Battery firmware lockout: Difference between revisions

Line 2:

==How it works==

When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after ~~recondition~~ or ~~repair~~.

When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after reconditioning or repairing.

Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"<ref>[https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf? https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf?]</ref>. However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of [[self-destructive design]].

Line 48:

*Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.

*Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.

*~~Buying~~ the unlock password: Some of the battery models' BMS code has been leaked ~~and~~ it's possible to purchase it in the grey market~~. However the legality of such behavior is in the gray area~~, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.

*Acquiring the unlock password: Some of the battery models' BMS code has been leaked, some of them are publicized<ref>{{Cite web |last=@davext |date=25 Jun 2024 |title=unbrick-dji |url=https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |url-status=live |archive-url=https://web.archive.org/web/20250914163205/https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |archive-date=14 Sep 2025 |access-date=14 Sep 2025 |website=[Github]}}</ref>. For others, it might be possible to purchase it in the grey market, however, there's a risk of scam as some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.

*Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.

*Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.

@@ Line 2: / Line 2: @@
 ==How it works==
-When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after recondition or repair.
+When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after reconditioning or repairing.
 Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"<ref>[https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf? https://www.ti.com/lit/ug/sluua43a/sluua43a.pdf?]</ref>. However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of [[self-destructive design]].
@@ Line 48: / Line 48: @@
 *Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.
 *Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
-*Buying the unlock password: Some of the battery models' BMS code has been leaked and it's possible to purchase it in the grey market. However the legality of such behavior is in the gray area, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
+*Acquiring the unlock password: Some of the battery models' BMS code has been leaked, some of them are publicized<ref>{{Cite web |last=@davext |date=25 Jun 2024 |title=unbrick-dji |url=https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |url-status=live |archive-url=https://web.archive.org/web/20250914163205/https://github.com/davext/unbrick-dji/blob/main/src/main.cpp |archive-date=14 Sep 2025 |access-date=14 Sep 2025 |website=[Github]}}</ref>. For others, it might be possible to purchase it in the grey market, however, there's a risk of scam as some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
 *Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing<ref>{{Cite web |date=2019-08-15 |title=Reset-BQ20xx |url=https://github.com/otofoto/Reset-BQ20xx |url-status=live |archive-url=https://web.archive.org/web/20220923061011/https://github.com/otofoto/Reset-BQ20xx |archive-date=2022-09-23 |access-date=2025-09-13 |website=[[Github]]}}</ref>.
 *Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.