Dyson v7 Trigger cordless vacuum - TEARDOWN of battery pack - Page 1
Forum section: electronics / general

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 12:18:02 pm
content: I bought a Gtech Multi to clean up after my cat. It looked perfect for the job, and was a fair bit cheaper than the Dyson. Sadly, having charged it after it first arrived, it failed due to overload the first time I used it with the powered brush bar. It would run for about 20 seconds then cut out. "Oh, it shouldn't do that" said customer services, who immediately shipped out a replacement. Needless to say the replacement did EXACTLY the same thing.Clearly Gtech had both a batch problem, and a quality control problem. Given that this battery stuff is their core business, for me that is a red flag. I have personally lost faith in them.Hence I went up-market to the Dyson, at £200. Worked nicely with light daily work, often vacuuming the white duvet cover to clean off the black cat hair. All happy for 9 months then the evil flashing 32 times red flash code of death. This happens when you either try to turn it on or charge it. It was of course still under warranty so they sent out a new one, which worked nicely. Maybe I am just unlucky?I have seen another site where a small number of people have had the same experience. What percentage of these things fail is of course unknown.Anyway, a (free) duff battery pack is a valid excuse to tear it down and see what happened.The battery pack itself is fairly easy to remove (3 screws) but I can't see my youngest Aunt (75) or my mum (85) being able to do so.Removing the battery pack cover on the other hand is a horrible job, even with proper spudgers/ tools designed for the job.The battery pack is locked into its cover by the LED light pipe. You have to pry the case away on both side simultaneously to slide it out. I numbered the cells for later use.The Battery Management System (BMS) is shown on top of the cells. Cell 1 is the low end of the series connected chain, the negative end. The negative battery terminal is circled in blue. There is an interesting looking device circled on the left. It measures as open circuit (maybe). It has a silkscreen identifier as S1. (Thermal switch?) I originally thought it was a fuse, but there is a SM fuse at the positive end of the pack, and it is marked F1. You can follow the tracks easily and the small package would seem to be an N-channel enhancement MOSFET by its location. It is a strange looking package that looks like an SO-8 but the legs on the RHS are all merged into one. The upper three legs on the left are all connected to the 0.002 ohms sense resistor. The fourth lead is the gate. I know because I put some voltage on it via a 3K3 resistor and got it to turn on the supply voltage to the output terminals.The BMS board in the bottom right corner is marked as 228499-01/03, but a web search did not find anything relevant.This is a close up of the unknown "switch". I searched the unknown part number GD 18-05 and got nothingMy first thought was that the cells had become out of balance and upset the BMS.(1) 3.92 V(2) 4.15 V(3) 4.10 V(4) 3.84 V(5) 4.15 V(6) 3.92 VSo I put a PSU across each low cell and charged them all up to at least 4.05 V. No change in the flash code, but it is possible that the fault is permanently latched.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 02:03:47 pm
content: The whole board is covered in silicone rubber, so a bit of digging was required.The MOSFET is shown as best as I can get it below:Maybe it is ICD30b or 1CO30b or some variant in betweenThen maybePrm1740I couldn’t even find this type of package in manufacturers’ data.The annoying thing is that the cells all work, the MOSFET works, and something has gone wrong causing it all of it to end up in landfill.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 02:30:14 pm
content: S1 (marked GD 18-05) had 19 V across it. Thinking it was a fuse I tried a “soft short” with 100R, and when that was successful, took the resistor down to 10R. The result was 0.8mV across it. Now instead of 32 red flashes when operating the ON switch I get 32 red flashes, a slight pause and a green flash.It still doesn’t work, but the green flash sounds like an improvement!

author: schmitt trigger
author_rank: Super Contributor
timestamp: January 22, 2020, 03:01:02 pm
content: Please continue with your detective work.... I also own a Dyson, and might come back to this thread later.Charged batteries give me the creeps when I am poking around on a board. Do you think you could open up a terminal, and substitute the battery pack with a current limited PSU of roughly the same voltage?That way, you could safely poke around without fear of a major short.Can you read the part numbers on the ICs?

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 04:09:56 pm
content: Quote from: schmitt trigger on January 22, 2020, 03:01:02 pmThe trouble is, there is not "a terminal". We have the two ends of the series chain of cells, but also all the intermediate taps. Undo the connections in the wrong order and it may cause it to blow up. I designed a large pack, where each cell was 1 kg, and each cell had its own charge balancer between the terminals. Plugging in to the monitor board had to be done in an exact order or the monitor board would be fried. Those cells were seriously scaryThe ICs are still under the silicone rubber. But they look like FPGAs or micros. If the MOSFET is unrecognisable, you have to figure that they are too.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 04:16:06 pm
content: Quote from: CJay on January 22, 2020, 03:07:04 pmIt's too scary, so no.It has to be said, I can power up the output using an override resistor to the MOSFET gate, so in principle I could bodge it to function. Trouble is that bypasses the BMS and makes it a pretty serious fire risk. Also the charging circuit doesn’t currently work either.Since you can’t eject the battery pack in this design, if the BMS is bypassed, and something makes it catch fire, you have to chuck the whole vacuum cleaner out the nearest window and duck!

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 04:45:56 pm
content: Quote from: schmitt trigger on January 22, 2020, 03:01:02 pmAfter digging out the silicone, then scraping or the varnish or paint, it doesn't look very readable:And that is the best after several tries, with the light and camera at different angles.But there are only two ICs. There seems to be little on the underside. There doesn't seem to be enough stuff to do cell balancing, which is possibly why the cells were so out of balance.

author: capt bullshot
author_rank: Super Contributor
timestamp: January 22, 2020, 04:47:54 pm
content: Quote from: Lesolee on January 22, 2020, 02:30:14 pmThis thing looks like a reed switch to me. Maybe there's a magnet in the body that activates the battery when plugged in?Anyway, the cell voltages looked heavily out of balance to me, my guess this caused the permanent lockout. Laptop battery packs often have a "pyrofuse" or "chemical fuse" that gets blown by the BMS to permanently disable the battery. In your picture, I didn't spot such a thing here. Depending on the evilness of the embedded firmware, a complete reset (by disconnecting all cells) might help.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 04:59:47 pm
content: Quote from: capt bullshot on January 22, 2020, 04:47:54 pmExactly rightI first tried my continuity buzzerThen realised it was a live circuit, so tried a voltmeter instead. Sure enough the voltage drops from 19V to nothing when a magnet approaches it.I can't find any magnet in the battery cover or vacuum body. Nevertheless, great happiness found.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 05:11:50 pm
content: I found the magnet!This is the overview, with the dust bin removed. This is easily done by opening the dust release mechanism (as if emptying) and then releasing the bin attach clip. (They say to do this when changing the battery pack, although it is not actually necessary.)Then we use the handy "magnet detection tool" (a spanner). It is stuck to the magnet in this shot.One mystery solved.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 05:38:05 pm
content: If you remember your old B/W WWII movies (and maybe this is just for fellow Brits) the procedure for defusing bombs was to say what you were doing into a mike, so if it blew the next guy would know what you did, and what did or didn’t work!To detach the BMS from the pack involves cutting the 7 battery pack wires. Either the order matters or it doesn’t. Supposing it does matter, which one should be cut first?My first thought was the 30A fuse at the positive end of the pack. But I don’t really fancy desoldering that live. The next best thing would be to cut the main positive feed. But then we have all the intermediate cells feeding in voltage, potentially above the power supply voltage of the sense chip.So, new plan. Snip the cell-sense wires starting at the most positive and going all the way down, leaving both positive and negative feeds from the pack intact. Then cut the positive feed. (S1 not shorted or magnetically turned on during this process.)

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 05:58:10 pm
content: Step 1 complete:Now if you are wondering why the pack is sitting on a wooden board let me explain:Given that mobile phone batteries are known to catch fire and be very unpleasant, and this battery pack is a shed load bigger, the window in the room was opened, the net curtain looped out of the way, and the pack resting on a small wooden board. In case of smoke or flame the pack would have been ejected out the window.As it turns out nothing happened.Maybe I’m just being melodramatic.I like to think it is just sensible caution.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 22, 2020, 07:54:58 pm
content: Step 2 complete:re-connected in the reverse sequence after leaving it open for an hour or more.Now I no longer get a green LED at the end of the 32-flash red sequence (using a magnet to actuate the reed) when using the charger.The on/off switch gives no flashes, but the voltage that develops across the open switch contact is around 7mV (the switch is used in a normally closed configuration).

author: capt bullshot
author_rank: Super Contributor
timestamp: January 23, 2020, 06:25:48 am
content: Looks like the BMS either is broken or permanently locked out to protect the average user from fire hazards.I might try to connect battery bottom (-) first, then all the middle taps, then the top end (+) - so the BMS never sees an unconnected cell when it is finally powered on. This might damage a chip, though I wouldn't expect that, but as it is unusable anyway it doesn't matter anymore.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 23, 2020, 08:05:14 am
content: Quote from: capt bullshot on January 23, 2020, 06:25:48 amWouldn't that be equivalent to removing the positive lead, waiting, then reconnecting it?It occurs to me that the BMS must have been connected to a live battery pack in the first place. Of course there could be all sorts of special links needed to fit it in the first place, but it is hard to understand how you could ever connect it in a particular order in the first place, given that all the terminals are soldered by inserting from the bottom of the board and soldering from the top. Accidental connection in a random order would be all too easy.

author: Lesolee
author_rank: Regular Contributor
timestamp: January 23, 2020, 09:47:20 am
content: Quote from: CJay on January 23, 2020, 09:33:18 amI looked for adjacent pin holes that could be shorted (in place of a switch) and I found a row of 4 holes buried under the silicone rubber near to the reed switch.The only thing I can see underneath is a large black lump, which I am guessing is thermal cutout or sensor.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 01, 2020, 05:35:01 pm
content: The test points are numbered N7 (top), N3, N4, N8 (the text is difficult to read so these values could be incorrect).Measured with respect to the battery negative when nothing is happening:N7: < 1mV 22KN3: < 1mV 78KN4: < 1 mV 76KN8: < 1 mV 17KN7 3.3 V when flashing LEDN3 3.0 V when flashing LEDN4 3.0 V when flashing LEDN8 3.3 V when flashing LEDAll 4 test points seem to come up at the same time -They also seem to fall at the same time -A 1K resistor will pull any of them down to 0V,except N8, which is unaffected even by a 111 ohm load.Pulling N7 down stops the LED from flashing. None of the other 3 have this effect.There is no fast digital activity on these lines.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 02, 2020, 10:37:24 am
content: My scope is earthed via the USB cable. Of course it is, it's traditional. Mind you the BNCs are marked as being equipotential, not earthed. It does say it is grounded very clearly in the separate safety manual, but it doesn't seem to be mentioned in the User manual.My soldering iron is earthed. Well it is a direct mains powered heating element, so obviously it needs to be earthed for safety.It means that soldering onto the battery positive terminal when the scope is connected is inadvisableGOTCHAIt does produce a nice spark! Clearly the old grey cells have got a bit rusty.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 02, 2020, 11:24:10 am
content: Two more attempts to reset the BMS:(1) Charge the battery pack via the output terminals. Since the MOSFET is not ON, the MOSFET body diode will be the only charging path. 25.4 V on the output terminals and the battery charged at 0.5 A. Maybe 30 seconds or so of this before testing again.No permanent change to BMS.(2) Make the output turn ON using a 1K resistor from N8 to the MOSFET gate. Not a huge gate voltage, but enough to make the voltmeter show an ON state.No permanent change to BMS.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 03, 2020, 09:35:11 am
content: Quote from: CJay on February 03, 2020, 09:25:29 amNo, it is a double sided board covered in silcone rubber, so it would be difficult to follow the tracks.There are about half a dozen SOT-23 devices and then a couple of fine pitch multi-legged packages (FPGA/processor/custom battery sensor?) There really don't seem to be enough parts to do anything interesting, like shunt current away from an over-charged cell. At a guess I would say the BMS has a purely measurement/protection function and doesn't start if it is unhappy for any number of reasons.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 03, 2020, 10:16:26 am
content: I tried the cooling trick as well. Both multi-legged chips had been dug out of the silicone rubber earlier, so they were nicely exposed. I used a thermocouple to measure the temperature and managed to get it down to a measured -51°C.No change

author: Lesolee
author_rank: Regular Contributor
timestamp: February 03, 2020, 01:50:13 pm
content: The black lump descending below the BMS into the battery pack looks like some sort of thermal sensor. One end is connected to the battery pack negative (ground), the other end sits at around 1 V when the red LED flashes (constant 1 V regardless of the flashing activity). When the LED was not flashing, the non-grounded terminal measured 9.5 K to ground.A 10 R resistor on the 1 V end of the sensor (to ground) pulled the 1 V down to ground, but had no other effect. Pulling the 1 V up to 3 V by using a 1 K resistor to N8 also had no other effect. (Had to remember to unhook the scope when soldering to prevent ark-y sparky smokiness.)The measured 1 V (when LED flashing) dropped to 0.6 V when the sensor was heated to 60°C with a hair dryer.I would conclude that this testing rules out a faulty thermal sensor.

author: capt bullshot
author_rank: Super Contributor
timestamp: February 03, 2020, 02:46:35 pm
content: Quote from: Lesolee on February 03, 2020, 01:50:13 pmAgreed. I'm astonished by your effort to revive this battery pack. To me it looks like a one way ticket - once the controller has detected some kind of maybe dangerous battery or single cell failure it'll shut down the pack in some irreversible way (e.g. by flashing some internal variable). Regarding all the safety regulations that might apply to such kind of a battery pack, that'd be the way to design the BMS firmware.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 03, 2020, 03:30:18 pm
content: Quote from: capt bullshot on February 03, 2020, 02:46:35 pmFor me it is not just one, but potentially thousands. The landfill waste of a nearly working pack is horrific.

author: BillyD
author_rank: Regular Contributor
timestamp: February 03, 2020, 03:30:43 pm
content: I applaud your hard work on this. I and some family members have Dysons and it's only a matter of time before the batteries start failing so I'm hoping you'll succeed!Thanks for sharing your findings.

author: Lesolee
author_rank: Regular Contributor
timestamp: February 03, 2020, 03:53:42 pm
content: Quote from: BillyD on February 03, 2020, 03:30:43 pmThank you. To be fair I had run out of ideas when I posted the first message. Various encouragements have brought about new ideas to try. I am still in the position of having no further ideasIf Capt Bullshot is right, and an internal variable has been flashed, that seems problematic. I suspect a device with internal flash may well be itself programmable, so that a far UV source might clear the flash variable and the program at the same time.

author: capt bullshot
author_rank: Super Contributor
timestamp: February 03, 2020, 04:11:23 pm
content: Quote from: Lesolee on February 03, 2020, 03:30:18 pmI absolutely agree. It's a horrible waste of resources - some year or two ago, I recovered about 300 18650 cells from unused but for some reason discarded (shitty) power banks - my plan is to build another "large" battery of them for my home low voltage solar power supply system:http://wunderkis.de/pvbat/index.html. The cells are no-name chinese 2000mAh (usable 1500mAh averaged), so the final battery should be good for more than 1kWh. Among other issues (including a temporary lack of motivation), I'm still searching for a "fireproof" place to put the final battery into. Already made a lot of 9P packs, each nine of them will be paralleled in a total 81P / 4S configuration, so the charge/discharge current on the individual cell will be quite low (less than 15A current for the whole battery is planned). This way one can get quite an amount of capacity of these rather shitty cells.

author: schmitt trigger
author_rank: Super Contributor
timestamp: February 05, 2020, 03:12:14 pm
content: My post #3 proved to be an Omen.My wife just called, telling me that my V6 is quitting after a few seconds of operation.And indeed...although the replacement packs on Amazon are not that expensive, the bigger deal is the E-waste. I definitively will NOT dispose in the trash, but plan on looking for a recycle center.Just hope that the recycle center does indeed recycle it properly.Most likely it will end up in one of those African countries where they "recycle" the E-waste under terrible environmental conditions.EDIT: Rather than hijack this thread, I will open another one related to replacement batteries. This time on E-bikes.

author: wilfred
author_rank: Super Contributor
timestamp: November 05, 2020, 06:24:50 am
content: I have a need of a replacement battery for a Dyson V6. As far as I can determine it is Part number: 967810-21 on the Dyson Australia website and appears to be $79 with free shipping. I assume it will be about the original capacity. I'm not too bothered by the price since I got the device free.Checking on Ebay there seem to be endless selections of 4000mAh batteries with brand name cells. Of course I and I imagine no-one else will open one up to verify this and I doubt they are either 4000mAh or brand name cells for about 1/2 the price of the Dyson genuine battery.Has anyone had experience with these non-genuine batteries? I've done a bit of searching but haven't found much except for a NYtimes consumer article which wasn't complimentary.

author: DavidAlfa
author_rank: Super Contributor
timestamp: November 08, 2020, 06:18:22 pm
content: I guess those BMS are made in way that they will lock up if you try to remove the batteries.More planned obsolescence, and engineering to block repairing.Tried few times with laptop batteries, once you desolder the battery pack, it's over.I'm 100% sure that the thing sets a bit on its eeprom on first boot. Then, it never powers off.The voltage should never go down for the bms, when the battery goes flat it just cuts the output, but there's plenty of juice left for powering a micro-amp bms.So in the case you replace the cells..Bang! It knows the supply was removed and won't work again.In not "high end" devices, I was able to replace the cells successfully.Last week I did it again with a Lidl impact drill.

author: najrao
author_rank: Regular Contributor
timestamp: October 06, 2021, 03:27:37 am
content: I want to revive interest in this oldish post.Having read this over again, I was spurred to acquire six of these Dyson batteries to see if there can be a salvage. Flea market, but still moderately pricy.One decapped is exactly the same as Lesolee's, and tests out the same, i.e., 32 red flashes (+ one blue sometimes). There is never any output, nor any charging current at input. The cells were only partially charged, and somewhat unbalanced; I rebalanced them and charged up fully. A partial discharge test showed cells to be still good.I disembowelled a second, bigger 7S 3.6Ah (picture), after some serious spudger work. Somewhat different BMS pcb, no reed relay or other switch here. The control chip can be read under powerful light, and is BQ76930. Seems cell equalizer is fitted and works, all seven cells showed 4.065V exactly. There is no output or input, and no led blink at all. Sad.If forum wisdom cannot crack this, I hope to simply replace the entire BMS by a generic unit, and recover the high value battery. What issues in selecting?Do chip in if you will, please. Thank you all.

author: SilverSolder
author_rank: Super Contributor
timestamp: October 07, 2021, 01:46:47 pm
content: This thread has reinforced my conviction that corded appliances still have a place in my life!

author: scootley
author_rank: Contributor
timestamp: December 14, 2021, 03:03:07 am
content: (Hopefully this isn't too off topic for this thread. Will re-post in a new thread if so)There is a video online (see below) showing the process (for a model DC30 vac) of removing the factory cells from the battery and soldering on some common RC-style lipo battery connectors (one for power and one for balancing), and then using such a commonly available battery, as long as (presumably) it has the same number of cells (in series) and same nominal voltage per cell. I wouldn't think the cell physical size (18650 vs 21700, etc) or capacity in MAH matters too much, right?And as far as I can see, the Dyson stock charger would work too, right? The video creator seems tosay in commentsthat he doesn't use it because his other charger is faster.This seems to be a great option to avoid things like:1) Having to pay for expensive Dyson OEM batteries2) The fact that Dyson OEM batteries are discontinued X years after the vac is3) Dealing with low quality BMS circuits in cheap replacement batteries4) Dealing with low quality cells in cheap replacement batteries (since it seems easy to find high quality versions of these RC batteries)5) Making it very easy to replace the battery without any spot welding, etcAnything critical related to safety or functionality that I am overlooking? I'm assuming the Dyson BMS will handle all of its regular functionality with such a battery pack attached as if those cells were just like the originals and spot welded to the nickel tabs. Maybe just need to pick a pack that can handle the same sustained amperage, but I believe that most can and I suppose one could guess based on the C rating. And choose connectors/wires with the correct amp rating.I also see a there's anadapter for a Makita tool battery to fit it to Dyson V6, but obviously this won't charge the battery and I have a feeling that it does not appropriately handle low-voltage protection.They don't make one for V7, which is what I have.Edit: One issue may be that I believe the stock battery has a temperature sensor and it may be a bit tricky to get that positioned well with the lipo pack. Or perhaps it could be eliminated, but that probably carries some risk.Edit 2: Oh and there is a reed switch in the stock battery, right? Probably should be easy to deal with.

author: najrao
author_rank: Regular Contributor
timestamp: December 14, 2021, 04:51:30 am
content: Very interesting, thanks.Later Dyson models have much more difficult bms's. They seem to lock up even with perfectly good original cells! I have checked on 13 batteries: only TWO had one or two bad cells, and the rest were all still perfectly usable, accepting the rated Ah of charge and discharge. I have even repurposed three of the 3600 mAh 25.2V, extricating the cell packs and throwing out the bms's! They now work on an APC 1000VA UPS.Another 21.6V 2.6Ah unit received a different bms, and powers an 18V cordless drill.I have only a V11 motor unit, which I have never once been able to run. None of the 13 batteries would fit ideally, so I have tried with bench power supplies, up to 30V, 25A. Apparently, pressing the trigger sends a codefromthe motor unittothe battery to wake it up. The battery thenenablesthe motor if it has enough charge. Not knowing this communication protocol, one can never power the motor.This is precisely where eevblog wise ones can help!.

author: SilverSolder
author_rank: Super Contributor
timestamp: December 15, 2021, 08:45:24 pm
content: Killing the environment with disposable, self bricking products... that's what some manufacturers make a good living from. The authorities should really be more on the ball about this kind of thing....

author: NiHaoMike
author_rank: Super Contributor
timestamp: December 16, 2021, 01:58:58 am
content: The mod I did to mine is to add more 18650s in parallel with the existing ones when the pack started getting weak. Now I have a cordless vacuum that rarely needs charging. What I would like to do next is 3D print an extension to the dust can so I don't have to empty it so often, but it looks to be quite a challenge to get it to fit right.

author: tinfever
author_rank: Regular Contributor
timestamp: December 18, 2021, 02:21:01 am
content: I left my Dyson V7 off the charger for a few weeks until I got around to cleaning it and I'm now the proud owner of a battery pack that only blinks red 32 times if you try to use it. I thought I might chime in on the fight to get the things working again. The cells in mine are slightly out of balance but all between 3.4-4.1V.After much digging (literally, through the potting compound), it appears that my 6-cell battery pack is run by what is probably a PIC16LF1847-I/MV microcontroller with a Renesas/Infineon ISL94208 battery management IC.Getting the whole thing desoldered was interesting and there were a few sparking incidents so now the fuse (F1) is blown. I just soldered a small piece of wire over the fuse for now. I've soldered pin headers to each of the terminals and then used a resistor divider network with 330R resistors to simulate the voltages as if the board were connected to a battery back (24V from bench PSU, 20V, 16V, 12V, 8V, 4V, GND). If I bring a magnet near the reed switch, with everything powered up, the red LED still blinks 32 times so I don't think the microcontroller knows it is a brain with no body.I doubt this is possible but it sure would be convenient if the four plated through holes to the right of the PIC (which I've populated with headers) were the debug/programmer pins for the PIC and Dyson forgot to prevent the firmware from being able to be dumped. Then, ideally, we could dump the firmware, change ENABLE_PLANNED_OBSOLENECE_TIMER from 1 to 0, and then anyone with this issue could reflash the PIC with fixed firmware by just poking through the potting compound in those header locations.Now that I think of it, I wonder how blatant the firmware is written as far as this planned obsolescence goes...

author: tinfever
author_rank: Regular Contributor
timestamp: December 19, 2021, 05:51:57 am
content: I'm pretty sure I've figured out the pinout of the headers and they contain all the correct pins for programming the PIC microcontroller. I bought a PicKit 3 to attempt to talk to it but haven't had much luck so far. I've just been trying to use the PicKit to power the device to read the memory and I'm only getting the error "Target Device ID (0x3fe0) is an Invalid Device ID. Please check your connections to the Target Device." which from reading only it sounds like that can mean almost anything. I thought I got it to work once where I saw a message like "Target PIC16LF1847 recognized" or something but haven't been able to reproduce that. It's entirely possible my connections are dodgy so I need to do some more testing. I'm seeing activity on the oscilloscope but I don't know if that's just the PicKit just sending commands or the MCU actually responding. I've confirmed the PicKit is providing 3.25V to the MCU which should power it. (For the record, I'm totally out of my depth on anything software related so I certainly wouldn't turn down some help.)I also think the 3.3V power for the MCU is coming from an internal regulator function on the ISL BMS IC which can apparently control a transistor to generate a regulated 3.3V output.I've attached the best board photos (bottom side is mirrored) I could take with an overlay of the small portion of the circuitry I've figured out, also including pinouts of the two ICs in question.

author: tinfever
author_rank: Regular Contributor
timestamp: December 19, 2021, 11:02:43 pm
content: I think I'm able to more reliably connect to the PIC MCU, although I'm not sure what's different now. I think the next step would be to figure out if the copy protection bits are set and try to read the memory. I'm able to click the "Read" button on MPLAB IPE and then it looks like it works, but any output I get seems pretty much empty. What's weird is that sometimes I get different results depending on exactly how I connect to the PIC. Sometimes I'll read the memory and look at the configuration bits window to see the copy protection bits are set to OFF, then I'll do something and read again and it's say they are set to on. Sometimes it also includes a message about the debug bit being set or something like that. I'm not really sure what's going on.I've attached some screenshots and the dumps I've gotten so far. I'm pretty sure the dumps are empty or worthless though.

author: SilverSolder
author_rank: Super Contributor
timestamp: December 20, 2021, 11:01:04 pm
content: Is it not possible to simply replace the battery management chip with a more generic version? Or does the battery communicate with the "mother ship"? (Be glad that we're not yet at the stage where the battery needs Internet access to work, you can be sure our children or grandchildren will be dealing with that...)

author: tinfever
author_rank: Regular Contributor
timestamp: December 21, 2021, 12:48:12 am
content: I already ordered a replacement BMS board from Aliexpress. At least on my V7 vacuum, the "communication" with the battery is very simple. When you pull the trigger on the vacuum, it moves a lever that actually physically pushes a button built in to the battery pack. When the button is pushed, if the reed switch is closed (indicating the battery is inside the vacuum), if the MCU is happy it presumably send a "go" command over I2C to the BMS IC and the BMS IC will then charge the gate of the discharge MOSFET to electrically connect the battery cells to the vacuum. I believe as long as the vacuum gets power, it doesn't care where it comes from, which is why there are people making/selling adapters for you to use Makita tool batteries on them.If I had more time, and if I'm unable to dump the existing firmware, it sounds like a fun project to make new firmware for the PIC to replace Dyson's. It probably only sounds fun and easy because I haven't done it before though...Edit: I've started a new thread in the Microcontroller category regarding dumping the firmware or at least confirming the read protection bits are definitely set:https://www.eevblog.com/forum/microcontrollers/pic-attempting-to-dump-firmware-on-pic16lf1847-from-dyson-battery/

author: dvd4me
author_rank: Regular Contributor
timestamp: December 22, 2021, 01:52:59 am
content: Hello,Is the ISL94208 battery manager used in other power hand tools? It must be using similar PIC control since the ISL94208 communication is via I2C.Maybe some I2C commands can be sent to ISL94208 to unlock the charge/discharge and detach the I2C bus from the PIC control.Maybe the pack can be rendered in a more " dumb" state, but still usable, not locked. Any thoughts?

author: dvd4me
author_rank: Regular Contributor
timestamp: December 23, 2021, 02:26:15 am
content: Quote from: tinfever on December 21, 2021, 12:48:12 amHello again, I replied also in the microcontroller thread, this guy Robin actually used the ISL94208 battery manager to build his own 6 cell pack ( sic) and used an atmega microcotroller for it. I just send him an email, maybe he want to help and contribute to this battery salvage project, since I see no chance you can actually read the original Dyson locked PIC to get the code and modify the lock flag.Imagine saving hundreds if not thousands of these batteries from being discarded. That would be great!

author: SilverSolder
author_rank: Super Contributor
timestamp: December 27, 2021, 03:10:26 pm
content: It would be awesome if a replacement board of some kind could be conjured up!Obviously it is a problem if the cells really are toast, though.... Are there good ways to test the cells to make sure there is enough life left in them to make it worth the bother to repurpose them like this?

author: Craftsman
author_rank: Newbie
timestamp: December 30, 2021, 11:08:13 pm
content: There are 'replacement' boards available on Aliexpress like this one -https://www.aliexpress.com/item/1005003640893416.html.You can even get the whole works except the batteries for a few bucks more -https://www.aliexpress.com/item/1005003742394449.html.

author: Craftsman
author_rank: Newbie
timestamp: December 30, 2021, 11:20:18 pm
content: Interesting thread. Thanks to everyone for their contributions.One thing I haven't seen mentioned which may be worth investigating is can we prevent a pack failure from happening in the first place so that we don't have to try to resurrect a 'dead' pack? From what I can see, all failed packs seem to have one thing in common - the individual cells fall out of balance. I don't know how in balanced they were when the pack was new but I would assume that they were a heck of a lot closer than what people have posted. A few have put forward theories on how the BMS reacts to cause a pack death - the voltage of the pack drops below X brings the pack closer to death. With the cells being drastically out of balance, it's possible that as the cells become more unbalanced, more low voltage situations happens until at some point a threshold is reached and the BMS decides that life is not worth living anymore.How about we intervene before the pack hits that point by regularly balancing out the charge on the individual cells manually BEFORE the pack is declared dead by the BMS? For example, we could balance a pack's cells annually, then in theory, the pack's counter may never advance. This is assuming, of course, that the pack's cells steady become more out of balance with each charge/discharge and on a pack that is still good (let's say a 1 year old pack) if we put the cells back into balance, we would be extending the life of the pack.I may be wrong, but prevention may be the only route here.

author: dvd4me
author_rank: Regular Contributor
timestamp: January 03, 2022, 05:44:40 am
content: Quote from: Craftsman on December 30, 2021, 11:20:18 pmHello Craftsman,I have locked the original V6 BMS by mistake, while trying to measure capacity directly on cells. I was running a couple of charge discharge cycles directly on the cells. Big mistake, charge/discharge must run thru the BMS. Edit: if the BMS is awake and not in deep sleep mode.I was lucky to find at Home Depot in the recycling box another V6 battery, just last Friday. I open-it and the first thing I checked, it was already charged, at around 4.0V each cell . Checked all the cells, a bit unbalanced. Run a discharge cycle until the BMS cuts the power off. The lowest battery was at 3.3V. ( EDIT: it stops at 3.1V and in my case it slowly recovers to 3.3V) I connected a cell balancing device, used for LI-PO's, and discharged all cells to the same 3.3v.Then charge with the charger and run a measured discharge cycle (in the picture it shows a V7 battery while testing the capacity, this V7 battery I found-it some time ago. I used-it to experiment how to re-balance and measure capacity after I locked the V6 BMS).The V6 battery I found last week now shows a decent 1650mAh, after balancing.I understood that the battery managing chip should be able to do balancing, maybe Dyson did not implemented the algorithm in the PIC that controls it...So as a prevention, I believe a 6S balancing header ( i only had a 3S header to solder on the cells) that can be pulled out of the case and connect every now and then to a balancing device.Also never try to balance by charging the weak cells, that's what kills the BMS, detecting battery voltage increase without charging. ( EDIT: I assume if the BMS is in deep sleep mode, it can be charged/balanced )I believe it's safe to discharge to 3.4V (EDIT: 3.2V or higher.)Never discharge lower than EDIT: 3.1V, I believe that is the threshold BMS stops the discharge by itself. Lower than that may trigger the BMS to lock.Now that I have ordered a 6S balance header I will find a way to pass the wires safely thru a hole in the battery case.I now have the locked BMS from the original battery to experiment on it. I also ordered the Ali BMS but I would prefer to re-program the PIC if possible to revive-it, similar with user tinfever was trying to do.Best,

author: Craftsman
author_rank: Newbie
timestamp: January 03, 2022, 11:49:36 pm
content: Thanks for the clarification about the BMS and charging.One thing of concern about discharging individual cells down to 3.4V might be that during the discharge, we might trip a trigger point of 3.3V on the BMS accidentally. A better alternative may be:1. charge the pack through the BMS until full;2. measure the voltage of each cell;3. discharge the cells down to the lowest cell provided that the lowest cell is not below 3.5V (just a bit of safety just in case). If it is below 3.5V, then discharge down to 3.5V;4. Start back at 1 until the pack is somewhat balanced.I realize that going down to 3.5V might take an extra cycle or two to get a balanced set of cells but we just don't what the PIC's criteria is for locking up so it's better safe than sorry.

author: najrao
author_rank: Regular Contributor
timestamp: January 04, 2022, 09:52:43 am
content: Quote from: tinfever on December 21, 2021, 12:48:12 amI have what I believe is a V11 "absolute" motor and cyclone unit (no model no. on item, but compared pictures). None of the umpteen discarded batteries with me seem to fit exactly on this. Given the source, I do not know for sure that my motor unit is free of defect, but it was all very clean inside.Connecting a (high enough current) dc supply to the power in terminals does not even turn on the display, but there is a current draw of some 30mA. The motor-to-battery communication port does put out an undecipherable sequence of signals, sighted on oscilloscope. Note also that the feed for the brush motor was open.I tried to trick it to wake up by feeding the motor's signal to another Dyson 25.2V battery, while still fed by other PSU. No prize offered for guessing: nothing happened. (This is perhaps a V10 battery, and has very good cells but its bms has the orange blink scourge).I might have shown that there is more to it than just the nefarious battery BMS. No conclusion just yet.

author: najrao
author_rank: Regular Contributor
timestamp: January 04, 2022, 11:41:57 am
content: As a side question, may I ask:Also have just the motor, of a V7? (may be V6), pictured. What connects to J5? It has 10 points to connect. Suspect it leads to a two-position switch on the top of the assembly, for selecting normal or boost, but I don't know such. If so, can anybody tell me the wiring of this?This motor also talks to the battery, via J8, just two pins.Powering up the screw terminals as is does nothing, except a small current draw.I have detached the board to reveal the back of it. There are four mosfets in a H bridge, and three 270uF bus caps; all test good in circuit. The shaft can be rotated against 'detents'. But I cannot run it at all.Nothing hangs on this, I am just very interested in seeing it in operation.

author: dvd4me
author_rank: Regular Contributor
timestamp: January 13, 2022, 01:25:11 am
content: Hello,I have some updates in this V6 saga, i received the Ali BMS and install-it and tested. It's much less of a headache than to update the PIC program.OK, so in the pics you see the cells after removing the Dyson BMS, I managed to break one of original thermistor leg, so I had to take-it out completely.Ali BMS thermistor has the same 10kohm value as in the Dyson bms so it can be reused in case it comes intact.It is glued in epoxy between 2 batteries, so do NOT insert a metal object. I just melted the plastic around-it until it came out by gentle prying.The new Ali BMS fits almost perfect, a little file to trim the positive and negative contact blades, to make them fit in the holes. I also kept the original charging plug since it's so hard to remove-it. Just re-solder the wires to the BMS.Before installing the BMS I balanced the cells and discharged them all to 3.2V, just in case I make a short. And I did, while removing the 2 adjacent battery wires, a tiny spark while touching the screwdriver to both terminals, since the battery was so weak, nothing happened.To do the balancing, I bought the 6S nice silicon balance header on amazon, it was really helpful.Put some thermal compound in the older thermistor hole and adjust all the terminals to fit and voila! All is in place. Then soldered and testing.Dyson charger is a constant current PS, at 26V with no load. The regular current is around 700mA.The Ali BMS is charging up to 4.2V per cell which made me a bit worried, and then the discharge voltage is similar with Dyson, around 3.1V ( and not what I thought before 3.3V. It was 3.3 because the cells are recovering a bit of the voltage, you have to check-it right when it stops)Tested capacity was to an unexpected 1900mAh which I was amazed, remember, this was a wasted unbalanced red light battery.Ali BMS does not have a minimum current discharge of 2.3A like the Dyson one has, to keep the discharge port open.I discharged the Ali BMS with 1A current to measure the capacity. I used the paper clip to depress the grey button, simulating a real button press.I also had another Idea that came to me from the instructions I read for the ISL94208 battery management IC, particularly the sleep timer. This is weird, as I never thought about it before. You'll see in another post.

author: dvd4me
author_rank: Regular Contributor
timestamp: January 27, 2022, 03:17:03 am
content: Hello again,I finally got my second ordered Ali BMS, this is based on another chip, MC95FG208 microcontroller, basically a 8051 architecture that communicates via I2C protocol. I believe some buyer bought a blank version since his BMS was not doing anything. I intend to install this into a totally rebuild V6 battery where the cells were dead and I did the mistake to try to charge the pack before checking the cells, the original BMS locked up on the red light error right away.I took the cells from a Dewalt battery pack that was thrown in recycling with 2 cells off ( gas protection was triggered) The rest of the cells were ok so I took 6 to put them in the pack. I need to spot solder them using the same original terminals and test the BMS. I hope to do this in the next weekend.Then I can test the BMS battery management and see how it works. I will keep this posted after.

author: cnt
author_rank: Contributor
timestamp: January 28, 2022, 04:23:04 am
content: Thanks for this timely thread update! I just discovered the self-bricking capability of the dyson BMS PCB my self after installing 6 nice new cells. I've ordered my Chinese PCB replacement. Here's hoping it works and I don't set my house on fire

author: Craftsman
author_rank: Newbie
timestamp: February 02, 2022, 01:09:58 am
content: Quote from: cnt on January 28, 2022, 04:23:04 amI would charge it the first time outside without the case and use a no-touch infrared thermometer to see how hot the cells get while charging and to verify that the BMS is actually working!

author: tinfever
author_rank: Regular Contributor
timestamp: February 03, 2022, 05:31:40 am
content: Sorry for going AWOL. This project has finally made it's way to the top of my priority list so I've picked it up again and am continuing the reverse engineering of the original BMS board.In my fumbling effort to dump the firmware, I think I probably hit the wrong button in MPLAB and erased the microcontroller. I went as far as looking at the ICSP communications with a logic analyzer and the PIC on mine is definitely just full of all 1's. I noticed that in either MPLAB IDE or IPE, when looking at the configuration bits, there is a button that says something like "Read Configuration Bits" but under some circumstances it'll be replaced with a button with a very similar icon that hovering the mouse over indicates is now "Set Configuration Bits". I probably clicked this, the programmer tried to set the configuration bits, tried to turn off the code protect bit I'm assuming was present, and turning off this bit automatically wipes the PIC.I'm guessing the PIC was probably code protected anyways so this probably isn't a huge loss, but it does mean if I want to proceed with reviving this thing, I'll need to write new firmware for it. That should be interesting because I've never done that before.Thus, I've been attempting to reverse engineer the original BMS board as much as possible. I think I've probably got about 75% of it so far. I've attached an image showing the connections I've mapped out (Make sure to right-click and "Open image in new tab"). Please excuse the spaghetti wiring lines and poor color choice. I never was very good at arts and crafts. This image is only really useful if you want to trace something out because it's too messy to get much info out at a glance.Next step is to recreate the schematic in KiCad which should make it much easier to read.My question for all of you is: Does anyone know what the two IC's in nearly the exact center of the board could be? The whole arrangement with the capacitors just seems...weird.I've attached several photos of the ICs and the area, plus the schematic for what I've mapped out of it. I can see it gets a connection from the P4 battery cell to pin 7 of the lower IC (U4) and also a connection from the P7 battery cell to pin 6 of the same IC. Then pin 8 of the upper IC goes off to a diode over near the ISL94208.

author: tinfever
author_rank: Regular Contributor
timestamp: February 05, 2022, 02:31:45 am
content: An update on the mystery ICs:I've traced out what is probably the entire circuit for the two mystery ICs and I believe they are probably over-voltage charging protection ICs for the battery cells. I've attached a section of the schematic (work in progress) showing how all the battery cells have connections to these ICs and the only output appears to be to a PFET being used to control one of the NFETs in the charging path.For any future Google searchers, the IC appears to be a DFN-8 2mm x 2mm and has markings "BX 8LB" or possibly "EX 8LB" although I'm leaning towards the former.I still don't know what the exact IC is but something pretty close would be a Nisshinbo Micro Devices R5439K "2 to 4 Serial Cell Li-Ion or Li-Polymer Battery Protection IC for Secondary Protection". I've attached a copy of the datasheet and a snippet of the typical application and pinout.I'm not 100% sure this is the correct IC for a few reasons but the biggest is probably that the circuit would be relying on the mystery IC pin 8 to sink current to pull down the PFET gate which would then pull up the NFET gate and enabling charging. Pin 8 on the R5439K is a voltage regulator output pin which it seems like would be high most of the time unless the R5439K went in to SHUTDOWN2 mode when the voltage gets really low, which isn't what we want...I think. It doesn't seem like Pin 8 is designed to sink current so it'd be pretty odd to use it that way.If anyone knows what the IC actually is from the marking codes, I'd love to know.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 08, 2022, 01:22:50 am
content: Welcome back tinfever, happy to see you started with fresh ideas.While waiting for some new development I already replaced one of the red flashing Dyson BMS with an Ali BMS. it seems to work fine.I have another older version of V6 BMS that does not have the protective silicone coating, maybe the code is not protected.. ( by the coating..).I ordered a PicKit 3 on Ali. How I'm going to use that to try to read the Pic controller? I see you put some pins on your PCB.Maybe a short description of that would help, I do not feel reading a ton of documentation... What to install and how to connect to BMS. Let's do some BMS talk... Or at least try to.Second, have you seen the code posted on the ISL94208 project by the other contributor, maybe once you figure out the schematic it can help you out.Thanks

author: tinfever
author_rank: Regular Contributor
timestamp: February 08, 2022, 04:43:50 am
content: I'm happy to report I have the schematic 99% reverse engineered. It isn't the cleaned schematic in the world but it'll do. Only the two sections inside the rectangles I'm not quite sure about.I'm also able to load my own programs on to the PIC and successfully blink the LEDs!The right rectangle section I need to do some more testing on. The case marking indicated that SOT-23 component was likely the dual zener I show there but that really doesn't make any sense. Also, it my testing it doesn't act like I'd expect. When supplying current from my bench PSU, to pins on that IC, very little (0.4 mA) current will flow from pin 1>3 but lots (8mA) will flow from pins 2>3. In normal operation the voltage on pin 1 is 3.3V as regulated by the Q2 and the ISL94208. The voltage on pin 2 seems to be averystable 2.5V. I almost wonder if it's some kind of shunt regulator or LDO but I still don't understand why it would be needed at all. I thought the zener made sense as a backup in case the Q2 regulation failed. For the record, it's the SOT-23 closest to the battery GND terminal on the PCB right above the PIC. It is labeled U3 and has a case marking of VAP3 or VAPJ I think. The fact that it is labelled U3 also indicates it could be something else.Edit: Doh! This is totally a 2.5V series voltage reference for the ADC on the PIC. Looks like a SOT-23 MCP1525. Marking VA matches and everything. Mystery solved!I also did some more testing of the previous mystery ICs and they are definitely overcharge protection ICs that cut off one of the charging MOSFETs if any battery cell voltage gets too high. This is probably a secondary protection to the primary control of the ISL94208.It also occurred to me that there must be some mechanism for charger detection because the PIC clearly must wake up when the charging is connected to enable charging. However, it has to be smart enough to not turn on the output power and turn on the vacuum when this happens. I'd previously been imagining that the PIC would always enable the output whenever the PIC was awake unless there was some fault condition but that can't be the case.I think I finally figured out why I was getting seemingly random failures to talk to the PIC too. There was a small spec of solder (probably as a result of my scraping and probing) that was between the two ICSPDAT and ICSPCLK pins on the IC. I scraped that away and it's been working like a charm. The PIC was definitely erased though, again probably my own doing.Quote from: dvd4me on February 08, 2022, 01:22:50 amHi dvd4me! I actually ordered one of the Aliexpress BMS boards but I'm too stubborn to do things the easy way and replace the whole BMS board. I always seem to do things the hard way hahaI have no idea about the V6 BMS boards but if it is a PIC microcontroller and Dyson was kind enough to leave empty PTH for the programming pins I'd recommend you:Get the datasheet for that specific PIC and figure out what pins are the ICSP pins. If it's like the V7 BMS board I'm working on, you'll need to identify VCC, GND, VPP, ICSPCLK, and ICSPDATThe V7 BMS board has empty PTH on all the programming pins so I soldered headers on to those for easy access. I'd suggest doing the same if you can.Connect the PICKit to the Dyson BMS board. The pins on the BMS board weren't in the same order as those on the PICKit so you have to be very careful to connect them in the right orderInstall MPLAB IDE and IPEOpen IPE and configure the PICKit to power the target. You might also want to enable low voltage programming modeTry to connect to the PIC and see if you can dump the memoryIt'd be interesting to see a dump of the memory but it's going to be a binary dump that someone would have to reverse engineer to make any sense of. I have no idea how hard that part will be since I haven't done it before.I glanced at the code from the ISL94208 project when the author made it available (if it was you who reached out to them, thanks!) but haven't looked at it much. Right now I'm just blinking the LEDs in fancy colors so once I get a little further in to the software I might look at it for some guidance.

author: Craftsman
author_rank: Newbie
timestamp: February 08, 2022, 11:44:13 pm
content: Dvd4me,I might have missed it but do you have a conclusion for rebalancing a still working but short run time pack - ie one that the BMS hasn't locked up on? Does the pack's performance improve once rebalanced?Thanks!

author: tinfever
author_rank: Regular Contributor
timestamp: February 09, 2022, 01:30:07 am
content: Well I think I might have figured out why the cells becoming imbalanced in these battery packs... I DON'T THINK DYSON IMPLEMENTED CELL BALANCINGNot only that, it looks like the purposely miswired it to prevent cell balancing from even being possible!According to the ISL94208 datasheet, "An internal FET between the CBN and the VCELL(N - 1) can be turned on to discharge CELLN more than other cells, or to shunt some of the charging current away from CELLN. This function is used to reduce the voltage on an individual cell relative to other cells in the pack."I just noticed on my schematic, and confirmed on the PCB, that CBN and VCELL(N - 1) are connected together for each cell. Meaning enabling the internal balancing FETs won't do anything and the pack can't be self-balanced!I'm showing and measuring the following pins as being shorted together:Pins 3-4 (CB6, VCELL5)Pins 5-6 (CB5, VCELL4)Pins 7-8 (CB4, VCELL3)Pins 9-10 (CB3, VCELL2)Pins 11-12 (CB2, VCELL1)Pins 14-15 (VCELL0, CB1)The only way I see cell balancing working is if those mystery ICs are handling that, but cell balancing through 5.1K resistors? I don't think that's happening.Could anyone confirm my findings? If this is correct, well it's just disgraceful...

author: dvd4me
author_rank: Regular Contributor
timestamp: February 09, 2022, 04:15:10 am
content: Quote from: Craftsman on February 08, 2022, 11:44:13 pmHello Craftman, in theory (measured on the cells) the charging stops at 4.2 high and 3.1V low. Obviously if cells are getting unbalanced it will stop charging as soon as one gets to 4.2V. There is less energy to put in and less to take out, while one cell goes low to 3.1 V it stops.Balancing it's vital to maximize capacity and it seems the original Dyson BMS has not even implement the balancing, otherwise BMS will not get the blinking lights after severe unbalancing.I run the balancing of a V7 pack just to measure the voltages of the charge/discharge limits of an original Dyson BMS. I do not have a vacuum for the V7 so no other use other than experimenting. Capacity measured thru BMS discharge is 2100Mah, not far from the 2800 maximum. I put some capacity measuring pictures in my other post.I must say it's fun to understand all these details about their technologies.To fix the problem I assume a balance connector can be passed thru a hole in the battery housing, to do a voltage measure and balancing every now and then.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 09, 2022, 04:38:51 am
content: Quote from: tinfever on February 09, 2022, 01:30:07 amHello tinfever, i cannot confirm because I do not want to remove the coating on my only V7 I have, in good working condition.The second V6 Ali BMS has a ton of transistors comparing to the first one I bought. Check the picture below. I believe it may have balancing.Also I put the picture of the first V6 BMS I replaced, the "naked" one. You can see it has the same PIC as the V7, thus maybe sharing the same code...I really appreciate your enthusiasm regarding all this, reminds me back on my younger times.I regularly check the recycling places to find new batteries, it's fun to study. In parallel with this, I am testing the process of reviving old or heavy discharged laptop batteries.I successfully brought back to live one that was around 2 V per cell, now it's charging just normally in the laptop, old shitty one, but charging...Dyson BMS lead me to that idea in the first place, so everything is connected.Many thanks to your hard work to pull out the schematics, I imagine the lack of balancing kind of disappointing. When I receive the Pickit maybe I can get to read the code.. Since there is no balancing it must be simple...A lot of protection for nothing...I am procrastinating to assemble the second pack out of Dewalt batteries, I discharged them to around 3.5 so I can assemble/spotweld them safely in case I make a short. They are very unbalanced so I can test if the second ALi BMS has that implemented. Take a look at the pcb, similar interface pins for the chip... so much to learn but so short time.

author: tinfever
author_rank: Regular Contributor
timestamp: February 09, 2022, 11:06:43 pm
content: Quote from: dvd4me on February 09, 2022, 04:38:51 amThanks for the kind words. That V6 BMS you showed looks extremely similar to my V7 BMS. I bet the programming pin out on the right matches mine. Keeping that the same would let the factories use the same programming header, assuming they don't just use a bed of nails with the bottom test points.I also just noticed that the V7 BMS you previously included photos of is slightly different to mine. It looks wider and the programming pin spacing is different, so the pin order could be different too.I tried to determine from your photos if the ISL94208 on your V6 or V7 BMS is wired for balancing but I just can't tell. If I had to guess, the V7 looks so similar to mine that it probably has the same non-balancing wiring as mine. The V6 has traces surrounding the ISL IC that look different enough that it could have balancing but I don't see any resistors around the battery connections that would be needed.It's sad because all they had to do was add 220 Ohm 1/10th Watt resistors (4.2V drop over 220R = 80mW) to each battery connection and run the extra traces to the ISL IC and they could have had a much longer lasting product. That would have cost them about 1.2 cents (USD) in total BOM cost...I see only a few reasons why they didn't do this:Their engineers are morons and they have no line of communication from customer feedback to engineering so they never fix this.They do this on purpose to sell more batteries. Environment and the customer be damned.Their engineers tried their hardest but they just couldn't fit it all on a four layer PCB with cell balancing, and management rejected the cost of increasing the layer count.Some poor engineer had a week to build this and no one had the time to implement the software for cell balancing.Even if they didn't have the time to implement cell balancing in the software, I feel like it takes more effort to design the circuit to not have the balancing resistors. It'd be a lot easier to just copy-paste the reference schematic and just not implement the software.In order to preserve my sanity, I'm going to assume option three happened and so no one is truly evil or incompetent. Not sure I believe that though.This really puts a damper on my hopes to release a firmware update that anyone could use to make their pack functional again and have it self balance like it should. I think I'll still forge ahead and try to at least make something to revive the battery packs but I can't fix their stupid wiring in software. I'll probably cut the traces and add balancing resistors to my own pack out of spite though.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 09, 2022, 11:51:51 pm
content: Everything is in the first page of the datasheet:QuoteSo no external fets needed for cell balancing.But it's specified that max. fet current is 200mA.RDS(on) is 5 Ohm typical (max 10), so limiting resistors are required.If CBn and VCELLn are connected together, it will overload the mosfets, so in that case balancing is either disabled by software, or the fets are handling the overcurrent like champs.Batteries warranty is usually very short, between 3 and 6 months, and I bet Dyson had a little (intentional) idea to make money faster.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 10, 2022, 12:30:32 am
content: Quote from: DavidAlfa on February 09, 2022, 11:51:51 pmI was about to answer to your first version on the post when you changed...Yes the chip can do the balancing, that's clear from the beginning but the Dyson implementation is not using it...Tinfever pcb has CB6 and VCELL5 connected, that means there is no way to put balancing resistors, the 2 Fet terminals are shorted together.The design on my naked V6 has those connection not tied up together and also traces to non-populated pads where the balancing resistors should be installed.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 10, 2022, 12:40:09 am
content: Quote from: tinfever on February 09, 2022, 11:06:43 pmHello tinfever, I just scrutinized the naked V6 and it has the CB N pins not tied up to the VCELL N-1 as your BMS has!Actually I see the traces leading to non populated pads , it makes easy to put some resistors there. So if any software is to be released, there is hope balancing can be done on the hardware, at least on some of the original Dyson pcb versions.In your case, once you cut the small trace looping to the VCELL and CB pins, thus opening the balancing FET for business, you can solder a tiny wire to the CB pin to a 200ohm resistor going to the other cell, to enable discharge/balancingI just spent some time to clean with paint striper the silicone and the lacquer coating on the both dyson boards. The silicon cleans nicely once the lacquer underneath softens.As you can see the older (originally naked) board has different layout. When I will receive the pickit I definitely want to try reading-it, the loose balancing pins may have some software bonus beside-it.Parts marking cleaned up also with the paint striper...

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 10, 2022, 04:06:02 am
content: Quote from: dvd4me on February 10, 2022, 12:30:32 amYep, sorry, I completely missread something, so I thought wtf... This dude read nothing of the datasheet?That's why I used RTFM at first.Almost instantly I detected the mistake...

author: dvd4me
author_rank: Regular Contributor
timestamp: February 11, 2022, 01:30:01 am
content: Quote from: tinfever on February 09, 2022, 11:06:43 pmHey tinfever, out of disgust upon realizing the 32 flash error was just planned obsolescence, I just made a new topic with that exact title, pointing out to the real heroes here, working towards fixing this.Maybe someone has already that PIC code, who knows, it's good to attract some attention and maybe help.I could live with manual balancing but at least the pack does not lock up. If the code can be improved towards implementing balancing, even better...It's like Free Brittny - free dyson batteries...Hope to see some good news as I hope to see my PicKit soon... I had some dreams about them forgetting to lock that V6 older "naked" board... Yeah, getting into that naked thing...Anyway, hope to see good things soon. Cheers

author: dvd4me
author_rank: Regular Contributor
timestamp: February 14, 2022, 05:06:07 pm
content: Hello again,I finally took the time to install the second Ali BMS, the one that looked " promising" in terms of balancing... well, it is not balancing.I spot welded a bunch of Dewalt recycled cells that i did not tested for capacity, just put them together.. as in the picture. I practiced my spot-welding techniques, next time I can do better.It's hard to clean the spot welding bumps from the previous use so I try to re-use some part of those welded tabs, they were so thick on the Dewalt implementation, hard to cut them off nicely.The Dewalt cells were unbalanced and I was just charging the new assembly to see if the BMS will do something about-it. Well, it did not...I was trying to use the Dyson original pack thermistor, nicely aligning the legs to fit the new ali BMS holes... just to notice after I had already installed that the BMS had 20k thermistor while the pack one is 10k.This 10k pack value will simulate on the ali BMS the "real " temperature as too high, maybe the BMS would stop. I had to pull out the thermistor epoxied in the pack and put back the ali BMS (20k) one.This version of the BMS goes quite low on the discharge state per cell, 2.9 V. I think it's ok, the cells recover a bit after the discharge process stops.After manually balancing all the cells, the tested capacity it's quite low, 1300mAh, the Dewalt cells were already sort of wasted. That was some work for nothing but I did not had other low ESR cells to use right now.I will look for better cells to change them next time.Cheers

author: tinfever
author_rank: Regular Contributor
timestamp: February 14, 2022, 08:14:35 pm
content: I've run in to some trouble with my V7 (I'm going to try to call it SV11 from now on since that is more technically accurate) BMS firmware development. I think I may have somehow damaged by SV11 BMS board I was using for testing. It is no longer regulating the 3.3V VCC rail normally produced by the ISL94208 and the Q2 NPN. I was only getting around 2.8-3V and the whole board was drawing like 40mA even when I had the PIC completely erased. It seemed like something was pulling way too much current on VCC causing that voltage to dip.Attempting to troubleshoot it, I determined there was a 16V drop across the 500 Ohm (Parallel 1k resistors) VCC input resistors going in to Q2. Under thermal imaging I saw the PIC getting warm, even after I erased it for testing. I cut the VCC traces to the PIC and the current dropped to about 20mA but still wasn't regulating. Oddly, the 2.5V voltage reference wasn't regulating either and was around 2V. I cut the trace between the voltage reference and the PIC and that helped a little with the current draw but I think I still had 15mA draw. Finally, I cut the trace between the RGO pin on the ISL94208 and the emitter of Q2 and that at least reduced the current draw to 1mA.I have no idea what's really wrong with my SV11 BMS board or what caused it (it's probably my fault though). I snagged a SV09 (V6) battery out of the recycling at a nearby Lowes hardware store, and I'm going to continue development with that. Since I've already 100% reverse engineered the schematic for the SV11 BMS, and the SV09 BMS is extremely similar, I'm hopeful I can write firmware that will work on the SV09 and SV11 BMS.Starting work on the SV09 BMS, I've 100% confirmed the firmware is code protected and cannot be read through normal methods. The EEPROM data is not protected but it's content meaning isn't immediately apparent. For posterity, I've uploaded the EEPROM data and a mostly empty hex dump from the PIC on the SV09 BMS.It occurs to me that since the imbalanced cell permanent lockout error is retained after complete power loss, it is almost certainly stored as a bit in the EEPROM which we can edit without disturbing the protected code memory. Since my SV09 BMS still seems to operate normally (i.e. isn't locked out), I'm going to purposely imbalance the pack, measure when it goes in to lock out mode, and then determine which EEPROM bits change. Then I'll either write back my old EEPROM data or just change those specific bits. This might allow someone to manually rebalance their pack and then just reset the lockout bit to make the pack fully functional again.To be continued...

author: dvd4me
author_rank: Regular Contributor
timestamp: February 14, 2022, 08:39:29 pm
content: Thanks tinfever!This is one great piece of information, I wish I had the pickit arrived so I can try to read the eeprom myself.Now i will probably have to put back the Dyson BMS i just took out, if there is a way of restoring the lock bit.I could read the unlocked eeprom data and do a compare with the one you have. I will try to do this with the V7 when I will receive the Pickit.I am happy you found the other V6 SV09 battery BMS, recycling it's such a treasure hunt.Maybe you can find one for your V7 SV11 to fix the broken one.Reversing the lock bit it's huge already... Curious to see how it will act, meaning if it needs to restart somehow, to make the bit change work.Keep up the excellent work!Thanks

author: tinfever
author_rank: Regular Contributor
timestamp: February 16, 2022, 12:03:19 am
content: Quote from: dvd4me onYesterdayat 08:39:29 pmWell I have good news and bad news.The good news is that I have a better understanding of the various imbalanced cell lockouts on the battery packs. It appears that the battery will operate normally up until there is ~250-300mV difference between the highest and lowest voltage cell. Once that level of imbalance is reached, the pack output will turn off and the BMS will blink the blue LED 10x times. However, this is only a temporary lockout. Once you connect the pack to the charger, even for just two seconds, it will reset that lockout. However, even if you leave the pack on the charger to become fully charged, the cell imbalance will remain. Thus, if you fully charge the pack and attempt to use it, even though the temporary imbalance lockout is cleared, it will quickly detect the cells are still imbalanced and turn off the output with the 10x blue blinks error.Since the 10x blue LED blinks error is only temporary and is cleared by putting the battery on the charger, if you rebalance the pack it will become fully operational again.Once the cells in the pack become even further imbalanced, whichshouldn'teasily be possible given the pack output will be disabled with the 10x blue LED flash code first, the pack will eventually go in to permanent lockout with the 32x red LED blink error. There is no way to reset this lockout even by manually rebalancing the pack at this point and putting it on the charger. The BMS will also not permit charging when the pack is in 32x red LED error lockout.At this point, having rebalanced all the cells but still having the pack locked out, I attempted to load my previous EEPROM dumps to try to clear the lockout.In my testing, I was entering the temporary imbalanced cell lockout under the following conditions:Min. Cell Voltage / Max. Cell Voltage / Delta / Test cell discharge conditions3.772 / 3.981 / 209mV / Cell 2 discharge until imbalance cutout, then full pack charged to completion.3.932 / 4.154 / 222mV / 1A 3.8V CC+CV discharge on cell 2 until imbalance cutout3.881 / 4.125 / 244mV / 1A 3.8V CC+CV discharge on cell 23.845 / 4.109 / 264mV / 250mA 3.8V CC+CV discharge on cell 23.815 / 4.097 / 282mV / 100mA 3.8V CC+CV discharge on cell 2The above was me manually discharging just one cell at a set current until the pack went in to temporary lockout, briefly placing the pack on the charger to clear the lockout, and then making sure the output would still briefly turn on to make sure it wasn't permanently locked out. I would then reduce the discharge current on the single cell and discharge it further.I finally reached permanent lockout mode with the following conditions:Min. Cell Voltage / Max. Cell Voltage / Delta / Test cell discharge conditions3.705 / 4.100 / 395mV / 1A 3.7V CC+CV discharge on cell 2, stopping at 100mA discharge currentThus we reach the bad news:The MPLAB IPE is stupid or at least unintuitive. I don't think I had the settings configured correctly and MPLAB IPE automatically wiped by PIC when I attempted to load the EEPROM data. Since the program memory was protected, it was not possible to backup and thus I cannot do any further testing on clearing the permanent lockout using the factory firmware.In order to attempt programming the EEPROM without affecting the program memory or anything else, I went in to the Memory tab in IPE, changed "Auto select memories and ranges" to Manual, and unchecked the boxes for Configuration Memory, ID, and Program Memory, leaving only EEPROM checked.However, when I went to program the EEPROM data, I received the following output:Code:Connecting to MPLAB PICkit 3...Currently loaded firmware on PICkit 3Firmware Suite Version.....01.56.09Firmware type..............Enhanced MidrangeTarget voltage detectedTarget device PIC16LF1847 found.Device Revision ID = 32022-02-15 15:52:33 -0700 - Programming...Device Erased...Programming...The following memory area(s) will be programmed:EEData memoryProgramming/Verify complete2022-02-15 15:52:40 -0700 - Programming completeSo it programmed just the EEPROM as requested, but only after erasing the whole chip...Looking that the settings options further, I see there are checkboxes for "Preserve Program Memory" and "Preserve ID Memory" that sound like could have prevented this. In hindsight I should have tested altering the EEPROM while leaving protected code untouched on my SV11(V7) BMS I've been programming first to make sure my settings were correct.I've bought a few broken V6 and V7 battery packs that are being shipped so I might be able to come back to this in the future.Addendum on the BMS charging algorithm:As you may have mentioned in a previous post, the OEM charger is 26.1V at like 700mA. The BMS will permit you to charge the pack at almost any current if you don't break the charging over-current protection limit I assume is present. I tested charging up to 1A with no problems. When a charger is attached, the blue LED will turn on solid. Once any cell in the pack reaches 4.2V, the BMS will disable charging by opening one of the charging MOSFETs and blocking all current. After 70 seconds, charging will be enabled again until, once again, any cell reaches 4.2V. This process of charging pulses spaced 70 seconds apart (from the start of one pulse to the start of the next pulse) will repeat with the pulses getting shorter as it takes less and less time to reach 4.2V on any cell. Eventually, under some criteria I have not determined (but probably based on the voltage difference between the highest cell and the target 4.2V measured after 70 seconds with charging disabled), the pack will decide it is done and disable charging. All LEDs will now be off. Removing the charger and attaching it again will restart this process.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 16, 2022, 03:54:11 am
content: Quote from: tinfever on February 16, 2022, 12:03:19 amHello tinfever, amazing job you did, on the good side your hard work it brings things closer and closer. I am pleasantly surprised you found the lockout algorithm, others can benefit and fix the balancing before putting the pack to charge.It really sucks the MPLAB IPE settings are not very clear and there is only one chance of doing this, since the PIC accepts a full erase with no problem but no reading...I hope the batteries you bought used are not the clones, those seems to last even shorter due to bad cells.I know that being stubborn to find the solution, most of times pays off, as a sidetrack I just finished fixing a dead HP Pavilion 23xi display monitor found many months ago that was behaving strange... No wonder it was thrown away, other seems to have similar issues with this model. I bought the main chip and change-it, reprogram the Winbond 25x4 serial flash chip, changed the oscillator crystal... the monitor was not booting up... Just playing dead. I start to look around the resistors connected to the Winbond chip, one was bad, a 10k one was just open and the pin 7 - HOLD, the pin was floating low, chip was always going on HOLD because of that, no data, so much work just for a stupid resistor... R54, circled. I leave this here in case someone googles for this issue on the HP 23xi series.I took this work as a chance to practice my fine pitch soldering and the serial flash chip reprogramming, it was a while since I had not done this. I put the picture just for show off, my fine pitch manual soldering skills...Back to our subject, I hope you will receive your batteries soon to test the settings for lock bit re-programming. Meanwhile can you just load some garbage into the pic program area, set the read protect bit and then try to alter the eerom map and see if the program data is getting intact?Since your chip is still working please try to find the exact settings of the MPLAb IPE so I will not erase mine when I will try to restore the lock bit.Cheers

author: SilverSolder
author_rank: Super Contributor
timestamp: February 16, 2022, 04:53:34 pm
content: Nice work - it would be amazing if it turns out to be possible to re-program the BCM, or update its EEPROM values!Maybe the engineers at Dyson thought they'd leave a door open for someone willing to try hard enough, LOL

author: dvd4me
author_rank: Regular Contributor
timestamp: February 18, 2022, 03:57:38 am
content: Quote from: tinfever on February 16, 2022, 12:03:19 amHello tinfever, I was wondering, on the picture of the V6 interface i put below, can you please identify the signals that go to PICkit so I do not do any mistake, since yours died off prematurely.I know you mentioned them in the past in another post but now you connected to a V6 so there is no other mapping different than mine. Makes me feel more confident I know what I am doing.I finally bought a PICkit 2 out of amazon to try this weekend to read the thing. The one I ordered from Ali takes longer than expected, I was too curious and just bought one that will come Saturday.Maybe others have already tried but there is silence here... at least for the moment.Thanks

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 18, 2022, 06:50:31 am
content: Take the DMM and find these connections, takes a minute

author: dvd4me
author_rank: Regular Contributor
timestamp: February 18, 2022, 04:08:52 pm
content: Quote from: DavidAlfa on February 18, 2022, 06:50:31 amHello DavidAlfa, thank you for the schematic, it's very helpful actually since I had not much clue on what PICkit header pin I have to pair to which PIC16lf1847.Having your picture in front of me I will certainly help me find the right pinheader on the PCB much faster. Looking forward for the amazon delivery, it looks like it's going to be today, cannot wait to get back home.Tinfever already gave some details about the software, I hope I will get the settings right.Cheers

author: tinfever
author_rank: Regular Contributor
timestamp: February 18, 2022, 07:18:34 pm
content: Quote from: dvd4me on February 18, 2022, 04:08:52 pmI've essentially completed the reverse engineering of the SV09 V6 BMS board. I've attached a copy of the schematic, as well as an image showing the connections on the physical board (if anyone is desperate enough to want to see through the mess). The programming pinout is in the upper-right on the schematic, although it is upside down compared to your photo.I've also done some more testing on how to program the EEPROM without wiping the protected program memory. It appears this is not possible with the latest MPLABX IPE tool with any combination of settings I've tried. BUT, it is possible with the older PicKit 3 programmer software. This is "PICkit 3 Programmer App and Scripting Tool v3.10" which you can download here:https://www.microchip.com/en-us/tools-resources/archives/mplab-ecosystem. You'll probably still need the latest MPLABX for other things though.Here is the process to (I think) program the EEPROM without wiping the protected program memory:Install and start the PicKit 3 program linked previouslyDownload the bootloader when prompted (if needed)Connect and read the PIC to make sure things are working right. If you have removed the BMS board from the battery pack, you'll need to configure the PICKit 3 program to provide 3.3V power to the target to power the PIC.To attempt to load my EEPROM dump of a working PIC, go to File > Import Hex, and select the hex dump I've attached. It's empty for all the program memory but it still contains the EEPROM data.UNCHECK the "Enabled" box under Program Memory. Leave the "Enabled" box checked for EEPROM data (which should now some actual data from the imported hex file.)Click "Write" and hope for the bestEdit: if anyone knows what U6 could be, I'm all ears. It is a SOT23-5 (I think), 5-pins, with the markings "AATJ". It's got me stumped.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 19, 2022, 08:41:34 pm
content: Quote from: tinfever on February 18, 2022, 07:18:34 pmHello tinfever,I have run into some issues, I received the Pickit 2 and used with the pikkit2 app, see the picture. Problem is that I cannot find the right device - 16lf1847 and i tried couple of them.I cannot find any dropdown menu that gives me that device to select.While selecting random chips, the voltage was going from 3.3 to 5 v by itself.. forgot to turn off the target vdd. This is because i am working on the board that I pulled out so I have to put power.I can still read the chip, that means the 5V was not killing-it yet. Even in this case, it gets the read protection bits and the device model I chose does not have the EEprom data availble.Edit: loaded MPLAB IDE 8.92 to be able to use pickit 2 and I can find the chip there but if I select it does not work with PICkit 2.So I have to wait for the PICkit 3 to arrive, I could have bought the PICkit 3 in the first place but something made me thought let's have both... crapy logic, we'll see.

author: tinfever
author_rank: Regular Contributor
timestamp: February 19, 2022, 09:05:11 pm
content: Quote from: dvd4me on February 19, 2022, 08:41:34 pmAre you using a PicKit2 or 3? I can only speak for my PicKit 3, so I'd first make sure the PicKit 2 supports this PIC. You'll have to do some Googling to find the supported part document from Microchip.Also, you may need to pick the correct device family inside the program. I believe this 16LF1847 is in the midrange 1.8V family.I'd also suggest installing MPLABX and seeing if you get different results with the IPE included with that. I've at least seen the MPLABX IPE is pretty good at auto detecting the chip correctly.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 19, 2022, 09:34:04 pm
content: Hello again,Thanks for the reply, it's not supported by PICkit 2, so I will have to wait until I receive the ali one 16$CAN compare to min 30$ on amazonn.Question, is the one you have able to go from MPLAB mode and standalone mode ok?I mean, it's no problem to load on yours the original microchip FW and also converted back to MPlab mode.I just want to make sure my clone will be usable in both modes, before I do something to ruin-it.The PICkit 2 I have since yesterday did not gave me any error messages, with all the MPLAB versions, it seems to be always detected and works fine to generate power to the PIC chip, I verified.It really itches me to buy the ceapest kit3 from amazonn with tomorrow delivery, but it's too much money spent on this project. Better wait a little bit.Also today I had a chance to use the microchip software and get familiarized - never used before.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 19, 2022, 11:30:42 pm
content: With mplab X IDE / IPE you don't need to switch pickit 3 mode.IPE provides a similar standalone tool experience.

author: tinfever
author_rank: Regular Contributor
timestamp: February 20, 2022, 03:37:34 am
content: Quote from: dvd4me on February 19, 2022, 09:34:04 pmI've had no issues switching between PicKit 3 mode and MPLAB mode. I wish I could just stay in MPLAB mode but I haven't found a setting combo that lets you write to the EEPROM on a PIC with the CP bit set, without it automatically wiping the program memory. You can do that from the PicKit 3 program tool though.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 20, 2022, 08:25:54 am
content: That's part of the security.If you wipe the CP bits, internal erase is automatically triggered.Otherwise it would be plain easy to unprotect them.Although probably there's some glitch hack, ex. Removing power 10us after clearing the CP bit, you might be able to prevent the erasing.Anyways that would require a lot of testing and sending the CP sequence using a mcu, not the pickit.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 21, 2022, 03:56:57 am
content: Quote from: tinfever on February 18, 2022, 07:18:34 pmHello tinfever,I got the PICkit 3 and read the chip, without battery, just powered by the PICkit. looking at the eeprom values I saw mine was V15 while yours is V11.Then try to read just the eeprom, couple of times, some values are keep changing after each read, like a timer of some sort.Did you took a reading after you have locked-it with the 32 red lights?Comparing different versions may not be relevant, I do not want to try right now to write, until I understand a bit more.Since you had the working values and I hope you have the locked values too, would you mind first comparing those?I see a lot of differences between your values and mine, thus the hesitation to just write your hex file.From the datasheet page it seems that if we can read the eeprom then it is not protected, I am getting confident we can alter just the eeprom data, as you said."The entire data EEPROM is protected from external reads and writes by the CPD bit. When CPD = 0, external reads and writes of data EEPROM are inhibited.The CPU can continue to read and write data EEPROM regardless of the protection bit settings."I have to figure out what is the bit to change.Thanks

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 21, 2022, 11:47:51 pm
content: Strange... My eeprom area reads all 0s when CP /CPD bits are set!

author: dvd4me
author_rank: Regular Contributor
timestamp: February 22, 2022, 01:01:16 am
content: Quote from: DavidAlfa on February 21, 2022, 11:47:51 pmHello DavidAlfa,CP and CPD have different bits in 16LF1847, I spent a lot of time at work to read some of that datasheet.Luckily the dyson one has not enabled the CPD bit, meaning we can write eeprom directly.I just did the overwrite directly in the PICkit app, in the bottom window, overwriting the existing locations of the eeprom data.I just wrote "here I am" - 48 65 72 65 20 49 20 61 6D - in the first row and after reading the pic again, it's there, the same data...I wish I know what I am doing...but I accomplished writing the eeprom like that...What bit to change, I do not know, I have to try them one by one? No idea what that unlocked bit should be...Here tinfever could have been of great help with both of the hex dumps before lock and after lock, so we can compare what changed, in which location.Imagine, I just type there 00 or FF click write and bang, the bms is back to work.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 22, 2022, 08:46:12 am
content: Another posibility:Probably the Pic isn't supossed to reset during the whole battery lifetime, so who knows what's happening inside when doing so, the pickit resets it during reading.It might initialize some new data in the EEPROM ...Now you changed something, maybe it broke some kind of checksum, locking it, that's why it no longer changes?Try filling it with FF, that's what a virgin EEPROM reads.Anyways, there're also programable (non-volatile) user flags in the ISL94208 controller, it could use them to prevent hard resetting like this.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 23, 2022, 01:23:37 am
content: Well...It's almost there! I applied around 3.7 V per cell ( using the resistor divider ) and programming different eeprom locations. I begin to think I got-it right.I just need to piggyback-it on another battery so I can plug the charger and see how it's doing.Then I can see further if everything goes as planned.While the lock is off, remove and re-apply the power does not lock-it back. I believe that if the PIC has no power it will not do the cells check.It has to be powered ( awake by the other chip) to perform checks.I messed up completely the eeprom so I have to start over by restoring the older values, start to modify one by one, so I know which ones are important.Great tool the PICkit 3 app, I just write something in the eeprom map and hit the write button, then click the Dyson BMS switch and see what color the light comes on.Imagine my jaw dropping when at one point after clicking the switch the light came on blue... holly s*it, it's happening...Edit: charging it seems to work, blue light turns on steady blue.Keep you posted.

author: tinfever
author_rank: Regular Contributor
timestamp: February 23, 2022, 07:37:23 pm
content: Hi dvd4me, sorry for the delay. I've attached a copy of what I believe was my dump of the SV09 V6 EEPROM while it was in the 32 red blinks state. Unfortunately while I was working on that board, I tried to solder wires on to the I2C connections, accidentally broke off the resistors, and then after soldering on new pull-up resistors, I think the heat or something caused damage to the ISL94208 since, again it is no longer regulating 3.3V.I think started work on a second SV04 V6 battery (essentially identical to SV09) and in the process of soldering on the programming headers, I saw a spark and now the ISL94208 seems to have a short to GND on the 3.3V line. I'm getting the impression that the 3.3V regulation section on the ISL94208 is very fragile. I'm not sure if the flux I was using caused a short or what exactly happened since the spark seemed to be near the PIC, not the ISL. Working on a powered circuit board probably doesn't help either. Most of these issues seem to occur after I'm soldering on the board for some reason.Anyways, I'm on a third SV04 now and am now being extremely careful with them. I've got the headers soldered on and am in the process of charging it up so I can then cause an imbalance and cause the 32x red blinks issue. Then I'll see if I can load an earlier copy of the EEPROM and unlock it.FYI, the charging overcurrent protection seems to kick in around 1.4A. It will stop charging and will give 8 yellow (I think) LED blinks. Disconnecting the charger and reconnecting it at a lower current works fine so this doesn't appear to cause permanent lockout.Edit: the PIC is powered automatically by the 3.3V regulated from the ISL94208 controlling a transistor. As soon as the ISL94208 wakes up when you *release* the button, it will power up the PIC. The PIC is definitely designed to lose power. Normally the 3.3V rail will remain until you repress the button (pulling the trigger on the vacuum actually releases the button from being pressed) but if it detects no load or an error condition it will turn it off after a certain timeout I think.

author: tinfever
author_rank: Regular Contributor
timestamp: February 24, 2022, 01:48:33 am
content: Woo! I can confirm that I was able to bring a locked out battery back to life by reloading it with old EEPROM data!Here's what I did to create the 32x red LED flashes error and then recover from it:Started with a SV04 battery that was sold as not working, which I have lovingly named SV04 Unit 3. The battery initially presented the 10x blue LED flashes error and would not discharge. As usual, connecting the battery to the charger cleared this error and the battery seemed to function normally. All cells were very closely balanced to start with, with a delta of 40mV and a range of 4.0131V to 4.0531V. I'm still not entirely sure why this battery was sold as not working.The battery pack wasn't fully charged to start with but I discharged it until the BMS cutout with cell voltages between 3.4-3.5V (I should have noted the actual cell voltages). Pack voltage at the end was 20.97V. Capacity discharged was 1160mAhI then charged the pack to completion when the BMS turned off charging. Pack voltage was 24.858V with a min-max cell delta of 38.3mV. Cell range was 4.1654V to 4.1271V. Before doing anything else with the pack, I dumped the entire PIC including EEPROM and program memory (all zeros on program memory due to CP bit. CPD bit was not set.)The battery pack was then discharged with 1A drawn from cell 2, and simultaneously 50mA from the entire pack so I could monitor when the BMS cut out due to cell imbalance. This ended when the BMS cut out with the 10x blue LED flashes error. Pack voltage was 24.555V with a min-max cell delta of 199.5mV. Cell range was 4.1435V to 3.9440VThe error was cleared by placing the pack briefing on the charger. Discharging was then continued with 50mA from the entire pack and simultaneously 500mA from cell 2. This ended when the BMS cut out again with the 10x blue LED flashes error. Pack voltage was 24.464V with a min-max delta of 243.7mV. Cell range was 4.1356V to 3.8919VI then continued discharging just cell 2 in CC+CV mode with a max current of 1A and a target voltage of 3.80V. Discharging was stopped at 67mA discharge current @ 3.8V. Pack voltage was 24.388V with a min-max delta of 318.4mV. Cell range was 4.1354V to 3.8170V. I immediate placed the pack on the charger without pressing the button and I received what I believe was a solid yellow or red light that stayed lit for a few seconds and went out. The pack would not charge at all and from that point didn't respond to the charger. Removing the charger and pressing the button presented the 32x red LED light error code which could not be cleared.The battery pack was then rebalanced by charging cell 2 in CC+CV mode up to a target 4.13V. Current limit of 1A and charging stopped at 100mA. Pack voltage was 24.682V with a min-max delta of 37.7mV. Cell range was 4.1354V to 4.0977V (Cell 2 wasn't the lowest but was 4.1120V)Connecting the charger again still produced no response and pressing the button without the charger still produced the 32x red LED flashes error. Thus, the BMS was permanently locked out despite the cells being rebalanced. I made a complete dump of the PIC at this point as well.I connected the BMS to the PicKit 3 and using the old standalone programmer software v3.10, I imported the hex dump from step 3, unchecked the box for programming program memory so it would only program the EEPROM and clicked program.The battery pack immediately changed to a solid blue LED until it did the green or yellow flash and turned off due to no load, as usual. It worked! I just did a complete discharge of the pack at 3A until the BMS cut out at the discharge limit. Pack voltage at the end was 20.640V with a min-max delta of 178.4mV. Cell range was 3.4981V to 3.3197V. It appears one of the cells is weaker than the others because they were all around 3.45V-3.5V except for cell 1 at 3.3197V. The discharged capacity was 1395mAh, so perhaps this battery was disposed of due to reduced capacity. It has 66.4% of the rated 2100mAh capacity. Either way, it works!I've attached both the initial working PIC dump and the PIC dump after entering 32x red LED flash lockout.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 24, 2022, 03:38:28 am
content: Quote from: tinfever on February 24, 2022, 01:48:33 amHey tinfever, congrats! I have accomplished also unlocking on the trials from yesterday and today I just finished making a video about the whole process, while recovering the last V6 (SV03), never touched, locked battery pack.I am not sure if restoring the same unlocked hex file to all the packs will work. They are so different. It may not work.I found by many trials the 2 eeprom data locations that need to be changed, and the pack will unlock.I unlocked all the 3 original BMS that I had, including the last SV03 I had, untouched one. Just writing those 2 locations and not the whole eeprom.Similar, for your V7, how do you know if the unlocked V6 data will work on the V7 version of the pcb?If you want to see the video I posted, it's here:Video description is pointing back to this thread, for others to see the complete details.Cheers

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 24, 2022, 06:48:24 am
content: Have you tried the simplest method I said earlier?Just filling it with FFs, simulating an unprogrammed EEPROM.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 24, 2022, 02:50:22 pm
content: Quote from: DavidAlfa on February 24, 2022, 06:48:24 amHello DavidAlfa,No, since it would have lead me to nothing to try to enter 00 or FF in all those locations, too much work, since there are other values that needs to be put, not 00 or FF.I cannot edit the hex dump generated by the app directly to modify the eeprom data, maybe i have to use the MPLAB to export that, with the configuration bits, too complicated for me.I rather spend the time to alter specific locations and see the result directly in the PICkit app.The reason is that there might be some pack data I do not want to be lost, in case there is future development on this.I have seen locations that reflect each cell status, I assume there were intended for debug/fail analysis for the factory techs, when they had to analyse the warranty returns.Reading the pack statistics make sense to see what is going on. I rather let that be there, make the least invasive reset possible.I spend some time today to redirect here some of the obviously unanswered questions about the 32 red light flashes that I could found on some forums and youtube " fixing" videos.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 24, 2022, 03:00:10 pm
content: Normally you can select/copy/paste the hex values, also fill ranges.

author: tinfever
author_rank: Regular Contributor
timestamp: February 25, 2022, 02:52:07 am
content: Quote from: dvd4me on February 24, 2022, 03:38:28 amThat's awesome that you found the specific bytes in the EEPROM that need to be changed!That's way better than my method of just rewriting the entire EEPROM with a working published copy. You're right that I hadn't really considered EEPROM differences between versions. The hardware is nearly identical so I believe they can all run the same firmware, but if they have different firmware versions then they might be using the EEPROM differently.Quote from: DavidAlfa on February 24, 2022, 03:00:10 pmThe old PicKit 3 standalone programmer doesn't seem to let you copy and paste the EEPROM data. The only method I've found is to import a previously exported hex file dump of the entire device like I've published (which you could edit in a text editor if desired), and that will include the EEPROM data. Unfortunately the PICKit 3 standalone software is required because I don't believe there is a functional way in MPLABX IPE or IDE to program the EEPROM of a device with the CP bit set, but CPD bit clear, without erasing the program memory.I'm still going to try to make my own firmware for these. Maybe I can even add some features like an LED indicator that tells you how out of balance your cells are and doesn't go in to permanent lockout in the first place. I'm also planning on adding cell balancing routines, even if they won't work unless you add your own balancing resistors. Side note on adding your own balancing resistors, since Dyson used 1k resistors on the VCELLn lines, and the ISL balancing FETS short across CBn and VCELL(n-1), I think you could easily use 20 Ohm resistors for balancing, and possibly no resistors at all since the 1k resistors should limit the current. I haven't tested this though. This would mean balancing will be very slow with the 1k resistors already on the board though. I think it'll still work since these vacuums hang on the wall charging 99.9% of their life.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 25, 2022, 08:12:55 am
content: Why do you keep using such old and outdated utility?

author: tinfever
author_rank: Regular Contributor
timestamp: February 25, 2022, 06:56:10 pm
content: Quote from: DavidAlfa on February 25, 2022, 08:12:55 amAs I mentioned in my post:Quote from: tinfever on February 25, 2022, 02:52:07 amI'd be happy to be corrected.

author: DavidAlfa
author_rank: Super Contributor
timestamp: February 25, 2022, 10:13:49 pm
content: Oh, sorry, didn't read that. Will make a test.Edit: Meh, doesn't seem to work. IPE is newer, but buggy and slow as hell.It seems the programmer reads the memory first to preserve it when told so, and of course that won't work with CP set.Maybe the programming algorithm changes between standard and standalone firmwares.

author: dvd4me
author_rank: Regular Contributor
timestamp: February 26, 2022, 04:16:57 am
content: Hello again,I also made a video about locking and unlocking an SV10 battery pack, the only one I have and I was keeping it to experiment capacity testing and other things.The battery pack was working fine, just that I do not have a vacuum for it and the chances to find one are slim to none so I opened again and unbalance the pack by discharging one cell.At one point I got the fail lock lights, the pattern was different, is 2 red blinks on blue, not the 32... The software on this model seems to be different.Once the pack fail it does not charge anymore. It does not restore to working conditions after the cell is balanced back.After balancing the cells, changing those 2 eeprom locations restores the pack functionality.I posted the video here:Cheers

author: dvd4me
author_rank: Regular Contributor
timestamp: February 28, 2022, 04:42:05 pm
content: Hello,The V7 pack I have is an SV10 model ( on the label) that has level gauge implemented with 3 blue LED's .While still playing with the eeprom data to figure out more, about how data changes during different operations, I was having the blue charge light on while there was no current draw. I was like, what happens, the charge FET is not opening? Did I change something in the eeprom map that did this?I restored the exact working data as I saved before unbalancing the pack to make-it fail and the result - still not drawing charge current. I took the pack at work to check-it more and dig-it under the silicone.Since all the parts are also covered in lacquer, you have to use solvent to remove the coating and have a good contact to measure. I did-it with some acetone I found around.I was able to found the F2 ( as in tinfever SV09 schematics ) burned.So it is possible to burn that little fuse ( my power supply was on 1A but I suspect the current limit does not act instantly, so it must have overshoot - output capacitor discharge - and burned the fuse)As a note, the eeprom data is containing the battery level, when I restored the complete map, I had the level gauges light up as "FULL" - 3 blue on - while the pack was actually discharged, I was draining it to complete a cycle when I burned the F2 fuse. There is still a lot to dig into this packs. It seems like the SV03 eeprom map has limited uses, restoring that in a SV09 or SV10 it's not suitable.I found, for example, that discharge is not run up to the 3.1V / cell when the eeprom data is messed up, there must be some pack specific settings in the eeprom map.That being said, kind of reinforce my assumption that one cannot restore data from other packs to unlock any failed BMS, has to be kept the same data there...I will try to find something to replace that tiny thing.Edit: fixed with a similar size fuse from a lcd signal strip, was faster than ordering.

author: tinfever
author_rank: Regular Contributor
timestamp: March 01, 2022, 09:54:35 pm
content: I'm glad my schematic helped! That battery gas gauge is interesting. If they implemented that thoroughly by recording charge and discharge current draw over time, it would make sense they'd need to store some parameters in the EEPROM. I'm kind of curious how different that board is compared with either the SV11 (the first schematic I did) or the SV09 board in terms of wiring layout. They might have just replaced the single RGB LED with three separate ones and left everything else the same. Then the MCU just needs different firmware to drive the LEDs differently. That would also mean any firmware I make might work fine, but would just have LEDs that are driven oddly or nonsensically.The SV11 and SV09 don't have any way for the MCU to monitor the charging current, so either Dyson added a trace for that from the charging current shunt to the MCU, or they are just watching for the battery to complete a charging cycle, calling that "full", and then just monitoring the current draw * time to determine battery capacity until low voltage cut out. That would mean that doing a partial battery charge could confuse it though.If it were me, and I wasn't just doing it the cheap and easy way of hardcoding battery pack voltages to certain battery levels, and I didn't have a way to monitor charging current, I'd have a fall back mode that uses the pack voltage to determine battery level if there was a partial battery charge or if there is too much difference between the battery level from recorded usage vs measured pack voltage. Or they could have just used a separate battery gas gauge IC, just like they added separate over-charge voltage protection ICs on the SV11.Thinking about it more, if they just trust the charger is a relatively accurate constant current, they could determine charging current * time just by watching the charging time and assuming a hard coded charge current.Edit: I see now there are four LEDs on that SV10, they are very likely using one of the spare pins on the PIC with an extra trace.Quote from: DavidAlfa on February 25, 2022, 10:13:49 pmThanks for confirming.Nothing worse than buggy software!

author: tinfever
author_rank: Regular Contributor
timestamp: March 01, 2022, 11:20:45 pm
content: dvd4me, do you know if all of the original Dyson BMS boards you've worked on have 10k thermistors? I've only desoldered the very first BMS and ripped out the thermistor legs in the process. I've been having a very hard time measuring the thermistor in-circuit too.I did manage to jam some wires in to the epoxy where the ripped out legs were and measured roughly 10k at room temperature so I'm pretty sure it's a 10k on the SV11 but I'm not sure about any others.

author: tinfever
author_rank: Regular Contributor
timestamp: March 03, 2022, 12:38:53 am
content: I've got most of the functions put together for the firmware and so now I need to stop procrastinating on sorting out the details. I've put together a finite state machine diagram showing how I'm thinking the firmware would work. I don't have any major concerns with this, although I still need to mentally run through all the different scenarios to make sure I haven't missed anything, but I'm curious to hear everyone's thoughts. Any feedback would be appreciated!

author: dvd4me
author_rank: Regular Contributor
timestamp: March 10, 2022, 04:20:35 am
content: Quote from: tinfever on March 01, 2022, 11:20:45 pmHello tinfever, sorry for the late reply, I have missed the notification about your post. Yes, they are 10k on the Dyson BMS's. I replaced a broken one from a laptop battery, they have same value ( most of them).Congrats on the functions chart you build, I believe you're becoming expert on the ISL chip functions and how to implement them with the hardware on the Dyson BMS.A BMS that does not need to be " unlocked" every now and then and also safe is tempting.But I believe you're lifting most of the weight on this. I took the lazy path of the eeprom reset, it's good enough for me. I can balance or re-cell a pack in the future plus I have now 3 packs in working order with the original BMS. Way more that I need, considering my Dyson it's only a basement tool for now, not used very often.

author: MIS42N
author_rank: Frequent Contributor
timestamp: March 13, 2022, 04:44:57 am
content: Thank you people. I acquired a Dyson DC59 which the owner said "sort of works". I pressed the trigger and got the RFOD (red flash of death). I followed what now turns out to be a well trodden path. Pulled the battery case off, made a jig to charge the individual cells (using the electronics from a cheap backup bank, so cutting off at the right time). All Charged to between 4.04 and 4.08V (after resting for a day). No joy (as expected, had I read this thread first). Started searching and lucked onto this thread, searching for Dyson and PIC16LF1847. Fortunately the board (probably old) had no coating so not too hard to identify some of the chips.The control board looked identical to that posted by tinfever (thank you, sir) and I have a PICkit 3 so followed the video posted by dvd4me (than you, also) and the battery reset just as the video said it would. It is not a complete success, The vacuum cleaner runs for about 40 seconds then says it needs charging. However, if one runs it for 30 seconds, release trigger for a few seconds, it will run for another 30 seconds. This can be repeated for at least 15 minutes. It is ideal for getting into odd corners and cleaning the car, so one happy camper.I figured this is going to happen again, so I made an "adapter" to connect the PICkit to the board. It is a wooden clothes peg with bits of a wooden drink stirrer glued on. The contacts to the board are made by dressmaker pins on the ends of wires. A couple of cable ties and some 5 minute epoxy holds everything together. It took about an hour to make. The pins are not located as well as they could be, the holes are tight so the pins need a bit of fiddling to get proper contact and the wood split a bit. If I were to do it again, I'd do it a bit different. I'd use a fine blade saw to cut slots for the pins, then to hold the pins in place have a strip of rubber band. That would have a bit of 'give' when the pins are clamped, to give more reliable contact. All that said, the current version works well enough I don't think I'll make another one as it may get used a couple of times a year.

author: dvd4me
author_rank: Regular Contributor
timestamp: March 13, 2022, 04:57:17 pm
content: Quote from: MIS42N on March 13, 2022, 04:44:57 amI believe it should be a complete success.... I believe you're running in "turbo" mode, while motor running, press on the motor area where is that turbo button, just to make sure. Switch turbo off only works while motor it's running, does nothing when it's off.Batteries are probably getting weaker but it should at least last longer than 40 seconds in normal mode. Try and let us know.If you keep balancing the cells every now and then, you will never need to reset the pack again. If you try to replace the cells then maybe you will need to reset.Good job confirming that it works the reset.

author: tinfever
author_rank: Regular Contributor
timestamp: March 13, 2022, 08:35:31 pm
content: Quote from: MIS42N on March 13, 2022, 04:44:57 amThanks for reporting your results! I'm glad to hear some of this helped!If I had to guess, at least one of the cells in your battery pack has probably deteriorated to the point that it only takes about 40 seconds for the cell to reach the low voltage cut out of 3V (I think?). Then the BMS sets a flag that prevents enabling the output of the battery any further until you put it on the charger.I've implemented the same thing in my firmware (more information to come in the future) because otherwise, once you hit the cut out voltage and turn off the output, the battery cell voltage actually recovers by sometimes 500mV, which would mean you'd no longer be at the low voltage cut out level and the output could be enabled again. Thus, you end up oscillating between output on > cell voltage too low > output off > cell voltage recovers > repeat. I considered just requiring the trigger to be released and repressed before re-enabling the output, but my thinking was that if the cell voltage is low enough to have it cut out once, it probably wouldn't be good for the cells, very useful in general, or provide a very good user experience to be able to pull the trigger again and get another few seconds of output time.I'm guessing when you release the trigger before the low voltage cutout is reached, you're giving the failing cell(s) a chance to recover a bit, and thus able to prevent it from actually reaching the cutout point. In theory if you reduced the current draw, you could have a disproportionally longer amount of usage time before reaching the cutout point, but unless dvd4me's suggestion that you might be in turbo mode is correct, I don't think that's possible.Thinking out loud here: I already have an easy way to define the low voltage cutout point in my firmware, so I wonder if moving the cutout from 3V to 2.9V would make a major difference in your case. If the cell resistance is just higher than usual, thus the voltage under load is lower that usual, that might help? I wouldn't make that change in an official release but I do wonder if tuning that would help in your specific scenario. Also, I could add a setting that disables the low voltage "no output until charger connected" lockout and instead just required you to release the trigger, since I hadn't considered that some people might find even 30 second bursts of usable output to be helpful.

author: MIS42N
author_rank: Frequent Contributor
timestamp: March 13, 2022, 10:23:20 pm
content: I am using the cleaner in normal mode. Turbo mode runs for a few seconds, then cuts out.I find the behaviour of (30 seconds on, 10 seconds off, repeat) to be odd. If heating was a problem then it should be detectable after doing this for 10 minutes (and it isn't). If a cell is dodgy, 10 seconds doesn't seem like sufficient time to recover, especially if the cycle is repeated many times.After putting the partially discharged cleaner on the charger and recharging, the first time the trigger was pulled it ran for more than a minute before cutting out. I don't know enough about the battery chemistry to know if internal resistance rises if the battery is not exercised, and a few charges will 'rejuvenate' it. It was in a cupboard presumably not charged for over a year. After getting the RFOD I checked the cell voltages, the lowest was 3.6V and the highest 3.9V. From reading here, it seems the 300mV difference is enough to trigger the RFOD. I charged them individually so they should be balanced for a while. Before assembling the pack the difference was 40mV. Unfortunately, measuring the cells is incompatible with using the cleaner, so for the moment I am limited to reporting the behaviour of the cleaner.I should run it on the 30/10 second cycle until it stops, to see how long that takes. Another day.

author: dvd4me
author_rank: Regular Contributor
timestamp: March 13, 2022, 11:00:02 pm
content: Quote from: MIS42N on March 13, 2022, 10:23:20 pmHello, it seems that keeping the cells not used and fully charged increases the internal resistance of the cells.Because they evolved differently, their self discharge rate was not equal and got unbalanced.You need to exercise the cells, full discharge, close to 3V, let them rest and recover, keep draining again until 3V, until they cannot recover anymore.To do this, you can drain the pack externally until 3.0V with a load connected directly on the cells or the whole pack, similar with what I did, like a car lamp bulb or something similar.Do not worry to trigger any fault since you can reset again. After discharge you can plug the charger.Doing this charge - discharge cycle you will notice if any cell got weaker and it might trigger the red flashing light lock later.I am experimenting now with some cells ( taken out of what it was a Ryobi 40V pack) that were completely dead ( not leaked ) and to my surprise, they take and hold a charge and the tested capacity it's actual around 1900mAh.These cells were in pairs of 2, like the one in the pictures. I will try to test them all to have a conclusion. As you can see they are 0.02V initial voltage..Pre-charging them from 0 to 2.5 V has to be done in very low, like 100mA max current, that charger does this based on the internal resistance measured and not chemistry.I know this is not exactly safe but I keep an eye on them to check the temperature while charging, at any warm sign I stop charging. I will report back in couple of day, if nothing happens...Interesting relevant info about maximum discharge voltage here:https://lygte-info.dk/info/BatteryLowVoltage%20UK.htmlConclusion from that site is that under 3.0V might not be much energy left anyway, so no need to go further discharged. Below 2.0V is not recommended to go as capacity is affected.So there is hope your cells will improve after couple of charge to full discharge ( 3.0V) cycles. Try that.

author: GoneTomorrow
author_rank: Regular Contributor
timestamp: March 28, 2022, 03:46:34 am
content: Quite a bit in this thread, haven't had time to read it all yet.Anyway, I've had this Dyson DC34 handheld for like almost 10 years now (bought in 2013 or 2014). It gets used most days and is still on it's original battery (22.2V, 1300mAh) and still works fine, not even sure it's lost much runtime. But I've been toying with replacing the cells with something like 30Q 3000mAh just to get more runtime since I made a floor wand for it.Don't know if this BMS will lock down if you disconnect the power, but was wondering if anyone had used a bench PSU and resistor divider to make the pack swap invisible? So you'd solder on the resistor divider across the cells and then apply the pack voltage via PSU, should simulate a 6 cell battery while you disconnect and swap out the cells.Probably be a pain in the arse to work around while swapping the cells, might just be easier to go with the wun wing lo replacement BMS. but could be worth a try.

author: dvd4me
author_rank: Regular Contributor
timestamp: March 29, 2022, 01:58:47 pm
content: Quote from: GoneTomorrow on March 28, 2022, 03:46:34 amHello, yes you can try the trick with the divider. In one of the pictures I put here I was probing the eeprom map, to unlock, on a bms with no batteries, just a resistor network and power supply. And I unlock-it with no batteries. Of course you cannot plug the charger with no batteries.Some people swapped the cells without locking the pack, because the pack goes into deep sleep after some time following a button depress. The button is the key to wake up the bms. That's when it will lock.If you can secure the button not to be activated by mistake, once the bms goes into sleep you can disconnect the cells without worries, it will not care about the cells.Change the cells ( around the same voltage as the pack ) and once you depress the button it will be like nothing happens.To have an idea open the pack to see what it is inside, it may not be based on the PIC controller.I tried and successfully re-cell a laptop battery using this method of ghosting the cells on the pack while changing them. I also revived very discharged laptop batteries.Even if you lock your dyson BMS then you can unlock-it. Or even better you can test your cells swap on a already locked battery then unlock-it.You only need the PICkit 3 that goes under 20$. Overall you are much cheaper then buying a new original battery.Regards

author: GoneTomorrow
author_rank: Regular Contributor
timestamp: March 29, 2022, 08:49:19 pm
content: Is that a button on the battery itself? The DC34 (Type B) pack seems a bit dumber, it doesn't have any buttons or LEDs on it. I've heard vague ideas that this pack therefore is pretty easy to repack without bricking, so might just be worth a shot. I wanted to try acquire someone elses already dead pack to play with so I don't wreck my still-good one, found someone but they are taking the piss and won't budge on $20 for a dead packAny tips on opening without chowdering the casing too much? I've seen using thin steel spudgers to depress all 6? of the clips holding the halves together.

author: dvd4me
author_rank: Regular Contributor
timestamp: March 29, 2022, 11:00:58 pm
content: Hi, I opened them by slowly inserting a flat thin metal thingy to lift up each tab and then insert a guitar pick to keep the tab disengaged. I lift the bottom and the sides first.Top ones are the last. I cut off the side tabs ( the inside raised part) for eventual future opening. I have no good receipt for a perfect opening, it will show anyway.Balancing can be done eventually without opening, by drilling small holes on the side, to be able to touch the tabs of the cells. This is a 'meh' type of solution...These batteries are becoming more and more "user serviceable" so it seems the people finding them in the recycling starting to increase the price.I am surprised there is no LED and no trigger button, I had the impression Dy'sons are born like that...Update: I saw on the net your battery DC34 or 35 I believe, there is a different type of BMS, I saw no pads to access any connection. It may not be based on PIC32, It was not a clear picture.Cheers

author: GoneTomorrow
author_rank: Regular Contributor
timestamp: March 30, 2022, 01:57:29 am
content: Just looked up the V7 battery see what the fuss is about. Weird!Yeah this one is quite different and is basically just a bog standard battery with terminals. Not sure the mechanism then of sleep/wake up with only the main power connecting to the unit.

author: suenbrad
author_rank: Contributor
timestamp: April 22, 2022, 12:12:50 am
content: Hi, can I compare you? If I want to replace a V6 battery with a red light on the old 18650 battery with 6 batteries and replace it with a new battery, what should I do in the step-by-step procedure, please teach me. thanks

author: shein
author_rank: Newbie
timestamp: April 22, 2022, 02:54:38 pm
content: Hi there!Awesome work you guys have done!Have you seen that some guy have implemented open source firmware for those batteries?https://github.com/dr-mark-roberts/open-dyson-batteryIt's kind of limited functionality but I've been running it in my V6 and V8 batteries for several months with no issues.

author: dvd4me
author_rank: Regular Contributor
timestamp: April 22, 2022, 03:51:51 pm
content: Quote from: shein on April 22, 2022, 02:54:38 pmThat's great, there was another contributor here trying to make a similar firmware, not sure if he succeeded or not.I just looked into the git-hub project.It was easier for me to just do a simple eeprom change than to try to understand how to compile the hex and to program-it to the PIC32.How did you actually used that git-hub files? Some users may have erased completely their PIC32 by mistake so it could be good to try to gain at least some functionality.Explain in couple of steps how do you load a new program into PIC32. What hex file you use from that Git-hub?Thanks

author: capt bullshot
author_rank: Super Contributor
timestamp: April 22, 2022, 06:07:24 pm
content: Quote from: dvd4me on April 22, 2022, 03:51:51 pmIt's as simple as installing the correct version PIC32 tools onto your linux machine, clone the git repo and type "make flash".The Makefile knows everything you need to build and flash the firmware.There's no ready made hex file in this repo that you could use.

author: suenbrad
author_rank: Contributor
timestamp: April 28, 2022, 05:05:00 am
content: Thanks for your reply, I learned a lot.I'll explain my handler first to see where the error is.1. I went to buy a middle-aged dyson v6 battery. It can be charged normally. Press the button on the battery to display a blue light, but the recharge efficiency is not good.2. Disassemble the battery box and connect the balance charger to several nodes to charge, fully charge the battery, and then start to balance the voltage to 3.9V for every 6 18650 battery. The battery box button should be fixed first to prevent it from being triggered.3. In addition, connect 6 brand new 18650 batteries (SONY VTC5A 2600mah) in series, and the balance voltage is 3.9v for each battery.4. Disconnect the 18650 on the balanced v6 battery from the protection board and replace it with a brand new 18650 battery. Connect all contacts on the protection board.5. Double-check that each battery is the same voltage as the old battery that was replaced. Press the button on the battery. The protection board can work normally by turning on the blue light first and then the green light.6. After the battery box cover is installed, use the charger to fully charge the battery, and the process is normal.7. Here comes the problem. When I plug in the vacuum cleaner to test it, the red light turns on and it doesn't turn at all. May I ask you to know which program I did wrong? That's why I can't move, please tell me.

author: lern01
author_rank: Regular Contributor
timestamp: April 28, 2022, 08:17:48 am
content: Hello, how is the firmware going? Thank you for your hard work！

author: tinfever
author_rank: Regular Contributor
timestamp: April 28, 2022, 06:00:36 pm
content: Quote from: suenbrad on April 28, 2022, 05:05:00 amIf I'm understanding correctly, you replaced all of the battery cells, the cells were all balanced when connected, the battery charged correctly after you replaced the cells, but when you depress the button on the battery, the LED just shows solid red? If that's the case, you've encountered an error I'm not familiar with.If you had tripped some sort of lockout on the BMS, I'd expect it to give you some sort of red LED blink error code and neither charge or discharge. If it is charging fine, then I'm not sure what is happening. Have you tested the battery outside the vacuum? You might try connecting a multimeter to the output and pressing the button to see if the output is enabled. Unless you place a load of at least 1-2A on the pack, the output will be disabled automatically after a few seconds though.Theoretically, if there was a short circuit inside you vacuum, I could see that being detected by the BMS and causing your issue, but I've never tested that and that's just a wild guess for why a battery might work fine outside a vacuum but then not work inside a vacuum.Quote from: lern01 on April 28, 2022, 08:17:48 amI'm still here and working on it.I may have mentioned it was almost done before...well now it's evenmorealmost done. hahaThe firmware is feature complete. I've tested nearly all the protection systems and features. Essentially the only thing left is documentation, I should test it on a V6 battery to make sure the firmware is compatible with both V7 (that I've been developing on) and V6 batteries, and I need to put the battery in my refrigerator to test the low temperature protectionOh, I also need to actually use it to vacuum my apartment as a real world test.I was aiming for release yesterday...and then the day before that...and then the day before that. So ETA...today? tomorrow? Within a week? Soon™

author: lern01
author_rank: Regular Contributor
timestamp: April 29, 2022, 02:24:07 am
content: look forward to.....

author: suenbrad
author_rank: Contributor
timestamp: April 29, 2022, 10:50:41 am
content: Hello everyone:Continue today's unfinished work. After replacing 6 new 18650 batteries according to the last steps,The red light is on when the vacuum cleaner fails to start. So I went to get a brushless motor and installed it directly at the power output,When the button is pressed, the motor can operate normally, and it is normal to continue pressing for up to 20 seconds. So doubtIs it a problem with the board itself. Take the battery to discharge, put the original 26V into 22V, and then install the vacuum cleaner.is able to operate normally. But when the battery was recharged to 26V he couldn't run again.Fortunately, I still have a battery with poor power storage, and this time I replaced it with a new 18650 battery. All programs are the same as last timeThe same, but there is one more step, that is, before the battery is disconnected from the protection board, there is an external connection at each node.A battery of the same size will keep the protection board powered even after it is disconnected (because I'm not sure ifThere will still be problems), as a result, after replacing the new battery, remove the external battery. Balance the battery to 24V first, then installThe vacuum cleaner test finally succeeded and works fine. It is normal to continue to charge to 26V.The point is not very sure if the battery is successfully replaced because there is continuous power supply to the disconnected protection board. still isThere is a problem with the original protection board itself, and then we will study it.

author: Hank
author_rank: Newbie
timestamp: April 29, 2022, 12:09:49 pm
content: Hi there, at first I'd like to give some kudos to tinfever for his immaculate work and dedication on this.I wish I had read this thread more thoroughly, so I wouldn't have bricked my battery.I used Mplab X V6.00, and thought to have ticked all of the right boxes, but to no avail, so I have one more original pack, which I don't wanna brick.So please help me out on this, I made a 5 wire cable with 5 pins, is it safe to plug it into the Pickit 3, while the latter is connected to the PC?The next step seems to be to press the button on the pack, to power the PIC, and continue with the next step, just wanna be safe and not sorry.I also have an alternative pack, of which the cells are completely shot, but maybe, just maybe, the MPU is not read-protected.Unfortunately, the numbering has been erased, but I'll post some pics later on, it might be helpful in engineering new FW.Oh, it's about a DC61 for a V6.

author: dvd4me
author_rank: Regular Contributor
timestamp: May 02, 2022, 08:17:06 pm
content: Quote from: Hank on April 29, 2022, 12:09:49 pmHello, until tinfever does a release, here is the video I made, it was posted on the previous forum page, you can see the connections to the pcb and pic, what to click and what not to click...If you want to change the cells, make sure you remove first one wire from the trigger button, so the BCM does not wake up.No need to ghost the battery cells for this swap, just change them and if the pack died unlocked then it will wake up the same. use 3.5V charged and balanced cells to swap.If you want to see the video I posted, it's here:Some users report success to reset the pack by using the same way I did-it. Try.

author: Hank
author_rank: Newbie
timestamp: May 03, 2022, 07:40:56 pm
content: Quote from: dvd4me on May 02, 2022, 08:17:06 pmWell, this Pickit3 is doing my head in, I downloaded via your link on YT, but when I run it, I get a message that it is in MPLAB mode, and I need to download an OS compatible.And I also can't select the 16LF1847.When I want to quit the program, it won't let me, and I get this message: System.UnauthorizedAccessException: Access to the path 'C:\Program Files (x86)\Microchip\PICkit 3 v3\PICkit3.ini' is denied.The ZIP contains 3 other ZIPs, do I have to invoke those other files too in some way?An I'm running Win7-64b.Edit, it's running now, but still can't select the 16LF1847Edit 2, can select it now, but still get the error while trying to quit.

author: tinfever
author_rank: Regular Contributor
timestamp: May 03, 2022, 11:33:40 pm
content: In case anyone is interested in an update on my progress. I found a really tricky hardware bug while working on the documentation, and it took me a couple days to figure it out and create a work around.Current theory/procedure:0) Directly short the output (or connect it to multiple electronic loads that appear as a short until they start to limit the current)1) The trigger is pulled and output is enabled as usual2) There is a massive current spike, but not so huge as to trip the short circuit protection (which has to be set to 175A because the next lowest step, 100A, is insufficient for vacuum startup).3) The output is disabled, but probably not actually because short-circuit protection kicks in. It takes about 400us, vs the 190us for short circuit protection.4) The ISL94208 RESETS ITSELF AND DOES NOT PROVIDE ANY ERROR FLAG. Thus it is not obvious what happened.- This is likely because during a hard short, there can be a current spike of 140A+.- This causes the voltage on VBACK (attached to cell 1) to drop as low as 1.46V (vs 3-4.2V normally).- VCC for the ISL94208, which is connected to Cell 6 drops as low as 10.5V but that's still above the POR voltage- This is below the listed typical POR voltage (no minimum provided) for VBACK and is likely causing the reset of the ISL, which wipes all registers.- All of this is likely caused because Dyson omitted the 10uF capacitor for VBACK shown in the ISL94208 datasheet (page 32).5) The normal I2C commands to the ISL fail while it is resetting, causing I2C errors.6) Previously, I2C errors were handled by resetting the PIC. So the PIC is reset.7) The PIC starts up and sees the trigger is pulled and the ISL is presenting no error flags.8 ) Wash, rinse, repeat. Go to step 1.I've determined I can set some of the User Flag bits and periodically check those to determine of the ISL has silently reset itself. If those bits are cleared, it then asserts an ISL_BROWN_OUT error, rather than having the output flap. These User Flag bits also have to be checked in more than one place in the main loop because the ISL doesn't reset *immediately* after the output enable bit is set on a dead short, so if I check the User Flags immediately afterwards they'll still be fine. I also had to add more elaborate I2C error handling than just resetting the PIC since that would prevent the ability to detect that the ISL reset.I also tried to assess how the stock batteries react to this fault. I blew the MOSFET and the fuse. Then I replaced the MOSFET and shorted out the fuse. Then the MOSFET blew up again (that could be due to my bad soldering though). At this point I decided I needed to not permanently destroy my last working V6 BMS board since I still need to test that my firmware is compatible with it. Most development was done with a V7 BMS board but it was designed to be compatible with V6 boards too. There are a few different versions of the V6 BMS board, so after I publish everything it would be helpful for anyone willing to test the firmware on a previously untested board version are report their results.Quote from: Hank on May 03, 2022, 07:40:56 pmI think that error when trying to close the PICKit 3 programmer program is "normal". I always get it too. You can thank Microchip for that.

author: widlokm
author_rank: Contributor
timestamp: May 04, 2022, 07:14:46 am
content: Hello,First of all many thanks to all contributors to this thread, You probably saved a few dysons from scrap, helping the environment in the process.I recently fix faulty V7 battery by replacing the cells and reprogramming 2 "critical" EEPROM locations. Battery worked but after charging I have 6 orange flashes, something new. I expect that this is a temperature problem because original thermistor was destroyed when replacing cells, and I put there a 20k NTC one (just guessing the value).Could You please give me the original value for this thermistor? Or just a voltage on it during normal operation of battery, then I check if my is correct.I've also red that PIC16LF1847 is not 100% compatible with ICD debuggers because of to high MCLR voltage, this is not a problem with Pickit3 according to MicroChip - just a warning. I came around this issue when I wanted to use my old ICD2 on this chip (attempt failed, I ended up adding a module to my old DIY parallel programmer - slow as hell but works).I've also worked quite a lot on microchips before, and I thing that I can help with the "opensource" firmware for this battery if someone is interested.PS. My battery "fixed" itself after laying without cover for some time near open window. I will check that, but it seems that my idea about wrong thermistor is right :-).

author: tinfever
author_rank: Regular Contributor
timestamp: May 04, 2022, 08:39:24 pm
content: Quote from: widlokm on May 04, 2022, 07:14:46 amI believe both V6 and V7 batteries all use 10K NTC thermistors, although they use different pull-up resistor configs so the measured voltages are different between models.I've attached a text file containing the lookup table I've calculated and am using to determine temperature based on the voltage read on the thermistor. I've just assumed the beta of the thermistor of 3500K so the temperatures are probably only roughly accurate.I appreciate the offer to help with the firmware.Once I get this initial release out, I know I could really use some feedback on how the code could be improved for simplicity/best practices, since it's honestly a monstrosity at this point haha. I'm a bit burned out on the project so I can't commit to much more than fixing bugs that anyone finds, but I'm definitely interested to hear more about what I could do better in future projects.

author: suenbrad
author_rank: Contributor
timestamp: May 05, 2022, 12:41:07 am
content: Currently looking for a way to unlock the V10 battery, I don't know if the solution for the V6 can be used. The corresponding lead contact angle is being studied, and the management chip is BQ76930

author: lern01
author_rank: Regular Contributor
timestamp: May 05, 2022, 05:27:46 am
content: I have drawn the V10 interface and PICkit4 programmer interface diagram, as shown below, for your reference.

author: zhoukevin
author_rank: Newbie
timestamp: May 05, 2022, 07:14:56 am
content: The main control chip of V10 is ATMEL ATSAMD20E15A. The official manual indicates that it does not have EEPROM, so the previous solution should not be suitable.

author: dvd4me
author_rank: Regular Contributor
timestamp: May 05, 2022, 02:49:05 pm
content: Quote from: zhoukevin on May 05, 2022, 07:14:56 amThen this may be even better, there is a chance the chip in V10 pack behaves like the Arm Cortex in the Rigid battery packs, I made another video for that:Over there, a simple hard reset triggers the pack back to life again, the previous fail conditions are cleared out. Who has the V10 pack should try to reset and see the effect.On a Rigid battery it was working just fine.Regards

author: widlokm
author_rank: Contributor
timestamp: May 05, 2022, 08:29:51 pm
content: Many thanks, problem solved.It seems that my idea about thermistor was right, but the other way round - I must have heated the battery with my hands and that cleared this warning. I further confirmed that by cooling battery to ~15degC, that caused instant yellow/orange blinks. After changing thermistor to 10k, NTC it works as it should.Unfortunately my battery does not have the balancing possibility (pins on ISL chip shorted), so I will not be able to check/help on that. Maybe I will find a scrap, cheap battery here in Poland with the ISL connected right, but everything I've seen before was way to expensive.Are You using SDCC compiler or something else? Assembly? When You will have the initial firmware out, I will have to prepare my environment and programmer, that might need some work because I don't use Microchip software (hate it).

author: lern01
author_rank: Regular Contributor
timestamp: May 06, 2022, 03:50:02 am
content: Thanks! I reset pin3~pin7, all the same, nothing changed.Pin3 3.28V (CPU pin13)pin4 0.04V (CPU pin14)pin5 0.00V (CPU pin1)pin6 3.28V (CPU pin31,SWDCLK)pin7 3.28V (CPU pin32, SWDIO)pin8 REST(CPU pin26)

author: suenbrad
author_rank: Contributor
timestamp: May 06, 2022, 04:18:58 am
content: Thanks to dvd4me for sharing the processing technology and direction, I have purchased two V10 faulty batteries to try and see if it can be hard unlocked. I'll report back to you when I'm done trying. thanks!

author: kevinlo
author_rank: Newbie
timestamp: May 06, 2022, 05:45:13 am
content: I have one V10 SV12 Battery Pack , the battery run time only stay for few minutes , so I plan to replace the 18650 battery .Before I take down the old battery , the BMS is light Blue in normal .But once I take down one of battery , I start to take off -Ve cathode on P1 , then it blink into Red light immediately.I am no idea how to take down the V10 battery safety without trigger the BMS lock. I think two possible direction.1) Let it lock and blink Red light , after replace the new 18650 battery , then unlock it. (But seems no way to unlock it up to now.)2) Cut off the power supply to Power Management Chipset , after replace the new 18650 battery , then reconnect it again. But I still finding the schematic of V10 BMS board.

author: lern01
author_rank: Regular Contributor
timestamp: May 06, 2022, 06:45:48 am
content: Before replacing the battery, remove the connection wire on one side of the microswitch to avoid waking up the BMS chip, which will not supply power to the CPU. It's safe to replace the battery.

author: kevinlo
author_rank: Newbie
timestamp: May 06, 2022, 08:24:18 am
content: Quote from: lern01 on May 06, 2022, 06:45:48 amOh I see , let me try to replace my 2nd V10 battery pack. Thanks a lot.

author: zhoukevin
author_rank: Newbie
timestamp: May 06, 2022, 09:20:57 am
content: Quote from: kevinlo on May 06, 2022, 08:24:18 amYou can test it. The normal practice is to plug in the battery pack to ensure that the voltage does not change (as shown in the figure)

author: dvd4me
author_rank: Regular Contributor
timestamp: May 06, 2022, 01:04:45 pm
content: Quote from: zhoukevin on May 06, 2022, 09:20:57 amGhosting the cells while changing them works fine with laptop packs also, the access is locked on those packs, usually with encrypted TI bq chips.No matter what, if the voltage of the pack goes under a certain limit, like each cell below 3V, the BMS goes into deep sleep mode and you can do manual cell charge, balance, etc.I revived over-discharged "dormant" Laptop battery where one cell was 1.8V or even lower. Once you plug them in the laptop they get locked, you have to fix the voltage and balance before that.I did not made a video for that yet but it works nice.It seems to be too many variations out there for these packs, not sure if all are unlock-able. It's a common effort.Best

author: suenbrad
author_rank: Contributor
timestamp: May 10, 2022, 03:25:39 pm
content: The main control chip of V10 is ATMEL ATSAMD20E15A，This picture is a text description of the ATSAMD20E15A instruction file. Can anyone understand what he means? Is it helpful for resetting?

author: lern01
author_rank: Regular Contributor
timestamp: May 11, 2022, 01:20:53 pm
content: No use.

author: dvd4me
author_rank: Regular Contributor
timestamp: May 11, 2022, 05:17:59 pm
content: Quote from: suenbrad on May 10, 2022, 03:25:39 pmThe reset pin is active " LOW' means it needs to be connected briefly to GND to trigger reset.First balance the cells and manually charge them to a decent 3.7V each.Then find the "RESET" pin location on the ATSAMD20E15A and using a small wire connect-it briefly to GNG. Be careful where that GND is, make sure it's the same GND as the Atmel chip.Try this and report back the result if possible.

author: suenbrad
author_rank: Contributor
timestamp: May 12, 2022, 06:12:49 am
content: OK, I'll report the results to you after I've tried it

author: lern01
author_rank: Regular Contributor
timestamp: May 12, 2022, 07:51:31 am
content: No use, I tried.

author: suenbrad
author_rank: Contributor
timestamp: May 12, 2022, 03:30:47 pm
content: 1. Manually balance the battery to 3.7V.2. Take a thin wire to briefly connect REST (PIN26) and GND (PIN28).Nothing happened, still no solution.If you press the button of the battery first, the red light will start flashing. At this time, the red flashing light will go out when you connect Rest and GND for a short time, but it will start flashing red immediately after removing the connection.

author: kevinlo
author_rank: Newbie
timestamp: May 14, 2022, 04:19:13 am
content: Did anyone have information for V8 Sv10 BMS ? What is the MCU chipset and pin assignment ?Thx

author: tinfever
author_rank: Regular Contributor
timestamp: May 15, 2022, 08:52:29 pm
content: It's done.After much delay, I'm pleased to announce the release of:FU-Dyson-BMSAn (Unofficial) Firmware Upgrade for Dyson V6/V7 Vacuum Battery Management SystemGitHub Repo with much more documentation and info:https://github.com/tinfever/FU-Dyson-BMSDedicated EEVBlog Forum Thread:https://www.eevblog.com/forum/projects/fu-dyson-bms-an-(unofficial)-firmware-upgrade-for-dyson-v6v7-vacuum-bms/

author: lern01
author_rank: Regular Contributor
timestamp: May 16, 2022, 08:49:52 am
content: Thank you very much for your hard work!!!

author: zhoukevin
author_rank: Newbie
timestamp: May 17, 2022, 10:00:41 am
content: Quote from: shein on April 22, 2022, 02:54:38 pmHello, I don't have a compilation environment here. Please send me a copy of the compiled hex file. Thank you! zhoukaier@hoamil.com

author: Hank
author_rank: Newbie
timestamp: May 18, 2022, 07:55:19 pm
content: Quote from: tinfever on May 15, 2022, 08:52:29 pmThanks again for your effort, a sterling job I might say.And I've got 1 pack charging right now, but when I raise the charging voltage above 25 volts, it starts flashing 8 X red, which indicates charging overcurrent, but that's not the case.I thought that the original charger outputs 26 volts?

author: suenbrad
author_rank: Contributor
timestamp: May 19, 2022, 07:06:58 am
content: I have encountered a v7 battery that can be charged and discharged normally after treatment, but I don't know why the charging voltage can be adjusted below 24.5v to be able to charge normally. If it exceeds this voltage value, the red light will flash and cannot be charged (provided I replace it with it). The batteries are not brand new, I don't know if this has anything to do with it).Because there is no original charger.

author: Hank
author_rank: Newbie
timestamp: May 19, 2022, 07:57:01 pm
content: Quote from: zhoukevin on May 17, 2022, 10:00:41 amThe HEX-file is just out there, I'd suggest watching the YT video.

author: tinfever
author_rank: Regular Contributor
timestamp: May 19, 2022, 10:47:02 pm
content: Just a heads up for everyone, if your post is related to my firmware, the best place to post any questions or feedback would be in the dedicated thread here:https://www.eevblog.com/forum/projects/fu-dyson-bms-an-(unofficial)-firmware-upgrade-for-dyson-v6v7-vacuum-bms/Quote from: zhoukevin on May 17, 2022, 10:00:41 amI don't think there is a published hex file for his project.For my project, you can find the published hex file under Releases in the git repository:https://github.com/tinfever/FU-Dyson-BMSQuote from: Hank on May 18, 2022, 07:55:19 pmThat's odd. I'm pretty confident the CHARGE_OC_FLAG error can only be triggered if the Charge OC bit asserted by the ISL94208.Since you mention controlling the voltage, I'm assuming you aren't using the original charger? You are correct that the original charger is rated for 26.10V @ 780mA. I just measured mine at 25.99V open circuit. If you are using some other power supply, are you able to measure the current that passes when this error occurs?Also, does the error occur immediately? Or only after some time?If you are using a bench power supply, is it possible when you turn it on when set to 26V it is taking some time before it regulates the current down to what you have it set to?Quote from: suenbrad on May 19, 2022, 07:06:58 amAssuming that when you say "treatment" you mean my firmware was installed, what error code are you seeing? Does your issue sound similar to the one Hank posted about?

author: suenbrad
author_rank: Contributor
timestamp: May 20, 2022, 11:52:29 am
content: V6 situation:When using the charger, the yellow light flashes twice first, the blue light flashes once quickly and briefly, and the red light flashes eight times.The highest voltage cell in your pack is 4.05V. The lowest voltage cellis 3.93V. 4.05V - 3.93V = 120mV difference. 120mv / 50mv per flash = 2 flashes (2.4 rounded to 2)CHARGE_OC_FLAG ISL94208 asserted flag that the charging current was over the charge over-current limitV7 situation:When using the charger, the yellow light flashes first, the blue light flashes once quickly and briefly, and the red light flashes eight timesThe highest voltage cell in your pack is 4.09V. The lowest voltage cellis 4.05V. 4.09V - 4.05V = 120mV difference. 40mv / 50mv per flash = 1 flashes (0.8 rounded to 1)CHARGE_OC_FLAG ISL94208 asserted flag that the charging current was over the charge over-current limitI'll try to balance the battery manually first, maybe it's also caused by the old batteries, and I'll report the results to you when the new batteries are replaced.2022/5/22. Using 6 new batteries Sony vtc6 3000mah, the charging voltage must be adjusted to 25.8v for normal charging. If it exceeds, the red light will flash 8 times.

author: abraziff
author_rank: Newbie
timestamp: May 26, 2022, 06:09:10 pm
content: Hi guys, can you help me?i have dyson v8 with battery sv10, and the problem is 4 red lights blink.I disassembled battery, first cell was 3.7V, and other 3.95-4v. I've charged first cell up to 3.95v, and with the same result. Then i bought a cheap chinese pickit 3, it read firmware, and i think it read it incorrectly. Please check it and provide me with the working firmware.Thanks.

author: Bartman1001
author_rank: Newbie
timestamp: May 29, 2022, 06:04:55 pm
content: I solved 8 Red flash issue. I added series resistor to charge port for reducing charge current. When I add 1.2ohm resistor it solved charge over current error. When I measured charge current, I get a max 800mA. Not even Close to 1.4A limit. So I ,ncrease to sense time from 2.5ms to 5ms in isl94208.c file (tinfever firmware). It solved now.

author: suenbrad
author_rank: Contributor
timestamp: May 29, 2022, 11:22:54 pm
content: Thank you Bartman1001 for your sharing to try this firmware tonight

author: dvd4me
author_rank: Regular Contributor
timestamp: May 31, 2022, 02:38:01 pm
content: Quote from: suenbrad on May 12, 2022, 03:30:47 pmHello, I just had the time to go thru the latest posts, it's been a while. I see in your nice pictures another small 8 pin chip, that must be the flash memory where the program is stored, clear the top with some paint remover and let us know the printed code. There must be some access to program the eeprom since the the programmer holes are there. All these new implementations of the BMS are hard to track.Since nobody had a chance to work on a pack like yours there is not much info. This is a good chance to see more. If that's a flash chip then inside must be the location of the "red light lock" since it has to be stored permanently, not to be cleared by a hard " reset".BTW crazy cool tool you have there, I'm waiting to get rich and buy myself one...150$ on Amazon here, it's a gift I would love to give to myself, when it comes my birthday))

author: suenbrad
author_rank: Contributor
timestamp: May 31, 2022, 08:12:00 pm
content: U1:BQ769300 88TG4U2:ATSAMD20E15A8PIN:MV393I

author: palacios
author_rank: Newbie
timestamp: June 01, 2022, 06:18:13 am
content: Folks, I registered in this forum solely to thank you, and specially Tinfever and dvd4me, who's astonishing work led me to dismantle the Dyson of my wife, to buy a Pickit 3 and mobilise my engineering degree ooooold knowledge in micro electronic.I managed to get back blue light !- Used a Trustfire magnetic charger to rebalance manually one or two accumulators that were clearly off balance- Found on line 10 of EEPROM the values 5A and 09 on the two last figures, and replaced, as in the video of dvd4me by 00 and 7FPlugged charger and got blue light.One question, that I think is very related to unproper manual balance, is that some time I see an intermitent amber light on the LED, but it is sporadic for now.Thank you guys, so much. So much. This is an action for nature and avoiding waste. Your explanations were very clear. Very good, very interesting.I just can't believe how good people can be on this planet.

author: dvd4me
author_rank: Regular Contributor
timestamp: July 12, 2022, 11:23:45 pm
content: Quote from: palacios on June 01, 2022, 06:18:13 amYour enthusiasm is a good incentive to keep things moving in the battery repair area. Dyson was just an expensive example. Happy you made-it work.Check the balancing with a voltmeter after some charge/discharge cycles to see if your cells are still healthy.An intermittent amber could be the thermistor, it's 10K, if you try to change the cells there is a chance you can break-it.Power tools cells are also worth saving, 100$ 5Ah pack is a little treasure chest waiting to be found.Check my repair/revival video of a Rigid pack here:I have found and fixed 2 over discharged packs, they work just fine now. I bought a Rigid drill just to use the batteries..Have fun

author: colinng
author_rank: Newbie
timestamp: July 26, 2022, 02:52:48 am
content: I managed to use a PICkit2 compatible to reprogram location 1E to 00 - and it worked - on a V6 pack that had 32 blinks. Thanks!The original PICkit2 software doesn't support the PIC16LF1847, but PICkit- (PICkit minus) athttp://kair.us/projects/pickitminus/does! It adds support for hundreds of newer chips, and works with both PICkit2, PICkit3, and in my case, a PICkit2 compatible.Update: I tried the same thing (1E to 00) on a V7 pack that had 20 blinks --> did not work.Also tried (1E to 00) and (1F to 7F) but it also didn't work.I verified every write with a read, and it was set correctly.However once I start the pack up (magnet + switch) it does the 20 blinks, and when I read back, 1E is now B0. Before any changes 1E was 9E (which I changed to 00).The QR code inside the pack (which is 18650 with lots of padding) is VAL16108600212, made in Malaysia.

author: dvd4me
author_rank: Regular Contributor
timestamp: July 28, 2022, 03:20:11 am
content: Quote from: colinng on July 26, 2022, 02:52:48 amThat's nice, good to hear that.Quote from: colinng on July 26, 2022, 02:52:48 am20 blinks? This is a new blink code. Battery unbalance for a V7 I remember it was 2 red and 1 blue... or 32, as in the V6.I made those videos from the packs I have that were unbalanced only.If there is another type of problem then for sure it will persist after reset until you fix the problem.Try to find out what 20 blinks mean, I have no idea.I am not looking to go back to play with those batteries again, there's nothing interesting for me.The first V6 unlocked pack still works very well after balancing. And I have 2 spare also from the recycling.Tinfever made a custom FW, if you want to erase your BCM and load that, you can try. There's no going back to Dyson fw.Dyson FW I like because of the good charging voltages, comparing to the other asian clones of the BCM.The clones overcharge the cells over 4.2V, that was scary when I was first monitoring the charge.That's the reason I still stick with the original FW, it was well made ( despite the lock and lack of balance).Cheers

author: gpoint
author_rank: Newbie
timestamp: August 03, 2022, 03:57:42 am
content: Hi there,I came across your post. it's awesome, really thank you for the sharing (I used to be a firmware engineer on Pic processors long time ago).I recently opened a v7 battery pack just been curious about the BMS.I am not familiar with the firmware, can you please help with my question:Why didn't I get any voltage from the two output pins even while the trigger button (the normally close switch) is pressed (I am sure the BMS is not faulty)?Does it require certain load or some common grounding to "wake up" the BMS?Thanks in advance.

author: tinfever
author_rank: Regular Contributor
timestamp: August 03, 2022, 05:49:29 am
content: If youQuote from: gpoint on August 03, 2022, 03:57:42 amIf you have a V7 battery pack, you have to have a magnet near the reed switch on the BMS board, in addition to pressing the button on the battery pack, in order for the output to be enabled, assuming all else is working properly. Also, if using the stock firmware, the output will be disabled after a few seconds if there is not a load of at least a few amps (I think).Let us know what the LEDs are doing if this doesn't answer your question.

author: gpoint
author_rank: Newbie
timestamp: August 03, 2022, 06:12:51 am
content: Hi Tinfever,So many thanks for the input.Will give it a go by putting a magnet strip next to the switch, and see how it goes from there.BTW, how do u find out this?Cheers.

author: gpoint
author_rank: Newbie
timestamp: August 09, 2022, 12:12:26 am
content: Quote from: tinfever on August 03, 2022, 05:49:29 amThanks Tinfever,Your idea worked very well, I used hot gun glued a magnet near the reed switch, it woke up the BMS nicely. The LED doing what it should (blue on to indicate output on).Somehow the battery packs were not happy with high current drawing from my eBike motor and gave an odour of burning when used for upslope.But it was a good try though...Cheers.

author: diebog
author_rank: Newbie
timestamp: August 10, 2022, 10:34:23 pm
content: hey guys, im new to the forum but have been on it for many years reading/researching but just finally joined.So I have an SV10 off an V8 Dyson and unknowingly I removed the board before I knew to unsolder a wire from the switch, my goal was to balance the cells and put it back together as the cells were healthy and not even a year old, well as you might of guessed, it bricked the battery. Went to put together and got 5 red 1 blue, so I tried doing the reset with a pickit3 knockoff and while it reads and writes fine and the red light went away but now i get a single blue blinking light that doesn't stop. I wish I had the foresight to save the original hex file but I didn't. And I did uncheck "program Memory" ahead of all this. The pic on this is an PIC16L1F1847. Any suggestions? Does anyone have a good hex file for this model? Ive thought about buying a working used Dyson brand one off eaby and getting the hex off it to fix this one. But thought Id ask first.

author: davegsm82
author_rank: Contributor
timestamp: August 18, 2022, 03:31:32 pm
content: @tinfever I just wanted to come and drop a post on the board since this is a journey I've recently been on myself. I was given my mothers old handheld which would only work for a few seconds before cutting off, plugging and unplugging the charger would get it going again so I thought a balance might be in order.Disassembled the battery pack to try and balance it, but found that oddly all the cells were still in good balance so disassembled further and after dis/reconnecting the PCB to the cells was greeted with the 32 blinks of death. Found the same thing as you guys, the PIC and it's EEPROM data but since it was bricked, meant it was fairly useless.So I did what any self respecting particle accelerator engineer would do, bought a job lot of 'faulty' or more accurately in this case 'untested' batteries from ebay after the seller informed me that only 1 or 2 were completely knackered. Dumped the EEPROM data from a good one and uploaded it to my bricked one with the PICKIT3 clone and a little adapter plug that hits the pins on the PCB. That brought it back to life even though most of the EEPROM data was different, so I then bricked it again, read out the EEPROM and found the changed bytes. Changed them back and got it functional again.So, my quick question to tinfever would be, does any of the EEPROM data look like configuration data for the BMS chip? I'm guessing some of it is likely to be info like battery parameters (min/max safe charge voltage/current etc) but does anything you (or anyone else?) has extracted, look like data that is dumped directly into the BMS chip's configuration registers? i'd be interested to find out if there's any information we could garner about remaining capacity, dis/charge cycles etc once the bulk of the EEPROM data has been ruled out.Quote from: diebog on August 10, 2022, 10:34:23 pm@diebog - as far as I know, no one has yet found an un-protected PIC in one of these batteries, meaning the firmware can't (easily) be extracted. I've looked into having PIC protection defeated in the past and it's a minefield, there isn't one particular method which works for all chips and it's a very hit-and-miss process. One way that is used currently is to decap the chip and (somehow) manually disable the code protection bit, but that's very specialised and very expensive. Are you aware that tinfever has written an alternative firmware that you can use to unbrick your battery though?

author: diebog
author_rank: Newbie
timestamp: August 18, 2022, 07:24:48 pm
content: Quote from: davegsm82 on August 18, 2022, 03:31:32 pmHi, thanks for the reply. After reading the forums I did find his firmware and on my Dyson V8 SV10 battery I can confirm his firmware works! Thanks tinfever! on the SV10 it changes the led pattern from how it used to display but no biggie, at least the pack is up and working again. Only thing is I can only use it on the low suction setting which lasts for 20 mins or so. But even with a fully charged battery when I try the high suction mode I get like 5 seconds and then it cuts the power and blinks the blue led 3 x, 3x, 3x, 3x then back to a solid blue led on and after that led turns off (I’m guessing it goes to sleep) only after the last led turns off can use the vacuum again, and once I can the led blinks 6 times indicating it’s still fully charged. My thought was even though I balanced charged the cells before I put the pack back together, maybe I didn’t do it correctly and the cells are still out of balance so when the high output is used the BMS sees the unbalance and cuts off power? I’m going to check cells again and and see if that could be the case. Does anyone know of a sequence to properly balance the cells? I’m using a Hyperion 6 cell charger (which I use for my Traxxas batteries) with the balance wires soldered on the leads of battery, I first used the balanced function which lowers all the rest to the lowest cell and once finished I use same charger to charge which is also balancing them as it charges. Only thing I didn’t do is to let the battery sit after the first balance, perhaps the cells need to sit to settle down to their nominal voltage and then rebalance a second time before charging?Does anyone know of an aftermarket BMS for these batteries that will actually balance charge the cells? I bought a battery off Amazon (First Power Brand) to try out and after I charged it and discharged it a few times I did a time test with out the carpet head and on low setting and the battery only lasted 10 min when they advertised 35-40 min. Either I got a bad battery or they are full of crap! I’m leaning towards the latter. But I opened that battery up to see if they were at least balance charging them and found the circuit board had all the populated slots to solder the tabs going to each cell, however they weren’t even being used as there was no tabs/leads coming from the other cells even though there were spots for them in the shell moldings. And looking close the populated slots don’t have any traces going anywhere top or bottom of PCB.

author: tinfever
author_rank: Regular Contributor
timestamp: August 18, 2022, 09:53:00 pm
content: Quote from: davegsm82 on August 18, 2022, 03:31:32 pmI honestly haven't analyzed the stock EEPROM data much. However, I would guess it is mostly logging data and also a record of tripped flags. For example, when you run the vacuum until the battery gets too low and cuts out, it remembers that it had a low battery cutout and even if the PIC loses power (like it does when the BMS board goes to sleep), it remembers that flag was set and only clears it when you connect the charger.I'd guess the min max voltages and safe current settings are all hardcoded in the firmware. EEPROM would only make sense to use for data that changes over the use of the battery. For anything that is always the same, like the cell low voltage cutoff limit, I don't see why they'd use any of the precious 256 EEPROM bytes.The BMS IC doesn't actually have much configuration loaded in it, other than the overcurrent and short circuit levels and time windows, and few other boring operational settings. Nearly all the smarts are in the MCU.I'm glad it sounds like you had success in repairing your vacuum, or at least bringing someone else's battery back to lifeWhen you said that the cells were balanced but the vacuum was still cutting out very quickly, those may be cells that have legitimately aged and now have higher ESR (a normal age/use degradation thing I think). High ESR cells may measure fine with no load, but as soon as you apply a load to them, their voltage plummets. A good cell might have an ESR of 50mOhm, so 3A draw (normal vacuum power) might cause cell voltage to drop 150mV, like going from 4.20V to 4.05V while the load is applied. A high ESR cell with something like 350mOhm (random number I made up) would drop from 4.2V to 3.15V, which is very close to the 3V cutout. Thus, you get very little time until it cuts out but as soon as you remove the load, the cells measure OK.Quote from: diebog on August 18, 2022, 07:24:48 pmI'm glad it worked for you!QuoteI'm curious, was the battery able to operate longer in high suction mode before installing my firmware? What it sounds like is happening is under the high suction mode (draws 17A vs 3A in low suction mode) any higher ESR of the battery cells is greatly exacerbated like I describe earlier in this post.QuoteMy firmware doesn't lock you out if the cells are far out of balance. However, it will shutdown with those 3 blue blinks if any battery cell goes too low. Of course, it can only charge the battery pack until the highest cell hits 4.2V, and only discharge the pack until the lowest cell hits 3.0V, so if the pack it out of balance, you'll get diminished usable battery capacity.I don't claim to be a Li-Ion battery expert, but I don't think there is a terribly wrong way to balance a pack. As long as the cell voltages are all close together after letting the pack sit for a few minutes, I'd consider it successfully balanced. The way I would recommend balancing it, at least with a bench PSU, is to charge the battery pack with the normal charger until full, then charge the cells individually with the bench PSU set to 4.2V and a current limit of maybe 500mA (all assuming no cell is terribly low like 2V). Once the cell being charged goes in to current voltage mode, you'll see the current going in to the cell slowly drop. Once it drops to maybe 50mA, you can probably consider it done. Rinse and repeat for any cell below 4.2V. Once you are done going through all the cells, they should all be pretty close to 4.2V. They will drift a bit after you stop charging though.At that point, you could call it done balancing. Or to be extra thorough, you could use the battery pack until low voltage cutout, charge it back up again with the normal charger, and then recheck the cells and rebalance any lower ones.Using the cell charger that also balances like you described also sounds perfectly fine. As long as all the cells are close together and all near 4.2V when completely, I'd call it a success. Waiting a few minutes and rebalancing isn't going to hurt anything either though.QuoteThat's disappointing to hear the battery off Amazon doesn't even monitor the voltages on each cell, let alone balance them. Unfortunately I haven't worked with any of the aftermarket BMS's or batteries so I can't help much there.

author: diebog
author_rank: Newbie
timestamp: August 18, 2022, 10:42:52 pm
content: Quote from: tinfever on August 18, 2022, 09:53:00 pm

author: tinfever
author_rank: Regular Contributor
timestamp: August 19, 2022, 04:10:06 am
content: Measuring ESR (equivalent series resistance) of a battery cell isn't a one step measurement with a multimeter. I believe one way to do it is to measure the change in cell voltage with respect to an increase in load current.For example:With 0A load (no-load) a cell measures 4.20V.With 3A load, the same cell measures 3.87V.Ohms laws is V=IR. Voltage = Current * ResistanceThus:4.20V-3.87V (our change in voltage) = 3A-0A (our change in current) * Resistance330mV = 3A * Resistance330mV/3A = Resistance110mOhm = ResistanceCell ESR is 110mOhmThere are also battery cell ESR testers you can buy I think, but I've never used one.Regarding the fast cutout on high suction mode, if you wanted to, there is a setting in config.h that sets the low voltage cutout to 3000mV (3V). I think you could safely lower that to 2700mV. I'd be curious if that gives you any more usable high suction runtime.For replacement BMS boards, there are some you can get on Aliexpress that I think I heardmighthave balancing. Not 100% on that though.

author: diebog
author_rank: Newbie
timestamp: August 19, 2022, 07:37:34 pm
content: Quote from: tinfever on August 19, 2022, 04:10:06 amIll give it a try. I found the file config.h do I just adjust the value here or do I need the MPLAB X IDE to change and create a new hex file? I know a little on programing but not much as you can tell.

author: tinfever
author_rank: Regular Contributor
timestamp: August 20, 2022, 12:19:55 am
content: Quote from: diebog on August 19, 2022, 07:37:34 pmYou'd need MPLAB X to recompile the firmware. I think if you open the project in MPLAB X, edit the config.h file, and save. You should just be able to build and program. There is a chance you'd need to edit the project settings in MPLAB to use your PicKit though.

author: diebog
author_rank: Newbie
timestamp: August 20, 2022, 03:30:01 am
content: I downloaded the program, found the file and changed the value but haven't got a clue how to get it to work with the pickit 3. Everything is so foreign to me. I get message "Compiler toolchain "XC8" of type "XC8" does not exist. Please visit Tools/Options/Embedded to locate an installation of this toolchain or to select another compiler toolchain." when I try to compile and program chip. So I manually downloaded MPLAB XC8 Compiler but again dont understated where I tell the MPLAB to use itAny pointers? Sorry for being suck a pain, im sure you fell like your

author: tinfever
author_rank: Regular Contributor
timestamp: August 20, 2022, 04:05:43 am
content: Quote from: diebog on August 20, 2022, 03:30:01 amYou might need to download and install the XC8 compiler separately from here:https://www.microchip.com/en-us/tools-resources/develop/mplab-xc-compilers/downloads-documentation#XC8Then try to restart MPLAB (also make sure your PicKit is connected for future steps) and see if it finds XC8. You should be able to go to Tools > Options > Embeddeded > Build Tools and see something like I show in the attached screenshot 1. If XC8 isn't showing there after separately installing, try clicking "Scan for Build Tools".Then I'd suggest going in to the project settings by clicking on the tiny wrench and gear icon I circles in the second attached picture. Double check that the compiler toolchain of XC8 is selected. Then (you should already have your PICKIT connected to the computer) click the drop down arrow I also circled and select your PicKit. Then click OK.Finally, you should be able to click the Hammer and broom icon for "Clean and build" in the upper toolbar (next to the play button). If it builds, then you can connect the programming wires to the BMS board, and click the button to the right of the play button for "Make and Program Device". With any luck that should work!Also, MPLAB and the PICKits can be weird sometimes (that's not your current error reason though) so if things aren't acting right, it's always worth closing MPLAB completely, unplugging the PICKit, waiting a few seconds, plugging the PICKit back in, and starting MPLAB again. That's resolved more weird issues for me than it ever should hahaHope this helps!

author: diebog
author_rank: Newbie
timestamp: August 20, 2022, 08:46:25 pm
content: Thanks bud, after your help I got allot closer but still couldn't get the darn thing to recognize the pickit3. After some playing around I had to first open the pickit3 software and "revert to MPLAB mode". Then hold down the button on device while plugging in usb (dont know if this was really needed), and under "project property's>pickit3>option category's>firmware> uncheck "use latest firmware and then select the PK3FW_015609.jam file" went to compile and that manually forced it to download the correct firmware and finally it connected with the pickit3Its odd because the MPLAB did recognize the pickit3 but when I tried to compile and program it kept telling me there was no device found, after the firmware was updated it worked. But all in all I did learn allot in the process though which was good.Just want to make sure I adjusted the right spot, is this correct? Also Is there a way to check to see if the data got changed on the BMS pic16LF1847? I see there is a read function, its been awhile but if i remember correctly on the Arduino IDE I was able to compile and program then reread and check that everything was compiled correctly on the Arduino itself. With this do you just go off the fact if it complies correctly its good to go? I noticed when I close out the project the "read device memory" function is no longer available, its greyed out.

author: tinfever
author_rank: Regular Contributor
timestamp: August 26, 2022, 09:52:56 pm
content: Quote from: diebog on August 20, 2022, 08:46:25 pmSorry for the delay in getting back to you.You're definitely on the right track with the "revert to MPLAB mode". The PICKit has to be in a different mode with different software depending on if you are using the old PICKit standalone programmer software or MPLAB. Sorry I forgot to mention that earlier. It's really not obvious when MPLAB just says "Connection failed".I think what you found with "use latest firmware and then select the PK3FW_015609.jam file" might be a red herring though. I think what you found as far as "revert to MPLAB mode" is all you need to do. Don't forget that closing MPLAB completely, unplugging and replugging the PICKit, and restart MPLAB can solve lots of problems.If you adjusted "const uint16_t MIN_DISCHARGE_CELL_VOLTAGE_mV = 3000;" in the config.h file and changed it to something like 2700. That's the right spot. If you want to make sure your programming is changing something, you could change the line in config.h "#define FIRMWARE_VERSION 1;" to 2 or 3. Then when you use the procedure to check the firmware version (hold down trigger and then plug in charger, see Github page for more info) you should see 2 or 3 white blinks depending on the setting you used. That could be a quick way to tell your programming is working.I think as long as you are getting to the message "Programming/Verify complete" in MPLAB, you are probably doing everything right though.

author: zhoukevin
author_rank: Newbie
timestamp: October 10, 2022, 01:02:27 am
content: For the V10 battery, I tried to use the EV2400 tool to reset the bq76930 flag bit successfully. However, since the ATSAMD20E15A in the system has been working, the flag bit is restored in the next step. So, do you have any way to let this single chip computer get away from the system before it can succeed!

author: tude888
author_rank: Newbie
timestamp: November 15, 2022, 10:34:10 pm
content: Hello all,I'm new to this forum but not new to repairing electronics, including fiddling with low-level programming.First off, thanks to all who put in an incredible number of hours towards fixing the mess that Dyson created.I am about to replace the cells in my V7, and will probably have to re-program the PIC (thanks tinfever for the video and write-ups)That being said, a few questions came to mind as I browsed the thread:- Has anyone tried to modify the BMS board in order to make it balance the cells?- Second question: would it make sense to replace the original BMS with a cheap 6s BMS module that does the balancing on its own? (i know some functionality would be lost, but it seems the simplest solution)Thank you all in davance!T

author: tinfever
author_rank: Regular Contributor
timestamp: November 16, 2022, 12:37:11 am
content: Quote from: tude888 on November 15, 2022, 10:34:10 pmUnfortunately, right now my firmware doesn't support balancing even if you were to add the balancing resistors to the PCB. I highly doubt the stock firmware does either, although I guess I can't say for sure.If you were to replace the BMS with a different BMS module, you'd have to figure out some way to connect the vacuum trigger to a switch on the new BMS to turn it on. Since the vacuum trigger literally just pushes a button on the battery to turn it on, the BMS has to handle turning the vacuum on when the button is pressed. I'm not familiar with the various BMS modules but if one of them had an output_enable pin you could attach to a button maybe it could work? It might be easier to attach the balancing module in addition to the stock BMS and let the balancing module do it's thing when it wants, although I'm not sure how it decides when to balance or if there would be any leakage current that could slowly drain the battery over time.

author: tude888
author_rank: Newbie
timestamp: November 19, 2022, 01:37:01 pm
content: Thank you for getting back to me so quickly.The BMS boards I was able to find are simple: the charging and output ports are the same. two wires (see attached).My (very crude) solution is to connect the BMS directly to the charging port, and insert the trigger switch between the BMS and the vacuum motor. The problem with this solution is that the user will be able to turn on the vacuum while it's charging. I don't think this could cause any major problems unless I'm missing something.Sadly the vacuum charging plug has only two pins. If it had three, I could probably wire it so it would cut off the motor when plugging in the charger.The other alternative would be to put together a simple circuit, maybe 3 - 4 transistors to cut off the load when the charger is plugged in. I'll put together a schematic, but first I want to test the BMS idea.Will keep you all posted.

author: KalleMp
author_rank: Newbie
timestamp: December 03, 2022, 07:55:02 pm
content: Quote from: tinfever on August 18, 2022, 09:53:00 pmI wonder if you might like to save the time, cell voltages and temperature every time the trigger is activated and released, same for charger insertion. It might give ideas on how the batteries behave and give warning of failing ESR. I would be happy to sacrifice the bytes of EEPROM and the wear will likely never become a problem. It could be used to snapshot the values when charging by pressing the trigger or plugging in the charger while doing load tests and then reading the data. Using IR-Da or RC5 codes could get data out without opening the case perhaps.Your project has been phenomenal and just keeps on giving now that it supports V8 with just funny lighting effects.

author: KalleMp
author_rank: Newbie
timestamp: December 03, 2022, 08:16:14 pm
content: Quote from: tude888 on November 15, 2022, 10:34:10 pmThe Dyson board also manages the power switching, a lot of amps and using a switch would need a beefy switch. Also there is not much space to add a second board. Connecting to each cell and leaving a multi-pin balancing charger connection on the outside is probably the easiest. A possibly simpler balance capable board could be made that simply turns on the output when you press the switch but you would loose a number of protection modes. Making a board that includes balancing support but is otherwise the same is also possible but might be more money than it is worth.What is a cunning idea though is to do the design and order some boards etched, perhaps even a few prototypes populated at a service in the east, add the GitHub repo name to the silkscreen layer that includes the Hex File and BOM and some eastern knock-off shop will start making the boards at a price we could only dream of achieving, soon to be sold on Amazon and then callously ripped off by Amazon and sold under their own brand.This may be the correct way to make open-source-hardware affordable. Design and let it get copied in the east. Instead of bemoaning the rip-off, expect and embrace it.

author: tinfever
author_rank: Regular Contributor
timestamp: December 05, 2022, 02:09:49 am
content: Quote from: KalleMp on December 03, 2022, 08:16:14 pmApparently there is a Russian firmware version (not open source) that actually sends debug info out over the LED like you mention. It's a really cool idea. Now that I think about it, ideally you'd be able to have your smartphone camera decode it with no outside electronics required!Although if the phone camera is limited to 60 fps, that might limit you to 60 bits per second of data absolute max if you only use on or off. I wonder how much data you could encode in the colors of the LED?This is kind of insane but this paper makes it sound like the researchers managed to transmit 47 Kbps! It sounds like they are using a single RGB LED but I can't tell how they are getting 264 symbols/frame with a single LED."47 kbit/s (264 symbol/frame × 3 bit/symbol × 60 frame/second)"https://opg.optica.org/oe/fulltext.cfm?uri=oe-27-23-33840&id=422856it be clear, the odds I actually implement anything like this are pretty much zero. It'd be really cool but unfortunately being cool doesn't pay the rent

author: SilverSolder
author_rank: Super Contributor
timestamp: December 05, 2022, 11:42:11 am
content: Quote from: tinfever on December 05, 2022, 02:09:49 amBeing cool is much more important than paying the rent, though, so some kind of compromise needs to be achieved!

author: Steve1M
author_rank: Newbie
timestamp: January 20, 2023, 05:35:31 pm
content: Just joined this forum.-Such a relief to find this thread and your priceless youtube material, very much appreciated.-I have V8 with SV10 battery.-I sourced some Molicel 20700A cells, and have successfully changed out individual cells twice in the past, soldering, with no issue.-Poor performance yet again, tired of repeated strip down of pack, so decided to replace all 6.-Bought ten brand new Molicels, (expensive here, in UK) and and spent a long time performing discharge tests on quality RC iCharger, 2A down to 3V/cell, and managed to select 6 with only 40mAh between best/worst. Really lucky.-Charged all to exactly 3.85V each.-Spot welded them all in yesterday, which I was really pleased with, after having experimented for an eternity first.-End result - 4 x red LED flash if press trigger, or plug into charger.If hold trigger, 4 x red, then 1 x blue.-Lots of web searching, to discover this Dyson PCB "kill feature", and additionally, was absolutely shocked to discover lack of BMS balancing function (an absolutely essential function of any BMS...unbelievable).....absolutely furious, after so much cell research/welding prep etc.-Anyhow, I only wish to be able to unlock the BMS, changing the 2 x values in the eeprom positions, and have a couple of questions:--a) Can someone please tell me the correct pcb mapping (N7,N3,N4,N8,N9) to Vpp/Vdd/Vss/Data/Clock.-b) Also, if my pack is all assembled, do I need to check the Vdd box, or is the chip powered within the pcb?-Many thanks, Steve

author: tinfever
author_rank: Regular Contributor
timestamp: January 20, 2023, 09:58:21 pm
content: Quote from: Steve1M on January 20, 2023, 05:35:31 pmOn the GitHub repo (https://github.com/tinfever/FU-Dyson-BMS), part way down under "How to install it" there is an image showing the correct programming pinout. Edit: I'm 99% sure the pinout for the V8 is the exact same order, just with the ground pin in the same group. Reasons:Just realized I never really thought about the V8/SV10 pinout. Given others have reported success with the V8's, not mentioning any pinout differences, another person (Aleksey1406) traced out some of the circuitry for the V8 and that also looks the same (https://github.com/tinfever/FU-Dyson-BMS/issues/20), and also someone else (dr-mark-roberts) reverse engineered part of the schematic long before I did any of this and their info matches (https://github.com/dr-mark-roberts/open-dyson-battery/tree/master/hw/docs), I think it is the same.I recommend letting the microcontroller be powered by the PCB (Leaving the box unchecked, I believe.) You'll need to do something to wake up the BMS like push the button and apply a magnet (if applicable), then run the programming software while it is awake. I believe this is the safest method, although supplying VDD from the PicKit will work too, I'm just slightly more suspicious about doing it that way given how many times I've broken the VDD regulator portion of the ISL94208 IC for unknown reasons.Hope that helps! Good luck!

author: Steve1M
author_rank: Newbie
timestamp: January 20, 2023, 10:19:46 pm
content: Yep, it's in the same order.....thanks.Pic - bit concerned about how long it retains power if use magnet, press switch...will it corrupt if I mess up and it powers down mid-write?Thanks for your intetest/time.

author: tinfever
author_rank: Regular Contributor
timestamp: January 21, 2023, 12:59:50 am
content: Quote from: Steve1M on January 20, 2023, 10:19:46 pmOnce it is in programming mode, the PIC isn't running normally and so it won't shut down on it's own. You'll notice that if you place the magnet and press the button to wake it up, then take away the button press and magnet, it stays awake for a bit. This is because the software inside decides when it is time to turn off again. I think just having the programmer connected and clicking Tools > Check Connectivity while it is awake is enough to get it into programming mode and then it will wait indefinitely for you to do whatever until you remove the programmer.I wouldn't worry about it powering down mid-write. Since you are only editing the EEPROM hex to unlock your BMS, take very special care to configure the programming software correctly to only program the EEPROM. I believe the correct checkboxes and buttons are listed previously in the thread.

author: Steve1M
author_rank: Newbie
timestamp: January 21, 2023, 10:21:50 am
content: Excellent!!!Many thanks for your concise, detailed explanation.

author: Steve1M
author_rank: Newbie
timestamp: January 23, 2023, 11:49:54 am
content: Followed your guide.Silicon goop on pcb actually peeled away cleanly, using wooden toothpick to get under it, once I had cut around the perimeter really carefully using a fine-tipped scalpel blade, to avoiding shorting anything.Residual silicon in the plated through holes popped through on insertion of pins.-Found magnetic switch only activates when placed at one end or the other. If too central it will not activate.-I confirm that all connected fine for my V8 SV10 pack using same pin designations as your V7 photo as follows (white arrow on Pickit being pin 1):--N7>1 VppN3>5 CLKN4>4 DATN8>2 VddN9>3 Vss-I just disabled Program Memory, took a read, then just changed EEprom position 1E to 00, as per dvd4me's guide....now activated with blue LED when hit switch!!!-If brave enough, in future, will test your full modded firmware on a spare tired pack, and see how it behaves, considering difference in number of LEDs between V7 and V8.-Many thanks again to yourself, and Mr "dvd4me" for your boundless generosity.-Steve

author: dvd4me
author_rank: Regular Contributor
timestamp: January 24, 2023, 02:27:00 am
content: Quote from: Steve1M on January 23, 2023, 11:49:54 amYeah, dvd4me here is happy you managed to turn back on your "blue lights". Thanks to tinfever, to kindly support you over the path of "empirical" way of altering the eeprom.Even though he tried to lure you to the "dark side"you resistedRemember, once you go there there is no turning back.BTW, did you checked my other li-ion deep discharge recovery videos? It works for power tools battery or laptop ones too.Or the PS3 de-lid and restore from RLOD, by applying direct pressure on the silicon die.Cheers

author: Steve1M
author_rank: Newbie
timestamp: January 24, 2023, 12:49:23 pm
content: I'll take a look at your other vids, thanks.-With regards to balancing the pack periodically, everything is so snug in the case, that I don't even have room to add wiring and JST-XH connector.-I have therefore ordered 7 x single pin male 8mm pogo magnetic connectors.-Will bridge pin to outer, (maybe this will marginally increasing contact integrity when attached), drill 9mm holes in sides of pack shell, and use these to tap off the cells to do a proper balance charge on one of my RC chargers periodically, plugging holes with 9mm blanking/blind grommets when not in use.(Note...I have plated steel strip. This will probably provide good contact for their non-magnetic pure nickel strip also, as 20700 have steel case, and magnets are strong)-This will save the frustration of repeatedly struggling with those battery shell tabs, yet again, which is always a cumbersome exercise.-I realise that all the above sounds a bit obsessive, but I have always had the maybe over-optomistic view that, if you look after/maintain things properly, they will last forever.(Have Black Decker dustbuster, 30 yrs old still going!!! Just keep the motor bearing lightly oiled, and added Lifepo4 cells many years ago....similar story leccy drills/screwdrivers etc...latter 30yr old BD9019 with lovely metal planetary gearbox..tiny dab molybdenum grease now and again, nicad replaced with 26650 salvaged Life cell years ago, all still good)-Gone off-topic I'm afraid..apologies.-Rgds, Steve

author: tinfever
author_rank: Regular Contributor
timestamp: January 25, 2023, 02:46:39 am
content: Quote from: Steve1M on January 24, 2023, 12:49:23 pmIf you wanted to be really slick, you could install a multi-pin magnetic connector like this (or equivalent) :https://www.adafruit.com/product/5468I've never used these though. I might be a little worried about shorting the connections accidentally, but you could probably add some series resistors and a cover and be safe enough.

author: SilverSolder
author_rank: Super Contributor
timestamp: January 25, 2023, 10:46:21 am
content: Quote from: tinfever on January 25, 2023, 02:46:39 amThat's a pretty schmick connector...

author: ruddlescounty
author_rank: Newbie
timestamp: February 27, 2023, 05:22:57 pm
content: Slightly related, sorry! with all the experience on here - does anyone know what the 10 red flashing light sequence means on the dyson SV03? i have balanced a battery previously refusing to charge; all looking good (reporting 1700mah capacity) but when i put it into the vacuum i get the 10x red. the batt still has its cover off and balancing cables soldered on - but i cant see any "body" switches inside to check for this.so, just asking in case anyone knows...

author: rulof
author_rank: Contributor
timestamp: February 28, 2023, 07:20:34 am
content: apparently, a strong voltage drop during start-up. 10 red is an error in the charging process. if you replace the batteries should work fine.

author: ruddlescounty
author_rank: Newbie
timestamp: March 08, 2023, 05:56:42 pm
content: thanks for the reply.got a few of these dyson batteries.Is there anywhere i can see a list of codes and meanings?latest one is 10x BLUE flashes. this is after i have rewritten eeprom from a 32x red flash battery.several balanced charge/discharge cycles later - all indicating approx 1550mAh capacity, i now get the 10xBlue when i press the battery button.any ideas?thx

author: rulof
author_rank: Contributor
timestamp: March 09, 2023, 10:54:01 am
content: Quote from: ruddlescounty on March 08, 2023, 05:56:42 pmit's clear without ideas here.it is necessary to replace the batteries.

author: tinfever
author_rank: Regular Contributor
timestamp: March 09, 2023, 11:00:38 pm
content: Quote from: rulof on March 09, 2023, 10:54:01 amI'm not sure you necessarily need to replace the cells. I'm not sure there is any good info out there on what the stock firmware LED codes mean, specifically. I'd check the Dyson manual for any clues and Google around but if you can't find any info on that blink code, it's possible no one knows. You could flash my custom firmware (FU-DYSON-BMS) to get more specific LED codes if you wanted. Also, make sure it isn't something simple like the battery needing to be plugged in due to a fully_discharged flag being set or something, or the battery turning itself off because it isn't seeing a large enough load. Other than that, it's possible your cell capacity is okay but the ESR is too high so as soon as you try to use it with a high current load like the vacuum, the cell voltage drops and it goes in to low voltage cutoff.

author: rulof
author_rank: Contributor
timestamp: March 10, 2023, 11:30:37 am
content: Quote from: tinfever on March 09, 2023, 11:00:38 pmI've tried it many times already. even with a capacity of 1800-1900 milliamps, the batteries do not pull like that. on your firmware, most likely there will be error 16.

author: tinfever
author_rank: Regular Contributor
timestamp: March 10, 2023, 10:06:50 pm
content: I've uploaded Google Translate images of rulof's photos for anyone else.Quote from: rulof on March 10, 2023, 11:30:37 amWould you be able to share that entire document you took a picture of? It looks very useful.Also, would you be able to measure the VBACK pin of the ISL94208 with a scope when the error 16 occurs on trigger pull on a bad battery? I'm curious if VBACK is dipping below 2V, and if it is dropping that low, I'm curious if adding at 10uF capacitor to the VBACK pin helps any.My previous theory was that when the output is short circuited, the current wouldn't be enough to trip the short circuit protection but it would be enough to drop the battery cell voltage very low, causing the power to the VBACK pin to go too low, causing the ISL94208 to reset. In theory the same thing could happen with older battery cells with higher ESR when they aren't being short circuited but just subjected to inrush current demands. If my theory is correct, extra capacitance on the VBACK pin might let the ISL94208 ride though the inrush current voltage drop. This might also be why the ISL94208 reference design includes a 10uF cap there (which Dyson omitted).

author: rulof
author_rank: Contributor
timestamp: March 11, 2023, 07:20:29 am
content: Also, would you be able to measure the VBACK pin of the ISL94208 with a scope when the error 16 occurs on trigger pull on a bad battery? I'm curious if VBACK is dipping below 2V, and if it is dropping that low, I'm curious if adding at 10uF capacitor to the VBACK pin helps any.currently out of stock with error 16. as soon as it appears, I will take measurements.

author: bluesight
author_rank: Contributor
timestamp: March 13, 2023, 06:30:24 pm
content: Quote from: tinfever on May 03, 2022, 11:33:40 pmI think I have this problem. I did your firmware update. Unfortunately, I may have done a short when fiddling the switch near the exposed posts. Firmware update successful with all blink/color codes working. Charge codes working. When in vacuum and pulling the trigger, I get the 16 red blink "brownout" code. Tested vacuum motor with external supply and it works. Did attach VDD at PIC program time. So multiple opportunities to glitch the ISL94208. If that's the problem, this post seems to indicate that the ISL can be reset (or not). I see in your code that you provide a reset segment...?void ISL_Init(void){ISL_SetSpecificBits((uint8_t[]){WriteEnable, 5, 3}, 0b111); //Set all three feature set, charge set, and discharge set write bitsISL_SetSpecificBits(ISL.FORCE_POR, 1); //Make sure the ISL is clean resetSo, is this the problem, and is it permanent or fixable?Tnx!

author: tinfever
author_rank: Regular Contributor
timestamp: March 13, 2023, 07:29:50 pm
content: Quote from: bluesight on March 13, 2023, 06:30:24 pmFor future reference, the dedicated forum thread would be the best place for questions like this:https://www.eevblog.com/forum/projects/fu-dyson-bms-an-(unofficial)-firmware-upgrade-for-dyson-v6v7-vacuum-bms/If the battery is able to charge properly, I think the ISL94208 is working okay. I don't recall precisely what checks I run using the ISL94208 but I suspect at least one of them would fail if it wasn't operating. The PIC wouldn't run at all without the 3.3V from the ISL, and the ISL handles the multiplexing of all of the battery cell voltages so unless it got stuck reporting an identical valid result for every cell, the cell voltage checks wouldn't pass at all. Also, I just looked at the code again, the only way charging would work properly is if the ISL brown out check function passed, which would only work if the ISL is responding to I2C commands properly.Please also check if the battery LEDs act normally if you press the button with the battery out of the vacuum with no load attached.If that works fine, I suspect your battery cells have too high of an ESR and the load of the vacuum might be causing the cell voltage to drop enough to brown out the ISL. This is what rulof and I were discussing. I don't know what equipment you have but you could try to measure the battery ESR either with a battery tester, or by applying a known load and measuring the voltage drop. You could also try to measure the voltage drop on the VBACK pin of the ISL94208 during vacuum startup with an oscilloscope and see how far that voltage is dropping.My current theory is that it is the inrush current of the vacuum triggering these errors on batteries with high cell ESR, but at least some batteries might be able to sustain the normal running current if we could ride through the inrush-caused-voltage-drop.

author: PavChu
author_rank: Newbie
timestamp: March 24, 2023, 07:00:36 pm
content: Hello everyone, thank you for participating in this forum, especially the author of the custom firmware (FU-DYSON-BMS) and his colleagues and inspirers. This allows many people to solve their problems with batteries, as well as reduce the number of used batteries in the trash.I want to ask the guys. Can PICkit 3.0 (when properly connected according to thewiring diagram) automatically not detect PIC16LF1847 on the 61462 PCB and the 188002 PCB. There are two non-working ones. The EEPROM is also not displayed in both cases. When the voltage is applied via PICkit 3.0 to a PCB that is not connected to the power elements, the indicator light reacts and changes color when the voltage changes from 2.5 to 5.0 V. When connecting the PCB to the elements, the LED indicator does not react in any way. I thought maybe the PIC16FLF1847 is just disabled somehow, maybe with MPLABX? In any case, Dzyakuyu syabry!

author: tinfever
author_rank: Regular Contributor
timestamp: March 24, 2023, 09:30:40 pm
content: Quote from: PavChu on March 24, 2023, 07:00:36 pmThe latest recommendation is to not power the board with the PICKit and to leave the VCC wire disconnected. The battery should be able to power itself by pressing the button and applying a magnet to the reed switch if applicable. The PIC is a 3.3V version so you definitely shouldn't supply 5V. Any working board should be auto detected by the PICKit software I believe.

author: PavChu
author_rank: Newbie
timestamp: March 27, 2023, 05:34:16 am
content: I got you, Tinfever! Thank you sincerely

author: rulof
author_rank: Contributor
timestamp: May 11, 2023, 02:33:24 pm
content: I have two dyson v10- sv17 batteries.one is fully functional,the other is blocked.the atasamd20e15 processor is installed.there is a programmer j link v9.when connected, he wants to erase the firmware.tell me is it possible to read and flash only eeprom?by analogy with dyson v7-v8?

author: deuteron
author_rank: Contributor
timestamp: May 29, 2023, 11:58:48 am
content: Dear Alll,first of all many many thanks to all, who have contributed to this extremely interesting thread ! The work of tinfever & co is absolutely marvelous ! I read the thread from the very beginning since I'm a 'proud' owner of a Dyson V8 (SV10). The device was sold with a working battery, but the preowner said it is running only about 20 min with the actual battery. After having learned so much about the interior of the dyson batteries, I was curious to examine mine in more detail too. I'm not planning to 'repair' the pack or to change the cells, it's just that I wanted to now what's wrong. So I drilled alltogether 12 holes in the two side walls of the casing to be able to measure the individual cell voltages. Against my suspicion the pack is balanced pretty well, showing voltage between 4.07 and 4.12 V with an average of 4.10 V in the completely charged state, i.e. the charger stopped charging, all LEDs off. After all investigations done by various people about this batteries this behaviour was unexpected, at least to me. My imagination was so far that the charger charges the cells until the highest of them reaches 4.2 V, the unsual maximum voltage of Li ion cells. Ok, it's not much of a capacity which is unused in my case (got 24.5 instead of 25.2 V max). Nevertheless it looks like the charger doesn't use the full cell capacities. What do you think, could this be a fault from factoty, some bad adjustment of the parameters or even a 'feature' to sell faster and more batteries ?What's your opinion ? Did you see such an behaviour in your battery packs too ?Best regardsStefan

author: tinfever
author_rank: Regular Contributor
timestamp: May 29, 2023, 04:48:04 pm
content: Quote from: deuteron on May 29, 2023, 11:58:48 am20 minutes might actually be a normal run time. I don't recall what the vacuum is rated for when new. Even if that is actually low, I think it is normal for battery cells to have reduced capacity as they have more charge/discharge cycles on them.I wouldn't worry about your pack only charging to 4.1V. It's possible on the V8 vacuums they charge to a lower voltage to preserve battery life. The ISL94208 BMS IC has an analog out tolerance of -15 to +30mV anyways, so it could just be error stacking. Also, once the battery is removed from the charger, I think it isn't uncommon for the voltage to drift down slightly, especially since the Dyson charging doesn't do a full constant voltage then constant current charge cycle. If you haven't already, I would watch the voltage on the highest cell when you connect the charger and see what it does.

author: deuteron
author_rank: Contributor
timestamp: May 29, 2023, 06:31:06 pm
content: Hi, thanks fpr the reply,next, what I'll do is measuring the capacity of the pack, then we'll see whether or not the cells are weared in some way. These 20 min are just a guess, the seller told me, that the battery decreased in running time since he owned it. That's all I know. Is it possible that the charging voltage is programmed to decrease with time ? Frankly, I wouldn't believe.Another question, maybe somebody knows: I was somewhat inspired by the discussion here to learn more about power tool batteries and the way these are BMSed. It seems to be the case, that usually there is no active balancing in most cases either. Dyson doesn't seem by far not the only company saving the extra money for a balanced charging. Also that the battery is blocked by the BMS in the case of a too strong unbalance is apparently not an exclusion. I'm just wondering what the special problem of the Dyson batteries is that they give up allready after about one or two years. Ok, the non resettable blocking via eeprom is some particular feature of the Dyson batteries. To my knowledge, resetting of a blocked power tool battery seems usually more simple. But this can not be the reason for this particulatly short running time. What is it ? Perhaps the max charging voltage intentionally diminishes with time (see above) ? Or did I overlook something else ?GreetingsStefan

author: tinfever
author_rank: Regular Contributor
timestamp: May 30, 2023, 03:49:45 am
content: Quote from: deuteron on May 29, 2023, 06:31:06 pmI doubt they do anything outright malicious like having the cell charging voltage reduce over time. It's probably just aging of the cell from the charge and discharge cycles I'd guess. Maybe power tools have a different usage profile that means the cells last longer? It's possible that most people's Dyson sits on the charger all day long which means it spends most of it's life at 100% charge, whereas maybe a power tool is only charged once empty? Maybe they just picked a different cell type? Perhaps the thought isn't right to start with? Maybe power tool batteries degrade the same but people are worse at counting number of screws driven on a charge vs number of minutes vacuumed on a charge? You'd need lots of data before considering declaring a trend in power tool vs vacuum battery life spans.

author: deuteron
author_rank: Contributor
timestamp: May 30, 2023, 05:45:02 am
content: Yes, Tinfever that's all true and yours are similar to my thoughts. The idea with the long time in a 100% state sounds reasonable. And it would be certainly true, if the charger wouldn't stop charging after reaching full state. But as you kow, it ceases charging after a couple of minutes. Nevertheless, beeing fully charged is not a good idea over long time storage. Concerning the cell inventory you should have much more experience than me, since you dismanteld lots of packs, right ? So far - at least for the price of a new pack - I'm believing, they are using first class (japanese) cells, but this might not be the truth. I personly wouldn't also think that they act maliciously in any way. Nevertheless, when you look throughl all the forums and the comments at Amazon, it's more or less purely the battery, about which people are complaning. My personally strongest concern is more the very thin strength of the plastik housing, which causes these vacuums to crack, and this mostly at the handles, where the strongest forces are applied while unsing them. It makes no sense to speculate any further. Yesterday I ordered ordered an electronic load at Amazon and we will see what the capacity will be.BTW a good workaround seems to be the usage of a quality battery pack from a power tool. I'm using the uasual adapter from for the V8 with a fitting to the Bosch 18V cells. The 4Ah procore is working pretty well even it is only five instead of six cells.I'll keep the forum informed, if somebody is interested,sincerely,Stefan

author: deuteron
author_rank: Contributor
timestamp: May 31, 2023, 08:30:09 pm
content: Hello All,the electronic load, which I've ordered, arrived today. Tomorrow I'll do the first capacity measurement with the Dyson SV10 battery pack. Just one additional question, because I'll try not to brick the pack:Is there any minimum output voltage, which may cause the BMS to lock when fallen below ? Otherwise I would try 15 V discharge minimum being 5 x 3V. Surely I will measure all the cell voltages individually through the discharge process, in order not to get too much of an unbalance. If somebody knows, please let me knowStefan

author: tinfever
author_rank: Regular Contributor
timestamp: May 31, 2023, 09:29:37 pm
content: Quote from: deuteron on May 31, 2023, 08:30:09 pmThe vacuum normally runs until the BMS turns off the output when the voltage goes too low, so it doesn't matter what you set. Assuming you are leaving the BMS in the loop and not discharging the cells directly.

author: deuteron
author_rank: Contributor
timestamp: June 03, 2023, 08:42:34 pm
content: Hello,just if someone is interested: I tested the capacity (at 3A) of the SV10 battery pack, about which the preowner told me that it is not as good as in the beginning. As said, cell balance was pretty good, max charging voltage ~4.1V in average. The meassurement (3.0V cut off on the weekest cell) resulted in a little bit more than 2000mAh. The pack is marked with 2800mAh on the casing. Ok, looks like some wear of the cells. But, the interesting thing is the following: I also own a (red blinking) SV10 pack gotten together with another V8. Since I didn't plan to reprogram it, I just took it apart th salvage the cells. These cells appear to be LG ones (LGDAHD2C1865) with a max current of 22A, so well suited for the Dysons consuming around 20A max. I googled for these cells and found the data sheet. The cells have a capacity rating of only 2100mAh even though 2800mAh is explicitly written on the casing of the pack ! This agrees well with my measurement and shows that the pack is practically like new, although used for more than one year.In principle this is just another story about wrongly declared batteries from China. The interesting point here is that even Dyson itself doesn't seem to care about. I personly will stick to the power tool battery solution which is astonishingly working well even though the packs are only 18V.GreetingsStefan

author: dax2
author_rank: Newbie
timestamp: July 09, 2023, 12:23:09 pm
content: Quote from: dvd4me on February 16, 2022, 03:54:11 amhi dvd4me - on your videosomeone posted they had modified the eeprom locations using IPE software (and pickit4 ?) I am afraid to try and have succeeded using the standalone however I just spotted this option - is this Erase All setting not perhaps the problem?

author: Manuel Wald
author_rank: Newbie
timestamp: November 06, 2023, 08:40:06 am
content: Hello everyone,I couldn't find any other forum where the topic fits, so now I'm writing here.I have already repaired some SV09 and SV11 batteries using Tinfieber's instructions, thank you very much.Also carried out a cell replacement of defective cells and installed the new firmware with PICIT.I now have several Dyson V7 batteries of type SV10 to repair.Error flashes red 4 times, as described in the video, a battery flashes blue all the time!?I balanced the cells to an even voltage and then used PICIT to rewrite the code according to the video.Unfortunately the BMS is now without function, no LED display!What can I do?Is there a firmware that I can install on the others?How do I repair the other batteries?Thanks for your feedback!Kind regards from Austria.Manuel

author: tinfever
author_rank: Regular Contributor
timestamp: November 06, 2023, 05:08:20 pm
content: Quote from: Manuel Wald on November 06, 2023, 08:40:06 amSome have reported that my firmware will work on SV10 batteries as well, although the LEDs may not be correct.https://github.com/tinfever/FU-Dyson-BMS/issues/8If you were trying to change the value in the EEPROM to reset the battery, you have to be very very careful to not erase the firmware in the process. There is a checkbox somewhere, IIRC, that if you don't set, it will erase the flash memory that contains the firmware when you try to overwrite the EEPROM. This would cause a battery to not respond or light up at all.

author: Manuel Wald
author_rank: Newbie
timestamp: November 09, 2023, 12:07:05 pm
content: Hello,Thanks for your answer, unfortunately I can't find an IIC in the program, do you have a screenshot for me, thank you.

author: tinfever
author_rank: Regular Contributor
timestamp: November 09, 2023, 05:24:29 pm
content: Quote from: Manuel Wald on November 09, 2023, 12:07:05 pmBy IIRC I just meant "If I recall correctly".There is more info here:https://www.eevblog.com/forum/reviews/dyson-v7-trigger-cordless-vacuum-teardown-of-battery-pack/msg4016680/#msg4016680Make sure you are using the old PicKit3 programmer software as mentioned and that you uncheck the "Program Memory - Enabled" checkbox.

author: NeilP
author_rank: Contributor
timestamp: November 14, 2023, 06:25:06 pm
content: I have posted a new topic on these..not sure if a new topic or tagging on here or another post was the best thing to do ..so opted for a new post.If any of you ladies and gents have the time , I'd appreciate any input om thisThank youhttps://www.eevblog.com/forum/repair/beginner-dyson-battery-question-sv03-sv05

author: gold oxide
author_rank: Newbie
timestamp: November 16, 2023, 05:46:44 am
content: I have one of those batteries (Dyson V6, SV3) here. A friend of mine had already removed the case and pulled the switch from the spring contraption weeks prior (not knowing this will permanently pull the trigger). So the pack to my understanding kept the µC awake and switched the mosfet without a load until it went into undervoltage shutdown or some kind of timeout failure mode.Cells were around 3.45V each when I got it. No LED, no response to the switch or plugging charger. Charged it in series with a bench PSU to 25V and still no reaction at all.I reset it by removing the (-) tab from the pack and it went into red blink lockout. Just for posterity: Is there any other way to recover the battery from the completely non responisve state without triggering lockout?Great work on that firmware tinfever, will have to get a PicKit and give it a try.

author: Manuel Wald
author_rank: Newbie
timestamp: November 16, 2023, 11:01:09 am
content: Thanks for the reply,I found the checkmark and it works!!!Now I have two more batteries that I would like to bring to life:Type SV10 from Dyson V8 vacuum cleaner with 20700 cells, BMS 180207-02/04When I press the button and apply the magent to the reed switch, the battery flashes blue, approx. 3-5 times.I then measured all the cells, 3.8-3.9 V, I then connected my balance charger directly to the cells and charged the battery to 4.2 V.All cells checked with a measuring device, from 4.17-4.2V, internal resistance 25 mOhm.Flashing blue light still remains...Do you have any tips on how I should proceed?Please provide feedback, thank you.

author: tinfever
author_rank: Regular Contributor
timestamp: November 16, 2023, 04:58:04 pm
content: Quote from: gold oxide on November 16, 2023, 05:46:44 amUsually connecting the charger like you did should dosomething. I can't recall if I've seen one that's completely unresponsive before. I would have suggested charging up all of the cells directly to a safe range, because it's possible that the BMS won't wake up at all if the cells are too low, but it sounds like you already tried that to.Quote from: Manuel Wald on November 16, 2023, 11:01:09 amI'm not sure about this one. Have you connected the normal charger? If the BMS sees the cell voltages get too low, it can do a normal low battery lockout until the charger is plugged in, even if just for a second.

author: NeilP
author_rank: Contributor
timestamp: April 02, 2024, 08:16:25 am
content: I too have the same 180207 -01-04 battery SV10 from a V8Pin out from one of the video I watched, compared to the lead I made for doing my V6 BMS, seems to indicate the wiring order is different. But it is going to require some much much more careful Pause /Play / Pause /screen zoom mouse action of the YouTube video to get the wiring correctThe attached pics are what I have so far which I think are good to go… but…If anyone has a definite wiring of PicKit pins to the header on the 180207-01-04 BMS it would be appreciatedhttps://youtu.be/ENY8xcczowk?si=feZlTp8F8Rj3eixi

author: NeilP
author_rank: Contributor
timestamp: April 02, 2024, 09:22:11 am
content: OK, I got out of bed and fired up the computer and did the deed. far easier on computer screen!Confirmed that with the help of a diagram I found , that it is the same wiring as the V6 BMS pinout and flashing back the 00 and 7F to those two locations does re set the 180207 - 01- 04 batterySince it is now workmen and i only have the one battery , I will not be trying the firmware flash. But I am happy to do a read of the data , and upload here if it is of use.