Creating a new battery using spoofed battery information

[r00li]

Hi! I see a lot of Aibos sold without any batteries and I was thinking instead of focusing on getting batteries re-filled it would be interesting to try and create a whole new battery pack.

For the initial test I am looking into using a 2S RC lipo pack and a simple BMS board for "ease of mind" and then using an arduino to "simulate" the real battery controller chip (if required).

What I am wondering is if you have any information if the robots actually need the battery to communicate in order to work, or if they only communicate with the battery during the charge process. And if you know that they communicate with the battery - do you know which information they actually request?

[lpollier]

Hi Andrej,

Recreating battery packs for Aibo is a good idea. But simulating the behavior of the bq2040 fuel gauge through an Arduino software seems tedious to me. In the end, you must recreate all the SBS charge control commands for Li-Ion that I think are needed to communicate with the Aibo for charging and functioning.

I would prefer to recreate PCBs whose main components are known to be available in specialist shops. This is why I made the reverse engineering schematic available: https://github.com/lpollier/battmon/blob/master/example/ERA-201B1_reverse_engineering_schematic.pdf

Anyway, I'd be curious to see if you have any working solution for that. Loic

[r00li]

I have a few supplies on the way and I will see what I can do.

My idea for the first iteration is to use an off the shelf BMS board that has battery protection and balancing support and use either a DIY pack or a pre-made RC model lipo pack. Then just use the arduino (or a custom PCB with one of the arduino compatible micros) to communicate with the dog so that it thinks it has a original battery in there. I would skip the charging bit for first iteration and just use an external balance charger instead. That way the "spoofing" circuit doesn't need to actually talk to the battery at all. Obviously that means that the dog won't know when the battery is empty and all that. But as a proof of concept that should be good enough.

Then with the next iteration comes integrating the two things together. These days battery management chips handle a lot more work than the old ones did so the circuit could be done simpler I hope.

I was just wondering if you ever sniffed what the aibo and the battery communicate while the aibo is running. Because I would expect that it isn't that much.

[lpollier]

Well, I did not spy on the SMBus link between the robot and the battery, but I am pretty sure that the robot's CPU communicates with the bq2040 at startup and then periodically, to know the state of charge or discharge, and so if he can get up or when it's time to sleep.

However, the Arduino program proposed here behaves like the robot's CPU commands set, but in manual mode. But if I understand correctly, what you want is the opposite, to run an Arduino program that behaves like the bq2040's responses to the CPU commands.

[r00li]

You are correct, yes. I want to respond to the "questions" from the dog like the real battery would.

I did some spying with a logic analyzer... it seems the communication is pretty straightforward.

Looking at the data the dog is polling the battery roughly every 500ms. Every time the communication goes something like this:

write to 0x0B ack data: 0x0A -> READ Current
read to 0x0B ack data: 0x00 0x00 -> RESPOND 0mA
write to 0x0B ack data: 0x10 -> READ FullChargeCapacity
read to 0x0B ack data: 0xFC 0x08 -> RESPOND 2300mAH
write to 0x0B ack data: 0x0D -> READ RelativeStateOfCharge
read to 0x0B ack data: 0x63 0x00 -> RESPOND 99%
write to 0x0B ack data: 0x0E -> READ AbsoluteStateOfCharge
read to 0x0B ack data: 0x63 0x00 -> RESPOND 99%
write to 0x0B ack data: 0x16 -> READ Battery Status
read to 0x0B ack data: 0xC0 0x00 -> ????
write to 0x0B ack data: 0x08 -> READ Temperature
read to 0x0B ack data: 0x82 0x0B -> RESPOND 294,6K (21.45°C)
write to 0x0B ack data: 0x09 -> READ Voltage
read to 0x0B ack data: 0x91 0x1D -> RESPOND 7.596V

READ -> Dog reading the battery RESPOND -> Battery returning the data

[r00li]

Hey @lpollier ... I have successfully made a replacement board using a new battery gauge for the 3xx/7 series Aibos. 2xx is next in line 😄 ... Many thanks for giving me the idea.

You can check the project here: https://github.com/r00li/Aibo-ERS-xxx-battery

[lpollier]

Hi Andrej,

Congratulations on the work done. I went to see the characteristics of the MAX17320 and since it is compatible with the SBS 1.1 management, it seems like a good job to me. Very interesting. Also, I have seen your work in progress in the robotchat discord group.

I would like to test one of these "spoofed" batteries since I will soon be finishing the tutorial allowing the replacement of the original batteries, while the most complicated part to repair is about the PCB rather than the Li-Ion cells.

I'm glad to see that you provided all your work on Github, fully open to other Aibo users like us.

In the end, I still plan to recreate a pseudo PCB layout clone from the original, just in case someone like me wants to recreate an old school PCB with deprecated components (which you can still find at aliexpress for example bq2040...).

Thank you for your feedback, I will not fail to point to your Github repo at the next release.

Cheers, Loic

[lpollier]

Also I hope you will provide a PCB for ERS-2xx Aibo's soon.

[r00li]

I went with the MAX simply because it was cheap, the most readily available and unlike Texas offerings a lot more integrated - needing less components and doing pretty much everything - protection, charge monitoring, balancing, ... All that you really need. Plus very configurable.

Yeah the 2xx shouldn't be much of a problem. I just want to ship the first few test samples to people first, get their feedback and see if I need to change something. After that is done it should be just a matter of moving the connector a bit - 2xx seems to have it a bit nearer the edges than 3xx.

[lpollier]

I see. He prides me on testing this PCB. I knew MAXIM well, just like TI, and I have nothing to say on the technical side that could incriminate them. So for me it's very good to switch to another ecosystem that works in the same conditions (generic or normative). Very happy you have accomplished your initial goal.

[lpollier]

Hi Andrej,

Any update from you on your project and an ERA-201B1 compatible PCB? I provided a link to your project, so I will close this issue. Do not hesitate to let us know the results of the tests you have carried out with the ERA-301B1/ERS-7Bx version.

[r00li]

Hi Andrej,

Any update from you on your project and an ERA-201B1 compatible PCB? I provided a link to your project, so I will close this issue. Do not hesitate to let us know the results of the tests you have carried out with the ERA-301B1/ERS-7Bx version.

Hey! I just tested the ERS-2xx version of my project today. So all of it should be on my github either today or tomorrow.

[lpollier]

Great. One day I will try to assemble one myself.