Reviving a dead BT-E8010 battery

[CloudInMyHead]

If yours is still getting charged then its not the fuse that is blown, and the BMS is still OK. So that would be a different issue than described in this topic. In your case i would look at the power switch first.

The switch is what I was thinking too before I saw this thread and then second guessed my thought. Plus after seeing your thread and realizing it could be so many other things that I did not even know about. I am waiting for another used battery to arrive next week from the shop that sold me the used bike. Once it arrives I will take this one apart and see if I can fix it. I'm hoping there is just a loose wire to the switch as I'm not sure where I can find a membrane type switch to fit there. I guess I'll know once I am inside.

 

[Spiff]

It is not a membrane switch, the membrane is just a water proof protection, below there is a "standard" mechanical pushbutton.

 

[richk]

So in regards of my previous post i will make a seperate topic about this.

In short, yesterday one of my 2 batteries died. I had just been fully charged the day before, and when i was on the trails riding, i wanted to swap in this battery. But sadly it wouldnt turn on at all. No lights, no error code.
So back home i put it on the charger and the charger now starts blinking, meaning an error. My other battery still works fine in my bike and with that charger. So im left with one dead battery.

Opening it up and measuring voltages etc, shows the cells are all at fully charged state (as expected), the on/off button functions correctly (i can see the signal propagating to the BMS) and the temperature sensors are working fine (i can see them being polled on my scope a couple of times per second).

So i measured a fuse that is surface mounted on the BMS. Its a FR-9550-30A:
https://media.digikey.com/pdf/Data Sheets/Cyntec/FR-9550-30A-(C01~C14)-B_Ds.pdf
(i kinda thougt it was an oscillator before, it looks like a typical SMD oscillator...)
The fuse is located in the path between the cells positive tab and the P-channel high side switches (which regulate power flow in and out of the battery)

So that fuse seems to be blown, or at least not showing full conductance. Now the weird part is, that fuse has an integrated heating element inside. Possibly to blow the fuse deliberately by the BMS itself. So now the question arises, did that fuse just accidently blew, or did the BMS blew the fuse deliberately? Im measuring some weird voltage fluctuations coming out of the fuse's primary contacts, but also the heater pin. Could the BMS be in a state actively trying to destroy the fuse?

Anyway, im now set out to just bypass the BMS and see if i can still keep using this battery. I know, i know, not the safest thing to do, but im still on the road for a couple of months so i see this more as a temporary fix, an experiment. I dont recommend other people just doing this, but perhaps we can learn a thing or 2 here...

So my bypass:

I just figured i would permanently bypass both the Fuse and the high side P-channel mosfet switches.

And lo and behold, it works!
Well im still in the testing phase. But what i can tell is that the bike has no problem with this battery. Obviously you no longer have an on/off switch so as soon as you insert the battery it turns the bike on. However i get no error codes, and battery percentage is reported correctly (at least initially at 100%). I get motor power when i start pedaling, just like normal.
STunlocker shows correct battery percentage and usage as well (current battery health at 89%, 93cycles). So i will do some more real world testing later this day, see if it keeps working ok!

Now, i still need to figure out the charging. Since the charger does not agree with the BMS it will still not charge the battery. Perhaps i will try to find one of those generic amazon ebike 36V 10cell ebike chargers and just connect to the battery terminals. At least i think i can ship one to a local amazon locker in the area...

Any high power electric device should have a fuse to keep things safe. Lithium batteries can deliver a huge current thanks to their low internal resistance and if they overheat they can catch a volatile fire.

I would add a 30A automotive fuse in series to the red bypass wires just to in case something goes wrong. That special SMD fuse with the heat-element was 30A on my BT-E6010 battery.

May be a better option would be to add a regular 10S BMS in parallel to the Shimano BMS to keep the cells balanced while charging them. Without that the cells will get out of balance with different voltages and charge levels leading to battery damage due to over/under voltage sooner or later.

I managed to trigger some protection of the BT-E6010 battery by trying to discharge it directly. This has blown the special SMD fuse and probably did something else in the BMS to make it permanently shutdown. First I substituted the SMD fuse with a 30A mini car fuse and a 56Ohm resistor for the heating element, but that didn't make any difference. I managed to completely power down the BMS by disconnecting the balancing wires and de-soldering the positive nickel terminal from the PCB, but it didn't help to bring it back to life. (The SMD fuse is only for high current MOSFETs and there is a separate power path for the BMS chips.) I just wanted to check how much capacity the cells still have, but it was a very, very, very bad idea.

I may add balancing wires and external balancing connector to be able to charge the battery directly with a RC charger.

 

[Ianz1]

So in regards of my previous post i will make a seperate topic about this.

In short, yesterday one of my 2 batteries died. I had just been fully charged the day before, and when i was on the trails riding, i wanted to swap in this battery. But sadly it wouldnt turn on at all. No lights, no error code.
So back home i put it on the charger and the charger now starts blinking, meaning an error. My other battery still works fine in my bike and with that charger. So im left with one dead battery.

Opening it up and measuring voltages etc, shows the cells are all at fully charged state (as expected), the on/off button functions correctly (i can see the signal propagating to the BMS) and the temperature sensors are working fine (i can see them being polled on my scope a couple of times per second).

So i measured a fuse that is surface mounted on the BMS. Its a FR-9550-30A:
https://media.digikey.com/pdf/Data Sheets/Cyntec/FR-9550-30A-(C01~C14)-B_Ds.pdf
(i kinda thougt it was an oscillator before, it looks like a typical SMD oscillator...)
The fuse is located in the path between the cells positive tab and the P-channel high side switches (which regulate power flow in and out of the battery)

So that fuse seems to be blown, or at least not showing full conductance. Now the weird part is, that fuse has an integrated heating element inside. Possibly to blow the fuse deliberately by the BMS itself. So now the question arises, did that fuse just accidently blew, or did the BMS blew the fuse deliberately? Im measuring some weird voltage fluctuations coming out of the fuse's primary contacts, but also the heater pin. Could the BMS be in a state actively trying to destroy the fuse?

Anyway, im now set out to just bypass the BMS and see if i can still keep using this battery. I know, i know, not the safest thing to do, but im still on the road for a couple of months so i see this more as a temporary fix, an experiment. I dont recommend other people just doing this, but perhaps we can learn a thing or 2 here...

So my bypass:

I just figured i would permanently bypass both the Fuse and the high side P-channel mosfet switches.

And lo and behold, it works!
Well im still in the testing phase. But what i can tell is that the bike has no problem with this battery. Obviously you no longer have an on/off switch so as soon as you insert the battery it turns the bike on. However i get no error codes, and battery percentage is reported correctly (at least initially at 100%). I get motor power when i start pedaling, just like normal.
STunlocker shows correct battery percentage and usage as well (current battery health at 89%, 93cycles). So i will do some more real world testing later this day, see if it keeps working ok!

Now, i still need to figure out the charging. Since the charger does not agree with the BMS it will still not charge the battery. Perhaps i will try to find one of those generic amazon ebike 36V 10cell ebike chargers and just connect to the battery terminals. At least i think i can ship one to a local amazon locker in the area...

This is fantastic work. I have a Cannondale Neo with the Shimano Steps system with a E6010 battery.

I hope you can help me or point me in the right direction.

The bike just stopped on me. No display. When the battery is off the bike you can press the on button and it shows a good charge. When on the charger, it starts with a solid yellow but times out with the yellow charger LED blinking and the 2 outside LEDS of the battery also flashing (which indicates battery error) after about 15 seconds. When I put the battery back on the bike nothing happens. The screen is dead and unable to switch "on" at the computer display or at the battery. Take the battery off the bike, I can switch on the battery, but again, it times out after about 15 seconds. I put the battery on the bike after switching the battery "on" and the battery stays on, again for about 15 seconds before timing out. During the short time the battery was still "on" while on the bike, with the battery LEDs on, the computer still would not switch "on", just stayed dead.

Took the battery apart and it seemed as though the heat fuse was blown. Like you I by-passed all the electronics on the pcb of the battery ie soldered a wire so there was a direct connection from battery to the plug. Confirmed that there was voltage (39volts) at the connection plug of the battery, plugged it back into the bike .... and still nothing.

This seems to be quite a smart (or dumb) system. It has a bus system (rx and tx) between the charger and the battery so I assume it may also comunicate between the battery and the bike? And this is what I would like your opinion on.

With the battery BMS bypassed turning the battery "on" is irrelevant. The bike will be "on" as soon as it is connected to the bike. My question is does anyone know if the bike will fire up if there is no communication from the battery or if perhaps if there is an error signal transmitted from the battery to the bike? ie will the bike work by suppling the required voltage directly to the bike or does the bike require the authenticated handshake from the battery to enable the bike to function?

I have been unable to find any info really on the Shimano steps system and how it operates other than the operaton and dealers assembly manuals, and your analysis.

I am not close to any dealer or techs and would like to isolate the issue through ilimination as not sure if I have more than one problem ie battery alone or battery and bike.

Perhaps someone has had a similar issue or perhaps offer suggestions or a few links I could research.

Any help much appreciated.

 

[S13]

This is fantastic work. I have a Cannondale Neo with the Shimano Steps system with a E6010 battery.

I hope you can help me or point me in the right direction.

The bike just stopped on me. No display. When the battery is off the bike you can press the on button and it shows a good charge. When on the charger, it starts with a solid yellow but times out with the yellow charger LED blinking and the 2 outside LEDS of the battery also flashing (which indicates battery error) after about 15 seconds. When I put the battery back on the bike nothing happens. The screen is dead and unable to switch "on" at the computer display or at the battery. Take the battery off the bike, I can switch on the battery, but again, it times out after about 15 seconds. I put the battery on the bike after switching the battery "on" and the battery stays on, again for about 15 seconds before timing out. During the short time the battery was still "on" while on the bike, with the battery LEDs on, the computer still would not switch "on", just stayed dead.

Took the battery apart and it seemed as though the heat fuse was blown. Like you I by-passed all the electronics on the pcb of the battery ie soldered a wire so there was a direct connection from battery to the plug. Confirmed that there was voltage (39volts) at the connection plug of the battery, plugged it back into the bike .... and still nothing.

This seems to be quite a smart (or dumb) system. It has a bus system (rx and tx) between the charger and the battery so I assume it may also comunicate between the battery and the bike? And this is what I would like your opinion on.

With the battery BMS bypassed turning the battery "on" is irrelevant. The bike will be "on" as soon as it is connected to the bike. My question is does anyone know if the bike will fire up if there is no communication from the battery or if perhaps if there is an error signal transmitted from the battery to the bike? ie will the bike work by suppling the required voltage directly to the bike or does the bike require the authenticated handshake from the battery to enable the bike to function?

I have been unable to find any info really on the Shimano steps system and how it operates other than the operaton and dealers assembly manuals, and your analysis.

I am not close to any dealer or techs and would like to isolate the issue through ilimination as not sure if I have more than one problem ie battery alone or battery and bike.

Perhaps someone has had a similar issue or perhaps offer suggestions or a few links I could research.

Any help much appreciated.

Well, i think yes, the motor does need to communicate with the BMS in order to start at all. If you have no communication at all, the motor probably wont start up. Just having the power diverted to the motor is most likely not enough. The same goes for the charger; it needs to communicate properly with the battery in order to start the charging process.

To be honest i was a bit surprised my hack worked at all, because the BMS obviously was in a bad state (since the fuse was blown and the charger wouldnt work). Now it could be that my older motor firmware still allowed this behavior. But its not guaranteed to work on other/newer firmware or other motors, like your E6000.

I havent spend much time on it since, ive kind of moved on. Got a new bike with a different motor. Im still using the hacked E8000 every now and then. And it seems to keep working. Couple of things i did change:
- Manual On/Off switch: Removed it, it would fail because of vibration
- Added soft inrush circuit on the bike so when the battery is being attached it wont spark and burn up the contacts.
Still havent gotten around to placing that inline fuse yet...

I know there is not a lot of information to find on the Shimano systems. Shimano really didnt want anyone poking around, modifying or repairing things. Combine that with a system that was unreliable in the first place (in my case 2 batteries that just stopped working for no reason, bearings on the motor that failed after 4k kms, internal gears that failed after 5k kms) and i kinda gave up. I will keep using it the way it is, but my primary bike no longer has the shimano system.

 

[Alex51]

While waiting for the generic charger to arrive, i thought it would be fun to see why my charger is not letting me charge the "dead" battery.
So i hooked up a scope to the signals and powerline that runs from the charger to the battery BMS.

There is negotiation happening between the charger and BMS, so the charger knows the state of the battery and bms, and knows if it can safely apply charging power.

From what i was able to work out, there are 3 communication lines, 2 are simple UART RX and TX lines, the other doesnt do much (perhaps just a presence signal or something). Communication is running at 9600baud so its easy to capture and see what is going on.
Charger seems to be the master, the BMS responds to its commands. General packet structure (im using the first encountered packet as an example):

0x00 -> Start of packet
0x41 -> Command (can be anything, but below 0x80 i would think)
0x00 -> Length of payload that follows after this byte, in this case 0 bytes (there is no payload in this example)
0xF9 -> CRC-16/X-25 low byte calculation of the packet, starting from Command, ending with the payload
0x50 -> CRC-16/X-25 high byte calculation of the packet, starting from Command, ending with the payload

The BMS always responses to a command with a similar packet structure. However the Command byte now becomes the Response byte, which is equal to Command+0x80.

So the BMS responses to the previous example as follows:
0x00 -> Start of packet
0xC1 -> Response (equal to Command+0x80)
0x00 -> Length of payload that follows after this byte, in this case 0 bytes (there is no payload in this example)
0x35 -> CRC-16/X-25 low byte calculation of the packet, starting from Command, ending with the payload
0xDC -> CRC-16/X-25 high byte calculation of the packet, starting from Command, ending with the payload

I expect this first encountered packet to be something like a communication check, or presence check. Just to see if communication is good to go. There is no data payload, so no data is being exchanged yet.

So with my good battery this whole setup looks something like this on my scope:

You can see the communication lines in yellow(RX), blue (TX), purple (presence line or something?) and Green (power line)
Since this battery is good and full the power line is only applied a short period, but communication consists of multiple steps and keeps going even after power is removed.

Now the "dead" battery:

So as you can see, that other than the initial command and response packet, there is only one other command and response packet (this one does have more data, i will show later). Even though power is applied for a short time (green line), it is immediately removed after the first payload packet and then communication halts completely. The charger will then start blinking its led (indicating an error).

So is there a clue to be found in that first payload packet?
Trying to decode the payload of the packets is difficult. I can only compare the good vs the dead battery. I have made several captures of the RX and TX data of both the good and dead battery at startup. There is a highly variable payload content but there are some consistencies. On that first payload response packet, the good BMS will always start its payload with the values: 0x30, 0x00. However the dead BMS will always start its payload response with 0x30, 0x25.
I will try to post a couple of CSV files with all the captured RX and TX data later. However, i suspect that 2nd payload byte flipping from 0x00 to 0x25 might be the indication of the BMS that it is bricked and prevents the charger from starting its charging process...

Good job, could you tell me the data velocity? thanks

 

[S13]

I think it was standard RS232; 9600baud, 8N1.