Battery firmware lockout: Difference between revisions

Most devices with rechargeable batteries has a [[wikipedia:Battery_management_system|battery management system (BMS)]] module. This module monitors and regulate key variables and capable of communicating with the device and preventing unsafe usage that could cause failure. However, many of them contains proprietary code that locks the battery from operation, "bricking" it and prevent the battery from third-party repair. Effectively making the whole device that depends on said battery unusable.

When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after recondition or repair.  

Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"<ref>[https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf? https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf?]</ref>. However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of [[self-destructive design]].  

To make matters worse, many of the BMS needs "access code" to read and change it's parameters, including runtime ones like the "Permanent Fail" flag. The unlock or unseal code is kept secret by the battery's manufacturer, making user and third-parties very difficult, if not impossible, to repair said battery<ref>{{Cite web |date=28 Sep 2019 |title=Experiences with TI BQ management IC’s when re-building laptop batteries? |url=https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |url-status=live |archive-url=https://web.archive.org/web/20240926193741/https://www.eevblog.com/forum/chat/experiences-with-ti-bq-management-ics-when-revelling-laptop-batteries/?all |archive-date=26 Sep 2024 |access-date=13 Sep 2025 |website=EEVblog Electronics Community Forum}}</ref>.

Alarmingly, the condition of "bricking" includes "Capacity Degradation Permanent Failure"<ref>[https://www.ti.com/lit/ds/symlink/bq40z50.pdf? https://www.ti.com/lit/ds/symlink/bq40z50.pdf?]</ref>, which means the manufacturers can artificially limit the battery pack's lifespan, making it unusable after a certain health (e.g 80%).

Lithium-ion batteries are 95% recyclable, however, only about 5% of them are actually recycled<ref>{{Cite web |date=22 Sep 2022 |title=Lithium ion battery recycling |url=https://www.cas.org/resources/cas-insights/lithium-ion-battery-recycling?utm_source=chatgpt.com |url-status=live}}</ref>. BMS firmware lockout increases the number of battery packs end up in waste, increasing pollution. Some of the materials like cobalt, are hazardous.

[[File:BQ40Z50R3 1.jpg|thumb|A screenshot of a "bricked" battery pack with healthy cells, note the red "PF_EN"]]

{{Main|DJI}}DJI, a well known commercial UAV manufacturer, locks out the battery after long-term storage, claiming over-discharging damages the battery, even if the chemistry is still recoverable. Users who successfully "revives" the battery packs by charging their cells using a bench power supply and clearing the failure code, reports restored functionality<ref>{{Cite web |date=2024-03-21 |title=Reviving dead batteries - a heads up |url=https://mavicpilots.com/threads/reviving-dead-batteries-a-heads-up.146169/ |url-status=live |archive-url=https://web.archive.org/web/20250618000130/https://mavicpilots.com/threads/reviving-dead-batteries-a-heads-up.146169/ |archive-date=2025-06-18 |access-date=2025-09-13 |website=MavicPilots}}</ref><ref>{{Cite web |date=2023-08-02 |title=DJI Battery Killer repairing tool |url=https://greyarro.ws/t/dji-battery-killer-repairing-tool/68863 |url-status=live |access-date=2025-09-13 |website=Grey Arrows Drone Club}}</ref><ref>{{Cite web |last=McLoughlin |first=Liam |date=2023-10-01 |title=Repairing the DJI Spark Drone Battery with DJI Battery Killer, CP2112, & 9V battery |url=https://leelum.com/projects/repairing-the-dji-spark-drone-battery-with-dji-battery-killer-cp2112-9v-battery/ |url-status=live |archive-url=https://web.archive.org/web/20241211065622/https://leelum.com/projects/repairing-the-dji-spark-drone-battery-with-dji-battery-killer-cp2112-9v-battery/ |archive-date=2024-12-11 |access-date=2025-09-13 |website=Leelum}}</ref><ref>{{Cite web |title=DJI Battery Killer: Reviving Bricked DJI Drone Batteries with CP2112 & BMS Reset |url=https://www.elektroda.com/qa,dji-battery-killer-cp2112-bms-reset.html |url-status=live |website=elektroda}}</ref>. However some users reported "authentication failed"<ref>{{Cite web |date=2024-03-23 |title=Mavic pro battery authentication failed after clear pf |url=https://mavicpilots.com/threads/mavic-pro-battery-authentication-failed-after-clear-pf.144987/ |url-status=live |access-date=2025-09-13 |website=MavicPilots}}</ref> suggesting the possibility of parts serialization<ref>{{Cite web |last=Greenlee |first=Lauren |date=2023-01-17 |title=How Parts Pairing Kills Independent Repair |url=https://www.ifixit.com/News/69320/how-parts-pairing-kills-independent-repair |url-status=live |archive-url=https://web.archive.org/web/20250811033531/https://www.ifixit.com/News/69320/how-parts-pairing-kills-independent-repair |archive-date=2025-08-11 |access-date=2025-09-13 |website=iFixit}}</ref>.

{{Main|Dyson battery lifespan reduced by design and difficult to repair}}Dyson appliances often come with battery packs omitting balancing resistors, leading to higher battery degradation. When the battery cells are unbalanced, repaired or replaced. The BMS chip will lockout. This can be mitigated with added resistors and a custom firmware that doesn't brick the battery upon maintenance<ref name=":2">{{Cite web |last=@tinfever |title=(Unofficial) Firmware Upgrade for Dyson V6/V7 Vacuum Battery Management System |url=https://github.com/tinfever/FW-Dyson-BMS |url-status=live |archive-url=https://web.archive.org/web/20250912021607/https://github.com/tinfever/FW-Dyson-BMS |archive-date=2025-09-12 |access-date=25 Mar 2025 |website=GitHub}}</ref>.

Power tool manufacturers such as Ryobi and Makita are known to lock battery backs, causing good ones to fail and ended up in repair centers, or worse, landfills<ref>https://www.youtube.com/watch?v=NQ_lyDyzEHY</ref>. Repair technicians who know how to "unbrick" the BMS are capable of reviving these units with perfect condition, reducing e-waste.

Tesla cuts the range of some Model S and Model X by up to 20% by an OTA update. Some of the batteries became totally unusable, showing a "BMS_u029" error. Some users are able to reverse the change by flashing an older firmware, other users are forced to replace the entire battery pack, costing over $15,000<ref name=":0">{{Cite web |last=Crandall |first=Christine |date=2023-05-18 |title=How Tesla’s New OTA Software Update Cut EV Range By A Massive 20%, Owners Move To Sue |url=https://www.hotcars.com/tesla-software-update-cut-ev-range-owners-move-to-sue/ |archive-url=https://web.archive.org/web/20250413101832/https://www.hotcars.com/tesla-software-update-cut-ev-range-owners-move-to-sue/ |archive-date=2025-04-13 |access-date=2025-09-13 |website=Hotcars}}</ref>.

Although some consumers rationalize such behavior of increasing safety or avoiding liability. Many of them condemn such practices and describing it as planned obsolescence.

*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.

*Buying the unlock password: Some of the battery models' BMS code has been leaked and it's possible to purchase it in the grey market. However the legality of such behavior is in the gray area, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.

*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.

*Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.