ThinkPad X23 battery 02K6760 rebuild adventure, instructions on how to reprogram 80AF EEPROM

[kfzhu1229]

I think this thread is long since overdue.
After showing my experience with battery rebuilds to Thinkpad fans online, I got in touch with a fellow member who gave me a job lot of various ThinkPad batteries asking to be rebuilt. The costs, both my time involvements, and his monetary funding ended up not being cheap, but it was a win-win, for me doing extensive research into all sorts of abandoned forums and such and come up with ways to reprogram the old BMS to obtain free knowledge for everyone, while I get kinda paid for my time so my time wasn't wasted.
In the end, despite countless hurtles, it was a success! Pics are provided in an Imgur gallery: https://imgur.com/a/thinkpad-x23-batter ... ng-PatSdBu

In the case of X23, there are TWO kinds of batteries - a 4 cell prismatic (103450) that does not protrude, and a 6 cell 18650 based li-ion that protrudes slightly in the front. Basically the idea was 4 103450's laid in parallel against the longest side gives 200mm x 34mm x 10mm dimensions, while 6 18650's arranged in a rectangle gives 195mm x 36mm x 18mm, roughly the same dimensions other than the height! So, identify what cells you need before opening it up!
In my case, it's clearly a 6 cell Panasonic (02K6760) with the humps, so I got 6 EVE 18650-35V 3500mah cells lined up ready to go.
My Panasonic one is easy to open, it barely took any screwdriver prying at all before I was able to slice and wiggle all the clips until all of them unclipped with very minimal damage
It was however, very damaged on the inside. The middle cells read 0V, so I attempted CID reset to see if the BMS would come back alive, to my horror, battery juice starts coming out as soon as I restored voltage in the middle two cells! And nope, the battery wasn't working still! The laptop detects the battery, but while the health read healthy, and cell voltages are more or less balanced, it refused to charge! As I later found out, it in fact had locked, but X23 is too early to know what a locked battery is like so it falsely thought the battery is healthy!
In fact, I checked the fuse after this, and the fuse was blown too! And bypassing the fuse didn't fix the problem either. So this BMS definitely needs to be reprogrammed later!
Compared to my last daring attempt with this BMS found on the A31 battery, I am now far more equipped, with the addition of the old Philips LPT based adaptor and AccPlus and SmartBatteryWorkshop ready to go! Unfortunately, no one sells these to the best of my knowledge, I just ended up following the wiring diagram commonly provided with these utilities and hand made one. Choose a bigger sized board than I did when you do it yourself, I end up having to make use of every single hole of the PCB and it took 5 hours for the condensed wiring to be completed!

Battery rebuilding itself was very straight forward in this case. It is an easy rectangle arrangement, with a larger gap inbetween a pair of groups, so that wires can easily be routed through without them pinching and shorting against each other. I just took lots of pics of the original build in all sorts of angles, and then quickly disposed of the original cells since they were getting nasty. In hindsight I should've worn a mask in addition to window ventilation as the lithium smell was very prominent when the juice comes out.
Long story short, I just spot welded the new cells on, replicating the build of the old cells, making sure to transfer over all insulating materials, so that the wiring goes back exactly the same way as it did before to ensure maximum safety standards. I also washed the shells as they were potentially coated with battery juice from the incident.

Now the fun part was reprogramming. This is something I was essentially on my own! In this case, the 80AF (AK6480A) chip is the bigger SOP8 package like a BIOS chip, which made it much easier to desolder, so I went with desoldering, and managed to carefully desolder the chip without ripping any pads. While it is possible to read/write without removing the chip - it is risky! I did that on an A21m BMS with a similar SL394 chip, and it resulted in 5V Vcc reverse flowing into the P+ through a pull-up resistor for the voltage regulator and burnt the resistor!
It is a tricky dilemma, as if you decide to do a soldering job, it has to be 100% clean with healthy joints. These BMS really care about the cleanness of the EEPROM chips' legs! Even some residual flux inbetween the legs caused weird problems!
In this case, the M37516 and 80AF configuration is considered vintage, not only does it require you to program the EEPROM chip separately, but the EEPROM chip does not use SMBus protocols, rendering modern BMS utilities unusable! This is where the LPT based adaptor comes in, which supports communicating with this chip. I believe a TL866 can also be made to work with this chip, but forget about using CH341a.
I managed to desolder the chip cleanly and the soldered the chip into a DIP8 adaptor, which is then wired to the LPT adaptor with SmartbatteryWorkshop's pinout diagram.
As for tools, I found that only BE2Works 4.32 demo (requires CP2112 to start, officially free download), SBW demo, and AccPlus supports this chip. Only AccPlus can be found in full version, but it is very basic in its interface
But, for those hoping for one-click resets, it is in fact possible! I found out that, SBW demo reads and writes the chip just fine - only the one-click reset function is paywalled, whereas BE2Works 4.32 demo allows you to perform reset operation on the EEPROM but has no ability to write it back.
So, the idea is: use SBW (or AccPlus, both work fine) to read the EEPROM's dump, save it, then on another computer open BE2Works 4.32 demo, load the EEPROM manually, and then click the reset function, save the resulting dump, and use SBW again to flash it back!

In addition, I also found instructions file that explains exactly how 80AF and SL394's storage mechanism works, by understanding those, we can also find the parameters and clear them manually. I found out that BE2Works' one-click reset works well for the most part - it also clears the permanent fail flag fine - except that it doesn't change the design capacity, if your desired full charge capacity is significantly larger than the design capacity! In my case, I manually adjusted the design capacity to 4800mAh or 51Wh. I will attach a reply with the full guide on how to manually change the EEPROM of SL394 and 80AF family chips - it's very complicated!
After making sure that the EEPROM programming operation is successful, I desoldered the chip and carefully soldered it back onto the BMS. Then, I triple checked that on my blown fuse, the fuse trip leg is snipped off and the fuse is jumped over. And then I reconnected the cells carefully.

After starting the BMS with shorting the positive of the battery connector to the positive of the pack, the battery was alive! But, it was odd that the M37516 was heating up more than it should, and the cells would self discharge a few percentages overnight, and that concerned me. Turns out, the cause was simply that the legs of the EEPROM chips weren't clean enough and it created enough interference to confuse the BMS chip. I disconnected the cells, and then violently brushed the EEPROM chip with alcohol and contact cleaner until absolutely no flux is visible. Then I let it dry and reattached the cells, jump started it, it got warm again, but this time the chip only was warm for an hour or so, before it stopped heating up, and also no more anomalies!
Then the last step was for me to seal the battery back. This is where I ran into the next hurtle - my EVE 18650 cells are ever so slightly bigger in diameter than the original, so the shell wasn't closing 100% flush! Thankfully, I didn't break off any clips of the shell, so the remaining clips and the E6000 liquid adhesive I applied was strong enough to hold the case rigidly shut for the most part.
Finally, I ended up with a working X23 battery, and it works wonderfully! I first enterred a more aggressive full charge capacity of 60Wh and a more realistic design capacity of 51Wh. Two calibration cycles later, I ended up getting 52Wh of full charge capacity, which is a heck of a lot more than the original design capacity of 43Wh!
This is a wonderful result, as this means either 2 hours of gameplay, or like 4-5 hours of casual use on such an old ultraportable!

[kfzhu1229]

And the following is the detailed instructions on how to decipher the EEPROM of 80AF (M37516) or SL394 (AS3xxD), hand translated from Chinese into English:

1: 80AF vs SL394 share the same data storage algorithms. This being DEC to BIN, then reverse each 4 digits, and then swap the order of every pair of 4 digits.
Software required: accplus or SBW, and then compute the following on your own.

*******80AF commonly used data location:
1. Commonly used label location：
1 ) . Cycle Count (0x2c,0x2d)
2 ) . Full Charge Capacity (0x2e,0x2f)
3 ) . Key battery specific labels (0x32,0x33,0x34,0x35): These are battery specific, and host controller specific. Never change these labels.
4 ) . Manufacture Date (0x1bc,0x1bd)
5 ) . Manufacture Name: In ASCII. Here it's Panasonic, you could also see SANYO, etc.
6 ) . Device Name (0x1ca-0x1d5)
7 ) . Cell Type (0x1da-0x1df): LION or LIP, Never change this.
8 ) . Permanent Failure Flag (0x1fa,0x1fb): Important place for unlocking the battery. Change all of them to 00 00 to unlock.

3. About data storage algorithms

After finding the corresponding labels above, in the beginning only simple correspondences were observed. But then after rewriting everything in binary, the reverse and swap came to mind, and turns out all data inside this EEPROM are in this way. For example:
Cycle Count 0x2c=12,0x2d=34
Binary being:
0001　0010　0011　0100
After reversing:
1000　0100　1100　0010
And then after swapping the order of each pairs of 4 digits, the final data becomes 0100　1000　0010　1100, or: 482C = 18476, just an arbitrary example.
Or you can think of the reversed binary as HEX, which is 84C2, and then simply swap the position of every pair of digits: 482C
The date format is something special. It's written in year (15th to 9th binary position, base=1980), month (8th to 5th pos), day (4th to 0th pos). For example, 2007-01-12
Year: 2007 - 1980 = 27 = 1B = 0011011 (Again note, 7 digits only)
Month: 1 = 0001
Day: 12=0C=01100 (5 digits)
Put it all together: 0011011000101100. Reverse every 4 digits: 1100011001000011 (C643)
Then swap: 0110110000110100, or 6C34
ASCII characters get similar treatment.

4. Checksum
It's not exactly checksum, but anyway. The whole EEPROM data can be categorised into 4 regions. Region 0x00000200－0x000002FF contains the FF complement of 0x00000000－0x000000FF; 0x00000300 - 0x000003FF contains 0x00000100 - 0x000001FF's FF complement. For example 0x00000000 has HEX 29, then 0x00000200 must be FF - 29 = D6

5. Data Modification
1) Cycle Count (0x2c, 0x2d), change if needed (mine is changed to 00 80 or 1 count), corresponding checksum (0x22c,0x22d) must be modified too (FF 7F)!
2) Full Charge Capacity (0x2e, 0x2f), change if needed (mine is changed to 48 03 or 4800mAh), corresponding checksum (0x22e,0x22f) must be modified too (B7 FC)!
3) Design Capacity (0x1b6, 0x1b7), change if needed (mine is changed to 48 03 or 4800mAh), corresponding checksum (0x3b6,0x3b7) must be modified too (B7 FC)!
4) Manufacturing Date (0x1bc, 0x1bd), change if needed (mine is changed to 2C F4 or 2006-01-15), corresponding checksum (0x3bc,0x3bd) must be modified too (D3 0B)!
5) First Use Date (0x1f8, 0x1f9), from experience, change only 0x1f8 if needed, do not change 0x1f9 (my 0x1f8 is changed to 2C or year 2006), corresponding checksum (0x3f8) must be modified too (D3)!
6) PF Flags (0x1fa, 0x1fb), zero everything. Corresponding checksum (0x3fa, 0x3fb) must be changed too (FF everything).

After all is done, write the modified dump back into the chip, solder the 80AF back into the PCB, make sure you do not put the chip in backwards.
Reconnection of battery cells is of the following order: from low to high, from 0V (the bottom of the last group of cells), then 4V (bottom of middle group, or top of the last group), then 8V (bottom of top group, or top of middle group), then lastly 12V (top of the 1st group), 4 connections in this case.


2. *******SL394's key data locations are as follows:
1. Manufacturing date: 0000 0001
2. Cycle Count: 0020 0021
3. Full Charge Capacity: 0028 0029
4. Design Capacity: 0160 0161
********************************************************************************************************