# Ryobi 40V BMS troubleshooting and repair



## kennybobby (Aug 10, 2012)

*T1 and T2 terminals; Charger Notes*

The T1 terminal on the pack is also present on the charger units and is labelled as "COM" on the charger circuit board;

[Edit 3/27/22: This is a serial communications line between the charger and the pack, and my best guess of the details are covered in post #94. The T1 is used as a "feature" to prevent charging through any other means than using a Ryobi charger. The charger side of T1 schematic is in post #67]

It measures 5.0 VDC when plugged into the mains when not charging, and 1.5 VDC while charging. IC2 is a quad op amp, AS324M-E1, and there is a voltage feedback loop on op1 comparing the voltage going to T1 with a divider at 2.143 V (before diode D10) with output driving the base of Q6 with collector signal to IC3 pin 8. Drop 0.6 across the diode and that puts T1 at 1.5 VDC; the ground reference is with respect to the Pack (-) connector terminal which is 2 FET Vds(ON) above the bottom of the Cells.

There is a pull-up 10k R47 to the +5V buss, then Q9 is used to regulate that feedback voltage mentioned above, the base is driven by IC3 pin 23.

The unknown chip in the charger is IC3, an ABOV ADC2011 28-pin TSSOP ic, looks like some sort of microcontroller, possibly an 8051 core?

[EDIT] adding sketch of charger T1 circuit in post # 67

========

The T2 terminal is found on some of the tools: mower, chainsaw, and ? (seems to be tools that have a high current draw)

The leaf blower does not have a T2.

========

Still trying to determine what function they provide, but the charger has several LED indications, one for self check of the charger, another for checking if the pack is defective. If defective then it won't try to charge the pack.

i suspect that T1 is used to indicate to the charger that the FETs are turned off and thus the pack is disabled--and on the path to discharge and destruction. Sells a bunch of replacement packs...


----------



## ga2500ev2017 (Jun 12, 2017)

I've bought a few of these. I want to package 4 of them together as a pack for my black and decker 36V self propelled lawm mower. So my primary interest is in paralleling the packs and alternative charging methods.

The BMS can be completely bypassed, thus creating the option of both parallelization and alternative charging. The BMS has access points to every terminal for each of the cells in the pack that can be tapped. They are labeled on the board as CL[1-10][+-]. So CL1- is pack ground, while CL10+ is the pack positive terminal. The two half packs are joined with the tab between CL5+ and CL6-. Note that the MOSFETs switch ground to the power tab -, while CL10+ and power tab + are connected directly together.

So it's simple enough to simply solder a wire to CL1- (which is pack ground) and CL10+ and have direct access to the pack without the BMS. A balance harness can be soldered to CL1- and to each CLx+ lead for x from 1 to 10 to have cell level balance access completely bypassing the dormant onboard BMS.

With deals on Ebay for 6 packs for $90 USD which translates to $0.75 USD a cell, it may be worth the gamble to purchase a lot, test the individual cells, and for the ones that pass, strap them together for a already packages, medium capacity, high power pack.

ga2500ev


----------



## Coulomb (Apr 22, 2009)

*Re: T1 and T2 terminals*



kennybobby said:


> I suspect that T1 is used to indicate to the charger that the FETs are turned off and thus the pack is disabled--


Either T1 is an input, or there must be something missing from your traced schematic, I think. I don't see anything other than T1 (per the colored schematic) that could turn on Q3.


----------



## kennybobby (Aug 10, 2012)

That's a good observation ga2500, i have done the same, and even removed the cell 5+ to 6- connector tab labelled F1 to make 2 separate half-packs. Sometimes a cell or two is weak and pulls down the rest and prevents charging, but at least a 20V pack can be salvaged.

i want to figure out how to reprogram the controller to not destroy the packs. One way i've tried is to de-solder the little bridge joints located near the thru-hole tabs to the cell (+), for all but cell 10. With a high wattage iron the solder can be wicked off and you will see the little wavy line that cuts thru a large round pad, it reminds me of those half-moon or -heart necklaces that couples get where each half mates to the other. i don't know why they put so much solder on those junctions since no current flows thru the board--those are just for cell voltage sense, but it takes a big iron to get enough heat to wick all that solder, and it's nearly impossible to remove the board cleanly without pulling out the via for the cell tabs.

The OZ8940 chip drives the FETs and that is what needs to be understood how to keep him happy.

i'll post that schematic after i draw it up. It sure would help to have a datasheet for that thang.


----------



## kennybobby (Aug 10, 2012)

*Re: T1 and T2 terminals*



Coulomb said:


> Either T1 is an input, or there must be something missing from your traced schematic, I think. I don't see anything other than T1 (per the colored schematic) that could turn on Q3.


i was suprised too, T1 and T2 circuits are similar, but not the same circuitry, e.g. the missing zener and extra resistor. i mislabeled R6 twice, will have to fix it.

But the logic is simple if the FETs are open then there is no path back to GND (the bottom of cell 1 is GND) and the voltage at T1 or T2 will change state (assuming a pull-up inside the charger connected to T1). i tested a pack with FETs off and the charger flashed defective, then i manually charged the cells up to about 3.0 vpc and the FETs were driven back on, then it worked fine on the charger.

T1 can drive Q3 to send a Hi/Lo to U2 pin 21, but if the FETs are off then Q3 can't go active. Also U2pin16 can drive Q5 to pull T1 Lo, but not if the FETs are off. So my guess is that T1 has a pull-up resistor to B+ inside the charger to hold it Hi all the time. Then the pack can use these circuits to indicate the state of the FETs to the charger. Now i will have to dissect the charger to see--too many circuits, so little time..


----------



## pdove (Jan 9, 2012)

kennybobby;1011793
The OZ8940 chip drives the FETs and that is what needs to be understood how to keep him happy.
i'll post that schematic after i draw it up. It sure would help to have a datasheet for that thang.[/QUOTE said:


> FEATURES
> • High power BMU
> • Highly integrated battery pack monitor and protection
> - Li-Ion and Li-Polymer (Co, Mn and FeP chemistries), NiMH and Fuel cells - 6-12 cells standalone
> ...


----------



## kennybobby (Aug 10, 2012)

*Drivin' miss daisy--the FETs*

Here is another piece of the puzzle, one FET is driven by the OZ and the other by the PIC.


----------



## City (Mar 30, 2020)

Here is a video where I show how to bypass the charge FET. The bms still shuts down when discharging and the balancing still seems to work. The bms can not turn off charging so you need to monitor the charge process manually or have an external charge system that is smart. Enjoy!

https://youtu.be/9chLnW1jX2U


----------



## kennybobby (Aug 10, 2012)

Howdy City,

Thanks for sharing, it made me dust off my old notebook to look at this again.

i would be curious if you happened to do any troubleshooting to determine why the Q21 charge FET was OFF, e.g. measure the individual Cell voltages to determine if there was a low or imbalanced pair of cells, check for bad components in the path, check if the PIC controller was not sending the drive signal, etc?

Would this work without cutting the trace to the gate of Q21, there is a 2.7V zener diode to limit the voltage on the gate.

What about just putting a fat jumper wire to bypass the FET and take it out of the story?

Nearly all of the "Bad" packs that i found have been repaired by individually charging a pair of low cells. Not sure why they get out of balance, but it seems that if they do, then the BMS shuts it down. It is nearly impossible to remove and replace any individual cells without causing damage to the board.


----------



## City (Mar 30, 2020)

I have 20 of these packs that I purchased to hopefully make a pack for a bike. All of the packs that I received were at 0V so I found that charging them with my iMax B6 mini on NIMH setting at 1 amp got the pack started charging. I checked individual cells to make sure they were all charging equally and once I got all the cells above 3 volts I changed to my charging circuit shown in the video. I limit the current to 1 amp and voltage to 41 volts to be safe. Most of the packs seem to charge the cells equally but only some of the packs worked with charging them without modding them or bypassing the Q21 charge FET.

I did try to figure out why some packs would be ok but I figure the microprocessor just locks itself as dead. Without reprogramming (which is beyond me right now), I figure the easiest way was to add the resistor to keep the FET on. You could remove and completely bypass Q21, but I was hoping that the thermal shut off may still protect the pack with the resistor mod. Maybe I'll pull one of the temperature sensors and do some tests with that and charging.


----------



## kennybobby (Aug 10, 2012)

i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.


----------



## City (Mar 30, 2020)

I am now powering my e-bike with 2 of these batteries. Mind you these batteries are not new and are the smaller 2.5Ah. I spent $6 US for my batteries, but with shipping and brokerage fees(forgot about that one when I ordered!) I figure I spent $17 CAD. So for $34 CAD and a couple more bucks for wire and connectors I have a decent battery pack for $40 CAD! I think If I used 2 new 5Ah batteries it would be very comparable to the battery I purchased for my bike but for hundreds less! I use XT60 connectors soldered to the main terminals and made a y connector with 2 XT60 connectors going to a XT90 connector to match my e-bike. I do plan on making a mount system so I can slide the batteries in and then connect the connectors, but I would be interested in a 3d printed version if you have one. 

Here is a link for the video of what I have done.

https://youtu.be/3Gx68l37BsY


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> i plan to put an index here in the first post of the schematics and any firmware that i can extract. When it gets enough critical mass i may start a github or hackaday project for collaboration and sharing.
> 
> Ryobi makes a bunch of power tools that use these packs, but the packs seem to fail quite prematurely and often. Many have been disassembled to find perfectly good cells but the BMS has shut off the pack. The bms chip seems to have a permanent failure mode "feature".
> 
> ...


Hello From France, 

Here, we have the same problems with the Ryobi Batteries.
The 5Ah BMS seems to lock up without reason. All cells are good.
I'm also creating the schematic of the PCB.
The 2.6 Ah and 5Ah own differents PCB.
On the 2.6 Ah , there are one only Power mosfet, wired to OZ8940.
I wrote twice to O2 micro to ask for the technical datasheet, no answer.
On the 2.6 Ah , the Microchip is a HA1930, no documentation anywhere, but seem to be the 16F1786.
I have not yet understood how is made the dialogue between the charger and the battery.
I don't know if the firmware is locked, anyway, it's very difficult to understand the machine code extracted.
Finally, the simplest will be to rebuild a complete program.

The OZ8940 is configured by the PIC with the I2C protocol. With a scope or I2C spy, it's possible to read the dialog during the startup of the PIC, after the RST.

We find the OZ890 Datasheet on the web, maybe, the I2C registrers are the same.

I confirm it's a big job !

I also contacted several compatible ryobi sellers found on aliexpress, they do not sell the BMS circuit separately


----------



## kennybobby (Aug 10, 2012)

très bon et excellent travail pour dessouder les planches sans dommage.

very good, and great job to desolder the boards without damage.


----------



## Oric 1 (Apr 22, 2020)

My method for desoldering the PCB: 

Leave the solder in place which holds the terminals of the elements. Even add more. 
And heat each terminal by passing a plastic spatula below, and performing a slight lifting. ( spatula delivered with replacement kits for phone screens )
Remove the soldering iron before releasing the lift. 
And do that on all the terminals, going in circles.
The PCB will rise more and more.


----------



## kennybobby (Aug 10, 2012)

That's a great tip. They put so much solder on there that i used half a roll of wick to get one off, and the vias for some of the cell tabs pulled out. A big mess that put so much heat into the tabs that some melted the plastic holder.

ps check your private messages


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.



Found on aliexpress. It's a BMS for a Greenwork Battery 
The connector seem to be the same the Charger Ryobi


----------



## Eddie49 (Dec 6, 2018)

kennybobby said:


> They put so much solder on there that i used half a roll of wick to get one off


Wick ? You need a solder sucker.


----------



## Kith (May 1, 2020)

While searching the web, I came across this site. I have two of these batteries ( OP40301/3 Ah). One is still working and the other has issues. I really appreciate if someone can help me to identify if this issue can be fixed. I have listed below all the symptoms of this issue:

1. When I press the fuel gauge button, all 4 green lights keep on flashing
2. When connected to the charger, it blinks red/green to indicate the batter is defective
3. 22uF capacitor has 39V, but when I measure the voltage it keeps on dropping to 3v. This does not happen on the good one. It shows a steady 39V when I measure the voltage.
4. I checked all individual cell packs ( there are 10 of them) and all of them are good and hold charge. 
5. I can charge the battery using an external charger. I used the batter on a load ( Batt and Gnd) and it discharges properly.

Is this something that can be easily fixed?


----------



## kennybobby (Aug 10, 2012)

How close were all the CELLs (2 cells in parallel) in voltage? 

usually if you open it up and measure all the CELLS and find one low, it can be manually charged up to match the rest. Then the entire pack manually charged up above ~32V, and then it will work on the OEM charger. If that doesn't reset it, then try manually charging up higher, e.g. 36V and try the OEM again.

The OZ8940 chip has a protection feature and will disable the pack by shutting off the FETs for temperature, Over- , and Under-voltage conditions.


----------



## Kith (May 1, 2020)

Hi Kenny

This is what I got.
BATT - GND :40.8

GND - CLI+ :4.2
CL1+ - CL2+:4.2
CL2+ - CL3+:4.2
CL3+ - CL4+:4.2
CL4+ - CL5+:3.3

CL5+ - CL6+:4.0
CL6+ - CL7+:4.1
CL7+ - CL8+:4.1
CL8+ - CL9+:4.1
CL9+ - CL10+:4.0

GND - CL5+ : 20.3
CL5- -BATT : 20.5

I just charged this batter using an external charger between GND and BATT.

In the following diagram, which pin is the gate for charging FET and which ping is the gate for discharging FET?

what is causing the voltage drop between + and - ? ( the same happens if I measure the voltage across the 22uF capacitor)

I think if I can make this voltage solid, like the good one I have, the original charger may work on this battery.


----------



## Oric 1 (Apr 22, 2020)

Hi Kith, 

By analogy with the previous version of the PCB, the gates position should be as mentioned in the picture



But your problem is rather a balance problem. Your cell n°5 ( 3.3 V ) is too low. And the four first at the high limit. ( 4.2 V )
Normaly with a good balancing, the cells must be a few mv from each other.
So, the original charger could not charge the battery. You have to charge only the cell N°5.


----------



## kennybobby (Aug 10, 2012)

Kith said:


> ...
> BATT - GND :40.8
> 
> CL4+ - CL5+:3.3
> ...


If this is really the CL5 voltage, then that is the problem. 

You have to carefully match all the CL voltages using a current limited power supply or a big bleed resistor before charging the entire Pack.

Maybe you can discharge the entire pack down to a lower level, e.g. 36-38 V and then use a power supply to separately charge CL5 up to the exact same voltage as the other cells. The better you can match all the CLs voltage will help in the long run. 4.2 is too high for these cells, the BMS can't bleed these down quick enough and you will overcharge and damage the cells.

See the schematic in post #2, the 22uF capacitor is floating unless the 2 FETs are ON. So it is just a false charge reading that bleeds off thru the meter. The FETs are OFF because CL5 is out of range and caused a Protection Fault; Once you get all 10 CLs balanced i think the fault will clear.


----------



## Kith (May 1, 2020)

Thanks for your input!

I am using a current limiting charger. Amp rate is set to 0.3A and voltage is set to 20.5V. I am charging one bank at a time ( GND and CL5+ and CL5- and BATT). 

I will discharge the batter and bring all voltages close to 3.7V.


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.


Hello Kenny, 

For the female connector, i ordered twice adapter on aliexpress, for 2$ each.
i'm waiting them, to verify or modify to adapt to the battery


----------



## kennybobby (Aug 10, 2012)

That looks very promising.


----------



## T-elospathic (May 4, 2020)

Hi all, new user. I had a great reply with a lot of info, but it wouldn't post and I lost it... so here's the summary:

I have 2 of these batteries. One has two damaged cells, the other the cells are fine, but voltage was low since it got stored through the winter at low charge. I bought them off a guy for cheap.

The OZ8940 BMS IC has permanent failure (PF) features. It triggers a PF event based on any one of 5 factors (FET issues, cell voltage issues, temperature issues, etc.). These are stored in EEPROM in the OZ chip. The PIC16 reads this data on start-up and determines the CHG FET should be enabled/disabled, making it difficult for users to manually charge the bad cells and have the pack re-enable automatically.

What I intend to do:
1. Monitor the I2C on the PIC start-up (use the external reset)
--Check for the password feature being used (the OZ chip has optional authentication)
--Check for register 0x18h read (this is where the OZ chip stores PF events) and see the data to see if any bits are set
2. Hold the PIC in reset
3. Attempt to write 0's to register 0x18h of the OZ chip (clear the PF bits, they can be overwritten according to the OZ890 datasheet)
4. Release the reset of the PIC chip and hope it doesn't store the data in its own EEPROM (though I could wipe it out there too)

I requested a datasheet for the OZ8940 through my company, since it's an interesting chip and we could utilize something like it ourselves. Hopefully the 890 has the same, or similar, I2C registers. It'll be pretty obvious once I start listening in.


----------



## Oric 1 (Apr 22, 2020)

T-elospathic said:


> Hi all, new user. I had a great reply with a lot of info, but it wouldn't post and I lost it... so here's the summary:
> ..........
> I requested a datasheet for the OZ8940 through my company, since it's an interesting chip and we could utilize something like it ourselves. Hopefully the 890 has the same, or similar, I2C registers. It'll be pretty obvious once I start listening in.


Hi T-elospathic, 

One more passoniate, perfect !

I assume the PIC is protected. are you sure you can read the eeprom pic ?
Else, i think the OZ8940 PF signal is also wiring to the PIC.
It could be the Pin 17.



For the Datasheet, good luck. I wrote twice to O2 micro, without any answer.
They build a chip, but impossible to buy it and to have documentation ????

The OZ890 Datasheet is available, hope some caracteristics are the same.

I read somewhere the OZ890 registrers could be read via a I2C reader as a memory ....

smartBMS OZ890 mit ELV i2c-Interface ansprechen on google


----------



## T-elospathic (May 4, 2020)

Oric 1 said:


> Hi T-elospathic,
> 
> One more passoniate, perfect !
> 
> ...


I don't have much hope getting the DS from them... but I enticed them with business. We will see.

Hopefully I don't have to read anything from the PIC MCU. I'm thinking I can just overwrite the PF bits in the 0x18 register on the OZ chip and call it good. Fingers crossed.. I can read the I2C with my scope on PC, and use an external MCU to write commands to the OZ chip via I2C to clear those bits.


----------



## Oric 1 (Apr 22, 2020)

It could be intersting to monitor the pin 17, and dessolder R11, and pull up or pull down the PIC pin 13 .

And read all the content of the OZ8940.
Reading the german forum, the OZ8940 seem to not have authentification password.


----------



## Kith (May 1, 2020)

After a lot of charging and discharging I got all cell banks to have 3.7V. Unfortunately charger still refuses to charge it. It looks like the battery has a permanent fail code stored. It would be nice if these codes can be erased. Waiting on someone to find a way to do this.

I found the following link for OZ8940. Hope it is helpful to resolve this issue.

https://www.electronicsdatasheets.com/manufacturers/o2micro/parts/oz8940


----------



## kennybobby (Aug 10, 2012)

Were you able to determine if the FETs are ON? If OFF which one? There is a bypass trick or two that you could try. Depending upon which FET is OFF, an easy trick to try is to temporarily short the drain to source to send the common node voltage back to the PIC and hopefully change its state. The other trick is found in post #9 requires soldering to connect the two gates together.


----------



## Oric 1 (Apr 22, 2020)

Hi everyone, 

I connected an arduino by I2C to the board.


I started to scan the bus. The program found a device in 0x30.
I used the sample program Master_Reader found in the Arduino environment.


I don't know why some values constantly changing.
I remember to have made a similar assembly at office with the BMS soldered to the battery pack cell, the result was the same, some datas was changing.


----------



## kennybobby (Aug 10, 2012)

It appears to be 3 lines repeated. Without CL voltages it maybe in a constant restart loop.

Maybe you could connect one CL voltage and determine if something changes in the output strings.


----------



## Oric 1 (Apr 22, 2020)

PCB soldered

The value has change but it's always moving.

Anyway, reading the OZ890 datasheet, normally with this method we are supposed to read the operation register, not the eeprom register.
To read the eeprom is a little more complex.










But , in first time, it would be better to dialogue properly.
I read on the microchip forum a post on the OZ8920. i think it's similar. The dialogue is a chalenge !
Normally, the Cells voltage are from registrer 0x32h, but i read only zeros.
I'll have to plug in the oscilloscope and verify the correct I2C signal produced by the arduino


----------



## Kith (May 1, 2020)

kennybobby said:


> Were you able to determine if the FETs are ON? If OFF which one? There is a bypass trick or two that you could try. Depending upon which FET is OFF, an easy trick to try is to temporarily short the drain to source to send the common node voltage back to the PIC and hopefully change its state. The other trick is found in post #9 requires soldering to connect the two gates together.


Kenny, both FETs are off. In my board this is the pin configuration.
1- Gate for charging FET 
2 - Drain for Charging FET ( Connected to GND)
3 - Source for charging FET /Drain for Discharging FET
4 - Gate for Discharging FET
5 - Source for Discharging FET ( Connected to -)

Pin 3 to GND - 0V
Pin 3 to BATT - 0V

Nothing happens when I short 2-3 and 3-5.


----------



## Oric 1 (Apr 22, 2020)

I connected the oscillo. 
Strange, there are constantly a dialogue between the PIC and the OZ8940 ???

For the moment , i not analyzed the datas, just the screenshots :

1st data after reset:
0xEA writed in the register 17.



Delay after 1st data:


2nd data after delay:


Data in loop :


We can observe the registers 04 and 06 are read in loop.
The values change continiously.
I think the second data (64 or 65 ) is the CRC .


----------



## Oric 1 (Apr 22, 2020)

I think without the datasheet, it will be difficult to push the projet through.
For the moment, all our assumptions are based on OZ8940 having to be similar to OZ890. But all registers read by the PIC ( 17, 04 and 06 ) do not correspond to anything on the OZ890


----------



## Oric 1 (Apr 22, 2020)

*Re: T1 and T2 terminals*



kennybobby said:


> The T1 and T2 terminals are not used on the power tools. i have several chargers that do have a connection for the T1 terminal. Not sure what function they provide, but the charger has several LED indications, one for self check of the charger, another for checking if the pack is defective. If defective then it won't try to charge the pack.
> 
> i suspect that T1 is used to indicate to the charger that the FETs are turned off and thus the pack is disabled--and on the path to discharge and destruction. Sells a bunch of replacement packs...


Another intersting thing , the T2 contact is not used on the charger.


I monitored the I2C when i plug the battery on the charger.
I didn’t notice any change in the dialogue.


----------



## Oric 1 (Apr 22, 2020)

T-elospathic said:


> Hi all, new user. I had a great reply with a lot of info, but it wouldn't post and I lost it... so here's the summary:
> ........
> 
> --Check for register 0x18h read (this is where the OZ chip stores PF events) and see the data to see if any bits are set
> ...


Some information about the OZ8920 found on baidu

All the text is a automatic translation Chinese to english :

Scope of Application
This application note describes how to access the OZ8920's built-in EEPROM via I2C. 
Describe the scanning engine inside the OZ8920 and the external uP that can access the built-in EEPROM via I2C simultaneously. To avoid possible access conflicts, you need to follow up on the content that follows. 
Access stream I2C command 

(1) to inline EEPROM clears the low byte of the EEPROM data register to the OperationalRegister 0X5C, and when the scan engine stops at step(3), the OZ8920 will Reset the ADC channel. 

(2) Clear scan engine status Write 0x80 (action register 0x66) to the scan engine status register. 

(3) Set the scan control to stop the scan engine from writing 0xA3 (action register 0x60) to the scan control register (ScanControlRegister) to stop the scan engine; check that the scan engine register is 0xA3 to ensure that the write is successful. If it is not 0xA3, rewrite. 

(4) Check and wait until scan engine stops 
(a) If scan engine is running before step(3), after step(3), scan engine status bit changes from "0" to "1" within 600ms (maximum scan cycle tolerable) to indicate that scan engine is being run Stop. Check the scan engine status bit (action register 0x66) and wait for the scan engine status bit to be set from '0' to '1'. 
(B) If the Check Scan Engine Status Register bit is checked for more than 600ms and the Scan Engine Status Register bit is still "0", the scan engine has stopped before step(3). If (a) or (b) is satisfied, proceed to step(5). 

(5) Make EEPROM access 
(a) Set EEPROM mode Write 0x50 (Action register 0x5F) to EEPROM control register 
(b) Wait for EEPRPM to idle read EEPROM control register until bit7ee_busy is “0”.
(C) Start EEPROM memory direction action register 0x5C, 0x5D Write EEPROM data (EEPROMData) for EEPROM write operation; Write EEPROM address to action register 0x5E (EEPROMAddress) ; Write EEPROM control (EEPROMControl)
(d) to operation register 0x5F wait for EEPROM access to end reading EEPROM controller until bit7ee_busy is “0”. Read EEPRPM data from action register 0x5C, 0x5D to enable EEPROM read operation. 
(E) More EEPROM Access Repeat steps (c) and (d) to achieve more EEPROM access if needed.
(F) Exit EEPROM mode to write 0x00 to the EEPROM control register; check that the EEPROM control register is 0x00 to ensure that the write is successful, and if not, rewrite. 

(6) Set the scan control to enable the scan control engine to write 0xAC to the scan control register (ScanControlRegister) (action register 0x60); check that the scan control register is 0xAC to ensure that the write is successful, and if not, rewrite In the right-to Action registers related to EEPROM access registers 

5ch and 5dh EEPROM data registers are used to store the data being written when a word is written to the EEPROM and to store read returns when a word is read from the EEPROM Data from the back. When writing a byte to the EEPROM, register 5ch is used to store the data being written; register 5dh Not used.


----------



## Oric 1 (Apr 22, 2020)

Another post found on baidu

OZ8920 is a battery management chip from O2micro that supports 5-8 cell power. Ad acquisition is 12W bits and current is 16 bits with a variety of protection. Can be applied to power tools, electric vehicles, UPS, etc. The program is at the end. 

Communication Note: 

1. Standard IIC communication protocol can be used, just as normal IIC peripherals can be operated. Note: One set of data is two BYTEs, e.g. first cell voltage, two data are taken, 0x30/0x31. 

2、Can be configured as IIC communication protocol with Pec (CRC8 Check), e.g. picture below: If PEC communication mode, the second data is CRC Check Digit. CRC is the CRC8 value of the CRC previous data, the polarial is: X^8+x^2+x+1, the CRC function is at the end of the article



The following figure shows the PEC setup bits, which are shown in detail:



Operation BIT6:
0 : IIC is the standard IIC communication protocol 
1 : IIC is the IIC communication protocol with the PEC

IIC Address Change: 
As in Figure 2, the operation BIT5:2 (I2CADDR3-I2CADDR0) changes the existing IIC address, the rule is: 0X60+N(0-15). 
Number of Cores setting: As shown in Figure 2, operating BIT1:0 allows operation of the core, with a choice of 5-8 sections. 

EEPROM operation: 
OZ8920 maps the operational EEPROM to a normal address that we can manipulate, and we can read and write to the EEPCOM by working on the alternate address.


----------



## Oric 1 (Apr 22, 2020)

The eeprom registers seem to be look like OZ890


----------



## kennybobby (Aug 10, 2012)

It's strange that they have so many products with no way to purchase or get information; Of course not a big surprise when you find out they are an international company with HQ in Cayman Islands. Really? yeah, that place is huge manufacturing area with nothing to hide, off-shore bank accts, etc.


----------



## Oric 1 (Apr 22, 2020)

I found the OZ890 and OZ8920 Datasheets.
Most registers are equivalent.
Hope it's the same on the OZ8940.
I don't understand why on my spies I2C, the 04 and 06 registers are read in loop.
These registers do not correspond to anything, because they are only mapped at power-up.


----------



## kennybobby (Aug 10, 2012)

Good catch to find that datasheet.

The I2C seems to be trying to capturing the initial startup and may be trying to read some data stored in that lowest register bank. Many times that low bank points to either special function or configuration registers. Sort of like CAN buss where the lowest PID numbers have the highest priority.

i should build an IIC reader to read out my pack for comparison.


----------



## Oric 1 (Apr 22, 2020)

One more information : 

The protocol I2C used is the SMBus
and 
CRC-8-CCITT is a fast error detection algorithm. It's a standard CRC-8, with polynomial x⁸+x²+x+1


----------



## Oric 1 (Apr 22, 2020)

Hi everyone

Battery Repaired !!!!

In my previous post , I informed you that the i2C signals was constantly produced in loop. I thought it was strange that the PIC dialogue constantly with the OZ8940. it consumes current.
I have a second battery which works perfectly. I open it and make measures.
On a good battery, the I2C dialog only lasts 3 seconds when you press the button to see the capacity.
I decided to monitor the I2C dialogue when you plug it on the charger.
When the battery is charging, the I2C dialogue is constant in loop.
And stop when you unplug the battery.

I supposed that my faulty battery thought it always connected to the charger.
that's why the I2C dialogue was in loop.


I unpluged the battery from the charger and made some measures.
Thanks to the diagram made by Kenny.








I measured the output U2_pin21
On the good battery i measured 3.3 V
On the bad battery, i measured 0 V
While T1 was disconnected and 0V measured on the input U2_pin 16.
OV was mesured on the base of Q1, so the transistor should be cut-off.
The transistor Q1 was defective. I replaced it, but the result was the same, except the voltage on the base of Q1 went to 0.6 V.

I decided to measure the T1 input.
On the goog battery , i measured 0V.
On the bad battery , i measured 1,8 V

The only way to have a voltage to the unconnected T1 contact, is a failure on Q3, or Q6 and Q7.
Replacing Q3, the voltage on T1 returned to the normal 0V, and output U2_pin21 became 3.3 V

Connected to the charger, the battery charges !!!

To summarize, when you have a defective battery:
- Make sure all cells are balanced, and more 3.2V
- You have to measure T1 contact. You have to measure 0V between T1 contact and (-) , otherwise you have a problem on the T1 circuit.

There may be other source of failure....


----------



## kennybobby (Aug 10, 2012)

Excellent repair! 

So to summarize, 2 of the tiny NPN transistors in the T1 circuit were defective.

Maybe this will help Kith also.


----------



## Kith (May 1, 2020)

Kenny and Oric

This is very good news. I am sure this will help a lot of people out there with defective Ryobi batteries.

I still need your help to fix my battery since the circuit does not match exactly.

1. In my circuit there is no U2 chip as in your circuit. There is a 6pin U2 chip next to the -BATT terminal: IMG3.

2. As Oric mentioned, in my good battery, T1 to -BATT, the voltage is 0V.
But in the defective one, T1 to -BATT, starts at 39V and start dropping as I measure the voltage and ends at 0.045V.


3. There is no connectivity from T1 to -BATT and there is connectivity from -BATT to T1.But I could not locate this D1 diode shown in Kenny's diagram.

4. -BATT is connected to negative pin on C1(22uF/100V):IMG2

5. GND is conected to negative pin on C6(10uF/63V):IMG2

I really appreciate if you can help me to locate any transistors ( may be Q1 and Q3 exists on my circuit as well) on my T1 circuit and this +3.3V reference point (U2_Pin21).
I have uploaded 3 images for your reference.


----------



## Oric 1 (Apr 22, 2020)

Hi Kith, 

I don't have this battery with your PCB.
It is difficult to draw the diagrams without a PCB desoldered.
We can't follow the tracks on the other layer.
Your photos are too blurry. We cannot read any value

What can you read on the IC U1, U2 and U3 ?


----------



## kennybobby (Aug 10, 2012)

Kith,

i can barely read img3, maybe you can use better lighting and focus to get a clear picture.

but maybe we can use calculatus eliminatus to figure out what you have.

On the board you will find resistors and capacitors labelled RFx and CFx; these are shown in the schematic in post #9. these are filter components that connect the CELL voltages to the OZ8940 chip, U3 in img1. 

The value of the RFx is 510 Ohms (marked "511"), so from that we can know that external CELL balancing is done using external transistors, Qx, thru some bleed resistors (51 Ohms, marked "510") as shown in the attached diagram.

The base drive resistor for these bleed transistors will be marked "01A", so you could scan thru your board looking for any of these that are connected as shown in the attached figure. This would eliminate a huge number of devices from the board for searching out the T1 and T2 circuits. The OZ can only balance one cell at a time, but that bleed circuit will be repeated 10 times on the board.

i made some edits to post #2 about the T1 and what is in the charger.


----------



## Kith (May 1, 2020)

How about this image?

I like the image uploaded by Oric, its so clear. Let me see if i can get one like that.

Oric_1: For some reason I cannot read what is on IC U1-3. I will open up the good battery and see if i can get a reading there.

https://zupimages.net/viewer.php?id=20/21/lmdy.jpg


----------



## kennybobby (Aug 10, 2012)

Don't worry if you can't read the U3 or U1, they try to hide them by etching the part numbers off with acid.

About the images: Can't read the values or reference designators on that last post, your img1 was better than that but some areas were too blurry. 

What were the readings for the CL voltages?


----------



## Oric 1 (Apr 22, 2020)

The image is better but not bright enough.
Mine was taken with my Samsung S9


----------



## Kith (May 1, 2020)

Oric/Kenny, can you please let me know the location of Q3, Q6 and Q7 on your circuit. I could not find them on the picture posted in post #14.

Oric, when you took the picture, did you have an external light source or this is just the flash from the S9?


----------



## kennybobby (Aug 10, 2012)

my circuit board is different than yours, mine was built by TTI with number 280296 dated dec 17, 2013. Yours is built by KS with part number 280487 rev:Q. So the reference designators will likely not be the same between the two.

Also i realize that your RF1-RF10 filter resistors may only be 51 Ohms, not 510. That means that the balancing is done internal to the U3 chip. i was looking at my board not yours.

If we can find a solder connections that would remove power from your board, then you could probe and check components and transistors to find any with issues or faults. It would be too risky to probe around while the board is "hot".

Your board has a large-ish solder blob in img2 that is labelled "Power"--that may be providing power for the control circuits. Also on my board, at each CELL connection to the board is a solder blob that jumps over a gap on the board in order to send voltage to the control circuits. Maybe those solder bridges could be removed to de-activate the board. On your board those bridges are labelled "S1, S2, S3"etc, little circles on the board covered with solder. If you carefully remove those solder bridges then the voltage signals will not go to the U2 and U3. The pack will still be hot so be careful what you touch with the iron.


----------



## Oric 1 (Apr 22, 2020)

T-elospathic said:


> Hi all, new user. I had a great reply with a lot of info, .......
> 4. Release the reset of the PIC chip and hope it doesn't store the data in its own EEPROM (though I could wipe it out there too)
> .....


The PIC 16f1786 need an ICD3 or PICkit3 to be programmed / read.
At office, we only have the ICD2.
I wanted to try to read the PIC or its EEprom


----------



## kennybobby (Aug 10, 2012)

Kith said:


> Kenny, both FETs are off. In my board this is the pin configuration.
> 1- Gate for charging FET
> 2 - Drain for Charging FET ( Connected to GND)
> 3 - Source for charging FET /Drain for Discharging FET
> ...


i just realized that your labelling is not correct for 2,4,5, and your measurements did not check if the FETs were ON.

the correct ordering:

1-Charge Gate
2-Charge Source

3-Common Drain for both Charge and Discharge

4-Discharge Gate
5-Discharge Source


With your voltmeter, measure and report the voltage between 1-2, and 4-5.

This will let us know the status of the FET drivers.


----------



## Kith (May 1, 2020)

Kenny, here are the voltages.


----------



## kennybobby (Aug 10, 2012)

41.3 is too high for a bad pack with unknown CL voltages. How did it get so high?

What are the CELL voltages? Please measure and post, then put a load on it to drop the voltage down to 38, then see if it will work on the OEM charger.

i think the 3Ahr packs are a mirror image of the 2.6 and 5 packs. Here i have labelled all the CL (+). i think the FETs are reversed also, the Discharge FET should be the one closest to GND. Does this look right?


----------



## T-elospathic (May 4, 2020)

Oric 1 said:


> Hi everyone
> 
> Battery Repaired !!!!
> 
> ...


Very nice! I was doing more I2C diag... and I expect to receive a datasheet for the chip soon (O2 only sells to OEMs, but I happen to work for one). I replaced Q1 and Q3 with some 60v MOSFETs with 20v gates. I'm not surprised they went bad... the design is not good IMHO. The gate of Q1 can be exposed to half of the full battery voltage (max 21-22v, higher than most gate/base voltages), through the 100k/100k resistor divider. Ideally there will be a zener across R6, or R6 would be something less, like 50-80k. I will probably adjust this on my board.

When I get my charger back I'll test, but now T1 sticks at 0v. We'll see.

@Oric 1 what does the T1 signal look like when it's charging? Wondering how I can fake it for quicker testing.


----------



## kennybobby (Aug 10, 2012)

Did you get my PM about the datasheet?

[Edit 3/27/22: T1 is a serial communication line between the charger and the pack.]
T1 in the charger sends out 5V and it monitors and controls that output to be around 1.5 V when a battery pack is connected. See post #2 on the first page for more details.


----------



## T-elospathic (May 4, 2020)

kennybobby said:


> Did you get my PM about the datasheet?
> 
> T1 in the charger sends out 5V and it monitors and controls that output to be around 1.5 V when a battery pack is connected. See post #2 on the first page for more details.


I just replied. Has anyone done a schematic of the T1 circuit in the charger? I'm sure it applies that 5v through a resistor, since the battery can override it to 0v. My pack doesn't enable the CHG FET by default, but I'm thinking it wants to see a charger connection to do so. Or, I may still have a broken pack.

Edit: I should have re-read your post before asking. I'll just wait for my charger to test. Can anyone confirm if they can charge a pack through the B+/- terminals with nothing connected to T1? Such as via a benchtop power supply.


----------



## kennybobby (Aug 10, 2012)

You can charge thru B+ and GND, which bypasses the FETs, using a bench top supply. But now YOU are the BMS, so don't walk away and let it overcharge.


----------



## T-elospathic (May 4, 2020)

kennybobby said:


> You can charge thru B+ and GND, which bypasses the FETs, using a bench top supply. But now YOU are the BMS, so don't walk away and let it overcharge.


That's not what I'm asking; I know I can do that already. I'm wanting to test the BMS repairs (replacing Q1+3) before I get the actual charger back.

Edit: got the charger, still not fixed, despite T1 sitting at 0v after replacing Q1 and Q3. I may need to observe the behavior with a good battery (I'll have to find one) on T1, but after replacing Q1+3 the I2C traffic stopped being constant.

Edit #2: the T1 signal starts at 0v (before plug), rises to 2.5v (on plug) for ~3 seconds, then back to 0v (still on plug) and the charger errors (red+green blinking). Anyone able to do the same scope trace on a good battery?


----------



## kennybobby (Aug 10, 2012)

Q1 and Q3 are npn BJT marked "1D", MMBTA42. Q2 is the pnp compliment marked "2D", MMBTA92.

When plugged into charger, the T1 line is regulated to 1.5 VDC by the charger. The base of Q3 will see half of that, 0.75 to turn ON.

Then the U2p16 can be used to test the status of the big Charge and DisC FETs, and U2p21 is used to detect the results of this test.

U2p16 goes Hi to make the test:
If FETs are OFF then the Q7 can't turn ON to pull T1 low, and p21 stays Lo.

If the FETs are On, then Q7 turns ON and pulls T1 low, and p21 goes Hi.

Here is a quick sketch of the T1 output of the charger:


----------



## Oric 1 (Apr 22, 2020)

T-elospathic said:


> Very nice! I was doing more I2C diag........
> 
> @Oric 1 what does the T1 signal look like when it's charging? Wondering how I can fake it for quicker testing.


Sorry, i have no measurement on T1 when the battery is connected to the charger, but Kenny did a great job.

Otherwise, be careful with the connections on the I2C.
I wanted to monitor the I2C dialog when applying an electronic load to my 2,6 Ah battery, to perform the cells discharge curve.

When I disconnected the I2C, the battery is blocked. The SDA line is permanently kept at zero. The OZ8940 chip has been damaged.
Plan to use an I2C isolator.


----------



## T-elospathic (May 4, 2020)

Oric 1 said:


> Sorry, i have no measurement on T1 when the battery is connected to the charger, but Kenny did a great job.
> 
> Otherwise, be careful with the connections on the I2C.
> I wanted to monitor the I2C dialog when applying an electronic load to my 2,6 Ah battery, to perform the cells discharge curve.
> ...


I'm using very high-impedance probes with a Picoscope to watch the I2C bus.

Kenny DID do a great job, that's for sure. I'll be back on it when I have a bit to play around with them again. Thanks Kenny.


----------



## Oric 1 (Apr 22, 2020)

T-elospathic said:


> I'm using very high-impedance probes with a Picoscope to watch the I2C bus.
> 
> Kenny DID do a great job, that's for sure. I'll be back on it when I have a bit to play around with them again. Thanks Kenny.


Incredible ! I use also a picoscope .










The problem wasn't the probe, but my arduino.

My electronic load is an Itech IT8512A








When i disconnected the I2C from battery to arduino, my computer make a sound, and i realized that the battery didn't work. The OZ8940's SDA line is locked to 0V. No answer when pushed jauge button 
Maybe a ground problem between my electronic load, and the ground provided by USB to the arduino.
I remember reading an I2C problem on the OZ890. They recommend using an I2C optical isolator.


----------



## kennybobby (Aug 10, 2012)

Sorry to hear that the OZ chip has blown, but maybe you can buy some from one of those online chip suppliers that show up when you do a datasheet search.

i was thinking your issue might be a ground level difference when first reading your post about this.

The picoscope has a USB, as does the arduino, and so does the Itech load? And does the USB ground connect to the mains ground? And the PicoScope BNC barrel is connected to the USB ground?

What about the Itech load path, is it isolated or connected to the mains ground?

When you connected the Itech load, was it to the battery terminals B+ and B-, or did you by-pass the FETs and connect to CL1- ?


----------



## Oric 1 (Apr 22, 2020)

Yes, i found IC on Aliexpress....
I also found an I2C isolator. Maybe useful for future use.

The Computer, the USB, the Arduino and the electronic load had the same ground.
Maybe a problem with the electronic load.
I don't know if the inputs are floating.
The inputs was connected directly to the battery on B+ and B-.

We have a lot of problem with this BMS PCB.
It could be interesting to redesign a complete BMS. 
But it's a real projet, a big job.
Or find an Aliexpress compatible seller who agrees to sell only the BMS.


----------



## bigjoncoop (Jun 2, 2020)

Wow guys, Great Work.

I've been waiting for some info on these 40v Ryobi BMS's. I wish I could contribute to the project. Im just a DIYer Electronics guy. I've recently purchased probably more then 80+ of these 40v Ryobi Batteries. About half of them can be repaired by charging and balancing the cells with a Cc/CV power Supply and cycling them a few times to make sure the BMS and Cells are functioning Properly. Out of all the ones I've been able to repair successfully and sell, just one buyer has contacted me with a problem after using it for a month.

the other half of the batteries, I disassemble and recover the 18650's that checkout after cycling and testing for self discharge for my DIY power-wall.

❓❓❓
The one question I have is, has anybody figured out how to charge Ryobi battery packs without a Ryobi charger? Without opening the packs? I use Ryobi 18v cordless tools at work and as well as these 40v packs for diy projects and only have 1 charger for each.

What is the T1 and or T2 terminals on the BMS's looking FOR? Is it possible to use a resistor or a small voltage input on T1 or T2 to get the BMS to allow Charging on the Batt + and Batt - terminals?
❓❓❓

Unbelievable that These 40v Ryobi Batteries Sell for upto $160 plus and how often they fail because of there poorly designed BMS!!!! Tens of thousands of the 2.4Ah packs have been sold for just $6 until they went out of stock just last week... I've been selling them for $30ea or 4 for $100 and I can fix them fast enough.


----------



## kennybobby (Aug 10, 2012)

Post #67 has the T1 schematic inside the charger, and post #2 has the T1 circuit inside the battery.

[Edit 3/27/22: T1 is a serial communication line.]

T1 is a Test Terminal between the battery and charger, where either side has a way to test the other, and either side can shut itself off if conditions are not satisfied. There are processors in both and the firmware codes are not known, so we don't know how often this test is run during charging.

There is no safe way to bypass the Test without opening the cover that i have discovered.


----------



## Oric 1 (Apr 22, 2020)

As mentioned by Kenny, it exist a logic between the charger and the battery.
The T2 terminal is not used by the charger. On the 2,6 Ah battery, this pin is not connected. All is made by the T1 terminal.
I think in normal condition, it's the BMS's battery that stop the charge.
It's not easy to measure the T1 signal while connecting on the charger.

The Battery know his capacity. I recently changed the cells of a defective 2,6 Ah. A 2,6 Ah battery is composed of 20 cells 1,3 Ah assembled in 10S2P.
I replaced them by 2,5 Ah cells.
After 1h charge, the charger starts to blink. I need to unplug and replug the battery to finish the charge. 

You are lucky to have found batteries so inexpensive. 
Here in France, the 2,6 Ah are sell 150 $, and the 5 Ah 200 $


----------



## bigjoncoop (Jun 2, 2020)

@kennybobby

@Oric 1

Thx for you quick replies. So im assuming the the same problem would also be true on the 18v battery packs also? With making a diy charger instead of having opening them... They also have T1 terminal ...

I Have a couple of 18v Chargers that got wet, and the the DC-DC switching IC "TOP256EN" blew in both of them... in one of the Chargers I replaced the IC with a new one but when I plug it in it makes it strange noise for a second but still will not charge any batteries. I'm good at repairing pcbs so I know I replaced it correctly but something else must be wrong that is not noticeable


@Oric 1 - yeah that's a little more expensive than we pay here in the US for new batteries. I don't understand how they're able to charge so much money and people are willing to pay when these batteries fail so often. just that one business was able to sell tens of thousands of these defective 40 volt batteries. thankfully I was able to make a bunch of money since they were only $6 each and like I said half of them were repairable and the other half I extract the sales and use them myself. I'm waiting for more to become available. if shipping wasn't so expensive it would almost be worth buying them and having them shipped overseas to you for $6 a piece you can't beat that


----------



## Oric 1 (Apr 22, 2020)

I don't understand how Ryobi can sell products that are so unreliable.
Just a look on ebay to see a lot of defective batteries


----------



## kennybobby (Aug 10, 2012)

*It's all about the jack($)*

Oh they are reliable--for Ryobi. 

The patented BMS will shutdown to avoid any situation that might result in a fire and the legal claims to follow. It reliably saves them money.

Failed packs cost the users much money if they want to keep using the tools. It reliably brings them lots of money.

The needless waste of resources is offensive to the DIY spirit.


----------



## Oric 1 (Apr 22, 2020)

bigjoncoop said:


> Wow guys, Great Work................
> ❓❓❓
> The one question I have is, has anybody figured out how to charge Ryobi battery packs without a Ryobi charger? Without opening the packs? I use Ryobi 18v cordless tools at work and as well as these 40v packs for diy projects and only have 1 charger for each.
> 
> ...


One more difficult with Ryobi : 

A scope probe on T1 terminal while charging
It exist a dialog between the charger and the battery.
I don't know which way this dialog takes place. 





10 sec before end of charge


----------



## kennybobby (Aug 10, 2012)

Well that is a very interesting scope capture, and explains why the T1 terminal connection is labelled "COM" on the charger board.

i'm going to guess that the communication primarily originates in the charger due to the blocking diode D10 on the "COM" line shown in the hand-drawn schematic. That line gets controlled by signals from the IC3, "ABOV2011" pin23 which drives the base of Q9. So it can assert both Hi and Lo states.

On the battery side, T1 can only get pulled Low by the action of pin 16 of the PIC; it cannot assert a Hi. Maybe it pulls Low to assert a marking pulse or RTR (ready to receive) back to the charger?

In either case it appears that pin 21 of the PIC is the intended recipient of the message.

i wonder if these signals are status or commands somehow used for voltage or current control?

i can't find any info or datasheet for an ABOV microcontroller chip with that marking. We would need the firmware from that chip, plus the PIC firmware to really understand.


----------



## Oric 1 (Apr 22, 2020)

Hello Kenny, 

This morning i monitored the dialog during 1h30.
I discharged a fully charged battery with my electronic load at 5ah for 10 min.
And i plugged in the charger.
For the first 50 min the data was the same
After 50 min until the end of charge, the data move constantly every 20-60 sec.
The refresh rate is not constant.

By observing the scope curve, we can say that the dialog is asynchronous.
I think in this dialog, there are a acknowledge pulse. We can observe two different kinds of groung level.
The small pulse may represent a logic 0 , and the large pulse a logic 1. 
Or the opposite.
Anyway, i can count 32 bits.
Only the fisrts 16 bits move.

Kenny, i don't understand why the charger will make this dialog.


1011111000100010 1001100000000100 start 
1011111000100010 1001100000000100
.
.
.
0110000011111100 1001100000000100 50 min later
0000000010011100 1001100000000100
0111000011101100 1001100000000100
0011000010101100 1001100000000100
0101000011001100 1001100000000100
1101000001001100 1001100000000100
0001000010001100 1001100000000100
1001000000001100 1001100000000100
0110100011110100 1001100000000100
1110100001110100 1001100000000100
0010100010110100 1001100000000100
1010100000110100 1001100000000100
0100100011010100 1001100000000100
1100100001010100 1001100000000100
0000100010010100 1001100000000100
1000100000010100 1001100000000100
0111100011100100 1001100000000100
1111100001100100 1001100000000100
0011100010100100 1001100000000100
1011100000100100 1001100000000100
0101100011000100 1001100000000100
1101100001000100 1001100000000100
0001100010000100 1001100000000100
1001100000000100 1001100000000100
0110010011111000 1001100000000100
1110010001111000 1001100000000100
0010010010111000 1001100000000100
1010010000111000 1001100000000100
0100010011011000 1001100000000100
1100010001011000 1001100000000100
0000010010011000 1001100000000100
1000010000011000 1001100000000100
0111010011101000 1001100000000100
1111010001101000 1001100000000100
0011010010101000 1001100000000100
0101010011001000 1001100000000100
1101010001001000 1001100000000100
0001010010001000 1001100000000100
0110110011110000 1001100000000100
0010110010110000 1001100000000100
1010110000110000 1001100000000100
0100110011010000 1001100000000100
1100110001010000 1001100000000100
0000110010010000 1001100000000100
1000110000010000 1001100000000100
0111110011100000 1001100000000100
1111110001100000 1001100000000100
0011110010100000 1001100000000100
0011111010100000 1001100000000100
0011110110100000 1001100000000100 end


----------



## kennybobby (Aug 10, 2012)

The second field of 16 bits is repeating a sequence: 9 8 0 4

if we change the byte order gives: 8940 , which could be part number of the OZ chip?

i noticed at the :50 minute mark that the last byte of the first 16-bits word is shifting the lowest set bit to the left and back filling with zero. Something is increasing over time. It started at the second bit, then shifted over to the 6th bit position.


```
1011	1110	0010	0010		1001	1000	0000	0100
1011	1110	0010	0010		1001	1000	0000	0100
								
								
								
0110	0000	1111	1100		1001	1000	0000	0100
0000	0000	1001	1100		1001	1000	0000	0100
0111	0000	1110	1100		1001	1000	0000	0100
0011	0000	1010	1100		1001	1000	0000	0100
0101	0000	1100	1100		1001	1000	0000	0100
1101	0000	0100	1100		1001	1000	0000	0100
0001	0000	1000	1100		1001	1000	0000	0100
1001	0000	0000	1100		1001	1000	0000	0100
0110	1000	1111	0100		1001	1000	0000	0100
1110	1000	0111	0100		1001	1000	0000	0100
0010	1000	1011	0100		1001	1000	0000	0100
1010	1000	0011	0100		1001	1000	0000	0100
0100	1000	1101	0100		1001	1000	0000	0100
1100	1000	0101	0100		1001	1000	0000	0100
0000	1000	1001	0100		1001	1000	0000	0100
1000	1000	0001	0100		1001	1000	0000	0100
0111	1000	1110	0100		1001	1000	0000	0100
1111	1000	0110	0100		1001	1000	0000	0100
0011	1000	1010	0100		1001	1000	0000	0100
1011	1000	0010	0100		1001	1000	0000	0100
0101	1000	1100	0100		1001	1000	0000	0100
1101	1000	0100	0100		1001	1000	0000	0100
0001	1000	1000	0100		1001	1000	0000	0100
1001	1000	0000	0100		1001	1000	0000	0100
0110	0100	1111	1000		1001	1000	0000	0100
1110	0100	0111	1000		1001	1000	0000	0100
0010	0100	1011	1000		1001	1000	0000	0100
1010	0100	0011	1000		1001	1000	0000	0100
0100	0100	1101	1000		1001	1000	0000	0100
1100	0100	0101	1000		1001	1000	0000	0100
0000	0100	1001	1000		1001	1000	0000	0100
1000	0100	0001	1000		1001	1000	0000	0100
0111	0100	1110	1000		1001	1000	0000	0100
1111	0100	0110	1000		1001	1000	0000	0100
0011	0100	1010	1000		1001	1000	0000	0100
0101	0100	1100	1000		1001	1000	0000	0100
1101	0100	0100	1000		1001	1000	0000	0100
0001	0100	1000	1000		1001	1000	0000	0100
0110	1100	1111	0000		1001	1000	0000	0100
0010	1100	1011	0000		1001	1000	0000	0100
1010	1100	0011	0000		1001	1000	0000	0100
0100	1100	1101	0000		1001	1000	0000	0100
1100	1100	0101	0000		1001	1000	0000	0100
0000	1100	1001	0000		1001	1000	0000	0100
1000	1100	0001	0000		1001	1000	0000	0100
0111	1100	1110	0000		1001	1000	0000	0100
1111	1100	0110	0000		1001	1000	0000	0100
0011	1100	1010	0000		1001	1000	0000	0100
0011	1110	1010	0000		1001	1000	0000	0100
0011	1101	1010	0000		1001	1000	0000	0100
```


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> ........
> 
> 
> ```
> ...


It's a strange dialog
I noted that all datas are linked

0 -- 9
1 -- 8
2 -- B
3 -- A
4 -- D
5 -- C
6 -- F
7 -- E
8 -- 1
9 -- 0
A -- 3
B -- 2
C -- 5
D -- 4
E -- 7
F -- 6


----------



## kennybobby (Aug 10, 2012)

That is such a strange pattern--what could it possibly mean or how used?

Begin at the end and work back, the shift-bit and zero limit the range of available data pairs.

The link pairs go both ways, e.g. an F-->6 and a 6-->F

It could just be some sort of security feature to ensure that both the battery and the charger are OEM equipment, again for liability purpose$.

Maybe it's just constantly checking the health and status of the FETs using this linked pair, but it seems like busy-work code just to fill in some time.

The T1 line will always be held HI by the pull-up circuit in the charger, but then either/both sides can pull it LOW. So maybe this link pattern is a "call" and an "answer-back" response?

Schematic Note:
Looking back on the 5Ahr board, it seems that all balancing is done internally thru the OZ8940--nearly all the transistors are used for the T1 and T2 circuits with not enough left for balancing.


----------



## Oric 1 (Apr 22, 2020)

It will be very difficult to charge the battery without its original charger.
Even when using a microcontroller, we need a power supply, the connectors, a case ....
It's easyer to find a used original charger than try to make one.

I'm waiting an aliexpress battery, i could monitor the signal.
I wonder how the sellers managed to get around this problem.

Yes , the balancing is made inside the OZ8940. All other transistors are used by the T1 and T2 circuits.


----------



## pchris (Jun 6, 2020)

Very interesting research here.
I have a 5Ah battery that broke yesterday. The charge level lights are not working and putting it on the charger I get the error. Measuring the cells, all are at 3.35-3.38V, but one is 3.05.
I also measured the two FETs, and both are ON, so this is Ok. I suspect, that the PIC is seeing the imbalance of the cells, and communicating the error through T1. Now I am trying to tricke charge the low cell with 10mA to 3.35V and I will report here what happens.

EDIT: Actually, the charge FET is in a strange state, it measures 12V on the gate, but U2_pin18 is low, so it should be off...


----------



## kennybobby (Aug 10, 2012)

Check Q13 and Q14, maybe one of those is leaking but not enough to drive the gate, seems like the charge FET gets about 90% of pack voltage to turn on.

Is the discharge FET ON?

i've had good luck with charging low cells and getting a pack working again.


----------



## kennybobby (Aug 10, 2012)

@ Oric 1,

Could you try monitoring T2 to see if it is active when T1 is active?

Did you replace the broken 8940? And did you have to use an isolator to capture those scope traces?


----------



## pchris (Jun 6, 2020)

kennybobby said:


> Check Q13 and Q14, maybe one of those is leaking but not enough to drive the gate, seems like the charge FET gets about 90% of pack voltage to turn on.
> 
> Is the discharge FET ON?
> 
> i've had good luck with charging low cells and getting a pack working again.


I have revived the battery!
After charging the low cell up to 3.35V the battery still would not work, but after doing a reset on the PIC, the indicators started working and it also charges! I suspect, the PIC was trapped in an infinite loop or a failure state.

After looking closely at the FETs, I noticed that both should be off, but due to some leakage in the BJTs both gates were at ~12V and actually on. But it doesn't matter, I think what is relevant is the T1 communication between the charger and the battery.

After all I believe that the problem is that the battery can't balance the cells, there is simply no circuitry for that. Now I am curious, what would have happened if I just simply reset the PIC without charging the cell... There is either 1) a different logic for cutting off discharge and allowing charging or 2) the PIC falls in a failure state if a cell is too deeply discharged. If one more battery fails, I will try it out


----------



## kennybobby (Aug 10, 2012)

How did you do a reset on the PIC?


----------



## pchris (Jun 6, 2020)

On the corner of the PCB there is a 5-pin programming interface labelled CLK, DAT, GND, 3.3V, RST. I connected RST to GND with a 1K resistor for a second


----------



## kennybobby (Aug 10, 2012)

*Reset and Master Clear pin*

Thanks. The "RST" on header HR1 is directly connected to pin 1 of the PIC with a 1% 10k resistor (R12) pullup to 3.3V, and C7 capacitor to GND. 

PIC pin1 has the Master Clear function MCLR if enabled in the config register.

i wonder if the chip was in SLEEP mode or some low power state, and just needed to wake up?


----------



## pchris (Jun 6, 2020)

I would rather say it was in a failure state / infinite loop, since power consumption was high, by the time I charged the cell from 3.05 to 3.35, all other cells went down from 3.35 to 3.31...


----------



## kennybobby (Aug 10, 2012)

*Re: Scope Data Capture Guess*

Looking at the T1 COM data again.

The second word of the scope data capture appears to be the chip model number, 8940, IF we reverse the nibble (half-byte) order and read the bits as msb first.

So for the first 16-bit word, i tried the same approach to reverse the nibs but also reversed read the bits as "lsb" first, then an interesting pattern appears to show a sequence of countdown/up loops. i split the bytes into 4 for current hi, 4 for current lo, 2 for mode control, 2 for target/counter hi, 3 for target/counter low, and a loop toggle bit at the end.

Here's my guess of what this means:

Mode Control bits M2: 0 = CV; 1= CC; 2=OFF.

Ch4 and Cl4 are related to the settings or readings of the charging current.

T2 and T3 are related to a target setting/ up-counter toward some quantity (coulombs or Ahrs ?).

At the end is a Loop toggle bit or an ON/OFF for some function?


At the beginning the mode was set to Constant Current as indicated by the mode bits M2 = 1; the current was set to "4 4"; the target (coulomb?) counter was set to "3 6"; Loop bit set to 1/ON.

After :50 the voltage rose up to the CV level and the charger changed Mode to M2 = 0; there began a count-down loop on the C4 to decrease current; the Target counter began it's up-counter; the Loop bit basically began to toggle for every COM cycle after a few transition cycles.

At the end when the Target Value was reached the Loop bit turned OFF and the Mode went to 1, then on the next cycle went to 2, which was the OFF command to Stop Charging.

This is all just my attempt to put some sense to the data stream and relate it to a lithium battery charging protocol. Why the bit order would be different between the first word and the second word? strange


```
reversed nib and bit order  for the T1 data stream                                
                                   C4   C4   M2  T2  T3   Lb
hi        lo      hi       lo     hi   lo   hi   hi   lo   lo
0100    0100    0111    1101        4    4    1    3    6    1
0100    0100    0111    1101        4    4    1    3    6    1
                                  
0011    1111    0000    0110        3    F    0    0    3    0
0011    1001    0000    0000        3    9    0    0    0    0
0011    0111    0000    1110        3    7    0    0    7    0
0011    0101    0000    1100        3    5    0    0    6    0
0011    0011    0000    1010        3    3    0    0    5    0
0011    0010    0000    1011        3    2    0    0    5    1
0011    0001    0000    1000        3    1    0    0    4    0
0011    0000    0000    1001        3    0    0    0    4    1
0010    1111    0001    0110        2    F    0    1    3    0
0010    1110    0001    0111        2    E    0    1    3    1
0010    1101    0001    0100        2    D    0    1    2    0
0010    1100    0001    0101        2    C    0    1    2    1
0010    1011    0001    0010        2    B    0    1    1    0
0010    1010    0001    0011        2    A    0    1    1    1
0010    1001    0001    0000        2    9    0    1    0    0
0010    1000    0001    0001        2    8    0    1    0    1
0010    0111    0001    1110        2    7    0    1    7    0
0010    0110    0001    1111        2    6    0    1    7    1
0010    0101    0001    1100        2    5    0    1    6    0
0010    0100    0001    1101        2    4    0    1    6    1
0010    0011    0001    1010        2    3    0    1    5    0
0010    0010    0001    1011        2    2    0    1    5    1
0010    0001    0001    1000        2    1    0    1    4    0
0010    0000    0001    1001        2    0    0    1    4    1
0001    1111    0010    0110        1    F    0    2    3    0
0001    1110    0010    0111        1    E    0    2    3    1
0001    1101    0010    0100        1    D    0    2    2    0
0001    1100    0010    0101        1    C    0    2    2    1
0001    1011    0010    0010        1    B    0    2    1    0
0001    1010    0010    0011        1    A    0    2    1    1
0001    1001    0010    0000        1    9    0    2    0    0
0001    1000    0010    0001        1    8    0    2    0    1
0001    0111    0010    1110        1    7    0    2    7    0
0001    0110    0010    1111        1    6    0    2    7    1
0001    0101    0010    1100        1    5    0    2    6    0
0001    0011    0010    1010        1    3    0    2    5    0
0001    0010    0010    1011        1    2    0    2    5    1
0001    0001    0010    1000        1    1    0    2    4    0
0000    1111    0011    0110        0    F    0    3    3    0
0000    1101    0011    0100        0    D    0    3    2    0
0000    1100    0011    0101        0    C    0    3    2    1
0000    1011    0011    0010        0    B    0    3    1    0
0000    1010    0011    0011        0    A    0    3    1    1
0000    1001    0011    0000        0    9    0    3    0    0
0000    1000    0011    0001        0    8    0    3    0    1
0000    0111    0011    1110        0    7    0    3    7    0
0000    0110    0011    1111        0    6    0    3    7    1
0000    0101    0011    1100        0    5    0    3    6    0
0000    0101    0111    1100        0    5    1    3    6    0
0000    0101    1011    1100        0    5    2    3    6    0
        ^ .  stop bit                ^
```


----------



## Oric 1 (Apr 22, 2020)

Whaoo Kenny, very good job !




kennybobby said:


> @ Oric 1,
> 
> Could you try monitoring T2 to see if it is active when T1 is active?
> 
> Did you replace the broken 8940? And did you have to use an isolator to capture those scope traces?


no yet ordered !
I wonder if it's economically profitable to replace the broken oz8940 on a 2.6 Ah PCB.
Maybe, i'll use an ESP8266 D1 mini pluged directly inside the battery. In this case no isolation problem !

The T2 contact is not connected on the charger.
And my monitoring was perform on a 2.6Ah PCB . This PCB didn't own the T2 contact


----------



## Oric 1 (Apr 22, 2020)

2nd oz8940 DEAD 
I didn't understand what happened.
Just wired gnd, sda and scl to my d1 mini wemos.
At the begining , i power it by external USB pack bank.
But i need to reprogram , so i connected it to usb from my computer.
The oz8940 ouput pin 7 that power the 3.3v regulator is 1.3 V instead 12V ???

This Chip is very sensitive.

Very strange , on my first trials, i plug and unplug I2C ten times without any problem.


----------



## pchris (Jun 6, 2020)

Oric 1 said:


> 2nd oz8940 DEAD
> I didn't understand what happened.
> Just wired gnd, sda and scl to my d1 mini wemos.
> At the begining , i power it by external USB pack bank.
> ...


Was it also connected to the charger? Maybe the common ground is the problem... Have you tried using an optical isolator for the I2C?


----------



## Oric 1 (Apr 22, 2020)

The battery was not connected to the charger or load.
Only the battery I2C ( sda, scl and gnd ) connected to the ESP8266 mini.
And the ESP connected in usb to the computer.
I think the ESP don't own a true I2C protocol.
Normaly , the I2C is an open collector protocol.
The device apply a ground or nothing. With the pull-up resistor in the circuit , the level rise to vcc when the device release the bus.
The ESP apply gnd or vcc, and the current capactiy is 12 mA, enouth to destroy the input I2C device.


----------



## Kith (May 1, 2020)

pchris said:


> On the corner of the PCB there is a 5-pin programming interface labelled CLK, DAT, GND, 3.3V, RST. I connected RST to GND with a 1K resistor for a second


I was able to fix one of my batteries using this reset method. My circuit has 2 pin reset interface. I made sure all cells are at 3.3v and short these two pins with a 5ohm resister. The batter started working.

Now I am trying to fix the other battery. I tried to reset it with 4.0V in each cell bank and it did not do anything. Right now I am draining each cell to 3.7v and give it another try.


----------



## Kith (May 1, 2020)

Good news! I got the second batter to work as well. This is the one that did not work at 4.08V in each cell bank. I drained all 10 banks and tried a reset and it worked. To my surprise, cells are not even balanced. Below is the voltage in each cell:

CL1: 3.82
CL2: 3.63
CL3: 3.75
CL4: 3.77
CL5: 3.78
CL6: 3.79
CL7: 3.70
CL8: 3.65
CL9: 3.80
CL10:3.63

So it looks like resetting is the best way to fix the 4-light blinking issue. If this does not work, that means some other component may also be bad.

One of the things that I noticed during the reset process is that all 4 lights blink once if the reset is successful. After that blink, if you press the gauge button, it should indicate the right energy level of the battery.


----------



## kennybobby (Aug 10, 2012)

That's great news, thanks for sharing. So it looks like these packs can be reset when they have gotten off in the weeds.

It is a bit strange how far out the cell balance was from each other., but it is quite difficult to match cells by discharge.


----------



## Oric 1 (Apr 22, 2020)

Oric 1 said:


> The PIC 16f1786 need an ICD3 or PICkit3 to be programmed / read.
> At office, we only have the ICD2.
> I wanted to try to read the PIC or its EEprom



PicKit3 connected to the PIC connector :
The program is protected, but i succeeded to read the eeprom
First read on a 2.6 Ah battery:

0	FF	FF	FF	FF	FF	FF	FF	FF
8	FF	FF	FF	FF	0C	0	FF	FF
10	FF	FF	FF	FF	FF	FF	FF	FF
18	FF	FF	FF	FF	F3	FF	FF	FF
20	36	1	A3	0	7	FF	*1A* 0F
28	FF	FF	FF	FF	FF	FF	FF	FF
30	C9	FE	5C	F8	FF	FF	E5	F0
38	FF	FF	FF	FF	FF	FF	FF	FF
40	FF	FF	FF	FF	FF	FF	FF	FF
48	FF	FF	FF	FF	0C	0	FF	FF
50	FF	FF	FF	FF	FF	FF	FF	FF
58	FF	FF	FF	FF	F3	FF	FF	FF
60	FF	FF	FF	FF	FF	FF	FF	FF
68	FF	FF	FF	FF	FF	FF	FF	FF
70	FF	FF	FF	FF	FF	FF	FF	FF
78	FF	FF	FF	FF	FF	FF	FF	FF
80	FF	FF	FF	FF	FF	FF	FF	FF
88	FF	FF	FF	FF	FF	FF	FF	FF
90	FF	FF	FF	FF	FF	FF	FF	FF
98	FF	FF	FF	FF	FF	FF	FF	FF
A0	FF	FF	FF	FF	FF	FF	FF	FF
A8	FF	FF	FF	FF	FF	FF	FF	FF
B0	FF	FF	FF	FF	FF	FF	FF	FF
B8	FF	FF	FF	FF	FF	FF	FF	FF
C0	FF	FF	FF	FF	FF	FF	FF	FF
C8	FF	FF	FF	FF	FF	FF	FF	FF
D0	FF	FF	FF	FF	FF	FF	FF	FF
D8	FF	FF	FF	FF	FF	FF	FF	FF
E0	6E	5	41	0D	7B	4	F0	0A
E8	0	1	20	FF	FF	FF	FF	FF
F0	FF	FF	FF	FF	FF	FF	FF	FF
F8	FF	FF	FF	FF	FF	FF	FF	FF

Hex 1A = 26 in decimal, maybe the battery capacity !


----------



## kennybobby (Aug 10, 2012)

i suppose there is no way to read out the firmware when it is locked--what a pain. Seems like somebody would have figured out a way to read the code while it is running in single-step mode with an emulator tool?

i looked at the eeprom data in another format, but nothing jumps out.


```
2.6 A-Hr PIC eeprom																		

00  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  0C  00  FF  FF
10  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  F3  FF  FF  FF
20  36  01  A3  00  07  FF  1A  0F   FF  FF  FF  FF  FF  FF  FF  FF
30  C9  FE  5C  F8  FF  FF  E5  F0   FF  FF  FF  FF  FF  FF  FF  FF

40  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  0C  00  FF  FF
50  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  F3  FF  FF  FF
60  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
70  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF

80  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
90  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
A0  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
B0  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF

C0  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
D0  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
E0  6E  05  41  0D  7B  04  F0  0A   00  01  20  FF  FF  FF  FF  FF
F0  FF  FF  FF  FF  FF  FF  FF  FF   FF  FF  FF  FF  FF  FF  FF  FF
```


----------



## Oric 1 (Apr 22, 2020)

Oric 1 said:


> The image is better but not bright enough.
> Mine was taken with my Samsung S9


A faulty battery for $ 10:

Nothing is happening.
All cells below 0.1 V. Pull up to 3.6V with a power supply, but always nothing.
No light when push on the capacity button, and flashing on the charger.

The U1 marking is 3710LN 090.4G 1850B
The U3 marking is Q822J or O822J Z34 06 18511A


----------



## kennybobby (Aug 10, 2012)

U3 looks like an NXP microcontroller, if it's in the 8051 family there is possibilities. [LPC82x has IAP and ISP programming with on-chip code up in the high memory; that's how we found the code to read the LPC used in the TCCH/Elcon chargers]

i noticed there is a reset junction.

Are the cells holding at 3.6V after p/s charging?

i suppose the FETs are OFF?

Big electrolytic C6 looks damaged.

Is the GND strap on there with a good solder joint near CL1- ? It looks sketchy to me. Also the solder at the strap near CL6 looks cut?

if i had it i would remove all the big solder globs at the CLs and Power and trace out the power and ground connections.

That looks identical to Kith's 3.0 A-Hr pack, same part number and revision, Q. Looks fairly new, March 2019 date code.


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> ....
> i noticed there is a reset junction.


I tried it, no effect



kennybobby said:


> Are the cells holding at 3.6V after p/s charging?


Yes, no variation after 1 day.



kennybobby said:


> i suppose the FETs are OFF?


Yes, Off



kennybobby said:


> Big electrolytic C6 looks damaged.
> 
> Is the GND strap on there with a good solder joint near CL1- ? It looks sketchy to me. Also the solder at the strap near CL6 looks cut?
> 
> if i had it i would remove all the big solder globs at the CLs and Power and trace out the power and ground connections.


It can be a photo effect, I did not notice any problem of component or welding



kennybobby said:


> What capacity is that pack? Looks fairly new, March 2019 date code.


It's the same posted by Kith
On the mine, the date code on the label was cleared


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> i suppose there is no way to read out the firmware when it is locked--what a pain. Seems like somebody would have figured out a way to read the code while it is running in single-step mode with an emulator tool?
> 
> i looked at the eeprom data in another format, but nothing jumps out.
> 
> ...


2.6 Ah


5.0 Ah


----------



## kennybobby (Aug 10, 2012)

i had noticed on the 2.6 that the values in column x0C, when added together

0C + F3 = FF,

and the same for the 5.0,

10 + EF = FF.

Wonder if it is counting down how many times it has been charged? More puzzles.


----------



## Oric 1 (Apr 22, 2020)

I have several functional batteries but which lack capacity.
The battery works well on the mower but after 10/15 min , it stops and restarts every minute.
This symptom is confirmed on the 2.6 ah dated 2011/2012.
When you replace the cells, the problem goes away.
I tested each cells of the defective battery, i didn't noted any failure, just a loose of 20% of the capacity ( 1100 mA vs 1300 mA )

At the begining , the problem was only on the 2.6 Ah.
Now, I have a 2016 5Ah with this problem. 
PCB desoldered, 18 V battery pack separated to be tested on my power supply and electronic load.
I manualy charge the 18V pack at 21 V 2Ah ( 4.2V by cell ).
And i discharge at 5Ah with a cut-off at 14V ( 2.8V by cell ).
Periodicaly, i checked the individual cell voltage. The cells had a good balancing.


Both batteries pack have the same capacity and i don't see any problem
I don't know why when you replace the cells, the problem disappears.


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> i had noticed on the 2.6 that the values in column x0C, when added together
> 
> 0C + F3 = FF,
> 
> ...


A 2nd 2.6 Ah battery eeprom PIC


----------



## kennybobby (Aug 10, 2012)

Oric 1 said:


> I have several functional batteries but which lack capacity.
> The battery works well on the mower but after 10/15 min , it stops and restarts every minute.
> This symptom is confirmed on the 2.6 ah dated 2011/2012.
> When you replace the cells, the problem goes away.
> ...


That is quite a puzzle; i would have thought it was the mower shutting off using the T2 possibly due to over-temperature, or the pack shutting off for over-temperature. But when the problem disappears just due to cell change, it somewhat excludes the over-temp fault.

Possible theory: Maybe there is a low-voltage cutoff level, and the weaker cells let the pack drop too low under high load. When the load was removed the cell voltage bounced back up above the threshold, but then tripped again when under high load.

The 5AHr pack appears to still have good capacity when tested at 1C, but i suspect that the mower has a higher current draw and will bring cells down faster to hit the mower's LV shutoff point, maybe..?

i have a couple of "bad" packs that will charge to 4 bars, then run the mower or chainsaw for a period and cut off. The scale shows 1 bar; then i let it set for a bit and shows 3 bars, and starts back up to run for another period. Similar to your experience? i call them "bad" packs because they were discarded for recycling due to not working; i opened and charged the low cell(s) individually, and then they work and charge as normal except those low cells are likely weak and causing the LV cutoff.

Another idea: these cells have vents and internal protection devices with a thermal cutoff. A spec sheet that i found indicated no explosion and no fire requirement. Maybe that device is turning ON and disables the pack for a brief time, then resets itself?


----------



## Oric 1 (Apr 22, 2020)

The 18V packs has been tested with a 8A discharge current.
The curves are the sames. No problem detected.
I will try to solder a 2,6 Ah BMS on this 5Ah battery.
Test to follow....


----------



## Oric 1 (Apr 22, 2020)

Aliexpress 40V battery received !





Test in progress ............


----------



## t0astm0nkey (Jun 23, 2020)

Oric,
Keep us updated on that AliExpress battery.
Do you have a link the the one you purchased?
Can you tell what the cell manufacturer and model are used?


----------



## Oric 1 (Apr 22, 2020)

t0astm0nkey said:


> Oric,
> Keep us updated on that AliExpress battery.
> Do you have a link the the one you purchased?
> Can you tell what the cell manufacturer and model are used?


The cells marking is THISS 18650HR20R
Probably a 2000 mA, with 2 in parallel, the nominal capacity is 4000mA and not 6000mA as notified on the label.
Two discharge tests on my electronic load gave 3500 mA
The weigth of this battery is 1.2 Kg vs 1.5 Kg for an original 5Ah.
The battery accept to charge on the original charger.
But the capacity indicator is false. The 3 first led rise very quickly. In 1 minute, the 3rd led is flashing. 




Unable to post a link on the forum.
But write "Powtree Ryobi 40V LED 6000mAhOP4026A" on google.


----------



## kennybobby (Aug 10, 2012)

thanks for sharing your test data, that is very interesting that it works with the OEM chargger.

There is a "chain links" icon in the menu bar, hopefully that is a way to post a link?


----------



## Oric 1 (Apr 22, 2020)

kennybobby said:


> thanks for sharing your test data, that is very interesting that it works with the OEM chargger.
> 
> There is a "chain links" icon in the menu bar, hopefully that is a way to post a link?


€66.41 35% de réduction|Powtree Ryobi 40V LED 6000mAhOP4026A OP4050 RY40502 RY40200 RY40400 L50 | AliExpress


----------



## kennybobby (Aug 10, 2012)

That seems like a great price, i hope it works well and has a long life. i might have to buy one just to trace it out, especially with no shipping cost.

Did you identify the microcontroller chip? Is it a PIC 16F1933, i couldn't make out the markings clearly.

i see that is a Rev 5 board and does not have the reference designators for the components such as shown on Rev 6.


----------



## Kith (May 1, 2020)

All

Here are few updates.

1. Even though the charger would work on a battery with voltages posted ( see #100), it errored out towards the end. I believe this is how batteries get into this defective stage. For some reason the BCM could not charge all cell banks to the same voltage. I had to discharge some cells and get them to the same(almost) voltage. After that I was able to charge the battery all the way without any errors.

2. After a full charge, when I press the capacity check button, only 3 lights light up. I am not sure what is the reason for this. If I try to charge it again, it would not charge the battery. I can use the battery on my tools without any issues.


----------



## kennybobby (Aug 10, 2012)

Maybe the 4th LED is burned out or that circuit has an issue. Next time you have it open can check it with a DMM.

The cell balancing capability is very limited with the OZ8940 chip, like .008 Amps of discharge current depending upon the value of the RF1 resistors. It may be that the code just gives up if the voltage difference exceeds some stored limit, another reason for all the "dead" packs out there for sale on ebay.

Good work to get them matched close enough for it to recover. It takes a good DMM that can read down to the mV level generally for messing with cell voltages. 0.1 V is a huge difference in cell world.


----------



## t0astm0nkey (Jun 23, 2020)

THISS must be a cheap Chinese cell manufacturer. I'm not able to find much more about them other than an address for imports/exports.
I'd be more interested in the housing and the circuit board. I've got a small pile of (almost) new Samsung 35E18650 cells that would be AWESOME to drop into this package and get a 7.5AH battery out of it.


----------



## evluvseattle (Aug 24, 2020)

Hi all, I'm having a weird issue with one of these batteries (OP4015 circa 2013) and I couldn't find a solution earlier in this thread so I thought I'd add to the endless conversation. 😬 If a new thread is more appropriate, lmk.

The symptoms I'm seeing are:
1. when I press the test button on the battery, only the first LED lights up. (regardless of the cells' charge levels) 
2. when I put a load across +/-, the battery provides power for about a second, and then nothing.

This pack was previously heavily discharged (to around .6v per cell), and I brought it up to full charge by charging the individual cells to 4.2 volts about a month ago. The cells are currently around 3.9 volts each. When I put the battery in the charger (OP403) I get a steady green light that eventually goes dark. I assume this means the charger thinks the battery is charged, which is strange since I believe full charge should be ~4.2 volts.

I have tried resetting the PIC by putting a resistor between the RST and GND headers, but that didn't seem to do anything.

Any suggestions?

Thanks!
Theo


----------



## kennybobby (Aug 10, 2012)

Howdy Theo,
Does your circuit board have one FET or 2 on the heatsink? Does the board match with some of those shown in pictures. The 2013 version with 1.5AHr may be a different circuit board.

You may want to check if the LEDs on the check lights are burned out.

The + and - terminals on the pack do not connect directly to the cells--the - goes thru the FET(s), which must be ON in order to pass current. This is shown on some of the schematics posted on previous pages.

Maybe the cells are worn and won't go to 4.2 any longer?


----------



## Treeific (Dec 10, 2020)

Great info here I really appreciate all the effort and time everyone has contributed to this thread.

I've rebuilt my 40v Ryobi battery and I am fairly satisfied. I don't have a standard to compare with as I only have used battery packs. I actually replaced cells during my rebuild, harvested from laptop batteries (tested and monitored of course) but my rebuilt lasts about twice as long as my other packs. (As I calculated, hoped for) it has some problems that I'm okay with, like the 4th led I'm not positive is working, and the pack will cut out under high load. 

I use them in ryobi products like weed eater and mower.

Do y'all think the bms is cutting the power based on a current limit programmed in the MC? If so I would think I will experience the cut off from a new Ryobi battery of the same rating.
Or do you think my batteries do not supply enough current and the BMS can sense that, and that's what's makes it cut out.
I don't think it's heat related because I just need to start the mower up again (even with out a rest) and it works fine till I got another high spot of grass that puts a load in the pack.

I understand these BMS are poorly designed for us users, and probably designed with marketing and business in mind instead of reliability. I heard older batteries were designed worse, and newer one are more reliable. Have y'all heard this?

I want to ask this question, and I don't mean to disrespect all the amazing work yall have put into reverse engineering this product.

Can I simply buy a 10s BMS circuit (something like This ) and bypass all of Ryobi proprietary circuits?
It'd be great to use the same charger, but I don't expect it to be easily possible. I don't anticipate the tool having any problem with it. I know I will need to mod, rather alot, to make it fit and sink heat, etc, but it sounds smart to me... Do you guys see the same benefits as me in doing this?

Just asking because if I find a good quality 10s BMS that fits the specs, in my head I can get a much more reliable pack, probably simplified too.

What are yalls thoughts?
Thanks!


----------



## kennybobby (Aug 10, 2012)

Could the mower motor be hot? or high temperature inside the battery?

The T1 and T2 lines are used by the battery, the charger and the tools to control the FETs, and we don't know the firmware, so it's hard to say how to defeat all that. 

A separate control board that could respond to the charger and tools, and monitor the pack for OV, UV, OC, OT, etc would be an interesting project--i just wish we knew the present battery controller better. And the charger controller too. i've not taken any tools apart to see what they have either.


----------



## Treeific (Dec 10, 2020)

I think I'll order one, it's really cheap. It's worth a try.

I'm also curious about the present BMS, but I just like throwing ideas so they can shake in someone's head, who knows what could happen.


----------



## Halotem (Jan 4, 2021)

What kind of zener diode did you used in zener diode voltage regulator construction ?


----------



## taylorb (Feb 3, 2021)

Thanks for those who help with this post! I used it to fix a Ryobi 36V power pack (BPL3650D 130302002DG9 10ICR19/66-2) which is identical to the 40V pack. Specifically Q3 & Q1 are NPN BJT marked "1D", MMBTA42, and, Q4 is the PNP compliment marked "2D", MMBTA92, all of which were faulty and replaced. (The link between batteries 5-6 was removed to safely effect the repair.)
Looking at the circuit, Q1, Q3 & Q4 is an obvious design fault providing a low impedance path between B- and Gnd. Obviously a 10k resistor should be fitted between Q3 collector and Q4 base just like there is one between Q5 collector and Q6 base.


----------



## kennybobby (Aug 10, 2012)

That's an interesting observation, i will recheck my board to see if i missed it, like an "R3". Thanks for ID on those transistors.


----------



## taylorb (Feb 3, 2021)

There is definitely no 10k resistor fitted - there is a direct connection between Q3 collector and Q4 base. Also it seems that Ryobi engineers put in high voltage transistors (200V and 300V) assumedly to stop the problem from happening - however Vebo (reverse voltage) is always low for any transistor, and when a transistor is on it is definitely low impedance.
Anyway your circuit was instrumental in locating the failed transistors and replacing them. So thanks very much for working all that out - much appreciated! I actually used a MMBT5401 for the PNP, which is 150V, but it worked fine.


----------



## kennybobby (Aug 10, 2012)

i haven't found my bare board yet, too many projects on my bench.

i noticed that the T2 circuit is missing the base resistor such as R16 on T1, and also the same missing resistor that you pointed out. The 200k from the supply to the base allows it to be pulled lower than the emitter to turn the pnp ON, but i would have liked to see a 10k on the base as a current limiter.

The voltage of Gnd will be higher than B(-), but would it be enough to cause a current leakage if the Main FETs were turned OFF. [i also wonder if the FETs are powered OFF during "sleep" mode, and what turns them back ON?]

It would seem that the Gnd voltage would need to exceed B(-) voltage by the sum of the reverse PN junction voltage of Q1 E-B, plus the forward PN junction voltage of Q4 C-B, plus the reverse breakdown voltage of Q3 C-E, before any leakage would occur--does that appear to be a correct analysis or is there another path to consider?


----------



## taylorb (Feb 3, 2021)

Yes the missing “R16” in the T2 circuit, or for the matter if it was missing in the T1 circuit, is less likely to cause a failure because Vcbo for Q29 (Q6) is quite high. Again given it is in one circuit and not the other indicates to me that the Ryobi engineers were trying to fix an actual or potential problem.

Yes when the FETs are off, Gnd > B- and is obviously designed to isolate the battery. As you imply there must be another circuitry that continues to power the controller (from B-). Without seeing the whole circuit we can only assume that there is a low impedance path (e.g. a capacitor) between B+ and Gnd in order to cause the failure.

So yes you are correct on the likely failure path: Q1 Vebo = 5V, Q4 Vbc(sat) = 0.9V, and Q3 Vce(sat) = 0.5V, the total of which is well short of 36/40V excluding the assumed controller supply voltage (noted above). This assumes that Q3 is on (which is dependent on the controller) in order to cause the failure. We can only assume there is a set of intermittent circumstances that cause Q3 to be on while the FETs are off (along with other possible conditions). The C6 capacitor on the base of Q3 along with C12 tells me that the engineers were trying to prevent this “race” condition, but this is a very short time (I calculate around 20uS for C6 and in my experience capacitors on the base of a transistor are not much use). The 10k resistor between Q3 and Q4 would be a better idea.

Of course, much of this is conjecture without knowing more information (e.g. a full circuit diagram). It should be noted also that I have found that these types of level shifting circuits are difficult to design and perfect, and there are ICs that do a better job.


----------



## kennybobby (Aug 10, 2012)

Did you happen to see the schematic in post #8 . That plus the T1 and T2 circuits covers most of what's on there. i may have a more complete version in my kicad folder.


----------



## taylorb (Feb 3, 2021)

Well you have been busy! C26 and C27, the power supply capacitors, would have to form the final path to the failure circuit. So I think we can definitively say what happened: a "glitch" caused Q3 to turn on while the FETS were off and this shorted Q1, Q3 & Q4 through the power supply capacitors from B- to B+. However as to what caused the sequence of events one can only guess and of course the transistors may actually survive the fault current.
In any case thanks for your work on the circuit which allowed recipients to fix their battery packs! May Ryobi pay attention and fix the problem!


----------



## Oric 1 (Apr 22, 2020)

Oric 1 said:


> A faulty battery for $ 10:
> 
> Nothing is happening.
> All cells below 0.1 V. Pull up to 3.6V with a power supply, but always nothing.
> ...


Hi everybody, 
Sorry for not being present enough, but i have a lot of work at home.

I have a half a dozen Ryobi batteries , all have capacity losses.

Else, for this new model, without success to repair it , i was about to unsolder the pcb.
I had an idea : unsolder the Power link, apply the short to RST, resolder power link and re-apply the short to RST.
All cells was above 3.0 V

Miraculously the battery has woken up !
The first led flashing when pushing on the test button.

Currently the battery is on the charger, and it's charging....


----------



## d.vencius78 (Apr 5, 2021)

hi. could any one please tell me how to reset it. Is it RST+ground. if yes for how long. The PCB is with one FET and on the side is 5 small holes the RST and oters. thanks


----------



## Oric 1 (Apr 22, 2020)

d.vencius78 said:


> hi. could any one please tell me how to reset it. Is it RST+ground. if yes for how long. The PCB is with one FET and on the side is 5 small holes the RST and oters. thanks


Hi, yes on your PCB the Reset is made when apply a link between the RST contact to GND contact. One second is enough.


----------



## Oric 1 (Apr 22, 2020)

Oric 1 said:


> Hi everybody,
> Sorry for not being present enough, but i have a lot of work at home.
> 
> I have a half a dozen Ryobi batteries , all have capacity losses.
> ...


After several balancing cells with my T240 li-ion charger, the battery increased up to 4.4 Ah. I used an electronic load to verify the capacity.









My process is :

Charge the battery with the original Ryobi charger.
Discharge the battery at 6A with my electronic load, until the BMS stop the discharge
monitor each cells with a multimeter , and verify the delta voltage.
if the delta voltage between cells discharged is more than 50 mV, the battery need to be balanced.
i solder the wire balance to the half of the battery, on the differerent test points. The battery is assemblied with 2 packs of 5S2P.
I charge and balance the half of the battery with my T240 charger
When balancing finished i solder the wire balance to the other half part of the battery, and i charge and balance the other side.
At the end charge, i discharge the battery with the electronic load.
And i check the voltage cell at the end of discharge.
If delta a always present, i try to rebalance with an other max cell voltage ( 4.20 instead 4.15 )
After 2 or 3 charge discharge cycles, the battery recover capacity.
For the last test , i desolder all wires and charge with the original Ryobi charger.
This battery was 3.2 Ah before balancing, and 4.4 after


----------



## d.vencius78 (Apr 5, 2021)

Oric 1 said:


> Hi, yes on your PCB the Reset is made when apply a link between the RST contact to GND contact. One second is enough.


Thanks. Should I use the resistor? or just wire?


----------



## City (Mar 30, 2020)

kennybobby said:


> That is quite a puzzle; i would have thought it was the mower shutting off using the T2 possibly due to over-temperature, or the pack shutting off for over-temperature. But when the problem disappears just due to cell change, it somewhat excludes the over-temp fault.
> 
> Possible theory: Maybe there is a low-voltage cutoff level, and the weaker cells let the pack drop too low under high load. When the load was removed the cell voltage bounced back up above the threshold, but then tripped again when under high load.
> 
> ...





kennybobby said:


> That is quite a puzzle; i would have thought it was the mower shutting off using the T2 possibly due to over-temperature, or the pack shutting off for over-temperature. But when the problem disappears just due to cell change, it somewhat excludes the over-temp fault.
> 
> Possible theory: Maybe there is a low-voltage cutoff level, and the weaker cells let the pack drop too low under high load. When the load was removed the cell voltage bounced back up above the threshold, but then tripped again when under high load.
> 
> ...


The first Ryobi I got was a mower that someone put out at the end of their driveway. I was excited when I saw that the battery was included, but no charger.  Fortunately the battery showed 4 bars full charge!!! yahoo! I took it home and it had the same symptoms as yours. It would run for 5-10 mins then turn off. I would release and retry the switch and get a few more seconds. If I let it sit for a bit it would work for a few more minutes and die again. I found the problem to be a few cells that were getting hot. I was able to power the mower with my e-bike battery no problem, so I pulled apart the battery and found a few cells in the ryobi pack were defective/fubar. I believe that one cell of the two parallel cells was defective/fubar and eventually caused its mate to become less affective as it was doing all the work and getting hot. If you are getting hot cells while the rest of the pack is relatively cool the battery pack probably has bad cells. I recycle the defective cells and am reusing the other cells in other projects. I was working on a project of rebuilding the battery packs with a different BMS and salvaged cells.

Here are some of my projects.



https://www.youtube.com/channel/UClzPIppZHLRt1j0muxKdaZQ/



City


----------



## City (Mar 30, 2020)

Oric 1 said:


> Hello Kenny,
> 
> For the female connector, i ordered twice adapter on aliexpress, for 2$ each.
> i'm waiting them, to verify or modify to adapt to the battery


I picked up a couple bases for these that hold the battery beautifully and have 2 wires coming from them for charge/discharge. I also got a friend to 3D print a holder that holds the battery nice but requires the connector and wires(damn limits of 3D printing). I was also planning a wood project to hold the batteries the same as the plastic version. As soon as I get the pins that I ordered I will upload a video to my youtube channel showing all 3 and parts/price breakdown. Hopefully I can do this by May 2021...ish.

Here are some of my projects.



https://www.youtube.com/channel/UClzPIppZHLRt1j0muxKdaZQ/



City


----------



## Oric 1 (Apr 22, 2020)

Bonjour City,

I unsoldered the 2 female contacts and print an holder


----------



## Oric 1 (Apr 22, 2020)

Oric 1 said:


> Aliexpress 40V battery received !
> 
> 
> 
> ...


My Aliexpress battery is dead after 3 uses.
Two cells leaked corrosive fluid ( lithium ).
I unsoldered the pcb. it could be use for an other project. All holes except one are compatible with the original ryobi pcb.


----------



## City (Mar 30, 2020)

Oric 1 said:


> Bonjour City,
> 
> I unsoldered the 2 female contacts and print an holder
> 
> ...


Looks like your connectors stick further out than mine


























The red one was purchased and the white one was 3d printed by a friend. I am still waiting on the connectors for that one.


----------



## Albertintin (May 28, 2021)

ga2500ev2017 said:


> I've bought a few of these. I want to package 4 of them together as a pack for my black and decker 36V self propelled lawm mower. So my primary interest is in paralleling the packs and alternative charging methods.
> 
> The BMS can be completely bypassed, thus creating the option of both parallelization and alternative charging. The BMS has access points to every terminal for each of the cells in the pack that can be tapped. They are labeled on the board as CL[1-10][+-]. So CL1- is pack ground, while CL10+ is the pack positive terminal. The two half packs are joined with the tab between CL5+ and CL6-. Note that the MOSFETs switch ground to the power tab -, while CL10+ and power tab + are connected directly together.
> 
> ...


I have seen lot of video and read lot of suggestion regarding a way of doing something when ryobi battery is a problem, so for me the best way of making a difference is to replace all battery / only tha bad one and make another 2 packs of 10 cells and use tge same board, because of what I read it seams that it is always a battery problem voltage is not the same at everyone. Is it somenthing that you have tried?
thank to let me know


----------



## ShodanNinja (Jul 2, 2021)

Ryobi 40v rev Q

ok, i got all 13 of my voltages.
G-1 = 4.0
1-2 = 4.0
2-3 = 4.0
3-4 = 4.0
4-5 = 4.0
5-6 = 3.8
6-7 = 4.1
7-8 = 3.6
8-9 = 4.1
9-10= 4.1
G-5 =19.8 
5-B =19.9
G-B=39.9

That charger is from when i used to vape. made for 4.2v charging, easy. when I hold the leads on say 5-6 I watch it charge really fast in about 8 seconds(at only 0.5A) then when i let off and reapply voltage starts back at 3.8 and climbs back top 4.2v. Whats going on here?


----------



## TaSa (Jul 7, 2021)

Oric 1 said:


> Hello Kenny,
> 
> This morning i monitored the dialog during 1h30.
> I discharged a fully charged battery with my electronic load at 5ah for 10 min.
> ...


My battery was like this at the end.
0011110110100000 10011000000001*1*0 end


----------



## rcbullock (Jul 20, 2021)

Lots of people keep asking on my video about resetting the older packs with the PIC contacts. If anyone wants to comment on that: 




My video DOES show the super simple reset of the newer packs with the RST contacts, so I'd also like to post if there is a way to do it with older boards. 

The most common cause in newer batteries is the thermocouple trips on overheats and stupidly (IMHO) doesn't reset after a cooldown. My use case was thick weed cutting with a sold cutting head in Texas heat. 

So far, confirmed working resets on OP40501 and OP40401.


----------



## SteveBabiak (Dec 20, 2021)

kennybobby said:


> i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.


There is a YouTube channel called “Serendipity Sue” where the guy who runs it has done just that via 3d printing.





The above video shows that female connector in use.


----------



## DenisJ (Dec 12, 2021)

Hi there 
maybe someone can help me with a problem on the Ryobi batt. 
I just change the 18650 elements on the Ryoby 18V battery (10 pieces of 18650) 
and now the battery is not started anymore. 
Anyone have idea how can I reset is please ? 
Thanks a lot 
Denis


----------



## DenisJ (Dec 12, 2021)

JaredAllen said:


> I really hope you figured it out
> 
> 
> Sent from my iPhone using Tapatalk


Not yet... but I think I'll recycle it :-(


----------



## lunacyworks (11 mo ago)

Did you compare the internal battery resistance?



Oric 1 said:


> I have several functional batteries but which lack capacity.
> The battery works well on the mower but after 10/15 min , it stops and restarts every minute.
> This symptom is confirmed on the 2.6 ah dated 2011/2012.
> When you replace the cells, the problem goes away.
> ...


----------



## kennybobby (Aug 10, 2012)

i didn't know there was any activity on this thread--i thought i was subscribed to get PM notifications, but that didn't seem to work. 

i made some edits in posts #1, 2 to identify how to reset and the serial comm of T1, try to clean it up a bit so you don't have to read everything to get to what is needed.


----------



## kennybobby (Aug 10, 2012)

TaSa said:


> My battery was like this at the end.
> 0011110110100000 10011000000001*1*0 end


i think that is the mode signal bit for the OFF mode. See post #94 on page 5 for details, the nibs (4 bit half-bytes) are reverse ordered.


----------



## buckeyeguy (9 mo ago)

Seeking some guidance

Have an older pack OP4026. Was working now isn't.

What I know: Pushing the button with the 4 led's and no LED's turn on (light)
The OZ chip (at U3) appears to be "on". It is warm/hot to the touch, reads at 100F, but this can vary. Sometimes it registers cooler like in the 80s and feels cool other times it gets hot. Best way to describe is it feels like it is on/off or pulsing.

Is it normal for this chip to be drawing power/warm?

I also read about the mosfet, but mine appears to have only 1, so I wasn't sure how to test/reset and if that was even a good idea.

I tried the reset method mention on post 91, but no luck. 

Is there another way to reset? Should I try to charge the cells between CL1- - CL1+ above 3.7? 


Measuring between:
CL1- and Bat+ = 41.80v
Bat+ - Bat- = 20.98V
Bat+ - T2 = 41.74V
CL1- - CL1+ = 3.383V
all others in the series eg CL2-CL3 and the respective counterparts read 4.2 to 4.328 V


----------



## kennybobby (Aug 10, 2012)

It's not normal. It is trying to bleed down those too high cells and will burn itself up unless you take action. It doesn't need reset, it needs to see lower cell voltages.

Your cells are way too high for some reason. Put an external load like a resistor or light bulb or cooking stove eye (burner element) between CL10+ and CL1+ (no need to include cell 1 because it is already low). Try to get a load of a couple of Amps or so, and monitor the voltage to get the cells down to about 3.8 to 4.0V. Then adjust cell 1 up to match the rest, then try the reset. 

i usually just add some wires with a spot of solder to the blobs of solder already on the board to use for cell voltage adjustment. Good luck hope it works.

Any ideas how the cells got to be overcharged?

[edit]
But first measure the voltage of each cell to make sure there is not a shorted pair somewhere in the pack. Don't try the bleed off unless all the cells are about the same voltage or higher than 4.15V.


----------



## buckeyeguy (9 mo ago)

Thanks for the response kennybobby. When you say lightbulb, is that like an automotive 9006 bulb? 
Or just a regular incandescent bulb?
Something else? I don't have a stove element so might need some other ideas.

I've got some resistors in the following values: 100, 220, 330, 1K, 2K, 5K, 10K, 100k,1M 

No idea how the cells got so high in value. I had it on the charger and took it off to use and then the fun began.

Here are all the values I see:

CL1- CL1+ = 3.324
CL2+ CL3+= 4.223
CL4+CL5+ = 4.299
CL6- CL6+ = 4.301
CL7+ CL8+ =4.303
CL9+ CL10+ = 4.307


----------



## kennybobby (Aug 10, 2012)

i was thinking of some sort of high power resistance that could take about 2 Amps, such a 100W light bulb or outdoor spotlight bulb, or element from an electric range or oven. i get them at the thrift store for a buck and they can be strung together to make variable electric loads. How about a battery tester for a car starter battery--have anything like that.

An old electric heating blanket? A heater strip to keep water lines from freezing?

An electrical resistance load of about 20 Ohms rated at about 80 Watts or higher. Do you have any old TVs or scrap electrical equipment, or circuit boards, electric drill motor (corded variety), etc.

Your cells are way too high, don't know how that happened but it is not good. something may be broken with your charger.

i suspect that your resistor assortment are small 1/4W resistors with metal leads; they would not be suitable, need a power resistor for something like this.


----------



## buckeyeguy (9 mo ago)

I tried the 100W bulb and it burned out after about 20-30 seconds (might just be a bad bulb). I will go to the thrift store tomorrow to get an electric stove element. Don't know if the pack will last that long (overnight).

Do I leave the element connected for a little while or is it a quick touch then remove situation?


----------



## kennybobby (Aug 10, 2012)

Measure the resistance with your DMM. You might want to get 2 just so you can adjust the load if it draws too much with only 1.

You will want to connect it for a length of time to get the cells down. You could do some touch testing just to get an idea of how much current it is drawing. 

The current will be the voltage divided by the resistance, so if the 9 cells have a total voltage of about 41 and the range eye is about 8 Ohms, then it will be drawing 41/8 = about 5 Amps. At that rate it would drain your cells to the lower limit in about 30 minutes; so i would recommend to let it run 3 minutes, then stop and measure the voltage; then 2 minutes and stop and measure; then 1 minute and stop and measure. If not there yet continue with 1 minute intervals. It is better to go slow and measure often than to get in a hurry.

With 2 range eyes, the R would be double, 16 Ohms; so current would be 41/16 = about 2.5 Amps, a lower drain rate.

If cell 1 is at 3.8, then the target for the 9 would be about 34 Volts, so you are looking to bleed it down from 41 to 34 at whatever rate you can get with 1 or 2 stove eyes.

Once you get the high 9 more in line with cell 1, then i suspect that the battery will operate as normal again, but if not then try the reset. Measure all the cell voltages to see how closely they are balanced; if they are widely varying then some manual balancing may be needed.


----------



## buckeyeguy (9 mo ago)

Wanted to test a few things and took a few days. 

Thank you for the suggestion on how to drain. I found a long hot plate that had 18 ohms and 800 Watt rating. Worked Great!

It appears that the BMS or the board is bad. Even after discharging the cells/banks that reported high, the voltage continued to drop until it showed less than 16 Volts total.

I removed the pcb and tested the cells and all tested good! I charged and balanced over the weekend and found no weak cells. 

Not sure what the issue is, I guess some type of internal failure and then the BMS went to fail safe...aka drain the cells.

If there is anything you would like me to test, please let me know.


----------



## kennybobby (Aug 10, 2012)

So you were able to bleed down the higher cells (CL2-10) to the level of CL1 ?, and then did you try to do the Reset?, and still it would not work in the tool?

And later you measured manually the voltage of each cell pair and they were all within the same range?

It could be that the FET was damaged somehow, so there is no path from the cells to the output terminals--but when you say that you charged it after the bleed down, did you use the Ryobi charger station to do this?

If you could try to put a load on the pack using your heater connected to the + and - blades of the connector--this would tell you if the FET is either broken or not being commanded to turn ON.

The FET could be replaced if it were bad, but there is a lot that we don't know about the OZ chip and the firmware of the controller to know how to troubleshoot those items.


----------



## buckeyeguy (9 mo ago)

So you were able to bleed down the higher cells (CL2-10) to the level of CL1 ?, Yes
and then did you try to do the Reset?, Yes, following post #91 as mine has the 5 board contacts and a single FET at the connector end
and still it would not work in the tool? Correct

And later you measured manually the voltage of each cell pair and they were all within the same range? Correct, Cl1 was lower, but that was already known.

but when you say that you charged it after the bleed down, did you use the Ryobi charger station to do this? No, I removed (de-soldered) the board and then charged each cell using an external charger. 

If you could try to put a load on the pack using your heater connected to the + and - blades of the connector--this would tell you if the FET is either broken or not being commanded to turn ON, I'll try this


----------



## kennybobby (Aug 10, 2012)

If you already have the board removed then you could check if the FET is okay or not. Lots of videos on how to do it if you do a search for testing a mosfet, e.g.


----------



## buckeyeguy (9 mo ago)

So I have another battery exhibiting similar behavior and about the same age.(I have not taken off the board yet). I've done the same steps and this time I tested with the heater connected to the + and - blades of the connector. Doesn't get hot and voltage reading on DMM is 0 (while also connected to the load). Will read a voltage with DMM when placed on the blades with no load. I see the above video for testing mosfet, but that appears when not connected. Any way to test while connected to the board? Mine is a single fet at the blade connector...identical to this board posted previously.


----------



## kennybobby (Aug 10, 2012)

First measure each CL voltage and write them down so you can determine the level and balance situation. If only one or two pairs is low, then it might help to charge them using a power supplies up to about the average level of all the rest. If any CLs are totally drained below 2.5 Volts, then you could use that board for parts possibly to repair the other pack with the good cells.

The FET acts like a switch to connect the CL1(-) terminal to the blade (-) thru the large current sense resistor down by the CL1- solder joint. So unless the FET is ON, then any measurement or load on the Blade terminals will not have a current flow path and it won't provide any power.

It can be dangerous to charge cells that have fallen too low (fire hazard), so be careful out there.


----------



## twaddington (8 mo ago)

For folks finding this thread and looking for sockets that match the Ryobi 40V battery connections:

I recommend checking auction sites, or your local electronics recycler, for the Ryobi OP403/404 charging units. I purchased one on eBay for $11 shipped, which was cheaper than the 3D printed sockets some vendors are selling.

You can take the charger apart and desolder the connector, or just solder some DC power leads directly to the connector and use as-is. Works great.


----------



## kennybobby (Aug 10, 2012)

Thanks tw, that is a good find. 

i ordered the OP403 (w/ USB output) and ran it for an hour powering up some LED light strings on the USB port--and dang if it didn't get too hot to touch. It's not gonna last long with such high internal temperature. i haven't dismantled it yet to see how the DC/DC works. 

It gets 42VDC power for charging thru a special 2 pin plug; i didn't get an AC adapter and cord so can't try charging the 40V pack.

The 40V connector has sockets for +, -, and the T1 only, no T2 socket. The big OP401 charging bases have all sockets populated.


----------



## twaddington (8 mo ago)

kennybobby said:


> Thanks tw, that is a good find.


Most of these chargers are ultimately going to become e-waste. Might as well reuse them! Whether they charge or not the socket remains usable.

Attached are photos from the first pre-owned unit I purchased.

It's more complex than I expected. I thought the batteries themselves contained most of the charging logic; so I'm not entirely sure what it's doing.


----------



## kennybobby (Aug 10, 2012)

Thanks for the photos, that shows where the heat is generated--all those resistors to bleed off excess voltage. 

Very cheap and crude DC/DC, but it is a sturdy housing with the sockets to make a portable 40V supply.


----------



## danededane (7 mo ago)

Hi guys , I dont hope to bother you too much . I'm in a little of a trouble with my 40V battery . 
I changed the 10 cells on a dead 1,5Ah battery to some 3200mah cells . But it still doesnt work . 
If I take some wires directly from the cells positive and negative - I measure around 41.8v. 
On the battery positive and negative I measure around 19.5v
When I put it in the charger it just blinks red and green. 

Any suggestions?


----------



## kennybobby (Aug 10, 2012)

i can't make out the board solder joints clearly, but did you make all the little "half-moon" solder bridges?. For example CL7 looks like an open solder bridge. Those are the Cell monitoring pick up points for the BMS.

That is an early version using only one big FET (transistor on the bottom end), and i suspect that the functions are similar to the 2 FET boards. The FET makes or breaks the connection between Pack ground and the Negative blade. terminal. If the controller detects an abnormal situation it drops the FET gate drive and the Pack is disabled. The gate has to be driven by something to allow the Pack to discharge or charge, which could be either the OZ chip or the microcontroller.

A simpler replacement board was discussed earlier in this thread. That would get rid of all the proprietary and useless features of the OZ chip added to the OEM boards.

it might be that you could do a Reset procedure to restart the controller. The pads are located in the upper left corner of the board, instructions are posted earlier in this thread.

i almost hate to mention it, but as a last resort if all else fails (reset or replacement board), then a dangerous trick to allow discharge use of the Pack would involve a bypass jumper. There would no longer be any BMS protection circuits and it wouldn't charge on the Ryobi unit (manual charging with power supply). You would be frequently opening the case to measure the cells, and YOU and your voltmeter would be the BMS. Not as convenient as a fully functional Pack, but at least you could get some use out of the new cells.


----------



## danededane (7 mo ago)

kennybobby said:


> i can't make out the board solder joints clearly, but did you make all the little "half-moon" solder bridges?. For example CL7 looks like an open solder bridge. Those are the Cell monitoring pick up points for the BMS.
> 
> That is an early version using only one big FET (transistor on the bottom end), and i suspect that the functions are similar to the 2 FET boards. The FET makes or breaks the connection between Pack ground and the Negative blade. terminal. If the controller detects an abnormal situation it drops the FET gate drive and the Pack is disabled. The gate has to be driven by something to allow the Pack to discharge or charge, which could be either the OZ chip or the microcontroller.
> 
> ...


Hi KB , Thanks for your quick reply! You were right about the halfmoon solder bridges - I did forget about them , so I just made them all again and now the battery can operate my hedge trimmer . Still not charging however . It starts charging and blinking green but after a few seconds it starts with red/green blinking . I have tried to reset the battery with the RST and 3.3V in the corner , dont know if this is the way?


----------



## kennybobby (Aug 10, 2012)

i suspect a blown transistor in the communication circuit between the charger and the pack thru the T1/2 lines. See the schematics earlier in this thread. Using the diode check function of your meter i think you could ring out all those transistors to find a short or open.

The charger sends out a serial stream and the Pack has to be able to read it. i think this is done during the green blinking led of the charger. It's really stupid--it just repeatedly sends out the model number of the OZ BMS chip.

i don't think reset would matter since it was allowing discharge means the FET gate was being driven.


----------



## danededane (7 mo ago)

kennybobby said:


> i suspect a blown transistor in the communication circuit between the charger and the pack thru the T1/2 lines. See the schematics earlier in this thread. Using the diode check function of your meter i think you could ring out all those transistors to find a short or open.
> 
> The charger sends out a serial stream and the Pack has to be able to read it. i think this is done during the green blinking led of the charger. It's really stupid--it just repeatedly sends out the model number of the OZ BMS chip.
> 
> i don't think reset would matter since it was allowing discharge means the FET gate was being driven.


Can you please try to point out on this image where you want me to test transistors? I'm not that strong in schematics .
I just have a super cheap multimeter , can that do the job? I dont think it has any diode check function :/


----------



## kennybobby (Aug 10, 2012)

i can't see your meter clearly, but it appears to have a transistor tester built in, and likely the red position just next to that is the diode check function,

The transistors are marked with Reference Designators on the board with the letter "Qnn" like Q2 is near the edge in the bottom right corner. They will have 3 pins called b, e, c; base, emitter, collector, and there should be a diode voltage drop of about .4 to .7 volts across b-e and b-c and open circuit e-c in a good transistor. Some are NPN and others PNP type and the polarity of the meter leads will be have to be adjusted. Watch some utub vids about how to check diodes and transistors using the diode function of the meter. Then check them all and take notes of the results.


----------



## danededane (7 mo ago)

kennybobby said:


> i can't see your meter clearly, but it appears to have a transistor tester built in, and likely the red position just next to that is the diode check function,
> 
> The transistors are marked with Reference Designators on the board with the letter "Qnn" like Q2 is near the edge in the bottom right corner. They will have 3 pins called b, e, c; base, emitter, collector, and there should be a diode voltage drop of about .4 to .7 volts across b-e and b-c and open circuit e-c in a good transistor. Some are NPN and others PNP type and the polarity of the meter leads will be have to be adjusted. Watch some utub vids about how to check diodes and transistors using the diode function of the meter. Then check them all and take notes of the results.


Here's the multimeter:










I get the C and B == collector and base but why are there two "E"?

Which one is Q1 and whats the name of the other one ? 










And why cant I find Q2 on the schematics?


----------



## kennybobby (Aug 10, 2012)

Q1 is above and to the left of your red circle; D8 is the other 3 pin device located below the red circle.

The diode check is the red labelled function just 1 notch clockwise from the transistor function. Notice the diode symbol and the continuity beeper symbol. A short or very low resistance will beep, a diode drop will show the voltage in the meter display.

As for Q2, i think it is related to the programming port, not to charging.

The schematics in post #1 are for the T1 and T2 circuits of the 2 FET boards and may not be exactly the same for the single FET version. See the picture of the board and it has lots of transistors that your board lacks. 

But its worth checking all the diodes and transistors you can while troubleshooting to rule out possible causes, be very careful when probing on a live board not to short any circuits with a tip and cause damage.


----------



## danededane (7 mo ago)

kennybobby said:


> Q1 is above and to the left of your red circle; D8 is the other 3 pin device located below the red circle.
> 
> The diode check is the red labelled function just 1 notch clockwise from the transistor function. Notice the diode symbol and the continuity beeper symbol. A short or very low resistance will beep, a diode drop will show the voltage in the meter display.
> 
> ...


Alright now I get the diode test function . 

Its funny when I try Q1 with the collector emitter / the two pins on the same side 
with the positive probe on the emitter 
I get 564 on the screen but you said it should be open circuit ?

The battery indicator also starts blinking like when you put it in the charger . Not just showing battery status but actually charging .


----------



## kennybobby (Aug 10, 2012)

i should have mentioned not to check diodes and transistors while they are powered up in a circuit board. That should only be done off the board or with an unpowered board.

When the board is powered, then the checks involve measuring the voltage across devices to determine if it is ON or OFF, or what voltage exists at a circuit node.

The terminal to the left of the 2-terminal side is considered as pin 1, and is generally the Base, pin 2 next to it is the Emitter, and pin 3 on the opposite side is the Collector. But this is not a hard and fast rule, the datasheet for the part will show the orientation and should be consulted to verify the layout of the part.

See post #67 for part numbers and how the charger communicates to the pack.  #67

datasheet: https://www.diodes.com/assets/Datasheets/ds30062.pdf




> The battery indicator also starts blinking like when you put it in the charger . Not just showing battery status but actually charging .


That is quite puzzling--Your meter leads were turning on Q2 which provided the necessary conditions to allow charging. i can't seem to find any mention of the function of Q2, but this is certainly worth investigation. See post #14 for a clear picture of your board from Oric.

[edit]
looking at the board it appears that the output of Q24 is upstream of Q2 and drives the base of Q2 to turn it ON. It is located near the header marked SDA1, but i haven't traced it down to figure what is driving Q24?


----------



## danededane (7 mo ago)

kennybobby said:


> i should have mentioned not to check diodes and transistors while they are powered up in a circuit board. That should only be done off the board or with an unpowered board.
> 
> When the board is powered, then the checks involve measuring the voltage across devices to determine if it is ON or OFF, or what voltage exists at a circuit node.
> 
> ...


Well - not testing while its powered on... thaaaats.. a little too late 

Anyway no harm done . I'm guessing you cant use my measurements for anything . Then I have to desoldering everything again .

I have looked at post #14 from Oric but it seems like his board has alot more transistors than mine?

Its the Q1 that makes the battery indicator blink not Q2


----------



## kennybobby (Aug 10, 2012)

There are two ways to troubleshoot electronics, actively powered up, or passively with no power. i do diagnostics and repairs all the time and just know from years of experience when and what tools to use. 

When a circuit board has power then the troubleshooting would consist of using the voltage mode of the meter to measure the voltage at various nodes of the circuit and compare with expected values (assuming a schematic is available to pinpoint the nodes). When you find a voltage reading that is not correct, then you know you are getting close.

When a board has no power, then the passive resistors and capacitors can be measured to check their values, and diodes and transistors can be checked without danger of arcing and shorting a hot circuit.

i realized later that you were not familiar with this sort of thing and may not be aware, hence the belated warning of checking transistors while powered up. Hopefully no damage was done.

If you did make measurements and got some data then post it up. There may be some clues that would help.

Zooming in on Oric's board and your board shows that they are from different build dates, but appear to be the same basic circuit board with only a single FET, and only 5 small transistors and a diode around the U2 chip. Are there more that i'm not seeing?

It might be possible to just de-solder the little half moon bridges for each CL and that would remove power from the controller chips such that diodes and transistors could be tested using the diode check function of the meter. De-solder the half moons then probe if any voltage still exist on the board before doing the passive checks.

i haven't traced the circuits for Q23, Q24 and Q2, but they seem to all be related and involve both U2 and U3, and also affect the charging as you discovered. So all the parts in those circuits could be passively checked to verify their value. It could be as simple as a bad resistor.


----------



## kennybobby (Aug 10, 2012)

danededane said:


> ...
> 
> Its the Q1 that makes the battery indicator blink not Q2


Okay now that is getting somewhere. Take a look at the T1 schematic and you can see the nodes for the Q1 transistor. T1 is a communication line between the charger and the pack. There may be differences in your board but it will likely be a similar function.

You could measure voltage at all the circuit node points from T1 thru Q1 and possibly find the culprit. OR passively probe all the components in that path to find a bad part. Two different ways to get to the root cause.


----------



## danededane (7 mo ago)

kennybobby said:


> If you did make measurements and got some data then post it up. There may be some clues that would help.


Here are the combinations that gave me a reading using the diode function:









I will try desoldering the bridges later if this doesnt make any sense. 
Sorry I'm not that familiar troubleshooting electronics. Luckily I didnt pay much for the 40V set I bought so no harm done.


----------



## kennybobby (Aug 10, 2012)

What was the diode check voltage in the second figure, reading e-c ? That is not normal, maybe Q1 has a defect.

check resistors R19, 20, 37, R2, 4, 6; and Capacitors C6 C12.

The voltage at the collector of Q1 with respect to the emitter should be 3.3V when Q1 is OFF. Can you check if this voltage is present at the collector node?

[edit]
i found some notes of conversations with Gregory (Oric1) and Q1 and Q7 are NPN type and involved with the T1 circuit communicating with the charger.

The T1 signal drives the base of Q1 and the collector of Q7. When Q7 turns ON, then Q1 is turned OFF. The PIC controller has lines to the base of Q7 and the collector of Q1.

notes indicated that Q2, Q23, Q24 are fet devices not bipolar, and are used for communication between the OZ chip and the PIC microcontroller. Q2 and Q23 are N-type, Q24 is P-type. So these can't be tested with the diode check other than to verify the internal body diode (which your test indicates is good).

When the charger sends a "1" it raises T1 high to 5V, which drives Q1 ON and sends a "0" to the PIC. When charger sends a "0", T1 goes low and the collector of Q1 goes Hi due to the pullup resistor R4 connected to the 3.3V buss.

When the PIC talks to the charger and sends a "1", it drives the base of Q7 thru R19 to turn it ON, which pulls down the voltage on T1 (held up internally in the charger), and Q1 is OFF so the PIC senses a "1" on the Read port due to the pullup mentioned above. When the PIC sends a "0" then Q7 is OFF and the T1 lines stays HI, which drives the base of Q1 to ON such that the sense at the PIC is LO, i.e. a "0" at the collector of Q1 input to the PIC.


D8 appears ok


----------



## rosrooster (4 mo ago)

I read through all of the posts and I can honestly say I understood about 60% of what has been talked about, so please bear with me. I have a OP40602 40v 6AH ryobi battery. Currently it shows 4 solid lights when I push the indicator on the front of the battery. I was able to get it to a full charge by connecting positive and negative terminals from a known good 4ah OP40401 battery to the b- and positive blade terminal. I have also tried jumping the RST and GND terminals, but I'm still receiving a green and red flashing light when i plug it into a charger. Attached is a picture of the battery board. Currently showing 4.06v on each set of cells. When battery is put in a tool it runs the tool fine, just not charging when connected to the charger. Any help is appreciated


----------



## kennybobby (Aug 10, 2012)

That board looks similar and likely has similar functions. Can you read the part numbers on U1 and U8 chips--i can't read them in the photo.

i noticed lots of metal splatter on the board, maybe solder balls or something blew? It needs a careful cleaning without shorting anything, and remove any shorts if they exist. The board has power and can arc and spark with lots of current if the cells get shorted, so be careful.

There are 2 big transistors on the heat sink (no shown in your picture), one is for the discharge path and the other is for charge. If they don't get a gate signal to turn ON, then the function will not be active. When you charged from the + blade to the B- pad, you have bypassed that Charge FET.

Most failures seem to have been the tiny 3-pin transistors such as Q1,etc which are used in the T1 or T2 communication circuits. If any of those fail then the charger can't talk to the battery and the big FET for charging will not be turned ON. And the red-green blinking pattern will be shown for a defective battery.

Look at the T1 schematic and see if your board has the same transistors and resistors. With a voltmeter it is possible to measure the tiny transistors to find an open or short; these can be removed and replaced,

Let me know what you find.


----------



## rosrooster (4 mo ago)

Thanks for the response kennybobby,
I didn't notice any leftover metal on the board, the U1 chip had something white on it and I was able to brush that off.

What is the best way to test the Q1 Transistor? 

Does 3.3v across T1 and B- indicate that the fets are open? I can measure 3.3v across T1 and B-, and T2 and B- after i perform the reset on the board by jumping the GND and RESET terminals, but after i try hooking up the charger again and it does the red and green blinking light it no longer shows any volts from T1 or T2 across B-.


----------



## kennybobby (Aug 10, 2012)

That's encouraging voltage readings. 

The Reset is working to get the T1 circuit up and running, but there is something not letting the signals thru when plugged into the charger.

The T1 is used to do a self check by the battery that the FETs are On,
and to send the code signal when charging. 

If the charger reads the code okay, then it will operate to charge the battery.

The problem could be any of the transistors on the T1 schematic found in post #2.
It could be a defective charger.

Did you get the marking codes of the chips?

i would imagine that your transistors will have different reference designators so my T1 drawing probably won't be the same for your battery.


----------



## TottoA (3 mo ago)

A great thanks to Kennybobby for starting this thread. I have been reading this post with great interest as I have been experiencing some of the issues related to it. Now I want to share some of my experience with you.

Some years ago I bought a Ryobi Max battery, 36v, 9 Ah, for a real bargain in a shop. At the time they did not have anything in the shop the battery fit into. Basically, for the prize, I could salvage cells for other projects. The battery has been stored, and I haven’t done anything to it.


A few months ago I came across a guy who was selling a brand new 36v Ryobi chainsaw, the latest model RY36CSX35A, and thought that may be something for me. This fellow told me that he was so happy with the previous version of the Ryobi saw, and when his saw malfunctioned, he bought the new version. Unfortunately for him, it was the battery that caused the problem with his first chainsaw. I got his old 5 Ah battery for free when I bought his new saw. I thought maybe I could fix it, as I have some experience of fixing tool batteries.


Experience 1: With my brand new Ryobi chainsaw and my previous bought 9 Ah battery in my garden, I soon discovered that the battery hanging below under the saw was not constructed for this. The battery cracked, fractures around the screw caused the battery to split apart. I took it to my workshop and glued it together. But this was for no help, and the same happened again. The four screws holding the battery together are way too small and the plastic in the battery wall is too thin to maintain the weight of the battery when hanging under the saw. The solution to this was that I made four pierce out of aluminum to fit in the groove for the screws. I drilled out the location for the original screws and glued in place a 40/50 mm long M3 all-thread rod in the bottom part of the battery. The top and bottom part of the battery case was then put together and secured with four M3 nylock nuts. Problem solved.
















Experience 2: The malfunctioning 5 Ah battery was blinking red-green when attempting to charge it, and I attempted every trick available through the Internet and Youtube to get it operational again. I opened the battery, recharged individually every cell group to 3.7 volt and attempted to reset, as a lot of people suggests. This was of no luck, it still blinks red-green. I noticed that after manually recharging cell group the battery slowly discharged over a few days. I then started to test with an Ohm-meter, and observer that one of the cell group had an odd reading. The forward resistivity in a cell group is 0 ohm, and the reverse resistivity is in the range of 10-15 Mohm. On one of the cell group I measured only 27 ohm in reverse. I dismantled the battery and replaced the malfunctioning cells. I spot welded in two new cells and put the battery back together, reset the battery and voila! The battery charged again with blinking green - problem solved.


My learnings from this:

1. The big Max batteries are not made for hanging, they are way too heavy for this, unless they have been modified as mine.

2. The electronics in the battery will tell the battery to discharge, if it finds out that the battery has an error.

3. As the reverse resistivity is in the range of 10-15 Mohm, the battery will gradually lose its charge if left unused for a longer period, and the battery will then go into "sleep mode".


----------



## kennybobby (Aug 10, 2012)

That's a couple of good saves to keep using the packs. Thanks for sharing.

Finding 2. agrees with the datasheet that the OZ chip has a fail-safe mode to bleed the pack in the event of a fault.


----------



## NexGen-3D (3 mo ago)

Hi, I have read through this thread, and pretty sure no one mention it, but I had been trying to directly charge these batteries without using the Ryobi Charger, the after market batteries I have from China, will charge directly, but the original batteries as we all know will not, the internal BMS shuts off and goes to 0v, what I have found is a 300kohm resister from T1 to the + terminal will allow you to charge the battery fully to 42v at 5amp, this works for the 5amp older versions and the newer ones.


----------



## kennybobby (Aug 10, 2012)

Did you measure any voltage on T1 before doing this mod to add the resistor?

On a closed pack i measured pack voltage from + blade to T1 and -0.2 V from T1 to the - blade. 

On an open pack (cover removed) i measured 0.925 V from T1 to Gnd (Cell 1 negative solder junction). The Gnd and - blade are isolated from each other by the 2 FETs and will only be at the same potential if both FETs are commanded ON, otherwise the - Blade is floating and disconnected from the pack (which prevents charging or tool operation).

i suspect that your mod has the effect of raising the voltage at T1 in order to turn ON the base of the Q3-Q4-Q1 transistor string and change the state by pulling down the signal at U2 pin 21. Maybe this is enough to cause U2 to drive the gate of the Charging FET.


----------



## NexGen-3D (3 mo ago)

No I didn't measure anything, I just monitored the charge voltage and amperage.

I have 8 of these packs, the old ones dated 2017 wont charge with this mod, and they are the touchiest of the batteries, as they have always cut out randomly while using them, they will run all the way to flat, but if draw too rapid load they intermittently cut out, and these will not charge using the resistor, the packs I have that are dated 2020 and are the new type, these will charge all the way to 42v but the moment they get there, they will cut out momentarily, probably should drop the charge voltage to 41.7v if you need them to stay active.

I also have the nock-off ones made from the finest Chinesium, they say 6 amp, but they go flat quicker than the 5 amp oem ones, but these will let me charge with out the resistor all the way to 42, but they also have issues in the oem chargers, they only seem to charge to about 39v and will randomly throw the charger into fault, these would the best candidate if you wanted to build a powerful pack from good LG or Samsung Cells as the BMS is a lot more forgiving. 

And the last type I have, the big honking 6 amp pack that comes from the big mower, they made it huge to stop you from using it in certain tools, its dated 2020, but it wont charge with resistor mod either, just as touchy as the 2017 model batteries, but it does actually put out the most power, really makes my mower sing, and will not bog down even on the thickest lawn, I suspect it may have 21700 cells in it, haven't opened it as they have resined over the screws for tamper protection.

I initially wanted to use these packs for camping power, but after all these hassles, I wont bother, and I will say they are a terrible investment, I love the mower and lawn trimmer, but that's where it ends, I have Dewalt, Hitachi and Bosch Blue batteries, all will let you charge, all will stay active with no special things to trick them, Ryobi plain suck, even the 20v ones, they also require 18kohm to trick the BMS, if Ryobi actually released an automotive 12 to 24v portable charger, then I would not be looking for a way to charge them directly, even their new "Powerstation" skin that they charge you as much as real portable power-station like the Bluetti which comes with built in batteries, and even that cant charge from solar, or from a 12v source, its basically useless.

If I didn't actually have any of the Ryobi 40v tools I would just open the packs and run some wires to the terminals of the fet and add a switch to the casing, any time it thinks it knows better, I will just bridge the terminals with the switch and bypass the BMS.

TLDR: Just invest in better brand, the Dewalt FlexVolt is a much better choice, and are very comparable in price, will give 20v or 60v, and my opinion is 20v is better choice for portable power, it will allow you to use tools from any brand with a 3D printed adaptor, will allow you run products designed to operate between 12and 24v, they will also work as a higher voltage ebike battery giving you higher speeds when used at 60v, they will allow you to run 2 packs in series if you need 40v, or if you want some ridiculous DC power, run 2 packs at 60v in series for 120v. The Ryobi are good for recycling the cells from to use in something else.


----------



## AMDFX8150 (2 mo ago)

I am so glad there is a forum for this as I am trying to revive a next gen 6.0 AH and a 7.5 AH as someone mentioned before the pack will bleed if a under volt condition is met. This is true, it will bleed the pack through a parallel pair of 750 OHM resistors coming to around 375 ohms, you can see them in Rosrooster's picture. The PCB's and controllers on these units are identical with the 6.0 missing two of the FETs. The 30 leg is a Texas instruments BQ7693003, it's companion controller is unidentifiable but markings are (Top) 824j. (Middle) 92 04, (Bottom) 20511A. It must be TTI proprietary, but the condition I stand at is that I've desoldered the bleed down resistors and charged pack to 42v and as soon as I drop those resistors on it resumes bleeding down. Read through the 63 page datasheet file for the TI BQ76930 and it states it will remain clamped high on a discharge circuit until cleared by the host, batteries appears to have two serial wire debug ports. Both these 6.0 and 7.5 have these resistors and do the same thing. As soon as I begin sending voltage directly to the 40v pack the resistors on both begin to heat. I know my way around flashing a bios chip but this is a whole new level for me, this is like tampering with a brick of C4. Have multiple pictures to post when I can figure out how to do so


----------



## kennybobby (Aug 10, 2012)

Maybe need to make a few posts before the "insert image" button shows up in the tool bar?

Some clear high res pictures would help to see what is different on the newer larger-capacity packs.


----------



## AMDFX8150 (2 mo ago)

Pictures are of the 2021 6.0 AH which uses what look like LG cells. The 7.5 uses Samsung cells


----------



## kennybobby (Aug 10, 2012)

Looks like a clear conformal coating on the board and ICs, can't read the marking on U1. May need to get a flashlight and illuminate from the side or different angles to read thru the coating.


----------



## AMDFX8150 (2 mo ago)

The 30 leg (U1) is a Texas instruments BQ7693003, it's companion controller (U8) is unidentifiable but markings are (Top) 824j. (Middle) 92 04, (Bottom) 20511A. It must be TTI proprietary


----------



## kennybobby (Aug 10, 2012)

That may be a version of the OZMicro 8940 chip shown in post #1 of this thread.


----------



## AMDFX8150 (2 mo ago)

There appears to be a pretty decent software interface for this controller


----------



## AMDFX8150 (2 mo ago)

Bought an SWD interface, gonna connect to battery and see if anything can be done. But I'm new to SWD


----------



## kennybobby (Aug 10, 2012)

Sounds like a good plan, keep us posted on your findings. 

Is the SWD reasonably priced?


----------



## AMDFX8150 (2 mo ago)

Yeah, bought an STlink v2 and it was under $10


----------



## AMDFX8150 (2 mo ago)

Attempt has suffered Massive failure, ST Link will not connect to any SWD interface other than ST. There appears to be a specific module to evaluate the controller, a Ti EV2400. A bit more expensive but connecting to the battery would still be a problem


----------



## dk992000 (2 mo ago)

Would anyone know where you can purchase a replacement board for the ryobi op40602, the tti part number says 280849. I have not much luck on finding one.
Thx


----------



## Joel (Jul 29, 2008)

kennybobby said:


> *T1 and T2 terminals; Charger Notes*
> 
> The T2 terminal is found on some of the tools: mower, chainsaw, and ? (seems to be tools that have a high current draw)
> 
> ...


So I have a chainsaw and am building a battery backpack without a ryobi BMS (using 26650 A123 LiFePO4 cells). the chainsaw runs in "limp-mode" when there is nothing connected to T2. Full rpm at no load, but when load applied, it bogs down way to easily. I took apart the tool and probed T2 with an OEM battery on the workbench (without a blade, no load). The chainsaw outputs 5V to T2, which is only measurable when T2 pin is taped off/blocked on the battery.
No voltages show up on T2 on the battery on its own, but it does have resistance to GND (BATT-). When the battery is asleep, it measures 20k. When connected to the saw, and the trigger is just slightly pulled enough to wake up the battery (but motor not running), the resistance quickly drops to 139 ohms. At full throttle on the bench (no load), it goes to something around 640 ohms.
On my substitute pack, I soldered what I had (166ohms) onto T2 to ground, and it solved the limp mode issue! Now it cuts wood like butter on my own battery.
I hope this helps you understand what T2 does. I think it monitors either voltage sag, or, more likely, amps coming out of the pack. the feedback tells the controller to back off to prevent damage to the fets/cells. 20k/open circuit = minimal current available, 139ohms seems to indicate maximum current available. I have not done further tests to see how this scales... cant be bothered. I dont want to risk damaging the chainsaw controller, especially with a 0 ohm short to ground on T2.
Thanks for everyone's hard work in hacking these batteries.


----------



## kennybobby (Aug 10, 2012)

Thanks Joel, that is an excellent finding on T2 and how to get a custom pack working. 

Here is the schematic again. If the pack is in sleep mode, then there is indeed 20k between T2 and Batt- thru the voltage divider of R62 and R63.

When the pack wakes up and goes active, then U2 chip pin 7 goes high to drive the Q28-29-30 trio to come on and now there is 110 Ohms of R73 between T2 and Batt-, plus whatever contribution is from your meter across the C-E junction of Q30, so that might total up to be the 139 Ohms that you measured.

The T1 line is used by the pack and the charger to send a secret code back and forth; as long as they are communicating then the FETs are kept On to allow charging.

i have not dismantled my chainsaw to see if a similar secret code circuit is used on the tool T2 line, but the T1 and T2 circuits in the pack are nearly identical and likely perform a similar function.


----------



## DIYGuy3321 (21 d ago)

kennybobby said:


> Well that is a very interesting scope capture, and explains why the T1 terminal connection is labelled "COM" on the charger board.
> 
> i'm going to guess that the communication primarily originates in the charger due to the blocking diode D10 on the "COM" line shown in the hand-drawn schematic. That line gets controlled by signals from the IC3, "ABOV2011" pin23 which drives the base of Q9. So it can assert both Hi and Lo states.
> 
> ...


Late to the show, but I have a battery at full charge and cells balanced and voltage between pos and neg but wont run a tool. I discharged below board and put in charger and got green lights and it charges back up. Any ideas?


----------



## kennybobby (Aug 10, 2012)

What tools are you trying to use?

Have you seen the posts about how to do a reset using a jumper wire at the programming/test port?

Touch a jumper from the Reset pin to Ground for a few seconds.


----------

