Battery firmware lockout

Most devices with rechargeable batteries has a battery management system (BMS) module. This module monitors and regulate key variables and capable of communicating with the device and preventing unsafe usage that could cause failure. However, many of them contains proprietary code that locks the battery from operation, "bricking" it and prevent the battery from third-party repair. Effectively making the whole device that depends on said battery unusable.

How it works

When the battery is outside its operating range, such as overcharged, overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after recondition or repair.

Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure". However users report the battery is "bricked" after scenarios like long-term storage, discharging laptop overnight or use a power tool in warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a from of self-destructive design.

To make matters worse, many of the BMS needs "access code" to read and change it's parameters, including runtime ones like the "Permanent Fail" flag. The unlock or unseal code is kept secret by the battery's manufacturer, making user and third-parties very difficult, if not impossible, to repair said battery.

Alarmingly, the condition of "bricking" includes "Capacity Degradation Permanent Failure", which means the manufacturers can artificially limit the battery pack's lifespan, making it unusable after a certain health (e.g 80%).

Why it is a problem

Increased repair cost

When the battery is bricked, most users would buy an entire battery pack, increasing the total cost of ownership. The "access code" lock prevents third-parties from replacing individual cells and refurbishing the battery pack, reducing its lifespan.

Environmental impact

Lithium-ion batteries are 95% recyclable, however, only about 5% of them are actually recycled. BMS firmware lockout increases the number of battery packs end up in waste, increasing pollution. Some of the materials like cobalt, are hazardous.

Undermining ownership

When the purchase is complete. The ownership is transferred to the user of the device. Locking out the battery after purchase is akin to installing a lock on someone else's property, and should be considered "Digital Handcuffs".

Examples

Consumer electronics

A screenshot of a "bricked" battery pack with healthy cells, note the red "PF_EN"

The most common consumer electronics using sophisticated battery management system for their multi-cell battery pack are laptop computers. There are many discussions about the battery "lockout" after replacing or recharging individual cells, indicating battery firmware lockout is the main obstacle of battery repair.

Commercial UAVs

Main article: DJI

DJI, a well known commercial UAV manufacturer, locks out the battery after long-term storage, claiming over-discharging damages the battery, even if the chemistry is still recoverable. Users who successfully "revives" the battery packs by charging their cells using a bench power supply and clearing the failure code, reports restored functionality. However some users reported "authentication failed" suggesting the possibility of parts serialization.

Home appliances

Main article: Dyson battery lifespan reduced by design and difficult to repair

Dyson appliances often come with battery packs omitting balancing resistors, leading to higher battery degradation. When the battery cells are unbalanced, repaired or replaced. The BMS chip will lockout. This can be mitigated with added resistors and a custom firmware that doesn't brick the battery upon maintenance.

Power tools

Power tool manufacturers such as Ryobi and Makita are known to lock battery backs, causing good ones to fail and ended up in repair centers, or worse, landfills. Repair technicians who know how to "unbrick" the BMS are capable of reviving these units with perfect condition, reducing e-waste.

Electric vehicles

Tesla cuts the range of some Model S and Model X by up to 20% by an OTA update. Some of the batteries became totally unusable, showing a "BMS_u029" error. Some users are able to reverse the change by flashing an older firmware, other users are forced to replace the entire battery pack, costing over $15,000.

Consumer reactions

Although some consumers rationalize such behavior of increasing safety or avoiding liability. Many of them condemn such practices and describing it as planned obsolescence.

There are ways of tackling battery firmware lockout:

• Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers.
• Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
• Buying the unlock password: Some of the battery models' BMS code has been leaked and it's possible to purchase it in the grey market. However the legality of such behavior is in the gray area, there's a risk of scam, some of the passwords can be as expensive as the pack itself, and there's no guarantee of working.
• Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users won't modify the battery pack after repairing.
• Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and write own program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.

Lawsuits

Four plaintiffs are suing Tesla over an automatic over-the-air (OTA) software update that they say reduced the driving range of their vehicles by 20 percent. Forced updates by Tesla may violate California's Computer Fraud and Abuse Act and the Unfair Competition Law.