diy solar

diy solar

Decoding the DALY SmartBMS protocol

Have you tried logging the Bluetooth protocol that is sent between the BMS and e.g. your phone with an ordinary Bluetooth sniffer/logger? I've heard, there are a few good sniffer out there and you might be able to see, what protocol the BMS BT adapter is actually using. As the Bluetooth adapter connects to the same port as the UART, I'd assume, at least the messages are the same. But no guarantee on that ...
 
Have you tried logging the Bluetooth protocol that is sent between the BMS and e.g. your phone with an ordinary Bluetooth sniffer/logger? I've heard, there are a few good sniffer out there and you might be able to see, what protocol the BMS BT adapter is actually using. As the Bluetooth adapter connects to the same port as the UART, I'd assume, at least the messages are the same. But no guarantee on that ...
With my phone i don't get any usable results. With for example the "nrRF Connect" app i only see the values i already know from the gatt commands from my raspberry. I now ordered a "Adafruit Bluefruit LE Sniffer", we'll see if i get some more informations out of that. I will let you know if I'm succesfull.
 
With my phone i don't get any usable results. With for example the "nrRF Connect" app i only see the values i already know from the gatt commands from my raspberry. I now ordered a "Adafruit Bluefruit LE Sniffer", we'll see if i get some more informations out of that. I will let you know if I'm succesfull.
Hi,
Have you had luck reading the parameters using BLE ?

I have four Sterling Power 150Ah LiFePO4 batteries that come with Daly SmartBMS BLE builtin. As I use these on a boat I would like to set up either RasberryPi or Arduino to monitor the batteries and gather information that can be used to send alerts, turn off inverter should the SoC drop to low etc.

Cheers and Seasons Greetings!
 
I wish all these chinese BMS brands would just use standard protocols like Modbus or SMbus, would make things so much easier!
I have the MODBUS protocol that they use... It is a ods spreadsheet and won't load here...
 
I am looking for someone to parse the DALY or HEYO Smart BMS data (I have identified it and have all of the addresses etc...) and make it display on a Intelligent LCD like Nextion or??? It is for a product I manufacture and I will pay appropriate rates to get it done right. Interested??? Anyone???
A little clever averaging for smooth current readouts while loading with an inverter will be necessary... But it should be a slam dunk. Has to be fast, modern, and beautiful... And preferably use (virtually) no power. I also want to be able to display pictures (slides) and/or video for on board manual and product info.
 
I have the MODBUS protocol that they use... It is a ods spreadsheet and won't load here...
Thanks for uploading the protocol description in the Resources section.
Some comments:
  1. The document you posted does say "MODBUS" protocol but MODBUS is a specific protocol that definitely looks different (see MODBUS on Wikipedia). So I assume the author used this name because it probably uses the RS485 hardware layer (as MODBUS does in most cases - see RS485 on Wikipedia).
  2. Can you please specify the BMS that follow this protocol as the "standard" DALY RS485 protocol for 8S and up BMS is here in the Resource Section. I have a couple of DALY R16T and R16A BMS that I interface using this protocol in a Python script.
Can you please add your BMS type for which you received this document?
 
i want to use the daly bluetooth module it sends d2 03 00 80 00 29 96 5f i made software to set all the data on the lcd display that works with the normal protocol that was explained here in the forum. but when i connect the bluetooth module and send the same data as i send to the display nothing happend. but the bluetooth module sends sometimes d2 03 00 80 00 29 96 5f. does anybody has a idea to decode the bluetooth protocol ? i use the display and bluetooth to monitor the seplos bms. like a protocol converter.
 
Not sure it help ... I did monitor the UART (bluethooth modul) and this is the result

Sending of D2:03:00:80:00:29:96:5F →
D2:03:52:04:1A:0C:80:00:01:00:04:00:00:00:00:00:01:00:00:00:00:00:00:1C:20:0D:AC:0D:AC:0A:28:0A:28:00:8C:00:8C:00:68:00:68:74:CC:74:CC:74:90:75:D0:00:55:00:55:00:28:00:28:00:6E:00:6E:00:27:00:27:00:FF:00:FF:00:FF:00:FF:0C:80:00:14:00:01:00:01:02:A8:00:57:7F:8B

Sending: D2:03:00:A9:00:20:87:91→
D2:03:40:32:30:34:30:31:32:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:53:48:33:39:46:30:30:33:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:B8:F5

Sending: D2:03:00:C9:00:03:C6:56 ( Name und Battery type )
D2:03:06:31:32:33:34:35:36:4C:69:D2:03:06:31:32:33:34:35:36:4C:69

Sending: D2:03:00:00:00:3E:D7:B9 ->
D2:03:7C:0D:06:0D:09:0D:09:0D:07:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:3C:00:28:00:00:00:00:00:00:00:00:00:00:00:00:00:85:75:30:02:A8:0D:09:0D:06:00:3C:00:3C:00:00:02:CA:00:04:00:01:00:00:00:00:00:01:00:01:0D:07:00:03:00:00:00:00:00:00:00:00:00:00:E0:44

20Grad + 40 = 60 = 003C
0085 = 133 = 13.3V
02A8 = 680 = 68% SOC
0D09 + 0D06 = 3.337V + 3.334V (Max Min voltage of cell)
00:3C Tempr?

(

D2:03:7C:0D:06:0D:09:0D:09:0D: Voltage of each cell
07:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:3C:00:
28:00:00:00:00:00:00:00:00:00:
00:00:00:00:85:75:30:02:A8:0D:
09:0D:06:00:3C:00:3C:00:00:02:
CA:00:04:00:01:00:00:00:00:00:
01:00:01:0D:07:00:03:00:00:00:00:00:00:00:00:00:00:E0:44



D2:03:7C:0D:07:0D:0A:0D:0A:0D:
06:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:38:00:
28:00:00:00:00:00:00:00:00:00:
00:00:00:00:85:75:71:02:A8:0D:
0A:0D:06:00:38:00:38:00:01:02:
CA:00:04:00:01:00:00:00:00:00:
01:00:01:0D:08:00:04:00:54:00:00:00:00:00:00:00:00:2A:3A

00:54 = Actual current?


Still busy do decode this frame but found SOC Voltage, ...

Corrections, Ideas ?
 
This discussion is interesting and helpful. We are trying to integrate a teensy processor with a Daly BMS (72V 100A) via CAN bus. Has anyone here successfully used CAN Bus to communicate with Daly BMS? If so, grateful if you can indicate details about the specific CAN bus protocol that Daly BMS make use of. We could not find this information in the limited manufacturer documentation.
 
Last edited:
This discussion is interesting and helpful. We are trying to integrate a teensy processor with a Daly BMS (72V 100A) via CAN bus. Has anyone here successfully used CAN Bus to communicate with Daly BMS? If so, grateful if you can indicate details about the specific CAN bus protocol that Daly BMS make use of. We could not find this information in the limited manufacturer documentation.
no info or experience with teensy + CAN bus + Daly BMS :(

your project is really cool in my humble opinion, good luck!☀️???
 
This discussion is interesting and helpful. We are trying to integrate a teensy processor with a Daly BMS (72V 100A) via CAN bus. Has anyone here successfully used CAN Bus to communicate with Daly BMS? If so, grateful if you can indicate details about the specific CAN bus protocol that Daly BMS make use of. We could not find this information in the limited manufacturer documentation.
I bought a CAN adapter and successfully communicated with a DALY 16S 100A BMS using the DALY software - so I know it works and blasting fast it is !!!
On the other hand, I tried to get "behind" the CAN bus protocol and I assume, DALY is just using CAN hardware and run their own protocol on top of that. So it's like RS485 and MODBUS - which many people use synonym while DALY uses UART over RS485 and not any MODBUS protocol.
Same I guess for the CAN protocol in which each client gets a HW encoded address which defines also its priority in the CAN bus system (working in automotive myself, hence my humble opinion here). As the CAN protocol (automotive CAN or OpenCAN or whatever follows the standard) is in its structure well defined and fix, the DALY implementation looks QUITE different. You can find it in the resource section DALY CAN protocol. You can also find it on the DALY website after heavy searching and lots of luck ;)

So, although I did not go down this road, I would start with understanding the protocol implementation by listening into the CAN communication of the two DALY components. I would at least assume, you can't use any CAN stack provided by Teensy enthusiasts, if my assumption is correct.

But please post your findings here and if you're successful, write a small How-To in the resource section ...
 
Last edited:
Anyone know if there is a way to control the Digital IOO GPIO ports DO0-DO3 on the Daly BMS modules?
Must be there for some reason?
This is a DI/DO-Testing button in their Power App, not sure what it does, DI2 is always high, but no way of controlling the pins to turn things on/off from custom software...

Ive tried writing to the Status Infor 0x94 command with flags for ports set... but nothing happens..
Hidden command? There just for their internal use only? But wonder why they mention the Ports and label them Digital In/Out and have a test button??

1671689076842.png
 
Anyone know if there is a way to control the Digital IOO GPIO ports DO0-DO3 on the Daly BMS modules?
Must be there for some reason?
This is a DI/DO-Testing button in their Power App, not sure what it does, DI2 is always high, but no way of controlling the pins to turn things on/off from custom software...

Ive tried writing to the Status Infor 0x94 command with flags for ports set... but nothing happens..
Hidden command? There just for their internal use only? But wonder why they mention the Ports and label them Digital In/Out and have a test button??

View attachment 125776
I haven't played with the DI/DO myself but I guess, one would need a special firmware on the BMS that allows for it. I had to ask quite nicely for a firmware that let one change the board number (which you obviously mastered already) and I know that there is another firmware that lets one calibrate the current. But unfortunately, if I flash one firmware, the other's functionality is gone. So I assume, DALY can and has to switch on certain functionalities in the firmware at compilation. So you might make a wish list, contact DALY and ask if they would provide. Good luck!
 
I am disassembling the protocol from the firmware for this and it seems on the firmware I have a checksum has been implemented. The format I have so far discovered is:

Code:
Byte 0 = Header, must always be 0xA5
Byte 1 = Unknown still (valid values are 0x40 and 0x80)
Byte 2 = Command
Byte 3 = Must always be 0x08
Byte 4 = Checksum

The checksum calculation is simple, it's just:
Code:
checksum = (uint8_t)(byte0 + byte1 + byte2 + byte3);

There are a heck of a lot of commands that are not yet publicly known, the firmware has sets of commands, and some are extended commands. The below is a complete list of all the short command codes the device sees as valid:

Code:
0x00 - 0x0F = Command Set 1 - Extended Length Commands
0x10 - 0x27 = Command Set 2
0x50 - 0x6A = Command Set 3
0x90 - 0x99 = Command Set 4
0xD0 - 0xDD = Command Set 5

As I discover more I will update THIS post.
 
Hello,
I also want to access information pieces (Soc, Load, Voltage) from Daly, but by Bluetooth.
Anybody that found out more reliable stuff?
It seems there is a lot on github. Tested a lot. Had a lot of errors. Does not work on recent version xyz etc
I also heard about some Daly Documentation for Bluetooth connectivity.
Any help would be highly appreciated.
Thanks.
 
Back
Top