Reviving a dead BT-E8010 battery

[S13]

So in regards of my previous post i will make a seperate topic about this.

In short, yesterday one of my 2 batteries died. I had just been fully charged the day before, and when i was on the trails riding, i wanted to swap in this battery. But sadly it wouldnt turn on at all. No lights, no error code.
So back home i put it on the charger and the charger now starts blinking, meaning an error. My other battery still works fine in my bike and with that charger. So im left with one dead battery.

Opening it up and measuring voltages etc, shows the cells are all at fully charged state (as expected), the on/off button functions correctly (i can see the signal propagating to the BMS) and the temperature sensors are working fine (i can see them being polled on my scope a couple of times per second).

So i measured a fuse that is surface mounted on the BMS. Its a FR-9550-30A:
https://media.digikey.com/pdf/Data Sheets/Cyntec/FR-9550-30A-(C01~C14)-B_Ds.pdf
(i kinda thougt it was an oscillator before, it looks like a typical SMD oscillator...)
The fuse is located in the path between the cells positive tab and the P-channel high side switches (which regulate power flow in and out of the battery)

So that fuse seems to be blown, or at least not showing full conductance. Now the weird part is, that fuse has an integrated heating element inside. Possibly to blow the fuse deliberately by the BMS itself. So now the question arises, did that fuse just accidently blew, or did the BMS blew the fuse deliberately? Im measuring some weird voltage fluctuations coming out of the fuse's primary contacts, but also the heater pin. Could the BMS be in a state actively trying to destroy the fuse?

Anyway, im now set out to just bypass the BMS and see if i can still keep using this battery. I know, i know, not the safest thing to do, but im still on the road for a couple of months so i see this more as a temporary fix, an experiment. I dont recommend other people just doing this, but perhaps we can learn a thing or 2 here...

So my bypass:

I just figured i would permanently bypass both the Fuse and the high side P-channel mosfet switches.

And lo and behold, it works!
Well im still in the testing phase. But what i can tell is that the bike has no problem with this battery. Obviously you no longer have an on/off switch so as soon as you insert the battery it turns the bike on. However i get no error codes, and battery percentage is reported correctly (at least initially at 100%). I get motor power when i start pedaling, just like normal.
STunlocker shows correct battery percentage and usage as well (current battery health at 89%, 93cycles). So i will do some more real world testing later this day, see if it keeps working ok!

Now, i still need to figure out the charging. Since the charger does not agree with the BMS it will still not charge the battery. Perhaps i will try to find one of those generic amazon ebike 36V 10cell ebike chargers and just connect to the battery terminals. At least i think i can ship one to a local amazon locker in the area...

 

[S13]

Alright! So far so good.
Did a fair bit of trail riding this afternoon with the "dead" battery. And all was working just fine
The battery gauge on the handlebar display is working correctly. It showed nice normal progression from full to almost empty. I stopped riding at ~20% battery, because for the next few days i have no way of recharging it.

My observations so far:
- Battery cannot be switched on or off, so you never have batt % indication on the battery itself (the 5 leds)
- There is a bit of inrush current when you connect the battery to the bike (you can hear it)
- The bike functions completely normal, throwing no error codes whatsoever
- Even though the battery cant switch itself off, the bike actually does! After like 15mins or so (not sure about the exact time) the handlebar display goes black and the motor assistance is gone. The only way to get it back powered on is to remove the battery from the bike and re-insert it.
- Battery gauge is working, so the BMS is actually still running its coulomb counting process. (discharging at least, cannot test charging yet)
- By removing the battery you switch the bike off abruptly (if you dont want to wait that 15 mins). Im not sure if this causes problems with storing things like odometer, fault codes etc. I will keep an eye on this the next couple of rides.

Ive ordered one of those cheap generic amazon ebike chargers, see if i can use that to recharge the battery via the battery terminals.

 

[S13]

While waiting for the generic charger to arrive, i thought it would be fun to see why my charger is not letting me charge the "dead" battery.
So i hooked up a scope to the signals and powerline that runs from the charger to the battery BMS.

There is negotiation happening between the charger and BMS, so the charger knows the state of the battery and bms, and knows if it can safely apply charging power.

From what i was able to work out, there are 3 communication lines, 2 are simple UART RX and TX lines, the other doesnt do much (perhaps just a presence signal or something). Communication is running at 9600baud so its easy to capture and see what is going on.
Charger seems to be the master, the BMS responds to its commands. General packet structure (im using the first encountered packet as an example):

0x00 -> Start of packet
0x41 -> Command (can be anything, but below 0x80 i would think)
0x00 -> Length of payload that follows after this byte, in this case 0 bytes (there is no payload in this example)
0xF9 -> CRC-16/X-25 low byte calculation of the packet, starting from Command, ending with the payload
0x50 -> CRC-16/X-25 high byte calculation of the packet, starting from Command, ending with the payload

The BMS always responses to a command with a similar packet structure. However the Command byte now becomes the Response byte, which is equal to Command+0x80.

So the BMS responses to the previous example as follows:
0x00 -> Start of packet
0xC1 -> Response (equal to Command+0x80)
0x00 -> Length of payload that follows after this byte, in this case 0 bytes (there is no payload in this example)
0x35 -> CRC-16/X-25 low byte calculation of the packet, starting from Command, ending with the payload
0xDC -> CRC-16/X-25 high byte calculation of the packet, starting from Command, ending with the payload

I expect this first encountered packet to be something like a communication check, or presence check. Just to see if communication is good to go. There is no data payload, so no data is being exchanged yet.

So with my good battery this whole setup looks something like this on my scope:

You can see the communication lines in yellow(RX), blue (TX), purple (presence line or something?) and Green (power line)
Since this battery is good and full the power line is only applied a short period, but communication consists of multiple steps and keeps going even after power is removed.

Now the "dead" battery:

So as you can see, that other than the initial command and response packet, there is only one other command and response packet (this one does have more data, i will show later). Even though power is applied for a short time (green line), it is immediately removed after the first payload packet and then communication halts completely. The charger will then start blinking its led (indicating an error).

So is there a clue to be found in that first payload packet?
Trying to decode the payload of the packets is difficult. I can only compare the good vs the dead battery. I have made several captures of the RX and TX data of both the good and dead battery at startup. There is a highly variable payload content but there are some consistencies. On that first payload response packet, the good BMS will always start its payload with the values: 0x30, 0x00. However the dead BMS will always start its payload response with 0x30, 0x25.
I will try to post a couple of CSV files with all the captured RX and TX data later. However, i suspect that 2nd payload byte flipping from 0x00 to 0x25 might be the indication of the BMS that it is bricked and prevents the charger from starting its charging process...

 

[steve_sordy]

Well, I'm impressed!

 

[S13]

Well, I'm impressed!

Why thank you


Ok, ive just received the cheap generic 10cell lithium charger from amazon, so lets find out if we can also charge the dead battery!

 

[S13]

Another update on the "dead" battery. I did a partial charge with the generic amazon charger, just to see if everything is working as it should.
And yes, we have a nice 2.1amp charging current through the battery terminals and cell voltage is rising. I stopped charging after a couple of hours and all cells now measure around 4.02 to 4.03 volt.
Next i put the battery back on the bike to check the battery level indicator. And yes, that is working too! The handlebar display level indicator got up to 4 bars (where it was at 2 bars before charging) and stunlocker shows battery level at 75%.

Thats all good news i guess. I will now try to charge to a full state and see how the charger and cell voltage behave.

If anyone is interested, im using this charger from amazon:
KFD Cargador de batería Fuente de alimentación 36V 42V 2A
It shows a red led while charging and then a green led when its done. Simple, but should do the trick.

 

[jimbob]

Very interesting, and good work!

Strange that enough of the BMS is working to be able to monitor and report battery state, but not communicate correctly with the charger.

Have you thought about shorting the blown fuse to see what happens?

 

[robbydobs]

What are you using to capture that information out of interest??

I'm poking around in the firmware at the moment, but I'm new to the hardware reverse engineering stuff!

 

[S13]

Very interesting, and good work!

Strange that enough of the BMS is working to be able to monitor and report battery state, but not communicate correctly with the charger.

Have you thought about shorting the blown fuse to see what happens?

Thank you!
So yeah, parts of the BMS still work as it should, but other parts are just in the "bricked" state. I have thought about shorting the fuse, but a) i currently dont have access to my SMD rework tools, and b) i figure it wont work any way, the BMS chip in that bricked state probably wont switch the high side p-channel mosfets on anyway. So bypassing the entire power path seems the easiest thing to do for now.

 

[S13]

What are you using to capture that information out of interest??

I'm poking around in the firmware at the moment, but I'm new to the hardware reverse engineering stuff!

Im using a Siglent SDS1104X-E for that purpose. Its an affordable 4 channel scope with built-in protocol decode function. Always comes in handy when troubleshooting electronics.
What are you trying to do with the firmware if i may ask?

 

[jimbob]

Thank you!
So yeah, parts of the BMS still work as it should, but other parts are just in the "bricked" state. I have thought about shorting the fuse, but a) i currently dont have access to my SMD rework tools, and b) i figure it wont work any way, the BMS chip in that bricked state probably wont switch the high side p-channel mosfets on anyway. So bypassing the entire power path seems the easiest thing to do for now.

Thanks!

Does that mean that the BMS is a separate circuit to that for the communication to the bike / charger?

 

[jimbob]

What are you using to capture that information out of interest??

I'm poking around in the firmware at the moment, but I'm new to the hardware reverse engineering stuff!

Would also be very interested in what you're upto.

 

[RickBullotta]

Curious why you didn't just bypass the fuse (or put another one in parallel)?

 

[S13]

Curious why you didn't just bypass the fuse (or put another one in parallel)?

Like i said earlier:
a) i currently dont have access to my SMD rework tools, and b) i figure it wont work anyway, the BMS chip in that bricked state probably wont switch the high side p-channel mosfets on.

 

[S13]

Does that mean that the BMS is a separate circuit to that for the communication to the bike / charger?

Well, all the BMS "logic" is inside one chip. Its probably a shimano proprietary design, couldnt find any info on that chip. In that chip there are probably several separate hardware circuits for things like protection (overvoltage, undervoltage, temperature, overcurrent etc), communication (to motor and to charger), coulomb counting (the thing that keeps track of the battery % level) and maybe a couple of other things (led control for example).
The fact that protection has kicked in, does not mean the other hardware circuits in that chip stop working. Communication and coulomb counting remains operational it seems.

 

[S13]

So another update:
yesterday i was able to fully charge the "dead" battery with the generic charger. I really like how good that thing is working btw. It does a nice 2A constant current, right up to ~80% and then slowly tapers off to lower and lower current until all cells are fully charged at 4.16V

In fact, compared to the shimano original charger, it is more careful with charge current when nearing 100%. The taper is longer and more gentle. That does mean it takes a little longer for those last 5 to 10%'s, but at least its more safe.

Charging too quickly at almost full state can cause imbalance between the cells. I now actually suspect that might have been the reason for the original failure of this "dead" battery. Since the failure must have happened at some time near the end of a charge cycle. Alternatively it must have happened when transporting the battery, but that seems highly unlikely...

Anyway, i took the fully recharged dead battery for a spin, and it works great! My bike feels just as normal, with the pedal assist
One problem i encountered though, is that for some reason the battery level indicator did not start at 100%. In fact it started at 77%. Im not sure what mechanism Shimano uses to detect a 100% charged battery? In any case the indicator was off by more than 20% at the start. During the ride it counted down at the normal expected rate, but that meant that at 0% on the indicator, the battery had still ~20% left in it. I could have continued riding at that point, but i decided to play it safe and stop there.
The coming days i'll do more charge cycles and see how the indicator on the handlebar behaves!

 

[jimbob]

Well, all the BMS "logic" is inside one chip. Its probably a shimano proprietary design, couldnt find any info on that chip. In that chip there are probably several separate hardware circuits for things like protection (overvoltage, undervoltage, temperature, overcurrent etc), communication (to motor and to charger), coulomb counting (the thing that keeps track of the battery % level) and maybe a couple of other things (led control for example).
The fact that protection has kicked in, does not mean the other hardware circuits in that chip stop working. Communication and coulomb counting remains operational it seems.

Thanks for the detailed explanation. I wasn't sure if there were more chips on the back of the board.

I'd be surprised if they used a dedicated chip for the BMS - ASICS are usually far more expensive than a micro processor and less flexible. I could of course be wrong, but just strikes me as strange, and if so, that part of it was still working. Hence my curiosity of replacing / shorting the blown fuse.

Out of interest (and inspired by this) I had a quick look inside my internal E8035 battery, and it would appear to be similar circuits, although I couldn't fully open it as the switch us RTVd in place and I didn't want to have to redo it.

On a brighter note, it looks not too hard to re-cell the batteries when needed.

Thanks again for posting, all very interesting!

 

[S13]

Since my last update, ive added an ON/OFF switch to the battery:

The switch interrupts the positive power lead from pack to the battery terminal. I needed something to reduce the inrush current when connecting the battery to the bike or the charger. That inrush current was doing some real harm! You could hear it arc pretty violently when placing the battery on the bike. So you run the risk of destroying the contacts of the terminal.
And so for that reason, the switch also has a 10ohm resistor shorted across it, so that when the switch is in the OFF position there is a 10ohm path from the cells to the battery terminal. That way you can insert the battery, have only minimal inrush current (still a couple of amps), then switch it to ON position and you can ride the bike.
The same applies for connecting the charger.


Yesterday the battery performed great. After the last charge it now actually did register as "full" (5 bars) on the handlebar display. Rode it until about 2 bars, put it back on the generic charger and 5 hours later i had a fully charged battery again! Awesome!

So im pretty happy for now. Im still able to use the dead battery, without too much fuss. And i can now charge my 2 batteries at the same time since i have 2 chargers now! Sort of a win situation i guess...?

Still, for anyone wanting to try this out for themselves, i do need to stress that without a BMS you no longer have adequate protection for your battery cells. That means making sure you dont charge or discharge them when outside the temperature range. Also manually check the cell balance every once in a while when nearing 100% charge.
Perhaps it is a good idea to place an inline 30A fuse somewhere in the battery for short circuit protection. I might add that at a later point.
Also im not sure how the bike now handles a battery empty cutoff? Havent tried running the battery all the way down to zero yet. Maybe it works, maybe it doesnt?

 

[eMullet]

If you leave the battery on the bike and the switch is off, does that mean that resistor acts as a ~50W heater? Could that generate some potentially dangerous situations? Would a NTC thermistor be a better option?

Anyway, cool project you got there.

 

[S13]

If you leave the battery on the bike and the switch is off, does that mean that resistor acts as a ~50W heater? Could that generate some potentially dangerous situations?

Yes, yes it does...
But only if you activate the motor.

Yeah this botched solution isnt perfect...
You would know that something is wrong though, the resistor blocks soo much current that the motor wouldnt even run and probably goes in to shutdown due to the voltage collapse.

But perhaps some kind of resettable PTC fuse would be a good solution instead of a fixed resistor.

 

[S13]

Well i couldnt be happier...
The battery is performing great. Ive done three complete cycles and it is working perfectly. The battery gauge on the handlebar display shows the correct level. Yay!

 

[Spiff]

My original external battery BT-E8010, which is out of warranty, gave an E020 error:

So the fix I have to try is to "close" the sockets in battery so they make contact with the male pins in frame.

As you have opened the battery, do you have any recommendation on how to do this??

Do I have to open the battery or it can be done from outside??

 

[Spiff]

I "closed" the socket "walls" from outside using a thin sewing pin, and now the battery is working and not showing E020 error. Now I have to test it in a trail, but looks that problem is fixed cheap and easy.

 

[S13]

Yeah i was just going to say, use some tweezers with very fine point and you can bend the internal pins inwards (toward each other). You can do this from the outside, no need to open the battery.
Ive done the same for the primary battery contacts, giving them a little more spring force on the tabs.

Anyway, good thing you were able to fix your battery!

 

[Spiff]

Hi S13, thank you for your help your work with battery and battery is amazing, you remind me of Mr. Wolf: “I'm Winston Wolf. I fix problems.” . Ha ha

The openings in the battery connector are so small that even the smallest tweezers does not fit, so I used a sewing pin. I am opening a new thread with the proper tittle, so anybody with this error can search and find the fix.

 

[joxelitor]

I'd be surprised if they used a dedicated chip for the BMS - ASICS are usually far more expensive than a micro processor and less flexible. I could of course be wrong, but just strikes me as strange, and if so, that part of it was still working. Hence my curiosity of replacing / shorting the blown fuse.

The BMS-AFE is an standard chip from Texas Instrumets, it controls de secondary protection, the "fuse" you mention, as a last line of defense
May be for any reason, the BMS tripped an alarm and tirggered the fuse

What is more interesting is that the control circuit, the uC driven does not block the battery when the BMS triggers a critical alarm.
You could attach a BMS from Daly por example if there is enough room to fit it correctly and still maintain the communication with the motor.

Anyway, a question worries me!!!
¿What protects de inside circuitry if the PCB against a short for example in the uC section?
A critical failure should trip all the power path down as close as posible to the input terminals from the battery pack!

 

[Lovely]

My BT-E8101 battery is no longer working, it needs a new BMS - can such a thing be sourced? Thanks.

Louis.

 

[Spiff]

My BT-E8101 battery is no longer working, it needs a new BMS - can such a thing be sourced? Thanks.

Louis.

Shimano does not provide ANY spare part for motor, battery, etc. You may rehuse a BMS from another battery with dead cells, but you'll need soldering skills and also be very careful.

 

[CloudInMyHead]

This is all amazing information. My BT-E8010 will not power on my bike nor show any power level when the on/off button is pressed. The battery will charge and shows it has 4 out of 5 bars already charged.
I'm guessing either the power switch is dead or maybe that fuse? I don't know. The bike was not in use when this started. I rode the bike for 1 minute. Powered it off. Left it off and parked for 2 days. Drove it home and then it could not power on again. Tested it off the bike and no power level displayed when the on/off button is pressed. The battery still has a charge as shown in the photo.

 

[S13]

The battery will charge and shows it has 4 out of 5 bars already charged.
I'm guessing either the power switch is dead or maybe that fuse?

If yours is still getting charged then its not the fuse that is blown, and the BMS is still OK. So that would be a different issue than described in this topic. In your case i would look at the power switch first.