Add Berger LFP BLE command notes and client

2026-07-27 01:20:56 +02:00
commit b390792e34
10 changed files with 861 additions and 0 deletions
@@ -0,0 +1,80 @@
+# Berger LFP BLE Command Catalog
+
+Status: decompiled from Berger LFP Android app `1.0.3`. Entries are based on
+the bundled uni-app JavaScript code, not live BLE captures.
+
+## GATT Surface
+
+| UUID | Direction | Purpose |
+| --- | --- | --- |
+| `0000ff00-0000-1000-8000-00805f9b34fb` | service | Main JBD/BMS service |
+| `0000ff01-0000-1000-8000-00805f9b34fb` | notify/read | BMS response frames |
+| `0000ff02-0000-1000-8000-00805f9b34fb` | write no response | BMS command frames |
+
+## Frame Format
+
+Read command:
+
+```text
+DD A5 <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
+```
+
+Write command:
+
+```text
+DD 5A <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
+```
+
+Checksum:
+
+```text
+sum = command + length + sum(payload)
+checksum = ((sum ^ 0xFFFF) + 1) & 0xFFFF
+```
+
+Responses observed in the parser:
+
+```text
+DD <command:8-bit> <status:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
+```
+
+## Commands In App
+
+| Name | Frame / payload | Meaning |
+| --- | --- | --- |
+| Read base data | `DD A5 03 00 FF FD 77` | Pack voltage/current/SOC/capacity/MOS/temps |
+| Read cell voltages | `DD A5 04 00 FF FC 77` | Per-cell voltage list |
+| Read hardware version | `DD A5 05 00 FF FB 77` | ASCII hardware version |
+| Enter factory mode | `DD 5A 00 02 56 78 FF 30 77` | Factory/settings mode |
+| Exit factory mode | `DD 5D 01 02 28 28 FF AD 77` | Exit factory/settings mode |
+| Read BMS model | `DD A5 FA 03 00 B0 04 FE 4F 77` | New-style FA parameter `0xB0`, length `4` |
+| Read battery model | `DD A5 FA 03 00 9E 0C FE 59 77` | New-style FA parameter `0x9E`, length `12` |
+| Read full-charge capacity | `DD A5 FA 03 00 70 01 FE 92 77` | New-style FA parameter `0x70`, length `1` |
+| Read barcode, new version | `DD A5 FA 03 00 58 10 FE 95 77` | New-style FA parameter `0x58`, length `16` |
+| Read manufacturer, new version | `DD A5 FA 03 00 38 10 FE B5 77` | New-style FA parameter `0x38`, length `16` |
+| Read barcode, old version | `DD A5 A2 00 FF 5E 77` | Old-style barcode |
+| Read manufacturer, old version | `DD A5 A0 00 FF 60 77` | Old-style manufacturer |
+| Set charge/discharge MOS | `DD 5A E1 02 00 <mode> <checksum> 77` | Mode `0..3`, see below |
+| Set BLE name | `FF AA 07 <len> <ascii> <check8>` | Alternate name command frame |
+
+## MOS Control Mode
+
+The Android app writes command `0xE1` with payload `00 <mode>`.
+
+| Mode | Meaning inferred from app logic |
+| ---: | --- |
+| `0` | charge on, discharge on |
+| `1` | charge off, discharge on |
+| `2` | charge on, discharge off |
+| `3` | charge off, discharge off |
+
+The app response handler treats command `0xE1` status `0` as success.
+
+## Scan Hints
+
+The app scans using only the service filter `ff00`. It also derives a MAC-like
+address from advertising data on iOS and reverses byte order when the derived
+address ends in `A5`, `A4`, `12`, `52`, or `00`.
+
+The desktop utility treats service `ff00` as the strong match and device names
+containing `JBD`, `BMS`, or `BERGER` as soft hints.