This repo is a collection of notes and tools made while reversing operation of the BMS in JUMP battery packs.

Thanks to Jehu and Alex for documenting their work on waking up these batteries:

• https://github.com/alex3dbros/LGH1ScooterPackPower
  Video detailing the hookup of micro-controller to can bus enabling battery pack.
• https://www.youtube.com/watch?v=E87EcLeqIX0
  Source code for STM32 that enables battery output.

• Manufactured by BYD. Model INR18650MH1-10S4P (R10 BMS)

  

The BMS speaks the CANopen protocol which makes it easy to fetch all data and interact with the device. At minimum read these two links if not familiar with CAN bus:

• https://en.wikipedia.org/wiki/CAN_bus

• https://en.wikipedia.org/wiki/CANopen

• CAN bus baud rate: 100000

• CANopen device profile is unknown and likely vendor specific. The Energybus / Cia-454 profile for light electric vehicles is worthy of investigation but its not publicly available...can-OPEN ?

• CANopen node id is 0x30 and no obvious way to change it. Methods such as LSS do not work. Hopefully there is a method via software or hardware. Worst case is a static ID which means only a single battery per bus.

• BMS starts up with 1 sec heartbeat in pre-operational mode.

• 2 pre-mapped TPDOs available. Mapping is fixed.

• Check Alex's repo for BMS connector pinout

  Pin	Function
  1 - BLUE
  2 - WHITE	3.3v
  3 - RED	5v
  4 - YELLOW	CAN HI
  5 - GREEN	CAN LO
  6 - BLACK	GND
  7 - ORANGE	Power enable, connect to 8
  8 - PINK	Power enable, connect to 7

• Power/charge connector Molex ML-XT 4 pin ( should be compatible with Deutsch DT connectors )

• Data connector: JST JWPF 8 pin

The main document spec document is available in HTML, Markdown, and YAML below.

The most interesting stuff is located at canopen index 0x2000 and higher.

• Power output enable/disable
• Battery Voltage
• Battery Temperature
• Current in mA
• Capacity in mAh
• Max Capacity in mAh
• State of Charge in %
• How to pull data from BMS or config BMS to push data.

1. A way to change the device ID so more than one battery can be controlled on the same bus.
2. Balance information such as per cell voltage or deltas if any.
3. Cycle count/history if any.
4. Calibration procedure if not automatic.
5. LVC info if any.
6. High resolution photos of the BMS and its components for repair/debugging. Already killed one caused by short on 8 pin connector. DC-DC stage is dead.

Tools were created with Python under linux. Should run on windows but hasn't been tested and may need fixing.

Minimum Requirements

• Python 3.2 or later
• pipenv

Run the following inside the jump_bms directory to automatically install the rest and setup shell to run the tools.

pipenv install
pipenv shell

Setup your can interface:

ip link set can0 type can bitrate 100000
ip link set can0 txqueuelen 1000 up

• Analyze the test scenarios and see what you can decode.

• Get yourself a USB to CAN interface so you can poke around and run your own tests. Anything supported by the python-can library should work:

  https://python-can.readthedocs.io/en/master/interfaces.html

• Add anything you discover to the spec file jump_bms_spec.yaml and submit a pull request.

Reversing the device is mostly about decoding the meaning of each data point on the BMS.

We can dump all the data and compare the differences under various testing conditions to facilitate this:

• Battery placed in freezer for about 2 hours and then removed.
• Output off, no load, 34.3v

1. cold-1.csv - 5 min after, room temp 24c
2. cold-2.csv - 30 min after, room temp 24c
3. cold-3.csv - 45 min after, room temp 23c
4. cold-4.csv - 60 min after, room temp 23c

• Dump BMS at idle with power on then off

1. idle-power-off.csv - Power off
2. idle-power-on.csv - Power on

• Charge battery under different conditions

1. charge-2A.csv - Charging @ 2A 36v
2. charge-5A-40v.csv - Charging @ 5A 40v