Bricked Kelly KLS controller

[HorstFugger]

Hi my name is Andi and this is my first post

I have a problem with my Kelly KLS7250D (http://kellycontroller.com/kls7250d24v-72v400asinusoidal-brushless-motor-controller-p-1337.html). I think I briked it by changing the motor spin direction via the PC interface while the motor was running. Now no RS232 communication is possible and the controller does not move the motor. After having a conversation with Fany from Kelly the can't help me because my controller ran out of warranty and I told them that I opened the controller. When I opened the controller I saw two JTAG interface headers.

I think by reprogramming the firmware the controller can be unbricked.

• So what programming hardware do I need to flash a new firmware via the JTAG interface?
• Can someone provide me the firmware or read it from their controller?
• Is there an other possibility to unbrick the controller?

Thanks

 

[catacon]

Kelly's are not field-programmable, so I doubt anyone will have a firmware file you can download.

 

[macribs]

I don't know the Kelly. But as a "thinkerer" I have "hacked", improved usability or swapped firmware on various devices, made mad errors and what not. And I got to say the only time I bricked something has been with not paying attention during firmware upgrades. Are you sure the controller is bricked? One would think you should get an error code if bricked? Maybe electro mechanical rather then software?

As you already has it open, is there any blown fets, fuses or other things that might be the source of your problem?

 

[HorstFugger]

Hi macribs, I'm pretty sure that I haven't blown anything so a hardware defect is unlikely. The controller worked as aspected right before I i wrote the spin direction change via the PC softwate to the controller. Now when I start the controller I receive 0x00 in RealTerm and the BREAK Status indicator in RealTerm stays on. The Kelly software on the PC isn't able to talk to the controller and the controller itself shows no reaction to a throttle input. I really don't know if I blew the main µC. It may be possible but this would be really bad hardware design and I don't know how to check if it is dead. So I guess it is a software bug but I'm not sure.

The heart of my controller is a SPC5602PEVLL6 chip http://pdf1.alldatasheet.net/datasheet-pdf/view/561970/FREESCALE/SPC5602PEF0MLH4R.html
Has anyone programmed the main µC of a Kelly controller via JTAG?
Has anyone ever had a similar problem and solved it?

Thanks

 

[kristofl]

Hello,


I have the same problem with the same controller. I have changed somerhing in the settings while the Bldc was turning. I contacted Kelly and got a firmware file. Buth i cant write it because there is no RS-232 connection possible. I checked it with a scope and there is no answer from the u-processor.

Is it possible to reprogram it with jtag or something else?

 

[Endy]

Hi Kristofl,
I have the same problem with my kelly Keb controller so can you please send me the firmware file ?
Thanks

 

[flippy]

those firmware files are specific to that model and type.
i tried flahsing a KLS that bricked during driving and could not recover it even with a bootloader and firmware from fany.
they did replace it as it was only used for 3 weeks.

 

[Bricoleur1702]

Hi

I'm Fabien in France.

I have the same problem with the KLS 7230S and Fany tells me it's dead. I had a firmware because the one he was there was not working for my use, but I have no communication with the controller!
Someone got to troubleshoot this problem?

I had to send information while the engine was running.

You do not think that the warning message in the notice should appear in the software ??

Thank

 

[AlexFerrer]

Hi, Last week I received a brand new KHB1440 controller but in never worked.
As the manual instructs I put 24 volts DC on power and ground on return , but I only got a red steady light. (never seen the green led at all)

When I tried to connect to it via USB-RS232 and Kelly's KHB software, it said it could not recognize the controller.

I talked multiple times with their support, they send me a flash burst software, when run, it shows the software connected to the serial port, but could never load the slave burst.

Now they are telling me I have to send it back !

I have many questions..

Kelly's support say they tested the controller twice before shipping. Is it possible that the controller got damaged during shipping? This controller is designed to go on a vehicle, I can't believe that normal FED-EX shipping can damage it so easy. (The box arrive in good condition)

Could the controller have been damaged by static electricity during shipping? The controller just came wrapped on regular shipping foam, no special anti-static materials, and no warnings about that.

As I read on this board, it looks like the controller is on a fault state that does not activate the RS232 interface, so no new firmware can be loaded. Is there anything I can do to test the controller before I send it back?

I can not believe that a $900 piece of equipment does not have a hard reset sequence to return the CPU to a sane state !!!

Any help is appreciated.

Alex in South America.

 

[billvon]

I can not believe that a $900 piece of equipment does not have a hard reset sequence to return the CPU to a sane state !!!

You are assuming a simple reset will fix things. If the firmware is corrupted, or there is a hardware failure, a "hard reset" won't help you.

 

[AlexFerrer]

I guess you are right.. it might be something bigger than a corrupt bios.. in any case, Kelly is sending me a new one.

 

[dant74]

I was in the same situation but managed to reprogram the uP MPC5602P and solve the problem.

Some details: my controller is a KLS72501-8080I. I accidentally hit the "WRITE" button in Kelly's configuration program while the motor was running.
After that it was no longer possible to connect to the controller with the PC.

I wrote to Kelly's support, who quickly sent me a link with a program to re-flash the uP via serial and the FLASH image, a .mot file in S19 format.
Unfortunately the reflash program didn't connect to the controller, so it wasn't possible to repair the fault in this way.

So I opened the controller (the warranty had expired) and took out the PCB with the MPC5602P (I had to unsolder 2 connections that locked the PCB to the bottom board).
Next to the MPC5602P there is the JTAG connector.

Unfortunately, the MPC5602P is not very popular and there are not many JTAG tools that support it. The cheapest method I found to flash it with JTAG was this:
I bought a TRK-USB-MPC5602P development board (cost about 55€):
https://www.nxp.com/design/developm...rtrak-usb-development-system:TRK-USB-MPC5602P

I installed S32 Design Studio for Power Architecture:
https://www.nxp.com/design/software...design-studio-for-power-architecture:S32DS-PA

I verified that I could write to the FLASH of the MPC5602P on the TRK-USB-MPC5602P board the .mot file that Kelly sent me.

Then I desoldered the MPC5602P on the TRK-USB-MPC5602P board. On this board there is a J5 connector from which the JTAG signals (TDI, TDO, TCK, TMS, RESET) and +5V and GND come out.
I connected these 7 signals to the JTAG connector on the controller PCB (as pictured below).
With S32 Design Studio I programmed the uP and now Kelly's configuration program connects to the controller again.

 

[rbutl61]

Thanks for the info Dant74!
I have a 7250d controller with the same issue. Is there any way to program the microcontroller directly from a computer, using an adapter or something (just like usb to ttl, usb to jtag?). Trying to figure out a way around buying that development board

 

[ebike11]

Are all of these problems the fault of the user by changing the settings while motor is turning?
I think kelly clearly says make sure the motor is stopped before changing settings

 

[Ca7]

I managed to somewhat corrupt the firmware (kls7230s), by writing bad-error settings, it still turns on and connects, but nothing really works, b+=0v, overvoltage, hall error-111, all parameters changed including the greyed out and firmware number, user and model remained, Bluetooth connection still works.

 

[larsb]

I was in the same situation but managed to reprogram the uP MPC5602P and solve the problem.

Some details: my controller is a KLS72501-8080I. I accidentally hit the "WRITE" button in Kelly's configuration program while the motor was running.
After that it was no longer possible to connect to the controller with the PC.

I wrote to Kelly's support, who quickly sent me a link with a program to re-flash the uP via serial and the FLASH image, a .mot file in S19 format.
Unfortunately the reflash program didn't connect to the controller, so it wasn't possible to repair the fault in this way.

So I opened the controller (the warranty had expired) and took out the PCB with the MPC5602P (I had to unsolder 2 connections that locked the PCB to the bottom board).
Next to the MPC5602P there is the JTAG connector.

Unfortunately, the MPC5602P is not very popular and there are not many JTAG tools that support it. The cheapest method I found to flash it with JTAG was this:
I bought a TRK-USB-MPC5602P development board (cost about 55€):
MPC5xxx StarterTRAK USB Kit

I installed S32 Design Studio for Power Architecture:
S32 Design Studio for Power Architecture^®

I verified that I could write to the FLASH of the MPC5602P on the TRK-USB-MPC5602P board the .mot file that Kelly sent me.

Then I desoldered the MPC5602P on the TRK-USB-MPC5602P board. On this board there is a J5 connector from which the JTAG signals (TDI, TDO, TCK, TMS, RESET) and +5V and GND come out.
I connected these 7 signals to the JTAG connector on the controller PCB (as pictured below).
With S32 Design Studio I programmed the uP and now Kelly's configuration program connects to the controller again.

That’s the first time i’ve seen someone unbrick a Kelly that had the ”command sent while running” issue.

What is then the root cause to the problem? Hardware still works, but the software needs reflash to get controller functional again? Seems like a really poor software implementation by Kelly.

 

[nprobst]

Hi,
I currently have the same issue, where my kelly kls controller (mpc5602 mcu) won't connect to the pc anymore. I did a deepdive into different methods of flashing powerpc-architecture based mcus and the way dant74 did it is indeed the cheapest option (segger jflash ~900$, nxp u-multilink ~300$, lauterbach trace32 >1000$, wiggler diy + ocd commander might work but requires win2000 and really old hard/software which is hard to get and not worth the time) there are no other methods trust me I spent a lot of time searching).

The only thing I wonder is, if it would be possible to flash the kelly without desoldering the mcu from the EvalBoard
(I would like to order the eval board for a single flash and then return it.)

Thank you for your thoughts,
Niklas

 

[display4kelly]

Hi,
I currently have the same issue, where my kelly kls controller (mpc5602 mcu) won't connect to the pc anymore. I did a deepdive into different methods of flashing powerpc-architecture based mcus and the way dant74 did it is indeed the cheapest option (segger jflash ~900$, nxp u-multilink ~300$, lauterbach trace32 >1000$, wiggler diy + ocd commander might work but requires win2000 and really old hard/software which is hard to get and not worth the time) there are no other methods trust me I spent a lot of time searching).

The only thing I wonder is, if it would be possible to flash the kelly without desoldering the mcu from the EvalBoard
(I would like to order the eval board for a single flash and then return it.)

Thank you for your thoughts,
Niklas

In about 80% cases Kelly controllers can be restored in 2-3 seconds.
Check this video.
Not every programmer for these MCU's can flash Kelly. There is a problem with the reset signal because Kelly architecture. It block flashing.

99% you don't need desoldering MCU.

Your model have Red/Green LED? If yes. Please describe how is Red LED flashing? With flickering or no?
Or please write down your controller model name.