Flipper Zero Battery Reader

Flipper Zero application for reading SBS-compatible battery management systems and servicing supported Texas Instruments BQ controllers.

Features

• Scans the external I2C bus and reads standard SBS battery data
• Displays pack voltage, current, charge, capacity, cycles and individual cell voltages
• Detects DJI BQ40z307/BQ9003 and BQ30z55/BQ30z554 profiles
• Supports BQ40 Unseal and Full Access with selectable DJI and TI factory key presets
• Supports BQ30 SHA-1 Unseal and Full Access with the documented default key
• Provides confirmed Clear PF and controller-specific service commands
• Returns BQ30/BQ40 controllers to Sealed state with Seal / Reset Access
• Exports dated battery reports to the SD card
• Uses SMBus PEC, status verification and explicit hold-to-confirm screens for write operations

Screenshots

Battery information	Full Access result

Connection

Flipper Zero	Battery
C0	SCL
C1	SDA
GND	GND

Use 3.3 V logic only. The battery must be powered by its normal pack connection; do not power it from the Flipper GPIO rail.

Installation

1. Download battery_reader.fap from the latest GitHub release.
2. Copy it to /ext/apps/Tools/ on the Flipper Zero SD card.
3. Open Apps > Tools > Battery Reader.

The release build targets Flipper Zero firmware API 87.1. Rebuild the application if your firmware uses an incompatible API version.

Build

Install uFBT, then run:

ufbt

The resulting application is written to dist/battery_reader.fap.

Safety

Reading SBS data is non-destructive. Unseal, Full Access, Clear PF, reset and Seal commands write to the BMS.

• Use write operations only on batteries you own and understand
• Repair the physical battery fault before clearing Permanent Failure data
• Check cell voltage and balance before servicing the controller
• Always use Seal / Reset Access after service work
• Do not use damaged, swollen, overheated or deeply discharged packs

BQ30 service writes are blocked when a cell is below 3600 mV, above 4400 mV, or the cell spread exceeds 200 mV. BootMode and firmware/EEPROM backup are intentionally not implemented because a safe transport and memory boundary have not been verified.

Supported Controllers

Controller	Reading	Security access	Service commands
BQ40z307 / BQ9003	Yes	Unseal, Full Access, Seal	Clear PF
BQ30z55 / BQ30z554	Yes	SHA-1 Unseal, Full Access, Seal	Clear PF, Black Box Reset, Lifetime Reset, Device Reset
Generic SBS battery	Standard SBS fields	No	No

Hardware behavior can vary when an OEM has replaced the default security keys or customized firmware. The application does not brute-force keys.