Dyson v7 Trigger cordless vacuum - TEARDOWN of battery pack

[dvd4me]

Hi there, at first I'd like to give some kudos to tinfever for his immaculate work and dedication on this.

I wish I had read this thread more thoroughly, so I wouldn't have bricked my battery.
Unfortunately, the numbering has been erased, but I'll post some pics later on, it might be helpful in engineering new FW.

Oh, it's about a DC61 for a V6.

Hello, until tinfever does a release, here is the video I made, it was posted on the previous forum page, you can see the connections to the pcb and pic, what to click and what not to click...
If you want to change the cells, make sure you remove first one wire from the trigger button, so the BCM does not wake up.
No need to ghost the battery cells for this swap, just change them and if the pack died unlocked then it will wake up the same. use 3.5V charged and balanced cells to swap.

If you want to see the video I posted, it's here:



Some users report success to reset the pack by using the same way I did-it. Try.

[Hank]

Hi there, at first I'd like to give some kudos to tinfever for his immaculate work and dedication on this.

I wish I had read this thread more thoroughly, so I wouldn't have bricked my battery.
Unfortunately, the numbering has been erased, but I'll post some pics later on, it might be helpful in engineering new FW.

Oh, it's about a DC61 for a V6.

Hello, until tinfever does a release, here is the video I made, it was posted on the previous forum page, you can see the connections to the pcb and pic, what to click and what not to click...
If you want to change the cells, make sure you remove first one wire from the trigger button, so the BCM does not wake up.
No need to ghost the battery cells for this swap, just change them and if the pack died unlocked then it will wake up the same. use 3.5V charged and balanced cells to swap.

If you want to see the video I posted, it's here:

https://youtu.be/7t9yA3_KUI0

Some users report success to reset the pack by using the same way I did-it. Try.

Well, this Pickit3 is doing my head in, I downloaded via your link on YT, but when I run it, I get a message that it is in MPLAB mode, and I need to download an OS compatible.
And I also can't select the 16LF1847.
When I want to quit the program, it won't let me, and I get this message: System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Microchip\PICkit 3 v3\PICkit3.ini' is denied.
The ZIP contains 3 other ZIPs, do I have to invoke those other files too in some way?
An I'm running Win7-64b.

Edit, it's running now, but still can't select the 16LF1847
Edit 2, can select it now, but still get the error while trying to quit.

[tinfever]

In case anyone is interested in an update on my progress. I found a really tricky hardware bug while working on the documentation, and it took me a couple days to figure it out and create a work around.

Current theory/procedure:
0) Directly short the output (or connect it to multiple electronic loads that appear as a short until they start to limit the current)
1) The trigger is pulled and output is enabled as usual
2) There is a massive current spike, but not so huge as to trip the short circuit protection (which has to be set to 175A because the next lowest step, 100A, is insufficient for vacuum startup).
3) The output is disabled, but probably not actually because short-circuit protection kicks in. It takes about 400us, vs the 190us for short circuit protection.
4) The ISL94208 RESETS ITSELF AND DOES NOT PROVIDE ANY ERROR FLAG. Thus it is not obvious what happened.
     - This is likely because during a hard short, there can be a current spike of 140A+.
     - This causes the voltage on VBACK (attached to cell 1) to drop as low as 1.46V (vs 3-4.2V normally).
     - VCC for the ISL94208, which is connected to Cell 6 drops as low as 10.5V but that's still above the POR voltage
     - This is below the listed typical POR voltage (no minimum provided) for VBACK and is likely causing the reset of the ISL, which wipes all registers.
     - All of this is likely caused because Dyson omitted the 10uF capacitor for VBACK shown in the ISL94208 datasheet (page 32).
5) The normal I2C commands to the ISL fail while it is resetting, causing I2C errors.
6) Previously, I2C errors were handled by resetting the PIC. So the PIC is reset.
7) The PIC starts up and sees the trigger is pulled and the ISL is presenting no error flags.
8 ) Wash, rinse, repeat. Go to step 1.

I've determined I can set some of the User Flag bits and periodically check those to determine of the ISL has silently reset itself. If those bits are cleared, it then asserts an ISL_BROWN_OUT error, rather than having the output flap. These User Flag bits also have to be checked in more than one place in the main loop because the ISL doesn't reset *immediately* after the output enable bit is set on a dead short, so if I check the User Flags immediately afterwards they'll still be fine. I also had to add more elaborate I2C error handling than just resetting the PIC since that would prevent the ability to detect that the ISL reset.

I also tried to assess how the stock batteries react to this fault. I blew the MOSFET and the fuse. Then I replaced the MOSFET and shorted out the fuse. Then the MOSFET blew up again (that could be due to my bad soldering though). At this point I decided I needed to not permanently destroy my last working V6 BMS board since I still need to test that my firmware is compatible with it. Most development was done with a V7 BMS board but it was designed to be compatible with V6 boards too. There are a few different versions of the V6 BMS board, so after I publish everything it would be helpful for anyone willing to test the firmware on a previously untested board version are report their results.

When I want to quit the program, it won't let me, and I get this message: System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Microchip\PICkit 3 v3\PICkit3.ini' is denied.
The ZIP contains 3 other ZIPs, do I have to invoke those other files too in some way?
An I'm running Win7-64b.

Edit, it's running now, but still can't select the 16LF1847
Edit 2, can select it now, but still get the error while trying to quit.

I think that error when trying to close the PICKit 3 programmer program is "normal". I always get it too. You can thank Microchip for that.

[widlokm]

Hello,
First of all many thanks to all contributors to this thread, You probably saved a few dysons from scrap, helping the environment in the process.
I recently fix faulty V7 battery by replacing the cells and reprogramming 2 "critical" EEPROM locations. Battery worked but after charging I have 6 orange flashes, something new. I expect that this is a temperature problem because original thermistor was destroyed when replacing cells, and I put there a 20k NTC one (just guessing the value).

Could You please give me the original value for this thermistor?  Or just a voltage on it during normal operation of battery, then I check if my is correct.

I've also red that PIC16LF1847 is not 100% compatible with ICD debuggers because of to high MCLR voltage, this is not a problem with Pickit3 according to MicroChip - just a warning. I came around this issue when I wanted to use my old ICD2 on this chip (attempt failed, I ended up adding a module to my old DIY parallel programmer - slow as hell but works).

I've also worked quite a lot on microchips before, and I thing that I can help with the "opensource" firmware for this battery if someone is interested.

PS. My battery "fixed" itself after laying without cover for some time near open window. I will check that, but it seems that my idea about wrong thermistor is right :-).

[tinfever]

Hello,
First of all many thanks to all contributors to this thread, You probably saved a few dysons from scrap, helping the environment in the process.
I recently fix faulty V7 battery by replacing the cells and reprogramming 2 "critical" EEPROM locations. Battery worked but after charging I have 6 orange flashes, something new. I expect that this is a temperature problem because original thermistor was destroyed when replacing cells, and I put there a 20k NTC one (just guessing the value).

Could You please give me the original value for this thermistor?  Or just a voltage on it during normal operation of battery, then I check if my is correct.

I've also red that PIC16LF1847 is not 100% compatible with ICD debuggers because of to high MCLR voltage, this is not a problem with Pickit3 according to MicroChip - just a warning. I came around this issue when I wanted to use my old ICD2 on this chip (attempt failed, I ended up adding a module to my old DIY parallel programmer - slow as hell but works).

I've also worked quite a lot on microchips before, and I thing that I can help with the "opensource" firmware for this battery if someone is interested.

PS. My battery "fixed" itself after laying without cover for some time near open window. I will check that, but it seems that my idea about wrong thermistor is right :-).

I believe both V6 and V7 batteries all use 10K NTC thermistors, although they use different pull-up resistor configs so the measured voltages are different between models.

I've attached a text file containing the lookup table I've calculated and am using to determine temperature based on the voltage read on the thermistor. I've just assumed the beta of the thermistor of 3500K so the temperatures are probably only roughly accurate.

I appreciate the offer to help with the firmware.  Once I get this initial release out, I know I could really use some feedback on how the code could be improved for simplicity/best practices, since it's honestly a monstrosity at this point haha. I'm a bit burned out on the project so I can't commit to much more than fixing bugs that anyone finds, but I'm definitely interested to hear more about what I could do better in future projects.

[suenbrad]

Currently looking for a way to unlock the V10 battery, I don't know if the solution for the V6 can be used. The corresponding lead contact angle is being studied, and the management chip is BQ76930

[lern01]

I have drawn the V10 interface and PICkit4 programmer interface diagram, as shown below, for your reference.

[zhoukevin]

The main control chip of V10 is ATMEL ATSAMD20E15A. The official manual indicates that it does not have EEPROM, so the previous solution should not be suitable.

[dvd4me]

The main control chip of V10 is ATMEL ATSAMD20E15A. The official manual indicates that it does not have EEPROM, so the previous solution should not be suitable.

Then this may be even better, there is a chance the chip in V10 pack behaves like the Arm Cortex in the Rigid battery packs, I made another video for that:



Over there, a simple hard reset triggers the pack back to life again, the previous fail conditions are cleared out. Who has the V10 pack should try to reset and see the effect.
On a Rigid battery it was working just fine.
Regards

[widlokm]

Many thanks, problem solved.
It seems that my idea about thermistor was right, but the other way round - I must have heated the battery with my hands and that cleared this warning. I further confirmed that by cooling battery to ~15degC, that caused instant yellow/orange blinks. After changing thermistor to 10k, NTC it works as it should.

Unfortunately my battery does not have the balancing possibility (pins on ISL chip shorted), so I will not be able to check/help on that. Maybe I will find a scrap, cheap battery here in Poland with the ISL connected right, but everything I've seen before was way to expensive.
Are You using SDCC compiler or something else? Assembly? When You will have the initial firmware out, I will have to prepare my environment and programmer, that might need some work because I don't use Microchip software (hate it).

[lern01]

Thanks! I reset pin3~pin7, all the same, nothing changed.

Pin3    3.28V (CPU pin13)
pin4   0.04V  (CPU pin14)
pin5   0.00V  (CPU pin1)
pin6   3.28V (CPU pin31,SWDCLK)
pin7  3.28V (CPU pin32, SWDIO)
pin8 REST(CPU pin26)

[suenbrad]

Thanks to dvd4me for sharing the processing technology and direction, I have purchased two V10 faulty batteries to try and see if it can be hard unlocked. I'll report back to you when I'm done trying. thanks!

[kevinlo]

I have one V10 SV12 Battery Pack , the battery run time only stay for few minutes , so I plan to replace the 18650 battery .
Before I take down the old battery , the BMS is light Blue in normal .
But once I take down one of battery , I start to take off -Ve cathode on P1 , then it blink into Red light immediately.

I am no idea how to take down the V10 battery safety without trigger the BMS lock. I think two possible direction.
1) Let it lock and blink Red light , after replace the new 18650 battery , then unlock it. (But seems no way to unlock it up to now.)
2) Cut off the power supply to Power Management Chipset , after replace the new 18650 battery , then reconnect it again. But I still finding the schematic of V10 BMS board.

[lern01]

Before replacing the battery, remove the connection wire on one side of the microswitch to avoid waking up the BMS chip, which will not supply power to the CPU. It's safe to replace the battery.

[kevinlo]

Before replacing the battery, remove the connection wire on one side of the microswitch to avoid waking up the BMS chip, which will not supply power to the CPU. It's safe to replace the battery.

Oh I see , let me try to replace my 2nd V10 battery pack. Thanks a lot.

[zhoukevin]

Before replacing the battery, remove the connection wire on one side of the microswitch to avoid waking up the BMS chip, which will not supply power to the CPU. It's safe to replace the battery.

Oh I see , let me try to replace my 2nd V10 battery pack. Thanks a lot.

You can test it. The normal practice is to plug in the battery pack to ensure that the voltage does not change (as shown in the figure)

[dvd4me]

Before replacing the battery, remove the connection wire on one side of the microswitch to avoid waking up the BMS chip, which will not supply power to the CPU. It's safe to replace the battery.

Oh I see , let me try to replace my 2nd V10 battery pack. Thanks a lot.

You can test it.

Ghosting the cells while changing them works fine with laptop packs also, the access is locked on those packs, usually with encrypted TI bq chips.
No matter what, if the voltage of the pack goes under a certain limit, like each cell below 3V, the BMS goes into deep sleep mode and you can do manual cell charge, balance, etc.
I revived over-discharged "dormant" Laptop battery where one cell was 1.8V or even lower. Once you plug them in the laptop they get locked, you have to fix the voltage and balance before that.
I did not made a video for that yet but it works nice.
It seems to be too many variations out there for these packs, not sure if all are unlock-able. It's a common effort.
Best

[suenbrad]

The main control chip of V10 is ATMEL ATSAMD20E15A，This picture is a text description of the ATSAMD20E15A instruction file. Can anyone understand what he means? Is it helpful for resetting?

[lern01]

No use.

[dvd4me]

The main control chip of V10 is ATMEL ATSAMD20E15A，This picture is a text description of the ATSAMD20E15A instruction file. Can anyone understand what he means? Is it helpful for resetting?

The reset pin is active " LOW' means it needs to be connected briefly to GND to trigger reset.
First balance the cells and manually charge them to a decent 3.7V each.
Then find the "RESET" pin location on the ATSAMD20E15A and using a small wire connect-it briefly to GNG. Be careful where that GND is, make sure it's the same GND as the Atmel chip.
Try this and report back the result if possible.

[suenbrad]

OK, I'll report the results to you after I've tried it

[lern01]

No use, I tried.

[suenbrad]

1. Manually balance the battery to 3.7V.
2. Take a thin wire to briefly connect REST (PIN26) and GND (PIN28).
    Nothing happened, still no solution.If you press the button of the battery first, the red light will start flashing. At this time, the red flashing light will go out when you connect Rest and GND for a short time, but it will start flashing red immediately after removing the connection.

[kevinlo]

Did anyone have information for V8 Sv10 BMS ? What is the MCU chipset and pin assignment ?

Thx

[tinfever]

It's done. 

After much delay, I'm pleased to announce the release of:

FU-Dyson-BMS
An (Unofficial) Firmware Upgrade for Dyson V6/V7 Vacuum Battery Management System

GitHub Repo with much more documentation and info: https://github.com/tinfever/FU-Dyson-BMS

Dedicated EEVBlog Forum Thread:
https://www.eevblog.com/forum/projects/fu-dyson-bms-an-(unofficial)-firmware-upgrade-for-dyson-v6v7-vacuum-bms/