[004] Reverse-engineering the Milwaukee M18 Redlink Protocol
ฝัง
- เผยแพร่เมื่อ 25 ก.ย. 2024
- Support my work on Patreon to see videos early and see extra information:
/ toolscientist
Milwaukee M18 batteries and chargers communicate via digital signals, which Milwaukee calls Redlink Intelligence. A USB logic analyser, some leads, and a few resistors is all you need to listen in on these signals. I tested 2 chargers and several batteries and listed my best interpretation of what the messages mean and what each byte in the messages means.
There's still a few parts that I'm unsure of or have no idea of their meaning. It'd be great if others can follow my guide and record the signals of their batteries and chargers to see if they can uncover any new information.
This video owes a lot to Buy It Fix It who solved a lot of the basics of the protocol and definitely saved me a lot of time. They don't have a video on this topic, but they've got lots of repair videos on their channel, so go check them out: / buyitfixit
REFERENCES:
Buy It Fix It (Reddit post): / m18_fuel_battery_protocol
Quagmire Repair: quagmirerepair...
CREDITS:
Matrix Raining Code: • The Matrix Raining Gre...
Explosion: • Explosion croma key gr...
![[005] How M18 batteries communicate with tools](/img/n.gif)
The World Needs more of this sort of reverse engineering
Yes but what it needs even more is right to repair so that this level of documentation is provided by the manufacturer as per regulations
@@benargee Unfortunately manufacturers are less willing to help. I had the same with FLIR when trying to repair one of their thermal cameras, and the same with another company when I repaired a Solar inverter and needed a service password. Good job I've been reverse engineering stuff for years. So I looked at their software and wrote my own password generator for the inverters. The M18 comms stuff I did a few months back, it was nice to get a mention :)
With like 80% less gross sexist humor.
@@BuyitFixitHence why the right to repair movement is trying to get through the red tape with the governmental agencies. Trying to make them create an easy to self-repair instead of replace the products or make them take it to the dealer/manufacturer to do anything simple or do a 'programming thing' to reset the part so it works again. Like John Deere does with their tractors when you replace something. You have to bring the entire machine to the dealership so they can use their software tool to tell the new part that it is okay to work with that tractor.
@@ryanohoro3764 nope, not at all. We need exactly that. If you dont like it, dont listen.
TH-cam recommended me your video. Loved the way you made it funny and simplified it in a way anyone could understand. 👍
Thanks, mate. It's definitely hard to make an interesting video about digital signals. Ultimately you end up just looking at 1s and 0s.
Well, probably anybody who's an electrical engineer, not just _anybody._
But yes, I found his metaphors quite humorous -at least the ones i understood.-
all the various pointy things was interesting as well :) @@toolscientist
@@Palmit_ thank you! I spent way too long getting that blue-screen effect to work and you're the only one that's noticed.
I also noticed!
This is phenomenal. I also have no doubts you are the guy to solve the historical “how to run Milwaukee battery tools on AC power” question.
Not too complicated I got it working in the shop a year ago. If I roughly try to remember you have to send 5V to either J1 or J2 pin. Can't remember which. Even 1V was enough if I remember correctly. Then the tool will accept current via the Power and Ground pins. I powered a whole bunch of Milwaukee tools like this using a lab bench power supply. Just make sure your wires are beefy because you're dealing with a lot of current. Having said that, I am looking forward to the next video in case there's some current throttling happening without explicitly communicating through uart.
@@renegaed From my testing and reverse engineering of this a few months back the only communications I saw were between the charger and the battery. I didn't see any data between any of the tools I tested and the battery. The tools seem to measure the pack voltage via a potential divider, and I think they possibly measure the pack temperature (which I think could be your 1v you mentioned)
@@BuyitFixit very interesting, thanks for sharing
I just converted a milwaukee 18v vacuum to run on my Bosch batteries. I put in the Bosch mount for their 18v battery and can now vacuum using my plethora of bosch stuff. Worked good for me. Got a good deal on the vacuum but did not want to invest in their batteries or chargers. Next step is to put 18v mount on my Pyle Speaker/mp3 player (big pyle 10in woofer compression driver pro speaker) so that I can play it out where there is not power. Going to put two mounts on it for capacity and run two 8ah or 12ah bosch batteries on it. Do you think anyone would be interested how its done using Bosch Milwaukee or Makita batteries? There are some points to keep in mind.
@@KlodFatherYep I run the framing nailer, inverter, and backpack vac off an adapted Makita battery without issue.
TH-cam may finally be learning what kind of videos I really would love to watch.. This is golden, specially the verbose messages, imagine seeing that in a datasheet 🤔😅
Oh TH-cam is way better than that it literally updates me on new DIY 3D printer designs with like only 800 views and me not having to search anything in a topic I am super interested in since it was on a front page
@@cybyrd9615 yt has really had its finger on the pulse recently ngl (at least for our algos)
As someone who has had to reverse engineer the BIOS flash procedure on a laptop I highly appreciate your work. I HATE proprietary crap, vendor lock-in and vendor lock-out.
As someone who's not an electronics expert, this whole concept absolutely amazes me. Just the idea of how you can make 2 simple devices "talk" to each other and communicate information in a way in which they both reliably understand without needing a bunch of extra expensive components. I'm just now getting into Arduino and learning how to write code to control it, but getting devices to do this simply with a few pennies worth of extra components (and without requiring an Arduino or similar) just amazes me.
if you're interested in these kind of subject. search up an "embedded system" course. most Arduino tutorial are basic and won't give you the low-level explanation you need.
Ben Eater's videos are fantastic if you want to learn how digital electronics works in a from-first-principles kinda way
Keep in mind that a lot of these devices use a microcontroller, so they're basically just an purpose-built Arduino... (The Quagmire Repair link documents it as having a TI microcontroller and battery monitor IC)
The real sad thing is that they could've just put the logic like the battery monitor into the charger and done away with this whole thing...
@@JohnRunyon It's to try to justify proprietary tool batteries.
I mean he did use a laptop, which is a vastly more powerful computer than an Arduino.
As someone who has carried out similar work between ECU's in a car and a diagnostic machine, this video was amazing. :)
now you sound like you could make very interesting videos. always curious about how ecu works in cars
@@lordjaashinwell most cars at least have a factory service manual that helps you narrow down how it’s communication works from system to system.
Although it doesn’t tell you what that data looks like, you’d need to intercept and start playing with values on the ECU and see what they do.
It would be really cool to see it in this type of format though.
Great work on preserving the Milwaukee battery culture!
lol
As someone who's worked on his M18 batteries (manually rebalancing by charging / testing individual cell rails), this is fascinating and much appreciated. I have a USB logic analyzer in one of the tool drawers of my bench that I haven't put to use yet, and you're making me want to break it out. Great stuff, thank you.
Great video! I know the MX Fuel line costs a lot more and isn't as popular, but if anyone wanted to poke around at the comms, I toured Milwaukee's headquarters right after the product released and they said it used RS-485 communication
Interesting! I'd have to be a lot more careful when poking around an 80V MAX pack, though!
Awesome to see how this works!
The crazy part is there are companies who make aftermarket/copy parts (especially in China) that have people with tons of reverse-engineering experience who often figure out this kind of stuff before most people have a chance to shop for one 😂
Nice to see the secrets shared instead of found and kept!
I always assumed they didn't reverse engineer it but had back door access to the genuine factories in china to quietly steal all the technical data.
00:28 I shared them a few months back 😂😂
My dad will die on the hill that 'china has horrible engineers'. As an engineer, I hopelessly try to explain to him that China has the best engineers at what they do. Want performance? German. Want reliability? Japanese. Want reverse engineering and/or cheapest manufacturing? Chinese.
@@weemackee performance ? Tell me you've never worked with German engineers without telling me you've never worked with German engineers.
@@Hepad_ He means product output performance, not engineering process efficiency.
Nicely done, and presented in a professional, and fun way...not to much "overhead", good stuff (from a guy with about 20 years FAE/AE experience with Tek, Agilent, Motorola, and R&S)
Pls do more reverse engineering videos like this. This is 10/10 content
Same! Love this shit.
I noticed your other videos didn't have as many views as this one so I'm glad the algorithm might've blessed you. Need more videos like this on TH-cam as a a Milwaukee user so please keep doing what you're doing. Subscribed
Definitely got blessed. I had 101 subscribers before releasing this vid, and my other vids were only 1k, 2.3k, and 1.7k.
just dont get spooked or feel pressured to produce more content mate, keep a finger on yer pulse
@@toolscientist I think your format is very good, snappy, to the point, dense with humour but the humour does not obscure the information. I also think the presentation of the video, visuals + your voiceover are excellent.
explained like an expert talking to a room of children, funny throughout, i have no interest in milwauke stuff but i like low level comms like this, youve earned a sub and a regular viewer for your comedic explanations, keep smiling n keep making us laugh
I want MORE digital signal analysis. The mating ritual was riveting!
That's surprisingly different to DeWalt's way of doing thing. There's mostly no electronics in the battery, but there's more pins, so the charger can monitor and balance individual cells, monitor the temperature, etc. all by itself. The way to differentiate batteries (High output or not) is a simple resistor installed between an additional pin and the 0V pin.
Yeah, the Dewalt's are admirable for their simplicity.
That's M12. Thermistor, balancing wires, done.
Sweet Jeebus, where did all you tool nerds come from? There's probably less than 1,000 people who need to know this protocol, so I assume the rest of you are just here to gawk at Milwaukee's innards. I'm trying to reply to all your questions but I'm going to have to stop soon - so far you've all given me about 5 years and $100,000 worth of experiments to do!
Just kidding. Thanks for all the support. Each of my videos has at least 100 hours of work behind it, so it's quite rewarding to go from getting 2k views/month to 4k views/hour. I was worried that my 100 subscribers wouldn't be interested in a video about digital signals and barely limp past 1,000 views, but you've proved me wrong. Thank you!
The magic of ✨the algorithm✨
The best ! Best explanation of logic analyser data in history !! Well done ! Very educationally entertaining
This is amazing! Hope you get enough support to do this for a Makita battery!
I'd hope this video blows up, really good content and also well explained. 100% subscribing
Thanks mate. Appreciate it.
Would be cool to see videos like this with other manufacturers
Definitely. I'd love to compare them all, but it'll take some time. For every vid I get out, my todo list grows by another 10 items!
Nicely done and presented with humor. Take on HP printer cartridges (and Brady industrial Label machines) next. You will be a hero :)
Cool video. I'm a computer guy but it makes me start holding my head when I see TX and RX signals for a battery charger. All it takes is a simple "are you within the warranty period" check and then it makes the battery do something sneaky like blow internal fuses in the microcontroller.
I've often thought about that. It would be a very risky move. Big class action if you were caught, and alienating a lot of your loyal customers. Difficult to get caught if you hide it well enough, but only takes one disgruntled employee to expose you.
There's no reason this can't be done internally, unless you want the "failure" to be contagious. I know EGO batteries already have an RTC in them so they can self discharge for storage.
Cool video.
Thinking you might be able to revive the dead battery if your able to dump the eeprom on a good one and flash to bad one - there might be a lockout condition if the controller detects missing balance rail
I'm a dewalt household, but TH-cam recommended this to me, and I thoroughly enjoyed it. Great stuff!
Excellent work. I have attempted years ago to learn more about the EGO 56V BMS Communications. I can't seem to get motivated enough to go much further or buy better equipment just to look deeper. I like the look into the M18 communication. It will be very interesting to see how it communicates with the tools and how the aftermarket packs differ or if even at all. Just like the EGO aftermarket packs, I assume they have to be very close to the same if they play well with the brand's real tools and chargers. Thanks for all the effort you put into this to share it. It was a huge effort I can tell.
I didn't put it in this video to avoid going off on tangents, but there's an older and simpler protocol that the charger can fall back to. Older batteries (mine are Dec 2013) communicate with a very basic system of pulses. From memory it's something like 2 pulses from the charger to initiate charging, and then battery holds high until it wants to stop. Charging current is much lower, I think around 1A. So some of the aftermarkets are probably using this simpler communication. You'd be able to tell which ones use the full protocol and which ones the older protocol by their charging speed.
Yeah, it was a big one! My files say I started in late July. Took me a week to get reliable data capture as it was my first time using a logic analyser and I initially thought I had a dud. Fortunately Buy It Fix It's work let me know that it was possible and had enough info for me to figure out the necessary resistor setup
@@toolscientist No doubt it took a lot of time. When you have months of footage to go back through for me it gets very tough keeping up with what I did record and what I meant to record later...
Especially if I let one or 2 projects sit waiting on parts or waiting on cells in a storage test to see how they fare after a month or so.
100%. I think someone needs to hire us some research assistants 😄
@@toolscientist for real! 🤣
The algorithm gods blessed me with a genuinely interesting and unique channel.
Well researched and presented. It's refreshing to see reverse engineering on YT done so scientifically and with real thought put into it.
Unlike certain "other" high profile 'tear-down & schematic' channels that have a million subscribers wildly guessing how they think something works.
Oh don't worry, I do a LOT of wild guessing. I just edit out the 5 hours of me being completely wrong. Then the 2min that's left makes it look like I know what I'm talking about 😉
@@toolscientist Much like actual science is
TH-cam algorithm correctly identifying and serving up quality content
TH-cam randomly recomended this to me, and I'm glad it did. Loved this video and subscribed to the channel.
Instant sub for an Aussie nerd channel. I love how manufacturers add a microcontroller and basic UART communication to something and then decide it's so revolutionary that it needs some kind of fancy name.
I do like Milwaukee, but their marketing is Apple levels of calling everything revolutionary and magic.
Randomly got this recommended. Great content, got yourself a subscriber. Looking forward to see your channel grow.
After doing some deep dives on TLV message exchanges for work, this was an excellent video to see. THERE ARE WORSE MESSAGE EXCHANGES!
Completely unexpected recommendation by TH-cam, looking forward to more content, thank you!
Those basic logic analysers are an indispensable tool, the number of capabilities you get for the money is incredible
Indeed, though these cheap ones do not have the slightest bit of input protection. Probing with a scope prior to using them is advised.
Reverse engineering protocols is fun! Once upon a time I reverse engineered the image feed off one of the AUSSAT satellites... so we could put it on to microfiche. The 1990s was a weird time.
This was super interesting. I'd like to replicate this with my AEG battery to see how it communicates with its charger. I have tried to charge it with a lab power supply and it went into protection mode so I think there must be a similar handshake happening.
It would be cool if theyre sharing the same tech being both TTI companies
Definitely give it a crack, I'd be interested to hear what it's like. Apparently Milwaukee operates fairly independently, so my guess is that they more likely copied Ryobi 40V. You can find a thread on diyelectriccar where someone posts some data from Ryobi 40V
@@toolscientist this is kinda correct. Milwaukee works with Empire level and Imperial Blade, Stilleto Hammers, Kango Blades. With most of this design work is done in Milwaukee, WI.
But is largely independent of Rigid, Aeg, Ryobi, Hart or any of the vacuum brands. Most of this is done in North/South carolina
Poor Muriel. Forever shamed on the fridge.
And nice work on the battery protocol. :)
"The charger gets frustrated and goes home." I cried 😂
This is really incredible. You never know how deep the rabbit hole of a specific technology goes.. until you watch a video like this!
SUPER interested on how they communicate with the tools. I would love to make my dewalt 60v blower have a DIY backpack mounted battery.
The DeWalt batteries are essentially dumb batteries which expose all the individual series cell voltages, and a resistor to indicate capacity.
The flex volt batteries, iirc from an Internet post, are the same unless an electrical jumper is made, and a special physical connector switched it to 60v mode.
@@cculpepper1Right, one reason is to help with air transport. In 60V mode the battery is too big to air transport IIRC.
God, TH-cam is great for stuff like this. What a world we live in nowadays where shared information helps society as a whole
Alright now this is the type of content I’ve been looking for 👀 saving it to my favorites
Wow, TH-cam just recommended the type of content I really used to like. + Your video is simple enough that almost anyone can understand, good job.
That's some awesome work. I recently started analyzing the protocol of the Metabo CAS batteries. It's a bit more annoying since they use a bidirectional single wire UART, but I got to sniff a few charging cycles of different (18V only) batteries. I identified 12 different messages, but am currently at a loss of how to continue.
The data does not change during the whole charging progress. There are multiple values that get queried, but except for some that seem to correlate to the design-capacity and a kind of repeated status query (that has a different value across all tested batteries but never changes for a battery) there seems to be absolutely nothing meaningful in there.
Are you doing a full charge sequence? When the M18 batteries are full, it just does queries to check that its ok. When they're in CC mode, all messages are just asking for 6A. To see changing data you need to be in CV mode.
I think Makita does current request via an analog pin, so maybe Metabo is doing similar. Check for another pin where the voltage slowly changes during CV phase. If this is the case, then data will simply be "R U OK", followed by "Yes, I'm ok". You can try heating the battery up to induce change, but this could be damaging. If you can find the thermistor, you might be able to short it with a resistor to trick it into overheat detection. I used a 4.7k resistor for my tests, but you might need different.
@@toolscientist @toolscientist I recorded the whole process from a partially charged battery until it was full. After the initial query of some data values it's just an infinite repeating of the same two queries (one of which seems to be a ping with no data) with no changes in answers every second.
The battery has 5 contacts: GND, V+, NTC+, NTC- and Data. It seems like the charger handles all of the work as if the battery has no brain at all. The only meabingful looking data gets read once at the start and has some fields that could indicate the capabilities of the pack.
I'll need to run another test with a completely empty pack and maybe need to find some with other voltages.
Hm. Maybe I should try if the charger still works after blocking the data connection.
@@The_M1k3y only just saw this as it was marked as spam - maybe don't do the double @. Yeah, sounds weird. If you've got a clamp meter (or multimeter with high enough amp rating) then measure the charging current and voltage. Film it and try and identify the CC/CV/full phases in your vid and data. Maybe there's some sort of double ping for CV and full? There's another commenter in here that had worked on Metabo and said "...uses half-duplex UART at 2400 and it was enough to hardcode response to make it work." Maybe it's a dumb handshake with no info and the CC/CV stuff is handled by analogue pins? You should be able to find that comment and you could ask them.
You demonstrated that electronics and their protocols are explainable to non-technical individuals, kudos for that!
That battery that you dreamed toast, try putting 18v from another battery to the + and - pins. Had that same error come up on batteries people had thrown out. The batteries that I did this with came alive and was accepted by the charger again. I think something on the BMS sets a byte when the voltage goes under a threshold and the 05 get sent to the charger so it don't try to charge a broken cell. The batteries I have done this with is is all original Milwaukee and the types was the 2x M18 2.0A, 1x M18 4.0A and 2x M18 8.0A.
Maybe. I would have thought the charger would give flashing green and red lights for that, though. I think I damaged something when desoldering. Possibly the thermistor and 05 means undertemp. If I get the time I might try and investigate. I have 17 other batteries, and this one was pretty old and beat up, so it's a low priority.
Much safer to disassemble the pack and use a standard 18650 charger to charge one bank of cells at a time. You can use a multimeter to find the bank that reads low voltage (
@@bnasty267 I did exactly that and when it read approx 18v total on the battery outs (+/-) I tried putting it into a tool first, where it worked then put the battery into the charger (original Milwaukee charger non-rapid charge) and it gave the broken battery code with the read and green blinking. I googled the problem and saw a video where the guy said that he had "kickstartet" his faulty batteries by putting 18v onto the output terminals. I did that with another battery just for 10 sec or something like that and measured the voltage on the cells and on the board. Nothing changed but when I plugged it into the charger it didn't give the faulty lights and it began to charge. That was my first revival and that battery still goes strong after 3 years. But yes be careful, a damaged cells is nothing to take lightly.
Great content, thanks. I hadn't even considered that a battery power tool would do anything other than +, - and over temperature.
You just gained a subscriber.
This is quality content. Thanks for sharing this.
This is genuinely some of the best content in the history of humanity
This is great information it would definitely help in my idea of creating a powerwall based off of the M18 batteries.
Yeah, the interesting thing was that the battery doesn't react to not receiving it's desired current. So you could have a battery getting charged and pull current from it at the same time. The downside is you'll lose low-voltage cutout, but you can detect it as the battery reduces its current request to 300mA (0x012C) whenever any cell goes below 3V.
@toolscientist thank you for the further insight. I might not have your skills, yet, so I hope to learn more from your content.
TH-cam suggested your video. Sub hands down. Your clear appreciation of tech mixed with stellar humor is unique and refreshing. Please keep doing this content. Seriously.
Just subbed great video I do my part for the m18 anti extinction program by performing surgery on them
Hey doc! I've seen a few of your vids, keep up the good work.
@@toolscientist you too sir your channel is cool
Very interesting. The TH-cam algorithm is a fickle mistress, isn’t it? Glad it sent me your way. Subbed and good luck with your channel!
This is phenomenal information and the delivery is spot on.
Great video dude. Keep it up. P.S. I'm stealing all of this 😂
Intellectual theft is the foundation of civilisation, so go nuts! Tools & Stuff turning into an electronics channel would be an unexpected twist, although I really liked your explanation of tabless cells.
Out of curiosity, where did you find this vid? YT seems to be pushing it to SE Asian repair channels and DIY Solar channels, but I guess that's what YT does when you're new.
@@toolscientist Don't worry, I haven't the patience to do electronics reviews. I got a push notification on my phone, but that is likely because I was already subscribed 😉
Hope you give me a mention too then 😂😂😂😂
Why did I decide to watch this? I have no idea. Is this the funniest Milwaukee battery-related video I have ever watched? Most definitely. 😌
I have a pretty good understanding of battery charging, but this communication stuff is beyond me. I did pick up that the charger has a constant voltage section at the end of the charge profile. That's good to know and I had had missed that in past M18 videos. Any idea if that 600mA termination the same in the standard, rapid and super chargers?
Well put together video. Thanks!
CC-CV is the standard Lithium Ion charging protocol. Constant current until the target voltage is reached then constant voltage until whatever termination current is set.
I don't have standard charger. Samsung datasheet says 10% termination current, and rapid charger follows that. So standard charger is most likely 300mA
@@toolscientist My understanding, the 3 chargers are 3A, 6A, and 12A respectfully. Likely following the same profiles.
Great methodology, and entertaining video. Glad you happened to come up in my suggestions!
BRO YES. This is EXACTLY what I’ve wanted to see for ages now. I’ve always wanted to get a glimpse at the communication between Milwaukee batteries and the charger since the milwaukees batteries have the BMS on board unlike dewalt etc. with that being said, because what you’re doing is above my skill level, is there anyway that you could see, to trick an m18 charger to give me the raw charging output? I’ve got some projects where I’m building 18v packs with a common BMS that chargers simply through the output. Would love to trick my m18 charger to simply run a + and - wire out kind of like a wall wart. Only reason I want to do this is to take advantage of the high current output of these chargers. 3A charges quick. Any insight would be greatly appreciated.
ALSO, a project I’ve wanted to make was creating my own “forge” battery from an old pack, curious about the behavior of the board completely disconnected from cells then reintroduced to a fresh “pack” and if this would have any cause/effect on the microcontroller. Also just watched your video on the over discharging 18650 packs. It seems if I wanted to make a lipo pack for safety it looks like the high output boards would be ideal given the 2.5v cutout. Also using the OEM board itself would be nice I’m assuming to retain the better protection functions rather than an aftermarket board.
Maybe. I have found an older and simpler protocol that just uses high/low voltages. However, this only gives a low charging current - I think 1A. To get the full 6A, you'll need to make a microcontroller and program it to mimic this message sequence. It still may not work, as the charger has some extra error detection in it. For example, when I used thin leads for the main current path, the charger seemed to notice the extra resistance. It would ramp the current up to around 400mA, then stop, then ramp up again, and stop. It repeated this about 3-4 times before giving the red/green error. Communication was working fine, it just sensed the extra resistance.
I wrote some Arduino code a few months back that let's you talk to the battery.
@@toolscientist very interesting. Would love to see if I could get a full 3-6a out at some point. You’re the man. Loving the videos. Will be keeping up with all of them.
@@BuyitFixit would it allow for full output current?
@@mrb3888 The batteries I've looked at the cells are connected directly to the output terminals. The low voltage disconnect is handled in the tool. The circuit in the battery just handles the charging, not the output.
All my life I thought engineers were like smart and knew what they were doing. Thanks to videos like this, I know that may products are just cludged together in any hacked way that makes them work, with little thought to making it elegant.
the cloud is also like that but it costs you ten grand if you fuck up
This is sick! Now we're just need this in API or library format
TH-cam brought me here! Was happy to find someone else who sees a communication port on a tool or device and just has to hook up a logic analyser to find out what its sending, great video! Subscribed and looking forward to the video on the battery-tool communication.
I don't think there is any tool communication that I could find with the tools I tested. I documented most of this on Reddit a few months back but then got distracted reverse engineering teddy ruxpin 😂😂
really cool demonstration of revere engineering in addition to the very valueble data someone out there will need.
Haha, I'm sure someone will need it...right? I guess making a custom charger would be somewhat useful if you wanted to slow charge. Unfortunately it doesn't communicate cell voltages as that would be useful for making a charger that only charged to 4V or 4.1V to increase longevity.
Dang Mate, you hit that algo! I can remember wayyy back (like a week or so) it was just an exclusive club of a few hundred or so subs . Now the cat's out of the bag. There are many tool/battery nerds interested in this line of inquiry ...look forward to more
I'd just ticked over 100 subs the day before I posted this. Only had about 6k views and 20 different commenters across all my vids. It's a shame I can't give you some kind of flair to say that you were here before it was cool. Thanks for being there!
We know who we are. Have you checked into the M12 charging side of things? Looks maybe simpler , like straight balance charge of the 3 banks
@earl3358 M12 is mostly analogue thermistor and balance pins. Newer M12 have an IC, but it's hidden under a PCB. It has Vcc, GND, CLK, DATA, and RST pins exposed, so I could tap into i2c if I knew the chip. Might have to desolder it. My best guess is there's something on there to isolate the charging pins to prevent them shorting, or maybe something that shorts the thermistor if it detects a fault.
Meteoric Rise to 10k
@earl3358 aye, lots of pressure to keep the quality up on the next vid.
Just thought i'd share a recent experience and thoughts on this great work! I have a fair amount of M12 and M18 gear, I have the multi-port 12/18v charger (essentially three single-port 12/18v fast chargers in one unit), single-port12/18v fast chargers and a 12v only dedicated charger. Recently I've had the dreaded christmas tree fault code with a freshly drained 12v 6ah battery, and one 'long time no use' 12v 3ah battery. Low lifetime cycles on both batteries. Not abused. They look and are essentially new, but with around 4 years of intermittent use. All of my 12/18v chargers faulted out to the red/green flashing lights with the batteries on charge. Multiple attempts were made. Battery temperatures were changed/played with. No luck. I played around with leaving them on the charger in fault mode, putting them in tools etc. and eventually got them to kick into charge mode. (Note: they were not below threshold voltages) So all good right? Unfortunately after another fresh discharge they have faulted again. These are not the first M12 batteries I have lost to this issue - though in the past I have just forced the issue with the dealer for replacement. This time they are too old I would think. The twist is that they are charging fine on the dedicated 12v fast charger, which makes me think that the M12 batteries have a comms issue / tolerance / firmware issue with the multivoltage chargers - something maybe overlooked in the design or relationship with these chargers? It would be great to see hand held analyser released oneday, sitting between the battery and tool or battery and the charger with a readout of what was going on...allowing the consumer to know the fault, and have a robust conversation with dealer/milwaukee ensuring that batteries are not just junked due to over zealous product management protocols, design errors, production errors or dare I say it planned obsolescence. Not that I think that is Milwaukee's game here, but there are $ made in batteries.
M12 batteries are entirely analogue and don't have any digital communication. The charger has access to all the cells for balancing and monitoring through the C1, C2 and Th pins. It could be that the contacts on your charger need cleaning? Maybe one of your chargers is fussier in terms of measured cell resistance or imbalance.
Love the mating rituals of electronics. I'll probably never touch a Milwaukee battery in my life but it was interesting watching your process.
The different “pointers” every few frames has got to be the funniest thing I’ve seen done in a long time.
Don't know if I can do it again. That green-screening took too long and my lighting isn't great so I got lots of artifacts.
thx for research and good data vis. when i last priced one, standalone logic analyzers were five figures. awesome to see them in reach of hobbyists
Just reading the title of this video i subscribed, need more people like you 🖤
You've found a great niche. Very interesting channel...
This was hilarious. Loved all your names for the handshakes 😂
First video I've watched and I'm loving the narration. :)
This seems to be the most interesting Discovery channel out there!
If only I could do a decent Attenborough impersonation
Love that this was suggested for me, I'll be checking out the rest of your stuff!
Having the Bosch E-Bike batteries reverse engineered like this would be amazing...
knowledge is power!!! love seeing this side of common items
I found a Miluwaukee M18 5 Ah battery in a trashed battery pile, and I charge it with a benchtop DC supply and lot of courage ! 😆
But this was simultaneously a very technical and hilarious video 😂😂Subscribed
Lovely , reminds me of the festo valve protocol I decoded for arduino. But I had very good documentation online from festo with the protocol. Looks a fascinatong project
I got recommended you and you now have a new subscriber ♥️ scratches my curiosity itch thank you
Just found your channel. I really enjoyed your video and subbed. I'm not smart enough to help you in investigating the RedLink protocol, I'm more of the hand-you-the-tools and find-you-the-correct-resistor type of guy, but everyone has their level. I will keep watching though. Thanks.
Man I haven’t gone through most of this since college for my IT administrator course and that was pretty brief.
Loved the commutations and signal breakdown nice work sir, earned a sub.
Good job! Awesome to document this kind of stuff!
I'm a lowly ruby developer and this was hilarious and informative.
Hey! Nice work, I wrote some Arduino code a few month back when I was looking at this that let's you send your own messages to the battery. It was a bit of a pain, as you're probably aware that the bits are inverted and the in reverse bit order. You also have to wait 1 bit length between sending each byte or it fails.
I modified the Arduino Softserial library to suit.
I also tested communication between a M18 battery and a tool, but I couldn't find any data. I think it's just temperature, and the voltage is measured directly. The tool handles the disconnect when the voltage is too low. I repaired a few tools that measure the battery voltage via a potential divider. I had been going to do a video myself on this at some point but haven't got round to it yet. Thanks for the mention 🙂👍
Hey mate! I'm out atm so I'll give a longer reply later. Can you post 2-3 of your most relevant vids and I'll put them in the pinned and description. Hopefully give you some suggested traffic. I should have contacted you before posting, but I was honestly expecting this vid to barely limp past 1k views.
@@toolscientist No worries mate 😂😂😂 If you want some of my Arduino code or some of the data I captured to compare such drop me a message. I'm just off to bed as it's 02:41 here👍
So, thank you so much for your reddit post. I had a fair bit of trouble getting data capture going and might have given up without your data. Thanks to your datastreams I was at least able to know I was on the right track with the TX messages. Then I was able to trial and error an input resistor for J2 (100k is too high and LA sees nothing, 57k is too low and breaks comms. 69-79k seems to be the sweet spot).
I'd love to see what you can do feeding serial data in. There's got to be a diagnostic command in there that'll make the battery spit out health, cycles, etc. I'm some ways from starting that as I've been out of the electronics game for a long time and all I've got is a 10+ year old pinguino board that I never learnt very well. I need to get myself a pico or arduino.
@@toolscientist Thanks, it took a bit of figuring out at first but after working out the baud rate and messing with MSB and inverted data that's when I figured out the check sum, so I knew I was on the right track. I did notice the value decreased during charge so guessed that was the current. Good shout on the 3000 vs 6000 thing as I missed that. Oh I just hooked up to where the data went to the microcontroller in the charger for the TX and TX. I've done a fair bit of reverse engineering in the past on both hardware and software 🙂 most recent was the medical ultrasound machine and the solar inverter I repaired where the company wouldn't give me the password to change settings so I did a video in reverse engineering their software 😂😂
Hat's off for the reversing work, but also for the hilarious innuendo 👍
First video I've seen from your channel, subbed!
It would be AWESOME to have openly documented protocols for the major 5s platforms, so that adapters could be made much safer by translating the low/over temp and LVC protocols from battery to tool. Most I've seen are dumb +/- to +/- wiring.
I've been trying to ID my Bosch blue (CORE) packs/tools/chargers but haven't figured out the "NTC" or "COD" pins yet. This is even more advanced. I'd like to use the Bosch batteries with my other tools, without sacrificing LVP etc. Bosch's own 18v lights are either low efficiency (lumens/watt) from using outdated LEDs, or have poor tint shift or color temp. Their Scangrip-made 4k/10k lumen ones are efficient but have a bad 6000k color temp. So I got a Metabo HPT UB18DCQ4 (rebrand of the Metabo version) which is great,
NTC sounds like a thermistor (Negative Temperature Coefficient). It's likely an analogue pin that the tool uses to monitor the battery's temp.
@@toolscientist EDIT: Did some more testing, the Metabo HPT (Hitachi / Hikoki) battery will pull down the LD pin to ground at around 16v, which signals the tool to shut down. The tool puts out 5v on that pin. A work light shuts off as soon as the pin is grounded, whereas on a small drill only checks for the pin to be high at the beginning of each trigger pull--- so holding the trigger can draw the pack down past 16v. The light has a backup LVC below 13.00v.
Still working on figuring out the Bosch battery ID pin.
cool video - and goes to show why anything can be reverse-engineered. Great job.
This is pretty cool, I expect that the generic Chinese boards for the battery packs were reverse engineered in a similar way? The big thing about these battery packs is how the boards are designed to self destruct if the battery is removed so you can't repack with new cells unless you keep power applied while replacing them
Quite likely. It'll be interesting to look at a 3rd party board to see if they've got the full protocol.
Nice work! FWIW this is why I switched to dewalt 18v batteries - the pinout just has the individual cells so it's trivial to connect them to any charger for balancing.
Definitely advantages to Dewalt's design. Downside is that it's a bit more prone to short circuits and it's unable to brick itself if it detects a fault (which some people would consider a pro, but I'd consider it a con for most users as it means they're more likely to get a flamming battery)
The algorithm landed us on a banger of a video
Im waiting for this type of content for so long
Now do one between the tool and the battery! Excellent video!
I have no idea how i ended up here, but you earned another sub!
This is a first! I follow Douglas McKee a sans instructor and amazing researcher. Has some great talks about reversing proprietary protocols
Okay so the algorithm is spooky: I just moved into my first ever owned home, and was looking at the Ozito battery for the drill driver and impact driver I purchased to do work on it and wondering if I could reverse engineer their protocols; I work in embedded firmware dev haha. Incredibly niche, incredibly relevant, and you did some great work here
Are ozito digital? I would have assumed they just had analogue NTC pins and maybe an analogue current request (that's if it's even doing CC/CV, they might just trickle charge)
@@toolscientist Most likely not, but I want to poke and prod anyway! There’s a surprising amount of logic inside batteries and chargers (I should know, I build it at work lol) - but ozito is cheap as hell so I’m curious! I’m going to bring it to work to poke and prod with the scope now lol
@@Girvo747 you design battery systems in AU? Home solar storage would be my first guess.
@@toolscientist industrial, and not just solar but you’re in the ballpark haha
@Girvo747 Cool. I hope you keep watching. It'll be good to have some insider knowledge when I can't figure out what or why they've done something a certain way.
Inappropriate handling of power tools and lithium batteries? I'm here for it!
This is the kind of stuff I like to see on youtube. Awesome work!
Love the video, I appreciate the work you have put in. That is a crazily oddly complicated interface. It smells it was never actually designed but evolved from something simpler.
I've been there, my project manager just wants me to bodge the interface again, I'm not happy because a previous programmer liked undocumented assembler... I complain that it is already too complicated and there's a real risk that there will be unforeseen complications and bugs. We bodge it again because commissioning is next year.
I feel that Milwaukee will bring out a new and improved drill & battery with an simpler interface which does what they need with less fuss.
Seems pretty simple, when you strip out some of the noise and the weird repeating sequences. I probably ironically over-complicated it with my layman's terms. First exchange (I'm a charger/Okay) is charger giving its parameters to the battery, 2nd exchange (Snapchat/0510f4) is battery giving some ID info to the charger, then it's just (hookup/sure) the charger asking the battery for charging current. The repeated parts seem unnecessary, but are probably to do with the structure of their loops/routines.
I always seen codes referenced similar to these in other videos, happy after many years to finally have a better understanding of these almost hieroglyphic symbols with snap chat references lol!
Subbed:).
Thanks, mate! Glad you enjoyed it.
Same here! I've been looking for a more easy to understand breakdown of Milwalkee (and other tool brands) communication protocols for years. Very curious how feasible it would be to create "smart" tool adapters vs the current ones out there that only pass through the power pins.
Coolest video about reverse engineering I've seen in a long time.. Kudo's to the software developers btw for that human readable labeling of the pulses.. very nice!