How I Revived Drill Battery Packs

Main Failure Modes Identified

The author analyzed dozens of defective Ryobi PBP005 batteries purchased on eBay and documented nine distinct failure modes:

Permanent Software Lockout (65% of Failures)

When batteries remain inactive for extended periods, the firmware apparently decides conditions are unsafe and activates a permanent lock preventing charge/discharge cycles. On first press of the status button, a single LED flashes; subsequent presses show all four LEDs flashing.

The author discovered a specific byte at memory address 0x7E90 that controls this lockout. Setting it to 0 removes the lock; setting it to 1 enables it.

Firmware Modification Process

• Use NXP LPC804M101 microcontroller with SWD interface
• Connect via TagConnect cable to J-Link EDU Mini programmer
• Dump memory with SEGGER J-Flash
• Edit hex file with VSCode HexEditor plugin
• Invert the lock byte at 0x7E90
• Reflash with SEGGER J-Flash Lite

Cell Imbalance Issues

Cells became unbalanced due to internal resistance variations or manufacturing defects. The 500Ω balancing resistor limits balancing current to approximately 8mA, creating very slow rebalancing.

Recovery involved manual voltage equalization using a 0.5A constant-current power supply, followed by a J1 jumper reset procedure: press the status button, close J1, press the button again until LEDs 2 and 4 light up, then open J1.

Deep Discharge Scenarios

Batteries with less than 1V per cell showed potential permanent damage. The author successfully revived some cells at 0.5V per cell through very slow trickle charging, but explicitly warns against this approach due to safety risks.

One revived battery showed excessive heat generation and high internal resistance during recharging, requiring safe discharge and disposal.

Component-Level Failures

Feedback Resistor (RFx): Water-damaged board prevented voltage feedback to the AFE (Analog Front-End) chip. Solution: replace with equivalent resistor.

Indicator Button Circuit: Pull-up resistance dropped to approximately 1kΩ, preventing proper button detection. Fix: removed R27 and replaced R28 with a 100Ω resistor to restore proper voltage pull-down.

D10 Diode: Failed diode prevented charging detection. Solution: removal restored charging functionality.

Schematic Analysis

The author reverse-engineered the complete circuit, achieving approximately 95% documentation accuracy. The system uses a custom or cloned ASIC AFE chip (marked 3705T), I2C bus communication (partially decoded but undocumented), a load detection circuit enabling power delivery via FET switching, and multiple protection stages in firmware.

Author's Critical Assessment

The author questions whether the aggressive software protection strategy actually improves safety: "This system often generates false positives and can transform functional batteries into worthless bricks. Engineers likely acted with good intentions for safety, but insufficient testing of false-alarm scenarios created a situation where the error lock never self-clears."

Project Resources

Full documentation, code, and schematics are available at: github.com/bjkayani/ryobi-battery-repair

Safety Notice: Working with lithium batteries requires caution and established techniques. You alone are responsible for your personal safety.