Author Topic: Asus laptop battery BMS reset? TI BQ30Z55  (Read 29057 times)

0 Members and 2 Guests are viewing this topic.

Offline Kureigu

  • Newbie
  • Posts: 3
Asus laptop battery BMS reset? TI BQ30Z55
« on: April 11, 2015, 12:14:50 pm »
Hello all.

I'll try to keep this as short as possible while also providing as much information as I can. (And I failed. Italics = long version. Note form below)

Back Story

So a couple days ago I bought a (cheap, used) Asus X200CA notebook with no charger. As expected it didn't power up without said charger, and with, all was golden, or so it seemed. Windows reported that the battery was detected and charging. However it transpires that it wasn't charging, the percentage wouldn't increase from 0 and 3rd party software reported that the charge/discharge rate was 0mw. After seeing this, I proceeded to try various internet found methods to initiate an internal charge to no avail.

Disassembly time... having already popped open the case to disconnect the battery for above "methods", I figured in for a penny in for a pound. The battery pack itself fortunately reveals the cells by simply peeling back a film. Measuring the voltages confirmed that it had been without power for quite some time, less 1.50v a cell, eek! Being a 11.25v pack with 3.7v cells my trusty Li(Po/Ion) charger was of course having none of it and complained of low voltage. So I trickle charged them in turn under NiCad mode up to a more respectable 3v each. I then continued to charge them correctly until the charge currant dropped to 0.2A. This was to test if the battery would now charge in the laptop, nope, but 84% charge was reported by windows. Disconnected mains, instant off. hmm... Checked voltage at the header, nothing  :palm:  Next ripped the board out to have a general look, and do some research on the main BMS chip.


Notes (Short of above)

Asus X200CA Notebook. 3* 3.7v cell, 11.25v Li-ion pack. Cells good, battery pack doesn't charge or have power out at header. BMS seems intact as battery condition/state is reported to laptop.

Reasearch

The main chip in the BMS is from Texas Instruments and has the part number BQ30Z55. One of its many protection features is a series of "permanent" failure states, which is stored in flash and can be reset. I believed that the critical low voltage fail state was triggered during storage. Communication with this chip appears to be with a TI proprietary protocol called SBS 1.1 which I can't find any detailed information on. Their own Battery Management Studio "bqStudio" does not list my chip, and I'm not sure on how to interface with the chip anyway. Pins 13 "SBS 1.1 data line" and 15 "SBS 1.1 clock line" look like a good bet for access, but beyond that I'm not sure.

Links

bq30z50-R1 and bq30z55-R1Technical Reference http://www.ti.com/lit/ug/sluu852/sluu852.pdf
bq30z554-R1 Data Sheet http://www.ti.com/lit/ds/symlink/bq30z554-r1.pdf (Essentially the same chip, confirmed here https://e2e.ti.com/support/power_management/battery_management/f/180/t/311497)
Texas Instruments Battery Management Studio bqStudio http://www.ti.com/tool/BQSTUDIO

And finally the Question.

How can I interface and communicate with the chip to reset the failure state? Can I use the main header (probably not) or do I have to connected directly to the chip? I have an Arduino, and a Raspberry Pi for GPIO at my disposal.


Any help would be greatly appreciated.
Regards, Craig (Kureigu).
 

Offline senso

  • Frequent Contributor
  • **
  • Posts: 951
  • Country: pt
    • My AVR tutorials
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #1 on: April 11, 2015, 01:27:42 pm »
There is a 3 pin fuse somewhere in the pcb of the battery, when the BQ signals the battery as faulty it kills the fuse.
There are also lots of keys to be able to change those registers.
I think SBS is just another flavor of I2C, plug it into the laptop and probe the pins, but there is also an 100$ Devboard from TI that talks all those protocols.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 7368
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #2 on: April 11, 2015, 01:46:31 pm »
Yes, SBS is I2C-based protocol. Download the specification and read it first.

Check the fuse first, as mentioned above.

The Russians seem to have the most expertise in "hacking" these ICs... do some Googling and translating.
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 10771
  • Country: gb
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #3 on: April 11, 2015, 02:12:12 pm »
Please also be aware that the BMS 'kills' the battery pack for a good reason. Lithium Ion cell chemistry is irreversibly changed if the p.d drops below the minimum threshold. The OEM ensures that the battery disables itself in such cases due to fear of cell instability and potential negative consequences. If you do re-enable the battery, I recommend that you charge it only in your presence until you are sure that it does not get hot or present other symptoms such as out gassing.

Aurora
Cogito, ergo sum
 

Offline Kureigu

  • Newbie
  • Posts: 3
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #4 on: April 12, 2015, 09:21:22 am »
The fuse appears to be fine, although I'm not sure on the proper test methodology for testing a 3 pin fuse. Continuity is being read in all directions.

Aurora, thank you for your concern regarding the cells. I am aware of this and was present throughout the charging process. If I do manage to get the pack functioning again, I will be doing a few charge/discharge cycles at different rates to ensure that the cells are stable and still maintain a reasonable capacity.

Looking at the Toshiba TPC8073 MOSFETs on the board, the 1st one (left in image) is switched on, while the second is off. If I take power from the first and apply it to the second then it too switches on. So possibly there is a bad transistor some where, or the BQ30Z55 is not signalling to turn it on, permanent failure state or sleep state?

So far my Googling of Russian forums hasn't come up with much on my specific IC, but has given me some software options. Unfortunately again, they don't seem to support my IC and also require additional serial hardware and licencing fees  :--

I would like to make use of my Arduino or Raspberry Pi for I2C comms, however I am struggling to find useful addresses in the technical reference document.
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 7368
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #5 on: April 12, 2015, 04:24:08 pm »
Check the MOSFET control pins of the BQ to determine if it is keeping them off or not.

The datasheets/references should have enough information to at least read the state of the pack from the IC.
 

Offline tapasloveu

  • Newbie
  • Posts: 1
  • Country: in
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #6 on: February 07, 2021, 04:47:09 pm »
had u got the solution
 

Offline strawberry

  • Frequent Contributor
  • **
  • Posts: 346
  • Country: lv
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #7 on: February 07, 2021, 07:55:22 pm »
It should be something like this https://www.ti.com/lit/ug/sluua79/sluua79.pdf?ts=1612727477316
you have to reprogram BMS if you remove cells or ran out of resource(some energy metering stuff)
you can bypass MOSFET if everything else works but not recommended
for example Apple wont start normally without green light from BMS and sometimes serial number match
« Last Edit: February 07, 2021, 08:10:25 pm by strawberry »
 

Offline mefistotelis

  • Contributor
  • Posts: 5
  • Country: pl
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #8 on: February 18, 2021, 09:07:50 pm »
Here is how I do it:

 
The following users thanked this post: Rasz, ledtester, syau

Offline jamarjan

  • Newbie
  • Posts: 2
  • Country: pl
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #9 on: May 06, 2021, 12:38:44 pm »
Thanks mefisto for a detaild guide.
Everything went flawlees untill the the unseal step.
Apparantly manufacturer changed the default code.
Is there any way to gain acces to such a chip?
If no than maybe there is a way to replace and program a new one?
Any expirience in that field?
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 7368
Re: Asus laptop battery BMS reset? TI BQ30Z55
« Reply #10 on: May 06, 2021, 11:59:03 pm »
The unseal code is only 32 bits, right? How long does it take per attempt? Trying all 4 billion combinations might not seem that difficult. There's software out there (paid, unfortunately) which claims to open them, so either they have hardcoded a set of known keys to try or know a specific backdoor/attack to get in. Anyone with a logic analyser and willing to pay would be able to find that out...

The fact that it's a 16-bit core internally and won't be nearly as secure as something designed with serious crypto may mean that you can guess both halves separately, using the usual timing attacks. Power analysis may also work.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf