It’s not something you often give a lot of thought to, but the modern consumer laptop battery is a pretty advanced piece of technology. Not only does it pack several dozen watt-hours of energy into a relatively small and lightweight package, but it features integrated diagnostic capability to make sure all those temperamental lithium cells are kept in check. Widely available and extremely cheap thanks to the economies of scale (unless you try to get them from the OEM, anyway), they’re a very compelling option for powering your projects.
Of course, it also helps if, like [teliot] you have a bunch of the things lying around. For reasons we won’t get into, he’s got a whole mess of Acer AL12x32 battery packs which he wanted to use for something other than collecting dust. He had the idea of hooking one up to a solar panel and using it as a power supply for some ESP8266 projects but wanted to be able to talk to the battery for status and diagnostic information. After studying the Smart Battery System (SBS) protocol the batteries use, he was able to come up with some code that lets him pull 37 separate fields of information from the pack’s onboard electronics using his ESP8266.
It took some fiddling with a multimeter to figure out which pin did what on the eight pin interface of the battery. Two of the pins need to be shorted to enable the dual 12 VDC pins to kick in. Technically that’s all you really need to do if you want to utilize the battery in a low-tech sort of way. But to actually get some information from the battery, [teliot] had to identify the two pins which are for the System Management Bus (SMBus) interface where the SBS data lives.
Once he knew which pins to talk to the battery on, the rest was fairly easy. SBS is well documented, and the SMBus interface is very similar to I2C. Like all the cool kids are doing these days, his code publishes the battery info to MQTT where he can plot it and get finely grained info on the performance of his solar power system.
This isn’t the first time we’ve seen a hacker wrangle laptop batteries through SMBus, but it’s always nice to get multiple perspectives on a topic. If you plan on making this kind of thing part of your standard bag of tricks, you might even want to take the time to build a dedicated SMBus scanner.
[via /r/esp8266]
Interesting post, would be interesting to compile a data-base
with cross-references of the most common battery packs and
data so coming with PPP Power Plug & Pray would be viable
for all sorts of interchangeable applications,
Thanks for this, putting my comment here gets me subscribed, cheers
Would you mind
leaving the line breaks
to their defaults?
It triggers my OCD,
and it hurts my scroll
wheel operating fingers.
Thanks.
Is it possible to modify contents on battery’s EEPROM this way? I had few Lenovo batteries, laptops were refusing to use them and spitting out “bad battery, change immediately”. I disassembled batteries to get some 18650 cells, and to my surprise after charge/discharge test cells have 2200mAh each, that’s about 70% of their original capacity, definitely not for trash. I use them now to drive 100W LED without problems (4S-3P config).
If I was able to clear some EEPROM flag laptop batteries could probably be usable for quite some time.
Most battery management chips have password protection feature. Depending on battery manufacturer the password will either be the default, or some manufacturer-specific secret value.
Without password you can only read status, not reset error flags or capacity counters.
Like the Evil Printer Cartridge Mafia
Of course, desoldering the management chip and soldering in a fresh one would give you one that you presumably would be able to write to with the manufacturer default password (and/or change the password so that the host couldn’t potentially lock it down).
Long ago, I had a laser printer whose drum had an eeprom that counted pages, then would go inop because the drum _must_ be worn out, and to circumvent that, you didn’t even need to reset the eeprom (say, because you lacked the tools to deal with it at the time), you could just desolder it and drop in a fresh eeprom, which was uninitialized, and the firmware treated it as 0 pages to start.
Isnt it the OS that acts on the eeprom contents, so my first
though is look for a utility or some intercept so the OS gets
what is suitable for it to not raise an exception regardless
of the eeprom contents.
That might be easier than trying to change the eeprom data…
That is also true, but the problem is once battery is marked as bad BCM won’t allow any current to be drawn from it. In my case it cut off voltage on terminals that goes into laptop, but if you measure voltage directly on battery terminals it’s fine. Lenovo doesn’t have (like Toshiba) enable pin on battery, so voltage should always be present if BCM thinks battery is ok.
Hmm, what happens if you cause the eeprom data line to laptop
go open circuit or stuck low or stuck high ?
IOW: Is the OS s/w that decides to power up fully or not able to be
fudged by “failure to find eeprom” type rather than getting a fail
signal from the eeprom. Sounds maybe too simple as too easy to
bypass but, then again the OS driver programmers just needed to
get the job done and might have been under time pressure without
too much thought of event sequencing in event of some failure.
ie. A risk assessment issue in terms of warranty returns so the
eeprom interface might not be that sophisticated lest it cause $ loss
overall re warranty issues etc
I vaguely recall now something about a bios patch, as thats
the code that reads the eeprom before full power up, are you
handy with Debug if you can borrow a good battery and trap the
same code address where it gets the eeprom and subsequent branch etc…
i found a neat trick of replacing the crap cells in a cheap chinese pack with good quality cells for the specific feature the cheap chinese balance board will self reset if it senses an error giving change to maintenance or replace cells (in allot but not all controllers.) An authentic pack just goes numb and has to be replaced if you dont have tools to reset.
It would probably be easier to strip the batteries from the pack and roll your own. Battery management pcbs are super cheap, I bought a bag of 10 for a few dollars. Get some tabbing wire (presoldered) and turn your iron up to its highest setting. A spot of flux and a quick 2 second touch with the iron should give you a strong bond and keep the heat down so you don’t damage the electrolyte. People will shun this, but most people don’t have a spot welder, so use what tools you have. I’ve made several packs this way and as long as you aren’t using too low a heat setting you can prevent too much heat from soaking into the battery case and burning up the battery.
Even better, if you strip batteries from laptop packs, leave nickel strips and solder wires to them, 1cm from cell top is ok to keep cell safe.
I’ve used a really big, hot soldering iron to make packs. The secret is to have a high thermal mass iron and a flux pen.
and reduce the life of the cells by cooking them
If you are quick enough, you might be able to put your finger on it 10s after the soldering. Must be a high mass tip and reasonably powerful iron (60W). Flux, some nickel scratching (to remove external oxidation) and quick hands also help – cells are ok after this.
The alternative is not to use extra flux, and have a small soldering iron, then take 10+ seconds to achieve what you would in a second or two with the above setup.
Mind to point one with >1S capability ? i2c/smbus/spi communication is great plus.
The BMS boards he’s most likely referring to are the dirt cheap variant (just google for e.g. “3s bms”) which have a battery protection circuit and sometimes a passive balancing circuit on them.
A surprising amount of people just put these boards onto a number of cells and charge them using a 12.6v wall wart.
There is no communication interface to them because they’re just that: protection circuits. If you actually want to do it correctly you then would need a LiIon charging IC and if you want to have information about your batteries you would need to have a LiIon gauge IC.
The Laptop battery packs are a mix of this: They have protection, sometimes balancing and a gauge IC which gives you information about your battery but not a charging IC.
I’m not sure how important the correct way of charging a LiIon (CC/CV) actually is if you have a battery protection board with cell balancing though, it seems to work quite fine for a lot of people just using a 12.6v power supply (cutoff voltage for 3s packs).
A longer than expected query spitted bq20z45 as a protection ic + gas gauge. 4USD on eBay qty 1. I thought that there were all-in-one ics for this but when seeing recommended application, dayum. BOM skyrocketed. Still needs some sensing ic + fets. Keywords to search this kind of smart charging chip > sbs ic (smart battery specification). Nevertheless it was a great find.