Bowflex nautilus firmware woes

[CuriousJohn]

Hi Folks i dont post much but i have need today please read on and maybe we can get these things sorted.

I am on a health drive and last week bought a Bowflex max M7 to push on with my desire to get fitter but it was bought with a none functional "console screen" though the screen is dead the machine still works fine you can adjust the resistance manually like a bicycle brake adjustment it is cable fed but i want the programs and heart rate/calorie functions for my health drive. A new console is available but im getting quoted £520 or thereabouts and Bowflex as of yet have not offered any other solution and i dont think they will since they filed for Bankruptcy last March!

So, having some small skills in electronics I thought it would be a straightforward fix knowing the problem occurred when the previous owner decided to try powering it up with a laptop power supply of 19v when it really needed its own 9v DC supply. Doh! So these things are properly expensive new this model retailed at £1700? maybe, more to the point is Bowflex/Nautilus seem to have gone cheap on the power delivery providing just a standard 5mm socket that any old supply plug could fit into yet its rated strictly at 9v DC and no labels or warning marks on the unit at all. The wiring loom inside is a mess its been badly made in the factory with wire colours all mixed up at each junction so tracing it was a pain but whatever is plugged into the 5mm power socket feeds direct onto the console board there is no further protection other than a buk converter that feeds regulation on the board and thats why 19v seems to have damaged the BUK converter and destroyed a regulator fed off of it which in turn supplied the CPU among other things but gladly many parts where tolerant to 19v but defo not the PIC CPU which contains the firmware including separate boot loader as far as i can determine - this is my current theory anyway just waiting on new buk and sop23-5 regulator to restore power but not before i remove the CPU!!!. There is an additional 8Mbit flash chip for maybe user data not sure but it survived enough to have its content extracted so in a long winded way does anybody have the firmware for this equipment or does a fellow electronics enthusiast have this model by chance and also fancy deploying a PICkit3 programmer in order to extract cpu fw? The ICSP pin headers are present on the board i have, i would say they all got made the same so it would take just 5 minutes "he says".... :-)

The fried chips on the board seem to be readily available other than the LCD driver chip which is a bit harder to find but its not on the end of the fried regulator so it may have survived so im ready to rebuild it soon and need to find the firmware, Nautulis/Bowlfex arent seeming to be interested being in receivership...

[CapLeaker]

Waah? 19v instead of 9v? I think your are getting a bit too far ahead of yourself. Fix what's broken (the buck converter and the regulator), maybe the main chip and the LCD still works. See what that result is first.

[CuriousJohn]

There is still a short somewhere after the voltage regulator (removed) that is fed by the BUK measured as 0.7 ohm to ground the smd cap smoothing the output to GND was open i was hoping short but hey ho and this line supplies cpu among others i think its supposed to be 2.85v with something like 3.3v coming into it from the BUK. Ive probed about and figured out the power distribution on this board and removed the odd cap for testing my guess is the short is in the CPU as it has the most connections to the regulator and ground and it has the lowest tolerance max voltage of all the components fed by the regulator many of those can stand 19v ok it seems but there may be some texas instrument chips to look at.

The only thing i know to do now is remove the cpu and see if that cures the short to ground from the primary regulator, i could faf and lift up the 4 ground pads it has but the chip has a bit of a shine to it on one edge i suspect it got very hot and smoked out then the BUK current limit kicked in and saved the day but it got hot and hurt to as did the regulator. I intend to replace just the BUK first and see how that looks as it supplies other regulators including the lcd chip, cant do main cpu regulator till the short is located/solved

Here is the cpu it doesnt look great do you think?

[stj]

nothing obvious there
usually with flat packs like that they blow a hole in the top or round a pin.
it looks rubbed or maybe it has a coating on it of some sort.
post a picture of the rest of the board

[lotas]

Apply power (2.5 - 3v) from the laboratory power supply to this bus and increase the current, see what will heat up...

[CuriousJohn]

Hi folks. I will post a board photo later tonight when i have time and maybe treat you to a diagram of my reverse engineering of the power distribution on this board...

I was thinking about this situation last night in bed trying to get to sleep that i never measured the resistance between vcc and gnd of the pic32 icsp port headers that are soldered onto the board and i got up today its the first thing i did as the kettle boiled for morning coffee to see if there is a chance the 512KB integrated flash in the chip survived the over vault situation but sadly not this to is measuring 0.7ohm so i think its conclusive unless one of those pesky smd caps on the vcc into the cpu chip has gone short (or similiar on one of the other ic's which i doubt) and there are only 4 to remove to test so i might do that next rather than lift the chip prematurely but i dont think theres much in it...

So regarding injecting current restricted voltage to go fault finding, i dont have a bench psu to do it but i do have a cheap old unregulated dc power supply the kind with a sliding switch to change the voltage from 4.5v upto 12v and its 400ma max so nicely suitable for the job. What i did was set it low at 6v and use that to find the regulator faults i found without topping out the BUK. I had the led's on the board semi lit like that but the BUK got very hot and eventually limited itself with small amounts of stench and i measured only 400mv on its ip the BUK was the only thing getting hot to the touch i could detect so i went up stream to find the short circuit and landed at U18 after a considerable effort to trace it all and U18 is the the main voltage regulator that feeds the PIC cpu it is in fact a sop23-5 marked "L1RC" - linear regulator ADP3309ARTZ-2.85 OR ME6221CM5G. Both slightly rare these days not found on mouser or anything it seems but sourced on fleebay and ordered... U18 is tiny compared to other regulators on this board, its a weak point for sure given what it drives....

[CapLeaker]

I agree with lotas. And you need to have a PSU that is CC an CV controlled and some 99% IPA for that power injection method. Also something that that measures micro ohms (not milli) will also work to find the shorts. I found the 2.85v regulator no problem at Mouser. They got a 1000 pieces of them in stock. Lol

[CuriousJohn]

I agree with lotas. And you need to have a PSU that is CC an CV controlled and some 99% IPA for that power injection method. Also something that that measures micro ohms (not milli) will also work to find the shorts. I found the 2.85v regulator no problem at Mouser. They got a 1000 pieces of them in stock. Lol

I dont do this very often so i dont have a bench PSU on hand though i might get one and a way to measure micro ohms sounds good but alas i have never tried that either because i dont have the kit (at present). I did not find the specific regulator I was looking for on mouser, im sure there are plenty that are compatible but i refer you to opening statement in this reply but i do appreciate you looking in and laughing, can you show me where i asked for help to find the fault? All i need is firmware really can you help with that?

[CuriousJohn]

Apply power (2.5 - 3v) from the laboratory power supply to this bus and increase the current, see what will heat up...

Its a great idea with the limited kit i have i did that already, a thermal camera would knock out the park but now im at the price of just buying a new console for £520 and thats no fun at all.

[CapLeaker]

I dont do this very often so i dont have a bench PSU on hand though i might get one and a way to measure micro ohms sounds good but alas i have never tried that either because i dont have the kit (at present). I did not find the specific regulator I was looking for on mouser, im sure there are plenty that are compatible but i refer you to opening statement in this reply but i do appreciate you looking in and laughing, can you show me where i asked for help to find the fault? All i need is firmware really can you help with that?

As for short finders there are things like a Leakseeker 89 for example. As far as it goes for firmware, I think you are going to be out of luck, unless you find someone that has a working machine and can dump the contents of the chip for you.
A thermal imager is not needed. A bottle of 99% IPA is all you need to make things visible. Pure alcohol will boil off rapidly when it gets in touch with heat. To 90% of my repairs like this, all I use is a triple voltage bench PSU and 99% rubbing alcohol. Even so I do have a thermal imager to my disposal.

[lotas]

Yes, we don't need alcohol here yet, we need to make sure the controller is alive or not, you can check with your finger, if when you apply 3v power it immediately heats up to a high temperature, then the problem is there. The main thing is to observe polarity when supplying power!

[CuriousJohn]

As for short finders there are things like a Leakseeker 89 for example. As far as it goes for firmware, I think you are going to be out of luck, unless you find someone that has a working machine and can dump the contents of the chip for you.
A thermal imager is not needed. A bottle of 99% IPA is all you need to make things visible. Pure alcohol will boil off rapidly when it gets in touch with heat. To 90% of my repairs like this, all I use is a triple voltage bench PSU and 99% rubbing alcohol. Even so I do have a thermal imager to my disposal.

Thank you for the tips i have IPA on hand so will think about that one and these days bench psu are not to expensive and it would be a sound investment.

I am glad to say by the weekend I should have access to a working console unit but one thing i did learn yesterday after trying one out for the first time on another machine miles away is the cpu sends the entire thing to sleep in 5 minutes so all leds and the lcd are cathode controlled by the processor and there are transistors scattered about performing this function. I know its theory of operation but it all helps to understand the board it is very similar to a modern tv main board in many ways.

[CuriousJohn]

Yes, we don't need alcohol here yet, we need to make sure the controller is alive or not, you can check with your finger, if when you apply 3v power it immediately heats up to a high temperature, then the problem is there. The main thing is to observe polarity when supplying power!

I agree, my next step is to restore the BUK only and see if everything but what is fed by U18 voltage regulator (fed from BUK) is happy. Then i have the task of checking all coupling capacitors to every chip on the bus as there is nothing else i can find to suspect but as i said i really do feel the cpu is done as its the weakest point having lowest maximum voltage tolerance of all chips on the bus and most connections to ground and bus (think ohms law with loads in parralel) but to determine that none destructively is the prize and i am now considering injecting current controlled 2.85v down the faulty bus and going hunting with my finger and nose.

Below is another photo of the PIC32 chip and it shows the shiny side i mentioned which i believe is heat caused, the chip has not been polished or rubbed to summon some gene lol i just cleaned it with IPA a couple of times with a Q tip. Maybe its ok yet to be determined....

[CuriousJohn]

Thanks for the tips folks the IPA CC CV method is pretty cool i bought a USB pwoer supply with CC CV function for cheapish much cheaper than a bench psu anyway and it worked.

[CuriousJohn]

Bowflex Max M7 console board power distribution and stuff

[CuriousJohn]

MCU removed and S/C resolved.

Next problem after installing new PIC32 is tp flash it with already achieved extracted HEX dump of working board. Believe it is possible to upload the HEX dump back to the MCU in MPLAB X IDE.......? Currently struggling to convert it to a Bin anyway so more learning next week when MCU delivery arrives glad to report its not protected or encrypted according to configuration bits menu from MPLAB

[CapLeaker]

You are doing great! To convert a hex dump to bin that is easily accomplished in Linux.

You mind uploading the dump? I'd like to see it.

[lotas]

Why such complexity, there is a special converter that converts from HEX to BIN and back from BIN to HEX.

[CuriousJohn]

You are doing great! To convert a hex dump to bin that is easily accomplished in Linux.

You mind uploading the dump? I'd like to see it.

Thanks and i know its been a very long week and a bit i eventually received my mouser order specifically the PIC32MX MCU which tbh ive not worked with before or really any other MCU so learning to extract HEX and then reverse the process in MPLABX IDE was a bit stress but new PIC32 onboard (not fun till new solder techniques learned) and programmed. Sadly not done yet looks like all shift registers fubar (assumption as VCC good and no logic probes etc but they are cmos 7v max lol) along with a Quad gate SOP and most importantly it looks like to my eager eyes the LCD driver flatpack also decided to not like 19v very much which is understandable really but that part is hard to find (for me) it is a Princeton PT6578LQ which could be confirmation of the fools errand here.

I will post up the HEX dump shortly just wanted to verify it might work properly before doing so and im happy enough presently that what is going on even with major faults that this HEX dump does what it is meant to even just by watching its startup routine and the fact it tries to send the console to sleep as it should but LCD is garbled (not all anodes driven bu LCD chip? see photos below, incidentally the garbled LCD shows the same every power cycle, i have had to remove the board from the frame that secures the zebra strips a few times but dont think its that im guessing LCD chip is plenty poorly but no 100%, i wonder also how knackered shift registers affect the MCU but will change those first nxt week when they arrive they are cheap enough and more solder practice!


Photo 1. Image of a good console screen at power on startup test, this last about 2 seconds then it goes blank and the thing loads its program proper.







Photo 2, Image of this console screen after PIC32MX replace and reprogram suspect shift registers & LCD chip poorly as all power supplies good. The ring of RED led's never shows or the words within and the LED 7 segment never shows any sign of life all these driven by PIC32 into shift registers and also shift register controls the cathodes in the usual way but all shift registers have good VCC supplied from the Main regulator U18 3.2v that needed replacement.

Eagle eyes will note the absence of the green leds in the control panel, they do flash on briefly so there is life but dont stay on anywhere near as long as the good console example. I have ensured the leads of the PIC32 are all connected well with no shorts but i may revisit that as have spares on hand but will get the 5 shift registers replaced next and see how it likes that.

[CuriousJohn]

Why such complexity, there is a special converter that converts from HEX to BIN and back from BIN to HEX.

Thanks for that I tried it and it delivered a 1MB binary from a 1.5MB Hex dump for a 512KB flash space on the PIC32 though this was the best conversion i have seen having tried numerous tools including other versions of Hex2bin, there are things going on i dont understand with MPLAB and its HEX dump routine for e.g. according to the PIC32 data sheet the onboard flash is programed by the MCU's processor itself each address line at a time but anyway it seems despite having a JTAG header that function is stated to be turned off in this Firmware according to MPLAB (not aproblem for a new blank chip i suppose) and whilst there is a USB port on the board i dont know what file name to use and all that to see if it will upload a binary that way so i used the ICSP header and MPLAB with the PICTkti3 programmer to upload the dumped HEX file back to a blank chip (dont have JTAG dongle) and it worked ok i think (the second try) which was nice lol.

NOTE

I have seen traces online that BOWFLEX used to provide a USB stick firmware update to recover consoles under warranty so FW update by USB is or was possible once but there are loads of posts about from the last few years with folks complaining about BOWFLEX updates bricking there consoles and when out of warranty Bowflex where just disowning these poor souls telling them to go pay £500+ for a new console unit soemthing to do with an app called JRNY which possibly run an update bulldozer through the Max M7 and maybe other models now discontinued and not supported by this JRNY app (a annual revenue generating subscription thing). Could be a major contribution to why Bowflex filed for Bankruptcy protection recently. Point is with a bit of reverse engineering know how maybe the details of the usb FW update can be determined though i wonder if Bowlfex turned off JTAG support in a late update or something contributing to the state of affairs i have no idea for sure. I also heard there is a Max M7U version that is capable of connecting to blu tooth heart rate monitors like watches, i dont know if it is HW and FW upgrades or just FW but would love to find out lol. The M7 Max has blue tooth but it is just to connect to a phone running the old app now removed from app store though out there in apk form usual places and it does work still i tried it lol but not the heart rate blue tooth watch sadly. That old app just seems to give user data in nice grpah form taken from the Max M7 EEprom along with demanding location or refusing to open which is sad breach of privacy imo.