Homepage
Forum
Drivers
HMM-Manuals
MTM
Feed
A while ago, someone on Chinese 51nb suggested a BQ8030 specific set of unlock tutorials, and even longer ago, someone on the Chinese mydigit forum walked the guide of unlocking a BQ20Z955 using a cracked copy of BE2Works. Both of which involve the use of a CP2112 SMBus module (that effectively does the role of the EV2300)
Me being in Shenzhen right now with access to a sea of cheap and high quality Samsung and Sanyo 18650's as well as even the prismatic 103450's. I first bought some Samsung 35E's and then 33G's and rebuilt and unlocked an Acer pack with BQ20Z955 with success. Result is unbelievable with almost 60Wh of capacity, almost matching the real capacity of no name 9 cells!
Now, it's time for ThinkPads to get the love. For this, I just happen to come across a dead 22++ (42T4632) for cheap.
This time around, I decided to go adventurous and tried a set of 8 used Sanyo 18650GA's. Sanyo cells replaced with Sanyo cells to satisfy any OCD's out there, neat.
In order to charge the thing properly, I then went to get a well beaten up ThinkPad X60, which came with yet another Sanyo, but this time type 22 4 cell (92P1167), even more dead with guts spilling all inside the battery casing.
AND, to round it all off, while I was trying to be ambitious and get the ThinkPad 31 battery with 4 slim prismatic cells, I found a seller that not only sells the ThinkPad 31 (42T5247), but also, sells the almost unheard of ThinkPad reserve edition special 42T5260, with 4 prismatic and 4 cylindrical cells (flat bottom)! I am assuming all of which are dead though.
And YES, I will be using 8 Panasonic/Sanyo NCA103450 2350mah prismatic cells for these builds! All of which produced within this decade, they're in fact still produced today!
So, a guide of one battery rebuild turns into a whole family of every ThinkPad X6xs battery out there, excluding tablets and the extended life dock battery, which is li-po!
And, as luck will have it, all of which are Sanyo and have the BQ8030!
For this first post, it'll be about the 22++ only, and it will be done with the github open source DJI Battery Killer 0.5B2, although I have also by now unlocked the 22, which will be shown with the instructions of operating BE2Works 4.52.
Gallery will be provided at the end of the post
Before we start, a WARNING that this post is for educational purposes only. While every effort will be made to ensure the focus on safety dealing with these batteries, I will NOT be held responsible for any damages/losses incurred for following this guide!
Moreover, I CANNOT guarantee that either DJI Battery Killer or BE2Works are free of viruses/malware/worms etc! Use two dedicated laptops fully disconnected from other devices for these jobs!
As per forum rules consulted from RBS, linking to DJI Battery Killer's Github page is allowed (https://github.com/o-gs/dji-firmware-tools/issues/245 use wayback machine to access master-club. Make sure you have VS redist 2015, 32 bit and 64 bit installed!), but not for closed source BE2Works (which, also works ONLY on Windows XP SP2/SP3!). For now, if you insist on using BE2Works cracked version, send me a PM acknowledging that you're aware that the software can in fact be infected with spyware/trojan, and use a dedicated XP machine for this job!
This work presented will be essentially a combination of translating the finds of these members on those Chinese forums into English, plus my own personal take on this matter, having already rebuilt dozens of laptop batteries (mostly hot swapping)
Enough rambling, let's begin!
Disassembly
Disassembly is actually pretty straight forward with these X6x batteries. There are two square stickers that can be peeled off and it reveals one hole each, that is one very easy entry point and then just slowly go twist and pry at one clip at a time until it's all open.
For the 4 cell type 22, the rear of that battery is kinda weak and at a vertical angle that is hard to pry at. What I end up doing was prying open all the other clips, which left enough space for me to grab all the inside guts and rip them out. With an empty shell, it's then easy for me to access the plastic clips with a flathead screwdriver directly and simply unlatch each and every one of them until it's fully loose
(Gallery at the end of the post, please refer to it throughout this reading)
Once it's open, in the case of the 22++ 8 cell, you're greeted with what looks like a total mess on the inside. Don't worry, follow the following diagram and make sure you identify exactly how the wiring work
Take lots of photos of how the original was assembled before you dig any further
In my case, even though the cells all look in pristine shape, almost all of them are dead. two read 0.5V, all others 0. I carefully dislodged the temperature sensor, and then slowly disconnected all the wires. Once they're all disconnected, separate the cell groups and I end up reusing all the original wires, plus most of the original insulation material, including the wrapper cloth tape, and the all-so-important middle separator as pointed out in the diagram. Do NOT forget about that or else you'll have a nasty short circuit! And make sure no solder balls or wire strands are picked up by the adhesive!
I end up not using any of the original nickel strips as they were too thick for my spot welder to solder to them with good bond.
Inspection
Once the guts are all separated, time to inspect the BMS board.
It's got the BQ8030 like titled, and also it's got the 3 legged fuse, which in mine, when I measure across the two legs on one side, it reads full continuity, so it's not blown! If yours is blown, you need to bridge those two legs or replace it. A failed fuse will re-lock the BMS.
Then, before I forget, I lifted the one leg on one side which is the trip pin, and then stuck some kapton tape underneath. Before I can unseal/unlock the BMS, the BMS in locked state with sufficiently charged cells will try to blow the fuse with a nasty amount of heat and some magic smoke, I rather not see that.
I inspected the casing too, thankfully this one the casing is perfectly fine with no corrosion/battery juice, unlike my next project with the 4 cell type 22. Unbend any plastics that are bent, take off any already fully broken off pieces of plastic
Then, using the photos and that diagram, brainstorm about how you're going to reattach the cells.
From shown in the diagram, for 42T4632 (and one Sony 22++ I had before is similar), the bulge contains two groups of cells, groups 4 (closest to ground) and 3, each have their positives face together in the middle while their negative ends are connected together with a nickel strip.
Groups 1 and 2 are very normal 2P groups with the two cells side by side
Since a lot of the groups are actually connected together with wires from factory, I decided to assemble the packs by their groups individually
I first attempted to rebuild the weird groups 3 and 4 with the positive running out of the middle, and the negative being a nickel strip spot welded onto another nickel strip that runs from the two negative ends. And then I reapplied the cloth like material and taped the cells up into long sticks after I'm done, so that I get to handle two cells like they're one assembly, easier for reassembly.
Groups 1 and 2 are easy enough, just I made sure I left enough nickel strips in the angle that they were out of the factory. Remember you can also fold triangles with the nickel strip and have it route a perfect 90 degree turn
I end up taping the groups 1 and 2 together after they're spot welded together. And then I am left with basically 3 legos to connect together, nice.
Remember to put back that thick insulator in the middle of the groups 3 and 4, everything else went together without a hitch.
I shorted the positive terminal of the connector with the positive terminal of the battery pack, and then notice the voltage came on and then went back off. Time for unlocking!
UNLOCKING:
I'm sure this is where a lot of ppl get stuck on. Fortunately, the Chinese forums come in handy here. For this guide, it will be with the DJI Battery Killer. (When confused, go browse my gallery, pics are still too big to post here)
1. Open DJI Battery Killer, find the CP2112 device and click connect.
2. Make sure you select the BQ30Z55 in the dropdown menu. This has the same EEPROM dump structure as BQ8030. Read the battery info from there to verify its functionality. Don't freak out if things like cell voltages 1-4 are nonsense - it never worked right on both my batteries so far.
- It would help a lot if you remember info such as cycle count and full charge capacity when you go searching for them in the EEPROM dump. Note that on some BMS, like both of my 22 and 22++, the full charge capacity is in 1/100Wh. The way to tell that is through the designed capacity and compare against the labels on your battery case. If it reads for example 7488 for 22++, it's actually 74.88Wh (5.2Ah * 14.4V) . If it says 5200, then that's 5200mAh. Remember that.
3. Note we will NOT be using any of the automated one click functions - they won't work properly here. Overview: To make changes to the BMS's EEPROM for BQ8030:
a. Unseal the chip
b. Save the EEPROM
c. Open the EEPROM with a hex editor to edit values
d. Rewrite EEPROM
e. Seal the chip
4. Your first job is to unseal the chip. It's as follows (BQ8030 exclusive):
a. write word 0214 to 71 register
b. read (word) xxxx from 73 register. Open windows calculator programmer mode, calculate (in hex) 10000 - xxxx = cccc
c. write cccc to 71 register
d. write 0517 to 70 register
Now the BMS should enter unsealed mode. You can verify this by checking SMBus battery info where all the dynamic data like battery voltage, capacity etc are all filled with the same nonsense data, in my case it's full of 5911's
Now that it is in unsealed mode, go to the firmware section, uncheck boot mode check, and immediately use read EEPROM (do NOT touch firmware dump!) and save TWO identical dumps of your EEPROM, one for backup, one for modification! Double check the file size - it should be 2KB
Take one such copy of the EEPROM dump, and open it with hex editor of your choice. The go-to choice usually is HxD
Once you open the dump, from a lot of sources I've read on, the 0x0 to 0x4FF blocks are all static data, and in fact you should right away on the 2nd line see Sanyo and the FRU of your battery as ASCII. First line also has your designed capacity in mAh and in 1/100 Wh. You are NOT encouraged to edit these, since AFAIK they are checksumed somewhere.
Instead, all the stuff you truly want to modify are in 0x500 onwards, including full charge capacity, cycle count, and the all-so-important failure flags. Note that these info will appear exactly twice - it's recommended you change both exactly in the same way
On my dumps of the 22 and 22++, these have the occurrences in the following address:
Cycle Count (2-byte): 0x500, 0x600
Full Charge Capacity (2-byte): 0x502, 0x602
Failure flag (3-byte): 0x580, 0x640
It's very possible yours are in slightly different positions. On Karosium website and the Chinese guide I was following, they indicate that the failure flags are at 0x5A8 and 0x668 for example.
So the general advice is that if you can't find what you're looking for, use Ctrl + F, then search Hex-values to search for the cycle count after converting it in hex. Full charge capacity should be right adjacent to it (in either mAh or 1/100 Wh, as mentioned before). A Failure flag looks like 3-bytes of something in a land of FF's that have one or two of them being 00, and probably contains 01 or 80 (mine being 00 80 01). Remember there are two occurrences of each
If you still cannot find, make sure you're searching from the top in forward direction, and also try little endian (i.e. 0E A0 becomes A0 0E)
Change full charge capacity to whatever you think your cells will measure up to, change cycle count to any number you like, and then change the failure flag to 00 00 00
Save the EEPROM dump
Go back to DJI Battery Killer, write the edited dump. do NOT touch your input devices while it's writing, and do NOT freak out if the app hangs - look at the blinking LED's on your CP2112, that's your real status bar!
Once completed, send 08 COMMAND to seal the battery back up.
If done correctly and that your fuse is good, and that the battery cells have sufficient charge, you should now measure voltage coming out of your battery connector!
Repackage the battery casing so that SAFE and reliable for use.
General advices here include:
- It is advised that you always tend to use more insulating materials, not less. When in doubt, add more insulation
- Take lots of photos of your rebuild. Zoom in and see if there is anything that could go wrong.
- Make sure all fully broken off plastics and debris are cleared off. You don't want a tiny piece of plastic preventing your battery case sitting flush
- I use liquid adhesive and sometimes double sided tape to hold the battery cells in place on one of the sides. No need to give it a death grip, but 2-3 drops on each cell is more than sufficient. Especially on both of these battery packs, my rebuild end up being shorter than the original deal, and will rock around back and forth inside if not adhered down.
- It is not recommended for you to use superglue as the main adhesive to close the case shut. Sounds counter-intuitive, but Superglue dries rock hard, and every handling and insertion/removal of your battery pack means some torque to the casing. Over time, it will crack the battery casing. A few dabs of superglue in corners that won't sit flush is perfectly fine.
- I use again liquid adhesive to seal the sides of the battery pack. Liquid adhesive also works wonders on top of plastic clips. Liquid adhesive is flexible, is insensitive to temperatures, and is actually removable in case you seriously forgot about something and need to open the casing. It will need to be clamped shut for a few hours just like you'd do with a modern smartphone after battery replacement.
If you're truly following this guide for reviving a battery, please stay safe and good luck!
Gallery: https://imgur.com/a/thinkpad-x6x-batter ... -1-X4JQb4d
