|
楼主 |
发表于 2023-12-17 19:12:44
|
显示全部楼层
DF的0x204处记录的是电池废掉时的状态:
(safety status) V C T cell_V0 V1 V2 V3 RealtimeT ,其中T (-2732后对应摄氏度)
50 02、 29 3A(10554mV)、 F9 00(-1792表示放电)、 0B E3(3043) 、00 00(0)、 0E 21(3617mV) 、0E 11(3601)、 0D 08(3336) 0B F1(3057)
0D 13 0E 29 00 FA 0F 10 0F 2C
//对应 measure delta
mean_cell_VB 、 mean_cell_VA、[abs(delta(mean_V_A-delta(mean_V_B))??] mean_cell_VB、 mean_cell_VA
0D 13(3347mV) 0E 29(3625mV) 00 FA(250) 0F 10(3856) 0F 2C(3884)
验证:(3625-3347)-(3884-3856)=250,其中cell_V_B表示最低组电压,A-表示最高组电压
对应代码:
ROM:00003039 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; Voltage
ROM:0000303C 04 FB 02 move (i3,4), r3
ROM:0000303F 05 FC 02 move (i3,5), r2
ROM:00003042 FE AB 0E move r3, #1
ROM:00003045 CB AC 0E move r2, #0x34
ROM:00003048 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; Current
ROM:0000304B 06 FB 02 move (i3,6), r3
ROM:0000304E 07 FC 02 move (i3,7), r2
ROM:00003051 FE AB 0E move r3, #1
ROM:00003054 CF AC 0E move r2, #0x30
ROM:00003057 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; Temperature
ROM:0000305A 08 FB 02 move (i3,8), r3
ROM:0000305D 09 FC 02 move (i3,9), r2
ROM:00003060 FE AB 0E move r3, #1
ROM:00003063 AD AC 0E move r2, #0x52
ROM:00003066 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; 0x152 cell V 000
ROM:00003069 0A FB 02 move (i3,0xA), r3
ROM:0000306C 0B FC 02 move (i3,0xB), r2
ROM:0000306F FE AB 0E move r3, #1
ROM:00003072 AB AC 0E move r2, #0x54
ROM:00003075 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; cell V 001
ROM:00003078 0C FB 02 move (i3,0xC), r3
ROM:0000307B 0D FC 02 move (i3,0xD), r2
ROM:0000307E FE AB 0E move r3, #1
ROM:00003081 A9 AC 0E move r2, #0x56
ROM:00003084 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; cell V 002
ROM:00003087 0E FB 02 move (i3,0xE), r3
ROM:0000308A 0F FC 02 move (i3,0xF), r2
ROM:0000308D FE AB 0E move r3, #1
ROM:00003090 A7 AC 0E move r2, #0x58
ROM:00003093 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; 0x158 cell V 003
ROM:00003096 10 FB 02 move (i3,0x10), r3
ROM:00003099 11 FC 02 move (i3,0x11), r2
ROM:0000309C FE AB 0E move r3, #1
ROM:0000309F A5 AC 0E move r2, #0x5A
ROM:000030A2 E7 C4 3A calls get_R3R2_from_r3r2_sub_B148 ; 0x15A Temperature
ROM:000030A5 12 FB 02 move (i3,0x12), r3
ROM:000030A8 13 FC 02 move (i3,0x13), r2
ROM:000030AB 00 F5 02 move (i3,0), i2h
ROM:000030AE 01 F4 02 move (i3), i2l
ROM:000030B1 E3 AC 0E move r2, #0x1C
ROM:000030B4 FF AB 0E move r3, #0
ROM:000030B7 6E AF 0C move r0, i3l
ROM:000030BA FD CE 0E add r0, #2
ROM:000030BD 7D 5F 0D incc r1, i3h
ROM:000030C0 4F D4 3A calls save_into_DF??_sub_8310 ; r3r2:num ,r1r0:i3hi3l:buf
ROM:000030C3
ROM:000030C3 loc_30C3: ; CODE XREF: kill_batt_??_sub_2FBE+63j
ROM:000030C3 FF AB 0E move r3, #0
ROM:000030C6 B2 F0 3A calls save_into_DF_4040h_sub_2DE7
ROM:000030C9 FE A1 0E move i0h, #1
ROM:000030CC DF A0 0E move i0l, #0x20
ROM:000030CF 01 AC 18 move r2, (i0)
ROM:000030D2 00 AB 18 move r3, (i0,0) ; 0x120) vs 0x2002
ROM:000030D5 DF 1B 0E cmp r3, #0x20
ROM:000030D8 B4 EF 32 jne blown_fuse_0x807C_0x8072_loc_30E1
ROM:000030DB FD 1C 0E cmp r2, #2
ROM:000030DE AC EF 36 jeq dead_loop_loc_30F9
ROM:000030E1
ROM:000030E1 blown_fuse_0x807C_0x8072_loc_30E1:
ROM:000030E1 8F A0 0E move i0l, #0x70 ; 807C
ROM:000030E4 7F A1 0E move i0h, #0x80
ROM:000030E7 0C AB 18 move r3, (i0,0xC) ; RC Control Register
ROM:000030EA FD BB 0E or r3, #2 ; RCPUP1 = 1
ROM:000030ED 0C CB 02 move (i0,0xC), r3
ROM:000030F0 02 AB 18 move r3, (i0,2) ; 0x8072
ROM:000030F3 FD BB 0E or r3, #2 ; RC Output Register
ROM:000030F6 02 CB 02 move (i0,2), r3 ; RCOUT1 ,blown fuse
|
|