Support for Washing Machine / Miele W3371 WCS Edition 111 / ID 2465

[michelesilla02]

Hi, I would like to help to support the washing machine i have.

Mod: W3371WCS Edition 111
Nr: 57/117281230
M-Nr: 09386340
Type: HW09-2

Software ID: 2465
Read Key: 0x2b67
Full Access Key: 0x8235

From a previous photo i took when i repaired the board, the board is ELP165F manifactured in 05-2013.
From the same photo i can see a part of the chip and it starts with R56F, so i guess it's the same mentioned here #15 (comment)

I followed this issue #15 but got lost a bit in the various pieces of code linked in it, I need some help ;-)

I too created id2465.rs based on the PR #5 but commented out enable_dummy_bytes, otherwise the dump scripts halted immediatly. Also added the entry in device.rs.

Then i altered the dump_memory example and set

const START: u32 = 0x0000_0400;
const END: u32 = 0x0000_a400;

And then used the same script to try to dump eeprom by setting

const START: u32 = 0xfffa_0000;
const END: u32 = 0xffff_ffff;

The memory read out ok, but the eeprom does not work, it halts immediatly at reading address fffa0000

How can I proceed from this point?
Thanks a lot! ;-)

[felix-albrecht]

Cool idea with the USB cable for the OSRAM!

[felix-albrecht]

I think you have the addresses reversed, here is what I would try to dump the memory:

const START: u32 = 0xfffa_0000;
const END: u32 = 0xffff_ffff;

And for the EEPROM (they should be 16-bit):

const START: u16 = 0x0400;
const END: u16 = 0xa400;

[michelesilla02]

Ok, will also try that. I got those addresses from this comment #15 (comment)

[medusalix]

The ELP165 most likely also has flash readout protection. I think @michelesilla02 meant to write "flash" instead of "EEPROM" in his initial post.

I'm currently working on an idea to bypass the readout protection with another user that has a bare ELP165 board.

[mauritsvdvijgh]

Reporting in with a Miele W667 also with software ID 2465. Used @felix-albrecht his find_keys edition to confirm the keys which are the same as mentioned in the initial issue description. EDIT: The board is an ELP165-T6

Anything I can try or do at the moment? Can we assume that the same software ID different washing machine should mean that if one works the other should work as well?

The Miele W667 is a top loader, the front dial looks to have the exact same program options and the buttons seem the same. The W667 does not have a display though.

cargo run -p freemdu --example find_keys --features bridge-ws-client,native-serial -- ws://192.168.1.210:8080/optical
     Running `target/debug/examples/find_keys 'ws://192.168.1.210:8080/optical'`
Trying read access key: 43ea
Trying read access key: b4ee
Trying read access key: 1234
Trying read access key: 2b67
Trying read & full access keys: 2b67, 1f02
Trying read & full access keys: 2b67, 4e83
Trying read & full access keys: 2b67, 5678
Trying read & full access keys: 2b67, 8235
Found keys: 2b67, 8235

Offtopic: I had an LLM add a websocket bridge edition so I don't need to have a laptop physically close to the washing machine. My adapter is not in a stable enough state yet so hard to confirm it works reliably at this stage. I seem to have some grounding/EM interference issue. At one point it was broken and worked if I held my hand close to the breadboard I am using (breadboard/jump wires might be part of the problem).

[mauritsvdvijgh]

Actually dump_eeprom/memory seems to have worked just fine, I sent them by email in case they are useful @medusalix

EDIT: Too soon, I did not adjust the address ranges in the script before I ran it.

[mauritsvdvijgh]

I found a few properties, sort of, found by looking for known values in memory dumps:

// type info
const TYPE_PLATE_ADDR: u32 = 0x19b6;

// `E000` + 9-digit serial + 2-digit index + 15-byte model field + 8-digit M-Nr + 8-digit suffix (?).
const TYPE_PLATE_MIN: usize = 46;

// Configured spin as rpm/10
const PROGRAM_SPIN_RPM10_ADDR: u32 = 0x2e69;

// Little-endian program-options word, not sure how it decodes exactly
const PROGRAM_OPTIONS_ADDR: u32 = 0x1d6f;

Looking them up:

Washing Machine — software ID 2465

  Equipment Code               E000
  Serial Number                125409356
  Serial Number Index          57
  Model Number                 W667
  Material Number              09700620
  Type Plate Extra             09198170
  Program Spin Speed           1200
  Program Options (raw)        264

EDIT: Forked/pushed here: https://github.com/mauritsvdvijgh/FreeMDU/commits/feature/add-id-2645/ (contains not yet reviewed llm code).

Planning to grab some dumps while the washing machine is running and hopefully extract some properties from that tomorrow.

[mauritsvdvijgh]

Offtopic:

@michelesilla02 does your washing machine have a delayed start functionality? If so, how does it work?
I just popped of the front cover of our top loader and it has a display on the control/front PCB that you cannot even see on the outside. Wondering if that can somehow be enabled/if a delayed start function is hidden somewhere.

[michelesilla02]

@mauritsvdvijgh yes mine has it. When the selector is in the neutral position (like in the photo) by pressing the start button the delay increases 30min at a time. Then just select a program normally, press start, and the display shows the countdown timer

[mauritsvdvijgh]

can you try reading one of the properties I found on your machine, wondering if we need to split this issue of if the memory values work for you as well (so same software id means different machines can be compatible).

[mauritsvdvijgh]

also thanks for the info on delayed start, tried on mine, it did not work. Strongly suspect it can be enabled in software though.

[michelesilla02]

ok i tested it and i can see the spin speed

Equipment Code            E000
Serial Number             117281230
Serial Number Index       57
Model Number              W3371
Material Number           09386340
Type Plate Extra          09339980
Program Spin Speed        1400 rpm
Program Options (raw)     261
Program Memory Valid      Yes