General > General Technical Chat
Experiences with TI BQ management IC’s when re-building laptop batteries ?
(1/8) > >>
Fraser:
Dear All,

I am more commonly found helping in the Thermal Imaging sub forum but I have come out into ‘General Population’ to ask for some help for a change.

This post relates to replacing cells in laptop and tablet battery packs that are using the various Texas Instruments BQ series battery management chips. For those unaware, the TI BQ chips come in many types and with varying features. What is common to all is the ‘battery lockout’ feature that basically disconnects the battery supply terminal if an imbalance or failure of a cell in the pack is detected. This is a safety feature and not a bad idea as it prevents overheating cells ! Sadly the BQ chips have evolved over the years. Whilst early versions were quite ‘dumb’ and could be persuaded to reconnect the battery to the outside world if the fault condition was corrected, later versions are more sophisticated and can permanently lock-out the battery terminals unless the BQ chip is ‘unsealed’ and ten the fault flag reset after new cells are fitted. Even accidentally disconnecting good cells in such a battery can cause a lock-out and effective loss of the battery from use. I am all for safety where Lithium cells are concerned but sadly the battery ‘lock-out’ feature has expanded to cover not only faults, but also charge/discharge cycles ! So in theory, perfectly healthy cells are placed beyond use by an arbitrary charge count. Now the killer..... to unseal a modern BQ chip to change its settings is lock-out status you need a password ! And, you guessed it, many manufacturers set their own password and even use custom firmware in the TI BQ chips. If you get lucky, the default TI password is used but such is not to be expected these days.

So the situation that faces me is having several different modern Lithium Ion battery packs that are in Lock-out, likely due to long term storage as they are almost new. I can buy new Lithium Ion cells for them without difficulty but I suspect the TI BQ chip will hamper or even prevent my plan to fit new cells in the packs. These tablet and laptop batteries are uncommon Military types so I cannot just buy new ones.

So, to the topic of this post. Has anyone else had experiences, good, or bad, when trying to fit new cells into a battery that is in ‘Lock-out’ and contains a BQ series battery management chip. Any and all experiences are welcomed. Does anyone know any BQ chip passwords ? Sharing those might help others who read this post. I am dealing with Samwell, Itronix (General Instruments) and Getac batteries but Dell, HP  and other makes are also of interest to me.

I just bought the official Texas Instruments EV2400 USB interface unit to communicate with the batteries via their normal SMBus I/O path so that side of things is covered.

Regards to all

Fraser
drussell:
Are the typical implementations generic enough that you could just replace the chip and use your own generic settings rather than any customized firmware, etc.?

Pardon my ignorance, I have no experience with these particular chips.  :)

i do have a few battery packs around here that are just "confused" though, so I always find these kinds of discussions interesting and informative.  I simply haven't had enough time to delve into these ones as projects here to try to decipher what battery management they use or what is wrong beyond checking for obvious blown fuses, mosfets, etc.  Once it's not obvious and classed as "will need to talk to the chip," it ens up on the "investigate later" shelf to gather dust.  :)
Fraser:
Drussell,

Much seems to depend on the particular BQ series chip used. The early models could often be ‘tricked’ into re-enabling the battery by charging the cell pack with a lab power supply to bring the cell p.d’s above the low voltage failure detection threshold of the chip. Some needed the battery output to the management board to be briefly connected to the supply output of the management board, effectively supplying battery full output voltage to the locked-out side of the battery and bypassing the Power MOSFET(S). This has worked many times for me but you should fit new cells if their p.d. is well below the manufacturers safe minimum voltage. It is claimed by the manufacturers that charging a cell that is below that minimum voltage can be risky due to claimed chemistry changes within the cell. That is a topic of much debate however ! Not really applicable to this post though.

BQ series Chips can have flash memory dedicated to OEM use and that can be used by the host computer to detect the type of battery pack fitted and its provenance. It can be used in a basic attempt to reduce clone battery production but is not effective. What it can mean is that if a new BQ chip is fitted, the OEM ID information needs to be programmed into the OEM flash area of the chip. Whether that data can be read from a locked-out battery I do not know.

Fraser
Fraser:
I just pulled the datasheet for the BQ 20Z70 chip used in some scrap HP laptop batteries that I have.

This datasheet will give an insight into the common activities and protection systems found in a relatively modern chip.

http://www.ti.com/lit/er/sluu250a/sluu250a.pdf

Fraser
amyk:
The not-entirely-serious answer is "learn Vietnamese"! There's a few Viet forums that specialise in this "recelling" of battery packs, and they have a lot of detailed information, but unfortunately not in English. I don't remember the URLs but I've come across them before while searching for related information.

There's also this: http://be2works.com/ "Any password for BQ20Zxx and BQ208x in 5 seconds." suggests they've found a way to bruteforce it. The password is only 32 bits, which is 4GB in linear terms, and someone with plenty of time can just wait; but I suspect there's some sort of timing difference (AFAIK it's an 8-bit CPU, and they might've done the "dumb" thing of comparing a byte at a time with early-out) that makes it easier to get it a byte at a time.

Another interesting article:
http://www.karosium.com/2016/08/hacking-bq8030-with-sanyo-firmware.html
Navigation
Message Index
Next page
There was an error while thanking
Thanking...

Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod