The first supported chip is BQ8030 with Sany firmware. Video demonstration How to Reset BQ8030 Sanyo using NLBA Laptop Battery Tester – Laptop Battery Chip Reset, Reprogram or Repair – NIP Embedded Forum. Service Menu Instructions. The service menu is a hidden menu on a lot of electronics items - allowing you to alter some of the factory settings, typically reserved for installers and technicians.
The battery in my Lenovo laptop were slowly losing part of it's capacity. The remaining capacity was 69% (good score after 2,5 years) but I need the really long battery time while travelling.
The battery statistics according to Lenovo power utility:
So, I bought some Panasonic NCR18650B Cells (3400mah) for 6 euro a piece (can be bought cheaply here in China, just watch out for fakes) and decided to put them in. Theoretically Increasing the capacity from 69% of 5.6 Ah = 3.86Ah to 6.8Ah, a 76% increase in battery life!
After breaking the casing I saw a really nicely designed and built battery pack. Being curious about the IC's on the PCB I searched online and found two trustworthy IC's from Texas Instruments doing all the hard work:
Ultimate unwrap 3d tutorial. - bq29330, a lithium battery protection IC
- bq8030, a lithium battery gauge, to keep track of the amount of charge left in the battery.
By chance I also found a site where they tried to refurbish a battery pack from a Lenovo battery pack and it did not work because of safety features on the PCB (link).
So checking the PCB again I found a curious small circuit which burns a non resettable fuse when problems are detected, trashing the battery. This is quite understandable, just another safety feature Lenovo build into the lithium battery I guess. Windows 7 activator toolkit download. Not knowing when the fuse would be blown, I had to proceed with caution. Thanks allaboutcircuits, for not letting me end up with a busted battery pack!
You cannot just solder wires to lithium-ion cells, they will just overheat and might even explode! Luckily at the moment I am living in Shanghai, so I went to a small electronics factory and spot welded some connections to the batteries (I did it myself) and connected them together in a 3x2 batteries in series way.
Back home, I first made sure both batteries had about the same voltage, the bad banana plug wires I used had enough resistance to keep the balancing current under 1A.
After waiting for a night the cells from the old and new pack had the same voltage. To keep the protection circuit from detecting the change in batteries I would need to keep the pcb powered with the old batteries until the new batteries were connected. Luckily Lenovo provided some testpads right next to the places where the batteries are connected to the PCB. So I soldered wires between the testpads and the tabs on the old batteries.
Then I slowly started to dismantle the old battery pack for the solder tabs connected to the pcb. It takes a bit of force, but you can get the tabs off in reasonably good shape.
And I attached them to the new batteries by soldering them together with a really thin layer of solder. The plastic seperators from the old pack were also reused.
Added some new double sided tape to the old plastic casing and put the batteries in:
I Soldered the tabs to the PCB again, taking good care not to short circuit anything. Then desoldered the wires running to the old battery pack and done! Ikea advent calendar.
After sliding the battery back into the laptop and trying to switch the laptop on..... It booted! Luckily, Lenovo does provide a way to reset the battery gauge in the Lenovo Power Controls software:
At the moment the laptop is still charging (says there were only two minutes of charging left for about half an hournow). Hopefully Hackaday projects will let me post an update, don't know about that yet.
So, what this shows is, that it is possible to rebuild your Lenovo battery pack without the protections against tampering are kicking in.
UPDATE:
After a few charge/discharge cycles, the total charge according to the battery gauge is still stuck at 61.21 Wh. It should be about 3*3.7*3.4*2=75.5 Wh. If you disable all the low battery hibernate and sleep timers, the laptop will beep like mad when according to the battery gauge 0.25Wh is left in the battery. Then the laptop happily keeps running for about one hour.
Probably there is a software programmed capacity limit about 4Wh larger than the designed battery capacity (stuck at 57.72 Wh).
Sadly there is no way to tell when the laptop battery will deplete completely, except for watching the battery voltage closely. I did find this nice program called Battery Care which can show the battery voltage. I might even convince the maker of the program to put in an alarm/warning system based on battery voltage.
So partial success on this hack. Anybody in for some battery gauge reprogramming via SMBUS action?
Some research has already been done into the subject of resetting the BQ8030, but no real progress so far. You can even buy a Sanyo battery reset tool (LINK), but don't have 3200usd to spare. O well, the batteries will wear out enough in about two years to reach the 61Wh limit again..
DISCLAIMER: Lithium batteries can be dangerous for a long healty life if you don't treat them with respect, so be curefull folks and do it at your own risk.
Sanyo Tool Reset Bq8030 Datasheet Archive. Jackson 5 Anthology Rar. WinRAR for Windows 10 Description WinRAR is a powerful utility for creating. Hello, I have a strange problem with dell inspiron battery with bq8030 sanyo chip. Hello guys, I have few batteries with BQ8030 which are released by Sony/Sanyo, there is no datasheet for this chip. I just want to know how can I reset the Cycle. Sony tool reset /program bq8030 bq8020 bq80201 software and how to reset/program.
I started out by measuring voltages on all the pins. Data warehousing data mining and olap alex berson pdf merger. Just going by logic I was expecting some sort of differentiation on the various sides of the chip. To summarize my findings after the first pass: • 1-12 is the 'main microcontroller side' has the SMBus pins, VCC (and probably RESET and others) • 25-36 is connected to current sensing and exposes various built-in voltage regulators • 37-48 appears to be mainly unused with a couple of pins at 3.3v, GPIO side? • 13-24 has many pins connected directly to 'high voltage' from the cells. I took a 1k resistor connected to ground and started poking the pins with it to find reset.
It should be possible to pull reset low through 1k resistor but unlikely on VCC and it shouldn't lead to a complete reset on an unrelated pin. It's also possible to rule out most pins through visual inspection and measurement. So long story short: Pin #12 is Reset. Next I wanted to see if there's something like a Boot pin that's going to get me a different mode when pulled either low or high during reset so I started up a continuous command scan and started poking at the pins again.
Pulling Pin #4 (also connected to Test Point 1 on the other side of the PCB) low during reset gave me this. $ smbusb_scan -w 0x16 ------------------------------------ smbusb_scan ------------------------------------ SMBusb Firmware Version: 1.0.1 Scanning for command writability. Scan range: 00 - ff Skipping: None ------------------------------------ *snip* [f0] ACK, Byte writable [f1] ACK [f2] ACK [f3] ACK [f4] ACK [f5] ACK [f6] ACK [f7] ACK [f8] ACK [f9] ACK [fa] ACK, Byte writable, Word writable, Block writable [fb] ACK, Byte writable, Word writable, Block writable [fc] ACK, Byte writable, Word writable, Block writable, >Block writable [fd] ACK, Byte writable, Word writable, Block writable, >Block writable [fe] ACK [ff] ACK The chip was ACKing on every command. A deliberate attempt at confusing any would-be attacker perhaps? The write scan however reveals that the chip is actually exposing some real functionality on some of the commands and that a couple of them violate SMBus protocol.
Pin #4 appears to be BOOT (active-low). Mapping Mapping out the protocol took a while especially because it doesn't correspond to standard SMBus protocol but I was eventually able to figure out how to read and write to RAM and erase blocks of memory-mapped flash.
Sanyo Tool Reset Bq8030 Remote
Just writing to the appropriate address in ram (after the flash blocks have been erased) writes the flash memory which is convenient. There are several partitions of flash mapped into RAM and I'm sure I haven't found all of them. The ones I did are included as address&length presets in the flasher tool. $ smbusb_r2j240flasher -d eep2.bin -p df2 ------------------------------------ smbusb_r2j240flasher ------------------------------------ SMBusb Firmware Version: 1.0.1 ------------------------------------ Dumping memory 0x3400-0x37ff. $ xxd eep2.bin 0000000: 0000 0000 0000 0000 0000 ffff ffff ffff.
Sanyo Tool Reset Bq8030 Wifi
0000010: 4c4e 562d 3432 5434 3739 3700 0000 0000 LNV-42T4797. *snip* $ smbusb_r2j240flasher -d eep3.bin -p df3 ------------------------------------ smbusb_r2j240flasher ------------------------------------ SMBusb Firmware Version: 1.0.1 ------------------------------------ Dumping memory 0xc000-0xdfff.
