AIMS Power Battery BLE BMS Interface

[Jagnala]

Hi,

I'm on the new side of Pi/Python but I'm trying to get my pi to get Battery data from my two AIMS power batteries.

I'm able to see all the devices programmatically:
List AIMS Devices

C6:6C:09:05:09:42 (RSSI=-79): AIMS12V200B-0626
C6:6C:09:04:0B:4A (RSSI=-83): AIMS12V200B-0443
....

I can connect and get all the service, characteristic, and descriptors for each device:

Connect C6:6C:09:05:09:42: AIMS12V200B-0626
return await client.get_services()
service 20 0000180a-0000-1000-8000-00805f9b34fb Device Information
characteristic 33 00002a23-0000-1000-8000-00805f9b34fb System ID ['read']
characteristic 35 00002a2a-0000-1000-8000-00805f9b34fb IEEE 11073-20601 Regulatory Cert. Data List ['read']
characteristic 25 00002a25-0000-1000-8000-00805f9b34fb Serial Number String ['read']
characteristic 37 00002a50-0000-1000-8000-00805f9b34fb PnP ID ['read']
characteristic 21 00002a29-0000-1000-8000-00805f9b34fb Manufacturer Name String ['read']
characteristic 27 00002a27-0000-1000-8000-00805f9b34fb Hardware Revision String ['read']
characteristic 31 00002a28-0000-1000-8000-00805f9b34fb Software Revision String ['read']
characteristic 23 00002a24-0000-1000-8000-00805f9b34fb Model Number String ['read']
characteristic 29 00002a26-0000-1000-8000-00805f9b34fb Firmware Revision String ['read']

service 43 f000ffc0-0451-4000-b000-000000000000 Unknown
characteristic 44 f000ffc1-0451-4000-b000-000000000000 Unknown ['write-without-response', 'write', 'notify']
descriptor 00002902-0000-1000-8000-00805f9b34fb (Handle: 46): Client Characteristic Configuration
descriptor 00002901-0000-1000-8000-00805f9b34fb (Handle: 47): Characteristic User Description
characteristic 48 f000ffc2-0451-4000-b000-000000000000 Unknown ['write-without-response', 'write', 'notify']
descriptor 00002902-0000-1000-8000-00805f9b34fb (Handle: 50): Client Characteristic Configuration
descriptor 00002901-0000-1000-8000-00805f9b34fb (Handle: 51): Characteristic User Description

service 10 00001801-0000-1000-8000-00805f9b34fb Generic Attribute Profile
characteristic 11 00002a05-0000-1000-8000-00805f9b34fb Service Changed ['read', 'indicate']
descriptor 00002902-0000-1000-8000-00805f9b34fb (Handle: 13): Client Characteristic Configuration

service 14 0000fff0-0000-1000-8000-00805f9b34fb Vendor specific
characteristic 15 0000fff2-0000-1000-8000-00805f9b34fb Vendor specific ['write-without-response']
characteristic 17 0000fff1-0000-1000-8000-00805f9b34fb Vendor specific ['read', 'notify']
descriptor 00002902-0000-1000-8000-00805f9b34fb (Handle: 19): Client Characteristic Configuration

service 39 0000180f-0000-1000-8000-00805f9b34fb Battery Service
characteristic 40 00002a19-0000-1000-8000-00805f9b34fb Battery Level ['read', 'notify']
descriptor 00002902-0000-1000-8000-00805f9b34fb (Handle: 42): Client Characteristic Configuration

.....


I am able to read all the "Device Information" characteristics without an issues but the rest of the characteristics seem to return nothing really

I did some BLE snooping on the comms between the app and a device and believe that command are being sent to service characteristic 15 0000fff2-0000-1000-8000-00805f9b34fb
and read from characteristic 17 0000fff1-0000-1000-8000-00805f9b34fb correct

the command to get data appears to be: d2030000003ed7b9

an example response is:d2037c0cce0ccf0ccc0cc90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003d00000000000000000000008300030083750e01f00ccf0cc4003d003d000203e00004000100160000000100010ccb000b002c00000000000000007e54



I tried to repeat this programmatically but the return from characteristic 17 0000fff1-0000-1000-8000-00805f9b34fb is always all 0s:

Below is the main code i've been working on:

import asyncio
import serial
from bleak import BleakScanner, BleakClient

address = "C6:6C:09:05:09:42" # MAC addres of the remove ble device

command = bytearray.fromhex("d2030000003ed7b9") # MODBUS Bluetooth command to get all data
print(command)

async def main():
devices = await BleakScanner.discover()
for d in devices:
DeviceInfo = str(d)
print(DeviceInfo)
if d.address == "C6:6C:09:05:09:42":
print(d.name, d.metadata, d.rssi)

if "AIMS12V200B-0626" in DeviceInfo:
print('Found it')
print(DeviceInfo)

#address = "C6:6C:09:05:09:42"
client = BleakClient(address)
try:
await client.connect()
if client.is_connected:
print('Connected to device')

# Send MODBUS command to device

await client.write_gatt_char("0000fff2-0000-1000-8000-00805f9b34fb", command)

#wait for response packet
response = await client.read_gatt_char("0000fff1-0000-1000-8000-00805f9b34fb")
#print("response: {0}".format("".join(map(chr,response))))
print('Response:',response.hex())

# Disconnect from device
await client.disconnect()
print('Disconnected from device')
except Exception as e:
print("Error:", e)

asyncio.run(main())

Attached is the only details the vendor has shared on the interface:


Any help or guidance would be very much appreciate.