Decode display port traffic

[syssi]

https://github.com/jblance/mpp-solar/issues/224#issuecomment-1123166015

For 'investigative' purposes, on my display I'm presently showing 0.00 Amps, 13.1 Volts, error 9 and 0% SOC. Sorry I can't give you more meaningful data, the board is essentially just on the bench at the moment, it's not doing any actual work.

ScreenCapture9600.txt

1. Identify SOF and EOF

[syssi]

@EasilyBoredEngineer Could you help to identify the start byte and end byte of a display frame by timing? It's hard to guess. :-)

[23900]

display port protocol: http://www.jk-bms.com/en/Upload/2023-12-05/1556482191.pdf

[syssi]

# Offset  Content                                 Type     Unit    Remarks
#  0      Battery voltage                        UINT16    10mV
#  2      Battery current                         INT16    0.1A
#  4      Reserved                               UINT16    -
#  6      State of charge                        UINT16    %
#  8      Maximum pressure difference            UINT16    mV
# 10      MOSFET temperature                      INT16    ℃
# 12      Battery temperature                     INT16    ℃
# 14      System warning                         UINT16    -       0: no alarm, 1: alarm
# 16      Cell average voltage                   UINT16    mV
# 18      Balanced switch state                  UINT16    -       0: close, 1: open
# 20      Charging MOS status                    UINT16    -       0: close, 1: open
# 22      Discharging MOS status                 UINT16    -       0: close, 1: open
# 24      Cell voltages[24]                   24*UINT16    mV
# 72      Single unit over-discharge alarm       UINT16    -       0: no alarm, 1: alarm
# 74      Cell overcharge alarm                  UINT16    -       0: no alarm, 1: alarm
# 76      Overcurrent alarm                      UINT16    -       0: no alarm, 1: alarm
# 78      MOS over temperature alarm             UINT16    -       0: no alarm, 1: alarm
# 80      Battery over temperature alarm         UINT16    -       0: no alarm, 1: alarm
# 82      Short circuit alarm                    UINT16    -       0: no alarm, 1: alarm
# 84      Co-handling communication exceptions   UINT16    -       0: no alarm, 1: alarm
# 86      Balance line resistance is too large   UINT16    -       0: no alarm, 1: alarm
# 88      The number of strings does not match   UINT16    -       0: no alarm, 1: alarm

[syssi]

# Frame structure

0xA5 0x5A  # Frame header
0x5D       # Data length (fixed / always 93 bytes)
0x82       # Frame type (fixed, it's always the status frame)
0x10 0x00  # Address
... 90 bytes data ...
+ Checksum?

[syssi]

I would be happy about a traffic capture. I could provide some instructions how to sniff the traffic between the BMS and the display using an ESP + RS485 module.

[23900]

Unfortunately, the display port and CAN port are both one-way, which means it can only receive BMS data but cannot send control instructions.

[23900]

If you remove the RS485 chip, connect RO to B and DI to A, the RS485 function of the display port becomes a 5V level uart port. A=uart tx B= uart RX (However, in fact, there is only TX on my BMS hardware, and RX is not connected to the MCU pin of BMS.)

[blacklopo]

Today I tried to capture display data. According manual the protocol parameters are 2400bps, RS485, pins according https://github.com/syssi/esphome-jk-bms/blob/main/docs/display-port.md. It worked perfectly.

Captured data: EXPORT3.hex.zip

Decoded data: b'\xa5Z' -23206 b']\x82' 23938 b'\x10\x00' 4096 b'\nw' 2679 b'\xff\xf8' -8 b'\x00\x02' 2 b'\x008' 56 b'\x00\x01' 1 b'\x00\x18' 24 b'\x00\x16' 22 b'\x00\x01' 1 b'\r\x15' 3349 b'\x00\x01' 1 b'\x00\x01' 1 b'\x00\x01' 1 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x15' 3349 b'\r\x16' 3350 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0 b'\x00\x00' 0