81 lines
2.9 KiB
Markdown
81 lines
2.9 KiB
Markdown
# Berger LFP BLE Command Catalog
|
|
|
|
Status: decompiled from Berger LFP Android app `1.0.3`. Entries are based on
|
|
the bundled uni-app JavaScript code, not live BLE captures.
|
|
|
|
## GATT Surface
|
|
|
|
| UUID | Direction | Purpose |
|
|
| --- | --- | --- |
|
|
| `0000ff00-0000-1000-8000-00805f9b34fb` | service | Main JBD/BMS service |
|
|
| `0000ff01-0000-1000-8000-00805f9b34fb` | notify/read | BMS response frames |
|
|
| `0000ff02-0000-1000-8000-00805f9b34fb` | write no response | BMS command frames |
|
|
|
|
## Frame Format
|
|
|
|
Read command:
|
|
|
|
```text
|
|
DD A5 <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
|
|
```
|
|
|
|
Write command:
|
|
|
|
```text
|
|
DD 5A <command:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
|
|
```
|
|
|
|
Checksum:
|
|
|
|
```text
|
|
sum = command + length + sum(payload)
|
|
checksum = ((sum ^ 0xFFFF) + 1) & 0xFFFF
|
|
```
|
|
|
|
Responses observed in the parser:
|
|
|
|
```text
|
|
DD <command:8-bit> <status:8-bit> <length:8-bit> <payload> <checksum:16-bit> 77
|
|
```
|
|
|
|
## Commands In App
|
|
|
|
| Name | Frame / payload | Meaning |
|
|
| --- | --- | --- |
|
|
| Read base data | `DD A5 03 00 FF FD 77` | Pack voltage/current/SOC/capacity/MOS/temps |
|
|
| Read cell voltages | `DD A5 04 00 FF FC 77` | Per-cell voltage list |
|
|
| Read hardware version | `DD A5 05 00 FF FB 77` | ASCII hardware version |
|
|
| Enter factory mode | `DD 5A 00 02 56 78 FF 30 77` | Factory/settings mode |
|
|
| Exit factory mode | `DD 5D 01 02 28 28 FF AD 77` | Exit factory/settings mode |
|
|
| Read BMS model | `DD A5 FA 03 00 B0 04 FE 4F 77` | New-style FA parameter `0xB0`, length `4` |
|
|
| Read battery model | `DD A5 FA 03 00 9E 0C FE 59 77` | New-style FA parameter `0x9E`, length `12` |
|
|
| Read full-charge capacity | `DD A5 FA 03 00 70 01 FE 92 77` | New-style FA parameter `0x70`, length `1` |
|
|
| Read barcode, new version | `DD A5 FA 03 00 58 10 FE 95 77` | New-style FA parameter `0x58`, length `16` |
|
|
| Read manufacturer, new version | `DD A5 FA 03 00 38 10 FE B5 77` | New-style FA parameter `0x38`, length `16` |
|
|
| Read barcode, old version | `DD A5 A2 00 FF 5E 77` | Old-style barcode |
|
|
| Read manufacturer, old version | `DD A5 A0 00 FF 60 77` | Old-style manufacturer |
|
|
| Set charge/discharge MOS | `DD 5A E1 02 00 <mode> <checksum> 77` | Mode `0..3`, see below |
|
|
| Set BLE name | `FF AA 07 <len> <ascii> <check8>` | Alternate name command frame |
|
|
|
|
## MOS Control Mode
|
|
|
|
The Android app writes command `0xE1` with payload `00 <mode>`.
|
|
|
|
| Mode | Meaning inferred from app logic |
|
|
| ---: | --- |
|
|
| `0` | charge on, discharge on |
|
|
| `1` | charge off, discharge on |
|
|
| `2` | charge on, discharge off |
|
|
| `3` | charge off, discharge off |
|
|
|
|
The app response handler treats command `0xE1` status `0` as success.
|
|
|
|
## Scan Hints
|
|
|
|
The app scans using only the service filter `ff00`. It also derives a MAC-like
|
|
address from advertising data on iOS and reverses byte order when the derived
|
|
address ends in `A5`, `A4`, `12`, `52`, or `00`.
|
|
|
|
The desktop utility treats service `ff00` as the strong match and device names
|
|
containing `JBD`, `BMS`, or `BERGER` as soft hints.
|