If the battery is dead then yes, the BMS needs power
Hi all, I’m Max from Italy.
I’m trying to repair three Mavic Air batteries but it seems I’m having trouble unlocking them.
I’m using DJi_Battery_Killer_ver.0.5beta2_01.02.2022_with_dlls and I was able to connect to the battery and read its information without any problems.
The last lines of the info logs are:
----------------------------------------------------------------
Write Block 0x44 <= 0200
Read Block 0x44 => 02004307010100270003850200
CHIP ID: 4307 => BQ9003 (BQ40Z307)
FW VERSION: 0101
FW BUILD: 0027
----------------------------------------------------------------
Write Block 0x44 <= 5400
Read Block 0x44 => 540000670000
Chip is sealed = SEC3 = xxxxxx11
----------------------------------------------------------------
Cliking on Unseal/FAS button I get
----------------------------------------------------------------
Write Block 0x44 <= 5400
Read Block 0x44 => 540000670000
Chip is Sealed = SEC3 = xxxxxx11
----------------------------------------------------------------
Key 1a successfuly entered
Write Block 0x44 <= 5400
Read Block 0x44 => 540000660000
Chip is Sealed = SEC2 = xxxxxx10
----------------------------------------------------------------
Key 1b successfuly entered
Write Block 0x44 <= 5400
Read Block 0x44 => 540000650000
Chip in FAS = SEC1 = xxxxxx01
----------------------------------------------------------------
But then, cliking on Clear PF or Clear PF2 button I still get
----------------------------------------------------------------
Write Block 0x44 <= 5400
Read Block 0x44 => 540000670000
Chip is Sealed = SEC3 = xxxxxx11
First, you need to unseal the chip
----------------------------------------------------------------
Any advice on how to overcome this will be greatly appreciated.
Thanks in advance.
Hello again. I have made some progress.
Now I get the message Clear PF2 successfull! after clicking the Clear PF2 button
After that message, the rightmost battery LED blinks 4 times and then nothing happens.
I don’t see any current flowing from the power supply to the battery.
Does anyone know what those 4 blinks mean?
Thanks in advance
Here the full log sequence :
This program is designed to unlock DJI Mavic batteries with BQ30Z55 and bq9003 (bq40z307) chips using the CP2112 HID USB to SMBus / I2C adapter. The program is distributed "as is" and the author is not responsible for any consequences caused by the fault of the program.
----------------------------------------------------------------
DJi Battery Killer ver. 0.5 Beta 2
compiled 01.02.2022
Thanks to everyone who helped in the creation and testing of this program ;)
----------------------------------------------------------------
use "Help" button to find the pinout
use "About" button for donate :)
----------------------------------------------------------------
PS Who is in the AndroSean sect, please do not use this free program, use the UBRT program that AndroSean advertises :)
----------------------------------------------------------------
File killer.ini opened successfully
Found 3 profile(s)
----------------------------------------------------------------
BQ9003 CHIP SELECTED
----------------------------------------------------------------
CP2112 HID USB to SMBus/I2C adapter successfully opened
CP2112 HID USB to SMBus/I2C adapter successfully configured
----------------------------------------------------------------
Read Info
(00) Manufacturer Access = 0xEF00
(01) Remaining Capacity Alarm = 712 mAh
(02) Remaining Time Alarm = 10 min
(03) Battery Mode = 0x6001
(04) At Rate = 0 mA
(05) At Rate Time To Full = 65535 min(s)
(06) At Rate Time To Empty = 65535 min(s)
(07) At Rate OK = 1
(08) Temperature = 23 C
(09) Voltage = 4934 mV
(0A) Current = 0 mA
(0B) Average Current = 0 mA
(0C) Max Error = 1 %
(0D) RSOC = 0 %
(0E) ASOC = 0 %
(0F) Remaining Capacity = 0 mAh
(10) Full Charge Capacity = 2113 mAh
(11) Run Time to Empty = 65535 min(s)
(12) Average Time to Empty = 65535 min(s)
(13) Average Time to Full = 65535 min(s)
(14) Charging Current = 0 mA
(15) Charging Voltage = 0 mV
(16) Battery Status = 0x4AD0
(17) Cycle Count = 6
(18) Design Capacity = 2375 mAh
(19) Design Voltage = 11550 mV
(1A) Cpecification Info = 0x31
(1B) Manufacture Date = 0x4CE4 - 2018.07.04
(1C) Serial Number = 1763
(20) Manufacturer Name = ATL NVT
(21) Device Name = DJI023
(22) Device Chemistry = 3856
(23) Manufacturer Data = 0x006F0002
(3C) Battery Cell 4 Voltage = 0 mV
(3D) Battery Cell 3 Voltage = 1765 mV
(3E) Battery Cell 2 Voltage = 1119 mV
(3F) Battery Cell 1 Voltage = 2050 mV
(D8) DJI Battery S/N : 0K4AF73A35088X
----------------------------------------------------------------
Write Block 0x44 <= 0200
Read Block 0x44 => 02004307010100270003850200
CHIP ID: 4307 => BQ9003 (BQ40Z307)
FW VERSION: 0101
FW BUILD: 0027
----------------------------------------------------------------
Write Block 0x44 <= 5400
Read Block 0x44 => 5400006F0002
Chip is sealed = SEC3 = xxxxxx11
----------------------------------------------------------------
Unseal / FAS
Write Block 0x44 <= 5400
Read Block 0x44 => 540000EF0004
Chip is Sealed = SEC3 = xxxxxx11
----------------------------------------------------------------
Key 1a successfuly entered
Write Block 0x44 <= 5400
Read Block 0x44 => 5400006E0000
Chip is Sealed = SEC2 = xxxxxx10
----------------------------------------------------------------
Key 1b successfuly entered
Write Block 0x44 <= 5400
Read Block 0x44 => 5400006D0000
Chip in FAS = SEC1 = xxxxxx01
----------------------------------------------------------------
Clear PF2
Write Block 0x44 <= 5400
Read Block 0x44 => 5400006D0000
Chip in FAS = SEC1 = xxxxxx01
----------------------------------------------------------------
Read Block 0x44 => 020401236667000030760000E44CE3060741544C204E56540000000000000000
Write Block 0x44 <= 01234567 - OK
Checking new values...
Read Block 0x44 => 020401234567000030760000E44CE3060741544C204E56540000000000000000
Clear PF2 successfull!
----------------------------------------------------------------
1 Like
Try this
- Click ‘Unseal/FAS’
- Then clear the PF and PF2 flags after each gives you a “Clear PF/PF2 successful!” message.
- You might need to do this a few times as they dont always clear
- Reset the chip
- Then Seal it.
Thanks @SparkyFPV
I have tried that sequence of commands many times but the result is always the same:
when all the steps are successful, the LED flashes 4 times and then turns off, even if at the end I performed a sequence of Reset/Seal commands.
Does it matter which GND/VCC slot of the battery I connect to the power supply and the cp2112 board?
Are they interchangeable?
Thanks
Whats the battery voltage? The voltage must be at least 3.3 volts per cell
Have you tried to charge it
Thanks for your help @SparkyFPV
I’m not sure what voltage you’re referring to:
- The voltage of the power supply I have connected to the battery is 12.00 V
- The Read Info report Parameter 09 returns 4934 mV
Is there any other voltage I should check ?
Yes, once that command sequence completes successfully, when I connect the battery to the original DJI 4-battery charger, the charger LED repeatedly switches from green to red.
I see now what you mean … 
All four cell voltages are below 3.3 V
- Cell 4 : 0 mV
- Cell 3 : 1765 mV
- Cell 2 : 1119 mV
- Cell 1 : 2050 mv
Charge the cells
Ok… last question: do I have to open the battery to charge each cell or can I do it without disassembling it?
Thanks once again
Yes it needs disassembling to gain access to each individual cell
Ok, I’ll do it and post the results 
For now, thanks for your advice
2 Likes
Found This
It is because the cell voltage is too low
These are the cell pads
It is listed here and might help
Hi. Actually my fpv battery is dead. bq9006 chip is inside. is it possible to reset the bms on fpv battery somehow?
Have a look here
Hi folks, I have a few aftermarket batteries for the Mini 3 / 4 Pro, and they were working fine until a recent firmware update. Now, the drone detects the batteries as being non-DJI batteries. Has anyone used the Battery Killer software to fix this issue? I’m wondering if I just need to modify the battery parameters (probably parameter 20) to match the OEM batteries. Thoughts?
Another reason not to update the firmware, the latest is known to stop most hacks
It’s worth a try but you may need to modify more parameters than just No 20
Hello, How can I get access to this group? Thanks!
@gustavohakime details of membership can be found at https://dronescene.co.uk/membership
I have this same problem, Do you found a solutions ?