Sniffing Around Inside A ThinkPad Battery

For most people, a battery pack that’s misbehaving simply means it’s time to get a new battery. But when the battery in their ThinkPad wasn’t able to muster up more than 20 minutes of runtime, [Shrinath Nimare] saw an opportunity to dig deeper and do a bit of investigating.

The problem seemed to be that the battery pack was reporting that it was 100% charged at just 11.7 V instead of the correct 12.3 V. As it turns out, that 11.7 V figure is only slightly above what the battery should be when its run flat — so in reality, the battery was never actually getting a charge and would report that it was dead after just a few minutes of use. But why?

With a logic analyzer attached to the pins of the battery, [Shrinath] set out to sniff its communications with the ThinkPad.  Even if it wouldn’t lead to fixing the battery pack, the information obtained would potentially be useful for other projects, such as creating a custom high-capacity LiFePO4 pack down the line.

With the pack opened, [Shrinath] determined that a 51F51 BMS IC was running the show. The battery communicates with the host computer over SMBus, which is very similar to I2C. In fact, they’re so similar that [Shrinath] was able to use the I2C decoder in sigrok to break out the read and write commands and compare them to a PDF of the Smart Battery Data Specification.

Using the I2C decoder to read SMBus messages.

With a few captures in hand, [Shrinath] made some good progress in decoding what the two devices are saying to each other. For example, when the computer sent the command 0x15, the battery correctly responded with the desired charge voltage of 12.3 V. The command 0x18 was then given, which the specification says should cause the battery to report its capacity. Here again, valid data was returned, confirming that [Shrinath] was on the right path.

Even though it’s still early in the investigation, [Shrinath] had enough trouble finding practical examples of sniffing SMBus data that they thought it would be worth uploading their captures and notes to Hackaday.io. Hopefully further poking will show if the battery can be revived, but even if not, we’re always glad to see when hackers are willing to document their exploits for the benefit of the community.

This actually isn’t the first time we’ve heard of somebody snooping on their ThinkPad battery — back in 2020, we covered [Alexander Parent]’s efforts to create an open source battery pack for the T420 based on the ATtiny85.

24 thoughts on “Sniffing Around Inside A ThinkPad Battery

    1. The charging block is the least common fault I ever dealt with in laptops, thinkpads included.
      There is a recent spree of falling (not failing) fets off the board but that is not actually the charger…nm-d011, qb6 overheats beiond solder melting point due to being undredriven by the usb-c power chip ub7.
      The actuall charging pump on laptops almost never fails. Seldomly I find faults there, like the bq chip or a power fet and most of these are accidents like somebody playing with a screwdriver on a live laptop or liquids&corrosion.

      This dude’s battery my have a damaged cell that can’t charge to 4.20v anymore.

  1. The 18650 battery cells are the most obvious and likely thing to fail. Before messing around with complicated stuff, simply verify that each one has something like 3.8V minimum across it. If one or more cells is very low, there’s the problem. Whether you can actually fix it is another matter: I’ve read that Lenovo (and other evil companies) have charging boards that have fuses or other tricks intended to keep people from simply running out to the nearest headshop and buying more 18650s.

    1. In this case, having some form of self disabling on the BMS is a valid safety thing.

      I think it SHOULD be something that can be bypassed with moderate effort though. (Less than swapping chips. More than bridging 2 pads)

      You really need to use a pretty closely matched set of cells for these to be “safe”.
      Even when used properly, LiPo batteries are barely “safe”. It is very easy for someone who knows just enough to mess with them to create something dangerous.
      Letting people simply slap a new cell in is absolutely going to result in fires and destruction. Maybe even death.

      So, while these companies might be doing evil, letting someone simply pop out to a head shop for an 18650 is a huge no.

      1. Laptop cells are pushed pretty hard to begin with. They’re being charged close to the limits to get the maximum capacity.

        Lithium cells don’t exactly have a “full” voltage – the more you raise the voltage, the more charge they hold and the faster they get worn out, to the point of catching fire. Laptop cells are wired and charged in series, so any mismatch between the cells will quickly get worse and worse.

        1. Compare and contrast to things like electric scooter batteries, which are charged very conservatively to maintain maximum lifespan, which consequently allows the cells to drift apart a lot more with the extra voltage headroom they have.

          1. Now most ev batteries have balancing circuits that try to maintain mismatches to manageable levels, canceling small drifts. But laptop and power tools batteries… I never saw them having any balancing. Well matched in factory but no more.
            Also, Apple and Samsung push NMCs to 4.33v in most devices I’ve seen and worked with. A little extra umpf from the pack and a little less life.
            Can’t have something for nothing…

          2. Cost and complexity, as always. Balancing while charging is easy – you just shunt around the cells that get full before the others – balancing while discharging is a whole lot more difficult or practically impossible, because you can’t conjure up more charge for the cells that are empty before others.

    2. People putting “headshop” cells in their laptops and expecting the BMS to just accept it is the equivalent of putting a copper penny in the fuse holder in your home. There is a good reason they’ve designed against that. It also prevents the usual people from picking dead batteries out of scrap laptops sent overseas for recycling, and “refurbishing” them, then selling them as “genuine” spare parts.

      1. That. After the Samsung Airplane Phone disaster, no company wants to see their product in the “airplane fire” news.
        I’m surprised the battery is not in its own case, showing the actual manufacturer logo.

  2. It used to be a thing that laptop batteries would report false capacity if they were never unplugged but you could force them to ‘learn’ with a charge, discharge, recharge cycle but I’d expect any decent manufacturer to have fixed that by now so I’d probably want to break out the electornic dummy load and test the cells before mucking about with the controller chip.

    1. That “learning” was more of a operating system function, because the OS doesn’t know when the battery is empty when it has never seen it go empty. It tries to predict what “empty” means by observing how the BMS is behaving, so you would have to “calibrate” the meter by running the battery down and then back up full. Modern BMS:s are smarter and report the data directly.

      With a failing battery though, the re-learning method is not accurate. At low load the battery can give out the normal amount, but with any load the voltages will sag sooner and the BMS starts cutting out when the OS still thinks you should have half the battery left according to last “calibration”. When that happens, you start to notice the battery gauge jumping from 50% to 10% and then 5% in mere minutes.

      1. The easiest way to make a battery ‘re-learn’ was to put the laptop into the BIOS setup and leave it there until it went flat, then recharge, discharge, recharge and lo, the battery had magically restored itself.

        So it was totally independent of the OS

  3. The problem with many of these batteries is after the battery dies, the BMS trips a fault bit that is not resettable after simply recelling it, you have to be able to talk to BMS and tell it to reset the fault. Which requires special tools that cost a lot of money,
    I managed to do it with my Spark battery when I didnt charge it for too long
    https://mavicpilots.com/threads/dji-mavi-pro-battery-reset-using-cp2112-and-dji-battery-killer.143429/
    But otherwise for laptops I am only aware of this NLBA ($$$) https://www.laptopu.ro/2021/06/06/how-to-repair-a-laptop-battery-by-replacing-the-cells-and-reset-the-chip-bq9000/

    1. On mine there is an actual physical fuse that gets blown when the battery dies. It’s a safety feature to prevent charging dead cells with high internal resistance which will heat up and may catch fire.

  4. If you have “Bin Stores” (mostly Amazon returns) in your area, you might have good luck finding really inexpensive battery packs with 18650s inside. I’ve purchased many for 2-7$. A Dremel and a steady hand will have those batteries out in no time.

  5. It’s usually not worth the effort to attempt replacing the cells. The controller will be locked out if you disconnect any of the cells. Even if you manage to replace the cells without breaking the connection, the BMS will not be calibrated for the new cells.

  6. Speaking of which, does anyone know what cell is used in a 9-cell battery pack for a truly ancient Dell Vostro 15xx which won’t say die? The battery pack is the extended model instead of the standard one for the machine. My money’s on the 18650 and so far I haven’t done my due diligence in finding out. The 18650 is 3.7 VDC so it probably must be in some kind of S-P configuration (laptop’s voltage is 19 VDC).
    I love Dells, they don’t know how to quit. I maxed the RAM, I’m replacing the HD which needs replacing anyway with an SSD and maybe replace the CPU as well with the most powerful chip compatible with it and which sells for pennies in Aliexpress.

    And see how it works.

    1. After some searching I know now that the batt pack gives 11.1V so 9 cells could be 18650s in 3S-3P configuration which more or less match the power output (I think) of the batt pack.

      I’ll eventually need to open it up to find out.

  7. There’s already a lot of work done on these batteries by someone named Karosium.
    I’d recommend the OP to have a look into it, there’s a couple good articles, pieces of software and even the comments section full of useful info.
    I was able to use this to reset my ThinkPad battery which used the same controller chip, after I replaced the old cells with new high-quality ones

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.