[kennybobby]

i plan to put an index here in the first post of the schematics and any firmware that i can extract. When it gets enough critical mass i may start a github or hackaday project for collaboration and sharing.

Ryobi makes a bunch of power tools that use these packs, but the packs seem to fail quite prematurely and often. Many have been disassembled to find perfectly good cells but the BMS has shut off the pack. The bms chip seems to have a permanent failure mode "feature".

The LG and Samsung cells (10s2p 18650) that are used have no-explosion and no-fire specifications for both over charge and discharge, so it is a big waste of cells--just check out all the folks trying to sell their junk pack on ebay because it won't charge or work anymore.

Index:
1. T1 and T2 terminals, what is the function? Ryobi 40V BMS troubleshooting and repair

2. Driving the FETs, Ryobi 40V BMS troubleshooting and repair

[Edit 3/27/22]
3. How to do a Reset on the board--see post #91 for the old packs, and post #135 for the newer ones.

[edit 6/2022]
4. Identify the small transistor part numbers and how the charger communicates to the battery in post #67. #67

p.s. There is also an 18V thread with similar issues as the 40V, just for reference: Ryobi 18v lithium battery. Internals and charging

 

[kennybobby]

T1 and T2 terminals; Charger Notes

The T1 terminal on the pack is also present on the charger units and is labelled as "COM" on the charger circuit board;

[Edit 3/27/22: This is a serial communications line between the charger and the pack, and my best guess of the details are covered in post #94. The T1 is used as a "feature" to prevent charging through any other means than using a Ryobi charger. The charger side of T1 schematic is in post #67]

It measures 5.0 VDC when plugged into the mains when not charging, and 1.5 VDC while charging. IC2 is a quad op amp, AS324M-E1, and there is a voltage feedback loop on op1 comparing the voltage going to T1 with a divider at 2.143 V (before diode D10) with output driving the base of Q6 with collector signal to IC3 pin 8. Drop 0.6 across the diode and that puts T1 at 1.5 VDC; the ground reference is with respect to the Pack (-) connector terminal which is 2 FET Vds(ON) above the bottom of the Cells.

There is a pull-up 10k R47 to the +5V buss, then Q9 is used to regulate that feedback voltage mentioned above, the base is driven by IC3 pin 23.

The unknown chip in the charger is IC3, an ABOV ADC2011 28-pin TSSOP ic, looks like some sort of microcontroller, possibly an 8051 core?

[EDIT] adding sketch of charger T1 circuit in post # 67

========

The T2 terminal is found on some of the tools: mower, chainsaw, and ? (seems to be tools that have a high current draw)

The leaf blower does not have a T2.

========

Still trying to determine what function they provide, but the charger has several LED indications, one for self check of the charger, another for checking if the pack is defective. If defective then it won't try to charge the pack.

i suspect that T1 is used to indicate to the charger that the FETs are turned off and thus the pack is disabled--and on the path to discharge and destruction. Sells a bunch of replacement packs...

 

[ga2500ev2017]

I've bought a few of these. I want to package 4 of them together as a pack for my black and decker 36V self propelled lawm mower. So my primary interest is in paralleling the packs and alternative charging methods.

The BMS can be completely bypassed, thus creating the option of both parallelization and alternative charging. The BMS has access points to every terminal for each of the cells in the pack that can be tapped. They are labeled on the board as CL[1-10][+-]. So CL1- is pack ground, while CL10+ is the pack positive terminal. The two half packs are joined with the tab between CL5+ and CL6-. Note that the MOSFETs switch ground to the power tab -, while CL10+ and power tab + are connected directly together.

So it's simple enough to simply solder a wire to CL1- (which is pack ground) and CL10+ and have direct access to the pack without the BMS. A balance harness can be soldered to CL1- and to each CLx+ lead for x from 1 to 10 to have cell level balance access completely bypassing the dormant onboard BMS.

With deals on Ebay for 6 packs for $90 USD which translates to $0.75 USD a cell, it may be worth the gamble to purchase a lot, test the individual cells, and for the ones that pass, strap them together for a already packages, medium capacity, high power pack.

ga2500ev

 

[Coulomb]

Re: T1 and T2 terminals

I suspect that T1 is used to indicate to the charger that the FETs are turned off and thus the pack is disabled--

Either T1 is an input, or there must be something missing from your traced schematic, I think. I don't see anything other than T1 (per the colored schematic) that could turn on Q3.

 

[kennybobby]

That's a good observation ga2500, i have done the same, and even removed the cell 5+ to 6- connector tab labelled F1 to make 2 separate half-packs. Sometimes a cell or two is weak and pulls down the rest and prevents charging, but at least a 20V pack can be salvaged.

i want to figure out how to reprogram the controller to not destroy the packs. One way i've tried is to de-solder the little bridge joints located near the thru-hole tabs to the cell (+), for all but cell 10. With a high wattage iron the solder can be wicked off and you will see the little wavy line that cuts thru a large round pad, it reminds me of those half-moon or -heart necklaces that couples get where each half mates to the other. i don't know why they put so much solder on those junctions since no current flows thru the board--those are just for cell voltage sense, but it takes a big iron to get enough heat to wick all that solder, and it's nearly impossible to remove the board cleanly without pulling out the via for the cell tabs.

The OZ8940 chip drives the FETs and that is what needs to be understood how to keep him happy.

i'll post that schematic after i draw it up. It sure would help to have a datasheet for that thang.

 

[kennybobby]

Re: T1 and T2 terminals

Either T1 is an input, or there must be something missing from your traced schematic, I think. I don't see anything other than T1 (per the colored schematic) that could turn on Q3.

i was suprised too, T1 and T2 circuits are similar, but not the same circuitry, e.g. the missing zener and extra resistor. i mislabeled R6 twice, will have to fix it.

But the logic is simple if the FETs are open then there is no path back to GND (the bottom of cell 1 is GND) and the voltage at T1 or T2 will change state (assuming a pull-up inside the charger connected to T1). i tested a pack with FETs off and the charger flashed defective, then i manually charged the cells up to about 3.0 vpc and the FETs were driven back on, then it worked fine on the charger.

T1 can drive Q3 to send a Hi/Lo to U2 pin 21, but if the FETs are off then Q3 can't go active. Also U2pin16 can drive Q5 to pull T1 Lo, but not if the FETs are off. So my guess is that T1 has a pull-up resistor to B+ inside the charger to hold it Hi all the time. Then the pack can use these circuits to indicate the state of the FETs to the charger. Now i will have to dissect the charger to see--too many circuits, so little time..

 

[pdove]

FEATURES
• High power BMU
• Highly integrated battery pack monitor and protection
- Li-Ion and Li-Polymer (Co, Mn and FeP chemistries), NiMH and Fuel cells - 6-12 cells standalone
- 6-12 voltage channels, 2 external temperature channels
- Fully programmable battery protection parameters
- Built-in protection includes: over-voltage, under-voltage, over-current, short circuit, over-temperature, under-temperature, cell unbalance, and permanent failure
• Internal cell balancing
• Low power consumption
GENERAL DESCRIPTION
OZ8940 is a highly integrated IC for battery pack protection and monitoring, used to manage Li-Ion and Li-Polymer packs with 6-12 series cells.
With an integrated multi-channel 12-bit ADC, OZ8940 continuously monitors each cell voltage and pack temperature to provide maximum battery safety. It also provides a Permanent Failure function that will automatically assert a signal to blow an external fuse to open the power line or to signal an alarm to the user.
OZ8940 may be con gured to work in standalone “hardware” mode or with a microcontroller in “software” mode by con guring the EEPROM.

 

[kennybobby]

Drivin' miss daisy--the FETs

Here is another piece of the puzzle, one FET is driven by the OZ and the other by the PIC.

 

[City]

Here is a video where I show how to bypass the charge FET. The bms still shuts down when discharging and the balancing still seems to work. The bms can not turn off charging so you need to monitor the charge process manually or have an external charge system that is smart. Enjoy!

https://youtu.be/9chLnW1jX2U

 

[kennybobby]

Howdy City,

Thanks for sharing, it made me dust off my old notebook to look at this again.

i would be curious if you happened to do any troubleshooting to determine why the Q21 charge FET was OFF, e.g. measure the individual Cell voltages to determine if there was a low or imbalanced pair of cells, check for bad components in the path, check if the PIC controller was not sending the drive signal, etc?

Would this work without cutting the trace to the gate of Q21, there is a 2.7V zener diode to limit the voltage on the gate.

What about just putting a fat jumper wire to bypass the FET and take it out of the story?

Nearly all of the "Bad" packs that i found have been repaired by individually charging a pair of low cells. Not sure why they get out of balance, but it seems that if they do, then the BMS shuts it down. It is nearly impossible to remove and replace any individual cells without causing damage to the board.

 

[City]

I have 20 of these packs that I purchased to hopefully make a pack for a bike. All of the packs that I received were at 0V so I found that charging them with my iMax B6 mini on NIMH setting at 1 amp got the pack started charging. I checked individual cells to make sure they were all charging equally and once I got all the cells above 3 volts I changed to my charging circuit shown in the video. I limit the current to 1 amp and voltage to 41 volts to be safe. Most of the packs seem to charge the cells equally but only some of the packs worked with charging them without modding them or bypassing the Q21 charge FET.

I did try to figure out why some packs would be ok but I figure the microprocessor just locks itself as dead. Without reprogramming (which is beyond me right now), I figure the easiest way was to add the resistor to keep the FET on. You could remove and completely bypass Q21, but I was hoping that the thermal shut off may still protect the pack with the resistor mod. Maybe I'll pull one of the temperature sensors and do some tests with that and charging.

 

[kennybobby]

i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.

 

[City]

I am now powering my e-bike with 2 of these batteries. Mind you these batteries are not new and are the smaller 2.5Ah. I spent $6 US for my batteries, but with shipping and brokerage fees(forgot about that one when I ordered!) I figure I spent $17 CAD. So for $34 CAD and a couple more bucks for wire and connectors I have a decent battery pack for $40 CAD! I think If I used 2 new 5Ah batteries it would be very comparable to the battery I purchased for my bike but for hundreds less! I use XT60 connectors soldered to the main terminals and made a y connector with 2 XT60 connectors going to a XT90 connector to match my e-bike. I do plan on making a mount system so I can slide the batteries in and then connect the connectors, but I would be interested in a 3d printed version if you have one.

Here is a link for the video of what I have done.

https://youtu.be/3Gx68l37BsY

 

[Oric 1]

i plan to put an index here in the first post of the schematics and any firmware that i can extract. When it gets enough critical mass i may start a github or hackaday project for collaboration and sharing.

Ryobi makes a bunch of power tools that use these packs, but the packs seem to fail quite prematurely and often. Many have been disassembled to find perfectly good cells but the BMS has shut off the pack. The bms chip seems to have a permanent failure mode "feature".

The LG and Samsung cells (10s2p 18650) that are used have no-explosion and no-fire specifications for both over charge and discharge, so it is a big waste of cells--just check out all the folks trying to sell their junk pack on ebay because it won't charge or work anymore.

Index:
1. T1 and T2 terminals, what is the function? https://www.diyelectriccar.com/forums/showpost.php?p=1011217&postcount=2

2. Driving the FETs, https://www.diyelectriccar.com/forums/showpost.php?p=1012049&postcount=8

3.

Hello From France,

Here, we have the same problems with the Ryobi Batteries.
The 5Ah BMS seems to lock up without reason. All cells are good.
I'm also creating the schematic of the PCB.
The 2.6 Ah and 5Ah own differents PCB.
On the 2.6 Ah , there are one only Power mosfet, wired to OZ8940.
I wrote twice to O2 micro to ask for the technical datasheet, no answer.
On the 2.6 Ah , the Microchip is a HA1930, no documentation anywhere, but seem to be the 16F1786.
I have not yet understood how is made the dialogue between the charger and the battery.
I don't know if the firmware is locked, anyway, it's very difficult to understand the machine code extracted.
Finally, the simplest will be to rebuild a complete program.

The OZ8940 is configured by the PIC with the I2C protocol. With a scope or I2C spy, it's possible to read the dialog during the startup of the PIC, after the RST.

We find the OZ890 Datasheet on the web, maybe, the I2C registrers are the same.

I confirm it's a big job !

I also contacted several compatible ryobi sellers found on aliexpress, they do not sell the BMS circuit separately

 

[kennybobby]

très bon et excellent travail pour dessouder les planches sans dommage.

very good, and great job to desolder the boards without damage.

 

[Oric 1]

My method for desoldering the PCB:

Leave the solder in place which holds the terminals of the elements. Even add more.
And heat each terminal by passing a plastic spatula below, and performing a slight lifting. ( spatula delivered with replacement kits for phone screens )
Remove the soldering iron before releasing the lift.
And do that on all the terminals, going in circles.
The PCB will rise more and more.

 

[kennybobby]

That's a great tip. They put so much solder on there that i used half a roll of wick to get one off, and the vias for some of the cell tabs pulled out. A big mess that put so much heat into the tabs that some melted the plastic holder.

ps check your private messages

 

[Oric 1]

i would like to find or make some sort of female connector to mate with the Ryobi battery in order to use it as a power supply for other projects. Seems like that would be a good 3-d printer item if i can find the mating electrical contacts.

Found on aliexpress. It's a BMS for a Greenwork Battery
The connector seem to be the same the Charger Ryobi

 

[Eddie49]

They put so much solder on there that i used half a roll of wick to get one off

Wick ? You need a solder sucker.

 

[Kith]

While searching the web, I came across this site. I have two of these batteries ( OP40301/3 Ah). One is still working and the other has issues. I really appreciate if someone can help me to identify if this issue can be fixed. I have listed below all the symptoms of this issue:

1. When I press the fuel gauge button, all 4 green lights keep on flashing
2. When connected to the charger, it blinks red/green to indicate the batter is defective
3. 22uF capacitor has 39V, but when I measure the voltage it keeps on dropping to 3v. This does not happen on the good one. It shows a steady 39V when I measure the voltage.
4. I checked all individual cell packs ( there are 10 of them) and all of them are good and hold charge.
5. I can charge the battery using an external charger. I used the batter on a load ( Batt and Gnd) and it discharges properly.

Is this something that can be easily fixed?