2.9 KiB
2.9 KiB
Berger LFP BLE Command Catalog
Status: decompiled from Berger LFP Android app 1.0.3. Entries are based on
the bundled uni-app JavaScript code, not live BLE captures.
GATT Surface
| UUID | Direction | Purpose |
|---|---|---|
0000ff00-0000-1000-8000-00805f9b34fb |
service | Main JBD/BMS service |
0000ff01-0000-1000-8000-00805f9b34fb |
notify/read | BMS response frames |
0000ff02-0000-1000-8000-00805f9b34fb |
write no response | BMS command frames |
Frame Format
Read command:
DD A5 <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
Write command:
DD 5A <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
Checksum:
sum = command + length + sum(payload)
checksum = ((sum ^ 0xFFFF) + 1) & 0xFFFF
Responses observed in the parser:
DD <command:8-bit> <status:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
Commands In App
| Name | Frame / payload | Meaning |
|---|---|---|
| Read base data | DD A5 03 00 FF FD 77 |
Pack voltage/current/SOC/capacity/MOS/temps |
| Read cell voltages | DD A5 04 00 FF FC 77 |
Per-cell voltage list |
| Read hardware version | DD A5 05 00 FF FB 77 |
ASCII hardware version |
| Enter factory mode | DD 5A 00 02 56 78 FF 30 77 |
Factory/settings mode |
| Exit factory mode | DD 5D 01 02 28 28 FF AD 77 |
Exit factory/settings mode |
| Read BMS model | DD A5 FA 03 00 B0 04 FE 4F 77 |
New-style FA parameter 0xB0, length 4 |
| Read battery model | DD A5 FA 03 00 9E 0C FE 59 77 |
New-style FA parameter 0x9E, length 12 |
| Read full-charge capacity | DD A5 FA 03 00 70 01 FE 92 77 |
New-style FA parameter 0x70, length 1 |
| Read barcode, new version | DD A5 FA 03 00 58 10 FE 95 77 |
New-style FA parameter 0x58, length 16 |
| Read manufacturer, new version | DD A5 FA 03 00 38 10 FE B5 77 |
New-style FA parameter 0x38, length 16 |
| Read barcode, old version | DD A5 A2 00 FF 5E 77 |
Old-style barcode |
| Read manufacturer, old version | DD A5 A0 00 FF 60 77 |
Old-style manufacturer |
| Set charge/discharge MOS | DD 5A E1 02 00 <mode> <checksum> 77 |
Mode 0..3, see below |
| Set BLE name | FF AA 07 <len> <ascii> <check8> |
Alternate name command frame |
MOS Control Mode
The Android app writes command 0xE1 with payload 00 <mode>.
| Mode | Meaning inferred from app logic |
|---|---|
0 |
charge on, discharge on |
1 |
charge off, discharge on |
2 |
charge on, discharge off |
3 |
charge off, discharge off |
The app response handler treats command 0xE1 status 0 as success.
Scan Hints
The app scans using only the service filter ff00. It also derives a MAC-like
address from advertising data on iOS and reverses byte order when the derived
address ends in A5, A4, 12, 52, or 00.
The desktop utility treats service ff00 as the strong match and device names
containing JBD, BMS, or BERGER as soft hints.