZ-2.85 OR ME6221CM5G. Both slightly rare these days not found on mouser or anything it seems but sourced on fleebay and ordered... U18 is tiny compared to other regulators on this board, its a weak point for sure given what it drives....

            Comment


              #7
              I agree with lotas. And you need to have a PSU that is CC an CV controlled and some 99% IPA for that power injection method. Also something that that measures micro ohms (not milli) will also work to find the shorts. I found the 2.85v regulator no problem at Mouser. They got a 1000 pieces of them in stock. Lol
              Last edited by CapLeaker; 06-12-2024, 11:19 AM.

              Comment


                #8
                Originally posted by CapLeaker View Post
                I agree with lotas. And you need to have a PSU that is CC an CV controlled and some 99% IPA for that power injection method. Also something that that measures micro ohms (not milli) will also work to find the shorts. I found the 2.85v regulator no problem at Mouser. They got a 1000 pieces of them in stock. Lol
                I dont do this very often so i dont have a bench PSU on hand though i might get one and a way to measure micro ohms sounds good but alas i have never tried that either because i dont have the kit (at present). I did not find the specific regulator I was looking for on mouser, im sure there are plenty that are compatible but i refer you to opening statement in this reply but i do appreciate you looking in and laughing, can you show me where i asked for help to find the fault? All i need is firmware really can you help with that?

                Comment


                  #9
                  Originally posted by lotas View Post
                  Apply power (2.5 - 3v) from the laboratory power supply to this bus and increase the current, see what will heat up...
                  Its a great idea with the limited kit i have i did that already, a thermal camera would knock out the park but now im at the price of just buying a new console for £520 and thats no fun at all.

                  Comment


                    #10
                    Originally posted by CuriousJohn View Post

                    I dont do this very often so i dont have a bench PSU on hand though i might get one and a way to measure micro ohms sounds good but alas i have never tried that either because i dont have the kit (at present). I did not find the specific regulator I was looking for on mouser, im sure there are plenty that are compatible but i refer you to opening statement in this reply but i do appreciate you looking in and laughing, can you show me where i asked for help to find the fault? All i need is firmware really can you help with that?
                    As for short finders there are things like a Leakseeker 89 for example. As far as it goes for firmware, I think you are going to be out of luck, unless you find someone that has a working machine and can dump the contents of the chip for you.
                    A thermal imager is not needed. A bottle of 99% IPA is all you need to make things visible. Pure alcohol will boil off rapidly when it gets in touch with heat. To 90% of my repairs like this, all I use is a triple voltage bench PSU and 99% rubbing alcohol. Even so I do have a thermal imager to my disposal.

                    Comment


                      #11
                      Yes, we don't need alcohol here yet, we need to make sure the controller is alive or not, you can check with your finger, if when you apply 3v power it immediately heats up to a high temperature, then the problem is there. The main thing is to observe polarity when supplying power!
                      Last edited by lotas; 06-12-2024, 05:07 PM.

                      Comment


                        #12
                        Originally posted by CapLeaker View Post

                        As for short finders there are things like a Leakseeker 89 for example. As far as it goes for firmware, I think you are going to be out of luck, unless you find someone that has a working machine and can dump the contents of the chip for you.
                        A thermal imager is not needed. A bottle of 99% IPA is all you need to make things visible. Pure alcohol will boil off rapidly when it gets in touch with heat. To 90% of my repairs like this, all I use is a triple voltage bench PSU and 99% rubbing alcohol. Even so I do have a thermal imager to my disposal.
                        Thank you for the tips i have IPA on hand so will think about that one and these days bench psu are not to expensive and it would be a sound investment.

                        I am glad to say by the weekend I should have access to a working console unit but one thing i did learn yesterday after trying one out for the first time on another machine miles away is the cpu sends the entire thing to sleep in 5 minutes so all leds and the lcd are cathode controlled by the processor and there are transistors scattered about performing this function. I know its theory of operation but it all helps to understand the board it is very similar to a modern tv main board in many ways.

                        Comment


                          #13
                          Originally posted by lotas View Post
                          Yes, we don't need alcohol here yet, we need to make sure the controller is alive or not, you can check with your finger, if when you apply 3v power it immediately heats up to a high temperature, then the problem is there. The main thing is to observe polarity when supplying power!
                          I agree, my next step is to restore the BUK only and see if everything but what is fed by U18 voltage regulator (fed from BUK) is happy. Then i have the task of checking all coupling capacitors to every chip on the bus as there is nothing else i can find to suspect but as i said i really do feel the cpu is done as its the weakest point having lowest maximum voltage tolerance of all chips on the bus and most connections to ground and bus (think ohms law with loads in parralel) but to determine that none destructively is the prize and i am now considering injecting current controlled 2.85v down the faulty bus and going hunting with my finger and nose.

                          Below is another photo of the PIC32 chip and it shows the shiny side i mentioned which i believe is heat caused, the chip has not been polished or rubbed to summon some gene lol i just cleaned it with IPA a couple of times with a Q tip. Maybe its ok yet to be determined....

                          Click image for larger version

Name:	IMG_4363.jpg
Views:	46
Size:	458.6 KB
ID:	3289527

                          Comment


                            #14
                            Thanks for the tips folks the IPA CC CV method is pretty cool i bought a USB pwoer supply with CC CV function for cheapish much cheaper than a bench psu anyway and it worked.



                            Attached Files

                            Comment


                              #15
                              Bowflex Max M7 console board power distribution and stuff

                              Click image for larger version  Name:	Bowflex_Max_M7_console _power_diagram.png Views:	4 Size:	3.28 MB ID:	3291001

                              Comment


                                #16
                                MCU removed and S/C resolved.

                                Next problem after installing new PIC32 is tp flash it with already achieved extracted HEX dump of working board. Believe it is possible to upload the HEX dump back to the MCU in MPLAB X IDE.......? Currently struggling to convert it to a Bin anyway so more learning next week when MCU delivery arrives glad to report its not protected or encrypted according to configuration bits menu from MPLAB
                                Attached Files

                                Comment


                                  #17
                                  You are doing great! To convert a hex dump to bin that is easily accomplished in Linux.

                                  You mind uploading the dump? I'd like to see it.

                                  Comment


                                    #18
                                    Why such complexity, there is a special converter that converts from HEX to BIN and back from BIN to HEX.
                                    Attached Files

                                    Comment

                                    Working...
                                    X