-
Hello all.
I'll try to keep this as short as possible while also providing as much information as I can. (And I failed. Italics = long version. Note form below)
Back Story
So a couple days ago I bought a (cheap, used) Asus X200CA notebook with no charger. As expected it didn't power up without said charger, and with, all was golden, or so it seemed. Windows reported that the battery was detected and charging. However it transpires that it wasn't charging, the percentage wouldn't increase from 0 and 3rd party software reported that the charge/discharge rate was 0mw. After seeing this, I proceeded to try various internet found methods to initiate an internal charge to no avail.
Disassembly time... having already popped open the case to disconnect the battery for above "methods", I figured in for a penny in for a pound. The battery pack itself fortunately reveals the cells by simply peeling back a film. Measuring the voltages confirmed that it had been without power for quite some time, less 1.50v a cell, eek! Being a 11.25v pack with 3.7v cells my trusty Li(Po/Ion) charger was of course having none of it and complained of low voltage. So I trickle charged them in turn under NiCad mode up to a more respectable 3v each. I then continued to charge them correctly until the charge currant dropped to 0.2A. This was to test if the battery would now charge in the laptop, nope, but 84% charge was reported by windows. Disconnected mains, instant off. hmm... Checked voltage at the header, nothing
Next ripped the board out to have a general look, and do some research on the main BMS chip.
Notes (Short of above)
Asus X200CA Notebook. 3* 3.7v cell, 11.25v Li-ion pack. Cells good, battery pack doesn't charge or have power out at header. BMS seems intact as battery condition/state is reported to laptop.
Reasearch
The main chip in the BMS is from Texas Instruments and has the part number BQ30Z55. One of its many protection features is a series of "permanent" failure states, which is stored in flash and can be reset. I believed that the critical low voltage fail state was triggered during storage. Communication with this chip appears to be with a TI proprietary protocol called SBS 1.1 which I can't find any detailed information on. Their own Battery Management Studio "bqStudio" does not list my chip, and I'm not sure on how to interface with the chip anyway. Pins 13 "SBS 1.1 data line" and 15 "SBS 1.1 clock line" look like a good bet for access, but beyond that I'm not sure.
Links
bq30z50-R1 and bq30z55-R1Technical Reference http://www.ti.com/lit/ug/sluu852/sluu852.pdf
bq30z554-R1 Data Sheet http://www.ti.com/lit/ds/symlink/bq30z554-r1.pdf (Essentially the same chip, confirmed here https://e2e.ti.com/support/power_management/battery_management/f/180/t/311497)
Texas Instruments Battery Management Studio bqStudio http://www.ti.com/tool/BQSTUDIO
And finally the Question.
How can I interface and communicate with the chip to reset the failure state? Can I use the main header (probably not) or do I have to connected directly to the chip? I have an Arduino, and a Raspberry Pi for GPIO at my disposal.
Any help would be greatly appreciated.
Regards, Craig (Kureigu). -
There is a 3 pin fuse somewhere in the pcb of the battery, when the BQ signals the battery as faulty it kills the fuse.
There are also lots of keys to be able to change those registers.
I think SBS is just another flavor of I2C, plug it into the laptop and probe the pins, but there is also an 100$ Devboard from TI that talks all those protocols.
-
Yes, SBS is I2C-based protocol. Download the specification and read it first.
Check the fuse first, as mentioned above.
The Russians seem to have the most expertise in "hacking" these ICs... do some Googling and translating. -
Please also be aware that the BMS 'kills' the battery pack for a good reason. Lithium Ion cell chemistry is irreversibly changed if the p.d drops below the minimum threshold. The OEM ensures that the battery disables itself in such cases due to fear of cell instability and potential negative consequences. If you do re-enable the battery, I recommend that you charge it only in your presence until you are sure that it does not get hot or present other symptoms such as out gassing.
Aurora -
The fuse appears to be fine, although I'm not sure on the proper test methodology for testing a 3 pin fuse. Continuity is being read in all directions.
Aurora, thank you for your concern regarding the cells. I am aware of this and was present throughout the charging process. If I do manage to get the pack functioning again, I will be doing a few charge/discharge cycles at different rates to ensure that the cells are stable and still maintain a reasonable capacity.
Looking at the Toshiba TPC8073 MOSFETs on the board, the 1st one (left in image) is switched on, while the second is off. If I take power from the first and apply it to the second then it too switches on. So possibly there is a bad transistor some where, or the BQ30Z55 is not signalling to turn it on, permanent failure state or sleep state?
So far my Googling of Russian forums hasn't come up with much on my specific IC, but has given me some software options. Unfortunately again, they don't seem to support my IC and also require additional serial hardware and licencing fees
I would like to make use of my Arduino or Raspberry Pi for I2C comms, however I am struggling to find useful addresses in the technical reference document.
-
Check the MOSFET control pins of the BQ to determine if it is keeping them off or not.
The datasheets/references should have enough information to at least read the state of the pack from the IC. -
had u got the solution
-
It should be something like this https://www.ti.com/lit/ug/sluua79/sluua79.pdf?ts=1612727477316
you have to reprogram BMS if you remove cells or ran out of resource(some energy metering stuff)
you can bypass MOSFET if everything else works but not recommended
for example Apple wont start normally without green light from BMS and sometimes serial number match -
Here is how I do it:
-
Thanks mefisto for a detaild guide.
Everything went flawlees untill the the unseal step.
Apparantly manufacturer changed the default code.
Is there any way to gain acces to such a chip?
If no than maybe there is a way to replace and program a new one?
Any expirience in that field? -
The unseal code is only 32 bits, right? How long does it take per attempt? Trying all 4 billion combinations might not seem that difficult. There's software out there (paid, unfortunately) which claims to open them, so either they have hardcoded a set of known keys to try or know a specific backdoor/attack to get in. Anyone with a logic analyser and willing to pay would be able to find that out...
The fact that it's a 16-bit core internally and won't be nearly as secure as something designed with serious crypto may mean that you can guess both halves separately, using the usual timing attacks. Power analysis may also work. -
The unseal code is only 32 bits, right? How long does it take per attempt? Trying all 4 billion combinations might not seem that difficult.
One attempt using mefistotelis' python tool takes around 1s which includes starting of the tool. This can probably speed up when doing the loop directly in that tool instead of calling it from commandline every time, but iirc the communication protocol officially requires a wait time of 500ms.
Also officially you need to wait 5 seconds before doing an unseal command, but I tested with an Mavic Pro battery which uses the same chip but the TI default key that it also works without extra delay.
Nevertheless this would take way too long (136 years) with just a single battery.There's software out there (paid, unfortunately) which claims to open them, so either they have hardcoded a set of known keys to try or know a specific backdoor/attack to get in. Anyone with a logic analyser and willing to pay would be able to find that out...
I found a very interesting article about hacking the bq8030 on Karosium from Viktor.
He found a backdoor which allowed him to switch to boot-loader mode and read out the firmware. With this he was able to disassemble the code and extract the key and even identify the non-standard command sequence for that specific Sanyo firmware.
A similar attack could also work with the BQ30Z55.
I'm not sure what the "DJI Battery Killer" can do because I couldn't find a copy of it until now.
When the commercial tools use the SHA1 hash mechanism instead of the 32 bit key, then they could do the hash calculation on their server and you need a different hash every time (challenge response protocol) and you can't extract the key from their tool.The fact that it's a 16-bit core internally and won't be nearly as secure as something designed with serious crypto may mean that you can guess both halves separately, using the usual timing attacks. Power analysis may also work.
"guess both halves separately" sounds interesting, but I doubt it will work in this case.
The two 16 bit values are written one after the other to the battery over smbus interface.
After that you call the unseal command and after some time you can query the result.
Even if the timing is different when e.g. the first 16 bits are correct, over the slow smbus communication it is probably hard to see such a small timing difference. With direct access to the mcu and knowing how long the key validation function takes it would be feasible. Maybe measuring the mcu current could help here.
The most feasible attack seem to be social engineering.
If anyone from DJI, Asus or the 3rd party tool vendors is listening: please give us the unseal and full access keys for the DJI P3 batteries and Asus laptop batteries
.
The DJI Phantom 3 batteries are no longer sold, so it should not be a commercial problem.
When the community continues and finds a backdoor this could be used for any device which uses this chip. This can be a commercial problem for the other vendors and maybe TI. So do them and TI a favor and share the keys.
Michael
-
Hello,
When I first bought my ASUS X550 laptop, the original battery was already faulty. I purchased a backup battery and have been using it ever since. The original battery has been sitting unused on the side. Recently, I decided to open it up and found that the individual cells seem to be in good condition, all showing around 3.4 volts. However, there is no output voltage, and I can't seem to identify any apparent issues with the circuit. When it initially malfunctioned, the battery abruptly stopped working even though it was fully charged.
Now, I have a Raspberry Pi 3 at hand, and I was wondering if anyone could kindly provide me with a connection schema or diagram to help troubleshoot and connect the original battery to the Raspberry Pi 3.
Thank you in advance for your assistance!
I needed ASUS X550 Battery to Raspberry Pi 3 Connection Schema