For most people, a battery pack that’s misbehaving simply means it’s time to get a new battery. But when the battery in their ThinkPad wasn’t able to muster up more than 20 minutes of runtime, [Shrinath Nimare] saw an opportunity to dig deeper and do a bit of investigating.
The problem seemed to be that the battery pack was reporting that it was 100% charged at just 11.7 V instead of the correct 12.3 V. As it turns out, that 11.7 V figure is only slightly above what the battery should be when its run flat — so in reality, the battery was never actually getting a charge and would report that it was dead after just a few minutes of use. But why?
With a logic analyzer attached to the pins of the battery, [Shrinath] set out to sniff its communications with the ThinkPad. Even if it wouldn’t lead to fixing the battery pack, the information obtained would potentially be useful for other projects, such as creating a custom high-capacity LiFePO4 pack down the line.
With the pack opened, [Shrinath] determined that a 51F51 BMS IC was running the show. The battery communicates with the host computer over SMBus, which is very similar to I2C. In fact, they’re so similar that [Shrinath] was able to use the I2C decoder in sigrok to break out the read and write commands and compare them to a PDF of the Smart Battery Data Specification.
With a few captures in hand, [Shrinath] made some good progress in decoding what the two devices are saying to each other. For example, when the computer sent the command 0x15, the battery correctly responded with the desired charge voltage of 12.3 V. The command 0x18 was then given, which the specification says should cause the battery to report its capacity. Here again, valid data was returned, confirming that [Shrinath] was on the right path.
Even though it’s still early in the investigation, [Shrinath] had enough trouble finding practical examples of sniffing SMBus data that they thought it would be worth uploading their captures and notes to Hackaday.io. Hopefully further poking will show if the battery can be revived, but even if not, we’re always glad to see when hackers are willing to document their exploits for the benefit of the community.
This actually isn’t the first time we’ve heard of somebody snooping on their ThinkPad battery — back in 2020, we covered [Alexander Parent]’s efforts to create an open source battery pack for the T420 based on the ATtiny85.
Isn’t the charger circuit in the laptop broken? This is very common for ThinkPads
Software/firmware error is also a possibility, since the charge controller was reporting the correct values.
Most likely a broken 18650 cell.
The 18650 battery cells are the most obvious and likely thing to fail. Before messing around with complicated stuff, simply verify that each one has something like 3.8V minimum across it. If one or more cells is very low, there’s the problem. Whether you can actually fix it is another matter: I’ve read that Lenovo (and other evil companies) have charging boards that have fuses or other tricks intended to keep people from simply running out to the nearest headshop and buying more 18650s.
In this case, having some form of self disabling on the BMS is a valid safety thing.
I think it SHOULD be something that can be bypassed with moderate effort though. (Less than swapping chips. More than bridging 2 pads)
You really need to use a pretty closely matched set of cells for these to be “safe”.
Even when used properly, LiPo batteries are barely “safe”. It is very easy for someone who knows just enough to mess with them to create something dangerous.
Letting people simply slap a new cell in is absolutely going to result in fires and destruction. Maybe even death.
So, while these companies might be doing evil, letting someone simply pop out to a head shop for an 18650 is a huge no.
Laptop cells are pushed pretty hard to begin with. They’re being charged close to the limits to get the maximum capacity.
Lithium cells don’t exactly have a “full” voltage – the more you raise the voltage, the more charge they hold and the faster they get worn out, to the point of catching fire. Laptop cells are wired and charged in series, so any mismatch between the cells will quickly get worse and worse.
Compare and contrast to things like electric scooter batteries, which are charged very conservatively to maintain maximum lifespan, which consequently allows the cells to drift apart a lot more with the extra voltage headroom they have.
People putting “headshop” cells in their laptops and expecting the BMS to just accept it is the equivalent of putting a copper penny in the fuse holder in your home. There is a good reason they’ve designed against that. It also prevents the usual people from picking dead batteries out of scrap laptops sent overseas for recycling, and “refurbishing” them, then selling them as “genuine” spare parts.
That. After the Samsung Airplane Phone disaster, no company wants to see their product in the “airplane fire” news.
I’m surprised the battery is not in its own case, showing the actual manufacturer logo.
It used to be a thing that laptop batteries would report false capacity if they were never unplugged but you could force them to ‘learn’ with a charge, discharge, recharge cycle but I’d expect any decent manufacturer to have fixed that by now so I’d probably want to break out the electornic dummy load and test the cells before mucking about with the controller chip.
That “learning” was more of a operating system function, because the OS doesn’t know when the battery is empty when it has never seen it go empty. It tries to predict what “empty” means by observing how the BMS is behaving, so you would have to “calibrate” the meter by running the battery down and then back up full. Modern BMS:s are smarter and report the data directly.
With a failing battery though, the re-learning method is not accurate. At low load the battery can give out the normal amount, but with any load the voltages will sag sooner and the BMS starts cutting out when the OS still thinks you should have half the battery left according to last “calibration”. When that happens, you start to notice the battery gauge jumping from 50% to 10% and then 5% in mere minutes.
The problem with many of these batteries is after the battery dies, the BMS trips a fault bit that is not resettable after simply recelling it, you have to be able to talk to BMS and tell it to reset the fault. Which requires special tools that cost a lot of money,
I managed to do it with my Spark battery when I didnt charge it for too long
https://mavicpilots.com/threads/dji-mavi-pro-battery-reset-using-cp2112-and-dji-battery-killer.143429/
But otherwise for laptops I am only aware of this NLBA ($$$) https://www.laptopu.ro/2021/06/06/how-to-repair-a-laptop-battery-by-replacing-the-cells-and-reset-the-chip-bq9000/
On mine there is an actual physical fuse that gets blown when the battery dies. It’s a safety feature to prevent charging dead cells with high internal resistance which will heat up and may catch fire.
If you have “Bin Stores” (mostly Amazon returns) in your area, you might have good luck finding really inexpensive battery packs with 18650s inside. I’ve purchased many for 2-7$. A Dremel and a steady hand will have those batteries out in no time.
It’s usually not worth the effort to attempt replacing the cells. The controller will be locked out if you disconnect any of the cells. Even if you manage to replace the cells without breaking the connection, the BMS will not be calibrated for the new cells.