DJI Phantom 4 Intelligent Flight Battery

Battery Management System for the DJI Phantom 4.

Accessing the SMBus using an Raspberry Pi

BMS Board lower half

BMS Board test pads
Black = Ground
Red = SMBus SDA
Green = SMBus SCL

Accessing the SMBus requires dji-firmware-tools by o-gs from GitHub, a disassembled battery, a Raspberry Pi, 3 temporary wires(preferably DuPont wire, male to female) and a soldering iron.

Connect the GND, SDA and SCL pins from the BMS to the Raspberry Pi(Pins SDA1, SCL1, GND). Verify the connection using i2cdetect. The two chips on the BMS will show up as i2c address 0x0B(The BMS) and 0x40.

Clear the PermanentFail BMS State

pi@raspberrypi:~ $ sudo i2cdetect -y 1
    0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- -- 0b -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: 40 -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --

Check the fault state of the BMS using

./comm_sbs_bqctrl.py -vvv --dev_address 0x0b monitor BQStatusBitsMA

Example Output

Unseal and reset the battery:

pi@raspberrypi:~/dji-firmware-tools $ ./comm_sbs_bqctrl.py -vvv --dev_address 0x0b sealing Unseal
pi@raspberrypi:~/dji-firmware-tools $ ./comm_sbs_bqctrl.py -vvv --dev_address 0x0b trigger ManufacturerAccess.PermanentFailDataReset
pi@raspberrypi:~/dji-firmware-tools $ ./comm_sbs_bqctrl.py -vvv --dev_address 0x0b sealing Seal

After that, the BMS will turn on again, remove the SDA/SCL/GND solder connections, fully charge the battery, and assemble it back together.