Battery firmware lockout: Difference between revisions

Charlie 6 (talk | contribs)
Page creation, adding main content (WIP)
 
Charlie 6 (talk | contribs)
m edit main article links
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Ph-T-Int}}Most devices with rechargeable batteries has a battery management system (BMS) module. This module monitors and regulate key variables and capable of communicating with the device and preventing unsafe usage that could cause failure. However, many of them contains proprietary code that locks the battery from operation, "bricking" it and prevent the battery from third-party repair. Effectively making the whole device that depends on said battery unusable.
Most devices with rechargeable batteries has a [[wikipedia:Battery_management_system|battery management system (BMS)]] module. This module monitors and regulate key variables and capable of communicating with the device and preventing unsafe usage that could cause failure. However, many of them contains proprietary code that locks the battery from operation, "bricking" it and prevent the battery from third-party repair. Effectively making the whole device that depends on said battery unusable.


==How it works==
==How it works==
When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after recondition or repair.  
When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after recondition or repair.  


Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"<ref>[https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf? https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf?]</ref>. However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of self-destructive design.  
Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"<ref>[https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf? https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf?]</ref>. However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of [[self-destructive design]].  


To make matters worse, many of the BMS needs "access code" to read and change it's parameters, including runtime ones like the "Permanent Fail" flag. The unlock or unseal code is kept secret by the battery's manufacturer, making user and third-parties very difficult, if not impossible, to repair said battery<ref>{{Cite web |date=28 Sep 2019 |title=Experiences with TI BQ management IC’s when re-building laptop batteries? |url=https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |url-status=live |archive-url=https://web.archive.org/web/20240926193741/https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |archive-date=26 Sep 2024 |access-date=13 Sep 2025 |website=EEVblog Electronics Community Forum}}</ref>.
To make matters worse, many of the BMS needs "access code" to read and change it's parameters, including runtime ones like the "Permanent Fail" flag. The unlock or unseal code is kept secret by the battery's manufacturer, making user and third-parties very difficult, if not impossible, to repair said battery<ref>{{Cite web |date=28 Sep 2019 |title=Experiences with TI BQ management IC’s when re-building laptop batteries? |url=https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |url-status=live |archive-url=https://web.archive.org/web/20240926193741/https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |archive-date=26 Sep 2024 |access-date=13 Sep 2025 |website=EEVblog Electronics Community Forum}}</ref>.
Line 12: Line 12:
==Why it is a problem==
==Why it is a problem==


=== Increased repair cost ===
===Increased repair cost===
When the battery is bricked, most users would buy an entire battery pack, increasing the total cost of ownership. The "access code" lock prevents third-parties from replacing individual cells and refurbishing the battery pack, reducing its lifespan.
When the battery is bricked, most users would buy an entire battery pack, increasing the total cost of ownership. The "access code" lock prevents third-parties from replacing individual cells and refurbishing the battery pack, reducing its lifespan.


=== Environmental impact ===
===Environmental impact===
Lithium-ion batteries are 95% recyclable, however, only about 5% of them are actually recycled. BMS firmware lockout increases the number of battery packs end up in waste, increasing pollution. Some of the materials like cobalt, are hazardous.
Lithium-ion batteries are 95% recyclable, however, only about 5% of them are actually recycled<ref>{{Cite web |date=22 Sep 2022 |title=Lithium ion battery recycling |url=https://www.cas.org/resources/cas-insights/lithium-ion-battery-recycling?utm_source=chatgpt.com |url-status=live}}</ref>. BMS firmware lockout increases the number of battery packs end up in waste, increasing pollution. Some of the materials like cobalt, are hazardous.


=== Undermining ownership ===
===Undermining ownership===
When the purchase is complete. The ownership is transferred to the user of the device. Locking out the battery after purchase is akin to installing a lock on someone else's property, and should be considered "Digital Handcuffs"<ref>{{Cite web |title=Words to Avoid (or Use with Care) Because They Are Loaded or Confusing |url=https://www.gnu.org/philosophy/words-to-avoid.html |url-status=live |archive-url=https://web.archive.org/web/20250909175856/https://www.gnu.org/philosophy/words-to-avoid.html |archive-date=2025-09-09 |access-date=2025-09-13 |website=GNU Operating System}}</ref>.
When the purchase is complete. The ownership is transferred to the user of the device. Locking out the battery after purchase is akin to installing a lock on someone else's property, and should be considered "Digital Handcuffs"<ref>{{Cite web |title=Words to Avoid (or Use with Care) Because They Are Loaded or Confusing |url=https://www.gnu.org/philosophy/words-to-avoid.html |url-status=live |archive-url=https://web.archive.org/web/20250909175856/https://www.gnu.org/philosophy/words-to-avoid.html |archive-date=2025-09-09 |access-date=2025-09-13 |website=GNU Operating System}}</ref>.


==Examples==
==Examples==


=== Consumer electronics ===
===Consumer electronics===
The most common consumer electronics using sophisticated battery management system for their multi-cell battery pack are laptop computers. There are many discussions about the battery "lockout" after replacing or recharging individual cells, indicating battery firmware lockout is the main obstacle of battery repair<ref>{{Cite web |date=2022-10-06 |title=How can I reset the laptop battery BMS? |url=https://electronics.stackexchange.com/questions/570919/how-can-i-reset-the-laptop-battery-bms |url-status=live |archive-url=https://web.archive.org/web/20250913130751/https://electronics.stackexchange.com/questions/570919/how-can-i-reset-the-laptop-battery-bms |archive-date=2015-09-13 |access-date=2015-09-13 |website=Stack Exchange}}</ref>.
[[File:BQ40Z50R3 1.jpg|thumb|A screenshot of a "bricked" battery pack with healthy cells, note the red "PF_EN"]]
The most common consumer electronics using sophisticated battery management system for their multi-cell battery pack are laptop computers. There are many discussions about the battery "lockout" after replacing or recharging individual cells, indicating battery firmware lockout is the main obstacle of battery repair<ref>{{Cite web |date=2022-10-06 |title=How can I reset the laptop battery BMS? |url=https://electronics.stackexchange.com/questions/570919/how-can-i-reset-the-laptop-battery-bms |url-status=live |archive-url=https://web.archive.org/web/20250913130751/https://electronics.stackexchange.com/questions/570919/how-can-i-reset-the-laptop-battery-bms |archive-date=2025-09-13 |access-date=2025-09-13 |website=Stack Exchange}}</ref><ref>{{Cite web |date=30 Oct 2023 |title=(i changed every cell in laptop battery then bms locked How to unlock bms of acer e5 laptop battery, total battery in series is 15v but in bms output voltage is 0v i tried to short battery positive to output positive, but still no output, i think bms is locked how to unlock without software help |url=https://old.reddit.com/r/batteries/comments/17jogjr/i_changed_every_cell_in_laptop_battery_then_bms/ |url-status=live |archive-url=https://web.archive.org/web/20250913133735/https://old.reddit.com/r/batteries/comments/17jogjr/i_changed_every_cell_in_laptop_battery_then_bms/ |archive-date=13 Sep 2025 |access-date=13 Sep 2025 |website=[[Reddit]]}}</ref>.


=== Commercial UAVs ===
===Commercial UAVs===
DJI, a well known commercial UAV manufacturer, locks out the battery after long-term storage, claiming over-discharging damages the battery. Users who successfully "revives" the battery packs by charging their cells using a bench power supply and clearing the failure code, reports identical or slightly degraded flight time.
{{Main|DJI}}
DJI, a well known commercial UAV manufacturer, locks out the battery after long-term storage, claiming over-discharging damages the battery, even if the chemistry is still recoverable. Users who successfully "revives" the battery packs by charging their cells using a bench power supply and clearing the failure code, reports restored functionality<ref>{{Cite web |date=2024-03-21 |title=Reviving dead batteries - a heads up |url=https://mavicpilots.com/threads/reviving-dead-batteries-a-heads-up.146169/ |url-status=live |archive-url=https://web.archive.org/web/20250618000130/https://mavicpilots.com/threads/reviving-dead-batteries-a-heads-up.146169/ |archive-date=2025-06-18 |access-date=2025-09-13 |website=MavicPilots}}</ref><ref>{{Cite web |date=2023-08-02 |title=DJI Battery Killer repairing tool |url=https://greyarro.ws/t/dji-battery-killer-repairing-tool/68863 |url-status=live |access-date=2025-09-13 |website=Grey Arrows Drone Club}}</ref><ref>{{Cite web |last=McLoughlin |first=Liam |date=2023-10-01 |title=Repairing the DJI Spark Drone Battery with DJI Battery Killer, CP2112, & 9V battery |url=https://leelum.com/projects/repairing-the-dji-spark-drone-battery-with-dji-battery-killer-cp2112-9v-battery/ |url-status=live |archive-url=https://web.archive.org/web/20241211065622/https://leelum.com/projects/repairing-the-dji-spark-drone-battery-with-dji-battery-killer-cp2112-9v-battery/ |archive-date=2024-12-11 |access-date=2025-09-13 |website=Leelum}}</ref><ref>{{Cite web |title=DJI Battery Killer: Reviving Bricked DJI Drone Batteries with CP2112 & BMS Reset |url=https://www.elektroda.com/qa,dji-battery-killer-cp2112-bms-reset.html |url-status=live |website=elektroda}}</ref>. However some users reported "authentication failed"<ref>{{Cite web |date=2024-03-23 |title=Mavic pro battery authentication failed after clear pf |url=https://mavicpilots.com/threads/mavic-pro-battery-authentication-failed-after-clear-pf.144987/ |url-status=live |access-date=2025-09-13 |website=MavicPilots}}</ref> suggesting the possibility of parts serialization<ref>{{Cite web |last=Greenlee |first=Lauren |date=2023-01-17 |title=How Parts Pairing Kills Independent Repair |url=https://www.ifixit.com/News/69320/how-parts-pairing-kills-independent-repair |url-status=live |archive-url=https://web.archive.org/web/20250811033531/https://www.ifixit.com/News/69320/how-parts-pairing-kills-independent-repair |archive-date=2025-08-11 |access-date=2025-09-13 |website=iFixit}}</ref>.


=== Home appliances ===
===Home appliances===
Dyson
{{Main|Dyson battery lifespan reduced by design and difficult to repair}}
Dyson appliances often come with battery packs omitting balancing resistors, leading to higher battery degradation. When the battery cells are unbalanced, repaired or replaced. The BMS chip will lockout. This can be mitigated with added resistors and a custom firmware that doesn't brick the battery upon maintenance<ref name=":2">{{Cite web |last=@tinfever |title=(Unofficial) Firmware Upgrade for Dyson V6/V7 Vacuum Battery Management System |url=https://github.com/tinfever/FW-Dyson-BMS |url-status=live |archive-url=https://web.archive.org/web/20250912021607/https://github.com/tinfever/FW-Dyson-BMS |archive-date=2025-09-12 |access-date=25 Mar 2025 |website=GitHub}}</ref>.


=== Power tools ===
===Power tools===
Ryobi
Power tool manufacturers such as Ryobi and Makita are known to lock battery backs, causing good ones to fail and ended up in repair centers, or worse, landfills<ref>https://www.youtube.com/watch?v=NQ_lyDyzEHY</ref>. Repair technicians who know how to "unbrick" the BMS are capable of reviving these units with perfect condition, reducing e-waste.


=== Electric vehicles ===
===Electric vehicles===
Tesla
Tesla cuts the range of some Model S and Model X by up to 20% by an OTA update. Some of the batteries became totally unusable, showing a "BMS_u029" error. Some users are able to reverse the change by flashing an older firmware, other users are forced to replace the entire battery pack, costing over $15,000<ref name=":0">{{Cite web |last=Crandall |first=Christine |date=2023-05-18 |title=How Tesla’s New OTA Software Update Cut EV Range By A Massive 20%, Owners Move To Sue |url=https://www.hotcars.com/tesla-software-update-cut-ev-range-owners-move-to-sue/ |archive-url=https://web.archive.org/web/20250413101832/https://www.hotcars.com/tesla-software-update-cut-ev-range-owners-move-to-sue/ |archive-date=2025-04-13 |access-date=2025-09-13 |website=Hotcars}}</ref>.


== Consumer reactions ==
==Consumer reactions==
Although some consumers rationalize such behavior of increasing safety or avoiding liability. Many of them condemn such practices and describing it as planned obsolescence.
Although some consumers rationalize such behavior of increasing safety or avoiding liability. Many of them condemn such practices and describing it as planned obsolescence.


There are ways of tackling battery firmware lockout:
There are ways of tackling battery firmware lockout:


* Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.
*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.
* Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
*Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
* Buying the unlock password: Some of the battery models' BMS code has been leaked and it's possible to purchase it in the grey market. However the legality of such behavior is in the gray area, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
*Buying the unlock password: Some of the battery models' BMS code has been leaked and it's possible to purchase it in the grey market. However the legality of such behavior is in the gray area, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
* Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.
*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.
*Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.


== Lawsuits ==
==Lawsuits==
Four plaintiffs are suing Tesla over an automatic over-the-air (OTA) software update that they say reduced the driving range of their vehicles by 20 percent. Forced updates by Tesla may violate California's Computer Fraud and Abuse Act and the Unfair Competition Law<ref name=":0" />.


==References==
==References==