Bosch dishwasher board SWS4118: what is on it and how to run the pump with it (part 1)

All parts of the article:

• Part 1: the board, what is on it, and the EEPROM copy (you are here)
• Part 2: copying the STM32 firmware with an ST-Link
• Part 3: what the firmware does and what use it is

draft — under discussion and being expanded

⚠ This board runs straight off 230 V mains with no isolation. The large capacitor on it charges to ~325 V DC and holds that charge after the plug is pulled. The motor wires are at mains potential too. While we study the board it is never connected to the mains: we power it only with 3.3 V, from a separate supply or from the programmer. Details are at the end of the article.

Why we are doing this

The old dishwasher left us its circulation pump with a built-in heating element, which is in effect a ready-made instantaneous heater: the pump moves the water and the element wrapped around the pump chamber heats it. The pump motor is three-phase with a permanent-magnet rotor and will not run straight from a socket: it needs an inverter. The dishwasher's own board already has one. So first we find out exactly what is on the board and how to make it run the pump without the rest of the dishwasher.

What useful parts are left

The board at a glance

Markings on the board itself: 702168823.01GA is the printed circuit board number, SWS4118 Rev.4 the board designation and revision, and 888172 looks like a batch number. Most chips carry the date code 1339, which looks like week 39 of 2013.

The brain: STM32, EEPROM and programming pads

• SWD is on the X20 pads (D): pad 1 SWCLK, pad 2 SWDIO, pad 3 NRST (through 220 Ω), pad 4 pin 90 (PB4), pad 5 GND, pad 6 3.3 V. Details are in part two.
• The marking does not match the die. The package says STM32F301 VCT6, but over SWD the die identifies as an STM32F302/F303 with 256 KB of flash (ID 0x422). The chip looks like it was marked to order for the board maker.
• The orange paint stroke on the package looks like a factory mark.
• There is no read protection: the firmware was read over SWD twice and the copies are identical (part two). What is in it is in part three.

The FSB50550AB inverter

The FSB50550AB (Fairchild, now onsemi) is a three-phase inverter in one package: six MOSFET switches, their gate drivers and the diodes that supply the high-side switches. It turns the DC bus into three phases for the pump motor.

• A 300 V bus is rectified 230 V mains (√2 × 230 ≈ 325 V). So the board powers the motors straight from the mains, with no transformer.
• The signals from resistors B go to the microcontroller, which shuts the inverter down on overload.
• One inverter for two motors. We checked with a continuity tester: the two pumps share one phase, and a relay, most likely C, switches the other two between them. A dishwasher either washes or drains; the two never run together.

Board power supply: TNY274GN

We will measure exactly which voltages the supply produces. All relay coils are rated for 12 V, the inverter drivers for 15 V, the microcontroller for 3.3 V.

Mains input: filter, fuse, capacitor discharge

Relays

The third relay, a Panasonic JW2SN-B-DC12V (5 A 250 V, 12 V coil), sits next to the inverter (C in the inverter photo) and most likely switches the phases between the pumps; we confirmed the phase switching itself with a continuity tester.

If A and B are indeed the element relays, they are already in place for the water heater and rated with headroom: 16 A versus 11 A.

Connectors

The board marks its connectors X2, X3, X4, X5, X7_1, X12, X17, X20 and MTOP (with PIN 1). We will trace the harness to find out what goes where: the pumps, the heating element, the temperature sensor, the valves, the link to the control panel.

[TO ADD: connector table — number, pin count, where it goes, wire colours]

What is needed to run the pump

The main difficulty is the "run the pump" command. In the dishwasher it comes from the control panel board over a data link. We have the panel, but we do not yet know how the two talk to each other. The options:

So before we change anything, we make copies of everything the board stores.

Step 1: a copy of the 24C08WP EEPROM

The easiest and safest first step: read the small settings memory without desoldering or writing anything. The 24C08WP holds 8 kbit, i.e. 1024 bytes, and talks over the I²C bus. Inside are four 256-byte blocks; on the bus they respond at addresses 0x50…0x53 (provided pin 3, A2, is tied to GND on the board — we will check with a continuity tester), but the reading software takes care of that.

How many probes and where

Four probes. The most convenient is a SOIC-8 clip: it clamps onto the chip and touches all eight pins at once, and its adapter plugs into the programmer's "24xx" socket, red wire (pin 1) to the "1" mark on the socket. Without a clip, use four thin wires soldered to pins 8, 4, 5 and 6 (or to nearby pads connected to them).

A fifth wire only if needed. The programmer powers pin 8, which is also the whole board's 3.3 V rail, so the STM32 microcontroller wakes up too and may access the EEPROM itself while you read. If two reads in a row give different files, hold the microcontroller in reset by tying its NRST pin to GND. We will trace where NRST is on the board with a continuity test.

Check the orientation with a multimeter before connecting anything:

• pins 8 and 4 must not be shorted;
• pin 5 to pin 8 and pin 6 to pin 8 should each read ≈ 4.7 kΩ: these are the "472" resistors next to the chip that pull SDA and SCL up to the supply. If that matches, pin 1 is identified correctly.

Wiring diagram

⚠ Keep the board off the mains the whole time. It has no mains isolation, and the USB programmer ties its ground to the computer. Plugging such a board into a socket with the programmer connected puts mains voltage on the computer.

⚠ Set the programmer to 3.3 V. Most CH341B boards have a 3.3 / 5 V switch: set 3.3 V and measure the voltage on the socket's VCC pin before connecting. Old black CH341A boards without a switch put 5 V on the data lines, which is a risk for a board with a 3.3 V microcontroller.

Can the programmer power the board? The 3.3 V regulator on a programmer is usually small, and it feeds the board's whole 3.3 V rail including the STM32. If the voltage on pin 8 drops below ≈ 3 V once connected, power the 3.3 V rail from a separate supply (sharing GND with the programmer) and leave the programmer's VCC unconnected.

Which software to read with

On Windows, first install the CH341PAR driver from WCH, the chip's maker (download page); how we did it is described below. On Linux, from the command line:

ch341eeprom -v -s 24c08 -r eeprom_1.bin
ch341eeprom -v -s 24c08 -r eeprom_2.bin
cmp eeprom_1.bin eeprom_2.bin && echo "copies match"

Command-line options may differ between builds of ch341eeprom; check them with ch341eeprom -h.

On Windows, fc /b eeprom_1.bin eeprom_2.bin compares the two copies and should report no differences. The file must be exactly 1024 bytes.

• Read only. Do not press "Erase", "Write" or "Auto": an erased EEPROM means erased board settings.
• Two identical copies mean the read is reliable. If they differ, check the clip contact and add the fifth wire (NRST to GND).
• flashrom will not help here: with a CH341 it works only over SPI, and the 24C08 is I²C.

How we read it

We read it on Windows with our own short Python script through the WCH driver library (CH341DLLA64.DLL, installed with the driver). The script only reads (it contains no write functions at all): it reads the chip twice at a slow 20 kHz bus speed and compares the copies.

1. The driver: CH341PAR on the WCH website, the file CH341PAR.EXE. Check its digital signature before running it (file properties → "Digital Signatures": Nanjing Qinheng Microelectronics). Silent install, as administrator: CH341PAR.EXE /S.
2. After installation, Device Manager should list the programmer as "USB-EPP/I2C… CH341A" with no warning icon. If it shows as "USB-SERIAL", the jumper on the programmer is in UART mode; move it.
3. The script: read_eeprom_ch341.py · 4.2 KB, which needs 64-bit Python 3. Run it with:

python -I read_eeprom_ch341.py

It saves two copies into a dumps folder next to the script (you can pass another folder as an argument: python -I read_eeprom_ch341.py D:\my_dumps) and reports whether they match.

What is in the dump

We read 1024 bytes, and the two copies read back to back match. The file: eeprom_24c08_sws4118.bin · 1.0 KB. It holds no board numbers: none from the sticker, no batch number, no PCB number; we searched for them in decimal, BCD and binary form.

Block 0: a table of 16-byte records. Each record is FF, a code byte, 13 zeros, and a final byte equal to the sum of bytes 1–14, which looks like a checksum (while the other bytes are zero it equals the code). The codes rise from record to record: 1B, 1F, 2E, 30, 53, 54, 55, 56, 57, 58, 5A, 61, 62, 63, 64. Address 0x0F0 holds a single number, 08. What exactly the table is (an error log, a list of enabled features or something else) may become clear if we manage to read the firmware and see how it uses the table.

Block 1: probably settings. What stands out:

• the value 1A 23 appears three times (0x126, 0x140, 0x181), possibly a data version ID;
• at 0x1B8–0x1DF there are 40 bytes, almost all 64 (= 100), including two 58 (= 88) and one 00: looks like a table of percentages or coefficients;
• at 0x1EE–0x1EF, 41 8F right after a run of FF: looks like a checksum for the block. It is not a plain sum of the block's bytes; the algorithm is not known yet.

Block 2. At 0x214–0x215, again right after a run of FF, there is BF 41 (which also looks like a checksum), then repeating pairs 0E 74 0E 74 and 2B 0E 2B 0E, and a few dozen more bytes of values; the last one is at 0x268. From 0x269 to 0x290 there are zeros, and from 0x291 to the end of the block only FF.

There is no text, no model name or version: the contents are entirely binary.

What this means for us:

• the memory does hold data, and it is structured: most likely these are the board settings that need saving, and we now have a copy;
• no run-time counters (hours or cycles) are visible yet: they can only be found by comparing copies taken before and after the board runs, and we are not powering it up for now;
• we are looking for what the fields mean in the microcontroller firmware. It has now been read (part two), and it holds a factory copy of block 1: 198 of 256 bytes match the EEPROM and 58 differ, most likely changed settings or calibration (part three).

Next

1. The STM32 firmware: how to read it, how to check the protection and what we read: part two. In short: no protection, the copy is saved.
2. What the firmware can do and how to use it to run the pump: part three.
3. The board connectors: we will add the table here once they are traced.

The EEPROM copy is published above: it does not contain the board number. We do not publish the firmware: it is the manufacturer's program.

Safety

• Do not plug the board into the mains while studying it. While the memory is being read, the board gets only 3.3 V into its 3.3 V rail, from the programmer or a separate supply.
• The bus capacitor holds ~325 V for anything from a few seconds to a few minutes after switch-off. Before touching the board, measure the voltage across it; if needed, discharge it through a 10 kΩ 5 W resistor, not a screwdriver.
• The motor wires are at mains potential: the inverter has no isolation, and each output pulses up to ~325 V relative to earth. The "54 V" on the drain pump is only the rated winding voltage that the inverter produces by PWM.
• A permanent-magnet motor generates voltage by itself when its shaft turns (by hand or from water flow), even with the board switched off.
• Run the heating element only with water flowing, on its own circuit with a 16 A breaker and a 30 mA RCD, with the pump housing earthed.

All parts of the article:

• Part 1: the board, what is on it, and the EEPROM copy (you are here)
• Part 2: copying the STM32 firmware with an ST-Link
• Part 3: what the firmware does and what use it is

Article changelog

• 2026-11-10 — first draft: useful parts left from the dishwasher, a description of the board from photos, what the pump needs, a plan for the memory copies.
• 2026-11-10 — the article is split into three parts: the board and the EEPROM stay here; the STM32 moves to part two and the firmware analysis to part three. The chip model and the SWD pads are clarified.