DJI Battery Killer: Reviving Bricked DJI Drone Batteries with CP2112 & BMS Reset

User question

how to use dji battery killer?

Artificial Intelligence Response

Direct answer to the question

‐ “DJI Battery Killer” is an unofficial hardware-and-software workflow that talks directly to the Battery-Management-System (BMS) inside DJI Intelligent Flight Batteries to clear “Permanent-Failure (PF/PF2)” flags, unlock hibernated packs and, if voltages are still healthy, make the battery chargeable again.
‐ The typical minimum kit is a Silicon-Labs CP2112 USB-to-SMBus/I²C adapter, flying leads to the BMS test pads, and the community-built DJI Battery Killer executable**.
‐ In essence you:

1. Wire CP2112 → SDA/SCL/GND pads on the battery.
2. (If the pack is ≤ ~3 V / cell) “wake” the BMS with a current-limited bench supply or a temporary 9 V source.
3. Run the program, CONNECT, UNSEAL, CLEAR PF/PF2, RESET/SEAL.
4. Disconnect all test gear and attempt a normal charge in the DJI hub.
5. Charge/discharge under observation to verify cell balance and capacity before flight.

Detailed problem analysis

1. Why DJI batteries appear “dead”
   • DJI packs contain a TI fuel-gauge (BQ30z55/BQ40z50 family) + protection FETs.
   • If any cell < ≈2.5 V, delta V between cells > ≈200 mV, or an internal error counter trips, the BMS sets PF (Permanent-Fail) bits.
   • Once PF is set the pack stops accepting charge on the normal charger even if the chemistry is still recoverable.

2. Electrical interface
   • Pads/pogo pins next to the power terminals expose SMBus lines:
   SDA, SCL, GND (+ sometimes PACK+ for wake-up).
   • CP2112 enumerates as a USB HID device so no kernel driver is needed on Win10/11, macOS or Linux.
   • Battery Killer merely wraps CP2112 HID commands and sends standard SMBus writes:
   Unseal 0x36720414 → Clear PF 0x0054 → Seal 0x0020 (model dependant).

3. Typical voltage thresholds
   • Spark / Mini (2 S): 7.6 V nominal, DJI charger refuses below ≈ 6.0 V.
   • Mavic / Air (3 S): 11.4 V nominal, refuse below ≈ 9.0 V.
   • Phantom / Inspire (4 S/6 S): 15.2 V / 22.8 V nominal, refuse below ≈ 12 V / 18 V.
   Bringing pack back above these “soft” limits is often all that is required after PF clearing.

4. Why a bench-supply or 9 V “kick-start” is sometimes needed
   • When every cell is deeply discharged the BMS FETs are open; CP2112 sees the gauge but the charger still disconnects.
   • Injecting 8–16 V at ≤ 0.2 A wakes the gauge long enough for PF clearing and pre-charges cells to > 3.1 V.

5. Failure modes you cannot fix
   • Puffy/swollen cells (gas generation = internal short).
   • Physical cracks, electrolyte leakage, corrosion, or thermistor error.
   • Blown protection FETs (fet-short will show pack voltage on both terminals).

Current information and trends

‐ 2023-2024 community builds now provide cross-platform GUI versions (Qt/Java) and auto-detect cell count.
‐ Low-cost CP2112 USB-C boards (~ US $5) have replaced hand-wired Adafruit breakouts.
‐ Some developers added scripts to reset cycle counters for rental fleets, but this is controversial and sometimes illegal.
‐ Newer batteries (e.g., Mini 3 Pro, Mavic 3) use encrypted gauges; only partial success has been reported. Expect further reverse-engineering via the dji-firmware-tools GitHub project.

Supporting explanations and details

Pin-out example – DJI Spark 2S pack (looking at mating face, left→right):

SMBus command timing: CP2112 defaults (100 kHz, 1 ms time-out) are adequate. No pull-ups required; the battery provides 2.7 kΩ pulls.

Ethical and legal aspects

‐ Warranty & EULA: Any modification voids DJI warranty and may violate DJI’s software licence.
‐ Transport regulations: Manipulated or revived packs may not meet UN 38.3 transport test requirements; air-cargo shippers can refuse them.
‐ Li-ion safety: Mis-charging can cause thermal runaway (> 500 °C). Always work in a flame-proof area with a Class D or ABC extinguisher.

Practical guidelines (step-by-step)

1. Inspection
   • Reject if swollen, punctured, salt-water damaged.
2. Setup
   • Install CP2112 HID API (Win: Silabs CP2112 SDK, macOS uses built-in).
   • Place battery in LiPo-safe bag on ceramic tile, connect SDA/SCL/GND.
3. Wake-up (only if total V < soft limit)
   • Bench-supply = pack-nominal V, current-limit 0.2 A, max 5 min.
4. Software
   ▸ Open BatteryKiller.exe → choose CP2112 serial → Connect.
   ▸ Press UNSEAL, wait “0x0000 OK”.
   ▸ Press CLEAR PF / CLEAR PF2 until status reads “PF=0 / PF2=0”.
   ▸ Press RESET (soft) then SEAL.
5. Charging test
   • Move battery to DJI hub; if LEDs start current-ramp, success.
   • Supervise to 100 %, let cool, then discharge in hover to 20 % while logging cell voltages.
   • If ΔV > 0.05 V at 50 %, retire the pack.

Possible disclaimers or additional notes

‐ Success probability drops sharply if any cell < 2.8 V for more than a few weeks.
‐ Capacity may be permanently reduced; mark the pack and use only for low-risk flights.
‐ Some firmware versions require a two-stage unseal key; community wikis list them.

Suggestions for further research

‐ Follow the dji-firmware-tools and unseal-bq40z50-scripts GitHub repos for updates.
‐ Investigate smart-battery spoofers that emulate DJI SMBus for deeper diagnostics.
‐ Explore safer “external-BMS” rebuilds: transplant healthy cells into an intact BMS module.

Brief summary

DJI Battery Killer is essentially a CP2112-to-SMBus service tool that clears protection flags in DJI Intelligent Flight Batteries. After carefully wiring SDA/SCL/GND, optionally pre-charging the pack, and running UNSEAL → CLEAR PF → RESET → SEAL, many “bricked” batteries can be returned to normal charging behaviour. The procedure is inherently risky, voids warranties, and must be carried out with strict Li-ion safety precautions and a clear understanding that not all packs are recoverable.