Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Battery firmware #17

Open
notsolowki opened this issue Feb 9, 2017 · 300 comments
Open

Battery firmware #17

notsolowki opened this issue Feb 9, 2017 · 300 comments

Comments

@notsolowki
Copy link

notsolowki commented Feb 9, 2017

i notice the battery firmware is not encrypted. i wonder what could be done to the battery controller so aftermarket batteries could be connected

@ferraript
Copy link

ferraript commented Feb 9, 2017

what FW version are you talking about?

edit: I guess you mean 1.7 as I found at phantompilots forum people complaining about how FW 1.7 disabled aftermarket batteries

but that's very strange, because on 1.6, those batteries were allowed
and there is no update of battery module firmware in 1.7 (at least with P3A)
so either battery module firmware was updated for P3P only or (most likely) this restriction is included in another firmware module

@mefistotelis
Copy link
Collaborator

There already are 3rd party batteries. And some people are disconnecting the lipo cells and connecting their own packets to the board. I don't see much benefit in looking at this firmware.

But id someone wanted to, first step would be to look at the battery board and identify microcontroller used.

Then a proper disassembler can be used to take a look at the code.

@notsolowki
Copy link
Author

notsolowki commented Feb 10, 2017 via email

@notsolowki
Copy link
Author

@mefistotelis. when i cranked up the speed settings the drone would go between 45-60 mph per hour, about 20-25 mps. only thing is the person i have running the firmware gets battery errors about the current. i dont get these errors at all. this persons gimbal has been moved to the front of the drone and they think that might be the problem, but i dont think it is. also it is 1 degree F where this person is flying.

@mefistotelis
Copy link
Collaborator

mefistotelis commented Feb 10, 2017

i thought it was a different processor

It is. Processors which are not focused on computational power but on driving another hardware are called microcontrollers (uC).

also it is 1 degree F where this person is flying

I'm pretty sure that was the issue. If the battery had time to cool down below zero, it would definitely act strange. There is a thermal sensor which usually blocks the drone from starting in such case.

@GlovePuppet
Copy link

It's a TI MSP430 IIRC. I guess they are authenticating the battery via a handshake on the I2C bus.

@pawelsky
Copy link
Contributor

Communication with the battery is done via serial at 115200 baud and I've managed to simulate most of the communication (enough to start the motors) using an Arduino board.
https://www.youtube.com/watch?v=inKlEuTi9cA

But I agree with mefistotelis that it is not wroth spending much time on the battery firmware as the 3rd party alternatives are easily available and cheap enough.

@notsolowki
Copy link
Author

notsolowki commented May 22, 2017 via email

@pawelsky
Copy link
Contributor

No, as I said I don't want to spend time on it to make it "shareable", sorry. The 3rd party replacements are good and cheap enough now.

@notsolowki
Copy link
Author

notsolowki commented May 22, 2017 via email

@pawelsky
Copy link
Contributor

I was just about to start translating the description of the battery communication protocol into English, but seeing the attitude above I've really lost my motivation :(

Maybe some other time...

@notsolowki
Copy link
Author

Lost your motivation?

"No, as I said I don't want to spend time on it to make it "shareable", sorry."

OKAY

@pawelsky
Copy link
Contributor

You do understand a difference between "Arduino code" and "description of the communication protocol" right?

You are really not making yoursef any favours with that attitude...

@notsolowki
Copy link
Author

notsolowki commented May 23, 2017 via email

@notsolowki
Copy link
Author

notsolowki commented May 23, 2017 via email

@pawelsky
Copy link
Contributor

It is not just a handshake. It is continuous exchange of vital battery parameters (including voltages, discharge current, temperature, charge level, errors, etc.)

@notsolowki
Copy link
Author

notsolowki commented May 23, 2017

Well if you still willing to shRe the project with me that would be great. I think it would be alot of fun. I setup my battery to 115200 and was getting somthing but not sure what to make of it. Were you able to get any english fro. The console? Thanks

@ruckusman
Copy link

@pawelsky I'm late to this party, however I do have some questions you may be able to answer easily.

I'm looking to re-use Inspire battery boards with higher capacity cells, so need to reset the discharge counter as well as the capacity reductions that the processor calculates and stores, just wondering if you've succeeded in any communications with the TI MSP430 microcontroller via the TX/RX pads, not the I2C communications between the battery and controller.

Or if that's not the place to be looking for communication to acess the usage logs, can you suggest if I should access the I2C comms instead

@pawelsky
Copy link
Contributor

Never had Inspire battery in my hands. PH3 batteries communicate via UART, not I2C.

@ITANOSYS
Copy link

Sorry for digging up the post!
But: Same problem here. I have connected a 7000 mAh battery to the TB47 board.
It would be nice if I could "teach" the battery controller the new capacity. Is there a solution for this by now?

@0r10nV
Copy link

0r10nV commented Apr 23, 2019

@ITANOSYS
If that still to the point, you fisrt need to figure out which gauge IC is your Intelligent Flight Battery equipped with. For Phantom 3 and Mavic Pro it's bq30z55, for Mavic Air and Spark it's bq9000 with proprietary firmware. Both could be reprogrammed using ev2300 and bqEVSW of bqStudio software after unsealing and getting full access to IC programming interface.

@pawelsky
Copy link
Contributor

TB47 has BQ76930 + BQ78350

@0r10nV
Copy link

0r10nV commented Apr 24, 2019

Do you know which firmware version of bq78350?
bqStudio supports v0.05, v0.06 and v1.03 only in default setup.

@pawelsky
Copy link
Contributor

Unfortunately not :(

@0r10nV
Copy link

0r10nV commented Apr 24, 2019

Do you have good quality pictures of TB47 battery board?
If have, send me please to orionv76(at)gmail.com
Thanks!

@pawelsky
Copy link
Contributor

Here http://i.imgur.com/bjeAfxz.jpg

@0r10nV
Copy link

0r10nV commented Apr 25, 2019 via email

@pawelsky
Copy link
Contributor

Well, I do have EV2300, but...

...I don't have the TB47 board (the picture was found somewhere in the internet) :)

@0r10nV
Copy link

0r10nV commented May 12, 2019

pawelsky, did you emulate SHA1-HMAC authentication sequence over UART between arduino board and P3 drone when experimented in your lab setup without genuine smart battery?
Is it battery autentication involved in P3 anyway?

@pawelsky
Copy link
Contributor

No, it was not needed.

@0r10nV
Copy link

0r10nV commented May 15, 2021

so i need approx a 0,0027 for a 5200mah lihv... where can i found that ?

my calculation shows different value,
it's reverse proportion so larger capacity should use less resistance

3850mAh (factory) => 2 mOhms (4||4)
5200mAh (mod) => 2 * 3850/5200 => 0.00148 => 1.48 mOhms

It's roughly 1.5mOhms, exactly like in DJI P3 battery board, 2 pcs of 3mOhms in parallel, so if you have this pcb in spares you could take it out there.

But the best practice is to reprogram the chip to proper capacity then messing with shunt resistors.

@Manpreetbhatiaji
Copy link

IMG_20210522_193213_1
Hi, just a offshoot to the discussion. I had put a small lipo 800mah in parallel to the cell3 in Mavic air battery. The cell 3 was spoiled during a high drain discharge. Now I can fly this battery back. Lot of challenge thou. Seperately charging this lipo being 1

@svarteld
Copy link

Guys, want to say thank you for the guidance.

I've just flown the first two Inspire 1 TB47 batteries I've resoldered new cells into. Turns out DJI puts heatsinks between each cell, and also a spacer between every two for air circulation; I've redone the new ones the same way. Managed to not destroy the thermistor, so that one's still reporting temp. After a power cycle the BMS reports full 4500mAh from the new cells, and power graphs from flying looks perfectly normal, no deviations. Landing at 10% got me 16 min flying; so far, like a new TB47. I'll try TB48 cells next in some old TB47; got 8x of dead ones bought cheap.

Thanks again.

IMG_0304
IMG_0315
IMG_0310
Screenshot 2021-06-21 at 22 21 02
Screenshot 2021-06-21 at 22 21 19

@ciasteekk
Copy link

Hey,

any updates about unlocking spark battery?

@mefistotelis
Copy link
Collaborator

If I remember correctly, comm_sbs_bqctrl.py supports BQ40z307 in general, but it does not support clearing PFF2 flag. This hasn't changed.
Also, all updates in the code are tracked - this is what GIT is for. This means you can check what changed recently yourself.

@rokz12
Copy link

rokz12 commented Jun 23, 2021

Hi just wondering where are you located ?Did you have much trouble desoldering/remove old cells

@svarteld
Copy link

Hi just wondering where are you located ?Did you have much trouble desoldering/remove old cells

@rokz12 Sweden. No problems desoldering, just watch the thermistor, it's thin and fragile. Use thin metal strips to open batteries; needs to be thin metal under all plastic hooks before removing top white from black. Reuse heatsinks and spacers. Afterwards all just snaps together, looking like new. Good luck!

@rokz12
Copy link

rokz12 commented Jun 25, 2021 via email

@svarteld
Copy link

@rokz12 there's a company that makes refurbished TB47 and TB48; HeliEngadin. Any inspiration from them?

Regarding cells, I'd give HSABAT a try; Alibaba/Aliexpress. There's an option with 12 cells already soldered together with the top connection board to fit inside TB enclosures, so only a couple of wires to resolder for all those 400 units.

What brand will you be selling those under? Price idea?

@OlliDXD
Copy link

OlliDXD commented Jul 5, 2021

@rokz12 DJI cells are supplied by ATL, maybe you can get a bulk order from them.

@rokz12
Copy link

rokz12 commented Jul 5, 2021 via email

@svarteld
Copy link

svarteld commented Jul 6, 2021

@rokz12, if you'd like to sell some of your dead TB47/TB48 to me (like 5-10), I'm interested. Or perhaps I send one back to you to try, with new cells as a thank you? Cheers /P

@rokz12
Copy link

rokz12 commented Jul 6, 2021 via email

@svarteld
Copy link

svarteld commented Jul 6, 2021

@rokz12 Sweden (EU), Norrköping

Where are u located

@rokz12
Copy link

rokz12 commented Jul 6, 2021 via email

@svarteld
Copy link

svarteld commented Jul 6, 2021

If you remove cells it should be OK? Also light to ship. Easy after the first one's done, but still some work.

@OlliDXD
Copy link

OlliDXD commented Jul 6, 2021

@svarteld I've got a TB47 with 2 cells that won't wake up(most likely dried up) Linköping if you're up for it.

@svarteld
Copy link

svarteld commented Jul 6, 2021

@OlliDXD if it's cheap absolutely; 200 kr?

@OlliDXD
Copy link

OlliDXD commented Jul 6, 2021

@svarteld Do you have a preferred way of contact? I'd like to exchange a few words to double check a couple of things with ya.

@rokz12
Copy link

rokz12 commented Jul 6, 2021 via email

@svarteld
Copy link

svarteld commented Jul 6, 2021

@OlliDXD mail is fine; svarteld at gmail dot com.
@rokz12 no worries mate, totally fine; send a mail at the adress above if you'd like to discuss anything.

Thanks guys

@OlliDXD
Copy link

OlliDXD commented Jul 9, 2021

@svarteld sent you an email the other day

@svarteld
Copy link

@OlliDXD sorry, I've been in vacation mode here :-) Mail sent

@nospam2000
Copy link

nospam2000 commented May 22, 2022

@pawelsky

Communication with the [P3] battery is done via serial at 115200 baud

I'm a bit confused. The labels on my P3 battery (PH3-4480 mAh) connector-board are "SDA" and "SCL" (see attached picture) and are connected to testpoints on the main battery board using the same labels, therefore I thought the external connector would be using the SMBus (or i2c) protocol.
My battery main board matches the picture here in this thread and the wiki of this repo. My drone is a P3 SE.

According to the RC on the video you have a different P3 model than me, but I thought the batteries are the same for the whole P3 family, except that the one for the Pro can be charged faster.

Can you please shed some light into this topic? Do some P3 battery models use UART and others SMBus protocol to talk to the battery?

Phantom_3_battery_i2c_pins_board_small

@pawelsky
Copy link
Contributor

Can you please shed some light into this topic? Do some P3 battery models use UART and others SMBus protocol to talk to the battery?

The fact that the pins are labelled as I2C on PCB does not automatically make them I2C. Their function can be configured in software. To my knowledge all the P3 batteries are the same, but I did not follow the P3 market for a long time, so can't tell if anything changed over the years.

All I know is that I communicated with the P3 battery using serial @ 115200. The easies way to check if that is still the case is to connect a serial adapter to the TX wire and listen to the communication.

@hsiboy
Copy link

hsiboy commented Jun 3, 2022

Wow, this is one heck of a github "issue" thread 🤔

I think i've read every message here carefully, but did anyone find the unseal key for TB47/TB48?

I've re-celled several packs, but i need to recalibrate and of course, unseal to do so.

image
image

Cheers,

hsiboy

@wang909
Copy link

wang909 commented Feb 10, 2023

如果有人想要,第一步是查看电池板并确定所使用的微控制器。

然后可以使用合适的反汇编程序来查看代码。

I have a DJI T30 battery with only STM32L071CZT6 chip on it How to unlock the battery

@wang909
Copy link

wang909 commented Feb 10, 2023

你能明白这个话题吗?有些P3电池型号是否使用UART和其他SMBus协议与电池通信?

事实上,引脚在PCB上标记为I2C并不会自动使它们成为I2C。它们的功能可以在软件中配置。据我所知,所有的P3电池都是一样的,但我并没有P3鼎有鼎市场,所以无法判定这些年来是没有任何变化。

我所知道的是我使用串行@115200与P3池通信。检查是否仍然如此的简单方法是将串行适配器连接到TX线并收听。

I have a DJI T30 battery with only STM32L071CZT6 chip on it How to unlock the battery

@Shayansts
Copy link

Wow, this is one heck of a github "issue" thread 🤔

I think i've read every message here carefully, but did anyone find the unseal key for TB47/TB48?

I've re-celled several packs, but i need to recalibrate and of course, unseal to do so.

image image

Cheers,

hsiboy

Hello, where did you connect the ev2400 to the battery board?

@pawelsky
Copy link
Contributor

Hello, where did you connect the ev2400 to the battery board?

Did you try testpoints marked SMBC, SMBD and GND? :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests