Lsi ibbu07 - Altering hex code to replace defective battery and replacing Ibm5015 heatsink

Discussion in 'RAID Controllers and Host Bus Adapters' started by Twist, Feb 1, 2016.

  1. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Hi

    I have been working on modifying the hex code for the ibbu07 raid battery to be able to replace defective battery with new instead of buying a new Lsi pack at the price of 230$ here in Norway.

    [​IMG]
    Here I have replaced U4 with new hexcode, U4 is a regular 24lc01B.

    [​IMG]
    New Samsung ICP103450S battery fitted removed from a new Dell Perc6 battery module.

    [​IMG]
    Here I have replaced hex code and the battery with 2000mAh , as you can see design capacity is 1800mAh which is 10% derated. Orginal battery I'm sure you now is 1215mAh if your module is fitted with Sony US503759 a8h but full capacity is 1350mAh also 10% derated.
    I also changed date of manufacture just for fun, clock 22.40.53 is not stored in eeprom but copied from the computer when smbus was accessed.
    Manufacturer and serialnumber is as orginal, completed discharge cycles I resetted to have a fresh start.

    [​IMG]

    This if the modified code I used for the 1800mAh setup above except for 0x3F that I changed to 64 and seals the eeprom.

    [​IMG]
    At first I did keep 0x3F at 24 but doing that Lsi has a built in code in msm or fw that replaces alot of alterations as you can see. It only happens when battery is fully charged at 100% and 4100mV.

    [​IMG]
    Here Megaraid storage manager or raid card fw replaced some of my alternations.


    Code:
    ID = 148
    SEQUENCE NUMBER = 343
    TIME = 16-01-2016 23:45:31
    LOCALIZED MESSAGE = Controller ID:  0   Battery is discharging
    
    ID = 113
    SEQUENCE NUMBER = 342
    TIME = 16-01-2016 23:44:31
    LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:0Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x31 0x10 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00
    
    ID = 113
    SEQUENCE NUMBER = 341
    TIME = 16-01-2016 23:44:31
    LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:1Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x92 0x40 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00
    
    ID = 113
    SEQUENCE NUMBER = 340
    TIME = 16-01-2016 23:44:30
    LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:0Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x30 0x30 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00
    
    ID = 113
    SEQUENCE NUMBER = 339
    TIME = 16-01-2016 23:44:30
    LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:1Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x91 0x20 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00
    
    ID = 268
    SEQUENCE NUMBER = 338
    TIME = 16-01-2016 23:44:30
    LOCALIZED MESSAGE = Controller ID:  0  PD Reset:   PD       =   -:-:1,   Critical       =   3,   Path   =       0x4433221102000000
    
    ID = 268
    SEQUENCE NUMBER = 337
    TIME = 16-01-2016 23:44:30
    LOCALIZED MESSAGE = Controller ID:  0  PD Reset:   PD       =   -:-:0,   Critical       =   3,   Path   =       0x4433221103000000
    
    ID = 151
    SEQUENCE NUMBER = 336
    TIME = 16-01-2016 23:44:30
    LOCALIZED MESSAGE = Controller ID:  0   Battery relearn started
    
    ID = 267
    SEQUENCE NUMBER = 335
    TIME = 16-01-2016 23:44:28
    LOCALIZED MESSAGE = Controller ID:  0  Command timeout on PD:   PD       =   -:-:1No addtional sense information,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x91 0x10 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =   ,   Path   =       0x4433221102000000
    
    ID = 267
    SEQUENCE NUMBER = 334
    TIME = 16-01-2016 23:44:28
    LOCALIZED MESSAGE = Controller ID:  0  Command timeout on PD:   PD       =   -:-:0No addtional sense information,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x30 0x20 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =   ,   Path   =       0x4433221103000000
    
    ID = 242
    SEQUENCE NUMBER = 333
    TIME = 16-01-2016 23:44:16
    LOCALIZED MESSAGE = Controller ID:  0   Battery charge complete
    When Lsi fw or msm noticed an unseal eeprom log also comes up with a few errors, later this weekend the log is not showing any errors with the new code.

    [​IMG]
    For those of you that is using a Lsi ibbu07 I hope you can check something for me. As you can see from picture above I have finished a battery relearn and battery is charging but stops at 49% and battery status is 'Optimal'

    Not sure if it is a problem with my hex code or normal feature of this software but can you check your software and report back at what capacity your battery charging stops ? pictures showing both properties and advanced properties just as picture above is more then welcome -serial number and manufacturer I don't need to see so feel free to paint over.

    Data I need is voltage, design and full capacity, remaining capacity and charge %.

    After fitting this battery I now regret using this big capacity - charging takes many many hours but I'm sure data retention time is awesome.

    Also yesterday I made a new post in the want to buy thread, I'm looking for a Lsi ibbu08 pack with swollen/defective battery to see ibbu08 code and see what charge controller it uses.
    If you have one let me know - link
     
    #1
    Last edited: Feb 1, 2016
    Patrick, Chuckleb and Dk3 like this.
  2. chinesestunna

    chinesestunna Active Member

    Joined:
    Jan 23, 2015
    Messages:
    516
    Likes Received:
    102
    @Twist awesome job and great way to recycle some hardware :)
     
    #2
  3. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Thanks - been wondering why no one have tried this as it is a quick way of saving a few $ and as you say it is a great way to recycle hardware.
    Did get a lot of help doing this so won't take all the glory my self and I'm not completely done yet either.

    Again, if anyone have a ibbu07 in use please check your setup, data I need is voltage, design and full capacity, remaining capacity and charge %.
     
    #3
  4. ChrisMunich

    ChrisMunich New Member

    Joined:
    Feb 14, 2016
    Messages:
    3
    Likes Received:
    0
    Hi Twist,

    i am Chris from Germany! Sorry my english is not very good, but i will try.
    I've seen your post here and tried the same. Unsealing the eeprom etc. My problem now, the same like yours. 23% state charging.
    Charging current 0 mA. I am trying on the iBBU07 for 3 weeks now and i know, the higher the Remaining Charge is, the lower the current charging.
    I try to change the Pre-Charge Current now to 500-600 mA now, i will tell u if i am successful.

    Sorry for my real bad english!
     
    #4
  5. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Hi Chris

    What kind of battery did you use and did you use the hex code I posted ? any changes to the code ?
    Can you post a picture from megaraid manager so I can see the battery data just as my picture above ?

    It is normal for charging current to be lower the higher the battery charge is.
     
    #5
  6. ChrisMunich

    ChrisMunich New Member

    Joined:
    Feb 14, 2016
    Messages:
    3
    Likes Received:
    0
    Hi Twist,

    sorry for answering so late....i got a fight with my iBBU07´s. I have 30 old ones and one new....first of all i connected the small interface card to my EV2200 from Technical Instruments. In the EV2200-60 Software the message "bq2060 ist sealed". I unsealed the EEPROM (u4) so i can read and change the values with the EV2200-60 Software. First i used the values from your screens, but i had the same problem like you. Then i began to change some values and as result nothing works....Battery Pack present, but no charge/discharge neither in the controller cli, nor in the storage manager in windows. I wanted to burn this shit!!! :)
    So now i have a new one in my server and i think i got the problem.
    I read and write on the U4 EEPROM while using an external powersupply with 4.1V.
    After nothing works i took a real new iBBU07 and read it with Battery on the Small Board. Now in EV2200-60 Software under the Tab "Calibration" he displays LION with 4 Cells. I took my old iBBU07 (where i use the external Powersupply and not the Battery) and he told my that it is a NI Akku with 0 Cells!!!!!
    In EV2200-60 Software i stored the EEPROM from my new iBBU07 and load it to my old one. Now it is in my Server and charges....If i know more i will tell you!!!

    P.S.: I used the original Battery that is built in the iBBU07 P/N: US503759 A8H
     
    #6
  7. ChrisMunich

    ChrisMunich New Member

    Joined:
    Feb 14, 2016
    Messages:
    3
    Likes Received:
    0
    Ok i found it! You need to burn the EEPROM (U4) with see the eeprom neu.txt then it seems to work
     

    Attached Files:

    #7
  8. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    I don't understand what you are trying to achieve, you can't use the values I used if your battery don't have the same capacity as the Samsung battery in my battery pack.

    Also, if several of your eeprom dumps displays lion with 4 cells or has any other device chemistry you have problems accessing the eeprom and have corrupted files - never charge a lion using other device chemistry settings.

    What do you mean by 23% state charging ? does you battery charge up to 23% and stop ?
    Pre-charge current is just the first mode before it switches to fast charging (512mA), it's for deeply depleted batteries.
    If you battery stops charging at 23% altering pre-charge won't help you.

    Your file is basically for a battery of 1215mAh that has a cycle count of 4 and now has been derated to 1139mAh, it's the standard for a ibbu007 and yes it will work as it is unaltered and remaining in an original state.
    These settings won't work for a 1800mAh battery if it is that you are using.

    Are these setting for a Sony US503759 a8h or a another type of battery ?
     
    #8
  9. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
    I am enjoying the discussion on this topic.
    Are there pin-outs and interface information for the Lsi ibbu07.
    How is the battery and the memory accessed?
    Is there any diagnostic software for the battery and and the TI bq2060A controller?
    Why wouldn't a direct replacement of the Sony US503759 work without all the software reprogramming?
     
    #9
  10. razvanc.mobile

    Joined:
    Apr 2, 2015
    Messages:
    48
    Likes Received:
    1
    Numbers below 100% are normal for these BBU's. I read somewhere that the controller charges the battery only enough to hold data for 48hours. I think new batteries hold at about 60-70%, which would explain your 49%@1800 mah max.
     
    #10
  11. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Hi Walter1604


    Since not playing with pinout I'm not sure but the Dell Perc6 module that uses the same plug and wire might have the same pinout.Opposite the plug pinout is marked - Data,Clock,-,T and +

    [​IMG]

    The bbu uses smbus to communicate with raid card, I haven't used smbus to communicate with the eeprom myself as the eeprom is sealed. Sealing the eeprom restrict access to eeprom register functions - that why I lifted the eeprom.

    You can download software and datasheet from Ti here
    I'm not aware of any test hw or tools other then Ti's evaluation kit - if you just need to test battery capacity just get a charger and load - look further down.

    A direct replacement of the Sony US503759 a8h will work just fine but since I don't have any new or found a trustworthy seller I instead altered the code to use the Perc6 battery I already had.
    Replacing the battery without altering code might also work, I just don't know if the controller is able to count the last measured discharge backwards.

    Yes I notied that too - the battery gets charged up to around 970mAh regardless of battery capacity, had the fw instead been based on battery charge percentage we could utilize the bigger battery.

    Because of that I'm now playing with these Htc phone cells, got 30 of them from phones that was spares and almost unused. They are 1200mAh so they are close enough and fit inside the 07 cover on it's side.
    Made a small test rig to test and make sure all are in spec.

    [​IMG]
    [​IMG]
    The phones logic boards has been cleaned for parts and I just use the phone and battery spring contacts as a 'hot swap' rig for testing batteries. Also, the charger from ebay fitted is not used anymore as it terminated at 4.240V. Found out that it is a fake chip - link

    I have also had a look at the heatsink on the 5015 I use, it's way to ineffective for use in a regular desktop with quiet fans and idle at 58-62C. Took a almost 3x bigger heatsink and modified it to fit.

    [​IMG]

    [​IMG]
    Old ati card, just need the heatsink.
    [​IMG]
    These needs to be removed to have a smooth surface.

    [​IMG]
    [​IMG]
    [​IMG]
    [​IMG]
    Made room for the beeper in the heatsink,nicely done.
    [​IMG]
    [​IMG]
    With bigger heatsink and fan fitted I guess I will see better temperatures.
    [​IMG]
    Smaller standard heatsink comparison.
     
    #11
    pgh5278 likes this.
  12. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
    Twist

    you say > The bbu uses smbus to communicate with raid card, I haven't used smbus to communicate with the eeprom myself as the eeprom is sealed. Sealing the eeprom restrict access to eeprom register functions - that why I lifted the eeprom.

    what is lifted mean that you desoldered the EEPROM from the card?

    How are you programming and unsealing the new EEPROM ?

    You show a picture on the EV2200-60 software - How is that accessed to the BBU

    I'm so confused what hardware and software are you using in this demonstration?
     
    #12
  13. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Yes, lifted means I desoldered eeprom - I'm programming it using an Xeltek programmer but any programmer supporting 24lc01b will do.
    Dave @ eevblog did a review of a cheap China programmer that might do - link , it's also hackable so look at the eevblog forum.

    When in programmer it does not matter if chip is sealed - you can read & write any address how many times you want.

    The Ev2200-60 software is not accessed by the bbu but only the eeprom bin file converted to txt file, same type txt as ChrisMunich uploaded further up in this thread.

    This is not that difficult, just take you time to read bq2060 datasheet to make sure your math is correct to your battery and if your unsure you can make a new txt file in Ev2200 to see what it should look like in hex format.
     
    #13
    Chuntzu likes this.
  14. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
  15. Twist

    Twist Member

    Joined:
    Oct 15, 2015
    Messages:
    59
    Likes Received:
    29
    Yes, saw that homepage earlier when searching for batteries before I got the Htc stock.

    Their 1350mAh batteries was a little to big to fit in the carrier as the Sony battery was 54x36x5mm
     
    #15
  16. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
  17. razvanc.mobile

    Joined:
    Apr 2, 2015
    Messages:
    48
    Likes Received:
    1
    i went a different way to replace batteries. i used 1500 mah batteries that come with a small connector instead. much easier to replace when needed.

    [​IMG]
     
    #17
  18. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
    nice work Razvac

    Would you please post you data from the card

    Thank you
     
    #18
  19. Terry Kennedy

    Terry Kennedy Well-Known Member

    Joined:
    Jun 25, 2015
    Messages:
    1,021
    Likes Received:
    474
    I would never trust a 2-wire remote LiPo battery in an application like this unless I knew what internal safeguards were in place and working. The Dell versions of the LSI battery pack (NU209, FR463, etc.) use a rigid-cased Li-ion battery with a thermistor (thermal probe) bonded to the battery.
     
    #19
  20. Walter1604

    Walter1604 New Member

    Joined:
    Mar 17, 2016
    Messages:
    7
    Likes Received:
    0
    It is not a matter of trust, but a matter of completely destroying the control and safety functions of the TI BQ2060

    Please note: that the temperature of the battery is a critical component of the system
    The bq2060A internal charge control is compatible with popular rechargeable chemistries. The primary
    charge-termination techniques include a change in temperature over a change in time (ΔT/Δt) and current taper,
    for nickel-based and Li-ion chemistries, respectively. The bq2060A also provides pre-charge qualification and a
    number of safety charge suspensions based on current, voltage, temperature, and state of charge
     
    #20
Similar Threads: ibbu07 Altering
Forum Title Date
RAID Controllers and Host Bus Adapters Are cards that can use LSIiBBU07 compatible with LSIiBBU08? Aug 11, 2015

Share This Page