# Ryobi 18v lithium battery. Internals and charging



## OmahaGuy (Feb 9, 2020)

I bought a Biswaye P103 (Chinese) battery to power my Ryobi drill, but when I tried to charge it using my bench power supply, it wouldn't work.
I did a teardown on the battery and a (borrowed) charger and found out how to bypass the Battery Management System (BMS).


Warning: Using the following could bypass the thermal and electrical protection circuits. Use at your own risk: I suggest the following:
Maximum of 21 volts (better is 20.5) for a 5-cell battery

Maximum current of AH / 4 is safe, more might be possible if you know the battery specifications
Charge in a fireproof container and don't charge unattended.


The battery has 4 terminals - 

+ and - on the battery stem sides
T1 on the middle of the stem 

T2 on the body of the battery.


Battery teardown:
Lots of pictures and information on the web so I won't repeat. I couldn't trace the number of the IC.


Charger teardown:
Ryobi P118B charger 140350004 FL19033D107838

Two 3-lead semiconductors, I presume they are MOSFETs. Number is 84312M 956BGH
One 20-lead IC. I couldn't read the numbers well, my best guess is 10266A J1A4B


Charger no-load voltages:
- to + 0.0
- to T1 5.0
- to T2 5.0


Voltages with a half-charged battery inserted:
- to + 19.96
- to T1 2.26
- to T2 1.61


The battery continued to charge when T2 was disconnected, but the light on the charger was red.


Terminal T1 battery characteristics:
Resistance approximately 7900 ohms. It was linear from 0.5 to 2.0 volts suggesting a pure resistance.
When the voltage was 0.5v or higher, the main +/- "opened" and it was possible to charge the battery. I suggest applying between 1 and 2 volts. Might want to put a ~4.7 K resistor in series for protection.


I presume the internal battery circuits will take care of cell balancing, but I suggest checking the individual cell voltages periodically.


Hope this helps.


Keywords: Ryobi lithium One+ One + BMS


----------



## kennybobby (Aug 10, 2012)

i don't know if the battery internals are the same as Ryobi, but i have dismantled both the 18 and 40V versions to trace the schematics and here is what i have found. Ryobi 40V BMS troubleshooting and repair


T1 is a Test terminal that is used by the charger to determine if the pack is okay—if the FETs are off then the pack will fail this test and the charger blinks the defective led pattern. The FETs connect the terminal labelled (-) to the bottom of cell 1.

The charger and the pack send a secret code back and forth on T1; without it the pack won't charge, and the charger won't work either.

T2 is a Test terminal with the same external indicator circuit as T1 for the state of the FETs, but it also has an internal indicator path to the PIC controller. It is found in some of the tools and likely passes the secret code the same as for T1, and can shut down the tool if anything is sensed out of line (eg overheating).

If anyone knows how to download and disassemble the firmware from a PIC16F1786, then we could look at the source code and get some ideas of what ryobi is doing.

The BMS chip on the ryobi board is an O2 micro, OZ8940ATN, which controls the FETs and also has a permanent failure mode to disable and drain a pack.


----------



## fast02wrx (Feb 24, 2020)

Just found this thread. I've been rebuilding ryobi packs for a few months now and have found alot of strange things. Funny you mentioned getting the code off of the onboard pic. I'll be attempting it this weekend. not sure if I'll find anything as most of the time, the firmware is locked down. 

Reviving these batteries is so painful and only works a fraction of the time (despite the cells being in excellent shape). getting the boards off of the batteries is a pain. I'm nearly to the point of attempting to spoof the signal lines needed to allow the ryobi charger to charge the battery, so that I can then use any 10s BMS instead of the junk ryobi has designed. If I make any headway, I'll update.


----------



## fast02wrx (Feb 24, 2020)

Interesting event last night.

I rebuilt some 18v (P107) last week. I disassembled the pack, recharged/tested/recharged the cells (all still had great capacity). Reassembled, and still a number of the batteries failed to work. As mentioned previously, if the FETs are off, the Batt- and GND do not connect, no current will flow. 

Last night while comparing a repair and functioning battery, to a repair and failed battery, the failed battery came back to life after taking a few voltage measurements and using the continuity checker on the FETs. I'm not exactly sure how this occurred, but I'll be trying to figure that out tonight. 

I will say that failed 18v packs usually have just 1 cell that is damaged if any. I recently picked up 100+ 18v batteries that all "failed". After going thru about 30 of them, I've noticed that the previous owner had already tried jumping the batteries which involves bypassing the BMS. After measuring individual cell voltages, there is a massive difference in cell voltages. This can lead to a battery pack showing 16v, but only 4 of the cells actually working and hence, very likely, the FETs being off.


----------



## kennybobby (Aug 10, 2012)

i have found that in some cases i could charge individual cells (if lower than the rest) and get the FETs to come back on. Once the FETs revive, then the pack can be charged and used as normal in the tools.

The BMS is always ON and will drain a pack over time, so if it is seldom used or charged it could pull one CELL lower that the rest or the limit, which then triggers a protection mode with FETS OFF. Just don't know without the code.


----------



## galstaf (Apr 29, 2021)

fast02wrx said:


> Interesting event last night.
> 
> ...
> 
> Last night while comparing a repair and functioning battery, to a repair and failed battery, the failed battery came back to life after taking a few voltage measurements and using the continuity checker on the FETs. I'm not exactly sure how this occurred, but I'll be trying to figure that out tonight.


I just had the same thing happen to me with an 18V 4Ah Ryobi battery. It was not charging or showing any voltage at the connector post (FETs cut off apparently). I pushed 21V thru the whole pack until all the cells were showing around 4.1V. Still the voltage at the connectors was low or nothing and seems to be constantly changing between 8V and 0V.
I tested each cell group again for voltage and all of a sudden the charge indicator LEDs all lit up and it showed full charge as it should. The pack was working again.

Put it back together and it went back to one LED flashing and no voltage at the connectors. However, the pack still measured 21V if you bypass the BMS and test the 5 cell groups directly.

This is such bullsht... there is nothing wrong with the pack. I am pissed at Ryobi for doing this.
Any ideas on how to reset the BMS or force it to recognize that the cells are fine?


----------



## john61ct (Feb 25, 2017)

Strip out the cells, build your own pack so the BMS is easily removed / replaced


----------



## galstaf (Apr 29, 2021)

john61ct said:


> Strip out the cells, build your own pack so the BMS is easily removed / replaced


It's cheaper to just buy another battery and a lot less of a PITA. 

I was hoping for a way to get the default BMS to start behaving again.


----------



## DenisJ (Dec 12, 2021)

Hi there all, 
I just have same problem with 2 pieces of Ryobi 18V 4Ah.
I changed the 18650 battery and is not start. 
The battery was charged before to insert in the Ryobi box. 

Any news on this please ? 
Thanks all 
Denis


----------



## theflyingsquirrel (5 mo ago)

DenisJ said:


> Hi there all,
> I just have same problem with 2 pieces of Ryobi 18V 4Ah.
> I changed the 18650 battery and is not start.
> The battery was charged before to insert in the Ryobi box.
> ...


I know this is an old thread but it seems that the problem was not resolved.
I too have the same problem with a 1.5Ah Ryobi battery.
The cell was dead and I replaced it with new cells. After putting back together, the cells measured 20V while the out terminals are 0.
The discharge FET is 20V while charging FET is 0V.
I tried many different things, but none work. 
At the end, I think I have it figured out!
I disconnect the whole BMS and connect it in order like how we should.
It is very tempting to connect +Ve and -ve first since those are the hardest to connect, but dont.
I connect the -ve first, then the bms wires 3.7v, and up.
Finally I connect the +ve.
I press the battery level indicator, it is no longer flashing. It shows me solid full bar!
If you have the same problem that output terminals measures 0 and battery indicator is flashing when pressed, try this method.
Hope it helps.


----------



## cheek1 (2 mo ago)

theflyingsquirrel said:


> I disconnect the whole BMS and connect it in order like how we should.
> It is very tempting to connect +Ve and -ve first since those are the hardest to connect, but dont.
> I connect the -ve first, then the bms wires 3.7v, and up.
> Finally I connect the +ve.


I also had a relatively new Ryobi battery that went belly-up because I left it outside in the cold. Taking it apart, the output FETs that connect the -ve terminal to the most negative battery mode were open (turned off). I could turn the FETs on and get output out of the battery by applying 5V to the FET gates, but once I took the voltage away, the battery would turn off again. I think the logic on the board "saved" the fault and basically disabled the battery forever. By taking away the voltage to the board for a while using "theflyingsquirrel"s method, the fault gets cleared. Re-soldering all of the terminals in order resulted in a battery as good as new! Thanks.


----------



## reissm (21 d ago)

galstaf said:


> It's cheaper to just buy another battery and a lot less of a PITA. I was hoping for a way to get the default BMS to start behaving again.


 Yes, find the "reset" pin and jumper it to ground for a second or two. Voila!


----------



## cheek1 (2 mo ago)

reissm said:


> Yes, find the "reset" pin and jumper it to ground for a second or two. Voila!


You're probably right that there's a reset pin on the IC that's pulled high or something. Hitting it would be a lot faster than unsoldering all of the battery terminals to kill it. I also seem to remember that there was an electrolytic cap in there that held up logic voltage for quite a while. Next time I have one of those things open, I'll look for a "reset".


----------



## pk382 (10 d ago)

Short out the j1 terminal while holding the battery level indicator number 2 and 4 led will stay lit for 2 seconds then pack is reset if all 4 flash then cells are to out of balance and you will have to recharge each cell and short out the jumper again


----------



## kennybobby (Aug 10, 2012)

Howdy pk, welcome to the forum and thanks for joining in.

Could you tell us how did you learn about this reset procedure, the use of the battery level button is a new one that we hadn't heard about.


----------



## pk382 (10 d ago)

kennybobby said:


> Howdy pk, welcome to the forum and thanks for joining in.
> 
> Could you tell us how did you learn about this reset procedure, the use of the battery level button is a new one that we hadn't heard about.


Oh I picked that trick up from Reddit r/roybi about a year ago a user was trying to replace his old cells with new ones the battery was still working until he replaced the cells then it wouldn't charge he put the old cells back in and still wouldn't work so another redditor suggested that he ground out the j1 terminal that Is located under the red wire and hold the battery level indicator for two seconds until the lights flash which he did and it worked.. since then when my batteries won't take a charge I no longer remove the cells I simply have an old cell phone charger I stripped the ends on and charge whichever cells are below the others to rebalance them then once they are close I use that trick and I haven't had one not reset yet..


----------

