Lsi ibbu07 - Altering hex code to replace defective battery and replacing Ibm5015 heatsink

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
Hi

I have been working on modifying the hex code for the ibbu07 raid battery to be able to replace defective battery with new instead of buying a new Lsi pack at the price of 230$ here in Norway.


Here I have replaced U4 with new hexcode, U4 is a regular 24lc01B.


New Samsung ICP103450S battery fitted removed from a new Dell Perc6 battery module.


Here I have replaced hex code and the battery with 2000mAh , as you can see design capacity is 1800mAh which is 10% derated. Orginal battery I'm sure you now is 1215mAh if your module is fitted with Sony US503759 a8h but full capacity is 1350mAh also 10% derated.
I also changed date of manufacture just for fun, clock 22.40.53 is not stored in eeprom but copied from the computer when smbus was accessed.
Manufacturer and serialnumber is as orginal, completed discharge cycles I resetted to have a fresh start.



This if the modified code I used for the 1800mAh setup above except for 0x3F that I changed to 64 and seals the eeprom.


At first I did keep 0x3F at 24 but doing that Lsi has a built in code in msm or fw that replaces alot of alterations as you can see. It only happens when battery is fully charged at 100% and 4100mV.


Here Megaraid storage manager or raid card fw replaced some of my alternations.


Code:
ID = 148
SEQUENCE NUMBER = 343
TIME = 16-01-2016 23:45:31
LOCALIZED MESSAGE = Controller ID:  0   Battery is discharging

ID = 113
SEQUENCE NUMBER = 342
TIME = 16-01-2016 23:44:31
LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:0Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x31 0x10 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00

ID = 113
SEQUENCE NUMBER = 341
TIME = 16-01-2016 23:44:31
LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:1Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x92 0x40 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00

ID = 113
SEQUENCE NUMBER = 340
TIME = 16-01-2016 23:44:30
LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:0Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x30 0x30 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00

ID = 113
SEQUENCE NUMBER = 339
TIME = 16-01-2016 23:44:30
LOCALIZED MESSAGE = Controller ID:  0   Unexpected sense:   PD       =   -:-:1Power on, reset, or bus device reset occurred,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x91 0x20 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =    0x70 0x00 0x06 0x00 0x00 0x00 0x00 0x0a 0x00 0x00 0x00 0x00 0x29 0x00 0x00 0x00 0x00 0x00

ID = 268
SEQUENCE NUMBER = 338
TIME = 16-01-2016 23:44:30
LOCALIZED MESSAGE = Controller ID:  0  PD Reset:   PD       =   -:-:1,   Critical       =   3,   Path   =       0x4433221102000000

ID = 268
SEQUENCE NUMBER = 337
TIME = 16-01-2016 23:44:30
LOCALIZED MESSAGE = Controller ID:  0  PD Reset:   PD       =   -:-:0,   Critical       =   3,   Path   =       0x4433221103000000

ID = 151
SEQUENCE NUMBER = 336
TIME = 16-01-2016 23:44:30
LOCALIZED MESSAGE = Controller ID:  0   Battery relearn started

ID = 267
SEQUENCE NUMBER = 335
TIME = 16-01-2016 23:44:28
LOCALIZED MESSAGE = Controller ID:  0  Command timeout on PD:   PD       =   -:-:1No addtional sense information,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x42 0x91 0x10 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =   ,   Path   =       0x4433221102000000

ID = 267
SEQUENCE NUMBER = 334
TIME = 16-01-2016 23:44:28
LOCALIZED MESSAGE = Controller ID:  0  Command timeout on PD:   PD       =   -:-:0No addtional sense information,   CDB   =    0x8f 0x00 0x00 0x00 0x00 0x01 0x45 0x30 0x20 0x00 0x00 0x00 0x10 0x00 0x00 0x00    ,   Sense   =   ,   Path   =       0x4433221103000000

ID = 242
SEQUENCE NUMBER = 333
TIME = 16-01-2016 23:44:16
LOCALIZED MESSAGE = Controller ID:  0   Battery charge complete
When Lsi fw or msm noticed an unseal eeprom log also comes up with a few errors, later this weekend the log is not showing any errors with the new code.


For those of you that is using a Lsi ibbu07 I hope you can check something for me. As you can see from picture above I have finished a battery relearn and battery is charging but stops at 49% and battery status is 'Optimal'

Not sure if it is a problem with my hex code or normal feature of this software but can you check your software and report back at what capacity your battery charging stops ? pictures showing both properties and advanced properties just as picture above is more then welcome -serial number and manufacturer I don't need to see so feel free to paint over.

Data I need is voltage, design and full capacity, remaining capacity and charge %.

After fitting this battery I now regret using this big capacity - charging takes many many hours but I'm sure data retention time is awesome.

Also yesterday I made a new post in the want to buy thread, I'm looking for a Lsi ibbu08 pack with swollen/defective battery to see ibbu08 code and see what charge controller it uses.
If you have one let me know - link
 
Last edited:

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
Thanks - been wondering why no one have tried this as it is a quick way of saving a few $ and as you say it is a great way to recycle hardware.
Did get a lot of help doing this so won't take all the glory my self and I'm not completely done yet either.

Again, if anyone have a ibbu07 in use please check your setup, data I need is voltage, design and full capacity, remaining capacity and charge %.
 

ChrisMunich

New Member
Feb 14, 2016
3
0
1
44
Hi Twist,

i am Chris from Germany! Sorry my english is not very good, but i will try.
I've seen your post here and tried the same. Unsealing the eeprom etc. My problem now, the same like yours. 23% state charging.
Charging current 0 mA. I am trying on the iBBU07 for 3 weeks now and i know, the higher the Remaining Charge is, the lower the current charging.
I try to change the Pre-Charge Current now to 500-600 mA now, i will tell u if i am successful.

Sorry for my real bad english!
 

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
Hi Chris

What kind of battery did you use and did you use the hex code I posted ? any changes to the code ?
Can you post a picture from megaraid manager so I can see the battery data just as my picture above ?

It is normal for charging current to be lower the higher the battery charge is.
 

ChrisMunich

New Member
Feb 14, 2016
3
0
1
44
Hi Twist,

sorry for answering so late....i got a fight with my iBBU07´s. I have 30 old ones and one new....first of all i connected the small interface card to my EV2200 from Technical Instruments. In the EV2200-60 Software the message "bq2060 ist sealed". I unsealed the EEPROM (u4) so i can read and change the values with the EV2200-60 Software. First i used the values from your screens, but i had the same problem like you. Then i began to change some values and as result nothing works....Battery Pack present, but no charge/discharge neither in the controller cli, nor in the storage manager in windows. I wanted to burn this shit!!! :)
So now i have a new one in my server and i think i got the problem.
I read and write on the U4 EEPROM while using an external powersupply with 4.1V.
After nothing works i took a real new iBBU07 and read it with Battery on the Small Board. Now in EV2200-60 Software under the Tab "Calibration" he displays LION with 4 Cells. I took my old iBBU07 (where i use the external Powersupply and not the Battery) and he told my that it is a NI Akku with 0 Cells!!!!!
In EV2200-60 Software i stored the EEPROM from my new iBBU07 and load it to my old one. Now it is in my Server and charges....If i know more i will tell you!!!

P.S.: I used the original Battery that is built in the iBBU07 P/N: US503759 A8H
 

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
I don't understand what you are trying to achieve, you can't use the values I used if your battery don't have the same capacity as the Samsung battery in my battery pack.

Also, if several of your eeprom dumps displays lion with 4 cells or has any other device chemistry you have problems accessing the eeprom and have corrupted files - never charge a lion using other device chemistry settings.

What do you mean by 23% state charging ? does you battery charge up to 23% and stop ?
Pre-charge current is just the first mode before it switches to fast charging (512mA), it's for deeply depleted batteries.
If you battery stops charging at 23% altering pre-charge won't help you.

Ok i found it! You need to burn the EEPROM (U4) with see the eeprom neu.txt then it seems to work
Your file is basically for a battery of 1215mAh that has a cycle count of 4 and now has been derated to 1139mAh, it's the standard for a ibbu007 and yes it will work as it is unaltered and remaining in an original state.
These settings won't work for a 1800mAh battery if it is that you are using.

Are these setting for a Sony US503759 a8h or a another type of battery ?
 

Walter1604

New Member
Mar 17, 2016
7
1
1
77
I am enjoying the discussion on this topic.
Are there pin-outs and interface information for the Lsi ibbu07.
How is the battery and the memory accessed?
Is there any diagnostic software for the battery and and the TI bq2060A controller?
Why wouldn't a direct replacement of the Sony US503759 work without all the software reprogramming?
 
Apr 2, 2015
48
1
8
46
Numbers below 100% are normal for these BBU's. I read somewhere that the controller charges the battery only enough to hold data for 48hours. I think new batteries hold at about 60-70%, which would explain your 49%@1800 mah max.
 

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
I am enjoying the discussion on this topic.
Are there pin-outs and interface information for the Lsi ibbu07.
How is the battery and the memory accessed?
Is there any diagnostic software for the battery and and the TI bq2060A controller?
Why wouldn't a direct replacement of the Sony US503759 work without all the software reprogramming?
Hi Walter1604


Since not playing with pinout I'm not sure but the Dell Perc6 module that uses the same plug and wire might have the same pinout.Opposite the plug pinout is marked - Data,Clock,-,T and +



The bbu uses smbus to communicate with raid card, I haven't used smbus to communicate with the eeprom myself as the eeprom is sealed. Sealing the eeprom restrict access to eeprom register functions - that why I lifted the eeprom.

You can download software and datasheet from Ti here
I'm not aware of any test hw or tools other then Ti's evaluation kit - if you just need to test battery capacity just get a charger and load - look further down.

A direct replacement of the Sony US503759 a8h will work just fine but since I don't have any new or found a trustworthy seller I instead altered the code to use the Perc6 battery I already had.
Replacing the battery without altering code might also work, I just don't know if the controller is able to count the last measured discharge backwards.

Numbers below 100% are normal for these BBU's. I read somewhere that the controller charges the battery only enough to hold data for 48hours. I think new batteries hold at about 60-70%, which would explain your 49%@1800 mah max.
Yes I notied that too - the battery gets charged up to around 970mAh regardless of battery capacity, had the fw instead been based on battery charge percentage we could utilize the bigger battery.

Because of that I'm now playing with these Htc phone cells, got 30 of them from phones that was spares and almost unused. They are 1200mAh so they are close enough and fit inside the 07 cover on it's side.
Made a small test rig to test and make sure all are in spec.



The phones logic boards has been cleaned for parts and I just use the phone and battery spring contacts as a 'hot swap' rig for testing batteries. Also, the charger from ebay fitted is not used anymore as it terminated at 4.240V. Found out that it is a fake chip - link

I have also had a look at the heatsink on the 5015 I use, it's way to ineffective for use in a regular desktop with quiet fans and idle at 58-62C. Took a almost 3x bigger heatsink and modified it to fit.




Old ati card, just need the heatsink.

These needs to be removed to have a smooth surface.





Made room for the beeper in the heatsink,nicely done.


With bigger heatsink and fan fitted I guess I will see better temperatures.

Smaller standard heatsink comparison.
 
  • Like
Reactions: pgh5278

Walter1604

New Member
Mar 17, 2016
7
1
1
77
Twist

you say > The bbu uses smbus to communicate with raid card, I haven't used smbus to communicate with the eeprom myself as the eeprom is sealed. Sealing the eeprom restrict access to eeprom register functions - that why I lifted the eeprom.

what is lifted mean that you desoldered the EEPROM from the card?

How are you programming and unsealing the new EEPROM ?

You show a picture on the EV2200-60 software - How is that accessed to the BBU

I'm so confused what hardware and software are you using in this demonstration?
 

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
Yes, lifted means I desoldered eeprom - I'm programming it using an Xeltek programmer but any programmer supporting 24lc01b will do.
Dave @ eevblog did a review of a cheap China programmer that might do - link , it's also hackable so look at the eevblog forum.

When in programmer it does not matter if chip is sealed - you can read & write any address how many times you want.

The Ev2200-60 software is not accessed by the bbu but only the eeprom bin file converted to txt file, same type txt as ChrisMunich uploaded further up in this thread.

This is not that difficult, just take you time to read bq2060 datasheet to make sure your math is correct to your battery and if your unsure you can make a new txt file in Ev2200 to see what it should look like in hex format.
 
  • Like
Reactions: Chuntzu

Twist

Member
Oct 15, 2015
79
42
18
48
Norway
Yes, saw that homepage earlier when searching for batteries before I got the Htc stock.

Their 1350mAh batteries was a little to big to fit in the carrier as the Sony battery was 54x36x5mm
 
Apr 2, 2015
48
1
8
46
i went a different way to replace batteries. i used 1500 mah batteries that come with a small connector instead. much easier to replace when needed.

 

Terry Kennedy

Well-Known Member
Jun 25, 2015
1,140
594
113
New York City
www.glaver.org
i went a different way to replace batteries. i used 1500 mah batteries that come with a small connector instead. much easier to replace when needed.
I would never trust a 2-wire remote LiPo battery in an application like this unless I knew what internal safeguards were in place and working. The Dell versions of the LSI battery pack (NU209, FR463, etc.) use a rigid-cased Li-ion battery with a thermistor (thermal probe) bonded to the battery.
 

Walter1604

New Member
Mar 17, 2016
7
1
1
77
It is not a matter of trust, but a matter of completely destroying the control and safety functions of the TI BQ2060

Please note: that the temperature of the battery is a critical component of the system
The bq2060A internal charge control is compatible with popular rechargeable chemistries. The primary
charge-termination techniques include a change in temperature over a change in time (ΔT/Δt) and current taper,
for nickel-based and Li-ion chemistries, respectively. The bq2060A also provides pre-charge qualification and a
number of safety charge suspensions based on current, voltage, temperature, and state of charge
 
  • Like
Reactions: ha$h