Thinkpads Forum

I think this thread is long since overdue.
A while ago, someone on Chinese 51nb suggested a BQ8030 specific set of unlock tutorials, and even longer ago, someone on the Chinese mydigit forum walked the guide of unlocking a BQ20Z955 using a cracked copy of BE2Works. Both of which involve the use of a CP2112 SMBus module (that effectively does the role of the EV2300)
Me being in Shenzhen right now with access to a sea of cheap and high quality Samsung and Sanyo 18650's as well as even the prismatic 103450's. I first bought some Samsung 35E's and then 33G's and rebuilt and unlocked an Acer pack with BQ20Z955 with success. Result is unbelievable with almost 60Wh of capacity, almost matching the real capacity of no name 9 cells!
Now, it's time for ThinkPads to get the love. For this, I just happen to come across a dead 22++ (42T4632) for cheap.
This time around, I decided to go adventurous and tried a set of 8 used Sanyo 18650GA's. Sanyo cells replaced with Sanyo cells to satisfy any OCD's out there, neat.
In order to charge the thing properly, I then went to get a well beaten up ThinkPad X60, which came with yet another Sanyo, but this time type 22 4 cell (92P1167), even more dead with guts spilling all inside the battery casing.
AND, to round it all off, while I was trying to be ambitious and get the ThinkPad 31 battery with 4 slim prismatic cells, I found a seller that not only sells the ThinkPad 31 (42T5247), but also, sells the almost unheard of ThinkPad reserve edition special 42T5260, with 4 prismatic and 4 cylindrical cells (flat bottom)! I am assuming all of which are dead though.

And YES, I will be using 8 Panasonic/Sanyo NCA103450 2350mah prismatic cells for these builds! All of which produced within this decade, they're in fact still produced today!

So, a guide of one battery rebuild turns into a whole family of every ThinkPad X6xs battery out there, excluding tablets and the extended life dock battery, which is li-po!
And, as luck will have it, all of which are Sanyo and have the BQ8030!
For this first post, it'll be about the 22++ only, and it will be done with the github open source DJI Battery Killer 0.5B2, although I have also by now unlocked the 22, which will be shown with the instructions of operating BE2Works 4.52.
Gallery will be provided at the end of the post
Before we start, a WARNING that this post is for educational purposes only. While every effort will be made to ensure the focus on safety dealing with these batteries, I will NOT be held responsible for any damages/losses incurred for following this guide!
Moreover, I CANNOT guarantee that either DJI Battery Killer or BE2Works are free of viruses/malware/worms etc! Use two dedicated laptops fully disconnected from other devices for these jobs!
As per forum rules consulted from RBS, linking to DJI Battery Killer's Github page is allowed (https://github.com/o-gs/dji-firmware-tools/issues/245 use wayback machine to access master-club. Make sure you have VS redist 2015, 32 bit and 64 bit installed!), but not for closed source BE2Works (which, also works ONLY on Windows XP SP2/SP3!). For now, if you insist on using BE2Works cracked version, send me a PM acknowledging that you're aware that the software can in fact be infected with spyware/trojan, and use a dedicated XP machine for this job!

This work presented will be essentially a combination of translating the finds of these members on those Chinese forums into English, plus my own personal take on this matter, having already rebuilt dozens of laptop batteries (mostly hot swapping)
Enough rambling, let's begin!

Disassembly
Disassembly is actually pretty straight forward with these X6x batteries. There are two square stickers that can be peeled off and it reveals one hole each, that is one very easy entry point and then just slowly go twist and pry at one clip at a time until it's all open.
For the 4 cell type 22, the rear of that battery is kinda weak and at a vertical angle that is hard to pry at. What I end up doing was prying open all the other clips, which left enough space for me to grab all the inside guts and rip them out. With an empty shell, it's then easy for me to access the plastic clips with a flathead screwdriver directly and simply unlatch each and every one of them until it's fully loose
(Gallery at the end of the post, please refer to it throughout this reading)
Once it's open, in the case of the 22++ 8 cell, you're greeted with what looks like a total mess on the inside. Don't worry, follow the following diagram and make sure you identify exactly how the wiring work

Take lots of photos of how the original was assembled before you dig any further
In my case, even though the cells all look in pristine shape, almost all of them are dead. two read 0.5V, all others 0. I carefully dislodged the temperature sensor, and then slowly disconnected all the wires. Once they're all disconnected, separate the cell groups and I end up reusing all the original wires, plus most of the original insulation material, including the wrapper cloth tape, and the all-so-important middle separator as pointed out in the diagram. Do NOT forget about that or else you'll have a nasty short circuit! And make sure no solder balls or wire strands are picked up by the adhesive!
I end up not using any of the original nickel strips as they were too thick for my spot welder to solder to them with good bond.

Inspection
Once the guts are all separated, time to inspect the BMS board.
It's got the BQ8030 like titled, and also it's got the 3 legged fuse, which in mine, when I measure across the two legs on one side, it reads full continuity, so it's not blown! If yours is blown, you need to bridge those two legs or replace it. A failed fuse will re-lock the BMS.
Then, before I forget, I lifted the one leg on one side which is the trip pin, and then stuck some kapton tape underneath. Before I can unseal/unlock the BMS, the BMS in locked state with sufficiently charged cells will try to blow the fuse with a nasty amount of heat and some magic smoke, I rather not see that.

I inspected the casing too, thankfully this one the casing is perfectly fine with no corrosion/battery juice, unlike my next project with the 4 cell type 22. Unbend any plastics that are bent, take off any already fully broken off pieces of plastic
Then, using the photos and that diagram, brainstorm about how you're going to reattach the cells.
From shown in the diagram, for 42T4632 (and one Sony 22++ I had before is similar), the bulge contains two groups of cells, groups 4 (closest to ground) and 3, each have their positives face together in the middle while their negative ends are connected together with a nickel strip.
Groups 1 and 2 are very normal 2P groups with the two cells side by side
Since a lot of the groups are actually connected together with wires from factory, I decided to assemble the packs by their groups individually
I first attempted to rebuild the weird groups 3 and 4 with the positive running out of the middle, and the negative being a nickel strip spot welded onto another nickel strip that runs from the two negative ends. And then I reapplied the cloth like material and taped the cells up into long sticks after I'm done, so that I get to handle two cells like they're one assembly, easier for reassembly.
Groups 1 and 2 are easy enough, just I made sure I left enough nickel strips in the angle that they were out of the factory. Remember you can also fold triangles with the nickel strip and have it route a perfect 90 degree turn
I end up taping the groups 1 and 2 together after they're spot welded together. And then I am left with basically 3 legos to connect together, nice.
Remember to put back that thick insulator in the middle of the groups 3 and 4, everything else went together without a hitch.
I shorted the positive terminal of the connector with the positive terminal of the battery pack, and then notice the voltage came on and then went back off. Time for unlocking!

UNLOCKING:
I'm sure this is where a lot of ppl get stuck on. Fortunately, the Chinese forums come in handy here. For this guide, it will be with the DJI Battery Killer. (When confused, go browse my gallery, pics are still too big to post here)
1. Open DJI Battery Killer, find the CP2112 device and click connect.
2. Make sure you select the BQ30Z55 in the dropdown menu. This has the same EEPROM dump structure as BQ8030. Read the battery info from there to verify its functionality. Don't freak out if things like cell voltages 1-4 are nonsense - it never worked right on both my batteries so far.
- It would help a lot if you remember info such as cycle count and full charge capacity when you go searching for them in the EEPROM dump. Note that on some BMS, like both of my 22 and 22++, the full charge capacity is in 1/100Wh. The way to tell that is through the designed capacity and compare against the labels on your battery case. If it reads for example 7488 for 22++, it's actually 74.88Wh (5.2Ah * 14.4V) . If it says 5200, then that's 5200mAh. Remember that.
3. Note we will NOT be using any of the automated one click functions - they won't work properly here. Overview: To make changes to the BMS's EEPROM for BQ8030:
a. Unseal the chip
b. Save the EEPROM
c. Open the EEPROM with a hex editor to edit values
d. Rewrite EEPROM
e. Seal the chip
4. Your first job is to unseal the chip. It's as follows (BQ8030 exclusive):
a. write word 0214 to 71 register
b. read (word) xxxx from 73 register. Open windows calculator programmer mode, calculate (in hex) 10000 - xxxx = cccc
c. write cccc to 71 register
d. write 0517 to 70 register
Now the BMS should enter unsealed mode. You can verify this by checking SMBus battery info where all the dynamic data like battery voltage, capacity etc are all filled with the same nonsense data, in my case it's full of 5911's

Now that it is in unsealed mode, go to the firmware section, uncheck boot mode check, and immediately use read EEPROM (do NOT touch firmware dump!) and save TWO identical dumps of your EEPROM, one for backup, one for modification! Double check the file size - it should be 2KB

Take one such copy of the EEPROM dump, and open it with hex editor of your choice. The go-to choice usually is HxD
Once you open the dump, from a lot of sources I've read on, the 0x0 to 0x4FF blocks are all static data, and in fact you should right away on the 2nd line see Sanyo and the FRU of your battery as ASCII. First line also has your designed capacity in mAh and in 1/100 Wh. You are NOT encouraged to edit these, since AFAIK they are checksumed somewhere.
Instead, all the stuff you truly want to modify are in 0x500 onwards, including full charge capacity, cycle count, and the all-so-important failure flags. Note that these info will appear exactly twice - it's recommended you change both exactly in the same way

On my dumps of the 22 and 22++, these have the occurrences in the following address:
Cycle Count (2-byte): 0x500, 0x600
Full Charge Capacity (2-byte): 0x502, 0x602
Failure flag (3-byte): 0x580, 0x640

It's very possible yours are in slightly different positions. On Karosium website and the Chinese guide I was following, they indicate that the failure flags are at 0x5A8 and 0x668 for example.
So the general advice is that if you can't find what you're looking for, use Ctrl + F, then search Hex-values to search for the cycle count after converting it in hex. Full charge capacity should be right adjacent to it (in either mAh or 1/100 Wh, as mentioned before). A Failure flag looks like 3-bytes of something in a land of FF's that have one or two of them being 00, and probably contains 01 or 80 (mine being 00 80 01). Remember there are two occurrences of each
If you still cannot find, make sure you're searching from the top in forward direction, and also try little endian (i.e. 0E A0 becomes A0 0E)
Change full charge capacity to whatever you think your cells will measure up to, change cycle count to any number you like, and then change the failure flag to 00 00 00
Save the EEPROM dump
Go back to DJI Battery Killer, write the edited dump. do NOT touch your input devices while it's writing, and do NOT freak out if the app hangs - look at the blinking LED's on your CP2112, that's your real status bar!
Once completed, send 08 COMMAND to seal the battery back up.
If done correctly and that your fuse is good, and that the battery cells have sufficient charge, you should now measure voltage coming out of your battery connector!

Repackage the battery casing so that SAFE and reliable for use.
General advices here include:
- It is advised that you always tend to use more insulating materials, not less. When in doubt, add more insulation
- Take lots of photos of your rebuild. Zoom in and see if there is anything that could go wrong.
- Make sure all fully broken off plastics and debris are cleared off. You don't want a tiny piece of plastic preventing your battery case sitting flush
- I use liquid adhesive and sometimes double sided tape to hold the battery cells in place on one of the sides. No need to give it a death grip, but 2-3 drops on each cell is more than sufficient. Especially on both of these battery packs, my rebuild end up being shorter than the original deal, and will rock around back and forth inside if not adhered down.
- It is not recommended for you to use superglue as the main adhesive to close the case shut. Sounds counter-intuitive, but Superglue dries rock hard, and every handling and insertion/removal of your battery pack means some torque to the casing. Over time, it will crack the battery casing. A few dabs of superglue in corners that won't sit flush is perfectly fine.
- I use again liquid adhesive to seal the sides of the battery pack. Liquid adhesive also works wonders on top of plastic clips. Liquid adhesive is flexible, is insensitive to temperatures, and is actually removable in case you seriously forgot about something and need to open the casing. It will need to be clamped shut for a few hours just like you'd do with a modern smartphone after battery replacement.

If you're truly following this guide for reviving a battery, please stay safe and good luck!
Gallery: https://imgur.com/a/thinkpad-x6x-batter ... -1-X4JQb4d

Hi, it's arpeas from reddit: great guide! The unlocking part will definitely come in handy for my Precision M4300, and of course the rebuilding process once I get an X60/1 (it's only a matter of time, lol) Oh, I'll be sending you a DM about that copy of SBWorkshop, I just couldn't find one online. BTW, I'm currently working on rebuilding my T40 battery, and I'm *much* better at doing... well, everything now that I've practiced making fake packs with dead cells. It's so easy now! The T40's original cells are still holding about an hour's worth of charge, but the controller's not reporting the correct percentage and it sits on 0 for about 30 minutes. Hoping new cells and some cycles will fix that. (I will be hotswapping so I won't have to worry about using SBW in this case, but it's still useful to have the full version of the software around).

Hi, forgot about the PM lol. It seems like I'm way too new a member to be able to send them though, the option isn't even showing up and my replies to threads have to be confirmed by moderators, probably as a spam protection mechanism. So could you send me a copy of SBW by Email? It's xxxxx @ outlook.com

Thanks!


Admin note:
Check your PM.

arpeas wrote: ↑

Wed Jan 15, 2025 7:21 pm

Hi, it's arpeas from reddit: great guide! The unlocking part will definitely come in handy for my Precision M4300, and of course the rebuilding process once I get an X60/1 (it's only a matter of time, lol) Oh, I'll be sending you a DM about that copy of SBWorkshop, I just couldn't find one online. BTW, I'm currently working on rebuilding my T40 battery, and I'm *much* better at doing... well, everything now that I've practiced making fake packs with dead cells. It's so easy now! The T40's original cells are still holding about an hour's worth of charge, but the controller's not reporting the correct percentage and it sits on 0 for about 30 minutes. Hoping new cells and some cycles will fix that. (I will be hotswapping so I won't have to worry about using SBW in this case, but it's still useful to have the full version of the software around).

I did in fact fix and got a T40 battery working fully before with the hot swapping method (and made a post about it), so I at least know what the difficulty and quirks of working with that is like. if you get the photos taken extensively then you can compare with my own work on that same battery (but different interior if yours isn't a Sony part)
Also, it's not SBWorkshop that I got a cracked version, nor have I gotten it to work, beyond it telling me by my modified EEPROM dump whether I modified the parameters correctly. It's BE2Works that I am currently working with, which I haven't yet tested with really old BMS.
Remember on this forum it will struggle with layout if you embed large pics, so just use links to pic hosting sites instead
https://imgur.com/a/ibm-lenovo-thinkpad ... ld-Tnzsz4b

Mine was made by Sanyo, hopefully that doesn't present a problem. When removing the old cells, the negative side always has to be removed first, right? And when putting new ones the positive goes in first, yes?

Reporting on that T40 battery: all was going great with adjusting fitment and whatnot, I started soldering the wires to the BMS... and one of the solder joints I used to power it with the 3 "bridge cells" came right off the bloody board. F............M.........L................................. is how I felt at that very moment. Came clean off, that thing. What's funny is that I tested all the joints by wiggling the cables that were soldered to them. Guess I didn't test that one well enough. The only reason I'm not angry at myself is because I know it's literally none of my fault, I mean there's no way I could've known that one joint could've failed *that* badly!

Anyhow I finished it all up despite the dreaded feeling of absolute failure, and guess what: it ded.
Tried connecting the + of the connector to the + of the very cells, but nope. I did get some hope when I jumped the fuse, but it seems the controller set its software flag and there's ~11.3 volts on the connector when there should be around 12.5. Hooking up a 12v fan and it starts to make faint noises of wanting to start but I guess there's not enough current provided by the controller... or something.

Oh and while probing around the board, as a final nail in the coffin, I accidentally shorted the + of the battery and the - of the connector... while the fuse was jumped. Got a nice little melted boom out of a protection resistor (I think?) I do have an exact spare from another battery board, so I might try this again some time in the future once I build that parallel i2c thingy for AccPlus. Hopefully the electronics aren't shot lol

So, in the end: what did we learn? ThinkPad batteries hate me. That's all. And curse Sanyo for not making a better PCB.

arpeas wrote: ↑

Fri Jan 24, 2025 8:23 pm

Reporting on that T40 battery: all was going great with adjusting fitment and whatnot, I started soldering the wires to the BMS... and one of the solder joints I used to power it with the 3 "bridge cells" came right off the bloody board. F............M.........L................................. is how I felt at that very moment. Came clean off, that thing.

Don't worry that happened to me several times before I actually had a success story. And it happened to me on Acer BMS before too, but Acer BMS has a grace period of a few seconds. I.e. according to BQ20Zxx manual, when such failure conditions are detected, manufacturers set a preset amount of time before such failure flag is raised and permanently lock down your battery. It's about 2-5 seconds. So in those case me quickly aligning the tab with the connection with my thumb and hold it there while I solder a cable in place was enough to keep the BMS alive.
Anyways you should buy a CP2112 before you attempt such procedures, and honestly I even highly recommend you make an EEPROM dump before you go ahead with the procedure, so that in the case of Sanyo BQ8030 it can be quickly unlocked by restoring the previously known good EEPROM

arpeas wrote: ↑

Fri Jan 24, 2025 8:23 pm

So, in the end: what did we learn? ThinkPad batteries hate me. That's all. And curse Sanyo for not making a better PCB.

Just telling you, before ThinkPads were sold to Lenovo, IBM was significantly lagging behind their competitors on battery technology, and as I soon found out, on battery assembly techniques too. My A31 battery featured interior designs and soldering jobs so wacky it's found only on batteries from the previous century, and those are not meant to carry the loads of a Pentium 4-M. The battery eventually caught fire on my hands after I rebuilt it successfully because the rubber housing on the wires were actually failing and me readjusting it was enough for the rubber housing to rupture.
Even my Sony based T4x battery still had some very odd design decisions, like leaving a gap between group 1 and 2 of the 3 groups (6 cells) just to feed cable spaghetti through there. This design could turn deadly if insulation gets pinched due to forces. I tripled up on insulation just to make sure that doesn't happen during normal use and I already made sure nothing is pinched prior to closing the top case.
Lenovo era batteries are more prone to locked BMS but at the same time their interior construction vastly improved on safety, even if it means that my 12++ battery has a death grip on the casing.

kfzhu1229 wrote: ↑

Sat Jan 25, 2025 2:26 am

arpeas wrote: ↑

Fri Jan 24, 2025 8:23 pm

Reporting on that T40 battery: all was going great with adjusting fitment and whatnot, I started soldering the wires to the BMS... and one of the solder joints I used to power it with the 3 "bridge cells" came right off the bloody board. F............M.........L................................. is how I felt at that very moment. Came clean off, that thing.

Don't worry that happened to me several times before I actually had a success story. And it happened to me on Acer BMS before too, but Acer BMS has a grace period of a few seconds. I.e. according to BQ20Zxx manual, when such failure conditions are detected, manufacturers set a preset amount of time before such failure flag is raised and permanently lock down your battery. It's about 2-5 seconds. So in those case me quickly aligning the tab with the connection with my thumb and hold it there while I solder a cable in place was enough to keep the BMS alive.
Anyways you should buy a CP2112 before you attempt such procedures, and honestly I even highly recommend you make an EEPROM dump before you go ahead with the procedure, so that in the case of Sanyo BQ8030 it can be quickly unlocked by restoring the previously known good EEPROM

arpeas wrote: ↑

Fri Jan 24, 2025 8:23 pm

So, in the end: what did we learn? ThinkPad batteries hate me. That's all. And curse Sanyo for not making a better PCB.

Just telling you, before ThinkPads were sold to Lenovo, IBM was significantly lagging behind their competitors on battery technology, and as I soon found out, on battery assembly techniques too. My A31 battery featured interior designs and soldering jobs so wacky it's found only on batteries from the previous century, and those are not meant to carry the loads of a Pentium 4-M. The battery eventually caught fire on my hands after I rebuilt it successfully because the rubber housing on the wires were actually failing and me readjusting it was enough for the rubber housing to rupture.
Even my Sony based T4x battery still had some very odd design decisions, like leaving a gap between group 1 and 2 of the 3 groups (6 cells) just to feed cable spaghetti through there. This design could turn deadly if insulation gets pinched due to forces. I tripled up on insulation just to make sure that doesn't happen during normal use and I already made sure nothing is pinched prior to closing the top case.
Lenovo era batteries are more prone to locked BMS but at the same time their interior construction vastly improved on safety, even if it means that my 12++ battery has a death grip on the casing.

Honestly I'm thinking I'd have better luck doing my aftermarket T4x battery once it stops holding a decent charge. This thing is surprisingly good, for sitting unused for a decade. It did lose some 20-25% of its capacity because of that, and the controller accounted for that after 2 cycles. I'm still getting about 1,5-2 hours with it, depending on the load of course, so it's far away from me trying to open it yet.

Your A31battery was a Panasonic IIRC? My Sanyo one had much better wiring, but the insulation was degrading on it as well.

What software can I use with the CP2112 to communicate with controllers?

I haven't read all of this , but my question is:
why not buy such control-chips and replace one that has 'locked' you out?
Also just saw this (did not read it): https://github.com/omarKmekkawy/Reverse ... Laptop_BMS

RealBlackStuff wrote: ↑

Sat Jan 25, 2025 3:06 am

I haven't read all of this , but my question is:
why not buy such control-chips and replace one that has 'locked' you out?
Also just saw this (did not read it): https://github.com/omarKmekkawy/Reverse ... Laptop_BMS

Actually such is in fact for sale for the BQ8030 where there are people that cut scrap BMS PCB's and give you a pair of BQ8030 and BQ29330.
That said, BQ8030's EEPROM chip is in fact a 8 legged chip right beside the IC, rather than built into the IC itself like 2010 era BMS are. So you can theoretically also rip that chip and adapt it into a CH341 and modify the locking flag that way. But a CP2112 programmer is about as cheap as a CH341a programmer, so there isn't much point to doing that. Just very few ppl know the existence of CP2112, that's all.
But as my costly mistakes with the A31 battery BMS indicated, desoldering these chips aren't as easy as you think and it's VERY easy to rip pads.

And on the subject of BQ20Z70. That is gonna be one annoying IC for you to deal with, and thankfully not many ThinkPads use them. like the BQ20Z65 and Z90 I dealt with, they have impedance (i.e. internal resistance) tracking technology which COMPUTES the full charge capacity, and hence cannot be changed directly.
The way to change the full charge capacity on those is to run calibration cycles either through some sort of automated utility with fixed loads or follow the guidelines and do it manually with your laptop (which isn't super accurate as I later learnt).
Such parameters almost all get erased on a power loss event, hence why you cannot rebuild with those IC's without re-trying unlock and recalibration on those.
What's the biggest headache though, is that the discharge curve is computed with the chemistry ID of the sub-category of li-ion battery in mind. Almost all older cells are ICR, and hence cobalt based lithium, while almost all new cells you buy today are INR, hence nickel based lithium. Their subtle differences in the discharge to voltage curve makes the learning process significantly more tricky.

RealBlackStuff wrote: ↑

Sat Jan 25, 2025 3:06 am

I haven't read all of this , but my question is:
why not buy such control-chips and replace one that has 'locked' you out?
Also just saw this (did not read it): https://github.com/omarKmekkawy/Reverse ... Laptop_BMS

Thing is, how can I know that the eBay/AliExpress controllers aren't locked as well? Besides, it's questionable if you'll get what was said in the listing anyway. The T/X6x battery controllers haven't been in production for at least 15 years, the T/X4x's ones even longer. It is known that sellers sometimes lie about what ICs they're selling, especially old or ones without publicly available datasheets, and both are true for these battery controllers.

arpeas wrote: ↑

Sat Jan 25, 2025 5:59 am

Thing is, how can I know that the eBay/AliExpress controllers aren't locked as well? Besides, it's questionable if you'll get what was said in the listing anyway. The T/X6x battery controllers haven't been in production for at least 15 years, the T/X4x's ones even longer. It is known that sellers sometimes lie about what ICs they're selling, especially old or ones without publicly available datasheets, and both are true for these battery controllers.

Again the problem is, at least for ThinkPad's favourite BQ8030, is that I don't think the lock flags and stuff are even stored inside either the BQ8030 or the BQ29330 protection IC. I think they're read off an external EEPROM chip. Hence replacing them probably won't unlock your BMS. But since BQ8030 is heavily EEPROM based, unlike BQ20Zxx, restoring the EEPROM with one that doesn't have the PF (permenant failure) lock flag clears your PF status. My X200t 12++ battery locked after I replaced the cells, but re-dumping a known good copy of EEPROM before I took my operations on it instantly and reliably made the pack back in working state.
And if you mean replacing the whole BMS, yes you can always do that. In fact many beginners opt to use aftermarket BMS because they don't lock. But the downside is that their circuitry are often overly simple and lacks redundancy in safety features, and they're also usually of worse performance (i.e. can't handle as much charge and discharge current as the original, and also trickle charging algorithm on aftermarket BMS sucks, which will shorten the lifespan of your cells)

kfzhu1229 wrote: ↑

Sat Jan 25, 2025 7:18 am

But the downside is that their circuitry are often overly simple and lacks redundancy in safety features

Oh I believe you. I had another A31 pack, an aftermarket one, fully dead. With the machine on it was reporting as charging in the ThinkPad battery properties, but it wasn't actually doing it. When in sleep/powered off it actually did start to charge... and got like 70degC hot after a few minutes. I did think of opening that one up as well, but decided against it since it was so obviously rubbish.

So, the BQ8030 in ThinkPad batteries should be pretty easy to handle. That's great to know!

BTW, how do I properly quote a single part of someone's reply without having to manually remove the excess?

You select/highlight the text you want to quote, then copy it (Ctrl-C).
Click on the "Postreply" button, then paste it (Ctrl-V).
Now highlight your pasted text again and click on the "Quote" button above. (Result 1 below)
If you want to specify WHO you quoted, change the {quote} box into {quote="username"} (using [...] instead of {...} obviously). (Result 2 below)

Result 1

properly quote a single part of someone's reply

Result 2

arpeas wrote:properly quote a single part of someone's reply

RealBlackStuff wrote: ↑

Sat Jan 25, 2025 12:42 pm

You select/highlight the text you want to quote, then copy it (Ctrl-C).
Click on the "Postreply" button, then paste it (Ctrl-V).
Now highlight your pasted text again and click on the "Quote" button above. (Result 1 below)
If you want to specify WHO you quoted, change the {quote} box into {quote="username"} (using [...] instead of {...} obviously). (Result 2 below)

Result 1

properly quote a single part of someone's reply

Result 2

arpeas wrote:properly quote a single part of someone's reply

Thanks! It's a pretty manual process.

If you had clicked on the "postreply" button instead of the "quote" button, your last post here would only have been a 1-liner!
There's no need to "quote" every time.

RealBlackStuff wrote: ↑

Sat Jan 25, 2025 3:06 am

I haven't read all of this , but my question is:
why not buy such control-chips and replace one that has 'locked' you out?
Also just saw this (did not read it): https://github.com/omarKmekkawy/Reverse ... Laptop_BMS

I remembered that you mentioned that back in the days ppl would go and reprogram the external EEPROM chips of the older BMS and then get the battery working that way.
Now I'm dealing with a bunch of T4x era Sanyos all of which with the BQ8011 and 24C01 external EEPROM. Unlike BQ8030, the BQ8011 cannot reprogram the 24C01 chip to remove PF flag or directly modify full charge capacity through SMBus commands, and hence the 24C01 needs to be swapped out and reprogrammed externally.
I'm working on a separate guide on how to reprogram the 24C01 and remove the permanent failure flag (PF), change cycle count and full charge capacity on T4x era batteries.
What did you hear of being the most cost effective solution when it comes to reprogramming the 24C01? The CH341a can do it but involves a lot of fiddling due to the IC being SMBus, and the TL866 that I use to reprogram the 24C01 is complete overkill for everyone else

I discovered last night that the older BE2Works 4.32 Demo version available for free download off their official website supports 24C01 EEPROM (newer versions don't), and there is a "glitch" with the Demo paywall where when you load a 24C01 dump, enter the desired full charge capacity, and click the reset EEPROM button, it shows a Demo paywall, but when you click OK, the EEPROM dump is already modified, with the FCC changed, cycle count zeroed, and PF flag zeroed, so you can just save the EEPROM dump to another file and then flash it back externally! So the paywall only prevented read and write EEPROM via the CP2112, but not opening/saving an EEPROM dump, or the reset operation to the dump itself

Don't know if you need this, but some related old stuff here..
They mention a program: LenovoBatteryDiagnosticTool.exe
I have it (dating from 2009) but cannot email it to you (no) thanks to Google forbidding Gmail to do that.
And all links on the web are dead.

RealBlackStuff wrote: ↑

Thu Mar 06, 2025 12:52 am

LenovoBatteryDiagnosticTool.exe

hello
can you please upload it or send me to email. My T60 now showing battery is poor and can't charge it

RealBlackStuff wrote: ↑

Thu Mar 06, 2025 12:52 am

Don't know if you need this, but some related old stuff here..
They mention a program: LenovoBatteryDiagnosticTool.exe
I have it (dating from 2009) but cannot email it to you (no) thanks to Google forbidding Gmail to do that.
And all links on the web are dead.

hello. can you please upload this tool somewhere or send me to email? my T60 battery now showing status poor and can't be charged. want to check it

Find that file here for a few days only.

Thank you so much.
Downloaded it, but no luck - it says Can't connect to server and not providing any diagnostic information. Looks like lenovo already killed it.
I also examined this file in PE Explorer, and it seems to be an installer that downloads the main program from a server and then launches its installation.

Check this: https://www.nirsoft.net/search_freeware ... atteryinfo

m.ksy wrote:

i recommend you to install lenovo power manager as well. it lets you in on more precise battery information because the software is designed specifically for thinkpads.

RealBlackStuff wrote: ↑

Thu Mar 06, 2025 12:52 am

Don't know if you need this, but some related old stuff here..
They mention a program: LenovoBatteryDiagnosticTool.exe
I have it (dating from 2009) but cannot email it to you (no) thanks to Google forbidding Gmail to do that.
And all links on the web are dead.

Hi RBS,
can you please reupload somewhere the LenovoBatteryDiagnosticTool.exe program that you have?
You Can use Mega.nz for this if you can not use Gmail Drive.

LenovoBatteryDiagnosticTool.exe
Get it here: https://transfer.it/t/cTRwO4oVnJpI

Just downloaded, thanks a lot RBS.
I must admit that I never see that Program in IBM/Lenovo Drivers or Software Collection. Was this part of ThinkVantage or Software and Utility Collection or some stand alone Program picked from somewhere else?

Don't remember anything about it...

No problem at all.
Thanks again for being so kind and share this Program.