LCD protocol

Controller to LCD

// B7: moving indication info
// (1 << 0) : none
// (1 << 1): throttle
// (1 << 2): none
// (1 << 3): cruise control
// (1 << 4): PAS
// (1 << 5): brake
// (1 << 6): none
// (1 << 7): none


S-LCD to S12S controller communication protocol hacked


S-LCD to S12S controller communication protocol hacked
by obelix662000 » Wed Oct 14, 2015 11:42 pm
I've successfully decoded communication protocol between LCD3 display and S12S controller (both available at bmsbattery.com) in both directions. Please see attached files. Attachments S12SN_to_LCD3.txt from S12S to LCD (1.04 KiB) Downloaded 278 times LCD3_to_S12SN-1.txt from LCD to S12S corr1 (2.65 KiB) Downloaded 131 times

Linked file: S12SN_to_LCD3.txt

Linked file: LCD3_to_S12SN-1.txt

flangefrog wrote:
Great work. When were the packets sent between the devices? Were they sent every 100ms or so, or for lcd to controller communication were they just sent when a button was pressed? Any special packets sent on start-up?
Continiously, about 10 times a second in both directions. Actually this is not important, everything works fine with any rate since LCD an S12s rememeber last state.

---

I have an S06S, the protocol is the same.
Regarding the S12SN to LCD3 communication protocol:
B2: is the controller voltage. I have a 24/36 V controller with a 36 V battery and B2 reads 36 in my case.
B6: B0 is not included in the CRC
B8: Value is 4x controller current instead of power. The display calculates the power from this value devided by 4 multiplied with the LCD supply voltage. So if B8 is 16 and the supply voltage is 30 V then the LCD shows (16/4)*30 = 120 W. If you supply the LCD with 40 V and the same value for B8 then the power shown is 160 W.

---

For the LCD to controller protocol, the crc in B5 is not always as described here, at least for my LCD5 and controller, both recently bought from bmsbattery.

The final xor 2 required in the crc calculation varies, even for exactly the same message but at different sessions/times - sometimes an even number in the final xor is required and sometimes an odd number.

Rather than attempt to work out how or why, I simply find the correct value from the first few messages sent by the LCD after powering on, and use that for the remainder of the session until the LCD is turned off.

If you're getting messages you're generating ignored by the controller, bear this in mind. I've recently added an arduino to dynamically modify the parameters (max speed / assist levels / etc) when in an internally managed "fast" mode set with a sequence of LCD buttons at startup, and this stumped me for a while, particularly as sometimes xor 2 is the correct value and so sometimes works.