12V/48V lithium iron phosphate battery module communication data sheet

Time	Revision
2019-6-29	Add time synchronization protocol, alarm record
2019-7-10	The alarm information adopts classification, and the real-time data and alarm records are changed. Delete WIFI/BLE connection status
2019-9-6	Add address and series no. Read/write
2019-09-29	Add revision。。。。。。
2019-10-19	Add software version no.

WIFI and Bluetooth are optional. WIFI and Bluetooth use E103-W01 and E104-BT01 of Chengdu Ebyte Electronic Technology.Communication data high byte first, low byte behind.

The serial port uses 485 communication, and the device address is distinguished by dial code (1~15, the soft address is used when the dial code is empty, the default is 170), the 485 baud rate is 9600, the data bit is 8 bits, the stop bit is 1, and there is no check.

Read-only real-time data. Use 03H/04H to obtain

Register address	Description	Format	Read/write	Remark
0	Equipment alarm information
1	Operational warning information	U16	R	Each bit represents an alarm state
2	Status	U16	R	Every 1/2 bit represents a state
3	Total voltage	S16	R	±xx.xxV
4	Current	S16	R	±xx.xA
5	SOC	S16	R	XXX%
6	SOH	S16	R	XXX%
7	Number of cycles	S16	R	Xxxx no.s
8	Number of cells	S16	R	Indicates how many cell voltages are valid, a fixed value
9~24	1~16 cell voltage	S16	R	x.xxxV，Unused/invalid defined as reserved
25~28	1~4Temp.	S16	R	±Xx.x℃
29	1~8 single cell over-voltage	U16	R	Every 2 bits represent the status of 1 cell, 0=normal
30	9~16 Single Cell low-voltage	U16	R	Every 2 bits represent the status of 1 cell, 0=normal
31	1~8 Single Cell low-voltage	U16	R
32	9~16Single Cell low-voltage	U16	R
33	1~4 High Temp. Alarm	U16	R
34	1~4 Low-Temp. Alarm	U16	R
35~63	Keep

Read-only device information. Use 03H/04 to obtain, this data is fixed data and will not change

Register address	Description	Format	Read/write	Remark
5000	Equipment no.	8byte	R	BCD code，Every 4bit represent a no.
5004	Rated voltage	U16	R	xx.xxV
5005	Rated current	U16	R	xx.xA
5006	Rated capacity	U16	R	xx.xAH
5007	Function support	U16	R	D8:WIFI_AP D9:WIFI_STA D10:BLE
5008	Single cell rated voltage	U16	R	xx.xxxV
5009	Single cell rated capacity	U16	R	xx.xAH
5010	No. Of Cell in parallel	U16	R
5011	No of cell in string	U16	R	Same as data 6
5012	485 address	U16	RW	Use this address to communicate with the device
5013	Main version	U16	R
5014	Minor version	U16	R
5015	Version release number	U16	R
5016~5063	Keep	U16	R

Serial number and calibration issued <not open to the public>

Definition	Function code	register	No.	Data
Broadcast or local address	0x10	6000	4	Byte1 ~byte8<Serial number>
Software address	0x06	5012		Software address.
Calibration on	0x 06	7000		FF 55 valid,rest is invalid
Calibration off		7001
Calibration data initialization		7002
Calibration data saving		7003
Current calibration1		7004		Current value, signed number(0.01A)
Current calibration 2		7005
VP calibration 1		7006		Voltage value, signed number(0.01V)
VP calibration 2		7007
C16 calibration 1		7008		Voltage value, signed number(1mV)
C16 calibration 2		7009

Read and write information. Use 03H to obtain, 10H to set (this function is reserved)

Register	Description	Format	Read/write	Remark
8000	Bluetooth ID	16byte	R	ASCII Code, ending with \0, the modification function is reserved, the default beginning with CP
8008	Keep	8byte	R
8012	WIFIAP ID (SSID)	16byte	R	ASCII Code, ending with \0, the modification function is reserved, the default beginning with CP
8020	WIFIAP password <WAP2>	16byte	R	ASCII Code, ending with \0, modification function reserved, default identification code suffix
8029-8063	keep

WIFIAP password <WAP2>：If it starts with \0, it means no password

Timely, can read and write information. Use 03H to obtain (reserved), 10H to set.

Register	Description	Format	Read/write	Remark
9000	Time year, month	2byte	R
9001	Time day、hour	2byte	R
9002	Time minutes、seconds	2byte	R

Alarm information, read-only information. Use 03H to obtain

Register	Description	Format	Read/write	Remark
10000/1000	Number of alarm records	U16	R	Up to 100 alarm records
10001/1001	Article 1 Alarm record year, month	U16	R
10002	Article 1 Alarm record date and hour	U16	R
10003	Article 1 Alarm record minutes and seconds	U16	R
10004	Article 1 Alarm Type	U16	R	See attached
10005	Article 1 Additional warning information	U16	R	See attached
10006	Article 2 Alarm record year, month	U16	R
10007	Article 2 Alarm record date and hour	U16	R
10008	Article 2 Alarm record minutes and seconds	U16	R
10009	Article 2 Alarm Type	U16	R
10010	Article 2 Additional warning information	U16	R
	…………
10496/1496	Article 100 Alarm record year, month	U16	R	Up to 100 records
10497/1497	Article 100 Alarm record date and hour	U16	R
10498/1498	Article 100 Alarm record minutes and seconds	U16	R
10499/1499	Article 100 Alarm Type	U16	R
10500/1500	Article 100 Additional warning information	U16	R

Alarm information

Register	Description	Read/write	Remark
B1B0	System total alarm	R	0：No alarm，1：alarm 2：Fault Take the highest alarm level
B3B2	Short circuit protection	R	……
B5B4	Total pressure over voltage	R	……
B7B6	Total Voltage low voltage	R	……
B9B8	Charging over current	R	……
B11B10	Discharging over current	R	……
B13B12	Single cell over voltage	R	Same as above, taking the highest alarm level
B15B14	Single cell low voltage	R	……

Equipment alarm information

Register	Description	Read/write	Remark
B1B0	Equipment failure	R	0：No alarm，1：alarm，2：failure
B3B2	Collection failure	R	……
B5B4	BLE failure	R	……
B7B6	WIFI failure	R	……
B9B8	keep	R	……
B11B10	keep	R	……
B13B12	Battery SOC failure	R	……
B15B14	Battery SOH failure	R	……

Status information

Register	Description	Read/write	Remark
B1B0	System status	R	10，Discharge 11 Charging, 01 Standby , 00 Not sure/invalid
B2	Discharge switch state		0：Disconnect 1：Closure
B3	Charging switch status		0：Disconnect 1：Closure
B4
B5
B6
B7
B8
B9
B10
B11
B12
B13
B14
B15

Alarm record correspondence table

Alarm type	Description	Extra information	Remark
0~3	Invalid data
4	Short circuit protection recovery	No
5	Short-circuit protection level 1 warning
6	Short circuit protection level 2 fault
7	Keep
8	Total voltage over voltage recovery	No
9	Total voltage over voltage level 1 warning
10	Total voltage over voltage level 2 fault
11	keep
12~15	Total voltage low voltage	No
16~19	Charging over current	No
20~23	Discharging over current	No
24~27	Single cell over voltage	No
28~31	Single cell low voltage	No
32~35	Temperature is too high	No
36~39	Temperature is too low	No
40~43	SOC too low	No
44~47	SOH too low	No
48~51	Collection failure	No
52~55	WIFI failure
56~59	BLE failure
60~63	Other failure

Connection method：

1.WIFI

The mobile phone finds the AP whose SSID is CP and connects. After the connection is successful, it uses TCP (IP, PORT to be determined) to connect to the SERVER on the AP (supports 1 connection). After the connection is successful, it sends query data to the device.

2.BLE

Use Bluetooth to search for Low Energy Bluetooth , CP starts, and connects.

Open the notification of 0000FFF1 channel under 0000FFF0 service. The data sent by the device is received through this channel.

The data sent to the device is sent through the 0000FFF2 channel. That is, write data to FFF2 channel for sending, and receive FFF1 channel for device response

Communication data: WIFI, BLE consistent

Example 1：

Address	Function code	Register	Quantity	CRC
0xAA	0x04	0x00 0x00	0x00 0x03	A9 D0

Get 3 data starting from 00 00

answer

Address	Function code	Number of bytes	Data	CRC
0xAA	0x04	0x06	0x11 0x22 0x33 0x44 0x55 0x66	E0 C9

The 3 responses are：0x1122、0x3344、0x5566

Example 2：

Address	Function code	Register	Quantity	CRC
0xAA	0x03	0x1F 0x40	0x00 0x08	5B D7

Get 8 data (16 bytes) starting with 1F 40 (8000)

Answer

Address	Function code	Number of bytes	Data	CRC
0xAA	0x03	0x10	43 50 45 53 2D 31 32 33 34 35 36 37 38 00 00 00	C2 13

The reply data are：4350 4553 2D31 3233 3435 3637 3800 0000,i.e.，CPES-12345678

On time：

Add.	Function code	Register	Quanity	Number of bytes	Data	CRC
1byte	1byte	2byte	2byte	1byte	6byte	2byte
0xAA	0x10	0x23 0x28	0x00 0x03	0x06	0x13 0x06 0x1D 0x0E 0x1E 0x28	BC 1C

The terminal sends data to the device, which means to register 0x23 0x28 (9000), sending 0x00 0x03 that is 3 data, 6 bytes of data, the content is: 0x13 0x06 0x1D 0x0E 0x1E 0x28 and 14:30 on June 29, 19 Minutes and 40 seconds

Answer

Add.	Function code	Register	Quanity	CRC
0xAA	0x10	0x23 0x28	0x00 0x03	12 5F

Get alarm records：

Add.	Function code	Register	Quanity	CRC
0xAA	0x04	0x27 0x10	0x00 0x06	62 A2

Get 6 data starting with 27 10 (10000)

Answer

Add.	Function code	Number of bytes	Data	CRC
0xAA	0x04	0x0C	0x00 0x05 0x10 0x06 0x08 0x05 0x01 0x02 0x00 0x09 0x00 0x05	XX XX

The reply data are: 0x00 0x05 means there are 5 alarm records in total

0x10 0x06 0x08 0x05 0x01 0x02 0x00 0x09 0x00 0x05

The first alarm, the time is 2016-06-08 05:01:02 Single cell is low-voltage, No. 5 battery is low-voltage.