Announcement

**Gabriel** · 12-19-2015, 04:44 PM

Re: Help identifying this chip - battery controller chip ?

So I have a bin dump of the eeprom - I verified it too so everything is ok.

Some of the content is easy to match up with the information the raid bios and the raid software in windows provides.

Looking at the Megaraid bios and comparing with hex workshop I can see

Mfg name - LS1121001A
Device Name - 3150301
Device Chemistry - LION

The serialnumber 274 and mfg date 9/19/2010 I can't see, windows software gives us information that the battery has been discharged 50 times and I can't see that either.

I don't know how smart the software is and if it is important to change mfg date to this year but what I would like to change is design capacity to match the samsung battery and the completed discharge cycles resetted.

Anyone has knowledge of this ?

Attached Files

**fzabkar** · 12-19-2015, 09:32 PM

Re: Help identifying this chip - battery controller chip ?

Code:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 7F 3C 0A 00 78 00 00 00 00 00 04 10 80 00 32 00 .<..x.......€.2.
00000010 00 00 74 0E 21 00 33 3D 12 01 00 02 00 00 64 00 ..t.!.3=......d.
00000020 0A 4C 53 31 31 32 31 30 30 31 41 04 00 00 B0 FF .LS1121001A...°ÿ
00000030 07 33 31 35 30 33 30 31 81 01 BF 04 34 FC 00 64 .3150301..¿.4ü.d
00000040 04 4C 49 4F 4E C0 8A 02 10 0A C6 9C A1 FF 09 32 .LIONÀŠ...Æœ¡ÿ.2
00000050 07 04 2D E6 12 64 00 00 00 00 00 00 00 00 05 3C ..-æ.d.........<
00000060 A0 EA FB 00 00 00 92 27 0E 18 75 0F F0 F1 8C F1 *êû...’'..u.ðñŒñ
00000070 28 F1 E4 0C 48 0D 00 00 AC 0D 00 00 00 00 5A A5 (ñä.H...¬.....Z¥

Code:

offset function			value (hex)	decoded value
------------------------------------------------------------------------------------		
0x00	Check Byte 1			0x3C7F
0x02	Remaining Time Alarm		0x000A		10 minutes
0x04	Remaining Capacity Alarm	0x0078		120mAh
0x06	EDV A0 Impedance Age Factor	0x0000
0x07	EDV TC Cold Impedance Factor	0x0000
0x08	Misc Options			0x00
0x09	Safety Overtemperature		0x00
0x0A	Charging Voltage		0x1004		4100mV
0x0C	Reserved			0x0080
0x0E	CycleCount			0x0032		50
0x10	Reserved			0x0000
0x12	Design Voltage			0x0E74		3700mV
0x14	Specification Information	0x0021		0x0031 --> v1.1/PEC for bq2060A
0x16	Manufacture Date		0x3D33		2010/9/19
0x18	Serial Number			0x0112		274
0x1A	Fast-Charging Current		0x0200		512mA
0x1C	Maintenance Charging Current	0x0000		0mA
0x1E	Pre-Charge Current		0x0064		100mA
0x20	Manufacturer Name Length	0x0A		10 characters for Manufacturer Name
0x21+	Manufacturer Name		"LS1121001A"
0x2B	Light Discharge Current		0x04		ILEAK = 0.18mA (= 0x04 x 45 / 1024)
0x2C	Reserved			0x0000
0x2E	Maximum Overcharge		0xFFB0		80mAh (= 0x10000 - 0xFFB0)
0x30	Device Name Length		0x07		7 characters for Device Name
0x31+	Device Name			"3150301"
0x38	Last Measured Discharge		0x0181		385mAh
0x3A	Pack Capacity			0x04BF		1215mAh
0x3C	Cycle Count Threshold		0xFC34		972mAh (= 0x10000 - 0xFC34)
0x3E	Reserved			0x00
0x3F	Pack Configuration		0x64		0b01100100
0x40	Device Chemistry Length		0x04		4 characters for Device Chemistry
0x41+	Device Chemistry		"LION"
0x45	MaxT DeltaT			0x8A		56C / 3.6C
0x46	Overload Current		0x028A		650mA
0x48	Overvoltage Margin		0x10		256mV
0x49	Overcurrent Margin		0x0A		160mA
0x4A	Cell Under/Over Voltage		0xC6		2816mV / 4288mV
0x4B	Fast Charge Termination %	0x9C		100%
0x4C	Fully Charged Clear %		0xA1		95%
0x4D	Charge Efficiency		0xFF		100%
0x4E	Current Taper Threshold		0x09		i = 0x09 x 0.5025 / Rs = 45mA ????
0x4F	Current Taper Qual Voltage	0x32		100mV
0x50	Manufacturers Data Length	0x07		7 bytes of Manufacturer's Data
0x51	Control Mode			0x04		0b00000100
0x52	Digital Filter			0x2D		50uV
0x53	Self-Discharge Rate		0xE6		2% per day = 52.73 / (256 - 0xE6) ????
0x54	Battery Low %			0x12		7%
0x55	Near Full			0x64		200mAh
0x56+	Reserved			0x0000000000000000
0x5e	VFC Offset			0x3C05		****
0x60	VFC Offset			0xA0		****
0x61	Temperature Offset		0xEA		-2.2C
0x62	ADC Offset			0xFB		-5
0x63	Cell 2 Calibration Factor	0x00
0x64	Cell 3 Calibration Factor	0x00
0x65	Cell 4 Calibration Factor	0x00
0x66	ADC Voltage Gain		0x2792		10130
0x68	ADC Sense Resistor Gain		0x180E		Gain = 625 / Rs (Rs = sense resistor)
0x6a	VFC Sense Resistor Gain		0x0F75		Gain = 409.6 / Rs (Rs = 0.10 ohm)
0x6c	VOC 25%				0xF1F0		3600mV
0x6e	VOC 50%				0xF18C		3700mV
0x70	VOC 75%				0xF128		3800mV
0x72	EDVF/EDV0			0x0CE4		3300mV
0x74	EMF/ EDV1			0x0D48		3400mV
0x76	EDV T0 Factor			0x0000
0x78	EDV C1/C0 Factor/EDV2		0x0DAC		C1 = 13, C0 = 172
0x7a	EDV R0 Factor			0x0000
0x7c	EDV R1 Factor			0x0000
0x7e	Check Byte 2			0xA55A

Serial Number = 0x0112 = 274

Manufacture Date = 0x3D33 = 0b0011110100110011 --> 0011110 1001 10011 --> 30 9 19 = 2010/9/19

CycleCount = 0x32 = 50

Code:

Pack Configuration = 0b01100100

DMODE = 0	LEDs reflect AbsoluteStateOfCharge()

SEAL = 1	SMBus read access is limited to commands (0x05-0x1c) and (0x20-0x23). 
		SMBus read/write access is limited to commands (0x00-0x04), (0x2f), and (0x3c-0x3f)

CSYNC = 1	The bq2060A updates RM with a programmed percentage of FCC at a valid charge
		termination

CEDV = 0	EDV compensation disabled

VCOR = 0	Midrange corrections disabled

CHEM = 1	The bq2060A uses Li-ion configuration parameters

LCC0/LCC1 = 00	VCELL4= Cell Stack

Code:

Control Modes = 0b00000100

NDF = 0	Digital filter enabled all the time

HPE = 0	No PEC byte on alarm warning to host

CPE = 0	No PEC byte on broadcasts to charger

LED = 0	Selects the 5-LED indication mode

SC  = 1	Learning cycle optimized for Smart Charger

SC  = 0	Broadcasts to host and charger enabled

**fzabkar** · 12-19-2015, 11:41 PM

Re: Help identifying this chip - battery controller chip ?

Instead of modifying the EEPROM of the original Sony battery with Samsung parameters, ISTM that it would be better to take the EEPROM from the Samsung battery and change the relevant text strings to enable it to identify itself as the original Sony battery.

**Gabriel** · 12-20-2015, 09:24 AM

Re: Help identifying this chip - battery controller chip ?

I took some time last night and also found the fields I wanted to alter and I see you did too but much better then me hehe

You obviously have done a very good job - Thanks

I wish I could swap eeproms but the Dell circuit does not have an external eeprom so the battery controller must have it internal and datasheet for that chip difficult to find.

I think it might work if I change the pack capacity to 1800mAh, change the last measured discharge (full charge capacity) to 1800mAh and 0 out cycle count.I will read the datasheet to see if it is possible to program a autolearn cycle.

I notice the standard charging current for the Samsung battery is 1000mA and as the eeprom has a lower value of 512mA I dont think it will hurt the battery, perhaps just leave all the advanced charging functions as they are.

The software also has a auto learn mode so perhaps it will be able to use a 1800mAh battery without editing every function.

Anyone have any obvious reasons for me not to proceed ? things I need to be aware of ?

**fzabkar** · 12-20-2015, 12:51 PM

Re: Help identifying this chip - battery controller chip ?

Sorry, I was confused. Too many batteries, too many bytes.

Is this your situation?

Code:

Original LSI battery:      SN0710031 IC with embedded EEPROM, Sony 1350mAh
Replacement Dell PERC battery: SN0710031 IC with embedded EEPROM, Samsung 2000mAh
Used LSI battery:        bq2060A, external 128x8 EEPROM, Sony 1350mAh

AIUI, the bq2060A IC allows a blank EEPROM to be read and written via the SMBus until the SEAL bit in the Pack Configuration byte (0x3F) is set. If you reset the SEAL bit, then you should be able to reprogram the EEPROM via the SMBus using an appropriate software tool. This would allow you to keep experimenting until you get it right, without having to desolder the EEPROM each time. You could also verify whether the calibration parameters change after autolearn, assuming it is supported.

One other parameter that you should consider modifying is the Cycle Count Threshold. This determines the discharge level at which the cycle count is incremented. Currently the Pack Capacity is 1215mAh (1215 / 1350 = 90%) and Cycle Count Threshold = 972mAh (972 / 1215 = 80%). This means that the battery must discharge by 80% to register an increase in the cycle count. In the Samsung case this value should be 2000 x 90% x 80% = 1440mAh.

The Self-Discharge Rate of 2% seems wrong for an Lithium battery. Your Samsung spec suggests that it loses 10% of its capacity after sitting for 30 days. That's 0.33% per day.

**Gabriel** · 12-20-2015, 01:40 PM

Re: Help identifying this chip - battery controller chip ?

This is what I got -

Code:

New replacement Dell PERC battery: SN0710031 IC with embedded EEPROM, Samsung 1800mAh
Used defective LSI battery: bq2060A, external 128x8 EEPROM, Sony 1215mAh

Although the Samsung battery datasheet specifies 2000mAh Dell has set the capacity to 1800mAh - for better lifespan I guess - see picture.

Originally posted by fzabkar View Post

One other parameter that you should consider modifying is the Cycle Count Threshold. This determines the discharge level at which the cycle count is incremented. Currently the Pack Capacity is 1215mAh (1215 / 1350 = 90%) and Cycle Count Threshold = 972mAh (972 / 1215 = 80%). This means that the battery must discharge by 80% to register an increase in the cycle count. In the Samsung case this value should be 2000 x 90% x 80% = 1440mAh.

The Self-Discharge Rate of 2% seems wrong for an Lithium battery. Your Samsung spec suggests that it loses 10% of its capacity after sitting for 30 days. That's 0.33% per day.

My knowledge of battery inner workings and specifics is very limited - Any suggestions and tips is more then welcome.

Attached Files

**fzabkar** · 12-20-2015, 02:37 PM

Re: Help identifying this chip - battery controller chip ?

Dell appears to derate the battery by 10%.

1350mAh x 90% = 1215mAh
2000mAh x 90% = 1800mAh

I don't know any more than you regarding batteries. This thread is a learning experience for me.

AIUI the battery is calibrated at the factory. The calibration data are written to EEPROM and the SEAL bit is then set. This restricts read and write access to certain bytes. If you reset the SEAL bit, then all bytes have read/write access. Therefore I would set the Pack Configuration byte at offset 0x3F to a value of 0x24 (SEAL = 0).

0x3F Pack Configuration 0x24 0b00100100

Also set the Cycle Count Threshold word at offset 0x3C to a value of 0xFA60.

0x3C Cycle Count Threshold 0xFA60 1440mAh (= 0x10000 - 0xFA60)

Note that words are little-endian, ie least significant byte first.

Also the Pack Capacity ...

0x3A Pack Capacity 0x0708 1800mAh

**fzabkar** · 12-20-2015, 03:07 PM

Re: Help identifying this chip - battery controller chip ?

This is the support page for the BQ2060A:
http://www.ti.com/tool/bq2060aevm-00

Perhaps you could try the software tools. There may be a way to read the EEPROM in-circuit via the SMBus. If so, then try the same software with the SN0710031 ICs.

**Gabriel** · 12-20-2015, 03:20 PM

Re: Help identifying this chip - battery controller chip ?

Hehe that software was a good tip - if I can make it work it will simplify everything.

Attached Files

**fzabkar** · 12-27-2015, 08:20 PM

Re: Help identifying this chip - battery controller chip ?

The TI URL is now dead. I'm attaching the software.

Attached Files

BQ2060A.zip (3.45 MB, 105 views)

**Gabriel** · 12-31-2015, 09:02 AM

Re: Help identifying this chip - battery controller chip ?

The controller chip sn0710031 most likely is a BQ20z90 or BQ8030, both has internal eeprom and is a 30 pin package.

Found some info here

After holiday ends I will continue with my BQ2060A setup.

Attached Files

**Gabriel** · 01-21-2016, 09:39 AM

Re: Help identifying this chip - battery controller chip ?

I found it easiest to use TI's software to modify the contents, sadly their software can't import bin files only txt files so I just saved their content as txt and filled in my hex content in the txt file instead and it worked perfect.

Picture above is original bin file.

And after modifying it looks like this, you can download the hex to txt file in my dropbox and import it in the Ti software.

Dropbox link

This is the new code.

What I do not understand is the value of the new battery hex FA60 which is 64096 in decimal. Orginal battery had a value of 04BF which is 1215 - Why is the new capacity 1800 not written as 0708 hex ?

Also why is MaxT DeltaT C0 hex which is 192 ?

**fzabkar** · 01-21-2016, 01:21 PM

Re: Help identifying this chip - battery controller chip ?

Offset 0x38-39 = Last Measured Dsg = 0x0708 = 1800
Offset 0x3A-3B = Pack Capacity = 0x0708 = 1800
Offset 0x3C-3D = Cycle Count Threshold = 0xFA60 = 0x10000 - 0x5A0 --> 0x5A0 = 1440
Offset 0x45 (byte) = Max T Delta T = 0xC0
Offset 0x46-47 = Overload Current = 0x028A = 650

**Gabriel** · 01-21-2016, 01:29 PM

Re: Help identifying this chip - battery controller chip ?

Yes, all of those seems to be correct - I also changed remaining capacity alarm from 120mAh to 180 mAh since this value should be 10% of pack capacity.

**fzabkar** · 01-22-2016, 02:04 PM

Re: Help identifying this chip - battery controller chip ?

Originally posted by Gabriel View Post

Also why is MaxT DeltaT C0 hex which is 192 ?

The "Max T Delta T" parameter consists of two nibbles. The least significant nibble codes for Delta T according to Table 11 on page 46 of the datasheet. So a value of 0x0 equates to 1.6 degC.

The Max T component is stored in the most significant nibble. It is calculated as follows (page 46):

Max T = (69 - maxtemp)/1.6

So ...

maxtemp = 69 - (MaxT x 1.6) = 69 - 0xC x 1.6 = 49.8 degC

Therefore a value of 0xC0 in the "Max T / Delta T" parameter represents 50C / 1.6C.

Note that bit 5 of the Miscellaneous Options parameter (offset 0x08, page 50) is the HIT bit. A value of 0 sets the Max T range from 45C to 69C, while a value of 1 selects a range from 61C to 85C.

**Gabriel** · 01-22-2016, 02:59 PM

Re: Help identifying this chip - battery controller chip ?

I see that I still have some hex/math to read up on.

I will flash back the modified content I posted above tomorrow,see what happens and come back with a report.

Also, since the eeprom is now unsealed I have been googling a solution to seal it again after a successfull calibration and it should be possible in dos with the commands below.

MegaCli -AdpBbuCmd -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -GetBbuStatus -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -GetBbuCapacityInfo -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -GetBbuDesignInfo -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -GetBbuProperties -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -BbuLearn -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -BbuMfgSleep -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -BbuMfgSeal -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -getBbumodes -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -SetBbuProperties -f <fileName> -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -GetGGEEPData offset [Hexaddress] NumBytes n -aN|-a0,1,2|-aALL
MegaCli -AdpBbuCmd -ScheduleLearn -Dsbl|-Info|[-STARTTIME DDD hh] -aN|-a0,1,2|-aALL

**fzabkar** · 01-22-2016, 03:06 PM

Re: Help identifying this chip - battery controller chip ?

I use Google's calculator.

http://www.google.com.au/search?q=69+-+0xC+x+1.6
http://www.google.com.au/search?q=0x...A60+in+decimal
http://www.google.com.au/search?q=0x24+in+binary
http://www.google.com.au/search?q=650+in+hex

BTW, do you really need to seal the EEPROM contents? Why not just leave them unsealed? I would think that sealing is only implemented by the manufacturer to prevent tampering by you.

**Gabriel** · 01-22-2016, 03:18 PM

Re: Help identifying this chip - battery controller chip ?

Are you sure about the bits in batterystatus ? 0b01100100

I was reading this, how did you come up with 24hex instead of 64hex ?

Originally posted by fzabkar View Post

BTW, do you really need to seal the EEPROM contents? Why not just leave them unsealed? I would think that sealing is only implemented by the manufacturer to prevent tampering by you.

No, not sure I really need to seal it again-this bit can be 0 while in development but should always be set to a 1 when the part is in the field so yes I guess it is to prevent tampering.

**fzabkar** · 01-22-2016, 03:37 PM

Re: Help identifying this chip - battery controller chip ?

Originally posted by Gabriel View Post

Are you sure about the bits in batterystatus ? 0b01100100

I was reading this, how did you come up with 24hex instead of 64hex ?

Bit 6 is the SEAL bit. A value of 0x64 for the Pack Configuration Byte sets the SEAL bit whereas a value of 0x24 resets this bit. AIUI, you need to select 0x24 until you have finished "tampering", then you can seal the EEPROM.

0x24 = 0b00100100 <- unSEALed
0x64 = 0b01100100 <- SEALed

BTW, "batterystatus" and "pack configuration" are not the same thing.

Just in case you need the user guide ...

https://cdn.badcaps-static.com/pdfs/...e97a1918e5.pdf

The "Battery Backup Unit Related Properties" are documented in section 2.6. Unfortunately there is no documentation for "MegaCli -AdpBbuCmd -BbuMfgSeal -aN|-a0,1,2|-aALL".

**fzabkar** · 01-22-2016, 05:27 PM

Re: Help identifying this chip - battery controller chip ?

AIUI, the battery pack communicates its status via the SMBus BatteryStatus command (0x16, page 33). This word reports alarm, status and error codes. It is presumably stored in the IC's RAM.

The Pack Status and Pack Configuration command (0x2f, page 38) reports the Pack Status in the upper byte and Pack Configuration in the lower byte. The Pack Configuration is retrieved from offset 0x3F in the EEPROM whereas the Pack Status appears to be RAM based.

Announcement

Help identifying this chip - battery controller chip ?

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment