Generic-Chinese-Bluetooth-BMS-communication-protocol

Batteries, Chargers, and Battery Management Systems.
simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Nov 25 2017 7:29pm

There are a number of generic Bluetooth BMS units based around the TI BQ76940 BMS controller with a number of different configurations. I am not sure if they are manufactured by one or a number of different manufacturers. The thing they have in common is that they can be used with an Android app called xiaoxiang and with a Windows program called JBDTools.

This is the command sequence sent by the JBDTools software to obtain the battery information. It is a binary string which in HEX format is. I have added the EOLs for clarity.
DD A5 03 00 FF FD 77
DD A5 04 00 FF FC 77
DD A5 05 00 FF FB 77

First two bytes are the header, bytes 3 and 4 are the command, bytes 5 and 6 are the checksum, the last byte is the EOR.

The battery current along with other information that I haven't decoded is returned by the BMS board by the first command. The second command returns the individual cell voltages and the third returns the BMS name in ASCII format and maybe other information.

The reply packet is a binary string in HEX format is. I have added the EOLs for clarity
DD A5 00 1B 13 78 00 00 00 00 03 E8 00 00 22 C7 00 00 00 00 00 00 19 00 03 0C 02 0B 64 0B 5F FC 83 77
DD A5 00 18 10 39 10 3A 10 38 10 3A 10 3C 10 39 10 37 10 39 10 3B 10 3F 10 36 10 3A FC 74 77
DD A5 00 14 4C 48 2D 53 50 31 35 53 30 30 31 2D 50 31 33 53 2D 33 30 41 FB 39 77

The first two bytes are the header, bytes 3 and 4 are the length of the reply data in bytes, the data follows followed by the checksum, and finally the EOR.

The battery current is in bytes 7 and 8 of the first line

The second line are the individual cell voltages. Each voltage is a 16 bit number so 0x1039 gives a voltage of 4153mV
10 39 10 3A 10 38 10 3A 10 3C 10 39 10 37 10 39 10 3B 10 3F 10 36 10 3A
These converted to decimal in mV are 4153 4155 4152 4155 4157 4153 4151 4153 4156 4159 4150 4155

Third line is the BMS name.

I have written an interface between BMS boards that use this protocol and my BMS software if anyone is interested. A link to my BMS software is in my signature

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Nov 10 2018 12:15am

I have done some further reverse engineering of the coms protocol for these BMS.

I have decoded the majority of the Config settings that are displayed in the config tab.

To read the config settings you first have to read the battery data information with these commands
DD A5 03 00 FF FD 77
DD A5 04 00 FF FC 77
I don't understand why you have to do this but you can't access the config data unless you do this first.
Then you have to send the following preamble command
DD 5A 00 02 56 78 FF 30 77
then you send the commands to access the registers you want to read, for example
DD A5 10 00 FF F0 77
will return the Full Battery Capacity register in the form
DD 10 00 02 07 D0 FF 27 77
The DD is the message header, 10 is the register number, 02 is the number of data bytes. 07 D0 is the data in binary which equates to 2000 decimal, FF 27 are the checksum and 77 is the EndOfRecord marker.

You send as many read register commands as you want which range from 10-3F and A0-A2 and AA.

You finish off the read with the command
DD 5A 01 02 00 00 FF FD 77

Writing to the registers is similar
DD 5A 10 02 4E 20 FF 80 77
where the 5A means write, the 02 is the number of bytes of data and the 4E 20 is the data to be written.
I have made up a spreadsheet with all the registers I have decoded to date, or if you want a PDF.

Does anyone know what the "protected count" section of the config tab is about. Is it the number of times a particular fault has occurred or something else.

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

999zip999   100 GW

100 GW
Posts: 9450
Joined: Jan 10 2010 1:40pm
Location: Dana Point So. Cal

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by 999zip999 » Nov 10 2018 9:25am

Wow Simon thank you getting interesting. Go E.S.

whereswally606   100 kW

100 kW
Posts: 1149
Joined: Jun 19 2011 2:11pm
Location: Cheshire, UK

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by whereswally606 » Nov 13 2018 5:45am

I like this a lot. I just installed a 10s one on a friends bike. would be nice to have an Arduino with an oled display for the voltages rather than a phone on the handle bars.

thanks for posting.
Distributing "Lebowski" FOC Controller PCB (Through hole) since 2016
Moped: Emax 110s 2009

whatever   100 kW

100 kW
Posts: 1159
Joined: Jun 03 2010 2:16am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by whatever » Nov 13 2018 7:16am

is this link of any use? it has bluetooth bms software for android:
https://apkpure.com/tyva-bms-app/centre ... yvaenergie

mario1122   1 µW

1 µW
Posts: 4
Joined: Aug 08 2015 10:09am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by mario1122 » Nov 15 2018 9:04am

Here is web app to monitor/control multiple BMS devices in one battery pack:
https://mono.software/2018/11/15/multiple-bms-monitor/

vreppeto   10 mW

10 mW
Posts: 25
Joined: Oct 03 2018 6:07pm

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by vreppeto » Nov 23 2018 3:29am

Here is the instruction book I received when I requested it from a vendor. It is instructions for a windows version of the JBDTools software for windows. If anyone finds more english or chinese instructions for these devices I would like to find out about it.

https://drive.google.com/open?id=0BwXiT ... Y0Z2Q1WGtF

ifishtoo

vreppeto   10 mW

10 mW
Posts: 25
Joined: Oct 03 2018 6:07pm

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by vreppeto » Nov 23 2018 3:44am

It appears to have a primary and secondary over current protection.

Q. What happens when the set threshold is exceeded? I will post when I find an answer.
The online instructions have a few tidbits in english. https://www.lithiumbatterypcb.com/smart ... -download/

vreppeto   10 mW

10 mW
Posts: 25
Joined: Oct 03 2018 6:07pm

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by vreppeto » Nov 23 2018 3:51am

mario1122 wrote:
Nov 15 2018 9:04am
Here is web app to monitor/control multiple BMS devices in one battery pack:
https://mono.software/2018/11/15/multiple-bms-monitor/
Thank you! That article has a misleading name. There is a reasonable amount of valuable info about these bms.

dakoal   100 µW

100 µW
Posts: 8
Joined: Nov 04 2016 2:42am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by dakoal » Dec 02 2018 3:48am

Hi,

@simat : Thanks for the work.

I built a little test setup for the "China BMS".

The data is read with a Pi-Zero running gatttool.
With the 3 read commands, I found a lot of things and did a little tinkering:

Packvoltage: 52.80 V
Amperage: -.23 A
BMS Name: LH-SP15S001-P14S-60A
Cell#: 01 02 03 04 05 06 07 08 09 10 11 12 13 14
Volt :3.73 3.83 3.71 3.79 3.75 3.69 3.81 3.84 3.72 3.83 3.76 3.72 3.77 3.79

But also with the registers from Excel I am missing some values that the Android App is showing:

SOC%
Temperature
Temp Sensor1
Temps Sensor2

Also it would be nice to controll the charge/discharge switch.

Does someone know additional read/write registers?
Attachments
IMG_3470.JPG
IMG_3470.JPG (132.84 KiB) Viewed 6745 times

simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Dec 02 2018 8:16am

This link gives information on the 03,04,05 commands that give the information you want

I have had limited success with switching the charge and discharge FETs on and off with the following.

send
DD A5 03 00 FF FD 77
DD A5 04 00 FF FC 77
DD 5A 00 02 56 78 FF 30 77
which is the same as getting the config data then
DD 5A E1 02 00 03 FF 1A 77 turn both FETs off
DD 5A E1 02 00 02 FF 1B 77 charge FET off, discharge FET on
DD 5A E1 02 00 01 FF 1C 77 charge FET on, discharge FET off
DD 5A E1 02 00 00 FF 1D 77 both FETs on
then
DD 5A 01 02 00 00 FF FD 77
I have been having a few problems with this but haven't had time to fully investigate.

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

dakoal   100 µW

100 µW
Posts: 8
Joined: Nov 04 2016 2:42am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by dakoal » Dec 02 2018 11:50am

Thank you.

I will do the MOSFET thing and tell here how it works.
SOC is only 1byte, therefore I couldn't identify it, because I only checked for 16bit values.

Kin   10 kW

10 kW
Posts: 864
Joined: Mar 05 2011 6:16pm
Location: NC or MA, U.S

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by Kin » Dec 11 2018 3:30pm

I just wrote up a long thread asking people if there are any of these UART BMS units with a known protocol. I almost hit send and then decided to check again on ES....found your thread! nice work!

Do you have any recommended BMS unit sellers? I also haven't had an easy time getting sellers to tell me what chip they use to confirm if it's based on the TI chip.

My end goal is to communicate via optoisolators to 3 bms units that are in series (for now ignore the mosfet output voltage issues in this , I can explain later) and monitor basic voltages. I plan to use a teensy or similar MCU as the central monitor of the multiple sub bms units.

I look forward to digging into what you've done so far! Thanks for sharing.
New to endless-sphere? Notice a lot of signatures recommending Ebikes.ca? That's because it's the best place for a quality and manageable, (but still 'real'), first build. Justin is a solid supporter of electric bike development, and a good source of equipment.

simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Dec 12 2018 8:06am

Kin wrote:
Dec 11 2018 3:30pm
Do you have any recommended BMS unit sellers? I also haven't had an easy time getting sellers to tell me what chip they use to confirm if it's based on the TI chip.
This is where I got my latest batch of BMSs, https://www.aliexpress.com/item/15S-Sma ... 66109.html

I am fairly sure that any of the units using the xiaoxiang android ap or the Windows JBDTools program will be using the TI chips. The TI chips are controlled and the comms is done by an Atmel microprocessor on these BMS boards.
My end goal is to communicate via optoisolators to 3 bms units that are in series (for now ignore the mosfet output voltage issues in this , I can explain later) and monitor basic voltages. I plan to use a teensy or similar MCU as the central monitor of the multiple sub bms units.
If you wanted to use the FET cut out switches on the BMS you could just use the ones on the BMS board connected to the battery minus and upgrade the FETs to ones that could cope with the higher voltage.

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

Kin   10 kW

10 kW
Posts: 864
Joined: Mar 05 2011 6:16pm
Location: NC or MA, U.S

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by Kin » Dec 12 2018 10:16am

With 45-48S as my likely total cell voltage I end up feeling like it's easier to have the bms units drive relays to control power to a main contactor. I still need to work through whether the quiescent current draw will be too high as a result or if I turn on off the relay when the car us off if the on in-rush current would be a problem for the contactor.

I dont love the idea of three bms units with such high voltage fets >150V) nor am I 100% comfortable with say 4110s for each chain and a diode to protect the 4110s in case one bms shuts off. Realistically the first version will just not have output control protection and that should be ok if my mcu is monitoring the bms units through the uart

It is unfortunate for me that this particular chip is only good to 15S cells, since my batteries are available in 8S modules I would be much better off with a bms with uart that could do 16s.
New to endless-sphere? Notice a lot of signatures recommending Ebikes.ca? That's because it's the best place for a quality and manageable, (but still 'real'), first build. Justin is a solid supporter of electric bike development, and a good source of equipment.

User avatar
trazor   100 W

100 W
Posts: 163
Joined: Jan 13 2015 10:48pm
Contact:

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by trazor » Dec 12 2018 10:32am

Kin wrote:
Dec 12 2018 10:16am
With 45-48S as my likely total cell voltage I end up feeling like it's easier to have the bms units drive relays to control power to a main contactor. I still need to work through whether the quiescent current draw will be too high as a result or if I turn on off the relay when the car us off if the on in-rush current would be a problem for the contactor.

I dont love the idea of three bms units with such high voltage fets >150V) nor am I 100% comfortable with say 4110s for each chain and a diode to protect the 4110s in case one bms shuts off. Realistically the first version will just not have output control protection and that should be ok if my mcu is monitoring the bms units through the uart

It is unfortunate for me that this particular chip is only good to 15S cells, since my batteries are available in 8S modules I would be much better off with a bms with uart that could do 16s.
All cell count up to 30s are available for these boards https://es.aliexpress.com/store/group/2 ... 8170.1_0_4

If your specific cell count is not there, just ask the vendor to do one for you (they configure the cables and firmware before sending to you)

User avatar
fechter   100 GW

100 GW
Posts: 14799
Joined: Dec 31 2006 3:23pm
Location: California Bay Area, USA

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by fechter » Dec 12 2018 11:06am

That's great work. Thanks for posting.

If they use TI chips, would the datasheet for the chip tell us about the available commands?
"One test is worth a thousand opinions"

Kin   10 kW

10 kW
Posts: 864
Joined: Mar 05 2011 6:16pm
Location: NC or MA, U.S

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by Kin » Dec 12 2018 1:03pm

trazor wrote:
Dec 12 2018 10:32am
All cell count up to 30s are available for these boards https://es.aliexpress.com/store/group/2 ... 8170.1_0_4

If your specific cell count is not there, just ask the vendor to do one for you (they configure the cables and firmware before sending to you)
Thanks Trazor! I had skimmed the datasheet for TI BQ76940 , and found it was only meant for 1-15 cells. Do you know the 20S to 30S options are using the same chip? They maybe are using multiple chips, which would be OK, I just wasn't sure when looking at higher voltage 'smart bms' options if they are actually the same as what simant found.
New to endless-sphere? Notice a lot of signatures recommending Ebikes.ca? That's because it's the best place for a quality and manageable, (but still 'real'), first build. Justin is a solid supporter of electric bike development, and a good source of equipment.

simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Dec 13 2018 7:58am

Kin wrote:
Dec 12 2018 1:03pm
Thanks Trazor! I had skimmed the datasheet for TI BQ76940 , and found it was only meant for 1-15 cells. Do you know the 20S to 30S options are using the same chip? They maybe are using multiple chips, which would be OK, I just wasn't sure when looking at higher voltage 'smart bms' options if they are actually the same as what simant found.
There are three variants of the BQ76940, the 76920 has five cell inputs, the 76930 has 10 inputs and the 76940 has 15 inputs.
Any of the BMSs that handle more than 15 cells do indeed have more than one TI chip. The 'high voltage' chip has its I2C bus coms opto isolated so the Atmel processor can talk to both of them. I am not sure how they handle the charge and discharge FET enables from both TI chips.

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

simat   10 mW

10 mW
Posts: 29
Joined: Apr 07 2013 10:27am
Location: Harvey, Western Australia

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by simat » Dec 13 2018 8:04am

fechter wrote:
Dec 12 2018 11:06am
If they use TI chips, would the datasheet for the chip tell us about the available commands?
I don't know of any way you can get the Atmel processor that runs the BMS boards to send 'raw' commands to the TI chip.

You could remove or disable the Atmel chip and talk directly to the TI chips via I2C bus if you wanted to.

Simon
Home off-grid solar: 2.0kW solar panels, 360ah Winston LFP battery @48V installed April 2013, MPPSolar PIP5048 inverter/charge controller
BMS Opensource project here https://github.com/simat/BatteryMonitor/wiki
Electric pushbikes: 2 x mountain bikes with Bafang BBS-02 1kW mid mount drives, 10ah LiCo batteries

User avatar
fechter   100 GW

100 GW
Posts: 14799
Joined: Dec 31 2006 3:23pm
Location: California Bay Area, USA

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by fechter » Dec 13 2018 3:25pm

simat wrote:
Dec 13 2018 8:04am
I don't know of any way you can get the Atmel processor that runs the BMS boards to send 'raw' commands to the TI chip.

You could remove or disable the Atmel chip and talk directly to the TI chips via I2C bus if you wanted to.

Simon
I see, there is an intermediary Atmel that talking to the outside. It would be great to get the source code for that (but not likely).
"One test is worth a thousand opinions"

BotoXbz   10 W

10 W
Posts: 91
Joined: May 20 2018 7:00am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by BotoXbz » Dec 13 2018 5:27pm

fechter wrote:
Dec 13 2018 3:25pm
simat wrote:
Dec 13 2018 8:04am
I don't know of any way you can get the Atmel processor that runs the BMS boards to send 'raw' commands to the TI chip.

You could remove or disable the Atmel chip and talk directly to the TI chips via I2C bus if you wanted to.

Simon
I see, there is an intermediary Atmel that talking to the outside. It would be great to get the source code for that (but not likely).
I made open source firmware for it: https://github.com/BotoX/xiaomi-m365-compatible-bms

User avatar
AadamZ5   1 µW

1 µW
Posts: 1
Joined: Dec 30 2018 7:55am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by AadamZ5 » Dec 30 2018 7:59am

Since this topic isn't that old, I received this spreadsheet (was in Chinese) for the data transmission protocol. I roughly translated it with Google/Microsoft, and added some notes. Hope this helps!

https://www.dropbox.com/s/03vfqklw97hzi ... .xlsx?dl=0

I'm working on an arduino library that gathers the data from it nicely. Work in progress.

EDIT:

While trying to enter factory mode, instead of sending the 0x03 and 0x04 commands, I noticed *for my board* that just sending enter factory mode twice will successfully let you enter "factory mode". Can someone confirm this? (@Simat 😊)
Last edited by AadamZ5 on Dec 31 2018 4:37am, edited 2 times in total.

User avatar
fechter   100 GW

100 GW
Posts: 14799
Joined: Dec 31 2006 3:23pm
Location: California Bay Area, USA

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by fechter » Dec 30 2018 12:40pm

AadamZ5 wrote:
Dec 30 2018 7:59am
Since this topic isn't that old, I received this spreadsheet (was in Chinese) for the data transmission protocol. I roughly translated it with Google/Microsoft, and added some notes. Hope this helps!
That looks super helpful. Thanks for posting it.
"One test is worth a thousand opinions"

bres55   1 µW

1 µW
Posts: 4
Joined: Apr 23 2018 6:41am

Re: Generic-Chinese-Bluetooth-BMS-communication-protocol

Post by bres55 » Jan 14 2019 4:54am

There may be some useful information here in relation to this BMS device.
https://github.com/bres55/Smart-BMS-arduino-Reader

The handshaking was the tricky part. Not sure I fully understoood it, but it worked.

Image

Post Reply