BMS CAN
BMS system internal CAN communication protocol
This article is suitable for engineers and technicians who use the CAN BUS
communication model of BMS to develop and test the communicationprotocol.
1.1 Physical layer descrip on
❖ Topological structure: The wiring topology of the network should be a linear
structure as compact as possible to avoid cable reflections. The cable
connecting the BMS to the bus backbone should be as short as possible. In
order to minimize standing wa ves, nodes cannot be connected at equal
intervals on the network, and access lines cannot be of equal length, and the
maximum length of access lines should be less than 1m.
❖ Terminal resistor: BMS has no onboard termina l resistor . Users should
prepare and connect their own terminal resistor according to the network
situation.
❖ Communication cable: Use twisted-pair shielded wire, which should be more
than 0.5m awayfromthepower lineand more than 0.1m away from t he
power control line. The "cross" wiring method can be used.
❖ Shielding measures: the shielding layer of each bus is connected
independently and grounded at a single point to avoid the potential difference
of the shielding layer caused by multi-point grounding when the body ground
is interfered.
1.2 Data link layer descrip on
² A complete set of data frames includes: frame start, arbitration field, control
field, data field, check field, response field and frame end.
² DA: destination address, SA: source address for sending this message.
² This protocol uses extended frames by default, and the baud rate is 250Kbps.
² The data link layer mainly refers to SAE J2284 -3-2010, GBT 36672 -2018,
SAE J1939 -21.
² The length of most data in this protocol is controlled within 8 bytes. If the
length is exceeded, it is called a super long frame, and multiple frames are
required to form a data packet to send (each data packet cannot exceed 255
frames). For data that needs to be sent in multiple frames, the first byte sends
the sequence number of the data frame, and the following 7 bytes are the data
content.
² The sending interval between two CAN data frames must be less than 50ms. If
it times out or the receiver loses frames, this packet will be invalid.
² The length of CAN message frame is 8 bytes, and the data adopts big -endian
format.
1.3 Applicaton layer descripp on
The data transmission adopts broadcast transmission, and the maximum
data bit per frame is 64 bits, and the reserved bits are all "0". Data transmission
adopts big -endian mode. See the table below:
Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bit0
Byte
0 7 6 5 4 3 2 1 0
1 15 14 13 12 11 10 9 8
2 23 22 21 20 19 18 17 16
3 31 30 29 28 27 26 25 24
4 39 38 37 36 35 34 33 32
5 47 46 45 44 43 42 41 40
6 55 54 53 52 51 50 49 48
7 63 62 61 60 59 58 57 56
Remarks: ：
Broadcast message: send information out in a regular and equal length of
time, and do not activate sending in anevent -triggered manner.
Event message: Triggered by an event change, no information is sent in othercases.
Broadcast/event message: indicates that when no event occurs, the content
of the frame is sent out for a fixed period of time. If an event occurs within the time
between two frames sent, the event will be responded to immediately and the
information after the event will be sent .
This document currently only contains broadcast messages. For event
messages with other functions, please ask B estWay Technology technical support
personnel for related documents.
1.4 Address alloca on able
1 vehicle control unit VCU 07(0x07)
2 Battery Management System BMS 09(0x09)
3 vehicle motor controller VMC 08(0x08)
4 Meter METER 10(0x0A)
5 Charger CHG 12(0x0C)
6 BMS host(Upper) computer BMS_PC 13(0x0D)
7 Broadcast address BROAD 255(0xFF)
Reference: 《GBT 36672-2018 Lithium-ion batery for electric motorcycles and electric mopeds 》
Appendix Table C.2 CAN network address allocaton table.
2.1 Broadcast message
2.1.1 Single cell voltage(maximum support 28s cell number)
ID: 0x0E640D09 ~ 0x0E6 A0D09：Cell 1~cell 28 cell data informa n
ID Cell voltage1~4
P R DP PF DA SA
3 1 0 100 BMS 0x0E640D09
Broadcast
address
Data
Position Data content Cycle Quality factor
Byte0 Battery 1 voltage high byte 1mV/Bit, offset 0; 3000 represents 3V
250ms*N
Byte1 Battery 1 voltage low byte Same as above
Byte2 Cell 2 voltage high byte Same as above
Byte3 Battery 2 voltage low byte Same as above
Byte4 Cell 3 voltage high byte Same as above
Byte5 Battery 3 voltage low byte Same as above
Byte6 Cell 4 voltage high byte Same as above
Byte7 Battery 4 voltage low byte Same as above
ID Cell voltage5~8
P R DP PF DA SA
3 1 0 101 BMS 0x0E650D09
Broadcast
address
Data
Position Data content Cycle Quality factor
Byte0
Battery 5 voltage high byte 1mV/Bit, offset 0; 3000 represents 3V
250ms*N
Byte1
Battery 5 voltage low byte Same as above
Byte2
Battery 6 voltage high byte Same as above
Byte3
Battery 6 voltage low byte Same as above
Byte4
Battery 7 voltage high byte Same as above
Byte5
Battery 7 voltage low byte Same as above
Byte6
Battery 8 voltage high byte Same as above
Byte7
Battery 8 voltage low byte Same as above
ID Cell voltage 9~12
P R DP PF DA SA 0x0E660D09
3 1 0 102 BMS
Broadcast
address
Data
Position Data content Cycle Quality factor
Byte0
Battery 9 voltage high byte 1mV/Bit, offset 0; 3000 represents 3V
250ms*N
Byte1
Battery 9 voltage low byte Same as above
Byte2
Battery 10 voltage high byte Same as above
Byte3
Battery 10 voltage low byte Same as above
Byte4
Battery 11 voltage high byte Same as above
Byte5
Battery 11 voltage low byte Same as above
Byte6
Battery 12 voltage high byte Same as above
Byte7 Battery 12 voltage low byte Same as above
ID Cell voltage 13~16
P R DP PF DA SA
3 1 0 103 BMS 0x0E670D09
Broadcast
address
Data
Position Data content Cycle Quality factor
Byte0
Battery 13 voltage high byte 250ms*N 1mV/Bit, offset 0; 3000 represents 3V
Byte1
Battery 13 voltage low byte Same as above
Byte2
Battery 14 voltage high byte Same as above
Byte3
Battery 14 voltage low byte Same as above
Byte4
Battery 15 voltage high byte Same as above
Byte5
Battery 15 voltage low byte Same as above
Byte6
Battery 16 voltage high byte Same as above
Byte7
Battery 16 voltage low byte Same as above
ID Cell voltage 17~20
P R DP PF DA SA
3 1 0 104 BMS 0x0E680D09
Data
Position Data content Cycle Quality factor
Byte0
Battery 17 voltage high byte 1mV/Bit, offset 0; 3000 represents 3V
250ms*N
Byte1
Battery 17 voltage low byte Same as above
Byte2 Same as above
Battery 18 voltage high byte
Byte3
Battery 18 voltage low byte Same as above
Byte4
Battery 19 voltage high byte Same as above
Byte5
Battery 19 voltage low byte Same as above
Byte6
Battery 20 voltage high byte Same as above
Byte7
Battery 20 voltage low byte Same as above
ID Cell voltage 21~24
P R DP PF DA SA
3 1 0 105 BMS 0x0E690D09
Data
Position Data content Cycle Quality factor
Byte0
Battery 21 voltage high byte 250ms*N 1mV/Bit, offset 0; 3000 represents 3V
Byte1
Battery 21 voltage low byte Same as above
Byte2
Battery 22 voltage high byte Same as above
Byte3
Battery 22 voltage low byte Same as above
Byte4
Battery 23 voltage high byte Same as above
Byte5
Battery 23 voltage low byte Same as above
Byte6
Battery 24 voltage high byte Same as above
Byte7
Battery 24 voltage low byte Same as above
ID Cell voltage 25~28
P R DP PF DA SA
3 1 0 106 BMS 0x0E6A0D09
Data
Position Data content Cycle Quality factor
Byte0
Battery 25 voltage high byte 250ms*N 1mV/Bit, offset 0; 3000 represents 3V
Byte1
Battery 25 voltage low byte Same as above
Byte2
Battery 26 voltage high byte Same as above
Byte3
Battery 26 voltage low byte Same as above
Byte4
Battery 27 voltage high byte Same as above
Byte5
Battery 27 voltage low byte Same as above
Byte6
Battery 28 voltage high byte Same as above
Byte7
Battery 28 voltage low byte Same as above
Temperature sensing informa
2.1.2 ID: 0x0E6C0D09： n
ID
Temperature sensing information
P R DP PF DA SA
3 1 0 108 9 0x0E6C0D09
Data
Position Data content Cycle Quality factor
Byte0
Temperature sensing 1 1℃/bit 40: 0x64 = 100 60 ℃
250ms*N
Byte1
Temperature sensing 2 Same as above
Byte2
Temperature sensing 3 Same as above
Byte3
Temperature sensing 4 Same as above
Byte4
Temperature sensing 5 Same as above
Byte5
Temperature sensing 6 Same as above
Byte6
Temperature sensing 7 Same as above
Byte7
Temperature sensing 8 Same as above
2.1.3 General ba ey pack informaaon
ID: 0x0A6D0D09 ~ 0x0A740D09：Batery pack informaaon summary
ID
General information 1
P R DP PF DA SA
0x0A6D0D09
2 1 0 109 BMS
Data
Position Data content Cycle Quality factor
Byte0
Total high byte
250ms*N The resolution is 0.1V/bit, such as:
Byte1 0x01E0 = 480 means the total voltage is
Total low byte 48.0V
Byte2
Total current high byte positive, discharging is negative (discharging
current is the complement of current value),
Byte3
BIT7 is the sign bit: 0xFFD4 = 65235 means
Low byte of total current
discharging 30A
Byte4 Remaining battery high byte Resolution 0.1Ah/bit such as: 0x01F4=
500 means 50Ah
Byte5 Remaining battery low byte
Byte6
High byte of full charge
Same as above
Byte7 Low byte of full charge
ID General information 1
P R DP PF DA SA
0x0A6E0D09
2 1 0 110 BMS
Data
Position Data content Cycle Quality factor
Byte0 SOC Resolution 0.001/bit such as: 0x02ED =
SOC high byte 749 means SOC is 74.9%
Byte1 SOC 250ms*N
SOC low byte Same as above
Byte2 SOH high byte
Byte3 SOH low byte 0~65535
Byte4 High byte of cycle times
Byte5 Low byte of cycle times
Byte6
Byte7
ID
General information 2
P R DP PF DA SA
0x0A6F0D09
2 1 0 111 BMS
Data
Position Data content Cycle Quality factor
Byte0 High byte of highest cell voltage 1mV/Bit, offset 0; 0x0F3C=3900
250ms*N represents 3.9V
Byte1
Low byte of highest cell voltage
Byte2 The highest cell voltage cell
number
Byte3 Lowest
battery cell voltage high byte
1mV/Bit, offset 0; 0x0E10=3600
Byte4 Low byte of lowest cell voltage represents 3.6V
Byte5 Lowest cell voltage cell number
Byte6 1mV/Bit, offset 0; 0x0E10=3600
Average cell voltage high byte
represents 3.6V
Byte7
Average cell voltage low byte
ID General information 3
P R DP PF DA SA
2 1 0 112 BMS 0x0A700D09
Data
Position Data content Cycle Quality factor
Byte0
Maximum cell temperature Resolution 1℃/bit Offset: 40 For example,
250ms*N
0x64 = (100 - 40) is 60℃.
Byte1 Maximum cell temperature
cell number
Byte2 High temperature
difference
Byte3 Low temperature
difference
Byte4 Minimum cell
temperature
Byte5 Minimum
cell temperature cell number
Byte6 High cell
voltage difference
Byte7 Low cell 1mV/Bit, offset 0; 0x0064 = 100
voltage difference represents 100mV
ID
General information 4
P R DP PF DA SA
2 1 0 114 BMS 0x0A720D09
Data
Position Data content Cycle Quality factor
Byte0
Number of battery cells
250ms*N
Byte1 MOS
temperature sense quantity
Byte2 Quantity of
environmental temperature
Byte3 Number of battery The maximum number of battery strings
strings currently supported is 25S
Byte4 Total temperature = sum(byte0...byte2)
Total temperature sense =
sum(byte0...b yte2)
Byte5
Byte6
ID 4
P R DP PF DA SA
2 1 0 115 BMS 0x0A730D09
Data
Position Data content Cycle Quality factor
Byte0 Balanced mode 0x00: automatic normal mode
250ms*N 0x01
Byte1 0x00: No balance 0x01: Charge
Balanced status
balance 0x02: Discharge balance
0x03: Standstill balance
Byte2 Balance information 1 1~8S cell balance state
Byte3 Balance information 2 9~16 S cell balance state
Byte4 3 17~24S
Balance information 3 17 ~24 S cell balance state
Byte5
Balance information 4 25~32S cell balance state
Byte6
Byte7
ID
General information 4
P R DP PF DA SA
2 1 0 180 BMS 0x0AB40D09
Data
Position Data content Cycle Quality factor
Byte0
Charge current exists bit0 = 1,
Protection status 1 250ms*N Charging overcurrent bit1 = 1,
Discharge current exists bit4 = 1,
Discharge overcurrent bit5 = 1,
Discharge short -circuit bit6 = 1,
Byte1 Open battery bit0 = 1,
Temperature open circuit bit1 = 1,
Command to turn o ffthe charging
Protection status 2
tube bit2 = 1,
Command to turn o ffthe discharge
tube bit3 = 1,
Cell s overvoltage bit4 = 1,
Cells undervoltage bit5 = 1
Pressure difference is too large bit6 =
1,
No. 68, Rhinoceros Industry, Dalang Town Dongguan, Guangdong Province, China.
Total pressure is too low bit7 = 1,
Byte2 The charger is not connected bit1 = 1,
Protection status 3
Charging over temperature bit2 = 1,
Discharge over temperature bit3 = 1,
Charging low temperature bit4 = 1,
Discharge low temperature bit5 = 1,
Large charging temperature
difference bit6 = 1,
Large discharge temperature
difference bit7 = 1
Byte3 Protection status 4 Turn on the charging tube bit0 = 1,
Turn on the charging tube bit0 = 1,
Charge tube failure bit2 = 1,
Discharge tube failure bit3 = 1,
Weak current switch is o ffbit4 = 1,
Turn o ffthe charging tube externally
bit5 = 1
Turn off the discharge tube
externally bit6 = 1,
Byte4
Byte5
Byte6
Appendix 1: Examples of broadcast messages
0x0E640D09 x| 0D 5E 0D 60 0D 60 0D 5D
Cell voltage of cell 1~cell 4 such as cell 1: byte1, byte2: 0x0d5e = 3422mV
0x0E6C0D09 x| 1F 1F 1D 1D 00 00 00 00
Temperature message: combined ID: 0xA720D09 byte1, byte2, byte3, byte4: the order of
temperature is the temperature sensor of the batery cell MOS temperature sensor
0x0A6D0D09 x| 02 23 00 1F 00 44 01 05
byte1,byte2:0x0223 = 547=54.7V byte3,byte4:0x001f= 31 = 3.1A
byte5,byte6:0x44 = 68 =6.8Ah byte7,byte8: 0x105 = 261 = 26.1Ah
Total voltage: byte1, byte2: 0x0223 = 547=54.7V Charging current byte3, byte4: 0x001f = 31 =
3.1A Remaining power byte5, byte6: 0x44 = 68 = 6.8Ah Full charge capacity byte7, byte8: 0x105 =
261 = 26.1Ah
0x0A6E0D09 x| 01 04 00 00 00 03 00 00
byte1,byte2: SOC= 0x104 = 260 =26% SOH byte3,byte4
byte5,byte6: 3
byte1, byte2: SOC = 0x104 = 260 =26% SOH byte3, byte4 has not been uploaded temporarily.
Number of cycles byte5, byte6: 3
0x0A6F0D09 x| 0D 61 07 0D 54 0C 0D 5B
byte1,byte2: 0x0D61 byte3:7
byte4,byte5: 0x0D54 NO byte6: 13(0) byte7, byte8: 0x0D5B
Highest cell voltage byte1, byte2: 0x0D61 Highest cell number byte3: 7 (startng with 0) Lowest
cell voltage byte4, byte5: 0x0D54 Highest cell NO byte6: 13 (star g with 0) Average volt age
byte7, byte8: 0x0D5B
0x0A700D09 x| 47 00 00 00 47 00 00 0D
0x047=71 -40 7(0) 0x0D =13mV
Maximum temperature 0x047=71 -40 Maximum cell number 7 (star n at 0) Single cell voltage
difference 0x0D =13mV
0x0AB40D09 x| 00 18 00 10 00 00 00 00
byte2 : 0x18 0x10 0x08
byte4: 0x10
byte2: 0x10 in 0x18 means charging overvoltage 0x08 means command to turn off the discharge
tube (to detect the presence o f the charger) byte4: 0x10 means charging tube is off and
discharge tube is on
Appendix 2: CRC check
statc const u8 aucCRCHi[] =
{
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40 };
statc const u8 aucCRCLo[] =
{
0x00, 0xC0, 0xC1, 0x01, 0xC3, 0x03, 0x02, 0xC2, 0xC6, 0x06, 0x07, 0xC7,
0x05, 0xC5, 0xC4, 0x04, 0xCC, 0x0C, 0x0D, 0xCD, 0x0F, 0xCF, 0xCE, 0x0E,
0x0A, 0xCA, 0xCB, 0x0B, 0xC9, 0x09, 0x08, 0xC8, 0xD8, 0x18, 0x19, 0xD9,
0x1B, 0xDB, 0xDA, 0x1A, 0x1E, 0xDE, 0xDF, 0x1F, 0xDD, 0x1D, 0x1C, 0xDC,
0x14, 0xD4, 0xD5, 0x15, 0xD7, 0x17, 0x16, 0xD6, 0xD2, 0x12, 0x13, 0xD3,
0x11, 0xD1, 0xD0, 0x10, 0xF0, 0x30, 0x31, 0xF1, 0x33, 0xF3, 0xF2, 0x32,
0x36, 0xF6, 0xF7, 0x37, 0xF5, 0x35, 0x34, 0xF4, 0x3C, 0xFC, 0xFD, 0x3D,
0xFF, 0x3F, 0x3E, 0xFE, 0xFA, 0x3A, 0x3B, 0xFB, 0x39, 0xF9, 0xF8, 0x38,
0x28, 0xE8, 0xE9, 0x29, 0xEB, 0x2B, 0x2A, 0xEA, 0xEE, 0x2E, 0x2F, 0xEF,
0x2D, 0xED, 0xEC, 0x2C, 0xE4, 0x24, 0x25, 0xE5, 0x27, 0xE7, 0xE6, 0x26,
0x22, 0xE2, 0xE3, 0x23, 0xE1, 0x21, 0x20, 0xE0, 0xA0, 0x60, 0x61, 0xA1,
0x63, 0xA3, 0xA2, 0x62, 0x66, 0xA6, 0xA7, 0x67, 0xA5, 0x65, 0x64, 0xA4,
0x6C, 0xAC, 0xAD, 0x6D, 0xAF, 0x6F, 0x6E, 0xAE, 0xAA, 0x6A, 0x6B, 0xAB,
0x69, 0xA9, 0xA8, 0x68, 0x78, 0xB8, 0xB9, 0x79, 0xBB, 0x7B, 0x7A, 0xBA,
0xBE, 0x7E, 0x7F, 0xBF, 0x7D, 0xBD, 0xBC, 0x7C, 0xB4, 0x74, 0x75, 0xB5,
0x77, 0xB7, 0xB6, 0x76, 0x72, 0xB2, 0xB3, 0x73, 0xB1, 0x71, 0x70, 0xB0,
0x50, 0x90, 0x91, 0x51, 0x93, 0x53, 0x52, 0x92, 0x96, 0x56, 0x57, 0x97,
0x55, 0x95, 0x94, 0x54, 0x9C, 0x5C, 0x5D, 0x9D, 0x5F, 0x9F, 0x9E, 0x5E,
0x5A, 0x9A, 0x9B, 0x5B, 0x99, 0x59, 0x58, 0x98, 0x88, 0x48, 0x49, 0x89,
0x4B, 0x8B, 0x8A, 0x4A, 0x4E, 0x8E, 0x8F, 0x4F, 0x8D, 0x4D, 0x4C, 0x8C,
0x44, 0x84, 0x85, 0x45, 0x87, 0x47, 0x46, 0x86, 0x82, 0x42, 0x43, 0x83,
0x41, 0x81, 0x80, 0x40
};
u16 GetCRC16( u8 * pucFrame, u16 usLen )
{
u8 ucCRCHi = 0xFF;
u8 ucCRCLo = 0xFF;
u16 iIndex;
usLen++;
while( usLen-- )
{
iIndex = ucCRCLo ^ *( pucFrame++ );
ucCRCLo = ( u8 )( ucCRCHi ^ aucCRCHi[iIndex] );
ucCRCHi = aucCRCLo[iIndex];
}
return ( u16 )( ucCRCLo << 8 | ucCRCHi );
}
