Software board general agreement

I. Overview
This protocol is a universal protocol for the RS485/RS232/UART interface of the Polar Air Active Balance Protection Board, and the baud
rate is 9600bps.
II. The frame structure
In the communication process, the protection board is always the slave and the remote device is the master. All communication can only
be initiated by the master and responded by the slave. To facilitate the distinction, it is agreed that the frame sent by the host is the configuration
frame, and the frame sent by the protection board is the response frame.
The configuration frame includes start bit, status bit, command code, data length, data content, checksum, and stop bit. The frame structure is as
follows:
Start bit Status bit Command code Data length Data content check Stop bit

among them:
1） Start bit: 1 byte, indicating the start of a frame of data, fixed to 0xDD;
2） Status bit: 1 byte, status 0xA5 means read, status 0x5A means write.
3） Command code: 1 byte. In the communication process, the command code is used to distinguish the data content carried in the
configuration frame. The corresponding relationship between each command code and the data carried is as follows:
Status bit Command code Data content
0x03 Read basic information and status
0x04 Read battery cell voltage
Read the hardware version number
0xA5 0x05
of the protection board
Read the private data of the
0x06
protection board user
0x5A 0xE1 MOS control instructions
4） Data length: 1 byte, indicating the effective length of the data carried in the frame.
5） Data content: N bytes, the content carried by the frame data, when the data length is 0, there is no such part.
6） Verification: 2 bytes, the verification field is "command code + length byte + data segment content", the verification method is the
 sum of the above fields and then the inverse plus 1, the high bit is in the front and the low bit is in the back.
7） Stop bit: 1 byte, indicating the end of a frame of data, fixed as 0x77;
The response frame contains the start bit, status bit, command code, data length, data content, checksum, and stop bit. The frame
structure is as follows:
Start bit Command code Status bit Data length Data content check Stop bit

among them:
1） Start bit: 1 byte, indicating the start of a frame of data, fixed to 0xDD;
2） Command code: 1 byte, which is the command code of the configuration frame that this frame responds to.
3） Status bit: 1 byte, 0x00 means correct, 0x80 means error.
4） Data length: 1 byte, indicating the effective length of the data carried in the frame.
5） Data content: N bytes, the content carried by the frame data, when the data length is 0, there is no such part.
6） Verification: 2 bytes, the verification field is "command code + length byte + data segment content", the verification method is the
sum of the above fields and then the inverse plus 1, the high bit is in the front and the low bit is in the back.
7） Stop bit: 1 byte, indicating the end of a frame of data, fixed as 0x77;

III. Communication example

1） Read basic information and status

Host computer send: DD A5 03 00 FF FD 77
BMS response: DD 03 00 1B 17 00 00 00 02 D0 03 E8 00 00 20 78 00 00 00 00 00 00 10 48 03 0F 02 0B 76 0B 82 FB FF 77
Red is the checked byte, which is the sum of all bytes; the latter 2 are the check results, which are the sum of all the check data in the front
and then take the inverse +1.
The data content structure of the response frame is as follows:
Data content length Description
Total voltage 2 Byte Unit: 10mV; high byte first, low byte last.
 Unit: 10mA; judge the battery charge and discharge status by current, charge is positive,
Total current 2 Byte
discharge is negative
The remaining capacity 2 Byte Unit: 10mAh;
Nominal capacity 2 Byte Unit: 10mAh;
Cycles 2 Byte Unit: times;
Use 2 bytes to transmit such as 0x2068, where the date is the lowest 5: 0x2028&0x1F = 8
Production Date 2 Byte means the date; month (0x2068>>5)&0x0f = 0x03 means March; the year is 2000+
(0x2068>>9) = 2000 + 0x10 =2016;
Each bit represents the balance of each string, 0 means off, 1 means on, which means
Equilibrium 2 Byte
1~16 strings
Each bit means each string is balanced, 0 means off, 1 means on, which means 17~32
Equilibrium_High 2 Byte
strings, and supports up to 32 strings
Protection status 2 Byte Each bit represents a protection status, 0 is unprotected, 1 is protected. See note 1:
Keep 1 Byte
remaining battery 1 Byte Indicates the percentage of remaining capacity
MOS indicates status, bit0 means charging, bit1 means discharging, 0 means MOS is off,
FET control status 1 Byte
1 means on
Number of battery strings 1 Byte Number of battery strings
Number of NTC 1 Byte Number of NTC
The unit 0.1K adopts absolute temperature transmission, 2731+(actual temperature*10), 0
N NTC content 2*N Byte
degrees = 2731 25 degrees = 2731+25*10 = 2981;

Note 1: Description of protection status:

BIT 0 monomer overvoltage protection BIT 5 charging low temperature protection BIT 10 short circuit protection
BIT 1 monomer undervoltage protection BIT 6 discharge over temperature protection BIT 11 front-end detection IC error
BIT 2 whole set of overvoltage protection BIT 7 discharge low temperature protection BIT 12 software locks MOS
BIT 3 whole group undervoltage protection BIT 8 charging overcurrent protection BIT 13~ BIT 15 reserved
BIT 4 charging over temperature protection BIT 9 discharge overcurrent protection

2） Read battery cell voltage

Host sends: DD A5 04 00 FF FC 77
BMS response: DD 04 00 1E 0F 66 0F 63 0F 63 0F 64 0F 3E 0F 63 0F 37 0F 5B 0F 65 0F 3B 0F 63 0F 63 0F 3C 0F 66 0F 3D F9 F9 77
The data content structure of the response frame is as follows:

Data content length the data shows

First string cell voltage 2Byte Unit mV, high order first
Second string cell voltage 2Byte Unit mV, high order first
The third string cell 2Byte Unit mV, high order first
voltage
Nth string cell voltage 2Byte Unit mV, high order first

3） Read the hardware and software version number of the protection board
Host sends: DD A5 05 00 FF FB 77
BMS response: DD 05 00 0A 30 31 32 33 34 35 36 37 38 39 FD E9 77
The data content structure of the response frame is as follows:

Data length N the data shows

BYTE N The reply content is ASCII code (for example, the hardware version is H-XXXX)

4） Read the private data of the protection board user

Machine send: DD A5 06 00 FF FA 77
BMS response: DD 06 00 0A 30 31 32 33 34 35 36 37 38 39 FD E9 77
The data content structure of the response frame is as follows:
Data length N the data shows
BYTE N The reply content is ASCII code (than "23562455")

5） Control MOS instruction

The host sends a control MOS command:
 Host sends: DD 5A E1 02 00 XX CH CL 77
BMS response: DD E1 00 00 CH CL 77
The comparison table of XX and MOS actions is as follows:
XX value MOS action
0x00 Release the software to close the MOS tube action
0x01 Software closes charging MOS, and releases software
closes discharging MOS
0x02 The software closes the discharge MOS, and the software
closes the charging MOS.
0x03 Software turns off charge and discharge MOS at the
same time
Example: The host sends DD 5A E1 02 00 02 FF 1B 77 to indicate that the software closes the discharge MOS;