Reverse Engineering

I was given a dead EM 5.7 BMS for reverse engineering. Thanks Les! The BMS is considerably more complicated than I had imagined. It's definitely overkill for the application. The device was designed so that multiple units could be connected together for a battery comprising a large number of cells.

No manufacturer is indicated on the PCB. Other than component identifiers, the only writing says, “14S - BMS BNT-MP-M0005-001 v4.2 2013.05.25” There are components on both sides of the PCB and both sides have a conformal coating that makes reverse engineering more difficult. The ICs have 2014 date codes. None of the jumpers or switches are labeled as to their function.

5.7 BMS top view of PCB

5.7 BMS bottom view of PCB

Powering-Up

The board contains a buck SMPS that develops +5V from battery voltage. The minimum voltage needed to power-up the unit is about 35 volts (where it draws ~40 mA, or about 1.4 W). But at 35 volts, it shuts itself down after 1 minute. When powered from a 50V source, it draws 28 to 31 mA (~1.5 W) and remains running.

When connected to power, one of three unlabeled status LEDs is green. Two other LEDs briefly flash red. The serial port emits the following message:

Init NAC: 1224960 Init LMD: 2450000

MCUSR: 0005
Universal BMS Started!
--- Master mode ---
BMSB1.23d2>

Then the serial port repeatedly sends:

LTC REG Configuration!
RD config:0
RD config:1SPI INIT FAILURE!

Basically, it keeps screaming “I'm broken, I'm broken, I'm broken....”

Failed Components

It was obvious right away that the conformal coating was bubbled over one of the actual battery management ICs. The bubbling was localize to pin 12 which is the C7 input (used for monitoring a cell's voltage).

There was also evidence of the “smoke getting out” on the inside cover of the BMS enclosure.

Additionally, several Zener diodes were burned beyond recognition.

Evidence of pin 12 having been vaporized

Credit: Linear Technology, LTC6803-2 pinout

LTC6803G-2

The actual battery management chips are Linear Technology's LTC6803G-2. (Analog Devices acquired Linear Technology in 2017 and this part is not recommended for new designs.) The chip presently costs around $25 in 1-piece quantities through US distribution (but is much cheaper via AliExpress).

It's interesting to note that the BMS uses two of the aforementioned chips. Each chip is capable of monitoring 12 cells and communicates with the microcontroller via an SPI port. So although, in theory, up to 24 cells could be monitored, the implementation is limited to 14 series-connected cells.

The SPI interface defines the following signals: SCKI Serial Clock Input, SDI Serial Data Input, SDO Serial Data Output, and CSBI Chip Select.

Pins C1 through C12 are the inputs for monitoring battery cell voltages.

Pins S1 though S12 pins are outputs used to balance battery cells. If one cell in a series becomes overcharged, an S output can be used to discharge the cell.

See the block diagram below.

Credit: Linear Technology Corp. LTC6803G-2 block diagram

Credit: Linear Technology Corp. LTC6803G-2 typical application

Passive Balancing

Initially, a battery pack should have well-matched cells. But over time, cell matching degrades.

A weak cell charges and discharges faster than a stronger cell. This becomes the limiting factor in a pack's ability to store energy. The balancing process forces every cell in the pack to have the capacity of the weakest cell.

In practice, a small amount of energy is drained from stronger cells during charging.

This is carried out by placing a MOSFET switch and bleeder resistor in parallel with each cell.

Simplified Schematic of LTC6803G-2 / Battery Interface

Linear Technology Corp. produced an evaluation board (P/N DC1652A) for the LTC6803G-2. The design dates back to 2010. As of this writing (2025) that board is no longer available. The last price I could find for it was $174.58 USD. It also requires a USB interface (P/N DC590) to facilitate communication with a PC running software provided as part of the evaluation board. Although the DC590 USB interface is supposedly still in production (approximate cost of $72) I could not find any in stock.

The circuit fragment below is a subset of the battery interface used on the evaluation board. I only drew 2 of the 14 sets of interface components. The basic group of 8 components would be replicated for each cell in the battery. I believe this is the circuit being used on the 5.7's BMS. However, there also seems to be an extra Zener diode per cell. (Top marked "H2". This is likely the Zener diode shown in the app note for clamping the gate drive signal.)

It would be really nice to be able to see the group of 14 LEDs during charging. An illuminated LED indicates a particular cell is being discharged as part of passive balancing.

Simplified cell interface for LTC6803G-2

Microcontroller

The microcontroller (U10) is an Atmel AT90CAN128-16AU. This is an 8-bit, 16 MHz AVR microcontroller with 128 KB of flash memory. It's in a 64-pin TQFP package. Atmel became part of Microchip Technology in about 2016.

The microcontroller has some internal EEPROM for storage of non-volatile parameters.

Connector CN4 (S/W Loading) has 6 pins. Positions for GND and VCC match the pinout of Atmel's SPI programming interface. No other connections were investigated.

Atmel ICE pinout for SPI interface

Integrated Circuits

U1 is marked "LW052A". This is an SN74LV4052A dual 4-channel analog multiplexer /demultiplexer. It is located very close to the cell temperature monitor connector (PH2). It likely provides up to 8 channels for thermistor measurements.

U2 is marked "LTCBZ". This is an LT6004 dual precision rail-to-rail input and output op-amp in an 8-pin MSOP. It is likely a buffer for the voltage reference needed for thermistor measurements. It is located near connector PH2.

U3 & U5 LTC6803G-2 are the battery management chips. Located near connector PH1.

U4 & U6 have the Linear Technology logo and are marked "16932I". This is an LTC1693-2IS8, a high speed dual N-channel MOSFET Ddiver. The respective IC is physically close to T1 or T2.

U7 is marked "T5C" in a 3-pin SOT-23. It is an LM50CIM3 thermal detector IC sensor reporting in centigrade (10mV / °C ±3%), -40 to +125 °C

U8 is marked "3311 EEUB". It is a Maxim MAX3311 dual RS232-compatible transceiver. It is located near near connector CN7.

U9 is an Atmel ATA6660 high-speed CAN Transceiver. This makes sense because the microcontroller has CAN-bus capability. Located near near connector CN7.

U10 is the Atmel AT90CAN128-16AU uC.

U11 is not populated. Possibly for an RS-422 chip? Located near near connector CN7.

U12 is a National LMP2012 which is dual high precision, rail-to-rail output op-amp.

U15 is marked "B8JQ" and is a tiny 5-pin device. Maybe a Seiko voltage detector like S-80824. Detectors like this are typically used to provide an orderly shutdown of the microcontroller when power is switched off. .

U13, U14, U16, U17, U18, U19, U20, U21 are marked "C5R" with 6 pins. Located on the back of the PCB. It's an SN74LVC1G3157DCKR, single-pole double-throw analog switch.

U22 is marked "2936". This is an LM2936 ultra-low quiescent current LDO voltage regulator.

U23 is marked "81 D21". 4-pin SOT. LDO regulator?

U24 is marked "SHBB". Small 6-pin. LM2736YMK buck regulator.

U25 is marked "47T1 SBLB". 10 pins. Located on the back of the PCB.

Other Components

T1 & T2 Yageo PE 68386NL pulse transformer (785 uH, 0.6 Ω) for gate drive. Described as providing isolation for MOSFET and IGBT drivers in industrial applications.

T3 is marked "BT-01" Likely custom, for buck SMPS.

RL1, RL2, RL3 are Omron 6GK-2F relays with 5-volt coil. Physically near CN3. Possibly to actuate charge and discharge relays?

ISO1, ISO2, ISO4, ISO5, ISO7, ISO8 marked "600". Fairchild HCPL0600 single channel high speed (10 MBit/s) logic gate optocoupler.

ISO3 & ISO6 marked "637" Fairchild HCPL0637 dual channel High Speed (10 MBit/s) logic gate optocoupler.

Note: All ISOx devices physically close to CN1 and CN2. Seems likely these are used for Top Link and Bottom Link to connect other modules.

PC2, PC3, PC4, PC5 marked "D208" Fairchild MOCD208M 8-pin SOIC dual-channel phototransistor output optocoupler.

TL1 is marked "3B". It has 4 pins, located back side of PCB. Likely a power transistor.

Q26 IRFR 220B, 200V N-Channel MOSFET, 4.6A, 200V, RDS(on) = 0.8Ω @VGS = 10 V.

Q31 FR9120R, HEXFET Power MOSFET, VDSS = -100V, RDS(on) = 0.48Ω ID = -6.6A.

Q1 - Q9 & Q11 - Q19 Marking is “PG”. is RQJ0303PGDQATL P-Channel MOSFET RDS(on) = 54 mΩ typ. for cell discharge balancing.

ZDxx PDZ7.5B 7.5V Zener 400 mW in SOD-323. Cell filtered voltage clamp.

Miscellaneous Observations

SW5 is a reset button for the microcontroller.

J2 is a 2-poition Berg jumper. I did not see the typical 120-ohm terminator for the CAN bus, but there are a pair of 62 ohm resistors and a pair of 1.3k ohm resistors next to J2.

TP5 shows 4.96VDC to ground.

SW1 & SW2 4-position DIP switch, not populated.

SW3 & SW4 4-position DIP switch. Configuration switches. Possibly to give a module an identity (address).

Linear Technology's app note shows an external 100k ohm (presumably at 25 °C) thermistor, so this is likely what was used for each of the 7 temperature monitoring points inside the battery.

To be Continued...

Page updated

Google Sites

Report abuse