Dyson v7 Trigger cordless vacuum - TEARDOWN of battery pack

[dvd4me]

Hello,

I have some updates in this V6 saga, i received the Ali BMS and install-it and tested. It's much less of a headache than to update the PIC program.
OK, so in the pics you see the cells after removing the Dyson BMS, I managed to break one of original thermistor leg, so I had to take-it out completely.
Ali BMS thermistor has the same 10kohm value as in the Dyson bms so it can be reused in case it comes intact.
It is glued in epoxy between 2 batteries, so do NOT insert a metal object. I just melted the plastic around-it until it came out by gentle prying.
The new Ali BMS fits almost perfect, a little file to trim the positive and negative contact blades, to make them fit in the holes. I also kept the original charging plug since it's so hard to remove-it. Just re-solder the wires to the BMS.
Before installing the BMS I balanced the cells and discharged them all to 3.2V, just in case I make a short. And I did, while removing the 2 adjacent battery wires, a tiny spark while touching the screwdriver to both terminals, since the battery was so weak, nothing happened.
To do the balancing, I bought the 6S nice silicon balance header on amazon, it was really helpful.
Put some thermal compound in the older thermistor hole and adjust all the terminals to fit and voila! All is in place. Then soldered and testing.
Dyson charger is a constant current PS, at 26V with no load. The regular current is around 700mA.
The Ali BMS is charging up to 4.2V per cell which made me a bit worried, and then the discharge voltage is similar with Dyson, around 3.1V ( and not what I thought before 3.3V. It was 3.3 because the cells are recovering a bit of the voltage, you have to check-it right when it stops)
Tested capacity was to an unexpected 1900mAh which I was amazed, remember, this was a wasted unbalanced red light battery.
Ali BMS does not have a minimum current discharge of 2.3A like the Dyson one has, to keep the discharge port open.
I discharged the Ali BMS with 1A current to measure the capacity. I used the paper clip to depress the grey button, simulating a real button press.
I also had another Idea that came to me from the instructions I read  for the ISL94208 battery management IC, particularly the sleep timer. This is weird, as I never thought about it before. You'll see in another post.

[dvd4me]

Hello again,

I finally got my second ordered Ali BMS, this is based on another chip, MC95FG208 microcontroller, basically a 8051 architecture that communicates via I2C protocol. I believe some buyer bought a blank version since his BMS was not doing anything. I intend to install this into a totally rebuild V6 battery where the cells were dead and I did the mistake to try to charge the pack before checking the cells, the original BMS locked up on the red light error right away.
I took the cells from a Dewalt battery pack that was thrown in recycling with 2 cells off ( gas protection was triggered) The rest of the cells were ok so I took 6 to put them in the pack. I need to spot solder them using the same original terminals and test the BMS. I hope to do this in the next weekend.
Then I can test the BMS battery management and see how it works. I will keep this posted after.

[cnt]

Thanks for this timely thread update!  I just discovered the self-bricking capability of the dyson BMS PCB my self after installing 6 nice new cells.  I've ordered my Chinese PCB replacement.  Here's hoping it works and I don't set my house on fire

[Craftsman]

Thanks for this timely thread update!  I just discovered the self-bricking capability of the dyson BMS PCB my self after installing 6 nice new cells.  I've ordered my Chinese PCB replacement.  Here's hoping it works and I don't set my house on fire

I would charge it the first time outside without the case and use a no-touch infrared thermometer to see how hot the cells get while charging and to verify that the BMS is actually working!

[tinfever]

Sorry for going AWOL. This project has finally made it's way to the top of my priority list so I've picked it up again and am continuing the reverse engineering of the original BMS board.

In my fumbling effort to dump the firmware, I think I probably hit the wrong button in MPLAB and erased the microcontroller. I went as far as looking at the ICSP communications with a logic analyzer and the PIC on mine is definitely just full of all 1's. I noticed that in either MPLAB IDE or IPE, when looking at the configuration bits, there is a button that says something like "Read Configuration Bits" but under some circumstances it'll be replaced with a button with a very similar icon that hovering the mouse over indicates is now "Set Configuration Bits". I probably clicked this, the programmer tried to set the configuration bits, tried to turn off the code protect bit I'm assuming was present, and turning off this bit automatically wipes the PIC.

I'm guessing the PIC was probably code protected anyways so this probably isn't a huge loss, but it does mean if I want to proceed with reviving this thing, I'll need to write new firmware for it. That should be interesting because I've never done that before. 

Thus, I've been attempting to reverse engineer the original BMS board as much as possible. I think I've probably got about 75% of it so far. I've attached an image showing the connections I've mapped out (Make sure to right-click and "Open image in new tab"). Please excuse the spaghetti wiring lines and poor color choice. I never was very good at arts and crafts. This image is only really useful if you want to trace something out because it's too messy to get much info out at a glance.

Next step is to recreate the schematic in KiCad which should make it much easier to read.

My question for all of you is: Does anyone know what the two IC's in nearly the exact center of the board could be? The whole arrangement with the capacitors just seems...weird.  I've attached several photos of the ICs and the area, plus the schematic for what I've mapped out of it. I can see it gets a connection from the P4 battery cell to pin 7 of the lower IC (U4) and also a connection from the P7 battery cell to pin 6 of the same IC. Then pin 8 of the upper IC goes off to a diode over near the ISL94208.

[tinfever]

An update on the mystery ICs:

I've traced out what is probably the entire circuit for the two mystery ICs and I believe they are probably over-voltage charging protection ICs for the battery cells. I've attached a section of the schematic (work in progress) showing how all the battery cells have connections to these ICs and the only output appears to be to a PFET being used to control one of the NFETs in the charging path.

For any future Google searchers, the IC appears to be a DFN-8 2mm x 2mm and has markings "BX 8LB" or possibly "EX 8LB" although I'm leaning towards the former.

I still don't know what the exact IC is but something pretty close would be a Nisshinbo Micro Devices R5439K "2 to 4 Serial Cell Li-Ion or Li-Polymer Battery Protection IC for Secondary Protection". I've attached a copy of the datasheet and a snippet of the typical application and pinout.

I'm not 100% sure this is the correct IC for a few reasons but the biggest is probably that the circuit would be relying on the mystery IC pin 8 to sink current to pull down the PFET gate which would then pull up the NFET gate and enabling charging. Pin 8 on the R5439K is a voltage regulator output pin which it seems like would be high most of the time unless the R5439K went in to SHUTDOWN2 mode when the voltage gets really low, which isn't what we want...I think. It doesn't seem like Pin 8 is designed to sink current so it'd be pretty odd to use it that way.

If anyone knows what the IC actually is from the marking codes, I'd love to know.

[dvd4me]

Welcome back tinfever, happy to see you started with fresh ideas.
While waiting for some new development I already replaced one of the red flashing Dyson BMS with an Ali BMS. it seems to work fine.
I have another older version of V6 BMS that does not have the protective silicone coating, maybe the code is not protected.. ( by the coating..  ).
I ordered a PicKit 3 on Ali. How I'm going to use that to try to read the Pic controller? I see you put some pins on your PCB.
Maybe a short description of that would help, I do not feel reading a ton of documentation... What to install and how to connect to BMS. Let's do some BMS talk... Or at least try to.
Second, have you seen the code posted on the ISL94208 project by the other contributor, maybe once you figure out the schematic it can help you out.

Thanks

[tinfever]

I'm happy to report I have the schematic 99% reverse engineered. It isn't the cleaned schematic in the world but it'll do. Only the two sections inside the rectangles I'm not quite sure about.

I'm also able to load my own programs on to the PIC and successfully blink the LEDs!

The right rectangle section I need to do some more testing on. The case marking indicated that SOT-23 component was likely the dual zener I show there but that really doesn't make any sense. Also, it my testing it doesn't act like I'd expect. When supplying current from my bench PSU, to pins on that IC, very little (0.4 mA) current will flow from pin 1>3 but lots (8mA) will flow from pins 2>3. In normal operation the voltage on pin 1 is 3.3V as regulated by the Q2 and the ISL94208. The voltage on pin 2 seems to be a very stable 2.5V. I almost wonder if it's some kind of shunt regulator or LDO but I still don't understand why it would be needed at all. I thought the zener made sense as a backup in case the Q2 regulation failed. For the record, it's the SOT-23 closest to the battery GND terminal on the PCB right above the PIC. It is labeled U3 and has a case marking of VAP3 or VAPJ I think. The fact that it is labelled U3 also indicates it could be something else.

Edit: Doh! This is totally a 2.5V series voltage reference for the ADC on the PIC. Looks like a SOT-23 MCP1525. Marking VA matches and everything. Mystery solved!

I also did some more testing of the previous mystery ICs and they are definitely overcharge protection ICs that cut off one of the charging MOSFETs if any battery cell voltage gets too high. This is probably a secondary protection to the primary control of the ISL94208.

It also occurred to me that there must be some mechanism for charger detection because the PIC clearly must wake up when the charging is connected to enable charging. However, it has to be smart enough to not turn on the output power and turn on the vacuum when this happens. I'd previously been imagining that the PIC would always enable the output whenever the PIC was awake unless there was some fault condition but that can't be the case.

I think I finally figured out why I was getting seemingly random failures to talk to the PIC too. There was a small spec of solder (probably as a result of my scraping and probing) that was between the two ICSPDAT and ICSPCLK pins on the IC. I scraped that away and it's been working like a charm. The PIC was definitely erased though, again probably my own doing.

Welcome back tinfever, happy to see you started with fresh ideas.
While waiting for some new development I already replaced one of the red flashing Dyson BMS with an Ali BMS. it seems to work fine.
I have another older version of V6 BMS that does not have the protective silicone coating, maybe the code is not protected.. ( by the coating..  ).
I ordered a PicKit 3 on Ali. How I'm going to use that to try to read the Pic controller? I see you put some pins on your PCB.
Maybe a short description of that would help, I do not feel reading a ton of documentation... What to install and how to connect to BMS. Let's do some BMS talk... Or at least try to.
Second, have you seen the code posted on the ISL94208 project by the other contributor, maybe once you figure out the schematic it can help you out.

Thanks

Hi dvd4me! I actually ordered one of the Aliexpress BMS boards but I'm too stubborn to do things the easy way and replace the whole BMS board. I always seem to do things the hard way haha 

I have no idea about the V6 BMS boards but if it is a PIC microcontroller and Dyson was kind enough to leave empty PTH for the programming pins I'd recommend you:

• Get the datasheet for that specific PIC and figure out what pins are the ICSP pins. If it's like the V7 BMS board I'm working on, you'll need to identify VCC, GND, VPP, ICSPCLK, and ICSPDAT
• The V7 BMS board has empty PTH on all the programming pins so I soldered headers on to those for easy access. I'd suggest doing the same if you can.
• Connect the PICKit to the Dyson BMS board. The pins on the BMS board weren't in the same order as those on the PICKit so you have to be very careful to connect them in the right order
• Install MPLAB IDE and IPE
• Open IPE and configure the PICKit to power the target. You might also want to enable low voltage programming mode
• Try to connect to the PIC and see if you can dump the memory

It'd be interesting to see a dump of the memory but it's going to be a binary dump that someone would have to reverse engineer to make any sense of. I have no idea how hard that part will be since I haven't done it before.

I glanced at the code from the ISL94208 project when the author made it available (if it was you who reached out to them, thanks!) but haven't looked at it much. Right now I'm just blinking the LEDs in fancy colors so once I get a little further in to the software I might look at it for some guidance.

[Craftsman]

Dvd4me,

I might have missed it but do you have a conclusion for rebalancing a still working but short run time pack - ie one that the BMS hasn't locked up on?  Does the pack's performance improve once rebalanced?

Thanks!

[tinfever]

Well I think I might have figured out why the cells becoming imbalanced in these battery packs... I DON'T THINK DYSON IMPLEMENTED CELL BALANCING 

Not only that, it looks like the purposely miswired it to prevent cell balancing from even being possible!

According to the ISL94208 datasheet, "An internal FET between the CBN and the VCELL(N - 1) can be turned on to discharge CELLN more than other cells, or to shunt some of the charging current away from CELLN. This function is used to reduce the voltage on an individual cell relative to other cells in the pack."

I just noticed on my schematic, and confirmed on the PCB, that CBN and VCELL(N - 1) are connected together for each cell. Meaning enabling the internal balancing FETs won't do anything and the pack can't be self-balanced!

I'm showing and measuring the following pins as being shorted together:
Pins 3-4 (CB6, VCELL5)
Pins 5-6 (CB5, VCELL4)
Pins 7-8 (CB4, VCELL3)
Pins 9-10 (CB3, VCELL2)
Pins 11-12 (CB2, VCELL1)
Pins 14-15 (VCELL0, CB1)

The only way I see cell balancing working is if those mystery ICs are handling that, but cell balancing through 5.1K resistors? I don't think that's happening.

Could anyone confirm my findings? If this is correct, well it's just disgraceful...

[dvd4me]

Dvd4me,

I might have missed it but do you have a conclusion for rebalancing a still working but short run time pack - ie one that the BMS hasn't locked up on?  Does the pack's performance improve once rebalanced?

Thanks!

Hello Craftman, in theory (measured on the cells) the charging stops at 4.2 high and 3.1V low. Obviously if cells are getting unbalanced it will stop charging as soon as one gets to 4.2V. There is less energy to put in and less to take out, while one cell goes low to 3.1 V it stops.
Balancing it's vital to maximize capacity and it seems the original Dyson BMS has not even implement the balancing, otherwise BMS will not get the blinking lights after severe unbalancing.
I run the balancing of a V7 pack just to measure the voltages of the charge/discharge limits of an original Dyson BMS. I do not have a vacuum for the V7 so no other use other than experimenting. Capacity measured thru BMS discharge is 2100Mah, not far from the 2800 maximum. I put some capacity measuring pictures in my other post.
I must say it's fun to understand all these details about their technologies.
To fix the problem I assume a balance connector can be passed thru a hole in the battery housing, to do a voltage measure and balancing every now and then.
 
 

[dvd4me]

Well I think I might have figured out why the cells becoming imbalanced in these battery packs... I DON'T THINK DYSON IMPLEMENTED CELL BALANCING 

Not only that, it looks like the purposely miswired it to prevent cell balancing from even being possible!

Could anyone confirm my findings? If this is correct, well it's just disgraceful...

Hello tinfever, i cannot confirm because I do not want to remove the coating on my only V7 I have, in good working condition.
The second V6 Ali BMS has a ton of transistors comparing to the first one I bought. Check the picture below. I believe it may have balancing.
Also I put the picture of the first V6 BMS I replaced, the "naked" one. You can see it has the same PIC as the V7, thus maybe sharing the same code...
I really appreciate your enthusiasm regarding all this, reminds me back on my younger times.
I regularly check the recycling places to find new batteries, it's fun to study. In parallel with this, I am testing the process of reviving old or heavy discharged laptop batteries.
I successfully brought back to live one that was around 2 V per cell, now it's charging just normally in the laptop, old shitty one, but charging... 
Dyson BMS lead me to that idea in the first place, so everything is connected.
Many thanks to your hard work to pull out the schematics, I imagine the lack of balancing kind of disappointing. When I receive the Pickit maybe I can get to read the code.. Since there is no balancing it must be simple... 
A lot of protection for nothing...
I am procrastinating to assemble the second pack out of Dewalt batteries, I discharged them to around 3.5 so I can assemble/spotweld  them safely in case I make a short. They are very unbalanced so I can test if the second ALi BMS has that implemented. Take a look at the pcb, similar interface pins for the chip... so much to learn but so short time.

[tinfever]

Well I think I might have figured out why the cells becoming imbalanced in these battery packs... I DON'T THINK DYSON IMPLEMENTED CELL BALANCING 

Not only that, it looks like the purposely miswired it to prevent cell balancing from even being possible!

Could anyone confirm my findings? If this is correct, well it's just disgraceful...

Hello tinfever, i cannot confirm because I do not want to remove the coating on my only V7 I have, in good working condition.
The second V6 Ali BMS has a ton of transistors comparing to the first one I bought. Check the picture below. I believe it may have balancing.
Also I put the picture of the first V6 BMS I replaced, the "naked" one. You can see it has the same PIC as the V7, thus maybe sharing the same code...
I really appreciate your enthusiasm regarding all this, reminds me back on my younger times.
I regularly check the recycling places to find new batteries, it's fun to study. In parallel with this, I am testing the process of reviving old or heavy discharged laptop batteries.
I successfully brought back to live one that was around 2 V per cell, now it's charging just normally in the laptop, old shitty one, but charging... 
Dyson BMS lead me to that idea in the first place, so everything is connected.
Many thanks to your hard work to pull out the schematics, I imagine the lack of balancing kind of disappointing. When I receive the Pickit maybe I can get to read the code.. Since there is no balancing it must be simple... 
A lot of protection for nothing...
I am procrastinating to assemble the second pack out of Dewalt batteries, I discharged them to around 3.5 so I can assemble/spotweld  them safely in case I make a short. They are very unbalanced so I can test if the second ALi BMS has that implemented. Take a look at the pcb, similar interface pins for the chip... so much to learn but so short time.

Thanks for the kind words. That V6 BMS you showed looks extremely similar to my V7 BMS. I bet the programming pin out on the right matches mine. Keeping that the same would let the factories use the same programming header, assuming they don't just use a bed of nails with the bottom test points.

I also just noticed that the V7 BMS you previously included photos of is slightly different to mine. It looks wider and the programming pin spacing is different, so the pin order could be different too.

I tried to determine from your photos if the ISL94208 on your V6 or V7 BMS is wired for balancing but I just can't tell. If I had to guess, the V7 looks so similar to mine that it probably has the same non-balancing wiring as mine. The V6 has traces surrounding the ISL IC that look different enough that it could have balancing but I don't see any resistors around the battery connections that would be needed.

It's sad because all they had to do was add 220 Ohm 1/10th Watt resistors (4.2V drop over 220R = 80mW) to each battery connection and run the extra traces to the ISL IC and they could have had a much longer lasting product. That would have cost them about 1.2 cents (USD) in total BOM cost...

I see only a few reasons why they didn't do this:

• Their engineers are morons and they have no line of communication from customer feedback to engineering so they never fix this.
• They do this on purpose to sell more batteries. Environment and the customer be damned.
• Their engineers tried their hardest but they just couldn't fit it all on a four layer PCB with cell balancing, and management rejected the cost of increasing the layer count.
• Some poor engineer had a week to build this and no one had the time to implement the software for cell balancing.

Even if they didn't have the time to implement cell balancing in the software, I feel like it takes more effort to design the circuit to not have the balancing resistors. It'd be a lot easier to just copy-paste the reference schematic and just not implement the software.

In order to preserve my sanity, I'm going to assume option three happened and so no one is truly evil or incompetent. Not sure I believe that though.

This really puts a damper on my hopes to release a firmware update that anyone could use to make their pack functional again and have it self balance like it should. I think I'll still forge ahead and try to at least make something to revive the battery packs but I can't fix their stupid wiring in software. I'll probably cut the traces and add balancing resistors to my own pack out of spite though.

[DavidAlfa]

Everything is in the first page of the datasheet:

The ISL94208 provides integral overcurrent and short-circuit protection circuitry, an internal 3.3V voltage regulator, internal cell balancing switches, and drive circuitry for external FET devices for control of pack charge and discharge.

So no external fets needed for cell balancing.
But it's specified that max. fet current is 200mA.
RDS(on) is 5 Ohm typical (max 10), so limiting resistors are required.
If CBn and VCELLn are connected together, it will overload the mosfets, so in that case balancing is either disabled by software, or the fets are handling the overcurrent like champs.

Batteries warranty is usually very short, between 3 and 6 months, and I bet Dyson had a little (intentional) idea to make money faster.

[dvd4me]

Everything is in the first page of the datasheet:

The ISL94208 provides integral overcurrent and short-circuit protection circuitry, an internal 3.3V voltage regulator, internal cell balancing switches, and drive circuitry for external FET devices for control of pack charge and discharge.

I was about to answer to your first version on the post when you changed... Yes the chip can do the balancing, that's clear from the beginning but the Dyson implementation is not using it...
Tinfever pcb has CB6 and VCELL5 connected, that means there is no way to put balancing resistors, the 2 Fet terminals are shorted together.
The design on my naked V6 has those connection not tied up together and also traces to non-populated pads where the balancing resistors should be installed.

[dvd4me]

I tried to determine from your photos if the ISL94208 on your V6 or V7 BMS is wired for balancing but I just can't tell. If I had to guess, the V7 looks so similar to mine that it probably has the same non-balancing wiring as mine. The V6 has traces surrounding the ISL IC that look different enough that it could have balancing but I don't see any resistors around the battery connections that would be needed.

Hello tinfever, I just scrutinized the naked V6 and it has the CB N pins not tied up to the VCELL N-1 as your BMS has!
Actually I see the traces leading to non populated pads , it makes easy to put some resistors there. So if any software is to be released, there is hope balancing can be done on the hardware, at least on some of the original Dyson pcb versions.
In your case, once you cut the small trace looping to the VCELL and CB pins, thus opening the balancing FET for business, you can solder a tiny wire to the CB pin to a 200ohm resistor going to the other cell, to enable discharge/balancing
I just spent some time to clean with paint striper the silicone and the lacquer coating on the both dyson boards. The silicon cleans nicely once the lacquer underneath softens.
As you can see the older (originally naked) board has different layout. When I will receive the pickit I definitely want to try reading-it, the loose balancing pins may have some software bonus beside-it.
Parts marking cleaned up also with the paint striper...

[DavidAlfa]

Everything is in the first page of the datasheet:

The ISL94208 provides integral overcurrent and short-circuit protection circuitry, an internal 3.3V voltage regulator, internal cell balancing switches, and drive circuitry for external FET devices for control of pack charge and discharge.

I was about to answer to your first version on the post when you changed... Yes the chip can do the balancing, that's clear from the beginning but the Dyson implementation is not using it...
Tinfever pcb has CB6 and VCELL5 connected, that means there is no way to put balancing resistors, the 2 Fet terminals are shorted together.
The design on my naked V6 has those connection not tied up together and also traces to non-populated pads where the balancing resistors should be installed.

Yep, sorry, I completely missread something, so I thought wtf... This dude read nothing of the datasheet?
That's why I used RTFM at first .
Almost instantly I detected the mistake...

[dvd4me]

This really puts a damper on my hopes to release a firmware update that anyone could use to make their pack functional again and have it self balance like it should. I think I'll still forge ahead and try to at least make something to revive the battery packs but I can't fix their stupid wiring in software. I'll probably cut the traces and add balancing resistors to my own pack out of spite though.

Hey tinfever, out of disgust upon realizing the 32 flash error was just planned obsolescence, I just made a new topic with that exact title, pointing out to the real heroes here, working towards fixing this.
Maybe someone has already that PIC code, who knows, it's good to attract some attention and maybe help.
I could live with manual balancing but at least the pack does not lock up. If the code can be improved towards implementing balancing, even better...

It's like Free Brittny - free dyson batteries... 

Hope to see some good news as I hope to see my PicKit soon... I had some dreams about them forgetting to lock that V6 older "naked" board... Yeah, getting into that naked thing... 

Anyway, hope to see good things soon. Cheers

[dvd4me]

Hello again,

I finally took the time to install the second Ali BMS, the one that looked " promising" in terms of balancing... well, it is not balancing.
I spot welded a bunch of Dewalt recycled cells that i did not tested for capacity, just put them together.. as in the picture. I practiced my spot-welding techniques, next time I can do better.
It's hard to clean the spot welding bumps from the previous use so I try to re-use some part of those welded tabs, they were so thick on the Dewalt implementation, hard to cut them off nicely.

The Dewalt cells were unbalanced and I was just charging the new assembly to see if the BMS will do something about-it. Well, it did not...
I was trying to use the Dyson original pack thermistor, nicely aligning the legs to fit the new ali BMS holes... just to notice after I had already installed that the BMS had 20k thermistor while the pack one is 10k.
This 10k pack value will simulate on the ali BMS the "real " temperature as too high, maybe the BMS would stop. I had to pull out the thermistor epoxied in the pack and put back the ali BMS (20k) one.
This version of the BMS goes quite low on the discharge state per cell, 2.9 V. I think it's ok, the cells recover a bit after the discharge process stops.
After manually balancing all the cells, the tested capacity it's quite low, 1300mAh, the Dewalt cells were already sort of wasted. That was some work for nothing but I did not had other low ESR cells to use right now.
I will look for better cells to change them next time.

Cheers

[tinfever]

I've run in to some trouble with my V7 (I'm going to try to call it SV11 from now on since that is more technically accurate) BMS firmware development. I think I may have somehow damaged by SV11 BMS board I was using for testing. It is no longer regulating the 3.3V VCC rail normally produced by the ISL94208 and the Q2 NPN. I was only getting around 2.8-3V and the whole board was drawing like 40mA even when I had the PIC completely erased. It seemed like something was pulling way too much current on VCC causing that voltage to dip.

Attempting to troubleshoot it, I determined there was a 16V drop across the 500 Ohm (Parallel 1k resistors) VCC input resistors going in to Q2. Under thermal imaging I saw the PIC getting warm, even after I erased it for testing. I cut the VCC traces to the PIC and the current dropped to about 20mA but still wasn't regulating. Oddly, the 2.5V voltage reference wasn't regulating either and was around 2V. I cut the trace between the voltage reference and the PIC and that helped a little with the current draw but I think I still had 15mA draw. Finally, I cut the trace between the RGO pin on the ISL94208 and the emitter of Q2 and that at least reduced the current draw to 1mA.

I have no idea what's really wrong with my SV11 BMS board or what caused it (it's probably my fault though). I snagged a SV09 (V6) battery out of the recycling at a nearby Lowes hardware store, and I'm going to continue development with that. Since I've already 100% reverse engineered the schematic for the SV11 BMS, and the SV09 BMS is extremely similar, I'm hopeful I can write firmware that will work on the SV09 and SV11 BMS.

Starting work on the SV09 BMS, I've 100% confirmed the firmware is code protected and cannot be read through normal methods. The EEPROM data is not protected but it's content meaning isn't immediately apparent. For posterity, I've uploaded the EEPROM data and a mostly empty hex dump from the PIC on the SV09 BMS.

It occurs to me that since the imbalanced cell permanent lockout error is retained after complete power loss, it is almost certainly stored as a bit in the EEPROM which we can edit without disturbing the protected code memory. Since my SV09 BMS still seems to operate normally (i.e. isn't locked out), I'm going to purposely imbalance the pack, measure when it goes in to lock out mode, and then determine which EEPROM bits change. Then I'll either write back my old EEPROM data or just change those specific bits. This might allow someone to manually rebalance their pack and then just reset the lockout bit to make the pack fully functional again.

To be continued...

[dvd4me]

Thanks tinfever!
This is one great piece of information, I wish I had the pickit arrived so I can try to read the eeprom myself.
Now i will probably have to put back the Dyson BMS i just took out, if there is a way of restoring the lock bit.
I could read the unlocked eeprom data and do a compare with the one you have. I will try to do this with the V7 when I will receive the Pickit.
I am happy you found the other V6 SV09 battery BMS, recycling it's such a treasure hunt.
Maybe you can find one for your V7 SV11 to fix the broken one.
Reversing the lock bit it's huge already... Curious to see how it will act, meaning if it needs to restart somehow, to make the bit change work.
Keep up the excellent work!
Thanks

[tinfever]

Quote from: dvd4me on Yesterday at 08:39:29 pm

Thanks tinfever!
This is one great piece of information, I wish I had the pickit arrived so I can try to read the eeprom myself.
Now i will probably have to put back the Dyson BMS i just took out, if there is a way of restoring the lock bit.
I could read the unlocked eeprom data and do a compare with the one you have. I will try to do this with the V7 when I will receive the Pickit.
I am happy you found the other V6 SV09 battery BMS, recycling it's such a treasure hunt.
Maybe you can find one for your V7 SV11 to fix the broken one.
Reversing the lock bit it's huge already... Curious to see how it will act, meaning if it needs to restart somehow, to make the bit change work.
Keep up the excellent work!
Thanks

Well I have good news and bad news.

The good news is that I have a better understanding of the various imbalanced cell lockouts on the battery packs. It appears that the battery will operate normally up until there is ~250-300mV difference between the highest and lowest voltage cell. Once that level of imbalance is reached, the pack output will turn off and the BMS will blink the blue LED 10x times. However, this is only a temporary lockout. Once you connect the pack to the charger, even for just two seconds, it will reset that lockout. However, even if you leave the pack on the charger to become fully charged, the cell imbalance will remain. Thus, if you fully charge the pack and attempt to use it, even though the temporary imbalance lockout is cleared, it will quickly detect the cells are still imbalanced and  turn off the output with the 10x blue blinks error.

Since the 10x blue LED blinks error is only temporary and is cleared by putting the battery on the charger, if you rebalance the pack it will become fully operational again.

Once the cells in the pack become even further imbalanced, which shouldn't easily be possible given the pack output will be disabled with the 10x blue LED flash code first, the pack will eventually go in to permanent lockout with the 32x red LED blink error. There is no way to reset this lockout even by manually rebalancing the pack at this point and putting it on the charger. The BMS will also not permit charging when the pack is in 32x red LED error lockout.

At this point, having rebalanced all the cells but still having the pack locked out, I attempted to load my previous EEPROM dumps to try to clear the lockout.

In my testing, I was entering the temporary imbalanced cell lockout under the following conditions:

Min. Cell Voltage / Max. Cell Voltage / Delta / Test cell discharge conditions
3.772 / 3.981 / 209mV / Cell 2 discharge until imbalance cutout, then full pack charged to completion.
3.932 / 4.154 / 222mV / 1A 3.8V CC+CV discharge on cell 2 until imbalance cutout
3.881 / 4.125 / 244mV / 1A 3.8V CC+CV discharge on cell 2
3.845 / 4.109 / 264mV / 250mA 3.8V CC+CV discharge on cell 2
3.815 / 4.097 / 282mV / 100mA 3.8V CC+CV discharge on cell 2

The above was me manually discharging just one cell at a set current until the pack went in to temporary lockout, briefly placing the pack on the charger to clear the lockout, and then making sure the output would still briefly turn on to make sure it wasn't permanently locked out. I would then reduce the discharge current on the single cell and discharge it further.

I finally reached permanent lockout mode with the following conditions:

Min. Cell Voltage / Max. Cell Voltage / Delta / Test cell discharge conditions
3.705 / 4.100 / 395mV / 1A 3.7V CC+CV discharge on cell 2, stopping at 100mA discharge current

Thus we reach the bad news:

The MPLAB IPE is stupid or at least unintuitive. I don't think I had the settings configured correctly and MPLAB IPE automatically wiped by PIC when I attempted to load the EEPROM data. Since the program memory was protected, it was not possible to backup and thus I cannot do any further testing on clearing the permanent lockout using the factory firmware.

In order to attempt programming the EEPROM without affecting the program memory or anything else, I went in to the Memory tab in IPE, changed "Auto select memories and ranges" to Manual, and unchecked the boxes for Configuration Memory, ID, and Program Memory, leaving only EEPROM checked.

However, when I went to program the EEPROM data, I received the following output:

Code: [Select]

Connecting to MPLAB PICkit 3...

Currently loaded firmware on PICkit 3
Firmware Suite Version.....01.56.09
Firmware type..............Enhanced Midrange
Target voltage detected
Target device PIC16LF1847 found.
Device Revision ID = 3
2022-02-15 15:52:33 -0700 - Programming...


Device Erased...

Programming...

The following memory area(s) will be programmed:
EEData memory
Programming/Verify complete
2022-02-15 15:52:40 -0700 - Programming complete

So it programmed just the EEPROM as requested, but only after erasing the whole chip... 

Looking that the settings options further, I see there are checkboxes for "Preserve Program Memory" and "Preserve ID Memory" that sound like could have prevented this. In hindsight I should have tested altering the EEPROM while leaving protected code untouched on my SV11(V7) BMS I've been programming first to make sure my settings were correct.

I've bought a few broken V6 and V7 battery packs that are being shipped so I might be able to come back to this in the future.

Addendum on the BMS charging algorithm:

As you may have mentioned in a previous post, the OEM charger is 26.1V at like 700mA. The BMS will permit you to charge the pack at almost any current if you don't break the charging over-current protection limit I assume is present. I tested charging up to 1A with no problems. When a charger is attached, the blue LED will turn on solid. Once any cell in the pack reaches 4.2V, the BMS will disable charging by opening one of the charging MOSFETs and blocking all current. After 70 seconds, charging will be enabled again until, once again, any cell reaches 4.2V. This process of charging pulses spaced 70 seconds apart (from the start of one pulse to the start of the next pulse) will repeat with the pulses getting shorter as it takes less and less time to reach 4.2V on any cell. Eventually, under some criteria I have not determined (but probably based on the voltage difference between the highest cell and the target 4.2V measured after 70 seconds with charging disabled), the pack will decide it is done and disable charging. All LEDs will now be off. Removing the charger and attaching it again will restart this process.

[dvd4me]

https://www.eevblog.com/forum/reviews/dyson-v7-trigger-cordless-vacuum-teardown-of-battery-pack/new/?topicseen#new

Looking that the settings options further, I see there are checkboxes for "Preserve Program Memory" and "Preserve ID Memory" that sound like could have prevented this. In hindsight I should have tested altering the EEPROM while leaving protected code untouched on my SV11(V7) BMS I've been programming first to make sure my settings were correct.

https://www.eevblog.com/forum/reviews/dyson-v7-trigger-cordless-vacuum-teardown-of-battery-pack/new/?topicseen#new

Hello tinfever, amazing job you did, on the good side your hard work it brings things closer and closer. I am pleasantly surprised you found the lockout algorithm, others can benefit and fix the balancing before putting the pack to charge.
It really sucks the MPLAB IPE settings are not very clear and there is only one chance of doing this, since the PIC accepts a full erase with no problem but no reading...
I hope the batteries you bought used are not the clones, those seems to last even shorter due to bad cells.

I know that being stubborn to find the solution, most of times pays off, as a sidetrack I just finished fixing a dead HP Pavilion 23xi display monitor found many months ago that was behaving strange... No wonder it was thrown away, other seems to have similar issues with this model. I bought the main chip and change-it, reprogram the Winbond 25x4 serial flash chip, changed the oscillator crystal... the monitor was not booting up... Just playing dead. I start to look around the resistors connected to the Winbond chip, one was bad, a 10k one was just open and the pin 7 - HOLD, the pin was floating low, chip was always going on HOLD because of that, no data,  so much work just for a stupid resistor... R54, circled. I leave this here in case someone googles for this issue on the HP 23xi series.
I took this work as a chance to practice my fine pitch soldering and the serial flash chip reprogramming, it was a while since I had not done this. I put the picture just for show off, my fine pitch manual soldering skills... 

Back to our subject, I hope you will receive your batteries soon to test the settings for lock bit re-programming. Meanwhile can you just load some garbage into the pic program area, set the read protect bit and then try to alter the eerom map and see if the program data is getting intact?
Since your chip is still working please try to find the exact settings of the MPLAb IPE so I will not erase mine when I will try to restore the lock bit.

Cheers

[SilverSolder]

Nice work - it would be amazing if it turns out to be possible to re-program the BCM, or update its EEPROM values!

Maybe the engineers at Dyson thought they'd leave a door open for someone willing to try hard enough, LOL 

[dvd4me]

So it programmed just the EEPROM as requested, but only after erasing the whole chip... 

Hello tinfever, I was wondering, on the picture of the V6 interface i put below, can you please identify the signals that go to PICkit so I do not do any mistake, since yours died off prematurely.
I know you mentioned them in the past in another post but now you connected to a V6 so there is no other mapping different than mine. Makes me feel more confident I know what I am doing.
I finally bought a PICkit 2 out of amazon to try this weekend to read the thing. The one I ordered from Ali takes longer than expected, I was too curious and just bought one that will come Saturday.
Maybe others have already tried but there is silence here... at least for the moment.

Thanks