BM2 Bluetooth Car Battery Voltage Monitor protocol

Question

I am opening this question, because it would be nice to create an open source app for this BLE voltage monitor:

https://www.aliexpress.com/item/32794632957.html

http://www.quicklynks.com/pro_show.php?id=159

I thought it is easy to understand the protocol, but I can't find any similar patterns in data. I collected BLE data with gatttool:

[LE]> connect F8:30:02:2D:4D:9C
Attempting to connect to F8:30:02:2D:4D:9C
Connection successful
Notification handle = 0x002e value: b4 db ec df bc dc 19 b5 d6 0f fa e1 cf 9b 79 44
Notification handle = 0x002e value: c0 fc fd 6f c3 ad 32 9a 56 43 39 57 91 16 ad 90
Notification handle = 0x002e value: 09 90 cf 1d 17 59 17 6e 8a 40 ca 8f ea 6b e8 69
Notification handle = 0x002e value: 8a b3 b1 26 3d 82 8c 56 6e 9e 55 0b fd c7 e4 a2
Notification handle = 0x002e value: 56 f4 19 a3 d2 ff 96 de a0 93 0b d7 78 d9 8a d8
Notification handle = 0x002e value: 77 88 82 c5 85 4d 75 0b bb ed 68 22 45 b3 99 3f
Notification handle = 0x002e value: 9c c9 37 d7 0c f9 34 db ca cd 80 db 23 ed d7 eb
Notification handle = 0x002e value: 33 22 c8 59 be 5a 2e cb 0f 88 6b 6d d5 09 fe a6
Notification handle = 0x002e value: 90 8e 97 ce be 46 f0 be 0a 60 d3 44 a6 3a 06 7e
Notification handle = 0x002e value: d7 6f d8 81 71 a0 2f 1e 86 ad a4 f1 a6 07 57 37
Notification handle = 0x002e value: b9 61 70 6e 4a a0 c2 ba 56 ad 64 ef e1 8b 32 bc
Notification handle = 0x002e value: f0 09 9a cd ba 03 98 5c c4 14 bd 60 50 07 67 a2
Notification handle = 0x002e value: 12 5c a7 99 b9 0d 8d 55 1c a7 42 d6 48 21 92 50
Notification handle = 0x002e value: 2e 16 c9 b1 60 ca c7 a2 0f 20 b0 85 77 e2 31 b0

Voltage set to 18.00V (sometimes it reads 18.01V). 18 in HEX is 12, searching for 12 I found only one occurrence. Maybe the data is encoded? In this case I think it is nearly impossible to decode the protocol.

Answer 1

Looks like the tool is capable of measuring from 6 to 20v.

So we would have to encode floats somehow into the data.

16 bytes per message.

I'm going to make a slightly informed guess that we have a 4 byte field, and then 6 2 byte fields. half-precision (16bit) IEEE floats maybe? It could be sampling the voltage multiple times and allowing the app to average.

Since you have the app, are there other values besides voltage which they app displays that are likely coming from the device? This would help us bound the number of fields we are looking for.

Can you post a bunch of readings from the device, ideally, with it disconnected from the battery, reading zero, followed by connected to the battery and then disconnected again. That was we can understand what the readout looks like when the voltage is 0. 100 messages would be great.