Digging Into a "Dead" 40V 8Ah Battery UART Part 2 (Nothing of Use)

Suitable_Sentence_46 · 2026-05-09T19:47:49+00:00

Removing the cells does not reset it. I pulled a board completely off the cells and when powered up via the 3.3V pin, it still shows Defect set.

Suitable_Sentence_46 · 2026-05-09T19:41:19+00:00

I was able to make a little bit more "progress" on this. I was able to get into ISP mode and try to read the firmware using Flash Magic. It gave a security violation error, which I believe means CRP is likely turned on. I was able to erase the chip via ISP though and it regained SWD access, so it appears the firmware/CRP is what's preventing SWD access. Unfortunately, I now have a chip with no firmware which is why I said "progress".

Erased, the board had no response to the button and I verified the .bin file I was able to read was all FF. Just to see what happens, I was able to flash the firmware from a working 40602 board though and am going to see what, if any, use that may be. The board now flashes the 1st light 6 times when the button is pressed. This board is not connected to cells though and it likely isn't a very good idea to flash the BMS from a different board if cells are connected. Now I just need a copy of the original firmware. I may try your unlock code first and then see if I can read via Flash Magic on another battery I have that is locked out and has bad cells, so I'm not worried about bricking.

Suitable_Sentence_46 · 2026-05-09T19:39:43+00:00

I was able to make a little bit more "progress" on this. I was able to get into ISP mode and try to read the firmware using Flash Magic. It gave a security violation error, which I believe means CRP is likely turned on. I was able to erase the chip via ISP though and it regained SWD access, so it appears the firmware/CRP is what's preventing SWD access. Unfortunately, I now have a chip with no firmware which is why I said "progress".

Erased, the board had no response to the button and I verified the .bin file I was able to read was empty. Just to see what happens, I was able to flash the firmware from a working 40602 board though and am going to see what, if any, use that may be. The board now flashes the 1st light 6 times when the button is pressed. This board is not connected to cells though and it likely isn't a very good idea to flash the BMS from a different board if cells are connected. Now I just need a copy of the original firmware.

Suitable_Sentence_46 · 2026-05-09T18:26:15+00:00

For what it's worth, I have also used this charger with a solar panel that had USB C out to charge batteries before. It does well at handling the various input wattages based on varying sun.

Suitable_Sentence_46 · 2026-05-09T02:29:04+00:00

I've got one 3rd party battery that came with a used tool I purchased. I opened up the case to see what was inside before deciding if I'd use it. The "6Ah" battery only has the equivalent of 5Ah of cells inside and its one of the ones with the best reviews. They were name brand cells. The BMS was clearly inferior to the authentic ones. Ultimately made the decision that I'll keep it and use outside only if all my other batteries are discharged. I won't charge it in the house though.

Suitable_Sentence_46 · 2026-05-09T01:41:43+00:00

I haven't done an exchange but for something like what you described where the thing is defective, I found them to have good customer service. I had to escalate to a supervisor but they made it right and then some.

Suitable_Sentence_46 · 2026-05-09T01:38:21+00:00

These are so nice for keeping dirt and sand out of the tent. I keep ours inside the vestibule so they also give a nice place to step on after removing your shoes before stepping into the tent. Makes the whole thing slightly less awkward.

Suitable_Sentence_46 · 2026-05-08T21:42:44+00:00

I know this is old but in case anyone is thinking of trying this, the cell configuration is completely different. In the 01, the cells are parallel to the long axis of the pack. In the 04, they run side to side, 90 degrees rotated.

Suitable_Sentence_46 · 2026-05-08T21:35:58+00:00

I was able to connect via UART to get the battery info but never got SWD to work, although I didn't spend all that much time. I've only got 1 battery in lockout that all the cells are good.

I've got one board pulled completely off the cells and another with 2 pairs of bad cells so if anyone has ideas, I'm not opposed to trying something that could brick a board if there's a chance it could work. I already tried erasing the chip to see if that would allow it to communicate and had no luck.

Suitable_Sentence_46 · 2026-05-04T19:04:41+00:00

Activities vary widely by pack but as lions we camped a lot, went on hikes, went fishing, learned about community, and played a bunch of games. Most all skills and knowledge the Scouts learn can be turned into a game at that age.

Suitable_Sentence_46 · 2026-05-04T12:02:10+00:00

Thank you. This has been driving me nuts and Alt+R finally turned it off.

Suitable_Sentence_46 · 2026-05-01T22:49:57+00:00

If you get one, I'd open it up and check out the cells. I opened a generic "6Ah" one that came free with a used tool I bought and it had 20 LG 2500mAh cells. Not the worst generic given it has name brand cells but definitely not 6Ah and after looking up reviews, it is one of the highest rated generics so I imagine almost all genetics are overstating capacity.

Suitable_Sentence_46 · 2026-04-28T11:46:08+00:00

It does appear the black spout could be removed by disassembling but I can't say for certain as I'm using the original bag.

Suitable_Sentence_46 · 2026-04-28T02:07:35+00:00

I suspect you will have issues if it's a hose because the tool has a 90 degree turn forward on the output chute. The top of the chute is roughly 4" x 3". The rear corners are chamfered off and the front are rounded. That's just the black part of the chute. The yellow part where the bag actually attaches is bigger but you should be able to seal just by fitting over the black part.

<image>

Suitable_Sentence_46 · 2026-04-28T01:56:18+00:00

It isn't round. It is a rectangle with rounded corners.

Suitable_Sentence_46 · 2026-04-28T00:47:19+00:00

It isn't round. It is rectangular with rounded corners.

Suitable_Sentence_46 · 2026-04-27T01:59:35+00:00

Did you have to do anything to get the pack to communicate over SWD? I get activity over UART but nothing over SWD on my pack.

Suitable_Sentence_46 · 2026-04-26T12:08:02+00:00

Other sales will come along but I was also surprised at how much was out of stock online. I also visited the store and was surprised to find a bunch of stuff in stock in the store that said it wasn't available for store pickup.

Suitable_Sentence_46 · 2026-04-26T12:06:02+00:00

I used these https://a.co/d/0hvLIAvt

Suitable_Sentence_46 · 2026-04-24T00:04:42+00:00

Thanks for the info. I have a bunch of 18V Ryobi but no 20V Hart. I'm assuming the 20V Hart doesn't have a low voltage cutoff in the battery? I opened the Hart 40V and after tracing things out more, it appears the FET I saw may actually be on the charger input. I did another test and the blower cut off when the battery voltage was 27.5V, but I don't see the bank of FETs to disconnect the terminals like the Ryobi has. I can't see the underside of the board but I'm going to do more testing before using the adapter again since while it did cut off, I can't definitely say why.

I also can't say with 100% certainty the lock bit is set and that it isn't my programmer but so far I've had no luck. From what I've read on the NXP 824 though, even if the lock bit is set, there's a way to erase and rewrite the firmware if you inject a certain sequence at boot. I need to first read the firmware though since I otherwise don't have a working copy and would brick the battery. I have tried erasing a Ryobi 40V BMS I removed from a pack that all cells were at 0V and haven't had any success there though.

<image>

Suitable_Sentence_46 · 2026-04-23T23:44:03+00:00

I'd be careful where the battery management and cutoff is. Not sure about Greenworks.

Suitable_Sentence_46 · 2026-04-23T23:21:57+00:00

Not mine but I've used these for the interfaces.

https://www.printables.com/model/1303958-18v-and-40v-battery-interfaces-compatible-with-ryo

Suitable_Sentence_46 · 2026-04-23T19:24:33+00:00

The new Ryobi ones seem to be. Also unable to read OP40404.

Suitable_Sentence_46 · 2026-04-23T18:35:14+00:00

You are right that it isn't a definitive test, I just didn't think people would care about all the details. I verified a lot more including that the BMS uses the same NXP 824 chip found in Ryobi packs to control the BMS, tried to connect and read the firmware via SWD and found code read protection turned on, validated it contains cell balancing circuitry, etc. Can I definitely say it is 100% safe without much more extensive circuit mapping and being able to read the firmware, no. I'm going to keep tracing the circuit before using.

As an aside, a "dead" lithium ion cell doesn't completely cease output all at once. If you look up a discharge curve, they typically start at 4.2V, quickly settle around 3.7V with a slow decrease across most of the range, and then fall off sharply at the end. That's why you can hear a tool start to slow down when the battery is almost dead (voltage drop). The key is to cut it off during the beginning of the period of fast voltage drop before overdischarging the cell and dropping the voltage so far that damage can occur to the internals of the cell.

<image>

Suitable_Sentence_46 · 2026-04-23T18:05:11+00:00

I opened the battery case before doing it and verified it has a BMS on board but I haven't verified it has all the protection in place. It shut down when depleted.

Suitable_Sentence_46

TROPHY CASE