Ryobi 40V Battery investigations

I was cleaning up things in the basement and accidentally shorted the data line for the BMS chip to the battery lead. Magic smoke has escaped.

V(cell) = GAIN x ADC(cell) + OFFSET 

So

Soldered on to the SDA and SCL pins of U6. File uploaded.

I uploaded the raw data files and I'm having trouble converting the values. See the i2c data.ods (libreoffice calc document). I've split out the commands and data returned. However, I'm not familar with the nomenclature used in the Datasheet with regards to '2'complement' and 'atomic value'.

This is the U6 on the board. This looks more promising from my expertise and tool set. TI has quite of bit of documentation and guides on this chip. I'll investigate this and see what kind of information it provides to the micro controller.

AKA

AFE (Analog Front End)

Short press of voltage check button

LED 1-4 blink 6 times

Long press of voltage check button

LED 1-4 on for ~2 seconds

LED 1,2 blink 1 times

LED 1 blink 6 times

My assumption of what  I thought was a binary pattern in the data is wrong. This is state of the four LEDs on battery.

There are 4 distinct sizes of test pads. I'll call them tiny, small, medium, large

The large pads appear to relate to the battery cells

The medium pads appear to be internal voltage test points

The small pads I'm not sure yet

The tiny pads I'm not sure yet

TP18 changes from 0 to 5VDC when in test mode

Each cell has a S# pad that removes the cell from the circuit. This causes a

001734242,AFE voltage invalid␍

AFE = Analog Front End = U6 = QB7693003

message to be displayed on the serial output.

Pressing the charge check button on the front of the unit starts everything off.

You are first greeted with the following data (time stamps are from CuteCom). The data is comma separated. 

[18:30:51:778] <0xff>000006591,WKUP 2␍␊
[18:30:51:826] 000006638,v2.4.2,2020.10.7,4868da2e,5,2␍␊
[18:30:51:830] 000006639,st 4␍␊
[18:30:51:833] 000006643,defects:00000001␍␊
[18:30:52:193] 000007000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:52:693] 000007500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:53:193] 000008000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:53:693] 000008500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:54:193] 000009000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:54:694] 000009500,R40G4.2,04,00028800,00,00,0,0,0,0,     8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:55:194] 000010000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35865,3624,3626,3623,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:55:694] 000010500,R40G4.2,04,00028800,00,00,0,0,0,0,    -8,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:56:194] 000011000,R40G4.2,04,00028800,00,00,1,1,1,1,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:56:694] 000011500,R40G4.2,04,00028800,00,00,0,0,0,0,    -8,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:195] 000012000,R40G4.2,04,00028800,00,00,1,1,1,1,    -8,35865,3624,3626,3623,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:695] 000012500,R40G4.2,04,00028800,00,00,0,0,0,0,     0,35866,3624,3626,3624,3626,3623,3244,3623,3626,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:57:828] 000012638,st 1␍␊
[18:30:58:195] 000013000,R40G4.2,01,00028800,00,00,0,0,0,0,     0,35867,3624,3626,3624,3626,3623,3244,3623,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊
[18:30:58:695] 000013500,R40G4.2,01,00028800,00,00,0,0,0,0,     0,35868,3624,3626,3624,3626,3623,3244,3624,3627,3626,3624, 250, 248,     0, 0,     0,   0,   0,0000,0000␍␊            

The first 4 rows appear to be header data giving the status of  free running clock, greeting, version info, date of manufacture? and serial number?

You can also hold the battery charge button until it lights up solid and the unit will continually report data until you short RST to GND.

Shorting RST to GND will produce the following ouput

What I find interesting is the spaces in some of the fields. This also appears notable.