Writing Data to JKBMS USB-TTL / RS-485

[alferz]

I think this is a question @Steve_S or @upnorthandpersonal may be able to answer.

I'm trying to write a python script that can write data to the JK BMS via USB-TTL. I found the documents here, specifically "Communication protocol between monitoring platform and BMS.pdf". There is also a chinese version at this link. I was able to read data successfully using inspiration from @upnorthandpersonal 's jk-bms_grafana project on github. Writing data back has been more of a challenge. I can send a write packet such as this one (modifies register 0xA3 to hex 0x0047/dec 71 -- the charging over temperature limit in celcius).

4e 57 00 15 00 00 00 00 02 03 00 a3 00 47 00 00 00 00 68 00 00 02 11

I get what looks like a successful reply from the BMS, however reading the 0xA3 value shows that it was unchanged from before. I have a feeling the answer lies with Command Word 0x05, the "Password Directives" command word from page 5 in the english spec doc. I formulated a packet like this to send the modify password first (the same password I use to modify settings in the bluetooth app, 0000):

4e 57 00 1c 00 00 00 00 05 03 00 30 30 30 30 00 00 00 00 00 00 00 00 00 00 68 00 00 01 f1
4e 57 00 1d 00 00 00 00 05 03 00 b2 30 30 30 30 00 00 00 00 00 00 00 00 00 00 68 00 00 02 a4

The 1st one uses no identifier in the ID+Data field, 2nd does use one. When I send these commands the BMS does not reply so it seems the packet may be malformed. Thinking that maybe a blank response is OK for setting the password, I tried the write 0xA3 command above directly aftfer sending it, but get the same results as before.

I was thinking maybe the Chinese version of the spec may have some clues about how to get this working that weren't translated by Google, any help there @Steve_S? Has anyone been able to get write commands working through the JKBMS serial communication path?

 

[upnorthandpersonal]

I've never tried writing to the BMS - I will see if I can make some time to dig into this, but no promises.

 

[pacman]

Hi Alferz, just yesterday I opened a similar thread: https://diysolarforum.com/threads/jk-bms-control-via-nodered.66068/.
I am not interested in changing parameters but rather being able to switch on/off the balancer switch.
I came to the same attempts you made with same results; I am using Node-RED, but this doesn't change the point.
Actually, I have been successful in switching on/off both the charge and the discharge switches and was expecting the same for the balancer, but nope.
If we get one of these working, I am confident we will get it all

 

[alferz]

@pacman that’s great that is one of the things I’d like to be able to control remotely as well. I’m working on a mqtt loader for the jkbms to interface with my victron nodered ESS mode 3 implementation for the multiplus-ii. Could you share the command you used to switch charge/discharge on and off? I see you can change those toggles without sending the password.

 

[pacman]

I have not yet made my mind on how to send the password and I believe that is the culprit to be able to change parameters.
These are the frames I use to operate the charge and discharge switches (these work without sending password):

Turn on charging switch
0x4E, 0x57, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x02, 0xab, 0x01, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x01, 0xd4

Turn off charging switch
0x4E, 0x57, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x02, 0xab, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x01, 0xd3

Turn on discharging switch
0x4E, 0x57, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x02, 0xac, 0x01, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x01, 0xd5

Turn off discharging switch
0x4E, 0x57, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x02, 0xac, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x00, 0x00, 0x01, 0xd4

 

[alferz]

Thanks, super helpful, I got these cmds to work with my B2A8S20P, and I see that the byte at position 11 (Transport Type) must be set to 0x02 "BMS Active Upload" for the write command to work. Unfortunately I still havent been able to get the BMS to accept the password after trying about 250 different packets and combinations of command word, frame source, transport type etc. I contacted the Chinese engineers at NEEY/JiKong via Alibaba to try and get a working example of a password verification packet and successful write command. Hopefully I get something back from them and I will be sure to share here.

 

[alferz]

@NEEY Electronics if you have any insights here please advise!

 

[alferz]

I heard back from JiKong and one of their Alibaba sales partners — apparently the write function was disabled at least in the current revision of the BMS they sell such as the B2A8S20P and writing parameters via rhe GPS port is currently not possible. The information in the protocol spec is apparently outdated from an older version of the BMS. As @pacman noted the charge/discharge mos can be controlled via GPS/TTL but no other parameters can be set. The sales reps I emailed cited battery safety as the reason for this change, not wanting a user to make a change that might put the pack at risk. This reasoning is a bit dubious to me because I can set wonky settings via the bluetooth app too, so what’s the difference if I write those via GPS?

I tried contacting @Nami who I believe is an owner or general manager for JiKong but could not get a response. Hopefully he can provide some insight here on whether the write function can actually be accessed or not when he has time.

 

[pacman]

Thanks Alferz, I agree that the explanation they gave you is nonsense.
Yesterday continuing my research, I found a thread from Jblance on GitHub that was saying the same: the write functionality is disabled.
Anyway if you connect to the BMS using BLE, you can operate the balancer switch for what I have understood. This makes things really upsetting
?