Ryobi 40V Battery investigations

Details

The battery started giving me the LED blinks of death. Online searching said "easy fix". So far the fixes didn't work. I did however find several header pins which proved interesting. I soldered on the header and button.

There are 2 main headers. One has CLK an DIO that looks interesting

The other has ISP, TX, RX. The serial port runs at 115200, N, 8, 1

Main IC is NXP LCP82X (824J)

LPC82x
32-bit ARM® Cortex ®-M0+ microcontroller; up to 32 kB flash
and 8 kB SRAM; 12-bit ADC; comparator

Second IC (U6) is Q7693003 6 to 10-Series Cell Li-Ion and Li-Phosphate Battery Monitor (bq76940 Family)

Project logs provide further details.

Been trying to convert the I2C data (U6) into human readable format but getting stuck on how the read data is formatted. There's a post in the project log about it. I'd like some help. The writes look good.

Files

i2c Data.ods

spreadsheet - 916.75 kB - 08/12/2024 at 21:43

Download

i2C.txt

Saved as Hex

plain - 305.76 kB - 08/12/2024 at 21:36

Download

i2c binary.txt

Saved as binary

plain - 451.81 kB - 08/12/2024 at 21:35

Download

Battery I2C.sal

Data Capture of I2C

sal - 5.51 MB - 08/11/2024 at 15:41

Download

cutecom_mildly_formatted.xlsx

converted to spreadsheet

sheet - 116.82 kB - 08/08/2024 at 22:21

Download

Project Logs

Collapse

Math is hard
Don • 08/14/2024 at 15:50 • 0 comments

V(cell) = GAIN x ADC(cell) + OFFSET
So
I2C
Don • 08/11/2024 at 15:41 • 2 comments

Soldered on to the SDA and SCL pins of U6. File uploaded.

I uploaded the raw data files and I'm having trouble converting the values. See the i2c data.ods (libreoffice calc document). I've split out the commands and data returned. However, I'm not familar with the nomenclature used in the Datasheet with regards to '2'complement' and 'atomic value'.
BQ76930 6 to 10-Series Cell Li-Ion and Li-Phosphate Battery Monitor
Don • 08/11/2024 at 14:21 • 0 comments

This is the U6 on the board. This looks more promising from my expertise and tool set. TI has quite of bit of documentation and guides on this chip. I'll investigate this and see what kind of information it provides to the micro controller.
AKA
AFE (Analog Front End)
32-bit ARM® Cortex ®-M0+ microcontroller
Don • 08/11/2024 at 14:17 • 0 comments

This is U1 on the circuit board. I don't have the tools necessary to further investigate this chip. I would assume it may be possible to de-solder this chip and dump it's contents.
LED Patterns and data file
Don • 08/11/2024 at 14:15 • 0 comments

Short press of voltage check button
LED 1-4 blink 6 times
Long press of voltage check button
LED 1-4 on for ~2 seconds
LED 1,2 blink 1 times
LED 1 blink 6 times
My assumption of what I thought was a binary pattern in the data is wrong. This is state of the four LEDs on battery.
Votlages
Don • 08/11/2024 at 13:52 • 0 comments

There are 4 distinct sizes of test pads. I'll call them tiny, small, medium, large

The large pads appear to relate to the battery cells

The medium pads appear to be internal voltage test points

The small pads I'm not sure yet

The tiny pads I'm not sure yet

TP18 changes from 0 to 5VDC when in test mode

Each cell has a S# pad that removes the cell from the circuit. This causes a

001734242,AFE voltage invalid␍
AFE = Analog Front End = U6 = QB7693003

message to be displayed on the serial output.

Serial Data partially decoded

Don • 08/08/2024 at 23:02 • 0 comments

Pressing the charge check button on the front of the unit starts everything off.

You are first greeted with the following data (time stamps are from CuteCom). The data is comma separated.

[18:30:51:778] <0xff>000006591,WKUP 2␍␊
[18:30:51:826] 000006638,v2.4.2,2020.10.7,4868da2e,5,2␍␊
[18:30:51:830] 000006639,st 4␍␊
[18:30:51:833] 000006643,defects:00000001␍␊
[18:30:52:193] 000007000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:52:693] 000007500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:53:193] 000008000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:53:693] 000008500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:54:193] 000009000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:54:694] 000009500,R40G4.2,04,00028800,00,00,0,0,0,0,     8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:55:194] 000010000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35865,3624,3626,3623,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:55:694] 000010500,R40G4.2,04,00028800,00,00,0,0,0,0,    -8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:56:194] 000011000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:56:694] 000011500,R40G4.2,04,00028800,00,00,0,0,0,0,    -8,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:195] 000012000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35865,3624,3626,3623,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:695] 000012500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:828] 000012638,st 1␍␊
[18:30:58:195] 000013000,R40G4.2,01,00028800,00,00,0,0,0,0,     0,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:58:695] 000013500,R40G4.2,01,00028800,00,00,0,0,0,0,     0,35868,3624,3626,3624,3626,3623,3244,3624,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊

The first 4 rows appear to be header data giving the status of free running clock, greeting, version info, date of manufacture? and serial number?

You can also hold the battery charge button until it lights up solid and the unit will continually report data until you short RST to GND.

Shorting RST to GND will produce the following ouput

defects:00000001

View all 7 project logs

Discussions

Adam Quantrill wrote 08/14/2024 at 15:31

Is it saying cell 6 is knackered? The voltage looks lower than the others too.

LED blinks 6 times too :-)

Are you sure? yes | no

Gravis wrote 08/14/2024 at 13:22

I did some search-fu and found a forum post you may have overlooked. It states that "[i]t is possible to charge a 40V pack using a power supply by connecting a high value pull-up resistor between the + terminal and the T1". https://www.diyelectriccar.com/threads/ryobi-18v-lithium-battery-internals-and-charging.202243/#post-1104239

As for decoding the protocol, you might try to dump the firmware using a fault injection.

Are you sure? yes | no

David Pye wrote 08/14/2024 at 09:15

https://github.com/davidmpye/V10_Dyson_BMS/wiki/Hardware-info

I did a new firmware for the Dyson v10 packs which uses a BMS IC from the same family.

The code I wrote might help you understand how to interpret the values.

Cheers

David

Are you sure? yes | no

Don wrote 08/14/2024 at 12:09

I'll take a look. Thank you.

Are you sure? yes | no

Don wrote 08/14/2024 at 15:48

See project log "math is hard" . I think I'm doing something wrong with assuming 16 bits for data.

Are you sure? yes | no

crjeder wrote 08/14/2024 at 06:45

Two's complement - Wikipedia

Are you sure? yes | no

jonfoster wrote 08/14/2024 at 12:31

@crjeder That Wikipedia page is impossible for most programmers to understand. It's hard enough for me to understand, and I have a math degree!

Two's complement is actually really easy for programmers, once you know the tricks.

I've posted a long comment on the "I2C" log, which has an explanation of two's complement aimed at programmers.

Are you sure? yes | no

Dan Maloney wrote 08/13/2024 at 15:54

Very cool, love these reverse engineering heroics. Wrote this up for the blog, should post soon. Thanks for the tip!

Are you sure? yes | no

Ryobi 40V Battery investigations

Description

Details