Hacking "JBLTools" Chinese Bluetooth BMS boards

simat

10 mW
Joined
Apr 7, 2013
Messages
29
Location
Harvey, Western Australia
There are a number Chinese Bluetooth PCBs that use the TI BQ76940 BMS controller/controllers connected to an Atmel 8 bit microcontroller looking like this.
48V-Smart-bluetooth-BMS-system-with-30A-discharge-current-for-54-6V-Battery-system-E-Bike.jpg_640x640.jpg

One of the main issues with these boards is the layout of the FETs that disconnect the battery from the rest of the world in the case of a fault and the external high current connections.

I have hacked the 30A version of this board to make it a dual port (separate charge and load ports) with ~100A load and ~50A 150V charge ports to connect between a 48V LFP battery with on the charge side 120V solar panels and on the discharge side a 4kW PIP4048 inverter.

Firstly, I removed the 5 charge FETs

Secondly, I used a Dremel to cut a slot between drains of the charge and discharge FETs to make the BMS dual port. Make sure to cut to the edge of the PCB and check with a multimeter that you have separated the two sets of pads.
BMSbarePCBfront.jpg
BMSbarePCBback.jpg


Thirdly, I soldered the 5 FETs I removed on the back of the PCB behind the discharge FETs on the front of the PCB. For the discharge FETs
I used 2 Vishay SUM80090E 150V FETs for a maximum charge current of 20A.

To make sure that the current is shared evenly between the FETs and to mininise the interconnection power losses I soldered ~3.5sqmm wires all of equal length from each FET or current sense resistor to 8mm crimp lugs.
BMScabling.jpg
BMStoBattery.jpg



From the voltage drop I measured I calculated the drain source resistance of the original HY3008 FETs to be ~7mOhms, so total resistance of the ten FETs in parallel is 0.7mOhms. This gives a power loss of ~7W with a 100A load.

Simon
 
Nice work.

Did you change the current measurement shunts?

Do you have a link for the BMS? It says it has "communication function". I'd be interested to know exactly what it does.

Any idea what the standby drain of the BMS is?
 
fechter said:
Did you change the current measurement shunts?
No, the original shunts are 4mOhms and there are ten of them.
Do you have a link for the BMS? It says it has "communication function". I'd be interested to know exactly what it does.
https://www.aliexpress.com/store/pr...attery-system-E-Bike/1379203_32733414980.html
I started a tread a while ago detailing the communications protocol here
There is more good information on the protocol here
I would be interested in any information on how to manually turn on the individual cell balance transistors.

Any idea what the standby drain of the BMS is?

I did a quick rough check of the current consumption on the negative lead:-
Idle, Bluetooth PCB disconnected, 0.1mA with ~8mA pulse every around two seconds
Bluetooth connected and linked to phone software 9.5mA with pulse of >29mA
Bluetooth PCB connected but not paired with phone, 0.7mA with pulse peak ~29mA

Simon
 
Great information. Thanks for posting it.

Do you know if the app displays the individual cell voltages? Are there any screen shots of the app?

Sorry for so many questions.
 
Looks like you're running CALB cells, is that right?
I'm using these cells in an offgrid solar system as well.

Totally unscientific question :) what do the red and black dots on the side of the cells signify?
 
fechter said:
Do you know if the app displays the individual cell voltages? Are there any screen shots of the app?
These are screenshots from the software provided with the BMS
HTB1k1TedQfb_uJkHFNRq6A3vpXal.jpg

HTB1Kv6XsQOWBuNjSsppq6xPgpXao.jpg

And from my software reading the data from the BMS
batday.jpg
 
EbikeAus said:
Looks like you're running CALB cells, is that right?
I'm using these cells in an offgrid solar system as well.

Totally unscientific question :) what do the red and black dots on the side of the cells signify?

I have been running Winston cells for over five years now. You are right, the cells in the photograph are a new batch of CALBs that I am using to put together a system for a friend.

The black and red dots are the protective terminal covers that came with the new cells. I might reuse them when I transport the battery to its final resting pace.

May I ask what charge controller, inverter, BMS and other electronics that you have connected to your battery.

Simon
 
OK, thanks for posting the screen shots. That looks pretty good, assuming it actually works the way it's shown.
 
I don't know if the forum has a method to "follow" without posting, but I'd like to follow this thread :D.

I'm personally curious aboiut the bluetooth BMS boards because they seem to me a cheap/modern way to get a form of isolation and convenience out of a BMS board.

I particularly am thinking about whether this wouldn't be useful for a cheap 48S car pack if it can be done ideally without relying on any of the BMS fets doing anything other than passively alarming that there's a problem (this would turn the BMS into a higher-drain higher-function celllog, insofar as it would mostly be functioning to balance, to report remotely the voltages, and maybe to set off an alarm if it faults.) In my particular car pack it's just a 30Ah pack for a honda insight parralel hybrid, so the fact they have balancing meant for ebike packs isn't reall an issue.) (Explicitly I'm looking for ways to use the 16S versions of these in series in an up to 200A application (120A 45S peaks, 90A 3minutes) that has other current protection systems]. I don't think I've done enough research yet to get a sense of whether I can bypass the protection fets and whether I can use them to set off an alarm so that I know something faulted without checking the app [which may be enough.])

Sorry I got way into the details of my application but generally just wanted to follow the topic because it seems like a good application and I am curious about the uses for the bluetooth bms units.
 
Kin said:
I don't know if the forum has a method to "follow" without posting, but I'd like to follow this thread :D.
If you click on the "spanner" button next to the "Post Reply" button you can subscribe. Interestingly I haven't been getting notifications via email recently, is there a problem?

I'm personally curious aboiut the bluetooth BMS boards because they seem to me a cheap/modern way to get a form of isolation and convenience out of a BMS board.

I agree. If you want to electrically isolate it you can use an opto isolated serial link and/or hook it up to something like the Raspberry Pi and use WiFi.

I particularly am thinking about whether this wouldn't be useful for a cheap 48S car pack if it can be done ideally without relying on any of the BMS fets doing anything other than passively alarming that there's a problem (this would turn the BMS into a higher-drain higher-function celllog, insofar as it would mostly be functioning to balance, to report remotely the voltages, and maybe to set off an alarm if it faults.) In my particular car pack it's just a 30Ah pack for a honda insight parralel hybrid, so the fact they have balancing meant for ebike packs isn't reall an issue.) (Explicitly I'm looking for ways to use the 16S versions of these in series in an up to 200A application (120A 45S peaks, 90A 3minutes) that has other current protection systems]. I don't think I've done enough research yet to get a sense of whether I can bypass the protection fets and whether I can use them to set off an alarm so that I know something faulted without checking the app [which may be enough.])

From what I can see these boards go as high as 27S.

You can easily bypass the protection FETs while still monitoring the current by connecting the battery minus to B- and the system minus to the other side of the current sense resistors. If you didn't want to monitor the current you needn't bring the main battery minus to the BMS at all.

You could either check for a battery fault via software interrogating the BMS boards via the serial links or via hardware by monitoring the output pins from the TI BQ76940 BMS controller/controllers that control the protection FETs or detect if the FETs themselves are On or Off.

You can via software commands manually switch the charge or discharge protection FETs on or off so could use the lowest voltages BMS board that is connected to the battery minus to disconnect the battery from the load and or charger.

I would like to control the individual cell balancing transistors remotely if this is possible but haven't really looked to see if it is possible. It would be possible to take the Atmel processor that is on the boards out of the picture and talk directly to the TI controller chips via the I2C bus but I would rather not have to go down that road.

Simon
 
fechter said:
OK, thanks for posting the screen shots. That looks pretty good, assuming it actually works the way it's shown.
I have been using them on our E-Bikes for some time and they seem to work well. Only issue I have had is that connecting/disconnecting the bluetooth module can "glitch" the Atmel processor and hang the software. Only way to fix this is to toggle the reset pin on the processor or remove the power. Hooking a reset switch up the reset pin of the Atmel processor might be a good idea.

Simon
 
Possibly naive question, but if the protection fets aren't being used (only balance taps), is there any danger to connecting multiple boards in series? I.e, two bluetooth 16s modules connected to make up a 32S pack, for example.


As far as I can tell, they should only see the voltage they're tapped across....I can't think of why they would see any higher voltage. I do not know what specific requirements these BMS have for balancing, i.e, when they will and won't balance. But ideally I would be able to set them to balance my voltages occasionally, or else I would just use them for cheap remote cell voltage monitoring. I would wire something to allow me to disconnect and reconnect the bluetooth modules remotely since those seem to be a major power draw. It seems by your recommendation I should also find a way to reset the atmel processor remotely. For context, the battery pack they'd be going into is under a few bolts and hard to access and I know realistically that without a remote monitor they'd get no monitoring :p.

If you're trying to reset the atmel processor every time you disconnect and reconnect the bluetooth, maybe there's something in the bluetooth module that toggles down temporarily during boot and could be connected to the atmel processor reset pin.
 
Kin said:
Possibly naive question, but if the protection fets aren't being used (only balance taps), is there any danger to connecting multiple boards in series? I.e, two bluetooth 16s modules connected to make up a 32S pack, for example.

I don't see any reason that won't work as long as you aren't passing the main power leads through the BMS and the two don't touch each other.

Getting two of them to pair and connect to the same phone might be difficult.
 
simat said:
EbikeAus said:
Looks like you're running CALB cells, is that right?
I'm using these cells in an offgrid solar system as well.

Totally unscientific question :) what do the red and black dots on the side of the cells signify?

I have been running Winston cells for over five years now. You are right, the cells in the photograph are a new batch of CALBs that I am using to put together a system for a friend.

The black and red dots are the protective terminal covers that came with the new cells. I might reuse them when I transport the battery to its final resting pace.

May I ask what charge controller, inverter, BMS and other electronics that you have connected to your battery.

Simon

Ok, that makes sense!

No problem. My system is currently packed away in wooden crates as I'm moving house in a few days.
Once at the new house i'll be building a new and bigger off grid man cave.

I run 16s 100 ah CALB cells for 48V system.

Charge controller is MPP Solar PCM60X
Inverter is Latronics 48v 1800 watt (Aussie made) 8)
BMS is Batrium with blockmons

I also have another 16 60ah cells I had paralleled with the 100s but not sure I'll do that next time.
I have a youtube channel which documents my off grid adventures, if you would like to check it out let me know. :)
 
simat said:
fechter said:
OK, thanks for posting the screen shots. That looks pretty good, assuming it actually works the way it's shown.
I have been using them on our E-Bikes for some time and they seem to work well. Only issue I have had is that connecting/disconnecting the bluetooth module can "glitch" the Atmel processor and hang the software. Only way to fix this is to toggle the reset pin on the processor or remove the power. Hooking a reset switch up the reset pin of the Atmel processor might be a good idea.

Simon

Hi Simon,

I accidentally shorted my pack with the GRND of the serial output on this BMS and a cell lead wire around 45 Volts. After the short, I tried communicating with the BMS via JBDTools software but made no connection, which hasn't happened before. Usually when the BMS shuts off the pack I'm still able to communicate with it. It seems like the short either froze or broke the BMS. I attempted reseting the BMS by shorting the two reset pins (I believe these are the reset pins) next to the thermo-resistor ports (see pic of BMS in link above) but this didn't work (btw this was also my first time attempting to use the reset pins).
Any ideas on what may be going wrong or another way to reset the BMS?
Thanks,
Bryan
 
In electronics usually over voltage damages them beyond repair unless they're explicitly designed to protect against it (more expensive.) I feel without knowing the details it's probably not worth repairing unless someone is confident they know how to repair it / what exactly was damaged
 
Most likely such a high overvoltage would have damaged the serial transceiver. If that is a separate part from the MCU, you could try replacing it, but it may be just pins directly on the MCU, in which case that is probably damaged and likley to be unavailable to replace.

It depends on whether that ground line is actually just the most negative of a pair of transceiver wires, or if it's actually ground. If it is actually ground, then there may be no damage to the transceiver, but there might be to the sensor for the 45v cell balance wire that was shorted to it (or to the one above or below it, depending on how current flowed in the stack of them).


It might also just have crashed the MCU program, and resetting it or disconnecting it from the entire battery at all points might fix it. But since it didn't reboot when you reset it, that's less likely.
 
I don't quiet follow why you did this.
The BMS has a port for connecting the battery -> B-
Then a set of discharge FETs and a discharge port after those -> P-
Then another set of FETs which are used to control charge current and a common discharge/charge port -> C-
So if you want to bypass the charge FETs then simply connect your load on the P- port, aka. in between the two FETs?

On your images it's not visible what the now isolated charge FET is even connected to.

Btw. I made open source firmware for this BMS: https://github.com/BotoX/xiaomi-m365-compatible-bms
 
BotoXbz said:
Btw. I made open source firmware for this BMS: https://github.com/BotoX/xiaomi-m365-compatible-bms
Even though i follow the main thread for this BMS and posted a lot as well there, i totally missed your announcement.
I read the README.MD on github, but I'm not sure i see what the benefits of your firmware are? Why did you do it?
I guess i'd just flash it just because I prefer hacked firmwares of any kind ;)
 
izeman said:
BotoXbz said:
Btw. I made open source firmware for this BMS: https://github.com/BotoX/xiaomi-m365-compatible-bms
Even though i follow the main thread for this BMS and posted a lot as well there, i totally missed your announcement.
I read the README.MD on github, but I'm not sure i see what the benefits of your firmware are? Why did you do it?
I guess i'd just flash it just because I prefer hacked firmwares of any kind ;)

The main motivation was to make a custom battery for my Xiaomi M365 scooter.
The stock BMS of the scooter talks a proprietary protocol to the motor controller, and without the battery talking to the controller the scooter does not work (and doesn't display battery stats on the display / app)
If you flash my firmware then the original JBD windows tool will not work anymore!
I've open sourced it so the code can be adapted for other applications. For example the bafang dpc-18 has a menu that can show battery stats, it would be cool to make the BMS compatible with that.
The other improvement is coulomb counting for SOC instead of voltage based SOC.
Configuring it has to be done when programming (in main.h) or by using the configtool.py in an interactive python shell, so not user-friendly compared to the JBD tool, but perfect for hackers :p
And I didn't implement all configurable features yet, like max charge current and min/max temperature.
 
amberwolf said:
Most likely such a high overvoltage would have damaged the serial transceiver. If that is a separate part from the MCU, you could try replacing it, but it may be just pins directly on the MCU, in which case that is probably damaged and likley to be unavailable to replace.

It depends on whether that ground line is actually just the most negative of a pair of transceiver wires, or if it's actually ground. If it is actually ground, then there may be no damage to the transceiver, but there might be to the sensor for the 45v cell balance wire that was shorted to it (or to the one above or below it, depending on how current flowed in the stack of them).


It might also just have crashed the MCU program, and resetting it or disconnecting it from the entire battery at all points might fix it. But since it didn't reboot when you reset it, that's less likely.

Thanks for getting back to me. Here's two images showing what I found on the BMS. It may be hard to see b/c imgur reduces photo upload resolution but it looks like the two components connected to GRND of the Serial Port are fried. PCB design is not my strongest but it looks like GRND and RX and connected via 2 105 resistors. I wasn't sure where the cell sensors may be so I didn't check them for damage. It also looks like the MCU pins are in good shape. Unless this is an easy fix and the needed parts are known, I think I'm just gonna buy another one. It would be awesome to hear what you think.

One related question though: Since it looks like that serial port can power a bluetooth unit, could it also power an Arduino nano and 20x4 LCD screen. This would draw more current but probably not by a lot ( I guessing about 100 more milliamps?). For context I'm working on a project (inspired by @simat) to use an Arduino nano to read battery data from the BMS and send it to the LCD screen. I originally powered the nano via arbitrary cells lead directly from my battery and have now learned my lesson to not do that :)
 
fordtheriver said:
amberwolf said:
Most likely such a high overvoltage would have damaged the serial transceiver. If that is a separate part from the MCU, you could try replacing it, but it may be just pins directly on the MCU, in which case that is probably damaged and likley to be unavailable to replace.

It depends on whether that ground line is actually just the most negative of a pair of transceiver wires, or if it's actually ground. If it is actually ground, then there may be no damage to the transceiver, but there might be to the sensor for the 45v cell balance wire that was shorted to it (or to the one above or below it, depending on how current flowed in the stack of them).


It might also just have crashed the MCU program, and resetting it or disconnecting it from the entire battery at all points might fix it. But since it didn't reboot when you reset it, that's less likely.

Thanks for getting back to me. Here's two images showing what I found on the BMS. It may be hard to see b/c imgur reduces photo upload resolution but it looks like the two components connected to GRND of the Serial Port are fried. PCB design is not my strongest but it looks like GRND and RX and connected via 2 105 resistors. I wasn't sure where the cell sensors may be so I didn't check them for damage. It also looks like the MCU pins are in good shape. Unless this is an easy fix and the needed parts are known, I think I'm just gonna buy another one. It would be awesome to hear what you think.

One related question though: Since it looks like that serial port can power a bluetooth unit, could it also power an Arduino nano and 20x4 LCD screen. This would draw more current but probably not by a lot ( I guessing about 100 more milliamps?). For context I'm working on a project (inspired by @simat) to use an Arduino nano to read battery data from the BMS and send it to the LCD screen. I originally powered the nano via arbitrary cells lead directly from my battery and have now learned my lesson to not do that :)

I like the idea of a LCD screen for these BMS, probably adding a coulometer. But beware that if you source power from the communication port, the protection circuit will not trigger. I've killed my battery by leaving the FTDI module connected for couple months.

I think it is a better idea to power the LCD from the battery output using a common power supply as step down. These usual work in 24 to 250v range ( https://www.amazon.com/BOLWEO-100-240V-Wireless-Connector-5-5mmx2-1mm/dp/B0719GY29M?keywords=5v+power+supply&qid=1547529201&s=Electronics&sr=1-3&ref=sr_1_3 ). This way the LVC will trigger and not permit more than safe drain. In this case you can extend the display for some minutes after LVC if you add a large capacitor. Please keep us posted if you make progress with the project.
 
trazor said:
I like the idea of a LCD screen for these BMS, probably adding a coulometer. But beware that if you source power from the communication port, the protection circuit will not trigger. I've killed my battery by leaving the FTDI module connected for couple months.

I think it is a better idea to power the LCD from the battery output using a common power supply as step down. These usual work in 24 to 250v range ( https://www.amazon.com/BOLWEO-100-240V-Wireless-Connector-5-5mmx2-1mm/dp/B0719GY29M?keywords=5v+power+supply&qid=1547529201&s=Electronics&sr=1-3&ref=sr_1_3 ). This way the LVC will trigger and not permit more than safe drain. In this case you can extend the display for some minutes after LVC if you add a large capacitor. Please keep us posted if you make progress with the project.

That's good to know that the VCC source on the serial output of the BMS is not part of the protection circuit. My current design is to put a switch on the VCC line so that I can easily turn on/off the Arduino. This switch would be located near the LCD screen on the handlebars but I would have to remember to turn off the display every time. I bet there's some way for the Arduino to turn itself off given a certain condition, I'll look into that.

It looks like you linked an AC/DC converter, but I think you are suggesting to use a DC/DC converter to convert my entire battery pack voltage (about 55V for me) down to 5V for the Arduino?

Given that the Arduino has a built-in DC/DC converter with an input range of 7 -12 Volts, I could also power the Arduino using the cell leads I have on my pack. This is what I was doing when I shorted the GRD of my Arduino with the GRD of the serial port because I was powering my Arduino with a GRD of about 45 Volts relative to the GRD of the serial port. If it is safe to assume that GRD of the serial port is GRD of the battery pack, then I could use the 3S cell lead at ~11.1 Volts relative to GRD to power the Arduino. Is this a safe assumption?

I'd love to keep you all posted with my progress. Given that this is my first time contributing to this forum, I don't know best practice. Should I create a new topic in the "Battery Technology" section for this project?
 
fordtheriver said:
trazor said:
I like the idea of a LCD screen for these BMS, probably adding a coulometer. But beware that if you source power from the communication port, the protection circuit will not trigger. I've killed my battery by leaving the FTDI module connected for couple months.

I think it is a better idea to power the LCD from the battery output using a common power supply as step down. These usual work in 24 to 250v range ( https://www.amazon.com/BOLWEO-100-240V-Wireless-Connector-5-5mmx2-1mm/dp/B0719GY29M?keywords=5v+power+supply&qid=1547529201&s=Electronics&sr=1-3&ref=sr_1_3 ). This way the LVC will trigger and not permit more than safe drain. In this case you can extend the display for some minutes after LVC if you add a large capacitor. Please keep us posted if you make progress with the project.

That's good to know that the VCC source on the serial output of the BMS is not part of the protection circuit. My current design is to put a switch on the VCC line so that I can easily turn on/off the Arduino. This switch would be located near the LCD screen on the handlebars but I would have to remember to turn off the display every time. I bet there's some way for the Arduino to turn itself off given a certain condition, I'll look into that.

It looks like you linked an AC/DC converter, but I think you are suggesting to use a DC/DC converter to convert my entire battery pack voltage (about 55V for me) down to 5V for the Arduino?

Given that the Arduino has a built-in DC/DC converter with an input range of 7 -12 Volts, I could also power the Arduino using the cell leads I have on my pack. This is what I was doing when I shorted the GRD of my Arduino with the GRD of the serial port because I was powering my Arduino with a GRD of about 45 Volts relative to the GRD of the serial port. If it is safe to assume that GRD of the serial port is GRD of the battery pack, then I could use the 3S cell lead at ~11.1 Volts relative to GRD to power the Arduino. Is this a safe assumption?

I'd love to keep you all posted with my progress. Given that this is my first time contributing to this forum, I don't know best practice. Should I create a new topic in the "Battery Technology" section for this project?

AC/DC "switched" power supplies work great with DC as input. I do it all the time, and there are plenty of threads on that on ES ( like https://endless-sphere.com/forums/viewtopic.php?t=50458 ).
I don't recommend to connect things directly to cells. That will skip the protection circuit too.
 
Great post. Please can you share details about communication between BMS and PC? I want to make ESP32 display using this BMS.
thank you!
 
Back
Top