A pack comes back from a swap station with its history pointing the wrong way. The BMS cycle counter reads lower than the charger's own record, and the last stored fault is a cell over-temperature from August on a pack that has run cool since. On the bench the board is fine: every byte reads, the checksum matches, and the pack passes a full charge and discharge.
That combination is the signature of a write that never finished. The BMS is powered from the cells it watches, so a contactor drop takes the logic rail with it, and an EEPROM write is a self-timed window in which the part answers nothing: 5 ms maximum here (p. 6). Interrupt that window and the record stays the old one, or becomes a half-written one, and both read back without an error flag.
The P24CM01H-TSH-MER is an I2C EEPROM of 1024 Kbit, or 128 Kbytes, in 256-byte pages, running from 1.7 V to 5.5 V over -40 to +125 °C in TSSOP8, with transparent ECC on every group of four bytes and 6 kV HBM (p. 1, p. 5). It closes the second half of this problem, because single-bit decay inside a written group is corrected on read. It narrows the first half, because a short record in one page leaves a smaller surface for a power cut. It does not remove the window, and no EEPROM does. For a pack that must keep its history across a disconnect it is the better option; for a design that cannot tolerate a write window at all, nothing in this class is.
What the failure looks like in the field
The symptom is not corruption, which a checksum catches. It is plausible old data that passes every check it is given.
Three things line up in one direction. The cycle counter is lower than the charger's log, the last fault is older than the pack's service history, and the state of health, recomputed from a stale count, drifts down more slowly than the cells age. Each alone looks like a calibration difference; together they say the pack's memory stopped earlier and has been writing from there since.
The second tell is the index pointer. A torn write leaves the last complete record intact and the pointer aimed at it, so the log looks consistent and the record that should have replaced it is missing. A technician sees a normal page with a stale newest entry, concludes the BMS stopped logging, and looks at firmware instead of memory.
Why the bench never reproduces it comes down to timing. A bench supply does not sag during a write, and a write is exposed only for its internal cycle, up to 5 ms (p. 6). The failure needs the rail to fall inside that window, which happens when a contactor opens under load or a weak group pulls the rail down near empty. It clusters in cold weather because the rail collapses slowly through the operating range instead of being cut cleanly.
Why it happens at the silicon level
The write is a blackout. After the stop condition the part starts an internal cycle, disables its inputs and does not respond until the cycle ends (p. 15), and the cycle is specified at 5 ms maximum (p. 6). The only honest completion signal is acknowledge polling, where a start condition plus the device address gets an answer only after the cycle finishes (p. 16).
The page is the unit of damage. A page write covers 256 bytes, the low address bits increment while the row stays fixed, and an access that crosses the boundary wraps to the start of the same page (p. 1, p. 15). A record that does not fit one page is two writes, and the gap between them is a second exposure.
Eight pins and one external component. SDA is an open-drain output, so the only part the datasheet asks for outside the package is a pull-up, and write protection arrives as a pin, WCB, which inhibits writes when tied to VCC and is pulled down internally when open (p. 2, p. 3).
ECC needs to be described precisely. A transparent ECC block covers each group of four bytes and corrects one bit on read (p. 1). Writing a single byte also rewrites the other three in its group (p. 13), so wear is counted per group, and a group that never finished programming is not a bit error ECC can rebuild.
Endurance depends on temperature: 10,000,000 cycles at 25 °C, 4,000,000 at 85 °C and 1,000,000 at 125 °C, all at group level (p. 7). Retention runs the same curve in reverse, 200 years at 55 °C, 50 at 85 °C and 20 at 125 °C (p. 7).
The power-on path is where the field failure lives. The part only re-initialises if VCC has fallen below 0.7 V and stayed there for at least 300 µs, then needs 100 µs before accepting a command (p. 9). A rail that sags to a volt and recovers in a hundred microseconds never crosses that threshold. The part keeps its internal state, the master has reset, and the first transaction after the sag begins in the middle of whatever the slave was doing. That is the mechanism behind the stale pointer, and it is a rail design problem that presents as a memory problem.
| Item | Datasheet value | Source |
|---|---|---|
| Density and page size | 1024 Kbit (128 Kbytes), 256 bytes per page | p. 1 |
| Supply voltage | 1.7 V to 5.5 V | p. 5 |
| Bus clock | 400 kHz, 1 MHz, 3.4 MHz | p. 6, p. 7 |
| Write cycle time | 5 ms maximum, self timed | p. 6 |
| Endurance | 10,000,000 at 25 °C, 4,000,000 at 85 °C, 1,000,000 at 125 °C | p. 7 |
| Data retention | 200 years at 55 °C, 50 at 85 °C, 20 at 125 °C | p. 7 |
| ECC | one bit per group of four bytes | p. 1 |
| Standby current | 0.5 µA typical, 16 µA maximum at 85 °C | p. 5 |
| Write current | 5.0 mA typical, 12.0 mA maximum | p. 5 |
| Reset re-arm | VCC below 0.7 V for 300 µs | p. 9 |
| First command after power-up | 100 µs | p. 9 |
| ESD | 6 kV HBM | p. 1 |
| Temperature range | -40 to +125 °C | p. 5 |
| Package | TSSOP8 | p. 1 |
The numbers that fix it
The first number is 5 ms, a budget rather than a delay. A record must fit one page write, so the worst case is one internal cycle and one exposure. A record spanning two pages doubles the window and adds a boundary where the second half is lost after the first landed.
The second set is 0.7 V and 300 µs, and together they define a rule that is easy to state and easy to break. When a pack disconnects, the rail must either stay above the EEPROM minimum long enough to ride out a full 5 ms write, or fall fast enough to sit below 0.7 V for 300 µs and force a clean re-initialisation. The middle ground, a slow sag that comes back, leaves the part neither finished nor reset. Bulk capacitance buys the first option, a discharge path the second.
The third is the record format. Two page-sized slots, alternating, each with a sequence number and a CRC over the page. A write lands in the free slot, so the previous record survives any interruption and recovery compares two sequence numbers instead of repairing anything.
The fourth is alignment and placement. The ECC block covers four bytes and a single-byte write cycles its neighbours (p. 13), so put the header on a four-byte boundary and count a one-byte counter as a four-byte cost. The endurance budget also falls tenfold between 25 °C and 125 °C (p. 7), so firmware that is comfortable in a floor-mounted pack is near its limit beside the inverter.
The fifth is identity, and it is the one most packs get wrong. A read-only 128-bit serial number sits at word address 0800h (p. 19), and a 256-byte Identification Page can be written once and locked permanently (p. 16). A pack serial stored there cannot be silently relabelled when a service centre swaps a BMS board.
Where density changes, the family covers it. P24C64C is 64 Kbit with a 32-byte page, 1 Million write cycles and no ECC block, enough for a fault-code store but not a cycle log. P24CM01B is the same 1024 Kbit and 256-byte page without ECC or High Speed Mode, at 1 Million write cycles. At the small end, P24C02A puts 2 Kbit in 256 bytes with 8 bytes per page and 4 kV HBM, one die in five packages: P24C02A-DPH-MER in PDIP8, P24C02A-MSH-MKR in MSOP8, P24C02A-SSH-MKR in SOP8, P24C02A-STH-MKR in SOT23-5 and P24C02A-TOH-MKR in TSOT23-5.
The ordering code is a decode, not a guess. P24CM01H-TSH-MER is the 1 Mbit die in TSSOP8 (TS), with halogen-free plating (H), the 1.7 V to 5.5 V option (M), the -40 to +125 °C grade (E) and tape and reel packing (R) (p. 20). The grade letter changes with mounting location rather than with the design.
Verification you can run before the next build
Interrupt the write on purpose. Put a MOSFET in the supply line and cut it at random offsets after the stop condition, across a few hundred iterations. After each one, power up, read both slots and check that the sequence rule recovers the older complete record. A record that passes CRC with an older timestamp means the format is wrong.
Sag the rail and recover. Drive VCC to just above 0.7 V for less than 300 µs and bring it back. The part will not have re-initialised (p. 9), so the test is of the firmware: it must issue the soft reset of a start condition, nine clocks, another start and a stop before trusting the bus (p. 11). Skip that and the log stops without an error.
Separate single-bit from double-bit. Inject one flipped bit inside a four-byte group and confirm the read is corrected. Flip two bits in the same group and confirm the CRC catches it, because one-bit correction per group is the whole promise (p. 1).
Check identity once, on a scrap unit. Read the 16-byte serial number from address 0800h (p. 19), then lock the Identification Page (p. 16). The lock is permanent, so the first attempt belongs on a scrap unit.
Frequently asked questions
Does this part need a hardware change?
Not electrically. It is a two-wire I2C device at 1.7 V to 5.5 V with the same 256-byte page as the parts it replaces, so footprint and driver carry over.
What changes is the firmware contract: acknowledge polling instead of a fixed delay, a two-slot record, and a soft reset after any rail event that did not cross 0.7 V for 300 µs (p. 9).
Which other parts show the same symptom?
Any EEPROM with a self-timed write cycle will, because the window is the mechanism. P24C64C and P24CM01B both specify a 5 ms cycle and neither has ECC, so a torn write can leave a stale record there too.
How can we verify this quickly?
The interrupt test is the fastest one that means anything. A few hundred power cuts inside the write window either recover the previous record every time or they do not, and the answer comes back in an afternoon. Pair it with a sag below the 0.7 V re-arm threshold and both halves of the failure are covered (p. 9).
How does the cost compare with the current solution?
What matters is the cost of a warranty return. A 1 Mbit part with ECC, 6 kV HBM and a 125 °C grade sits in the same bracket as the parts it replaces, and the price difference is small next to a pack reworked because its history is unverifiable.
Sourcing note
Send the record size, the page budget, the rail behaviour at disconnect and the temperature at the board location, and we will quote the P24CM01H-TSH-MER against datasheet V1.4 with the packing code confirmed. The datasheet makes no lifecycle or PCN commitment, so ask for a longevity statement with the quote. If the design needs an identity block rather than a rolling log, say so, because the P24C02A family does that job in five footprints for less.