Let's take a look at the Audi Ferex dual voltage 20 volt, 40 volt Lithium power pack for power tools and this, well I'm glad it's reverse engineered. That was an absolute nightmare to reverse engineer because of the way the circuitry is configured, but it was interesting and as the pieces of the jigsaw fell into place, it all made sense. So here's the case. Uh, part of the case and there's what's inside the case.

It is two separate batteries composed of five 2500 milliamp hour 18650 sales and because of the number of because it's two batteries. they've effectively got the big contacts at the end for the main current takeoff. but they've also got the bridging contacts coming up to the voltage monitoring pins. So to get this circuit board off required.

Um, basically putting slight pressure on the corners and then just going around all the solder joints repeatedly easing off a bit of time. It took a lot to get that off, but it is off now and it is basically two separate batteries now. I've got the circuit board here, but I can show you a close-up picture of it I can show you the close-up picture of this side and I'll Zoom down in this. I'll cut straight to the chase here.

so I'll zoom in this a little bit, maybe not too much. Um, and for those of you with low patience, what I'll say is this: it contains to see most microcontrollers with a single analog to digital converter. or certainly it's only using one analog to digital converter and effectively it treats it as two separate battery packs. but there's a master processor that uses up to isolators to communicate backwards and forwards with the other processor, and each processor is powered by its own voltage regulator from its own battery.

but the master one as well is dealing with the communication. backs and forwards. Also deals with the two thermistors, which is odd because the top layer is one battery, the bottom layer is the other battery, so you'd think that one thermistor would be in top layer and one would be in the bottom, but in reality they're both on the top. I Think it's just because ultimately, in most applications, it's treated as just one battery, so one thermistor would have done uh, other things that uh, there's a fuse for each of the batteries and just loads and loads of 702 mosfets there uh, 2n7002 mosfets and a surface mount firm I believe, which is a small signal level mosfet.

but the main processor here deals with uh, the switcher of the thermistors. it doesn't monitor them directly and also communication via two pins. excuse me I'm belching because I've just had beer actually, but that's okay. one of them is used for ID and one of them is used for temperature.

but I say temperature. It's also used for data communication because if we take a look at this little module out of a 40 volt tool which basically connects the two batteries in series to create the 40 volts, it's actually has just one pin connected. it's marked NTC It's a whole lot more than that. so let's take a look at this.

The reason there's so many mosfets with identical circuitry is because this is part of the battery monitoring circuitry. It basically switches in one cell at a time, and both of these are doing it independently. It switches in one cell, the time measures the voltage across it, then Stacks in the next cell measures the voltage, cross deducts the first voltage to get its voltage, and it basically just scans all the cells. Quite an interesting thing.

The circuitry for that is super weird. Anything else worth mentioning in this? Uh, let me take a look at this again. This is the other side. Anything special? Not really.

There's the other regulator. I Think we'll just cut straight to the schematic. So let's start with the battery monitoring, which is super complex. This is going to be vertical because, uh, it just made sense to draw it vertically.

This is so strange. I'm not sure why they've done it. You feel free to chime in with ideas about this. so when the processor wants to check the voltage of the first cell, it takes a high and that turns on that mosfet and the voltage will then cause current flow through this resistor to a potential divider based on one Mega Ohm resistor and from there it has a tap off to the analog to digital converter.

and here's the odd thing: there is a pull down resistor to make sure these mosfets stay off. but every single one, well, not, they're well, they are. Every single one is different because technically speaking, when you apply a positive signal to activate this mosfet and measure the voltage, say across the first cell, some current will flow through this pull down resistor that's normally used to keep that mosfet turned off and it also contributes to the analog to digital converter voltage reading. So aside from that, I thought these were all going to be fairly standard values I Thought they were all going to be matched and it was all going to be done in software just looking at a high resolution analog to digital converter.

But it looks as though the values of all these resistors are different because it's doing its best to make the software easier by perhaps moving to nice round values in the analog to digital converter. That's the only reason I can think for this. Uh, very strange. There is also a one nanofired capacitor across the Gate of each just for presumably stability, and this is basically how it works.

It's basically looking at the first cell and it's saying the votes across that is 3.6 volts and then it looks at the next cell and says the voltage here is probably say 3.6 times 2 7.2 and it will say deduct the first 3.6 So this is also 3.6 and it basically scans along and as soon as one of them reaches say for instance, it's charging 4.2 volts or thereabouts, it will send a signal to the battery charger saying this particular battery bank is charged. Likewise, if it drops below 3 volts I'd guess it will send a signal to the power tool saying uh, stop because the battery is flat God that it didn't take long to describe it, took a long time to reverse engineer. Oh, did it take a long time I Also Drew this vertically. Maybe this was a bad idea.

No. I had to go back to this old circuit board. This is one from the Ryobi clone, which is ridiculous. It's got all that monitoring circuitry, a processor that has been lasered off so we can't see what it is, and it's also got the voltage sensing chips that do the balancing it.

They turn on another mosfet and it clamps the resistor across it so that when it's just trickle charging at the end, it can just even the cells up. The this version does not have that larger because that would be ridiculous. It'd be circuitry everywhere on it would be hideous. Uh, they later this off but they didn't measure it deep enough and it had very faint impression of the text I Put in zinc oxide, heatsink compounds, scrubbed it into it, cleaned it off, put a bit of tape on, really, pressed it on, peeled it off, and I Was able to read the number and the number of the processor was Mc95 FG 208r Um, that's not what's in this though and but it is along the same Lanes So each processor has a 5 volt regulator, an Af50b that connects to the 15 to 21 volt basically the positive end of the battery via 100 ohm resistor which is diffused probably and it's got a couple of decoupling capacitors and then it supplies the processor.

Uh, the positive goes to pin 9 of the processor. this could be a clue. the negative goes to pin seven and there is what appears to be a reset circuitry circuit here, which is useful to know because this may be a way of rebooting the pack which goes to pin four. Uh, this is a I think it's 20 pin.

hold on. Let me look at the bigger drawing that would make sense because then it can count pins better. Whatever. Um, 20 pin.

Yeah, it's a 20 pin chip. The numbers in the chip are Fmd B2B P E K H but on the other chip, the slave chip is B2B 7 Ekh and that makes me think well, those didn't come up on a search. so I'm guessing that those are Uh custom programmed microcontrollers supplied pre-programmed so the processor has the facility to monitor the battery voltages. It's ABCDE outputs that go to the previously shown mosfets gets the signal back.

The other end of the potential divider is a one Meg Ohm resistor. Did I draw that correctly? Another page hold on. Yes, I did. Yes, that's good.

So it scans looking for those voltages. It also interrogates the other processor by using a 1K resistor in series the LED of an up twice later and it's got one of its pins with internal peel up just pulled straight to the zero volt rail by another up twice later so that each process has its own optimized later for controlling the Op to isolate to the LED and also receiving the data back through the photo transistor for the output pins. This is where it all gets hideous. The ID is fairly straightforward.

It controls the mosfet that just switches 100 ohm resistor I'm guessing maybe it just sends data through that. Not sure. But the really complex bit is the NTC bit the temperature sensing bit. Because this processor can switch either of the NTC thermistors in their standard 10K NDC thermistors I shall write that next to them 10K What that means is that typically at room temperature, there are about 10 000 ohms resistance.

There's no fancy cooldowns in these mosfets because it's less critical. The process will go to zero volt and output which turn them off and it will go to plus 5 volts to turn them on. But as well as being able to alternate between the two thermistors, it can also enable this which has a 750k resistor on the output. but also it's got a tap off that via another 750k super low currents here, which is partially used for data back from the tool that's plugged into.

So this NTC this temperature connection may be bi-directional communication as well. Uh, the two and I made a mass of a previous video. Where is that circuit board wherever I put that circuit board I had it and now it's gone. Anyway, there is the other tool.

I made a mistake in the circuit diagram. the other one I showed the input from the NDC as being pulled to the zero volt rail by a 10K resistor. In reality, it's built to the positive rail by a 10K resistor. Which makes sense because presumably this is going to say I don't know if it just alternates between the two thermistors and then the processor in the tool itself.

The power tool actually detects those two levels and all it's looking for is one because this will perform potential divide to the 10K thermistor reference to the common zero volt reel that is used by the power tool as well. Uh, it will see a potential divider with that 10 key resistor and then the thermistor. so it will see all possibly alternating values of the thermistors and it will be able to detect if it's overheating. But it could also potentially see a slight Jitter on the analog digital converter through this.

and it's possible that the processor might even be saying you know this is Thermistor a the sister Mr B And uh, this is the battery status and it might actually be communicating that data. It could be quite complex, or it could be quite simple without getting Scopes and analyzing data that just gets a wee bit too complex. For this project, it would be hard to say, and there's no point anyway, because ultimately, what you're going to do, these are custom program processors. All the software is tucked inside, which kind of spoils it for reverse engineering the final bit of the puzzle.

Oh, let's talk about that reset there, right? Okay, there is a little. Let me grab the drawing again. There is Where is it. It's in the vicinity of the voltage regulator each time, but there is a reset network on each of those components.

There's one, and there's one. If you wanted to force a reset on the processor, just put it in the battery pack. at the laptop, you would just bridge over this capacitor with a pair of tweezers. or this could pass to pair tweezers.

but keeping in mind that is actually on top of the circuit board. I Wonder if that's why they've been partly brought out to these pins? because that will let you do a first reset. If you could find which pin I think it's probably that one that these are connected to. It's possible that by bridging two pins in these connectors, you'll be able to force each processor to reset.

The other option is, unfortunately, quite valid. It's to bridge the supply capacitor, but I'm not sure what the regulator is going to make of that or that 100 ohm resistor. It could be quite grim that would be. So the reset is to bridge this capacitor here because I'm pretty sure that's a reset.

If it's not, then bridging this here will definitely reset it. but the little regulator may have a horrible moment when it sees huge current flow. Hopefully it will detect that and do a controlled thing and just basically allow it. Who knows, but that would reset the processor.

A bit uncomfortable with use of processors or battery voltage monitoring, because technically speaking of the crash, you lose your battery voltage monitoring. But maybe the charger is also using these pins to actually communicate. I'll just I'll use tweezers as a pointer and maybe the uh, battery charger is saying, well, there's no communication. Let's just abort this charging process because, well, obviously the processors have failed.

Maybe it's doing an audit on both processors and sending a similar to this one which then says yeah, I'm okay and I've communicated the other one and it's okay because otherwise you'd lose control over charging. But as long as the charger doesn't go above, say the potential upper voltage. uh, what is that that is? Five cells that could charge up to 4.2 volts probably written it with 21 volts. I Have written it.

Uh, as long as it doesn't go much above that, even with a slight sell imbalance, you're not going to get anything dramatically over charging. So the final bit of them stormed is this horrible little voltage level indicator. This is your battery monitor I Thought it was going to be something fancy. it's really not.

This is horizontal. let's zoom up. We have the plus: it's on the battery and it's just monitoring one of the battery packs and we have the minus: There's a little button there and when you press it, the lowest one will always like because it is just an LED in series. the resistor of it doesn't light.

It's really bad news. It means that the battery is at below about two volts, which wouldn't be good for a battery like that. The minimum voltage should be about 15-ish bolts, but the other one has a the 50 LED has a resistor and a Zener diode. WJR should have looked up to see what the voltage was and the other one is a slight load increase with a LED uh, a 1K resistor.

possibly just to increase the sharpness of the spectrum transition. but that's also got the WK Zener Diode. so these are just two voltage thresholds that will determine when you press the button how many of the LEDs will light up, so it only lights up when it's pretty full for this one, but if it's getting low, it'll be just this one. It wouldn't have enough voltage to make this one light up.

It won't exceed the Zener diode voltage and it when it gets even lower, it will go below this. you know voltage and then it will just be the lowest one. and uh, that will show you that it's time to recharge the battery pack and that is it. There is nothing more to say other than just to casually slip in.

Just how hellish that was to reverse engineer, but very interesting nonetheless. I Had a feeling it may be treating it as two separate batteries, but the Op twice liters were an unexpected communication that did answer that question. I had how did does it monitor that? How does it deal with it And the answer is with one processor reference to the common zero volt rail that's used by. well, that's the common zero for 20 volts and uh, 40 volts.

So it's the common to the power tool zero volt rail as well. And it's the common for the soccer train here as well. I spat my finger there. sorry about that and uh, this processor because it's the main base one on that zero vote rail does all the thermistors and communication and stuff like that and that is it.

So there we go. I do have another tool on order a faulty one which is good. Um, so once it arrives, it's the 20 volt tool. Um, it's I've been told it's a drill that can take this battery but operates at 20 volts and I've been told that uh, when you pull the trigger it runs okay, but when you get it low, there's a bit of a loud clack inside which actually sounds like some tools do normally.

Um, so once I get it. if it is fault, you're not sure if it will be faulty or not the circuitry is going to be I'm going to take the suction. We can analyze it for the 24 version to see if it just just does, slam them in parallel or just use one section. I'll also analyze it to see what actually went wrong.

but uh, that is it. So think the next in this uh, I was going to say Trilogy it's quadrilla. It's going to be a quint. Trilogy I think the next one is the charger that deals with the charging of the two batteries independently.

so that should be interesting and that's what I'm going to work on next.