Hilti Nuron battery B22 red light blink fix

[dvd4me]

Hello,

I just happen to get some used Hilti Nuron B22 battery packs, 3 have blinking red lights and one it's green but the test mode is also red.
Who threw them in recycling probably was fed up with them.

The B22-255 ( 3 battery layer, big ones, not the 18650) are badly unbalanced, despite the BMS featuring the BQ76920, battery monitor with balancing FET's.
At this capacity there's no way that small chip can balance, in years.
The BMS is sealed in hard epoxy that is very hard to remove, so you have access to nothing.
Well, I made myself the access after a lengthy process.
The board has the STM32F091 ARM®-based 32-bit MCU, up to 256 KB Flash, CAN protocol, etc..
Also there is a ST25DV04KC Dynamic NFC/RFID tag IC with 4-Kbit EEprom to drive the front antenna.

I do not have yet any hw tools to try to connect and read something yet out of this sealed thing, the BMS communicates with the charger thru a CAN interface chip TPT1042VQ, (automotive Fault Protected High-Speed CAN FD Transceiver with Standby Mode). (CAN is a controller area network (CAN bus))

Also the BMS has RF-ID antenna in front where it exchanges with high speed RF-ID interface chip directly with the MCU, that's how probably they check/track the battery health.
To put-it shortly, the cells are in very good shape ( 8mOhm!) but the battery is failed so it must be some different way Hilti "repair" their batteries, to keep the fleet "floating" 
Since it's very easy to open and balance the cells, this is probably what they do in "servicing" them, then re-program thru RF-ID or the RX-TX channel similar with the charger communication.

I am waiting for the ST-Link to see if there is anything that can be read directly thru the MCU. There is so much newer protocols and interfaces, just the result is crap.

Any interest in this project? I assume that if I  found 4 batteries recycled, there is a lot of them failing with the "red blinking light" mode, so they may be quiet about it.

[dvd4me]

To add some more details, I made this video of the debug access thru the SWDIO and SWCLK pins, accessible on the side of the battery.
With this occasion I was able to brick the third BMS, just entering debug mode it renders the battery useless, as the BMS never runs the app again.
In my second attempt to read the main flash I altered the option byte, obviously triggering the flash erase.
In the third attempt I only managed to read data as much I could, some areas are still protected, on top of the main flash zone.
Disconnecting the debug tool and performing a hard reset ( bring NRST pin to GND) does not re-start the BMS app.
It does nothing, no more blinking red light while pressing on the gauge button.
I do not have any charger or tool to test any additional behavior of this pack, quite dead now.

I would eventually harvest the cells, capacity measured around 3500mAh and 8mOhm, quite good. Absolutely no reason for the pack to blink red.
 
Attached is the zip with the data of the readable areas.