Dyson v7 Trigger cordless vacuum - TEARDOWN of battery pack

[Lesolee]

I bought a Gtech Multi to clean up after my cat. It  looked perfect for the job, and was a fair bit cheaper than the Dyson. Sadly, having charged it after it first arrived, it failed due to overload the first time I used it with the powered brush bar. It would run for about 20 seconds then cut out. "Oh, it shouldn't do that" said customer services, who immediately shipped out a replacement. Needless to say the replacement did EXACTLY the same thing. 

Clearly Gtech had both a batch problem, and a quality control problem. Given that this battery stuff is their core business, for me that is a red flag. I have personally lost faith in them. 

Hence I went up-market to the Dyson, at £200. Worked nicely with light daily work, often vacuuming the white duvet cover to clean off the black cat hair. All happy for 9 months then the evil flashing 32 times red flash code of death. This happens when you either try to turn it on or charge it. It was of course still under warranty so they sent out a new one, which worked nicely. Maybe I am just unlucky?

I have seen another site where a small number of people have had the same experience. What percentage of these things fail is of course unknown.

Anyway, a (free) duff battery pack is a valid excuse to tear it down and see what happened.



The battery pack itself is fairly easy to remove (3 screws) but I can't see my youngest Aunt (75) or my mum (85) being able to do so.

Removing the battery pack cover on the other hand is a horrible job, even with proper spudgers/ tools designed for the job.



The battery pack is locked into its cover by the LED light pipe. You have to pry the case away on both side simultaneously to slide it out. I numbered the cells for later use.



The Battery Management System (BMS) is shown on top of the cells. Cell 1 is the low end of the series connected chain, the negative end. The negative battery terminal is circled in blue. There is an interesting looking device circled on the left. It measures as open circuit (maybe). It has a silkscreen identifier as S1. (Thermal switch?) I originally thought it was a fuse, but there is a SM fuse at the positive end of the pack, and it is marked F1. You can follow the tracks easily and the small package would seem to be an N-channel enhancement MOSFET by its location. It is a strange looking package that looks like an SO-8 but the legs on the RHS are all merged into one. The upper three legs on the left are all connected to the 0.002 ohms sense resistor. The fourth lead is the gate. I know because I put some voltage on it via a 3K3 resistor and got it to turn on the supply voltage to the output terminals.

The BMS board in the bottom right corner is marked as 228499-01/03, but a web search did not find anything relevant.



This is a close up of the unknown "switch". I searched the unknown part number GD 18-05 and got nothing 



My first thought was that the cells had become out of balance and upset the BMS.
(1)   3.92 V
(2)   4.15 V
(3)   4.10 V
(4)   3.84 V
(5)   4.15 V
(6)   3.92 V

So I put a PSU across each low cell and charged them all up to at least 4.05 V. No change in the flash code, but it is possible that the fault is permanently latched.

[Lesolee]

The whole board is covered in silicone rubber, so a bit of digging was required.

The MOSFET is shown as best as I can get it below:



Maybe it is ICD30b  or 1CO30b or some variant in between
Then maybe
Prm
1740

I couldn’t even find this type of package in manufacturers’ data. 

The annoying thing is that the cells all work, the MOSFET works, and something has gone wrong causing it all of it to end up in landfill. 

[Lesolee]

S1 (marked GD 18-05) had 19 V across it. Thinking it was a fuse I tried a “soft short” with 100R, and when that was successful, took the resistor down to 10R. The result was 0.8mV across it. Now instead of 32 red flashes when operating the ON switch I get 32 red flashes, a slight pause and a green flash. 

It still doesn’t work, but the green flash sounds like an improvement!   

[schmitt trigger]

Please continue with your detective work.... I also own a Dyson, and might come back to this thread later. 

Charged batteries give me the creeps when I am poking around on a board. Do you think you could open up a terminal, and substitute the battery pack with a current limited PSU of roughly the same voltage?
That way, you could safely poke around without fear of a major short.

Can you read the part numbers on the ICs?

[Lesolee]

...
Charged batteries give me the creeps when I am poking around on a board. Do you think you could open up a terminal, and substitute the battery pack with a current limited PSU of roughly the same voltage?
That way, you could safely poke around without fear of a major short.

Can you read the part numbers on the ICs?

The trouble is, there is not "a terminal". We have the two ends of the series chain of cells, but also all the intermediate taps. Undo the connections in the wrong order and it may cause it to blow up. I designed a large pack, where each cell was 1 kg, and each cell had its own charge balancer between the terminals. Plugging in to the monitor board had to be done in an exact order or the monitor board would be fried. Those cells were seriously scary 

The ICs are still under the silicone rubber. But they look like FPGAs or micros. If the MOSFET is unrecognisable, you have to figure that they are too.

[Lesolee]

Have you tried disconnecting the pack from the BMS?

It's too scary, so no.

It has to be said, I can power up the output using an override resistor to the MOSFET gate, so in principle I could bodge it to function. Trouble is that bypasses the BMS and makes it a pretty serious fire risk. Also the charging circuit doesn’t currently work either.

Since you can’t eject the battery pack in this design, if the BMS is bypassed, and something makes it catch fire, you have to chuck the whole vacuum cleaner out the nearest window and duck!

[Lesolee]

Can you read the part numbers on the ICs?

After digging out the silicone, then scraping or the varnish or paint, it doesn't look very readable:



And that is the best after several tries, with the light and camera at different angles.



But there are only two ICs. There seems to be little on the underside. There doesn't seem to be enough stuff to do cell balancing, which is possibly why the cells were so out of balance.

[capt bullshot]

S1 (marked GD 18-05) had 19 V across it. Thinking it was a fuse I tried a “soft short” with 100R, and when that was successful, took the resistor down to 10R. The result was 0.8mV across it. Now instead of 32 red flashes when operating the ON switch I get 32 red flashes, a slight pause and a green flash. 

This thing looks like a reed switch to me. Maybe there's a magnet in the body that activates the battery when plugged in?
Anyway, the cell voltages looked heavily out of balance to me, my guess this caused the permanent lockout. Laptop battery packs often have a "pyrofuse" or "chemical fuse" that gets blown by the BMS to permanently disable the battery. In your picture, I didn't spot such a thing here. Depending on the evilness of the embedded firmware, a complete reset (by disconnecting all cells) might help.

[Lesolee]

This thing looks like a reed switch to me. Maybe there's a magnet in the body that activates the battery when plugged in?

Exactly right 

I first tried my continuity buzzer 

Then realised it was a live circuit, so tried a voltmeter instead. Sure enough the voltage drops from 19V to nothing when a magnet approaches it.

I can't find any magnet in the battery cover or vacuum body. Nevertheless, great happiness found. 

[Lesolee]

I found the magnet!

This is the overview, with the dust bin removed. This is easily done by opening the dust release mechanism (as if emptying) and then releasing the bin attach clip. (They say to do this when changing the battery pack, although it is not actually necessary.)


Then we use the handy "magnet detection tool" (a spanner). It is stuck to the magnet in this shot.



One mystery solved. 

[Lesolee]

If you remember your old B/W WWII movies (and maybe this is just for fellow Brits) the procedure for defusing bombs was to say what you were doing into a mike, so if it blew the next guy would know what you did, and what did or didn’t work!

To detach the BMS from the pack involves cutting the 7 battery pack wires. Either the order matters or it doesn’t. Supposing it does matter, which one should be cut first?

My first thought was the 30A fuse at the positive end of the pack. But I don’t really fancy desoldering that live. The next best thing would be to cut the main positive feed. But then we have all the intermediate cells feeding in voltage, potentially above the power supply voltage of the sense chip.

So, new plan. Snip the cell-sense wires starting at the most positive and going all the way down, leaving both positive and negative feeds from the pack intact. Then cut the positive feed. (S1 not shorted or magnetically turned on during this process.)

[Lesolee]

Step 1 complete:



Now if you are wondering why the pack is sitting on a wooden board let me explain:

Given that mobile phone batteries are known to catch fire and be very unpleasant, and this battery pack is a shed load bigger, the window in the room was opened, the net curtain looped out of the way, and the pack resting on a small wooden board. In case of smoke or flame the pack would have been ejected out the window.

As it turns out nothing happened. 
Maybe I’m just being melodramatic. 

I like to think it is just sensible caution.

[Lesolee]

Step 2 complete:

re-connected in the reverse sequence after leaving it open for an hour or more.



Now I no longer get a green LED at the end of the 32-flash red sequence (using a magnet to actuate the reed) when using the charger. 

The on/off switch gives no flashes, but the voltage that develops across the open switch contact is around 7mV (the switch is used in a normally closed configuration). 

[capt bullshot]

Looks like the BMS either is broken or permanently locked out to protect the average user from fire hazards.
I might try to connect battery bottom (-) first, then all the middle taps, then the top end (+) - so the BMS never sees an unconnected cell when it is finally powered on. This might damage a chip, though I wouldn't expect that, but as it is unusable anyway it doesn't matter anymore.

[Lesolee]

I might try to connect battery bottom (-) first, then all the middle taps, then the top end (+) - so the BMS never sees an unconnected cell when it is finally powered on.

Wouldn't that be equivalent to removing the positive lead, waiting, then reconnecting it?

It occurs to me that the BMS must have been connected to a live battery pack in the first place. Of course there could be all sorts of special links needed to fit it in the first place, but it is hard to understand how you could ever connect it in a particular order in the first place, given that all the terminals are soldered by inserting from the bottom of the board and soldering from the top. Accidental connection in a random order would be all too easy.

[Lesolee]

Hmm, there must be a way to comission these things, it's not apparent from the pics you've posted but are there components on the underside of the board?

Maybe some test/programming pads?

I looked for adjacent pin holes that could be shorted (in place of a switch) and I found a row of 4 holes buried under the silicone rubber near to the reed switch.



The only thing I can see underneath is a large black lump, which I am guessing is thermal cutout or sensor.

[Lesolee]

The test points are numbered N7 (top), N3, N4, N8 (the text is difficult to read so these values could be incorrect).


Measured with respect to the battery negative when nothing is happening:
N7:    < 1mV      22K
N3:    < 1mV      78K
N4:    < 1 mV     76K
N8:    < 1 mV     17K

N7 3.3 V when flashing LED
N3 3.0 V when flashing LED
N4 3.0 V when flashing LED
N8 3.3 V when flashing LED

All 4 test points seem to come up at the same time -



They also seem to fall at the same time -



A 1K resistor will pull any of them down to 0V, except N8, which is unaffected even by a 111 ohm load.

Pulling N7 down stops the LED from flashing. None of the other 3 have this effect.

There is no fast digital activity on these lines.

[Lesolee]

My scope is earthed via the USB cable. Of course it is, it's traditional. Mind you the BNCs are marked as being equipotential, not earthed. It does say it is grounded very clearly in the separate safety manual, but it doesn't seem to be mentioned in the User manual.

My soldering iron is earthed. Well it is a direct mains powered heating element, so obviously it needs to be earthed for safety.

It means that soldering onto the battery positive terminal when the scope is connected is inadvisable              

GOTCHA       It does produce a nice spark! Clearly the old grey cells have got a bit rusty.

[Lesolee]

Two more attempts to reset the BMS:

(1)  Charge the battery pack via the output terminals. Since the MOSFET is not ON, the MOSFET body diode will be the only charging path. 25.4 V on the output terminals and the battery charged at 0.5 A. Maybe 30 seconds or so of this before testing again. No permanent change to BMS. 

(2)  Make the output turn ON using a 1K resistor from N8 to the MOSFET gate. Not a huge gate voltage, but enough to make the voltmeter show an ON state. No permanent change to BMS. 

[Lesolee]

Have you tracked down which components connect to those pads?

No, it is a double sided board covered in silcone rubber, so it would be difficult to follow the tracks.

There are about half a dozen SOT-23 devices and then a couple of fine pitch multi-legged packages (FPGA/processor/custom battery sensor?) There really don't seem to be enough parts to do anything interesting, like shunt current away from an over-charged cell. At a guess I would say the BMS has a purely measurement/protection function and doesn't start if it is unhappy for any number of reasons.

[Lesolee]

I tried the cooling trick as well. Both multi-legged chips had been dug out of the silicone rubber earlier, so they were nicely exposed. I used a thermocouple to measure the temperature and managed to get it down to a measured -51°C.



No change 

[Lesolee]

The black lump descending below the BMS into the battery pack looks like some sort of thermal sensor. One end is connected to the battery pack negative (ground), the other end sits at around 1 V when the red LED flashes (constant 1 V regardless of the flashing activity). When the LED was not flashing, the non-grounded terminal measured 9.5 K to ground.

A 10 R resistor on the 1 V end of the sensor (to ground) pulled the 1 V down to ground, but had no other effect. Pulling the 1 V up to 3 V by using a 1 K resistor to N8 also had no other effect. (Had to remember to unhook the scope when soldering to prevent ark-y sparky smokiness.)

The measured 1 V (when LED flashing) dropped to 0.6 V when the sensor was heated to 60°C with a hair dryer.

I would conclude that this testing rules out a faulty thermal sensor.

[capt bullshot]

I would conclude that this testing rules out a faulty thermal sensor.

Agreed. I'm astonished by your effort to revive this battery pack. To me it looks like a one way ticket - once the controller has detected some kind of maybe dangerous battery or single cell failure it'll shut down the pack in some irreversible way (e.g. by flashing some internal variable). Regarding all the safety regulations that might apply to such kind of a battery pack, that'd be the way to design the BMS firmware.

[Lesolee]

I'm astonished by your effort to revive this battery pack.

For me it is not just one, but potentially thousands. The landfill waste of a nearly working pack is horrific.

[BillyD]

I applaud your hard work on this. I and some family members have Dysons and it's only a matter of time before the batteries start failing so I'm hoping you'll succeed!
Thanks for sharing your findings.