Looking for the pinout of the Li-Ion backup battery in HP Gen10 servers - Page 1
Forum section: electronics / projects

author: RoGeorge
author_rank: Super Contributor
timestamp: May 01, 2024, 04:25:00 pm
content: Anybody knows where I could find the connector pinout for the HPE 871264-001 cache backup battery, please?It looks like this:https://www.storagepartsdirect.com/hpe-871264-001-96w-smart-storage-battery-for-dl/xl-g10-servers/Has a 12 pins connector, with 3 red and 3 black wires, plus another 6 wires each of a different color: white, yellow, green, blue, brown and orange. I've searched online, including for pics, and couldn't find the pinout.

author: RoGeorge
author_rank: Super Contributor
timestamp: May 07, 2024, 07:08:30 am
content: Meanwhile managed to view the marking of the battery controller, it's a MAX17817, which (I guess) it's a MAX1781 IC customized for Hewlett Packard batteries.MAX1781 datasheet (so not exactly the MAX17817from this battery pack), looks like a BMS (Battery Management System) combined with a microcontroller:https://monitor.espec.ws/files/datasheet_max1781_126.pdfI'm not familiar with BMS chips, but aren't they supposed to manage the charge/discharge/ballancing/protection of the cells by themselves, why do they put a microcontroller, am I suppose to drive my own charge/discharge algorithms?So far it seems the interface used to communicate with the BMS is SMB. I could only find a payed software that can talk with the MAX17817 battery packs. Is there any free tool/program that can talk with the battery pack?I want to reuse the battery pack for random projects, powering Arduinos and such. Is there any standard for the data provided by the BMS? Any clues of how to reuse this battery pack, other than by just replacing the controller please?

author: RoGeorge
author_rank: Super Contributor
timestamp: May 07, 2024, 05:13:16 pm
content: Searched again today, and couldn't find much, not even the pinout, let alone how/what to talk with the battery pack over SMBus (side note, SMBus is like I2C, so most I2C chips would be compatible with SMBushttps://www.analog.com/en/resources/design-notes/guide-to-comparing-ic-bus-to-the-smbus.html).However, I did found some clues:1. - all wires but one seem to be floating2. - the wire that is not floating has a 0.1V level on it, so it is most probably a DO in zero logic3. - for all other BMS chips except MAX17817, the commercial software needs only a USB to SMBus adapter in order to talk with the battery pack. For MAX17817, however, the same program needs yet another Arduino, so all 3 devices has to be in parallel on the same SMBus: the USB to SMBus adapter, the Arduino board, the battery pack. By the .ino file for Arduino, it seems that the only thing it does is send a stop to the SMBus (which will also release the SMBus for further communications).4. - From the Arduino sketch, the slave address for MAX17817 seems to be 11 (in decimal).5. - The paid software can work with a lot of BMS models, but it cost about $300, plus it doesn't start without a physical USB to SMBus bridge installed (made with SiLabs CP2112, which I don't have). No way to spend that much money for a random battery found in an EE dumpster bin. However, it gives some clues for what it is expected to be inside the flash memory of a MAX17817:https://youtu.be/q-bojZF-EIoI have plenty of microcontrollers that can talk I2C. Raspberry Pi also has I2C pins, and in Linux there is quite a range of ready made generic I2C software tools, I2C libraries for C and Python, etc.Point 3, and the fact that one wire is stuck in zero logic (point 2) make sense together. I guess that wire is the data line (SDA) of the SMBus, locked in 0 by the slave, probably because that's how the last end transmission has endedhttps://www.arduino.cc/reference/en/language/functions/communication/wire/endtransmission/With all these hints so far, it feels like I'm halfway there (talking to the battery pack).Any other advice, ideas, or things I should know before starting?

author: RoGeorge
author_rank: Super Contributor
timestamp: May 10, 2024, 11:22:07 am
content: Did some detective work.After reading the I2C and SMBus standards, (see Table 17 from SMBus specificationshttp://smbus.org/specs/SMBus_3_2_20220112.pdf) turns out that there is, indeed, a specification for smart battery packs (like for example laptop batteries and such), and the standard specified the allocated I2C address for smart batteries is 11, which matches with the I2C address used in the .ino unlocker.Most probably, this particular battery (made for RAID and cache backup in HP servers), also aligns to the SMBus standard for smart batteries:SMBus Smart Battery Data Specificationhttp://sbs-forum.org/specs/sbdat110.pdfTurns out there are plenty of free software SMBus battery readers based on an Arduino or such, doesn't have to be a $300 paid software.Now, all it is needed is to identify the pinout for the connector of this battery. Most probably, the SMBus pins are yellow and white, but I'm not sure yet. I've poked at each pin by touching the wires one by one (to introduce 50Hz hum noise) while looking at the waveform, and more exactly looking at the limiting of Vmin and Vmax introduced by the battery circuit(see the measurement on the bottom in the oscilloscope captures).When I found the battery, one cell was at 0.86V, the other was at 3.6V. Meanwhile I've charged each of the two cells from outside, one by one, with a lab power supply limited at 4.2V/100mA. Datasheet for the Li-ion cells used in this battery:https://www.dnkpower.com/wp-content/uploads/2022/07/dnkpower-LG_daHB2-18650-datasheet.pdfNow I have to figure out which one is clock, which one is data, and most of all, how to "jump-start" a disconnected battery (don't have a ProLiant server). I've tried the most probable (by looking at the oscilloscope captures, white/yellow), swapped SMBCLK with SMBDAT (SCL and SDA from I2C), but still no answer so far.For laptop batteries, I've seen some of them may have one or two pins that has to be grounded, others needs to apply some external V+ to wake up the batteries, and others are just working as long as the cells are not totally flat.Any idea how to wake up the battery?

author: RoGeorge
author_rank: Super Contributor
timestamp: May 13, 2024, 06:38:36 am
content: Still can not talk with the 2 cells battery from the server.Since it was not clear if the various SMBus readers were working or not, tried one of the programs on another battery pack from a former Dell laptop, and after some code changes, accidentally made a SMBus reader for Dell batteries.Code:// This Arduino sketch requires the SoftICMaster library to be installed.// The sketch is modified for/tested with a Dell X284G battery. Initial code was from:// of https://www.instructables.com/Arduino-Battery-SMS-Bus-Reader///// Arduino Nano used pins were A4 for SMBDAT, and A5 for SMBCLK// two external pull up resistors of 10k each were added between A4, A5 and the 3V3 pin of the Arduino nano//// Pinout Dell X284G battery pack, count the small slots only while looking into contacts:// 1:GND, 2:GND, 3:?, 4:EN(tied to GND to enable V+), 5:?, 6:SMBDAT, 7:SMBCLK, 8:V+, 9:V+// SMBus reading will work no matter the state of EN pin, or the presence of a load/charger connected at V+//// The output can be seen in the serial Terminal Monitor (9600 baud), e.g.://// Manufacturer Name: SMP-LGC2.2// Device Name: DELL Y8****A1// Chemistry LION// Design Capacity: 4400// Current Capacity: 1879// Design Voltage: 11100// Manufacture Date (Y-M-D): 2009-10-1// Serial Number: ***// Specification Info: 33// State of Health: 33// Battery Mode (BIN): 0b110000010000000// Battery Status (BIN): 0b11111111111111111100000011100000// Max Charging Current: (mA)0 Max Charging Voltage: (mV)0////// *********Current data*********// Cycle Count: 316// Voltage: 12.09// Remaining Capacity: 1876// Relative Charge(%): 100 Absolute Charge(%): 43// Minutes remaining for full charge: -1// Cell 1 (mV): 4038 Cell 2 (mV): 3994 Cell 3 (mV): 4060//// Temp: 24.95// Current (mA): 0// **********************#define SDA_PORT PORTC#define SDA_PIN 4#define SCL_PORT PORTC#define SCL_PIN 5#define I2C_SLOWMODE 2#include <SoftI2CMaster.h>// #include <SPI.h> # LCD screen output removed// #include <Adafruit_GFX.h>// #include <Adafruit_PCD8544.h>// standard I2C address for Smart Battery packsbyte deviceAddress = 11;// Adafruit_PCD8544 display = Adafruit_PCD8544(7, 6, 5, 4, 3);// #define NUMFLAKES 10// #define XPOS 0// #define YPOS 1// #define DELTAY 2// #define LOGO16_GLCD_HEIGHT 16// #define LOGO16_GLCD_WIDTH 16// Standard and common non-standard Smart Battery commands#define BATTERY_MODE 0x03#define TEMPERATURE 0x08#define VOLTAGE 0x09#define CURRENT 0x0A#define RELATIVE_SOC 0x0D#define ABSOLUTE_SOC 0x0E#define REMAINING_CAPACITY 0x0F#define FULL_CHARGE_CAPACITY 0x10#define TIME_TO_FULL 0x13#define CHARGING_CURRENT 0x14#define CHARGING_VOLTAGE 0x15#define BATTERY_STATUS 0x16#define CYCLE_COUNT 0x17#define DESIGN_CAPACITY 0x18#define DESIGN_VOLTAGE 0x19#define SPEC_INFO 0x1A#define MFG_DATE 0x1B#define SERIAL_NUM 0x1C#define MFG_NAME 0x20 // String#define DEV_NAME 0x21 // String#define CELL_CHEM 0x22 // String#define MFG_DATA 0x23 // String#define MFG_DATA3B 0x4F // String//#define MFG_DATA3C 0x3C // String//#define MFG_DATA3D 0x3D // String//#define MFG_DATA3E 0x3E // String//#define MFG_DATA30 0x48 // String//#define MFG_DATA31 0x49 // String//#define MFG_DATA32 0x4A // String//#define MFG_DATA33 0x4B // String#define CELL8_VOLTAGE 0x43#define CELL7_VOLTAGE 0x42#define CELL6_VOLTAGE 0x41#define CELL5_VOLTAGE 0x40#define CELL4_VOLTAGE_DELL 0x38 // for DELL only (tested with X284G battery pack) NA, 0mV#define CELL3_VOLTAGE_DELL 0x39 // for DELL only (tested with X284G battery pack) Vcell 3#define CELL2_VOLTAGE_DELL 0x3A // for DELL only (tested with X284G battery pack) Vcell 2#define CELL1_VOLTAGE_DELL 0x3B // for DELL only (tested with X284G battery pack) Vcell 1#define CELL4_VOLTAGE 0x3C // These don't work on Lenovo and Dell Packs#define CELL3_VOLTAGE 0x3D // These don't work on Lenovo and Dell Packs#define CELL2_VOLTAGE 0x3E // These don't work on Lenovo and Dell Packs#define CELL1_VOLTAGE 0x3F // These don't work on Lenovo and Dell Packs#define STATE_OF_HEALTH 0x54#define bufferLen 32uint8_t i2cBuffer;void setup(){// display.begin();// display.setContrast(50);//Serial.begin(9600);//Serial.begin(115200);Serial.begin(9600);Serial.println(i2c_init());// rotation example// display.clearDisplay();// display.setRotation(2); // rotate 90 degrees counter clockwise, can also use values of 2 and 3 to go further.//// display.setTextSize(1);// display.setTextColor(BLACK);// display.setCursor(0,0);// // display.println("Rotation");// display.setTextSize(1);// display.println(" ");// display.println(" Battery ");// display.println(" Checker");// display.println(" ");// display.println(" by PBTech ");// display.println(" V1.0 ");// display.display();delay(1000);// display.setTextSize(1);// display.clearDisplay();while (!Serial) {; // wait for Serial port to connect.}Serial.println("Serial Initialized");i2c_init();Serial.println("I2C Inialized");// scan(); //bypassed but left in for future projects}int fetchWord(byte func){i2c_start(deviceAddress<<1 | I2C_WRITE);i2c_write(func);i2c_rep_start(deviceAddress<<1 | I2C_READ);byte b1 = i2c_read(false);byte b2 = i2c_read(true);i2c_stop();return (int)b1|((( int)b2)<<8);}uint8_t i2c_smbus_read_block ( uint8_t command, uint8_t* blockBuffer, uint8_t blockBufferLen ){uint8_t x, num_bytes;i2c_start((deviceAddress<<1) + I2C_WRITE);i2c_write(command);i2c_rep_start((deviceAddress<<1) + I2C_READ);num_bytes = i2c_read(false); // num of bytes; 1 byte will be index 0//Serial.println(num_bytes);num_bytes = constrain(num_bytes,0,blockBufferLen-2); // room for null at the end ??? macro warning, maybe use code instead//num_bytes is uint8_t, it can never be less than 0 (negative), #define constrain(amt,low,high) ((amt)<(low)?(low):((amt)>(high)?(high):(amt)))for (x=0; x<num_bytes-1; x++) { // -1 because x=num_bytes-1 if x<y; last byte needs to be "nack"'d, x<y-1blockBuffer = i2c_read(false);}blockBuffer[x++] = i2c_read(true); // this will nack the last byte and store it in x's num_bytes-1 address.blockBuffer = 0; // and null it at last_byte+1i2c_stop();return num_bytes;}// void scan() //bypassed but left in for future projects// {// byte i = 0;// for ( i= 0; i < 127; i++ )// {// bool ack = i2c_start(i<<1 | I2C_WRITE);// if ( ack ) {// Serial.print("Address: 0x");// Serial.print(i,HEX);// Serial.println(": OK");// Serial.flush();// }// else {// }// i2c_stop();// }// }void loop(){uint8_t length_read = 0;// display.clearDisplay();Serial.print("Manufacturer Name: ");// // display.print("Manu: ");length_read = i2c_smbus_read_block(MFG_NAME, i2cBuffer, bufferLen);//// display.println(Serial.write(i2cBuffer, length_read));Serial.write(i2cBuffer, length_read);Serial.println(" ");Serial.print("Device Name: ");length_read = i2c_smbus_read_block(DEV_NAME, i2cBuffer, bufferLen);Serial.write(i2cBuffer, length_read);Serial.println("");Serial.print("Chemistry ");length_read = i2c_smbus_read_block(CELL_CHEM, i2cBuffer, bufferLen);Serial.write(i2cBuffer, length_read);Serial.println("");// Serial.print("Manufacturer Data "); // These returns some static data, but not text// length_read = i2c_smbus_read_block(MFG_DATA, i2cBuffer, bufferLen); // (from a Dell X284G battery)// Serial.write(i2cBuffer, length_read); // don't know how to decode that data// Serial.println("");// Serial.print("Manufacturer Data 4F"); // This returns some 1052% ???// Serial.print(" ");// Serial.print(fetchWord(MFG_DATA3B));// Serial.println(" % ");Serial.print("Design Capacity: " );Serial.println(fetchWord(DESIGN_CAPACITY));Serial.print("Current Capacity: " );Serial.println(fetchWord(FULL_CHARGE_CAPACITY));Serial.print("Design Voltage: " );Serial.println(fetchWord(DESIGN_VOLTAGE));String formatted_date = "Manufacture Date (Y-M-D): ";int mdate = fetchWord(MFG_DATE);int mday = B00011111 & mdate;int mmonth = mdate>>5 & B00001111;int myear = 1980 + (mdate>>9 & B01111111);formatted_date += myear;formatted_date += "-";formatted_date += mmonth;formatted_date += "-";formatted_date += mday;Serial.println(formatted_date);Serial.print("Serial Number: ");Serial.println(fetchWord(SERIAL_NUM));Serial.print("Specification Info: ");Serial.println(fetchWord(SPEC_INFO));Serial.print("State of Health: ");Serial.println(fetchWord(STATE_OF_HEALTH));Serial.print("Battery Mode (BIN): 0b");Serial.println(fetchWord(BATTERY_MODE),BIN);Serial.print("Battery Status (BIN): 0b");Serial.println(fetchWord(BATTERY_STATUS),BIN);Serial.print("Max Charging Current: (mA)");Serial.print(fetchWord(CHARGING_CURRENT));Serial.print(" ");Serial.print("Max Charging Voltage: (mV)");Serial.println(fetchWord(CHARGING_VOLTAGE));Serial.println("");// Serial.println("*********My own reads*********");// uint8_t cucu;// Serial.print("OptionalMfgFunction5 at 0x2F, ");// length_read = i2c_smbus_read_block(0x2F, i2cBuffer, bufferLen);// Serial.print("read lenght was (bytes): ");// Serial.println(length_read);// for (cucu = 0; cucu <= length_read; cucu++) {// Serial.print(i2cBuffer < 16 ? "0" : "");// Serial.print(i2cBuffer, HEX);// Serial.print(" ");// }// Serial.println();// Serial.println();// Serial.print("OptionalMfgFunction1 at 0x3F, ");// length_read = i2c_smbus_read_block(0x3F, i2cBuffer, bufferLen);// Serial.print("read lenght was (bytes): ");// Serial.println(length_read);// for (cucu = 0; cucu <= length_read; cucu++) {// Serial.print(i2cBuffer < 16 ? "0" : "");// Serial.print(i2cBuffer, HEX);// Serial.print(" ");// }// Serial.println();// Serial.println();// Serial.print("OptionalMfgFunction2 at 0x3E, ");// length_read = i2c_smbus_read_block(0x3E, i2cBuffer, bufferLen);// Serial.print("read lenght was (bytes): ");// Serial.println(length_read);// for (cucu = 0; cucu <= length_read; cucu++) {// Serial.print(i2cBuffer < 16 ? "0" : "");// Serial.print(i2cBuffer, HEX);// Serial.print(" ");// }// Serial.println();// Serial.println();// Serial.print("OptionalMfgFunction3 at 0x3D, ");// length_read = i2c_smbus_read_block(0x3D, i2cBuffer, bufferLen);// Serial.print("read lenght was (bytes): ");// Serial.println(length_read);// for (cucu = 0; cucu <= length_read; cucu++) {// Serial.print(i2cBuffer < 16 ? "0" : "");// Serial.print(i2cBuffer, HEX);// Serial.print(" ");// }// Serial.println();// Serial.println();// Serial.print("OptionalMfgFunction4 at 0x3C, ");// length_read = i2c_smbus_read_block(0x3C, i2cBuffer, bufferLen);// Serial.print("read lenght was (bytes): ");// Serial.println(length_read);// for (cucu = 0; cucu <= length_read; cucu++) {// Serial.print(i2cBuffer < 16 ? "0" : "");// Serial.print(i2cBuffer, HEX);// Serial.print(" ");// }// Serial.println();// // end of *********My own reads*********Serial.println("");Serial.println("*********Current data*********");Serial.print("Cycle Count: " );Serial.println(fetchWord(CYCLE_COUNT));Serial.print("Voltage: ");Serial.println((float)fetchWord(VOLTAGE)/1000);// display.print("Yr=");// display.print(myear);// display.print(" Cy=");// display.println(fetchWord(CYCLE_COUNT));// display.print("DC=");// display.print((float(fetchWord(DESIGN_CAPACITY))/1000),1);// display.print(" CC=");// display.println((float(fetchWord(FULL_CHARGE_CAPACITY))/1000),1);// display.print("DV=");// display.print((float(fetchWord(DESIGN_VOLTAGE))/1000),1);// display.print(" V=");// display.println((float(fetchWord(VOLTAGE))/1000),1);Serial.print("Remaining Capacity: " );Serial.println(fetchWord(REMAINING_CAPACITY));Serial.print("Relative Charge(%): ");Serial.print(fetchWord(RELATIVE_SOC));Serial.print(" ");Serial.print("Absolute Charge(%): ");Serial.println(fetchWord(ABSOLUTE_SOC));Serial.print("Minutes remaining for full charge: ");Serial.println(fetchWord(TIME_TO_FULL));//Extended commands may not work with some battery packs - always show first 2 battery voltagesSerial.print("Cell 1 (mV): ");// Serial.print(fetchWord(CELL1_VOLTAGE));Serial.print(fetchWord(CELL1_VOLTAGE_DELL));// display.setTextColor(WHITE, BLACK);// display.print("1");// display.setTextColor(BLACK);// display.print((fetchWord(CELL1_VOLTAGE))/10);Serial.print(" ");Serial.print("Cell 2 (mV): ");// Serial.print(fetchWord(CELL2_VOLTAGE));Serial.print(fetchWord(CELL2_VOLTAGE_DELL));Serial.print(" ");// display.setTextColor(WHITE, BLACK);// display.print("2");// display.setTextColor(BLACK);// display.print((fetchWord(CELL2_VOLTAGE))/10);// if ((fetchWord(VOLTAGE))>10000){ // cell 3 shown if greater than 10volts// if ((fetchWord(VOLTAGE))>4200){ // cell 3 shown if greater than 10voltsif (true){ // cell 3 shown if greater than 10voltsSerial.print("Cell 3 (mV): ");// Serial.println(fetchWord(CELL3_VOLTAGE));Serial.println(fetchWord(CELL3_VOLTAGE_DELL));// display.setTextColor(WHITE, BLACK);// display.print("3");// display.setTextColor(BLACK);// display.println((fetchWord(CELL3_VOLTAGE))/10);// if ((fetchWord(VOLTAGE))>14000){// if ((fetchWord(VOLTAGE))>4200){// if (true){// Serial.print("Cell 4 Voltage: ");// // Serial.print(fetchWord(CELL4_VOLTAGE));// Serial.print(fetchWord(CELL4_VOLTAGE_DELL));// // display.setTextColor(WHITE, BLACK);// // display.print("4");// // display.setTextColor(BLACK);// // display.print((fetchWord(CELL4_VOLTAGE))/10);// Serial.print(" ");// // if ((fetchWord(VOLTAGE))>18000){// if ((fetchWord(VOLTAGE))>4200){// Serial.print("Cell 5 Voltage: ");// Serial.print(fetchWord(CELL5_VOLTAGE));// // display.setTextColor(WHITE, BLACK);// // display.print("5");// // display.setTextColor(BLACK);// // display.print((fetchWord(CELL5_VOLTAGE))/100);// // if ((fetchWord(VOLTAGE))>22000){// if ((fetchWord(VOLTAGE))>4200){// Serial.print(" ");// Serial.print("Cell 6 Voltage: ");// Serial.println(fetchWord(CELL6_VOLTAGE));// // display.setTextColor(WHITE, BLACK);// // display.print("6");// // display.setTextColor(BLACK);// // display.println((fetchWord(CELL6_VOLTAGE))/10);// // if ((fetchWord(VOLTAGE))>26000){// if ((fetchWord(VOLTAGE))>4200){// Serial.print("Cell 7 Voltage: ");// Serial.print(fetchWord(CELL7_VOLTAGE));// Serial.print(" ");// // display.setTextColor(WHITE, BLACK);// // display.print("7");// // display.setTextColor(BLACK);// // display.print((fetchWord(CELL7_VOLTAGE))/10);// // if ((fetchWord(VOLTAGE))>30000){// if ((fetchWord(VOLTAGE))>4200){// Serial.print("Cell 8 Voltage: ");// Serial.println(fetchWord(CELL8_VOLTAGE));// // display.setTextColor(WHITE, BLACK);// // display.print("8");// // display.setTextColor(BLACK);// // display.print((fetchWord(CELL8_VOLTAGE))/10);// }// }// }// }// }// display.display();}Serial.println();Serial.print("Temp: ");unsigned int tempk = fetchWord(TEMPERATURE);Serial.println((float)tempk/10.0-273.15);Serial.print("Current (mA): " );Serial.println(fetchWord(CURRENT));Serial.println("**********************");Serial.println(" ");Serial.println(" ");delay(5000);}The code is only a draft with many leftovers in it, gives a macro warning at compilation (uint8_t can never be < 0), but tested and working just fine with an Arduino nano and an X284G Dell battery.

author: RoGeorge
author_rank: Super Contributor
timestamp: May 14, 2024, 10:49:21 am
content: Eventually brute force it by cutting the plastic case. The pinout was marked on the silkscreen, easy to read after removing the white goo from around the wires.The plastic case I cut might have been open without damage, there are some plastic clamps that were fixed with a black rubbery glue. Leaving here some pics just for the docs, or in case somebody else want to try to clean open the enclosure without cutting it.There are 2 ICs on the PCB, one almost unreadable even under the microscope (probably the marking reads BOV TI 76K ?), the other is the BMS MCU, MAX 17817 ETI. The current sensing SMD resistors are marked R005.Pinout connector wires (grouped by function, not by pin number):Code:- red- VB(VBattery, ? +5V out ?)- black- GND- orange- GND(0 ohms, ? why orange, analog GND ?)- green- EN(ENable, ? tie it to GND or Vcc ?)- yellow- SDA(SMBus SMBDAT)- white- SCL(SMBus SMBCLK)- brown- Vin(? charging voltage ?)- blue- Add(? no idea, battery address ?)Though, I have already tried before the combination yellow/SDA and white/SCL (w and w/o the green EN pin tied to GND) and couldn't talk with the battery. Will see later why the battery didn't respond. Maybe it's defective, but I doubt that. My guess is it needs some initialization sequence in order to make it respond to SMBus requests.Any idea how to start the battery, or what for are the brown/Vin and the blue/Add wires?

author: r3a9670
author_rank: Newbie
timestamp: March 12, 2025, 09:57:24 am
content: Hello RoGeorge,do you find any way to read this chip ?

author: RoGeorge
author_rank: Super Contributor
timestamp: March 12, 2025, 12:05:36 pm
content: No, couldn't make it communicate. Managed to read other battery packs, from other brands, but couldn't make this one to respond.Found out later that this HP Gen10 battery has internal fuses that can be triggered (melted) by the microcontroller, in case the firmware decides something is wrong. That was the next check on the to do list, but I've never touched that battery since last posting here (almost a year ago), so no idea why this BMS doesn't respond to any SMBus messages.

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 09:39:49 am
content: This battery is for Gen9, not Gen10.I don't think the problem is with the fuse, because I also have working batteries that don't respond

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 09:44:47 am
content: When I scan this battery using an I2C scanner, it shows two addresses:0x54 and 0x64.I know that these addresses are not the correct ones for the battery's chip.The problem is that the main address of the chip doesn't appear.I know that the default address of these chips is 0x0B, but unfortunately, that address hasn't shown up so far. Do you think it's need some wakeup or something?

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2025, 10:49:54 am
content: Quote from: r3a9670 on April 09, 2025, 09:44:47 amIt certainly has some sort of unlock code. I know that from a (proprietary) battery reader that can read with this kind of battery pack. There was an additional Python script to unlock the battery first, then use the proprietary reader. I remember saving that somewhere, but I don't recall the details. I'll have to look through the old notes.I did try back then to run the unlocking script first, but it didn't work for me. In fact, IIRC, mine didn't answer at all, not even when scanning for I2C addresses.Will post more details and that presumably unlocking script as soon as I'll find them.How did you find out the gen9 vs gen10 info, and especially the presumably 0x0B address?

author: timeandfrequency
author_rank: Frequent Contributor
timestamp: April 09, 2025, 10:58:13 am
content: Hello RoGeorge,What's currently the voltage of each cell ?If below 2 VDC, did you try to wake up the cells with a lab power supply ?Are the two 18650 cells in series (2S configuration) ?In the affirmative, use a separate lab power supply for each cell.Set voltage to 3.65 VDC (because it might be a LiFePO4 chemistry)Set current limitation to 20 mADC.Let the charging process go on for one or two day (48 hours) at least up to 3.2 VDC (per cell)Unplug the power supplies, check for voltage drop (= cell internal leakage)If voltage keeps stable, try to communicate with the BMS (outside of the server or directly via BIOS/RAID firmware)

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2025, 11:50:09 am
content: Yes, I've charged the cells with a lab power supply before trying to communicate with the BMS. Don't have the server, only the battery pack. The battery was thrown away as EE waste.About the server size, for the very motivated might worth searching the HP driver responsible for the RAM backup battery, and trying to dissasemble the software in order to deduce the proper BMS unlocking sequence. I didn't try that.Back then tried to communicate with the battery only because I've never read any BMS before, so it was mostly an exploration/learning project out of curiosity.Meanwhile found my project notes from a year ago. The relevant part regarding extra unlocking code of my notes:QuoteThe page for the proprietary service software 'Battery EEPROM Works' is still available, the MAX17817.ino is from the same place,https://be2works.com/. There also is a video link for resetting MAX17817, which might show extra details.Found the link to the extra info and the presumably unlocking 'MAX17817.zip' (I was wrong about the Python script, my bad, it was a small .ino for an Arduino nano, not a Python script):https://be2works.com/how-it-works/max17817/Note that the proprietary 'Battery EEPROM Works' also can write/reset the proper BMS addresses and counters, in case you want to replace the batteries with new ones. The cost of 'Battery EEPROM Works' was not justify for my hobby/curiosity project, but considering the price of a new HP backup battery, that software will worth its price.Please let me know if you manage to talk with the battery pack, still have it somewhere, and hope to use it as a 5V supply for a hobby project.

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2025, 12:39:22 pm
content: Also found this:https://ubrt.com.ua/main/built-in-program-modules/max-tools/max17806-max17817The printscreen captures might be useful to identify SMB parameters and their expected addresses.

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 08:19:12 pm
content: The server itself provides 12 volts to the battery through the V1n pin.You can supply a voltage between 5 to 12 volts to the battery and see if the addresses0x54and0x64appear.Regarding the address0x0B,I should say that this has been the standard address for all the batteries I’ve tested, and it’s a common address for BMS chips.I also have the BE2WORK software, but it can’t read anything from this battery either, because the standard battery address doesn’t appear.BE2WORK also uses address0x0Bto read the BMS.About these batteries being for Gen9 servers — I should mention that every Gen10 server I’ve seen has batteries that are different from these.

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2025, 08:27:54 pm
content: Have you tried be2work AND the Arduino nano at the same time, to unlock the BMS following these steps:https://be2works.com/how-it-works/max17817/?

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 08:27:59 pm
content: I think this battery needs some kind of wake-up signal.I'm not sure how, but it has more pins compared to a typical laptop battery — like the "ADDR" pin (blue).Do you think it's possible to remove it's bms and solder it on a laptop battery PCB and test it again?

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 08:29:23 pm
content: Yes, but it's not work. I think the be2work tested on a laptop battery that has max17817

author: r3a9670
author_rank: Newbie
timestamp: April 09, 2025, 08:32:33 pm
content: Be2work support told me you don't need Arduino for reading battery info, you need Arduino just for resting it

author: RoGeorge
author_rank: Super Contributor
timestamp: April 09, 2025, 08:43:27 pm
content: Quote from: r3a9670 on April 09, 2025, 08:27:59 pmI don't know if that would help. I don't usually restore battery packs, but I've read some chips might detect when missing their power, and might write some internal fuses.If you translate and read at the end of the page in the second linkhttps://ubrt.com.ua/main/built-in-program-modules/max-tools/max17806-max17817, it sais MAX 17817 might enter in "Boot mode" (I don't know what that means), or might even be bricked (Google translated):Quote