After seeing someone having trouble with their battery, thought I'd share some of what I've learned about the Intelligent Battery.
https://forum.dji.com/forum.php?mod=viewthread&tid=195480
The Motion Controller board communicates with the battery via I2C. The Motion Controller acts as the master I2C device and reads data from the battery.
There are 10 connections on the battery. Four connections each for the positive and negative terminals. The center two connections are used for the I2C bus.
The Motion Controller boards sends requests to the battery at 1Hz if the battery doesn't reply. Here are the traces of a request which goes unacknowledged by the battery.

If the battery is properly connected and working properly, the battery will acknowledge the message and the Motion Controller will read data from the battery.

Once this initial communication is completed, the Motion Controller will continue reading additional information from the battery.
While looking through the data being read from the battery, I was surprised to see the ASCII characters "BATTERY" amoung the data being read.

Someone on Reddit had previously observed the S1 and battery communicate via I2C.
https://www.reddit.com/r/RobomasterS1/comments/ccjqd0/the_s1_boots_from_external_battery_wont_drive/
I've found it's possible to power the S1 using a bench power supply as long as the power is connected in parallel with the Intelligent Battery. The external power's voltage shouldn't be higher than the battery's voltage or it will cause and error state.
The way I use external power it start the S1 with battery power only and then connect my bench supply with the voltage set below the voltage of the battery. I then slowly increase the bench supply's voltage until a few hundred milliamps of current is being drawn from the power supply. As the battery voltage lowers, the bench supply supplies more and more current until all the power is supplied by the external power and the battery is just their keeping the Motion Controller happy with the I2C signals.
Eventually, I plan on using a microcontroller to reply to the Motion Controller over I2C so an Intelligent Battery won't be needed.
FWIW, I've used an external LiPo pack to power my S1. It's a bit trickier using a battery than an adjustable power supply since I have to match the voltages of the external battery and the intelligent battery in order not to damage anything. I don't recommend using an external battery until myself or someone else figures out how to trick the Motion Controller into thinking the external battery is legitimate.
Using a bench supply requires a XT30 Y-harness and a wired jumper for the 2mm 2-pin connectors.
It's possible to open up the Intelligent Battery, but it won't ever fit in the S1 the same after doing so.

There are three 21865 cells in the battery pack.

The above photos are also on my Hackaday IO project page.
https://hackaday.io/project/167276-dji-robomaster-s1-hacks/log/168042-battery-investigations
Apparently the batteries are rated as 2500mAh but DJI down rates the pack as 2400mAh.
The balancing is all done internal to the pack. The charger doesn't balance the pack.
The besides the internal balance leads, there's also a thermister used in the pack.

WoW this is really good data, thanks!  

Those Li-Ion cells are mega common and have a pretty good life span and performance.

Here's a link to a csv file of the data.
Dropbox Link
Here's a screen grab of the first bit of data.

It sure seems like there's a lot more data being read than just voltage level and temperature.
I'm puzzled why there appears to be so much text among the data.

When I first saw the I2C exchange between the Motion Controller and the Intelligent Battery, I was optimistic I'd be able to replicate the replies from the Intelligent Battery using a microcontroller. I'm no long as optimistic as I had been.
The Motion Controller not only reads data from the Intelligent Battery but it also writes data to the Intelligent Battery.
If I remember how I2C communication works, I think the Motion Controller writes three bytes of data to register zero and then reads six or seven bytes from register 35 (0x23).
I'm replaced the I2C read setup to a simple "Read from".
For example, rather than writing:
Setup Write to ['22' (0x16)] + ACK
#(0x23) + ACK
Setup Read to ['23' (0x17)] + ACK
'4'(0x04) + ACK
'0'(0x00) + ACK
'0'(0x00) + ACK
'0'(0x00) + ACK
'0'(0x00) + ACK
T(0x54) + NAK
I'll instead use:
Read from 0x23,0x04,0x00,0x00,0x00,0x00,0x54
Most writes are single byte writes to indicate which register to read. Some writes are longer. I think these longer writes start with the register being written followed by the data being written. Again, I'll use a shorthand to condense the data.
Instead of:
Setup Write to ['22' (0x16)] + ACK
0' (0x00) + ACK
Q (0x51) + ACK
0' (0x00) + ACK
\n (0x0A) + ACK
I'll use:
Setup Write,0x00,0x51,0x00,0x0A
Using these rules, here's the first part of the communication captured as the S1 is turned on.
Read from 0xD5,0x00,0x00,0x4E
Read from 0x18,0x60,0x09,0xD0
Read from 0x17,0x0A,0x00,0x4A
Read from 0x19,0x30,0x2A,0x23
Read from 0x1B,0xD8,0x4E,0xDF
Read from 0x1C,0x5C,0x00,0xB2
Read from 0x20,0x05,0x44,0x45,0x53,0x41,0x59,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A,0x7A
Read from 0x21,0x0D,0x58,0x57,0x30,0x36,0x30,0x37,0x42,0x41,0x54,0x54,0x45,0x52,0x59,0x08,0x08,0x08,0x08,0x08,0x08,0x08,0x08
Read from 0xC2,0x08,0x01,0x00,0x00,0x00,0x07,0x05,0xA4,0x03,0x69
Read from 0xD8,0x0E,0x30,0x52,0x54,0x44,0x47,0x35,0x35,0x35,0x35,0x31,0x30,0x30,0x58,0x32,0x9E
Setup Write,0x00,0x51,0x00,0x0A
Read from 0x23,0x04,0x00,0x00,0x00,0x00,0x54
Setup Write,0x00,0x53,0x00,0x20
Read from 0x23,0x04,0x00,0x00,0x00,0x00,0x00,0x54
Setup Write,0x00,0x54,0x00,0x4B
Read from 0x23,0x04,0x06,0x03,0x06,0x00,0xE3
Setup Write,0x00,0x55,0x00,0x5E
Read from 0x23,0x02,0x04,0x04,0x31,0x31,0x31
Read from 0x09,0x91,0x2D,0x5C
Read from 0x0A,0x00,0x00,0x51
Read from 0x10,0x97,0x09,0x1F
Read from 0x0F,0x1A,0x07,0xDF
Read from 0x08,0x78,0x0B,0x46
Read from 0x0D,0x4B,0x00,0xFF
Read from 0x51,0x04,0x00,0x00,0x00,0x00,0xDA
Read from 0xD2,0x00,0x00,0x2C
Read from 0x7B,0x97,0x09,0xC0
The part which concerns me is this:
Setup Write,0x00,0x51,0x00,0x0A
Read from 0x23,0x04,0x00,0x00,0x00,0x00,0x54
Setup Write,0x00,0x53,0x00,0x20
Read from 0x23,0x04,0x00,0x00,0x00,0x00,0x00,0x54
Setup Write,0x00,0x54,0x00,0x4B
Read from 0x23,0x04,0x06,0x03,0x06,0x00,0xE3
Setup Write,0x00,0x55,0x00,0x5E
Read from 0x23,0x02,0x04,0x04,0x31,0x31,0x31
If I understand the above exchange correctly, the Motion Controller is writing three bytes of data to register zero and then reads register 0x23 after writing register zero. Date read from 0x23 is different each time and even the number of bytes read changes. I don't know the significance of this exchange but I'm concerned there's some sort oh check being performed to make sure the intelligent battery is legitimate.
I'm wondering if trying to spoof the I2C exchange will be more work than it's worth.
I'll likely attempt to add a battery in parallel with Intelligent Battery rather than trying to spoof the I2C communication.
As I mentioned in an early post, I have previously used a large LiPo in parallel with the Intelligent Battery. It's a pain to do so since I have to be careful to match the battery voltages but this will likely be an easier task than figuring out the I2C verification system.

WOw, nice work!!

Great stuff Duane! Would you have an idea on how to make a Ronin battery work as a DTAP dummy, instead of using lipo cells? I used an old Ronin battery where I removed the cells, and soldered the DTAP +/- to B +/- on the pcb. So it works but since I haven't hooked the I2C pins it says "DJI NOT INTELLIGENT BATTERY" and kills the motors on the Ronin after few seconds. I'm wondering how could I trick the I2C to think it's a Smart Battery? Thank you!

octavez Posted at 4-24 11:10
Great stuff Duane! Would you have an idea on how to make a Ronin battery work as a DTAP dummy, instead of using lipo cells? I used an old Ronin battery where I removed the cells, and soldered the DTAP +/- to B +/- on the pcb. So it works but since I haven't hooked the I2C pins it says "DJI NOT INTELLIGENT BATTERY" and kills the motors on the Ronin after few seconds. I'm wondering how could I trick the I2C to think it's a Smart Battery? Thank you!

Sorry, I don't have any experience with the Ronin. I think there might be people working on this sort of stuff but I don't know the details.

octavez Posted at 4-24 11:10
Great stuff Duane! Would you have an idea on how to make a Ronin battery work as a DTAP dummy, instead of using lipo cells? I used an old Ronin battery where I removed the cells, and soldered the DTAP +/- to B +/- on the pcb. So it works but since I haven't hooked the I2C pins it says "DJI NOT INTELLIGENT BATTERY" and kills the motors on the Ronin after few seconds. I'm wondering how could I trick the I2C to think it's a Smart Battery? Thank you!

This will only work with old boxy 3400 mAh Ronin battery. The two other versions (4350 mAh and 1580 mAh) get the Power Failure flags from their BQ chip on the internal PCB as soon as the cells get disconnected or completely depleted. Then the battery is bricked until you reset the flags over I2C.

Duane Degn Posted at 2019-9-27 19:55
When I first saw the I2C exchange between the Motion Controller and the Intelligent Battery, I was optimistic I'd be able to replicate the replies from the Intelligent Battery using a microcontroller. I'm no long as optimistic as I had been.
The Motion Controller not only reads data from the Intelligent Battery but it also writes data to the Intelligent Battery.
If I remember how I2C communication works, I think the Motion Controller writes three bytes of data to register zero and then reads six or seven bytes from register 35 (0x23).

How about this idea? Disassambe the DJI battery to get it's pcb. Add an XT connector and a balance connector to connect external RC LIPO which replacing the original 18650s.