o-gs / dji-firmware-tools

Tools for handling firmwares of DJI products, with focus on quadcopters.
GNU General Public License v3.0
1.44k stars 403 forks source link

DJI Mini2 Battery : how to clear [TCA] and [TDA] Alarm bits #327

Open Scratch-b opened 1 year ago

Scratch-b commented 1 year ago

Battery not charged - all leds flashing 3 times per second. I replace battery elements and when use this command:

$./comm_sbs_bqctrl.py -vvv --dev_address 0x0b -c BQ40z307 -b smbus:1 --short monitor StatusBits

Opening smbus:1 Importing comm_sbs_chips/BQ40z307.py Reading simple command at addr=0xb, cmd=0x3, type=uint16, opts={'subcmd': None} Raw BatteryMode response: 0x6001 BatteryMode: 0x6001 bitfields Battery modes and capabilities [ CapM=0][ ChgM=1][ AM=1][ Rsvd=0][ Rsvd=0][ Rsvd=0][ PB=0][ CC=0] [ CF=0][ Rsvd=0][ Rsvd=0][ Rsvd=0][ Rsvd=0][ Rsvd=0][ PBS=0][ ICC=1] Reading simple command at addr=0xb, cmd=0x16, type=uint16, opts={'subcmd': None} Raw BatteryStatus response: 0x48c0 BatteryStatus: 0x48c0 bitfields Battery's Alarm and Status bit flags [ OCA=0][ TCA=1][ ResD=0][ OTA=0][ TDA=1][ ResA=0][ RCA=0][ RTA=0] [ INIT=1][ DSG=1][ FC=0][ FD=0][ EC=0]

I think the problem is [ TCA=1] and [ TDA=1]. No problem to unseal BQ chip, but can't find how to clear this flags. Any help please

partinis commented 1 year ago

Hi mefistotelis, I'm currently facing a rather peculiar issue with one DJI Mini 2 battery. The PF flags are definitely off, the XCHG and XDSG on, and the battery isn't functioning - it blinks three times and stops. If you have any suggestions or advice regarding my battery issue, I would be grateful. Thank you in advance! BQStatusBitsMA: MA.SafetyAlert: 0x00000000 bitfields Safety Alert bits [ ResU=0][ ResT=0][ ResS=0][ ResR=0][ UTD=0][ UTC=0][PCHGC=0][ CHGV=0] [ CHGC=0][ OC=0][ CTOS=0][ CTO=0][ PTOS=0][ PTO=0][ ResH=0][ OTF=0] [ ResF=0][ CUVC=0][ OTD=0][ OTC=0][ASCDL=0][ ResA=0][ASCCL=0][ Res8=0] [AOLDL=0][ Res6=0][ OCD2=0][ OCD1=0][ OCC2=0][ OCC1=0][ COV=0][ CUV=0] MA.SafetyStatus: 0x00000000 bitfields Safety Status bits [ ResU=0][ ResT=0][ ResS=0][ ResR=0][ UTD=0][ UTC=0][PCHGC=0][ CHGV=0] [ CHGC=0][ OC=0][ ResK=0][ CTO=0][ ResI=0][ PTO=0][Res11=0][ OTF=0] [ ResF=0][ CUVC=0][ OTD=0][ OTC=0][ SCDL=0][ SCD=0][ SCCL=0][ SCC=0] [ OLDL=0][ OLD=0][ OCD2=0][ OCD1=0][ OCC2=0][ OCC1=0][ COV=0][ CUV=0] MA.PFAlert: 0x00000000 bitfields Permanent Fail Alert bits [ TS4=0][ TS3=0][ TS2=0][ TS1=0][ ResQ=0][ ResP=0][OCECO=0][ ResN=0] [ ResM=0][ 2LVL=0][ AFEC=0][ AFER=0][ FUSE=0][ ResI=0][DFETF=0][CFETF=0] [ ResF=0][ ResE=0][ ResD=0][ VIMA=0][ VIMR=0][ CD=0][ IMP=0][ CB=0] [ QIM=0][ SOTF=0][ Res5=0][ SOT=0][ SOCD=0][ SOCC=0][ SOV=0][ SUV=0] MA.PFStatus: 0x00000000 bitfields Permanent Fail Status bits [ TS4=0][ TS3=0][ TS2=0][ TS1=0][ ResQ=0][ DFW=0][OCECO=0][ IFC=0] [ PTC=0][ 2LVL=0][ AFEC=0][ AFER=0][ FUSE=0][ ResI=0][DFETF=0][CFETF=0] [ ResF=0][ ResE=0][ ResD=0][ VIMA=0][ VIMR=0][ CD=0][ IMP=0][ CB=0] [ QIM=0][ SOTF=0][ Res5=0][ SOT=0][ SOCD=0][ SOCC=0][ SOV=0][ SUV=0] MA.OperationStatus: 0x00006300 bitfields Operational Status bits [ ResU=0][ ResT=0][EMSHT=0][ CB=0][SLPCC=0][SLPAD=0][SLCAL=0][ INIT=0] [SLEPM=0][ XL=0][CALOO=0][CALOC=0][ACALM=0][ AUTH=0][ LED=0][ SDM=0] [SLEEP=0][ XCHG=1][ XDSG=1][ PF=0][ SS=0][ SDV=0][ SEC=3] [ BTPI=0][SMOTH=0][ FUSE=0][ Res4=0][ PCHG=0][ CHG=0][ DSG=0][ PRES=0] MA.ChargingStatus: 0x0408 bitfields Charging Status bits [ VCT=0][ MCHG=0][ SU=0][ IN=0][ HV=0][ MV=1][ LV=0][ PV=0] [ Res7=0][ OT=0][ HT=0][ STH=0][ RT=1][ STL=0][ LT=0][ UT=0] MA.GaugingStatus: 0x081455 bitfields Gauging Status bits [ ResN=0][ ResM=0][ ResL=0][OCVFR=0][ LDMD=1][ RX=0][ QMax=0][ VDQ=0] [ NSFM=0][ ResE=0][SLPQMx=0][ QEN=1][ VOK=0][R_DIS=1][ Res9=0][ REST=0] [ CF=0][ DSG=1][ EDV=0][BAL_EN=1][ TCA=0][ TD=1][ FC=0][ FD=1] MA.ManufacturingStatus: 0x0028 bitfields Manufacturing Status bits [CALTS=0][LT_TS=0][ ResD=0][ ResC=0][ ResB=0][ ResA=0][ LED=0][ FUSE=0] [ BBR=0][ PF=0][ LF=1][ FET=0][GAUGE=1][ DSG=0][ CHG=0][ PCHG=0]

mefistotelis commented 1 year ago

Not going to analyze your bit list, sorry.

But if PF is cleared, and the battery still behaves like it has one set - it's likely that the DJI-specific PF2 flag is set. I don't have an implementation of clearing that in my tool, but the "Battery Killer" should be able to clear that.

waheedi commented 5 months ago

Hello folks,

I hope you are doing well. And I would like to thank @mefistotelis for this nice tool, I actually happened to have a laptop with this chip used as the battery manager, and have the same problem after successfully unsealing and then fullaccess i have managed to get into the step where i clear my PF, which had only one failure bit which is the CUV one. After PF reset all bits were cleared. (UPDATE: except the bit at PTC_BY_AFE was still active after a reset which was actually the main problem) Now as far as I can see the BatteryStatus bits are not writable and you cant change it directly with a command, but rather you would need to flash a new flashdata into the chip with these TDA and TCA set to 0.

But I'm just guessing so you may try that if you know how or wait until someone else do it :)

Here is one interesting finding, while im monitoring BatteryStatus and OperationStatus I plugged the two cells directly to a 4v power supply each cell is reading 3.6v at the moment after doing that:

The Battery Status changed from:

Raw BatteryStatus response: c0 4a c2
BatteryStatus:  0x4ac0  bitfields       Battery's Alarm and Status bit flags
                ERROR_CODE:     0=OK    [EC]    Function error code
          FULLY_DISCHARGED:     0=Not fully     [FD]    Battery capacity is depleted
             FULLY_CHARGED:     0=Not fully     [FC]    Battery is full
               DISCHARGING:     1=Yes   [DSG]   Battery is discharging
               INITIALIZED:     1=Recalibrate   [INIT]  State of calibration/configuration
      REMAINING_TIME_ALARM:     0=Inactive      [RTA]   Remaining time to depletion alarm tripped
  REMAINING_CAPACITY_ALARM:     1=Active        [RCA]   Remaining capacity alarm tripped
 TERMINATE_DISCHARGE_ALARM:     1=Active        [TDA]   Battery capacity is depleted
     OVERTEMPERATURE_ALARM:     0=Inactive      [OTA]   Temperature is above pre-set limit
    TERMINATE_CHARGE_ALARM:     1=Active        [TCA]   Charging should be suspended
        OVER_CHARGED_ALARM:     0=Inactive      [OCA]   Battery is fully charged

To this:


Opening i2c:7
Importing comm_sbs_chips/BQ30z554.py
Reading simple command at addr=0xb, cmd=0x16, type=uint16, opts={'subcmd': None}
Raw BatteryStatus response: 80 48 97
BatteryStatus:  0x4880  bitfields       Battery's Alarm and Status bit flags
                ERROR_CODE:     0=OK    [EC]    Function error code
          FULLY_DISCHARGED:     0=Not fully     [FD]    Battery capacity is depleted
             FULLY_CHARGED:     0=Not fully     [FC]    Battery is full
               DISCHARGING:     0=No    [DSG]   Battery is discharging
               INITIALIZED:     1=Recalibrate   [INIT]  State of calibration/configuration
      REMAINING_TIME_ALARM:     0=Inactive      [RTA]   Remaining time to depletion alarm tripped
  REMAINING_CAPACITY_ALARM:     0=Inactive      [RCA]   Remaining capacity alarm tripped
 TERMINATE_DISCHARGE_ALARM:     1=Active        [TDA]   Battery capacity is depleted
     OVERTEMPERATURE_ALARM:     0=Inactive      [OTA]   Temperature is above pre-set limit
    TERMINATE_CHARGE_ALARM:     1=Active        [TCA]   Charging should be suspended
        OVER_CHARGED_ALARM:     0=Inactive      [OCA]   Battery is fully charged

and also OperationStatus before feeding it with some nice voltage was (after FullAccess ofcourse ):

./comm_sbs_bqctrl.py -vvv --bus "i2c:7" -a 0xb -c BQ30z55 read OperationStatus
Opening i2c:7
Importing comm_sbs_chips/BQ30z554.py
Reading simple command at addr=0xb, cmd=0x54, type=uint32_blk, opts={'subcmd': None}
Raw OperationStatus response: 04 21 71 10 00 f3
OperationStatus:        0x00107121      bitfields       Operational Status bits
      SYS_PRESENT_LOW:  1=Active        [PRES]  System present input state low
       DSG_FET_STATUS:  0=Inactive      [DSG]   DSG FET status
       CHG_FET_STATUS:  0=Inactive      [CHG]   CHG FET Status
      PCHG_FET_STATUS:  0=Inactive      [PCHG]  PCHG FET Status
      GPOD_FET_STATUS:  0=Inactive      [GPOD]  GPOD FET Status
          FUSE_STATUS:  1=Active        [FUSE]  FUSE input status
       CELL_BALANCING:  0=Inactive      [CB]    Cell Balancing
           LED_ENABLE:  0=Inactive      [LED]   LED Enable
        SECURITY_MODE:  1=Full Access   [SEC]   Security Mode
       CAL_RAW_ADC_CC:  0=Inactive      [CAL]   Calibration Raw ADC/CC output active
        SAFETY_STATUS:  0=Inactive      [SS]    Safety Status
    PERMANENT_FAILURE:  1=Active        [PF]    Permanent Failure
 DISCHARGING_DISABLED:  1=Active        [XDSG]  Discharging Disabled
    CHARGING_DISABLED:  1=Active        [XCHG]  Charging Disabled
           SLEEP_MODE:  0=Inactive      [SLEEP] Sleep mode condition met
       SHUTDOWN_BY_MA:  0=Inactive      [SDM]   Shutdown activated by ManufacturerAccess()
      SHIP_MODE_BY_MA:  0=Inactive      [SHPM]  SHIP mode activated with ManufacturerAccess()
         AUTH_ONGOING:  0=Inactive      [AUTH]  Authentication ongoing
    AFE_WATCHDOG_FAIL:  0=Inactive      [AWD]   AFE Watchdog failure
    FAST_VOLTAGE_SAMP:  1=Active        [FVS]   Fast Voltage Sampling
    RAW_ADC_CC_OUTPUT:  0=Inactive      [CALO]  Raw ADC/CC offset calibration output
  SHUTDOWN_BY_VOLTAGE:  0=Inactive      [SDV]   SHUTDOWN activated by voltage
          SLEEP_BY_MA:  0=Inactive      [SLEPM] SLEEP mode activated by ManufacturerAccess()
     INIT_AFTER_RESET:  0=Inactive      [INIT]  Initialization after full reset
       SMB_CAL_ON_LOW:  0=Cal starts    [SLCAL] Auto CC offset calibration on low
 QMAX_UPDATE_IN_SLEEP:  0=Inactive      [SLEPQM]        QMax update in SLEEP mode
 CURRENT_CHK_IN_SLEEP:  0=Inactive      [SLEPC] Checking current in SLEEP mode
     XLOW_SPEED_STATE:  0=Inactive      [XLSBS] Fast Mode

and then after voltage bumping:

OperationStatus:        0x00105161      bitfields       Operational Status bits
      SYS_PRESENT_LOW:  1=Active        [PRES]  System present input state low
       DSG_FET_STATUS:  0=Inactive      [DSG]   DSG FET status
       CHG_FET_STATUS:  0=Inactive      [CHG]   CHG FET Status
      PCHG_FET_STATUS:  0=Inactive      [PCHG]  PCHG FET Status
      GPOD_FET_STATUS:  0=Inactive      [GPOD]  GPOD FET Status
          FUSE_STATUS:  1=Active        [FUSE]  FUSE input status
       CELL_BALANCING:  1=Active        [CB]    Cell Balancing
           LED_ENABLE:  0=Inactive      [LED]   LED Enable
        SECURITY_MODE:  1=Full Access   [SEC]   Security Mode
       CAL_RAW_ADC_CC:  0=Inactive      [CAL]   Calibration Raw ADC/CC output active
        SAFETY_STATUS:  0=Inactive      [SS]    Safety Status
    PERMANENT_FAILURE:  1=Active        [PF]    Permanent Failure
 DISCHARGING_DISABLED:  0=Inactive      [XDSG]  Discharging Disabled
    CHARGING_DISABLED:  1=Active        [XCHG]  Charging Disabled
           SLEEP_MODE:  0=Inactive      [SLEEP] Sleep mode condition met
       SHUTDOWN_BY_MA:  0=Inactive      [SDM]   Shutdown activated by ManufacturerAccess()
      SHIP_MODE_BY_MA:  0=Inactive      [SHPM]  SHIP mode activated with ManufacturerAccess()
         AUTH_ONGOING:  0=Inactive      [AUTH]  Authentication ongoing
    AFE_WATCHDOG_FAIL:  0=Inactive      [AWD]   AFE Watchdog failure
    FAST_VOLTAGE_SAMP:  1=Active        [FVS]   Fast Voltage Sampling
    RAW_ADC_CC_OUTPUT:  0=Inactive      [CALO]  Raw ADC/CC offset calibration output
  SHUTDOWN_BY_VOLTAGE:  0=Inactive      [SDV]   SHUTDOWN activated by voltage
          SLEEP_BY_MA:  0=Inactive      [SLEPM] SLEEP mode activated by ManufacturerAccess()
     INIT_AFTER_RESET:  0=Inactive      [INIT]  Initialization after full reset
       SMB_CAL_ON_LOW:  0=Cal starts    [SLCAL] Auto CC offset calibration on low
 QMAX_UPDATE_IN_SLEEP:  0=Inactive      [SLEPQM]        QMax update in SLEEP mode
 CURRENT_CHK_IN_SLEEP:  0=Inactive      [SLEPC] Checking current in SLEEP mode
     XLOW_SPEED_STATE:  0=Inactive      [XLSBS] Fast Mode

So if you want you can try to bump it with some volts and see these bits change in real time :) I hope this helps someone with the same issue

Here is my latest progress (I got my laptop battery to life again, thanks again man):

OperationStatus:        0x00000107      bitfields       Operational Status bits
      SYS_PRESENT_LOW:  1=Active        [PRES]  System present input state low
       DSG_FET_STATUS:  1=Active        [DSG]   DSG FET status
       CHG_FET_STATUS:  1=Active        [CHG]   CHG FET Status
      PCHG_FET_STATUS:  0=Inactive      [PCHG]  PCHG FET Status
      GPOD_FET_STATUS:  0=Inactive      [GPOD]  GPOD FET Status
          FUSE_STATUS:  0=Inactive      [FUSE]  FUSE input status
       CELL_BALANCING:  0=Inactive      [CB]    Cell Balancing
           LED_ENABLE:  0=Inactive      [LED]   LED Enable
        SECURITY_MODE:  1=Full Access   [SEC]   Security Mode
       CAL_RAW_ADC_CC:  0=Inactive      [CAL]   Calibration Raw ADC/CC output active
        SAFETY_STATUS:  0=Inactive      [SS]    Safety Status
    PERMANENT_FAILURE:  0=Inactive      [PF]    Permanent Failure
 DISCHARGING_DISABLED:  0=Inactive      [XDSG]  Discharging Disabled
    CHARGING_DISABLED:  0=Inactive      [XCHG]  Charging Disabled
           SLEEP_MODE:  0=Inactive      [SLEEP] Sleep mode condition met
       SHUTDOWN_BY_MA:  0=Inactive      [SDM]   Shutdown activated by ManufacturerAccess()
      SHIP_MODE_BY_MA:  0=Inactive      [SHPM]  SHIP mode activated with ManufacturerAccess()
         AUTH_ONGOING:  0=Inactive      [AUTH]  Authentication ongoing
    AFE_WATCHDOG_FAIL:  0=Inactive      [AWD]   AFE Watchdog failure
    FAST_VOLTAGE_SAMP:  0=Inactive      [FVS]   Fast Voltage Sampling
    RAW_ADC_CC_OUTPUT:  0=Inactive      [CALO]  Raw ADC/CC offset calibration output
  SHUTDOWN_BY_VOLTAGE:  0=Inactive      [SDV]   SHUTDOWN activated by voltage
          SLEEP_BY_MA:  0=Inactive      [SLEPM] SLEEP mode activated by ManufacturerAccess()
     INIT_AFTER_RESET:  0=Inactive      [INIT]  Initialization after full reset
       SMB_CAL_ON_LOW:  0=Cal starts    [SLCAL] Auto CC offset calibration on low
 QMAX_UPDATE_IN_SLEEP:  0=Inactive      [SLEPQM]        QMax update in SLEEP mode
 CURRENT_CHK_IN_SLEEP:  0=Inactive      [SLEPC] Checking current in SLEEP mode
     XLOW_SPEED_STATE:  0=Inactive      [XLSBS] Fast Mode

If anyone have problems with this, share your PFStatus, it should look like this, after a reset, if not share it...

./comm_sbs_bqctrl.py -vvv --bus "i2c:7" -a 0xb -c BQ30z55  read PFStatus
Opening i2c:7
Importing comm_sbs_chips/BQ30z554.py
Reading simple command at addr=0xb, cmd=0x53, type=uint32_blk, opts={'subcmd': None}
Raw PFStatus response: 04 00 00 00 00 63
PFStatus:       0x00000000      bitfields       Permanent Failure Status bits
      CELL_UNDERVOLTAGE:        0=Inactive      [CUV]   Cell Undervoltage
       CELL_OVERVOLTAGE:        0=Inactive      [COV]   Cell Overvoltage
      COPPER_DEPOSITION:        0=Inactive      [CUDEP] Copper deposition
        OVERTEMPERATURE:        0=Inactive      [OTCE]  Overtemperature in charge
    OVERTEMPERATURE_FET:        0=Inactive      [OTF]   Overtemperature of FET
         QMAX_IMBALANCE:        0=Inactive      [QIM]   QMAX Imbalance
         CELL_BALANCING:        0=Inactive      [CB]    Cell balancing
         CELL_IMPEDANCE:        0=Inactive      [IMP]   Cell impedance
 CAPACITY_DETERIORATION:        0=Inactive      [CD]    Capacity Deterioration
 VOLTAGE_IMBALANCE_REST:        0=Inactive      [VIMR]  Voltage imbalance at Rest
 VOLTAGE_IMBALANCE_ACTV:        0=Inactive      [VIMA]  Voltage imbalance at Active
             CHARGE_FET:        0=Inactive      [CFETF] Charge FET
          DISCHARGE_FET:        0=Inactive      [DFET]  Discharge FET
             THERMISTOR:        0=Inactive      [THERM] Thermistor
                   FUSE:        0=Inactive      [FUSE]  Value of the FUSE pin, designed to ignite the chemical fuse if one of the various safety criteria is violated
           AFE_REGISTER:        0=Not avail.    [AFER]  AFE Register
      AFE_COMMUNICATION:        0=Inactive      [AFEC]  AFE Communication
 FUSE_TRIGGER_2ND_LEVEL:        0=Inactive      [2LVL]  FUSE input trigger by external protection
             PTC_BY_AFE:        0=Inactive      [PTC]   Detected overtemperature using Positive Temperature Coefficient resistor connected to AFE PTC pin