Document BullTron live BLE capture

2026-07-10 19:01:42 +02:00
parent 5b6fdf764b
commit 0a1d7cff6e
4 changed files with 248 additions and 0 deletions
@@ -26,6 +26,10 @@ This is the app flow used to obtain battery/controller information such as disch
 8. It writes the current phone time to BMS registers using a `D210` multi-register write at `0x00D4`.
 9. Main screens periodically send `D203` read frames. Notifications are buffered, frame-split, CRC checked, parsed, then broadcast to UI screens.

+Live capture note: Android requested ATT MTU `517`; the battery responded with
+server MTU `247`. The app then used handle `0x0015` (`fff2`) for command writes
+and handle `0x0012` (`fff1`) for notifications.
+
 ## Pairing / Bonding

 - Needs Android bond before normal telemetry: likely no.
@@ -109,3 +113,7 @@ The `rated_capacity_Ah` input comes from the settings register set parsed into `
 6. Optionally query version with ASCII `AT+VER=?\r\n` on `02f...ff04`.
 7. Write the read frame for registers `0x0000` length `0x003E` to `fff2`.
 8. Parse the notify response from `fff1`, validate CRC, split into 16-bit big-endian words, then apply the formulas above.
+
+The live capture confirms that notifications may contain more than one `D203`
+frame concatenated. Split by frame header and byte count before applying CRC and
+register decoding.