2021.09.05: LiPo reverse engineering

2021-09-05 08:13 by Ian

I needed a specific kind of battery for a project. And I happened to have one salvaged from a ruined Nexus7 sitting in my "Reverse-Engineering TODO" box that fits the application perfectly. I guess it's time to tear into this battery and put it to good use.

The original connector had two red wires, two black, one yellow, and one white. The two red wires had the same voltage across all combinations of black wires. I assume that the wires were doubled-up for current-capacity reasons. The white and yellow wires are a mystery that I want to solve for the sake of system integration.

Opening up the tape on the battery to expose the protection PCB, the first thing I noticed is that the two red wires are joined at the pack. Same goes for the two black wires. The pack is, in fact, a single cell. So any replacement parts found online that claim a 3.75V battery and two cells are mistaken. There is a closely-related battery that is two cells. But that battery is 7.4V, and appears to have an additional wire (green). So be aware of that...

The protector PCB wires are helpfully labeled on the silkscreen. I see that the yellow wire is labeled "DAT", and the white labeled "CLK". That's a fairly good indicator that I2C is in use here. This was what I hoped to find. The battery had been sitting flat for many years. So the protection circuit had cut the battery off. Voltage across the red and black wires was ~0.6V. Interestingly, the voltage across yellow-black, and white-black was 2.15V. If is is I2C, than it appears the host controller can communicate with the protection board, even if the hard cut-off is engaged. Nice touch, Asus...

Also noticed what appears to be a pair of black leads leading into (around?) the pack wrapping. For now, I'll assume that this is a cell thermistor.

Noticed a pair of transistors (for implementing hard cut-off). A SOT-5 part that might be a temperature sensor, an LDO regulator, or a low-voltage cut-off switch. Probably the latter. But I'm not interested to find out right now. I also see what looks like a fuel gauge (and/or auth chip) on the back side of the board. If I scan the bus and find more than one I2C device on the board, I'll revisit the SOT-5.

That's an awfully unlikely package.... 12-pin, and about 2.5x4mm. A quick search through Digikey yielded about 85 possible parts. Almost all of them TI.

Based on the package alone (VSON-12), the part is either a TI BQ27500-V130 (or related), OR a Ricktek RT9426.

After a few quick continuity tests, I found which pins on the VSON-12 correspond to the DAT (10) and CLK (11) lines. Both candidate parts have the SDA/SCL lines in the same places, and those pins comport with the silkscreen on the protection PCB. It looks like Ricktek might have been trying to enter a niche created by the (more prolific) TI parts. The trouble is,that the package markings don't match those documented in the RT9426 datasheet, nor does TI's marking search tool know anything about the thing in my hands. The part bears the markings:

TI K 2A80

Maybe a white-labeled part? Asus is a big customer that uses lots of batteries. So that could make good sense. At this point, I need to start talking to it over I2C. So I'll let it charge for a few hours.