Editing a dump file from battery EEPROM - Page 1
Forum section: electronics / beginners

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 23, 2025, 02:05:14 pm
content: My old old laptop Toshiba Tecra M10 from 2007 has a dying battery. So I decided to replace the 18650 cells inside. After all the cells are replaced, I realized the battery has a EEPROM in the BMS that limit the full capacity to only around 19%. I did a lot of reading and I think I need to reset the FCC (fully charge capacity) in the EEPROM to reset the battery.The batteryModel number: PA3587U-1BRSListed info from battery label:DC 10.8V44WhIt is a 3s2p setup so I think nominal voltage should be 11.1V, min 9.6V and max 12.6VThe EEPROM chip inside is labeled as 34F04WP. I think it is a 24s chip so I can read it with ch341 programmer.I've attached the dump file.I also attached some picture of when I use upower and acpi to get battery data from the laptop.It seems that acpi data is not same as upower data.Key data:The one I want to find is energy_full at 8.305Wh. or 738mahI checked the file and it seems that those data are not recorded in hex but rather in reverse BCD.I think I found the min voltage 10.8V by searching 80 10and voltage of 11.24V by searching 24 11.Energy_full_design 43.2V by searching 20 43.But I cannot find energy_full by searching 30 08.Is my theory wrong? Or it is encoded in another way?The cell I put in is 2500mah each so new capacity should be 5Ah which translate to 54Wh.Also one strange thing is voltage of 11.24V is not changing. It is always 11.24.Any idea how can I crack this case?

author: fzabkar
author_rank: Super Contributor
timestamp: May 23, 2025, 05:20:01 pm
content: Can you run the laptop for a while and dump the EEPROM again together with its updated stats? It might be easier to look for differences in the two dumps and correlate them against the differences in the reports.Is there a battery fuel gauge IC?

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 23, 2025, 06:00:40 pm
content: Quote from: fzabkar on May 23, 2025, 05:20:01 pmOk I will do that.But I may need to run it for a while till the full charged capacity change again before I retake the dump file.

author: CaptDon
author_rank: Super Contributor
timestamp: May 23, 2025, 07:09:36 pm
content: In the laptop bios bootup is there a 'Battery Learn' selection?? Many laptops have this built into the boot menu. It is how the BMS and laptop learn the capacity of the battery as it ages. The learning process will charge the batteries until they reach some terminal voltage like 4.05VDC and then it will discharge them by running your laptop until the lowest cell reaches around 3.0VDC. It will then repeat this operation at least once more until it learns an estimated capacity and uses that new number for the 'fuel gauge'. Don't be surprised if the process takes two to four hours!!

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 23, 2025, 07:34:59 pm
content: I looked into the bios and there is no battery learn function. The bios is pretty primitive.This laptop is from 2009 so may be that function is not cooked into the bios then.I can try cycle the battery a few time and see if that does anything. But other than that I think I will use it for a while till the full charge capacity change to take the dump again.

author: RoGeorge
author_rank: Super Contributor
timestamp: May 24, 2025, 05:37:02 am
content: Usually there is no need to manually edit the EEPROM.If you are sure there is nothing battery related in the laptop BIOS, try a complete charge discharge while the laptop is running: from a totally discharged battery, plug the charger and start the laptop, let the laptop running untill the charging stop, then unplug the charger and let the laptop to run on batteries until the battery discharges completely.If that does not adjust the capacity, you'll need to reset the BMS. There are service tools to reset the BMS by communicating with the battery directly, using the SMBus protocol. (for examplehttps://be2works.com/- just an example, I didn't check if be2works can unlock your battery model)Alternatively, search for "Toshiba BMS reset", or "<battery model> BMS reset", things like these to find if somebody else already reversed engineered. If you know the BMS controller IC type (inside the battery), try searching "<ICmodel> BMS reset", too.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 24, 2025, 12:27:33 pm
content: Quote from: RoGeorge on May 24, 2025, 05:37:02 amI did try to cycle the battery a few times, but I didn't not tried plugging in the charger before turning on. I will try that. This battery is not SMBus compatible, so it will needed to be edit the dump manually. To add salt to the injury, I need to desolder the bms from the cells and then desolder the eeprom before I can read it. It doesn't read when the eeprom is still sitting on the board. 😭I can check out resetting services, but it is unlikely it can be reset remotely. I search for similar battery with the same eeprom from Toshiba and they edit the dump and write back to the chip. But that site is for professionals who buy Lisence by years who reset battery for trades. I am not going to buy a Lisence just for my 1 battery.They probably already decoded the eeprom data for this chip.I just can't seem to figure out how to decode it other than reverse bcd.I think raw data is from acpi which show mah. But even with that, I cannot find anything in the eeprom. May be dynamic and static data are stored differently. May be I will edit the min voltage to 10 instead of 10.8v to confirm what I think is min voltage is correct.I am also worried that something may be wrong with the bms since the voltage now does not change and stay at 11.24v.

author: fzabkar
author_rank: Super Contributor
timestamp: May 24, 2025, 07:39:57 pm
content: Maybe this thread could give you some ideas?https://www.badcaps.net/forum/troubleshooting-hardware-devices-and-electronics-theory/general-electronics-technical-discussion/46821-help-identifying-this-chip-battery-controller-chip/page2

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 24, 2025, 08:21:36 pm
content: Quote from: fzabkar on May 24, 2025, 07:39:57 pmThat is very good information. Thanks.I checked and it seems that the battery in that thread has data stored in hex.I am thinking may be the data I got from ubuntu is not correct and hence I cannot find it in the battery EEPROM.May be I will wipe Ubuntu and install window and try to install mega raid controller to see if it shows different data.I was trying to update the BIOS of the laptop but dynabook link to the bios seems to be not working. It seems that the bios is not where to be found.Next time I open up the battery, I will check and see if I can find the battery controller chip. Should it be on the BMS?I wonder where they find this information.offset function value (hex) decoded value------------------------------------------------------------------------------------0x00 Check Byte 1 0x3C7F0x02 Remaining Time Alarm 0x000A 10 minutes0x04 Remaining Capacity Alarm 0x0078 120mAh0x06 EDV A0 Impedance Age Factor 0x00000x07 EDV TC Cold Impedance Factor 0x00000x08 Misc Options 0x000x09 Safety Overtemperature 0x000x0A Charging Voltage 0x1004 4100mV0x0C Reserved 0x00800x0E CycleCount 0x0032 500x10 Reserved 0x00000x12 Design Voltage 0x0E74 3700mV0x14 Specification Information 0x0021 0x0031 --> v1.1/PEC for bq2060A0x16 Manufacture Date 0x3D33 2010/9/190x18 Serial Number 0x0112 2740x1A Fast-Charging Current 0x0200 512mA0x1C Maintenance Charging Current 0x0000 0mA0x1E Pre-Charge Current 0x0064 100mA0x20 Manufacturer Name Length 0x0A 10 characters for Manufacturer Name0x21+ Manufacturer Name "LS1121001A"0x2B Light Discharge Current 0x04 ILEAK = 0.18mA (= 0x04 x 45 / 1024)0x2C Reserved 0x00000x2E Maximum Overcharge 0xFFB0 80mAh (= 0x10000 - 0xFFB0)0x30 Device Name Length 0x07 7 characters for Device Name0x31+ Device Name "3150301"0x38 Last Measured Discharge 0x0181 385mAh0x3A Pack Capacity 0x04BF 1215mAh0x3C Cycle Count Threshold 0xFC34 972mAh (= 0x10000 - 0xFC34)0x3E Reserved 0x000x3F Pack Configuration 0x64 0b011001000x40 Device Chemistry Length 0x04 4 characters for Device Chemistry0x41+ Device Chemistry "LION"0x45 MaxT DeltaT 0x8A 56C / 3.6C0x46 Overload Current 0x028A 650mA0x48 Overvoltage Margin 0x10 256mV0x49 Overcurrent Margin 0x0A 160mA0x4A Cell Under/Over Voltage 0xC6 2816mV / 4288mV0x4B Fast Charge Termination % 0x9C 100%0x4C Fully Charged Clear % 0xA1 95%0x4D Charge Efficiency 0xFF 100%0x4E Current Taper Threshold 0x09 i = 0x09 x 0.5025 / Rs = 45mA?0x4F Current Taper Qual Voltage 0x32 100mV0x50 Manufacturers Data Length 0x07 7 bytes of Manufacturer's Data0x51 Control Mode 0x04 0b000001000x52 Digital Filter 0x2D 50uV0x53 Self-Discharge Rate 0xE6 2% per day = 52.73 / (256 - 0xE6)?0x54 Battery Low % 0x12 7%0x55 Near Full 0x64 200mAh0x56+ Reserved 0x00000000000000000x5e VFC Offset 0x3C05 ****0x60 VFC Offset 0xA0 ****0x61 Temperature Offset 0xEA -2.2C0x62 ADC Offset 0xFB -50x63 Cell 2 Calibration Factor 0x000x64 Cell 3 Calibration Factor 0x000x65 Cell 4 Calibration Factor 0x000x66 ADC Voltage Gain 0x2792 101300x68 ADC Sense Resistor Gain 0x180E Gain = 625 / Rs (Rs = sense resistor)0x6a VFC Sense Resistor Gain 0x0F75 Gain = 409.6 / Rs (Rs = 0.10 ohm)0x6c VOC 25% 0xF1F0 3600mV0x6e VOC 50% 0xF18C 3700mV0x70 VOC 75% 0xF128 3800mV0x72 EDVF/EDV0 0x0CE4 3300mV0x74 EMF/ EDV1 0x0D48 3400mV0x76 EDV T0 Factor 0x00000x78 EDV C1/C0 Factor/EDV2 0x0DAC C1 = 13, C0 = 1720x7a EDV R0 Factor 0x00000x7c EDV R1 Factor 0x00000x7e Check Byte 2 0xA55A

author: fzabkar
author_rank: Super Contributor
timestamp: May 24, 2025, 10:00:44 pm
content: That info comes from the support tools and datasheets for the BQ2060A "Gas Gauge" IC.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 24, 2025, 11:42:24 pm
content: Quote from: fzabkar on May 24, 2025, 10:00:44 pmI see. Then I think i need to find out what charging chip I have on the bms then.

author: amyk
author_rank: Super Contributor
timestamp: May 25, 2025, 02:35:35 am
content: Have you done a full-empty-full cycle yet? A lot of older BMS, before they started locking things down, will use the last full capacity as the current capacity, so a full cycle is needed to get it to recognise the new capacity. It'll look like the battery is full but actually still charging, i.e. the mAh counts will keep going up, so don't unplug it at that point, wait until the cells have actually reached saturation. At that point it should take the full capacity and use that as the reference.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 25, 2025, 03:18:02 am
content: Quote from: amyk on May 25, 2025, 02:35:35 amI was charging with the laptop off. When the led turned green, I unplugged it. May be i will try leaving it continue to charge for a day and see what happens. Thanks for the suggestion.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 26, 2025, 07:07:33 pm
content: I just tried continue to charge after the charging light turned green for a few hours.When I check the capacity in UPower and acpi, it is still the same.I guess I will still have to open up the battery again and find the charging chip model.I opened up the battery again and the only other IC I can find other than the EEPROM is M909.I was searching and I think it is MAX909 which is a TTL single supply comparator.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 27, 2025, 01:24:22 pm
content: I did a second read and a compare.It seem that only the top part is changing. And the it is huge change to those numbers.I cannot really make sense of any of those changes.

author: squadchannel
author_rank: Frequent Contributor
timestamp: May 27, 2025, 01:37:23 pm
content: https://www.elektroda.com/rtvforum/topic1753555.htmlThe “M” logo (also seen in the mountains) is the Mitsumi logo. MM1309B, is a protection IC.It would be quicker if we could find the charging IC inside the main unit.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 27, 2025, 01:41:44 pm
content: Quote from: squadchannel on May 27, 2025, 01:37:23 pmI was trying to avoid it but it seems that it is time to dissemble the laptop.

author: squadchannel
author_rank: Frequent Contributor
timestamp: May 27, 2025, 01:43:15 pm
content: Wait, I found a schematic of the motherboard, so I'll have to investigate.

author: squadchannel
author_rank: Frequent Contributor
timestamp: May 27, 2025, 01:54:54 pm
content: I followed the I2C destination of the EEPROM and saw that it was connected directly to the micro (IC8972, TMP86FS49AUG).I thought the charging IC was managing it, but it was a more primitive way to manage it.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 27, 2025, 03:03:00 pm
content: Quote from: squadchannel on May 27, 2025, 01:54:54 pmThanks!The model number is different. But it seems the same.I see DC on page 98. It is probably around there.I modified 0x0150 to 00 00 and 0x178 to 50 12.When I check in /sys/class/power_supply/BAT1/uevent in laptop, the voltage min is now shown as 10V while voltage now is shown as 12.5V.When I check with acpi,design capacity is now 3200mAh instead of 3843mAhlast full capacity is now 615mAh instead of 738mAhWhen I check with UPowerenergy full design become 40Wh, instead of 43.2Whenergy full become 7.69Wh instead of 8.305Whvoltage become 12.5V instead of 11.24VCapacity is shown as 19.225% instead of 19.2245%.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 27, 2025, 10:41:56 pm
content: Quote from: squadchannel on May 27, 2025, 01:54:54 pmOh I missed this part. haha.So if it is going to the microcontroller, then it gives no hints about how to interpret the EEPROM data from I2C.Back to decoding then.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 28, 2025, 01:54:46 pm
content: OK. Took took apart the battery for the 3rd time and take data.I compared 1,2,3 time I took the data.At 1,2,3 respectivelyat 0x0300520 0526 0527I seem like it is increasing and is possibility the cycle count.at 0x070 is stable at 19. I am thinking may be that is the capacity %? 19%Since both of the listed energy_full_design and energy_full changed when voltage changed, those numbers can't be a set number in the EEPROM.There is probably another number that is not affected by voltage since energy_full_design should be static.I am thinking it should be 4000 mah as the designed fulled charge.So I searched with 0040 and there are 2 possible location.0x0152 00400x0198 0040I will charge the EEPROM and see what will happen.Update:Confirmed data location:0x0150 Voltage min0x0178 Voltage0x0152 Design Charge Full in mah0x0030 date in format day/month/yearAlso confirm that capacity should be stored in mahThe following assumption were wrong."at 0x070 is stable at 19. I am thinking may be that is the capacity %? 19%""FCC is stored as a ratio to full charge design" It has to be stored as an individual number. It has to be stored as some form in 769Cannot confirm about the assumption about cycle count yet. Waiting for the next read.

author: fzabkar
author_rank: Super Contributor
timestamp: May 28, 2025, 06:10:49 pm
content: Does this make any sense?Code:Offset(h) 00 02 04 06 08 0A 0C 0E00000170 2411 9900 0500 000000000180 2110 4800 0910 3400 9009 3400Code:2411 9900 -- 11.24V, 99%0500 0000 -- 0.05V, 0% ???2110 4800 -- 10.21V, 48%0910 3400 -- 10.09V, 34%9009 3400 -- 9.90V, 34% ???

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 28, 2025, 06:37:12 pm
content: Quote from: fzabkar on May 28, 2025, 06:10:49 pmI was reading about anther battery online Toshiba PA3832u-1BRS WITH CHIP 34F04 and it has really similar design. There was a dump file and it seems that it has the same structure.When I did a compare between the 2 files, those addresses with values that are way off. So it is unlikely.QuoteI dont think the battery can go below 9.6V which is the absolute min for the lithium cells.So I would think 0% is min at 9.6V.I modified the 0x0178 to 5012 before and it did not change the % of the battery level but rather changed the energy_full_design and energy_full value from acpi -V.So even though it is marked as voltage now in the system, it is probably voltage average? Or voltage nominal.It was a good try.I cannot find any value even remotely close to 769 in the file. I am starting to think may be FCC is not stored in the EEPROM but got interpreted in the microcontroller?By changing the energy_full_design, Vmin and V, the FCC should change after a cycle if it is calculated based on enerygy_full_design. Let's test it out and see what falls.

author: theflyingsquirrel
author_rank: Contributor
timestamp: May 30, 2025, 12:34:27 am
content: Quote from: fzabkar on May 28, 2025, 06:10:49 pmI am now thinking may be you are on to something with this after all.Those value may as well be voltage.I am now thinking2110 4800 -- 10.21V, low voltage, the led starts flashing0910 3400 -- 10.09V, critical low voltage, shutdown power9009 3400 -- 9.90V, lock the battery?I ran the battery in bios till it shuts down and wont turn on again.I then took out the battery and measure the voltage. It was 10.48V.