3 ms·

Interesting that it uses a PIC processor. I had an American Standard (Trane) heatpump installed at my current house. I noticed once winter came that the defrost

by esaym 4y ago

Interesting that it uses a PIC processor. I had an American Standard (Trane) heatpump installed at my current house. I noticed once winter came that the defrost cycles just didn't seem to be working right. They are supposed to be "on demand" but were occurring at every 30 minutes of accumulated runtime once outside temps dropped below 32 degrees. Noticed the defrost controller board had a PIC processor on it... Got the pickit3 rom flasher/reader and was able to read the rom. It didn't have any code protection thankfully. I ran the exported hex through gputils to disassemble it, and then ran it in the mplab simulator. I could tell it was hand written assembly. It used hardcoded values in some areas to set the program counter (vs just using goto and lables) so that made modifying the code harder (since you would need to then find all these hard coded values and offset them). Long story short, the fireware was indeed full of bugs. It is possible that these controller boards haven't been working right for the last 10+ years. I managed to add a few lines of code to bypass some initial values when the board is first powered up, and that fixed the issues. It is indeed an "on demand" defrost controller now. I'm still slowly writing a blog post about it but probably won't get more time to publish for a few months. But I guess the point is, after messing with this, there seems to be an entire world of embedded firmwares that are just riddled with bugs and will never be fixed.

schemescape 4y ago
Were the hard-coded addresses just an artifact of disassembling from binary format? I’d love to see this blog post, if you end up having time to write it! Can you share a link to your blog? I didn’t see it in your profile.
- esaym 4y ago
  gputils did an amazing job on the disassembling! There are labels, gotos and functions all laid out. Hardcoded and calculated values were added to the PC in many places like: "addwf PCL, F" In that case, add W register into PCL, and store value into PCL. Trane had the original patent for computer controlled defrost: https://patents.google.com/patent/US4573326A/en https://patents.google.com/patent/US4573326A/en In the first image you'll see a chart with different temperature "bin" factors. In one place in the code, the temperature offset from 32 degrees (freezing) is added to a hardcoded value and the PC then jumps into a certain spot in a lookup table. The values in that lookup table help determine at what "DT" (delta temp between outdoor coil and outdoor ambient) a defrost should initiate. In another location, a hardcoded value is added to the PC along with a loop counter.... On loop 1 through the code, jump to this location, on loop 2 jump to this location, etc. Kind of a strange way to code, but after buying different revisions on ebay of this board going all the way back to the early 2000's, and on top of the patent being from 1985, perhaps this was the norm in the 80's and mid 90's.
  - the_biot 4y ago
    That adding offsets sounds like it could easily be compiler output. Elegant-looking jump table code is actually pretty standard for a compiler to generate. On the other hand, carefully hand-crafted and super clever machine code written in the '80s and subsequently fucked up by successive generations of maintainers who didn't understand it is an entirely plausible scenario.
gsempe 4y ago
I’ll be very interested to read your work on the Trane heat pump firmware. If you finally find the time, please, send me an email so I could add your article to the newsletter embedsys@embedsysweekly.com

by esaym 4y ago

schemescape 4y ago

Were the hard-coded addresses just an artifact of disassembling from binary format? I’d love to see this blog post, if you end up having time to write it! Can you share a link to your blog? I didn’t see it in your profile.

esaym 4y ago
gputils did an amazing job on the disassembling! There are labels, gotos and functions all laid out. Hardcoded and calculated values were added to the PC in many places like: "addwf PCL, F" In that case, add W register into PCL, and store value into PCL. Trane had the original patent for computer controlled defrost: https://patents.google.com/patent/US4573326A/en https://patents.google.com/patent/US4573326A/en In the first image you'll see a chart with different temperature "bin" factors. In one place in the code, the temperature offset from 32 degrees (freezing) is added to a hardcoded value and the PC then jumps into a certain spot in a lookup table. The values in that lookup table help determine at what "DT" (delta temp between outdoor coil and outdoor ambient) a defrost should initiate. In another location, a hardcoded value is added to the PC along with a loop counter.... On loop 1 through the code, jump to this location, on loop 2 jump to this location, etc. Kind of a strange way to code, but after buying different revisions on ebay of this board going all the way back to the early 2000's, and on top of the patent being from 1985, perhaps this was the norm in the 80's and mid 90's.
- the_biot 4y ago
  That adding offsets sounds like it could easily be compiler output. Elegant-looking jump table code is actually pretty standard for a compiler to generate. On the other hand, carefully hand-crafted and super clever machine code written in the '80s and subsequently fucked up by successive generations of maintainers who didn't understand it is an entirely plausible scenario.

gsempe 4y ago

I’ll be very interested to read your work on the Trane heat pump firmware. If you finally find the time, please, send me an email so I could add your article to the newsletter embedsys@embedsysweekly.com