Battery firmware lockout

Most devices with rechargeable batteries have a battery management system (BMS) module. This module monitors and regulates key variables and is capable of communicating with the device and preventing unsafe usage that could cause failure. However, many of them contain proprietary code that locks the battery from operation, "bricking" it and preventing the battery from being repaired by a third-party. Effectively making the whole device that depends on said battery unusable.

When the battery is outside its operating range, such as overcharged, overheated, unbalanced(in multi-celled battery packs), the BMS prevents the battery from further usage, limiting damage. However, the BMS should resume normal operation when the battery is back within operating range. Instead, the BMS changes bytes in its memory, leading to a "Permanent Fail (PF)" state, preventing the use of said battery even after reconditioning or repairing.

Documentations from known BMS manufacturers such as Texas Instruments said the device can permanently disable the use of the battery pack in case of a "severe failure"^[1]. However, users report the battery is "bricked" after scenarios like long-term storage, discharging a laptop overnight or using a power tool in a warm environment while charging it cool, indicating the manufacturers have abused the BMS program, exaggerating the nature of the failure as a form of self-destructive design.

To make matters worse, many of the BMS need an "access code" to read and change its parameters, including runtime ones like the "Permanent Fail" flag. The unlock or unseal code is kept secret by the battery's manufacturer, making very difficult, if not impossible, for users and third-parties to repair said battery^[2].

Alarmingly, the condition of "bricking" includes "Capacity Degradation Permanent Failure"^[3], which means the manufacturers can artificially limit the battery pack's lifespan, making it unusable after battery health drops below a certain threshold (e.g 80%).

When the battery is bricked, most users would buy an entire battery pack, increasing the total cost of ownership. The "access code" lock prevents third-parties from replacing individual cells and refurbishing the battery pack, reducing its lifespan.

Lithium-ion batteries are 95% recyclable, however, only about 5% of them are actually recycled^[4]. BMS firmware lockout increases the number of battery packs ending up in waste, increasing pollution. Some of the materials like cobalt, are hazardous.

When the purchase is complete. The ownership is transferred to the user of the device. Locking out the battery after purchase is akin to installing a lock on someone else's property, and should be considered "Digital Handcuffs"^[5].

The most common consumer electronics using sophisticated battery management system for their multi-cell battery pack are laptop computers. There are many discussions about the battery "lockout" after replacing or recharging individual cells, indicating battery firmware lockout is the main obstacle of battery repair^[6][7].

Main article: DJI

DJI, a well known commercial UAV manufacturer, locks out the battery after long-term storage, claiming over-discharging damages the battery, even if the chemistry is still recoverable. Users who successfully "revive" the battery packs by charging their cells using a bench power supply and clearing the failure code, report restored functionality^{[8][9][10][11]}. However some users reported "authentication failed"^[12] suggesting the possibility of parts serialization^[13].

Main article: Dyson battery lifespan reduced by design and difficult to repair

Dyson appliances often come with battery packs omitting balancing resistors, leading to higher battery degradation. When the battery cells are unbalanced, repaired or replaced, the BMS chip will lockout. This can be mitigated with added resistors and a custom firmware that doesn't brick the battery upon maintenance^[14].

Main article: Milwaukee battery drm

Power tool manufacturers such as Ryobi and Makita are known to lock battery backs, causing good ones to fail and ending up in repair centers, or worse, landfills. Badar, a known electrical engineer, managed to recover 30 "bricked" battery packs back to normal, reducing e-waste^[15]. Although 19% of them deeply discharged were no longer safe to charge. 65% of bricked batteries were purely due to software lockout with no performance impact after "unbricking" and recharging. Additionally, 13% had unbalanced cells, which were easily resolved by using an external power supply to bring the cells to the same level one by one, however, the "unbricking" procedure is still required for normal use^[16].

Tesla cut the range of some Model S and Model X vehicles by up to 20% via an over-the-air (OTA) update. Some of the batteries became totally unusable, showing a "BMS_u029" error. Some users are able to reverse the change by flashing an older firmware, other users are forced to replace the entire battery pack, costing over $15,000^[17].

Although some consumers rationalize such behavior as increasing safety or avoiding liability, many of them condemn such practices, describing it as planned obsolescence.

There are ways of tackling battery firmware lockout:

• Replacing the battery pack: This is the simplest way of "repairing" a "bricked" battery. However doing so is costly, increases e-waste production and further fuels planned obsolescence of said manufacturers. Some compatible third-party battery packs don't have lockout mechanisms, making it possible for the user to replace cells in the pack and cycle charge to calibrate its meter. However, the exact makes and models aren't well-known.
• Extracting the BMS code: Certain logic analyzers can extract the code from communications to and from the BMS chip. Users or repair technicians can use this way to extract the "unseal" password, then reset the "permanent fail" flag and recalibrate the battery's capacity.
• Acquiring the unlock password: Some of the battery models' BMS codes have been leaked, some of them are publicized^[18]. For others, it might be possible to purchase it in the grey market, however, there's a risk of scams as some of the passwords can be as expensive as the pack itself, and there's no guarantee of them working.
• Resetting the BMS: Some specialized hardware and software can be used to clear the PF flag, reviving the battery without the need of knowing the battery's parameters. Most of the users don't have a need for modify the battery's parameters after repairing^[19].
• Install a custom (or OEM) BMS chip: Buying a brand new BMS chip and writing a custom program. The main challenge is the knowledge of the working mechanism of the battery and its BMS. Different battery chemistries have different voltage and current characteristics, using the wrong data may cause incorrect capacity reading at best, or battery/device malfunction at worst.

Four plaintiffs are suing Tesla over an automatic over-the-air (OTA) software update that they say reduced the driving range of their vehicles by 20 percent. Forced updates by Tesla may violate California's Computer Fraud and Abuse Act and the Unfair Competition Law^[17].