Specialized Warranty Expired - battery failure, what are my options?

[GZA]

My 2019 Levo expert warranty has just expired, so naturally I’ve just had a battery failure (third green LED flashing when charging, bike completely unresponsive), so I’m guessing I will need to purchase a new battery. The battery was replaced under warranty over two years ago, but has failed again.

Are there any other options? Does anyone repair these? Usually any repairs are conveniently priced approx half the replacement cost, just shy of what you’d say sod it just buy new with warranty!

Had anyone had any luck with warranty past the stated period? Is it worth me loosing a day to a round trip to give it a try?

Any advice or similar experience appreciated

 

[Mcharza]

See the Discount Structure section here if that would be helpful.

Global Warranty Page

From seasoned pros and weekend warriors to kids and commuters, if you ride, we’re here for you. We believe that bikes have the power to change lives, and this simple truth drives us to be and do better.

www.specialized.com

 

[GZA]

See the Discount Structure section here if that would be helpful.

Global Warranty Page

From seasoned pros and weekend warriors to kids and commuters, if you ride, we’re here for you. We believe that bikes have the power to change lives, and this simple truth drives us to be and do better.

www.specialized.com

That is helpful thank you - there maybe hope of a discounted replacement then, that would certainly be appreciated

 

[cream]

Specialized batteries CAN be repaired. Most M2 batteries with 3rd led blinking when charging have good cells inside and a locked BMS. Assuming the cells are good, I can unlock/repair the BMS so the battery can be used again.

There are parts of the circuit inside that work on very low currents so any moisture inside can prevent the BMS from functioning properly. The firmware will then prevent the battery from being used, setting a PF flag (permanent failure).

I've spent quite a while reverse engineering Specialized battery management systems present on M1 or M2 models.

Also, BMS can be completely separated from the battery in case you want a cell replacement. Then, it can be connected back. I can also reset battery metrics in this case (battery health, cycle count, design capacity).

 

[BansEN77]

Specialized batteries CAN be repaired. Most M2 batteries with 3rd led blinking when charging have good cells inside and a locked BMS. Assuming the cells are good, I can unlock/repair the BMS so the battery can be used again.

There are parts of the circuit inside that work on very low currents so any moisture inside can prevent the BMS from functioning properly. The firmware will then prevent the battery from being used, setting a PF flag (permanent failure).

I've spent quite a while reverse engineering Specialized battery management systems present on M1 or M2 models.

Also, BMS can be completely separated from the battery in case you want a cell replacement. Then, it can be connected back. I can also reset battery metrics in this case (battery health, cycle count, design capacity).

Can you help me with resolving my gen1 504WH battery issue? The BMS is now blinking with 3 red lights.
Some water entered the battery- couple of LEDs were permanently lighting in red. I've opened the battery, demoisted it, cleaned the LEDs contacts with isopropyl alcohol (successfully) but now the BMS issue. I am ready to pay, even for remote assistance ;-)

 

[cream]

Just cleaning the LED board shouldn't trigger any error on the BMS. Maybe you accidentally touched something on the BMS board. Have you checked all cell banks if they have nominal levels(3-4.15V) and balanced (approx same voltage down to 10-50mV on each bank)? Are there any water signs/oxidation on the BMS board? I can help with BMS repair/unlock but make sure the cells are ok, otherwise the only solution is to replace all the banks. Also, I will need physical access to the battery.

 

[BansEN77]

The banks are at 3,92V. All of them. Couple of the screws have oxidation, but nothing visible on the PCB itself. I can provide you with videos of the battery inspection. I do not see sending the whole battery back and forth between Poland/Romania as a reasonable solution. I believe being guided by you I can perform the necessary steps myself.
Please find attached my direct contact details.

 

[cream]

The 3 LED red error can appear on different faults. Some faults will permanently disable access to the battery pack(charge/discharge), some won't. First, I would check the 2 NTC sensors near the VG terminal and monitoring channels of the BMS. This includes connections/circuirtry from the balancing tabs to the inputs of the AFE (panasonic AN49511A). Also, check SFC fuses for continuity. If they are blown, most likely the BMS entered protection mode (permanent failure). In this case, even if you replace them, the battery won't recover.

Of course, if you have access to diagnostic equipment (or somenone near you), make a report to see why/when the error was triggered and what the error is. Check to see if the diagnostic software correctly show the correct voltage levels on each cell bank.If the BMS entered "Permanent Failure" state, it needs to be unlocked. That, you can't do with dealer diagnostic tools. Or remote.

Other than that, I can't give a clear solution without knowing the exact problem. That can be done by physical access to the battery.

Good luck!

 

[lisalis]

Specialized batteries CAN be repaired. Most M2 batteries with 3rd led blinking when charging have good cells inside and a locked BMS. Assuming the cells are good, I can unlock/repair the BMS so the battery can be used again.

There are parts of the circuit inside that work on very low currents so any moisture inside can prevent the BMS from functioning properly. The firmware will then prevent the battery from being used, setting a PF flag (permanent failure).

I've spent quite a while reverse engineering Specialized battery management systems present on M1 or M2 models.

Also, BMS can be completely separated from the battery in case you want a cell replacement. Then, it can be connected back. I can also reset battery metrics in this case (battery health, cycle count, design capacity).

so does it mean it's basically possible to take a dead battery, replace only the cells and have it working on a specialized bike ? The BMS is the thing locking it to specialized right ??

 

[Dirtnvert]

Ive heard of a few occasions where they warranteed motors after the warrantee period. Maybe theyll help ya out with the battery

 

[cream]

so does it mean it's basically possible to take a dead battery, replace only the cells and have it working on a specialized bike ? The BMS is the thing locking it to specialized right ??

Yes, you got it right. But most gen2/3 faulty batteries I serviced had problems with the BMS, not the cells. That's because water can get inside to the BMS board (which is on the bottom part of the battery).

 

[lisalis]

Yes, you got it right. But most gen2/3 faulty batteries I serviced had problems with the BMS, not the cells. That's because water can get inside to the BMS board (which is on the bottom part of the battery).

Oh so it's basically impossible to get a "dead" battery ? There should be a way to acquire a BMS i guess to make a custom battery ?

 

[cream]

What do you mean by custom battery? What is your goal? You want to be able to use a generic battery on a Specialized ebike? Won't fitting be a problem ?

 

[lisalis]

What do you mean by custom battery? What is your goal? You want to be able to use a generic battery on a Specialized ebike? Won't fitting be a problem ?

Nono i want to basically make a second battery that i can fit into a 2nd hand specialized battery with possibly a dead BMS.
Where i live the specialized battery are 1k€. For this price i can make 2 batteries so i would rather buy a second hand dead battery and possibly replace the BMS with a good one and replace the cells. I know some batteries are around and people probably could sell dead ones for cheap. I mean if there are other ways i would try but i think it's impossible to pair another BMS with specialized ebikes so

I will see if specialized offer just BMS replacement or not and if its possible to buy a BMS from them

 

[PaulK]

I think it is a 50% reduction as it is just out of warranty.

 

[cream]

Nono i want to basically make a second battery that i can fit into a 2nd hand specialized battery with possibly a dead BMS.
Where i live the specialized battery are 1k€. For this price i can make 2 batteries so i would rather buy a second hand dead battery and possibly replace the BMS with a good one and replace the cells. I know some batteries are around and people probably could sell dead ones for cheap. I mean if there are other ways i would try but i think it's impossible to pair another BMS with specialized ebikes so

I will see if specialized offer just BMS replacement or not and if its possible to buy a BMS from them

Ok, I get it. Unless major water damage across the board, I can help you repair/unlock M1 battery BMS.

I don't think Specialized or other manufacturer will sell you internal battery parts. Or motor parts (besides the belt kit ).

 

[k0lo86]

Ok, I get it. Unless major water damage across the board, I can help you repair/unlock M1 battery BMS.

I don't think Specialized or other manufacturer will sell you internal battery parts. Or motor parts (besides the belt kit ).

Hi,
So if you can help with unlock. I have some question to you.

1. While doing reverse engineering of the BMC, were you able to dump the software that Spec loads onto the Renesas MCU R5F2134?
2. During your reverse engineering process, did you notice if Spec was using any encryption methods?
3. In the pictures, I've marked the location of the 24c32C. It's an external I2C EEPROM with 32 Kbit (4 KB) capacity, typically used for storing data like serial numbers, configuration settings, status flags, etc. Does your unlocking method involve clearing the PF flag stored in this EEPROM (in this IC)?

Best regards, and I’m looking forward to your response. Your insights might help unlock many batteries across Poland.

 

[cream]

Hello,

1 & 2. Yes, I have the firmware files, unencrypyed. Turbo Studio use encrypted firmware files. I’ve managed to reconstruct the firmware from the CAN messages logged during an update. But R5f2134 has a bootloader that won’t change when updating the firmware. So I don’t have a bootloader dump. In other words, you can’t replace this MCU and make it work on a Specialized BMS by writing above mentioned firmware dump.

3. Indeed, eeprom keeps a mirror of some portions of Dataflash inside Renesas MCU. There’s no point modifying eeprom data as it will be overwritten by copy from dataflash as soon as the system boots. Also, there are checksums on data segments.

If you like, you can send only the BMS boards and I can check/repair/unlock as needed.

 

[iTsCraig]

Specialized batteries CAN be repaired. Most M2 batteries with 3rd led blinking when charging have good cells inside and a locked BMS. Assuming the cells are good, I can unlock/repair the BMS so the battery can be used again.

There are parts of the circuit inside that work on very low currents so any moisture inside can prevent the BMS from functioning properly. The firmware will then prevent the battery from being used, setting a PF flag (permanent failure).

I've spent quite a while reverse engineering Specialized battery management systems present on M1 or M2 models.

Also, BMS can be completely separated from the battery in case you want a cell replacement. Then, it can be connected back. I can also reset battery metrics in this case (battery health, cycle count, design capacity).

Hi there,
I have a battery that the bms is locked. It did this after I desoldered the board to try and get it to reboot. The Bluetooth had not been working for about 12 months and the board was stuck in only full power mode. Please message me and let’s see what can be done

 

[k0lo86]

3. Indeed, eeprom keeps a mirror of some portions of Dataflash inside Renesas MCU. There’s no point modifying eeprom data as it will be overwritten by copy from dataflash as soon as the system boots. Also, there are checksums on data segments.

Hi,

Thanks a lot for the information!

Since the EEPROM is being overwritten by the MCU, it seems that the changes should be made in the Data Flash memory instead. I’ll try to use one of the Renesas-compatible programmers (E1, E2 Lite, or Minicube2) to access and modify the data there.

I'll also attempt to solder to the JTAG pins or directly to the pins of the Renesas MCU to ensure proper access.

Right now, the biggest challenge is identifying the exact position of the PF flag in the Data Flash and calculating the checksum after making changes.

Thanks again for your help! Your insights are incredibly valuable for this project.

Best regards,