SLUUCY8 December   2023 BQ77307

 

  1.   1
  2.   Read This First
    1.     About This Manual
    2.     Battery Notational Conventions
    3.     Trademarks
    4.     Glossary
  3. 1 Introduction
  4. 2 Device Description
    1. 2.1 Overview
    2. 2.2 Functional Block Diagram
  5. 3 Device Configuration
    1. 3.1 Direct Commands and Subcommands
    2. 3.2 Configuration Using OTP or Registers
    3. 3.3 Data Formats
      1. 3.3.1 Unsigned Integer
      2. 3.3.2 Integer
      3. 3.3.3 Hex
  6. 4 Device Security
  7. 5 Protection Subsystem
    1. 5.1  Protections Overview
    2. 5.2  Protection Evaluation and Detection
    3. 5.3  Protection FET Drivers
    4. 5.4  Cell Overvoltage Protection
    5. 5.5  Cell Undervoltage Protection
    6. 5.6  Short Circuit in Discharge Protection
    7. 5.7  Overcurrent in Charge Protection
    8. 5.8  Overcurrent in Discharge 1 and 2 Protections
    9. 5.9  Current Protection Latch
    10. 5.10 CHG Detector
    11. 5.11 Overtemperature in Charge Protection
    12. 5.12 Overtemperature in Discharge Protection
    13. 5.13 Internal Overtemperature Protection
    14. 5.14 Undertemperature in Charge Protection
    15. 5.15 Undertemperature in Discharge Protection
    16. 5.16 Cell Open Wire Detection
    17. 5.17 Voltage Reference Diagnostic Protection
    18. 5.18 VSS Diagnostic Protection
    19. 5.19 REGOUT Diagnostic Protection
    20. 5.20 LFO Oscillator Integrity Diagnostic Protection
    21. 5.21 Internal Factory Trim Diagnostic Protection
  8. 6 Device Status and Controls
    1. 6.1 0x00 Control Status() and 0x12 Battery Status() Commands
    2. 6.2 Unused VC Cell Input Pins
    3. 6.3 LDOs
    4. 6.4 ALERT Pin Operation
    5. 6.5 TS Pin Operation
    6. 6.6 Device Event Timing
  9. 7 Operational Modes
    1. 7.1 Overview of Operational Modes
    2. 7.2 NORMAL Mode
    3. 7.3 SHUTDOWN Mode
    4. 7.4 CONFIG_UPDATE Mode
  10. 8 I2C Serial Communications
    1. 8.1 I2C Serial Communications Interface
  11. 9 Commands and Subcommands
    1. 9.1 Direct Commands
    2. 9.2 Bit Field Definitions for Direct Commands
      1. 9.2.1  Safety Alert A Register
      2. 9.2.2  Safety Status A Register
      3. 9.2.3  Safety Alert B Register
      4. 9.2.4  Safety Status B Register
      5. 9.2.5  Battery Status Register
      6. 9.2.6  Alarm Status Register
      7. 9.2.7  Alarm Raw Status Register
      8. 9.2.8  Alarm Enable Register
      9. 9.2.9  FET CONTROL Register
      10. 9.2.10 REGOUT CONTROL Register
    3. 9.3 Command-only Subcommands
    4. 9.4 Subcommands with Data
    5. 9.5 Bitfield Definitions for Subcommands
      1. 9.5.1 DEVICE NUMBER Register
      2. 9.5.2 FW VERSION Register
      3. 9.5.3 HW VERSION Register
      4. 9.5.4 SECURITY KEYS Register
      5. 9.5.5 PROT RECOVERY Register
  12. 10Data Memory
    1. 10.1 Settings
      1. 10.1.1 Settings:Configuration
        1. 10.1.1.1  Settings:Configuration:Reserved
        2. 10.1.1.2  Settings:Configuration:Power Config
        3. 10.1.1.3  Settings:Configuration:REGOUT Config
        4. 10.1.1.4  Settings:Configuration:I2C Address
        5. 10.1.1.5  Settings:Configuration:I2C Config
        6. 10.1.1.6  Settings:Configuration:TS Mode
        7. 10.1.1.7  Settings:Configuration:Vcell Mode
        8. 10.1.1.8  Settings:Configuration:Default Alarm Mask
        9. 10.1.1.9  Settings:Configuration:FET Options
        10. 10.1.1.10 Settings:Configuration:Charge Detector Time
      2. 10.1.2 Settings:Protection
        1. 10.1.2.1 Settings:Protection:Enabled Protections A
        2. 10.1.2.2 Settings:Protection:Enabled Protections B
        3. 10.1.2.3 Settings:Protection:DSG FET Protections A
        4. 10.1.2.4 Settings:Protection:CHG FET Protections A
        5. 10.1.2.5 Settings:Protection:Both FET Protections B
        6. 10.1.2.6 Settings:Protection:Cell Open Wire Check Time
    2. 10.2 Protections
      1. 10.2.1 Protections:Cell Voltage
        1. 10.2.1.1 Protections:Cell Voltage:Cell Undervoltage Protection Threshold
        2. 10.2.1.2 Protections:Cell Voltage:Cell Undervoltage Protection Delay
        3. 10.2.1.3 Protections:Cell Voltage:Cell Undervoltage Protection Recovery Hysteresis
        4. 10.2.1.4 Protections:Cell Voltage:Cell Overvoltage Protection Threshold
        5. 10.2.1.5 Protections:Cell Voltage:Cell Overvoltage Protection Delay
        6. 10.2.1.6 Protections:Cell Voltage:Cell Overvoltage Protection Recovery Hysteresis
      2. 10.2.2 Protections:Current
        1. 10.2.2.1  Protections:Current:Overcurrent in Charge Protection Threshold
        2. 10.2.2.2  Protections:Current:Overcurrent in Charge Protection Delay
        3. 10.2.2.3  Protections:Current:Overcurrent in Discharge 1 Protection Threshold
        4. 10.2.2.4  Protections:Current:Overcurrent in Discharge 1 Protection Delay
        5. 10.2.2.5  Protections:Current:Overcurrent in Discharge 2 Protection Threshold
        6. 10.2.2.6  Protections:Current:Overcurrent in Discharge 2 Protection Delay
        7. 10.2.2.7  Protections:Current:Short Circuit in Discharge Protection Threshold
        8. 10.2.2.8  Protections:Current:Short Circuit in Discharge Protection Delay
        9. 10.2.2.9  Protections:Current:Latch Limit
        10. 10.2.2.10 Protections:Current:Recovery Time
      3. 10.2.3 Protections:Temperature
        1. 10.2.3.1  Protections:Temperature:Overtemperature in Charge Protection Threshold
        2. 10.2.3.2  Protections:Temperature:Overtemperature in Charge Protection Delay
        3. 10.2.3.3  Protections:Temperature:Overtemperature in Charge Protection Recovery
        4. 10.2.3.4  Protections:Temperature:Undertemperature in Charge Protection Threshold
        5. 10.2.3.5  Protections:Temperature:Undertemperature in Charge Protection Delay
        6. 10.2.3.6  Protections:Temperature:Undertemperature in Charge Protection Recovery
        7. 10.2.3.7  Protections:Temperature:Overtemperature in Discharge Protection Threshold
        8. 10.2.3.8  Protections:Temperature:Overtemperature in Discharge Protection Delay
        9. 10.2.3.9  Protections:Temperature:Overtemperature in Discharge Protection Recovery
        10. 10.2.3.10 Protections:Temperature:Undertemperature in Discharge Protection Threshold
        11. 10.2.3.11 Protections:Temperature:Undertemperature in Discharge Protection Delay
        12. 10.2.3.12 Protections:Temperature:Undertemperature in Discharge Protection Recovery
        13. 10.2.3.13 Protections:Temperature:Internal Overtemperature Protection Threshold
        14. 10.2.3.14 Protections:Temperature:Internal Overtemperature Protection Delay
        15. 10.2.3.15 Protections:Temperature:Internal Overtemperature Protection Recovery
    3. 10.3 Power
      1. 10.3.1 Power:Configuration
        1. 10.3.1.1 Power:Configuration:Voltage CHECK Time
        2. 10.3.1.2 Power:Configuration:Body Diode Threshold
      2. 10.3.2 Power:Shutdown
        1. 10.3.2.1 Power:Shutdown:Shutdown Cell Voltage
        2. 10.3.2.2 Power:Shutdown:Shutdown Stack Voltage
        3. 10.3.2.3 Power:Shutdown:Shutdown Temperature
    4. 10.4 Security
      1. 10.4.1 Security:Settings
        1. 10.4.1.1 Security:Settings:Security Settings
        2. 10.4.1.2 Security:Settings:Full Access Key Step 1
        3. 10.4.1.3 Security:Settings:Full Access Key Step 2
      2. 10.4.2 Data Memory Summary
  13. 11Revision History

4 Device Security

The BQ77307 device includes two security modes: SEALED and FULLACCESS, which can be used to limit the ability to view or change settings.

In SEALED mode, most data and status can be read using commands and subcommands, but only selected settings can be changed. Data memory settings cannot be read or changed directly.

FULLACCESS mode includes SEALED mode functionality, adds the ability to execute additional subcommands, and provides capability to read and modify all device settings.

Selected settings in the device can be modified while the device is in operation through supported commands and subcommands, but in order to modify all settings, the device must enter CONFIG_UPDATE mode, which stops device operation while settings are being updated. After the update is completed, device operation is restarted using the new settings. CONFIG_UPDATE mode is only available in FULLACCESS mode.

The BQ77307 device implements a key-access scheme to move from SEALED to FULLACCESS mode. A unique set of keys must be sent to the device through the subcommand address (0x3E and 0x3F). The keys must be sent consecutively to 0x3E and 0x3F, with no other data written between the keys. Do not set the two keys to identical values, and it is recommended to not use keys which are identical to subcommand addresses. When in SEALED mode, the 0x12 Battery Status()[SEC1, SEC0] bits are set to [1, 1]. When the FULLACCESS keys are correctly received by the device, the bits are set to [0, 1]. The state [0, 0] is not valid and only indicates that the state has not yet been loaded. The state [1, 0] is also not valid.

The FULLACCESS keys are stored in data memory in Security:Full Access Key Step 1 and Security:Keys:Full Access Key Step 2. The access keys are changed during operation using the 0x0035 SECURITY_KEYS() subcommand. This subcommand enables a R/W of the 2 key words (4 bytes). Each word is sent in little endian order using this subcommand.

When using the codes by writing them to 0x3E and 0x3F, they must be sent in little endian order; therefore, if 0x1234 and 0x5678 are written as the FULLACCESS codes to 0x0035 SECURITY_KEYS(), then to unseal requires writing 0x34 and 0x12 to 0x3E and 0x3F, followed by writing 0x78 and 0x56 to 0x3E and 0x3F. The two codes must be written within 5 s of each other to succeed.

To read the keys (only available in FULLACCESS mode, assume for example the keys are 0x1234 0x5678):

  1. Write 0x35 and 0x00 to 0x3E and 0x3F
  2. Read back 4 bytes from the transfer buffer at 0x40–0x43 (for example, 0x34 0x12 0x78 0x56).

To write the keys (only available in FULLACCESS mode):

  1. Write 0x35 and 0x00 to 0x3E and 0x3F.
  2. Write the data in little endian format to the transfer buffer at 0x40–0x43 (for example, 0x34 0x12 0x78 0x56).
  3. Write the checksum to 0x60. The checksum is calculated by inverting the modulo-256 sum of the data and command bytes (for example, 0xB6).
  4. Write the length of 0x08 to 0x61. The length includes the command, data, checksum, and length bytes.

To set the device into SEALED mode when initially powering up, the Security:Security Settings[SEAL] configuration bit must be programmed into OTP. During operation, a device in FULLACCESS mode can be put into SEALED mode by sending the 0x0030 SEAL() subcommand.

The BQ77307 device includes additional means to limit further modification of device settings. If the Security:Security Settings[LOCK_CFG] configuration bit is set, the data memory settings can no longer be modified when the device exits CONFIG_UPDATE mode. If the Security:Security Settings[PERM_SEAL] bit is set, the device cannot be unsealed after it has been sealed. If these bits are not set in OTP, the settings are lost on a full reset and the device is again able to unseal and modify data memory.

The catalog, uncustomized BQ77307 device is by default in FULLACCESS mode, so all settings can be configured in registers by the customer. If a customized, preprogrammed device is developed by TI, and the device is intended to only be used in standalone mode, then it can be preprogrammed with the Security:Security Settings[PERM_SEAL] bit set, such that settings can never be changed. If instead the customer wants the option to change settings on their production line or in the field, then the customer can use custom preprogrammed security keys to unseal the device and make changes, then can reseal the device again.