Greenworks 60v battery Ohm terminal

[q9104]

Okay, let me continue observations. I've  captured full exchange sequence from the beginning. My tool is 40V snow thrower (2600607), batt is 5ah (2927207)
Battery starts transmitting when a tool is rising Ohm line up, initially it passes 5 different signals in 100ms interval, then starts transmitting one sequence until a tool release the line. Not sure how long it will cycle this, may be it will periodically retransmit whole greeting sequence (say, for older devices).

Initial sync pulse length: 397us (marked as S below)
Long pulse length: 198us (marked as 1 below)
Short pulse length: 94us (marked as 0 below)
Inter-pulse pause: 100ms.

Initial sequence

Q means query from battery side
R means tool response


1. Nearly +700ms from the moment when line is up
  Q: S 0 x 24
  R:   0 x 15
2. +800 ms 
  Q S 0 x 24
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
3. +900 ms
  Q S 1 0 1 0 0 0 0 0 0 1 0 1 0 0 0 0 1 1 1 1 0 0 0 0
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
4. +1000 ms
  Q S 0 1 1 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
5. +1100 ms
  Q S 0 0 1 1 0 0 0 0 1 0 1 1 0 1 0 0 1 0 0 1 1 1 0 0
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
Note: Surprisingly, first response is really only 15 bits. All further are 16 bits length

Continuous mode

6. +1300ms
  Q S 1 1 1 0 0 0 0 0 1 1 1 0 1 0 0 0 0 1 1 1 1 0 0 0
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
7. +1500ms
  Q S 1 1 1 0 0 0 0 0 1 1 1 0 1 0 0 0 0 1 1 1 1 0 0 0
  R   1 0 1 1 0 1 0 0 0 1 0 0 1 0 1 1
... etc

Here is a arduino code, which works for me (chineese nano works perfectly). Didn't check yet for long load time, but at least it successfully starts.

Code: [Select]

const int LINE_PIN = 2;

const int S_PREAMBLE = 412;
const int S_SHORT = 105;
const int S_LONG = 205;
const int S_PAUSE = 100;

const int MSG_PAUSE = 1000;

#define MESSAGE_LENGTH 25
const int INITIAL[4][MESSAGE_LENGTH] = {
  {'S', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
  {'S', 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
  {'S', 1, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0, 0},
  {'S', 0, 1, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0} 
};

const int PERIODIC[MESSAGE_LENGTH] =   {'S', 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 1, 1, 1, 1, 0, 0, 0};

typedef enum {
  LINE_LOW,
  LINE_FLOAT
} line_state_t;

void set_line(line_state_t state) {
  switch (state) {
    case LINE_LOW:
      pinMode(LINE_PIN, OUTPUT);
      digitalWrite(LINE_PIN, LOW);
      break;
    case LINE_FLOAT:
      pinMode(LINE_PIN, INPUT);
      break;
  }
}

void send_pulse(int pulse) {
  set_line(LINE_LOW);
  switch (pulse) {
    case 'S':
      delayMicroseconds(S_PREAMBLE);
      break;
    case 0:
      delayMicroseconds(S_SHORT);
      break;
    case 1:
      delayMicroseconds(S_LONG);
      break;
  }
  set_line(LINE_FLOAT);
}

void send_message(const int m[MESSAGE_LENGTH]) {
  for (int idx = 0; idx < MESSAGE_LENGTH; idx++) {
    send_pulse(m[idx]);
    delayMicroseconds(S_PAUSE);
  }
}
 
void setup() {
  set_line(LINE_FLOAT);
}

int state = 0;

void loop() {
  int line = digitalRead(LINE_PIN);
  if (line == 0) {
    state = 0;
    return;
  }

  if (line == 1 && state == 0) {
    delay(700);
  }

  if (state < 4) {
    send_message(INITIAL[state]);
    state ++;
    delay(100);
  } else {
    send_message(PERIODIC);
    delay(200);
  }
}

The code is not working for my Greenworks 40v model J18 cordless chainsaw, it stops rotating after 3 seconds. Do you have the latest code to match it? If so, can you share it with me?

[frenky]

I plan on trying to decode protocol between battery and a tool.
I currently have 80V Powerworks lawnmover and 80V Powerworks grass trimmer.
I will record whole communication on both tools with a logic analyser.

It would be really cool if I would be able to collect data communication from more people who have similar tools from same parent company (Greenworks, Kobalt, Snapper).
Will see how things progress...

[q9104]

I plan on trying to decode protocol between battery and a tool.
I currently have 80V Powerworks lawnmover and 80V Powerworks grass trimmer.
I will record whole communication on both tools with a logic analyser.

It would be really cool if I would be able to collect data communication from more people who have similar tools from same parent company (Greenworks, Kobalt, Snapper).
Will see how things progress...

Can you record the cracking protocol process? There are no related tutorials online at the moment, and I want to learn following your teaching

[frenky]

Well I'll be guessing the most...

I will record long samples of data and look at it from different perspective.

One would be to try to see if battery charge level influences the data.
Second is if changing tool influences data.
Third is if throttle button on trimmer influences data.
...

This week I should be getting replacement boards that are inside of battery case ( https://vi.aliexpress.com/item/1005008557268215.html ) and will compare signals with original battery.
I should be able to create a fake battery with 20 10K resistors to feed voltages to bms and to see what happens if I change resistor values to simulate a bad cell.

Basically trying to learn as much as possible...

[frenky]

I have received the boards that are inside battery case.
Attached are the photos.

The board with battery terminals is very simple so I draw a schematics.

The function of terminals is:
P+ => Battery +
PC+ => Charging port (Connected only to a charger and not to a tool)
COM => Bidirectional communication port
P- => Battery -




BMS board is not potted and markings on chips are visible so I should be able to draw schematics of that one also.

[frenky]

Is anybody familiar with this site:
https://www.dssz.com/search.php?keyword=board%20schematic&cateid=0&sort=&sortby=&sm=0&page=23

This is the only reference in google for the BMS board GeLiBo80V:



I was not able to access this resource even though I succesufully registered on that site (with temp email).

[q9104]

I will help you download this material and look forward to your subsequent tutorial

[q9104]

Looking forward to your results, and hope the tutorial can be simpler

[frenky]

Than you very much I'm sure this willl be very helpful.

[frenky]

So pdf GeLiBo80V contains schematics of bldc controller that is in the lawnmover.
My bms board from aliexpress has GeLiBo80V-V2 on it which is strange. But this pdf might still be usefull in the future...

Progres report...

I have drawn overlay of bottom layers to be able to reverse engineer the board:


Main MCU (U1) is "HR7P169B": https://jlcpcb.com/api/file/downloadByFileSystemAccessId/8588882239707099136

Four other ICs are for battery protection "JW3312": http://www.bstelec.com/uploads/soft/240904/JW3312.pdf

COM line is connected to the pin 11 on the MCU.

The is also a UART header from MCU with pads:   Unknown -> pulled up to 5V, 5V, GND, RX, TX

I didn't try to connect to UART yet but I did pull up COM line (that goes to the tool) to 5V and MCU started sending signals:
(I have connected 80V battery + and - to the B20 and B0 pads.)

[q9104]

I read the pulse signal of the 82v battery and converted it into code, but it didn't make my machine run effectively, and it still stops after about 3 seconds, I will upload the pulse file I obtained, which needs to be opened with Saleae - Logic 2 software

[frenky]

Tnx for the file. I'll try to record mine this weekend.

[frenky]

I converted your signal to bits:
Battery request                 Tool response      Delay till next msg
00000000 00000000 00000000      /                  95ms
00000000 00000000 00000000      0110100 01001011   90ms
10100000 00101000 10011000      0110100 01001011   89ms
01100000 00001010 01101010      0110100 01001011   89ms
00110000 00111100 00010010      0110100 01001011   189ms
11100000 11101000 01111000      0110100 01001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   89ms
-- REPEATING --
00000000 00000000 00000000      0110100 01001011   90ms
10100000 00101000 10011000      0110100 01001011   89ms
01100000 00001010 01101010      0110100 01001011   89ms
00110000 00111100 00010010      0110100 01001011   189ms
11100000 11101000 01111000      0110100 01001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   189ms
11100000 11101000 01111000      1110100 10001011   89ms
-- REPEATING --
...

It took me quite some time because I did it by looking at the signal visually because I don't know how to automatically convert the signal to bits in Saleae since protocol is not known.
I should probably implement my own decoder that matches:
1=> 100us high, 200us low
0=> 100us high, 100us low

[q9104]

Tell you the latest news, the greenworks80v and greenworks82v tool batteries can be used interchangeably, the communication of the two batteries seems to be the same

[frenky]

Do you own two different batteries? If yes could you  record signal of both? Just to see if it is different. And if it is we would know which part of signal is not so strict...

[frenky]

This is data form my PowerWorks 82V with battery half full:

Battery request                    Tool response         Delay till next msg
00000000 00000000 00000000         0110100 01001011      200ms
10100000 00101000 10011000         0110100 01001011      191ms
01100000 00010100 01110100         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      186ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      186ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      192ms
11100000 00000000 11100000         0110100 01001011      188ms

As you can see the data is much simplier that yours.
I have a date on my battery 2015-12-14 and bms board is quite different that the one from aliexpress.
The MCU is also different. On this older board it's Renesas TS1102A.

[q9104]

I'm sorry, the battery was borrowed from someone else, and it has been returned. I only tried using 80v and 82v batteries on 80v and 82v tools respectively, and they all work normally. It seems that there is no other difference except for the battery slot

[frenky]

No problem.
I have now recorded signal from my lawnmover with a half ampty and full battery and the signal is exactly the same.

[frenky]

I have drawn the interesting part (COM) of the BMS board:

I would say that when COM line is pulled up by the tool, GPIO9 gets pulled down and so MCU knows when to start transmitting on GPIO11.

[q9104]

Can you teach me how to convert a signal into bits?

[frenky]

I have now captured signal of trimmer with original battery.
The signal is exactly the same as with lawnmover:

Lawnmover:
Battery request                    Tool response         Delay till next msg
00000000 00000000 00000000         0110100 01001011      200ms
10100000 00101000 10011000         0110100 01001011      191ms
01100000 00010100 01110100         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      186ms
11100000 00000000 11100000         0110100 01001011      192ms
...

Trimmmer:
Battery request                    Tool response         Delay till next msg
00000000 00000000 00000000          000000 00000000      193ms (tool not yet ready?)
00000000 00000000 00000000         0110100 01001011      202ms
10100000 00101000 10011000         0110100 01001011      191ms
01100000 00010100 01110100         0110100 01001011      188ms
11100000 00000000 11100000         0110100 01001011      191ms
11100000 00000000 11100000         0110100 01001011      191ms
...

[frenky]

Can you teach me how to convert a signal into bits?

Sure:

[q9104]

Thank you, I have learned new knowledge

[frenky]

Some progress...

After playing a bit with trimmer I'm now 100% that previous solutions with arduino were not ok.
When the tools circuit gets powered up (after you press trigger button) the tool will pull up COM line to 5V.
And with arduino we should be pulling this line down (to send a signal) with mosfet like in the shematics above. (Mosfet connected to pin 11 of MCU).

I have now connected aliexpress board to my trimmer to check if it works.
Trimmer shuts down after a few seconds, because the signal is wrong for my trimmer:

Comparison:


There are quite some diffrences.
I believe the tool shuts down because it did not understand the last request. The requests that this aliexpres board is sending are much closer to your captured signal than mine.

What I didn't do but should have is to attach all bms lines to 20 resistors to simulate voltages of 20S battery. Will do this in the future but I have doubts that that will help with the signal.

Next on TODO list is to try to recreate a circut to correctly simulate battery communication. (Logic level mosfet connected to ESP32).

[frenky]

Just to be sure I quickly soldered a chain of 20 resistors (each 2K) conected it to the bms board pins and tried it again.
No change... Trimmer shuts down after a few seconds and the signal is exactly the same as before...
So cell voltages have no influence on the data.