In case anyone is curious, here's a few photos of the inside of DJI FPV battery.

There are more photos on my Hackday IO project.

Edit: I've also posted photos showing the inside of the controller.

I was about to ask what the drone looked like after the crash but then I saw your other post where you took apart the drone so there you go.

I'm lucky that I don't get the take it apart urge until after it doesn't work, but I appreciate people like you that do so I can benefit when something breaks.  Thanks!

maihem.rc Posted at 3-18 12:26
I'm lucky that I don't get the take it apart urge until after it doesn't work, but I appreciate people like you that do so I can benefit when something breaks.  Thanks!

"I don't get the take it apart urge until after it doesn't work"
One of the reason I took it apart was I couldn't activate my drone. I received my "Fly More" kit so I knew I had a couple extra batteries if I ruined this one.
Fortunately I got this one back together with minimal blemish and then the Fly app was updated so I could activate my drone.
Now that I can fly it, the urge to take it apart has subsided a bit.

I'm still hoping someone will take apart the controller. I have no idea how to take it apart myself.

Hello there Duane Degn. Good day and thank you for posting this photo and for these information you have shared. Have a safe and a happy flying always.

Im surprised they use double sided tape.

DAFlys Posted at 3-19 01:28
Im surprised they use double sided tape.

I'm not sure if my use of "double sided tape" is completely correct. I just assumed that's what it is.
I was able to put the battery back together without any trouble. There's just a small blemish were I started prying the top off.

I'm hoping it's possible to refurbish an old battery with new cells. They're pricey batteries and I'd like to be able to reuse the electronics once the LiPo cells wear out.

Duane Degn Posted at 3-19 07:16
I'm not sure if my use of "double sided tape" is completely correct. I just assumed that's what it is.
I was able to put the battery back together without any trouble. There's just a small blemish were I started prying the top off.

Theres a good chance,  for some of the other DJI drones like the inspire there are companies that are cell swapping the packs.

I've been waiting to see exactly what's inside... thanks. It looks like LIPO not LIION. It also looks like the charging and balancing circuit boards are on the BOTTOM side of the battery where the drone lands. LOL Why?  I suppose it is safer having the actual cells protected a little more and it is very slightly balanced better this way. It's just such an odd design choice to have us land on our expensive batteries with the charger built in like that. Forget about landing this thing in manual mode even if you are experienced and in the soft grass, which isn't a deal breaker but sure is weird.

djiuser_90GiHJXBXaGU Posted at 3-27 20:37
I've been waiting to see exactly what's inside... thanks. It looks like LIPO not LIION. It also looks like the charging and balancing circuit boards are on the BOTTOM side of the battery where the drone lands. LOL Why?  I suppose it is safer having the actual cells protected a little more and it is very slightly balanced better this way. It's just such an odd design choice to have us land on our expensive batteries with the charger built in like that. Forget about landing this thing in manual mode even if you are experienced and in the soft grass, which isn't a deal breaker but sure is weird.

I tried to find where anyone suggested they were Li-Ion but I only found LiPo references.
Was your "not LIION" referring to something you saw in this thread?

For what it's worth, there are rubber bumpers on the bottom corner of the pack to hopefully reduce the problems of landing on the battery management circuit.

I sure hope DJI didn't design it his way to increase sales of batteries.

I just finished wiring up some wires to the inside of the battery in an attempt to capture the communication between the drone and the battery. It looks like the communication is CAN bus.

I still need to figure out how to read this data. I think I have some CAN bus transceivers I might be able to use to listen in on the exchange.

I was actually expecting I2C communication after seeing the communication between the RoboMaster S1 and its battery.

Not in reference to anything anyone said it was my assumption. The writing on the outside of the battery says lithium ion polymer. I wasn't sure if that meant lipo or liion but based on the shape of the cells, they're definitely lipo. I thought they might be liion packs because of the long-ish flight times and heavy weight. I'm glad it is lipo- now I don't feel so bad draining it down real fast. It does seem like they're just trying to sell more crap making it out of plastic and making us land on the batteries, but I hope not too. I think they had to put the battery down so low to balance the thing and the circuits on the bottom to keep the cells from taking damage and catching fire.

On Hackaday IO, someone pointed out that my logic analyzer had the ability to decode CAN signals. Here's the decoded data:

Time ,Packet,Type,Identifier,Control,Data,CRC,ACK
2.111320843750000,0,DATA,0x554,0xE,0xEF 0xEE 0x93 0xE9 0x7B 0xAE 0x8D 0xBF,,
2.114893812500000,1,DATA,0x138,0xF,,,
2.126467750000000,2,DATA,0x153EFBE9,0xE,0x67 0xFE 0xD6 0x15 0xE9,,
2.310771906250000,3,DATA,0x554,0xE,0xEF 0xEE 0x93 0xE9 0x7B 0xAE 0x8D 0xBF,,
2.314893750000000,4,DATA,0x138,0xF,,,
2.515036843750000,5,DATA,0x138,0xF,,,



The multiple instances of "DATA,0x138,0xF" make me suspect it is the battery's voltage.
I should monitor the communication with batteries at various states of discharge to see which values change.

Interesting!

Duane Degn Posted at 3-27 21:40
I just finished wiring up some wires to the inside of the battery in an attempt to capture the communication between the drone and the battery. It looks like the communication is CAN bus.
[view_image]
I still need to figure out how to read this data. I think I have some CAN bus transceivers I might be able to use to listen in on the exchange.

Can we do something like that (check the battery health etc.) without disassembling? Cause as of this morning in goggles view fully charged battery shows 0 and no SN or cycle count

T0P Posted at 4-9 04:56
Can we do something like that (check the battery health etc.) without disassembling? Cause as of this morning in goggles view fully charged battery shows 0 and no SN or cycle count

You can still check the voltage of the battery by turning it on. Of course this isn't help much with your issue.
If you have a logic analyzer and if you're willing to take the rear plate off the drone, you could probe the data pin closest to the positive terminal to aquire the CAN bus signal. You might be able to see if the battery is replying to messages sent by the drone.

Do you have a second battery to see if the issue is with the drone of the battery? It's possible there a bad solder joint on one of the data lines.

It's also possible one of the data pins have been damaged. Besides the two power connectors, there are three data connectors on the drone. One of these connectors is shorter than the others. From what I can see, this short pin isn't used for communication or any other purpose. If you think of the three pins forming a "L" shape, the short pin is the one in the corner of the "L". This short pin (from what I can see) isn't important to the operation of the battery or drone. The other two pins are used with the CAN bus. Either of these pins could be monitored to capture the data exchange.

Voltage is fine, checked with multimeter. Pins are like new, used it just a few times. Because of that and what I've been reading about (similar issues), I cancelled the order for Fly More Kit...so no second battery. Don't want anything invasive because I'm seriously considering giving up and returnig this, but probably can hook up something (not real logic analyzer but maybe some CH340 or CP2102 based adapters/programmers, or even RPi?) via probes and clips (to the battery data connectors or in between drone and battery)

The solder joints of the thermistor is covered with some tough transparent blue sealant/glue. I managed to peal this glue away in order to measure the resistance of the thermistor. The resistance is 11.1K at 20C (68F).

While downloading logs from the drone, I kept it powered on by using my bench power supply. As I did with my RoboMaster S1 battery, I set the voltage of the power supply to be just below the battery's measured voltage. I then slowly turn up the voltage until the output from the power supply is a couple hundred milliamps. As the battery drains, the current from the power supply slowly increases until the drone is being completely powered by the bench supply.

I haven't tried it myself, but I think the battery's PCB would still work if the cells of the battery were replaced. I'll give this a try myself once I wear out one of my batteries.

I recently started using some of the cool features provided by Airdata.com. They make it easy to see how your battery performed during a flight. Here's an example of battery temperature data.


I also like the feature which shows how much current was used at various points of the flight.



In case anyone else isn't aware of how to transfer the flight logs into your smart device, I provided some basic instructions in this post. Apparently there are mulitple sites which can help you interprete the data from these logs. This post has some info about one of these other sites.

I haven't figured out what the difference between the logs saved in the goggles vs the logs saved in the drone. The logs in the drone are harder to access since both the goggles and the drone need to powered on to retreive the drone logs. At least this is the I'm presently trying to do retreive them. If there's a better method, I hope people will let me know.

Duane Degn Posted at 4-1 19:24
On Hackaday IO, someone pointed out that my logic analyzer had the ability to decode CAN signals. Here's the decoded data:

Time ,Packet,Type,Identifier,Control,Data,CRC,ACK

Dear Duane,

Thank you for sharing this interesting data. I think the repetitive packet at ID=0x138 is probably the battery pinging the the master (drone). Usually, like other CAN-bus devices, the master needs to reply the pinging with certain content, and then the slave (the battery) will reply with actual meaningful info/data.

With that being said, if you could record a period of CAN bus traffic while the drone is powered by the battery, then we may have a chance to figure it out. Also, if the recording of the CAN bus traffic could be a bit longer, containing ~100 lines/packets, we would have a better chance of understanding it.

Thank you.

"if you could record a period of CAN bus traffic while the drone is powered by the battery, then we may have a chance to figure it out."

The data shared above was captured with the battery connected to the drone. It would be nice if I could record this sort of data while the drone is flying by my modifications don't really allow that. I'd need to modify my hack to make the thing flyable.

"Also, if the recording of the CAN bus traffic could be a bit longer, containing ~100 lines/packets, we would have a better chance of understanding it."

Yes, this would be good. I was limited by the memory of the logic analyzer. I think I could capture data at a lower resolution and extend the amount of data it captures.

I'd really like to figure out how to make a portable datalogger for the drone. Ideally, I would capture data while the drone is flying and save it to a SD card for analysis. If I understood the data logs saved by the drone better, I might be able to compare the CAN bus traffic to the data log and find correlations in the two sets of data.

I have a couple CAN interface boards. I'm hoping I can use these board to aid in making a CAN bus data logger.

Duane Degn Posted at 4-12 18:50
"if you could record a period of CAN bus traffic while the drone is powered by the battery, then we may have a chance to figure it out."

The data shared above was captured with the battery connected to the drone. It would be nice if I could record this sort of data while the drone is flying by my modifications don't really allow that. I'd need to modify my hack to make the thing flyable.

Ok, I see. Then I think a larger log would be just it.

I made a CAN bus relay to Serial port to a PC before for a DIY project and made a LabView UI to analyze the CAN bus traffic (pretty much like a OBD-II analyzer for cars). If you'd like to go that way, use the mentioned MCP2515 and a MCU to relay the traffic to a PC's serial port, I'd be more than happen to share you my home-made LabView program to run on the PC, to analyze the data. Or, perhaps an easier way, is just to copy and save the data from the serial port on a PC with a free serial port monitor software.

Making the logger hardware portable is more time-consuming. And simply for understanding the battery traffic, I think might be an over-kill. I guess as you mentioned in a previous message, you can just log a few sessions with the battery having different charge left.

wow this is just such great info! thank you a LOT!

Just for watching this post... Amazing job!

Duane Degn Posted at 3-27 21:40
I just finished wiring up some wires to the inside of the battery in an attempt to capture the communication between the drone and the battery. It looks like the communication is CAN bus.
[view_image]
I still need to figure out how to read this data. I think I have some CAN bus transceivers I might be able to use to listen in on the exchange.

Hmm I am shocked that it is not I2C.   Thanks for showing this.

Great information Duane. Interesting to get proof that the batteries are in fact normal LiPos, and not the normal LiHVs that DJI use.

... an interesting insight.

any new finds in topic of CAN comminication?

Hey guys.

Sorry to bump this, but I was wondering if anyone learned any more, or managed to capture any more data from the battery?

It would be great get get some longer data to see if we can decipher the messages.

I have some tests/experiments planned over the next few days. I hope I can find some new insights.

https://hackaday.io/project/184677-dji-fpv-6s-battery-compatibility-mod

Excellent. I just read up on your work so far. Some very useful info in there.

In the past DJI have used I2C for communication between battery and drone. I believe the primary chip used in the FPV battery is the same as used in other DJI batteries.

I’m now presuming that the three small pins on the battery plug are the SDA, SCL, and GND. I’ve identified the Ground pin easily enough but as there are no markings on the plug or where the pins terminate on the BMS board, which pins are SDA and SCL will be a 50/50 guess.

To gain access and read the data from other DJI Smart batteries you can use a CP2112 debug board. The software required is called DJI Battery Killer, but is difficult to find as I’ve only ever seen it appear for short periods on file sharing sites. If you Google you may get lucky.

I have a DJI FPV battery I obtained as a DOA sample. It as allegedly supplied new in this condition. All the cells were below 1Volt. Five of the cells would charge to a storage value but the first cell in the series chain would only charge to around 0.5Volt, and would discharge rapidly down to 0Volt when the charge supply was removed. I was able to establish a connection with the battery using the C2112 debug board but any attempt to read the data resulted in an error message. I have my suspicions the BMS board was faulty, causing the sudden discharge of all the cells, and why I’m unable to read the data or force a reset of the power failure (PF) flag.

I don’t want to run the process on my good FPV batteries just in case something is different in the FPV batteries from the rest of DJI’s Smart Batteries. I do know the process for resetting the BMS on Mavic batteries and those of the Spark as that has been documented and demonstrated numerous times.
As for replacing the cells. I think these cells were custom made for DJI as they don't have the usual catalog number format of other single LiPo cells. Interestingly they are only rated to 4C so I expect short lifespan's, especially if you fly aggressively in ACRO mode.

Turns out it's RS485 not CAN. Data is DUML messages. AirCruiser is making good progress with the help of fpv.wtf team on their discord.

fansebae Posted at 4-7 07:00
Turns out it's RS485 not CAN. Data is DUML messages. AirCruiser is making good progress with the help of fpv.wtf team on their discord.

Since I used a logic analyzer (LA) and not an oscilloscope, I don't know the voltage levels of the highs and lows. My past experience with RS485 suggests it idles with one line high and one line low (assuming I'm remembering correctly). CAN bus lines idle with an in between voltage. I think my LA picks up the middle voltage as high. This along with the way the bits are arranged in the packet makes me think it's a CAN signal.

I'll need to hook up my oscilloscope and find out more detail. I should also join the Discord you mention.

Thanks for the info.

Duane Degn Posted at 4-7 09:06
Since I used a logic analyzer (LA) and not an oscilloscope, I don't know the voltage levels of the highs and lows. My past experience with RS485 suggests it idles with one line high and one line low (assuming I'm remembering correctly). CAN bus lines idle with an in between voltage. I think my LA picks up the middle voltage as high. This along with the way the bits are arranged in the packet makes me think it's a CAN signal.

I'll need to hook up my oscilloscope and find out more detail. I should also join the Discord you mention.

https://discord.gg/TZXCqEKV
there's rs485 transceiver chip identified on the battery board

In the next few days I will post a few more photos of the chip (SN65HVD75), the wiring, oscilloscope pictures and a few more words in my hackaday project. Obviously the communication is about DUML packets like this: 5536043d0b03b126800d020000765300006cfcffff7c070000cc010000480106190000000003000000130164000047028102000064e4
(https://b3yond.d3vl.com/duml/#5536043d0b03b126800d020000765300006cfcffff7c070000cc010000480106190000000003000000130164000047028102000064e4)

Hi! Do you have access to a DJI AVATA? Can you log the data that is exchanged between the battery and the power adapter when it's being charged? I've lost my adapter and need to replicate the data so I can use a standard li-ion charger.