1.2.2 LiBat Canbus v2.x Data Frames

Every BMS frame uses a 29-bit extended identifier: the configurable base address in the upper bytes and the opcode below in the lowest byte. All signals are Intel (little-endian) unless marked Motorola.

Table.1.2.2.1: Frame Index

Opcode	Frame	DLC	Description
0x01	Hello Packet	8	Identification frame. Carries the protocol version, BMS model code, and elapsed uptime since power-on.
0x02	Battery Pack Status	8	Primary pack snapshot: state of charge, accumulated cycle count, and high-resolution pack voltage.
0x03	Overall Pack Voltages	8	Aggregated cell-level voltage statistics for the whole pack plus the total pack voltage at 0.1 V resolution.
0x04	Overall Pack Currents	5	Live pack current measurement together with the status of every power path (charge, discharge, pre-charge, single-power, pre-discharge) and the charge-completed flag.
0x05	Power and Energy	8	Instantaneous pack power (signed, kW) and the charge stored in the pack in ampere-hours.
0x06	Overall Pack Temperatures	8	Pack-level min / max / mean temperature plus the temperature delta between the hottest and coldest sensor.
0x07	System Errors L1	8	Fault, warning and status flags of the BMS as one 64-bit word.
0xB0	Multi-Master Parameters	2	Master-side configuration of the multi-master mode and the active overwatch output command issued to slave packs.
0xB1	Report Device Multi-Master Parameters Status	4	Slave-side reporting of the configured multi-master role, the current slave state machine value, and the input command received from the master.
0xB2	Device Info	8	Firmware version (24-bit triple), hardware revision byte, and the real-time clock as Unix time.
0xB3	System Info	8	Device serial number and bootloader version.
0x10–0x17	Module Voltages	4 or 8	Two modules per frame, see 1.2.2.12.
0x25–0x74	Cell Voltages	8, last frame shorter	Up to five frames per module, see 1.2.2.13.
0x85–0xA4	Temperatures	8 and 2	Two frames per module, see 1.2.2.14.

1.2.2.1 Hello Packet (0x01)

Identification frame. Carries the protocol version, BMS model code, and elapsed uptime since power-on.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Protocol Version Minor	0	0–3	uint4	1	—	Low nibble of byte 0. Increment on backward-compatible additions.
Protocol Version Major	0	4–7	uint4	1	—	High nibble of byte 0. Increment on breaking protocol changes.
BMS Model Type	1	8–15	uint8	1	—	Numeric model identifier. 4 = BMS1801, 6 = BMS1810, 7 = BCU2002, 10 = BMS1601, 11 = BMS1820, 12 = DIS500, 13 = DIS700, 14 = BMS3610
Uptime	2–5	16–47	uint32	1	secs	Seconds since BMS power-on, wraps at 2^32.

1.2.2.2 Battery Pack Status (0x02)

Primary pack snapshot: state of charge, accumulated cycle count, and high-resolution pack voltage.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
SoC	0	0–7	uint8	1	%	State of charge as a percentage (0–100).
Cycle	1–2	8–23	uint16	1	—	Lifetime full equivalent cycle count.
Pack Voltage High Resolution	4–7	32–63	uint32	0.01	V	High-resolution pack voltage; 32-bit unsigned at 10 mV resolution.

Worked example

Live capture from a healthy pack at 99 % SoC, charging at ~30 A, 95.72 V pack voltage. Byte 3 is reserved and currently transmitted as 0xFF.

Raw bytes: 63 13 14 FF 64 25 00 00

Field	Raw	Calculation	Value
SoC	byte 0 = 0x63	99 × 1	99 %
Cycle	bytes 1–2 LE = 0x1413	5139 × 1	5139 cycles
(reserved)	byte 3 = 0xFF	—	ignore
Pack Voltage High Resolution	bytes 4–7 LE = 0x00002564	9572 × 0.01	95.72 V

1.2.2.3 Overall Pack Voltages (0x03)

Aggregated cell-level voltage statistics for the whole pack plus the total pack voltage at 0.1 V resolution.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Min Cell Voltage	0–1	0–15	uint16	1	mV	Lowest individual cell voltage in the pack.
Max Cell Voltage	2–3	16–31	uint16	1	mV	Highest individual cell voltage in the pack.
Cell Voltage Delta	4–5	32–47	uint16	1	mV	Max − Min cell voltage; key metric for cell imbalance.
Total Pack Voltage	6–7	48–63	uint16	0.1	V	Sum of all connected cell voltages, expressed at 0.1 V resolution.

Worked example

Same capture instant. Cells average ≈ 1.77 V; total voltage matches Pack Voltage High Resolution above to within 0.02 V (resolution difference).

Raw bytes: E4 06 70 0A 8B 03 BD 03

Field	Raw	Calculation	Value
Min Cell Voltage	bytes 0–1 LE = 0x06E4	1764 × 1	1764 mV
Max Cell Voltage	bytes 2–3 LE = 0x0A70	2672 × 1	2672 mV
Cell Voltage Delta	bytes 4–5 LE = 0x038B	907 × 1	907 mV
Total Pack Voltage	bytes 6–7 LE = 0x03BD	957 × 0.1	95.7 V

1.2.2.4 Overall Pack Currents (0x04)

Live pack current measurement together with the status of every power path (charge, discharge, pre-charge, single-power, pre-discharge) and the charge-completed flag.

DLC: 5 (the DBC declares 8; bytes 5–7 are not sent).

Signal	Byte	Bit	Type	Scale	Unit	Description
Current	0–3	0–31	int32	0.1	A	Pack current in amperes. + = charge, − = discharge.
Charge Path Status	4	32	Flag	1	—	Charge FET / contactor closed (1) or open (0). 0 = OFF, 1 = ON
Discharge Path Status	4	33	Flag	1	—	Discharge FET / contactor closed (1) or open (0). 0 = OFF, 1 = ON
Pre-Charge Path Status	4	34	Flag	1	—	Pre-charge path active during pre-charge sequence. 0 = OFF, 1 = ON
Single Power Path Status	4	35	Flag	1	—	Single-power output path closed (1) or open (0). 0 = OFF, 1 = ON
Pre-Discharge Path Status	4	36	Flag	1	—	Pre-discharge path active during controlled discharge ramp. 0 = OFF, 1 = ON
Charge Completed	4	37	Flag	1	—	Set when the BMS considers the pack fully charged. 0 = Charging Not Completed, 1 = Charging Done

Worked example

Same capture instant. This frame is transmitted with DLC = 5 here (Current 4 bytes + path-status byte).

Raw bytes: 2C 01 00 00 03

Field	Raw	Calculation	Value
Current	bytes 0–3 LE int32 = 0x0000012C	300 × 0.1	+30.0 A (charge)
Charge Path Status	byte 4 bit 0 = 1	—	ON
Discharge Path Status	byte 4 bit 1 = 1	—	ON
Pre-Charge Path Status	byte 4 bit 2 = 0	—	OFF
Single Power Path Status	byte 4 bit 3 = 0	—	OFF
Pre-Discharge Path Status	byte 4 bit 4 = 0	—	OFF
Charge Completed	byte 4 bit 5 = 0	—	Charging Not Completed

1.2.2.5 Power and Energy (0x05)

Instantaneous pack power (signed, kW) and the charge stored in the pack in ampere-hours.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Power	0–3	0–31	int32	0.0001	kW	Instantaneous pack power. Same sign convention as Current.
Energy	4–7	32–63	uint32	0.001	Ah	Charge stored in the pack; the SoC is computed from it. Never negative.

Worked example

Same capture instant. Power matches Current × Total Pack Voltage to within rounding (30.0 A × 95.7 V ≈ 2.871 kW vs. reported 2.8759 kW).

Raw bytes: 57 70 00 00 64 00 00 00

Field	Raw	Calculation	Value
Power	bytes 0–3 LE int32 = 0x00007057	28759 × 0.0001	+2.8759 kW (charge)
Energy	bytes 4–7 LE uint32 = 0x00000064	100 × 0.001	0.1 Ah

1.2.2.6 Overall Pack Temperatures (0x06)

Pack-level min / max / mean temperature plus the temperature delta between the hottest and coldest sensor.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Min Temperature	0–1	0–15	int16	0.1	C	Coldest sensor reading across all modules.
Max Temperature	2–3	16–31	int16	0.1	C	Hottest sensor reading across all modules.
Temperature Delta	4–5	32–47	uint16	0.1	C	Max − Min temperature; always non-negative.
Mean Temperature	6–7	48–63	int16	0.1	C	Mean (arithmetic average) of all module temperature sensors.

Worked example

Same capture instant. All four sensors near room temperature; delta = Max − Min = 25.4 − 24.3 = 1.1 °C, which matches the reported Temperature Delta exactly.

Raw bytes: F3 00 FE 00 0B 00 F6 00

Field	Raw	Calculation	Value
Min Temperature	bytes 0–1 LE int16 = 0x00F3	243 × 0.1	+24.3 °C
Max Temperature	bytes 2–3 LE int16 = 0x00FE	254 × 0.1	+25.4 °C
Temperature Delta	bytes 4–5 LE uint16 = 0x000B	11 × 0.1	1.1 °C
Mean Temperature	bytes 6–7 LE int16 = 0x00F6	246 × 0.1	+24.6 °C

1.2.2.7 System Errors L1 (0x07)

Fault, warning and status flags of the BMS as one 64-bit word.

DLC: 8

The 64-bit error word, little-endian: byte 0 holds bits 0–7 and byte 7 holds bits 56–63. A bit set to 1 means the condition is active. Modbus reports the same word in registers 40114–40117.

Table.1.2.2.2: Error Status Bits

Bit	CAN byte	Name	Class	Behaviour
0	0	User Attention Required	STATUS	Set by a CRITICAL fault or when a PROTECT fault reaches the retry limit.
1	0	Over Temperature Protection	PROTECT	Switches off both paths until the condition clears.
2	0	Over Temperature Warning	WARNING	No path is switched off.
3	0	Discharge Under Temperature Protection	PROTECT	Switches off the discharge path until the condition clears.
4	0	Discharge Under Temperature Warning	WARNING	No path is switched off.
5	0	Charge Under Temperature Protection	PROTECT	Switches off the charge path until the condition clears.
6	0	Charge Under Temperature Warning	WARNING	No path is switched off.
7	0	Cell Over Voltage Protection	PROTECT	Switches off the charge path until the condition clears.
8	1	Cell Over Voltage Warning	WARNING	No path is switched off.
9	1	Cell Under Voltage Protection	PROTECT	Switches off the discharge path until the condition clears.
10	1	Cell Under Voltage Warning	WARNING	No path is switched off.
11	1	Max. Cell Delta Voltage Protection	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
12	1	Max. Temperature Delta Protection	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
13	1	Discharge Over Current Warning	WARNING	No path is switched off.
14	1	Discharge Over Current Protection	PROTECT	Switches off the discharge path until the condition clears.
15	1	Discharge Over Current 2nd Protection	PROTECT	Switches off the discharge path until the condition clears.
16	2	Charge Over Current Warning	WARNING	No path is switched off.
17	2	Charge Over Current Protection	PROTECT	Switches off the charge path until the condition clears.
18	2	Short Circuit Protection	PROTECT	Switches off both paths until the condition clears.
19	2	Low SoC 1st Warning	WARNING	No path is switched off.
20	2	Low SoC 2nd Warning	WARNING	No path is switched off.
21	2	PCB Over Temperature Warning	WARNING	No path is switched off.
22	2	PCB Over Temperature Protection	PROTECT	Switches off both paths until the condition clears.
23	2	FET Over Temperature Warning	WARNING	No path is switched off.
24	3	FET Over Temperature Protection	PROTECT	Switches off both paths until the condition clears.
25	3	Internal Error	UNUSED	Not set by the current firmware.
26	3	Cell Connection Error	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
27	3	Sleep Cannot Execute	STATUS	Set when a shutdown is requested while faults hold both paths off.
28	3	Max. Parallel Group Delta Voltage Protection	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
29	3	Slave Module Communication Error	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
30	3	Main Contactor Malfunction	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
31	3	Pre-Charge Fault	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
32	4	System Power On	STATUS	Set at power-on and cleared in the first protection cycle.
33	4	Multi-Master Enable Power-Out Sequence	PROTECT	Slave only: both paths stay off until the master enables power out.
34	4	Multi-Master Communication Timeout	MULTI-MASTER	Communication lost; depending on the comm-error strategy the master switches off the affected slave's power out.
35	4	Multi-Master Parallel Packs Delta Voltage Error	MULTI-MASTER	Master only: pack voltages differ too much; the master switches off the affected slave's power out.
36	4	Charge Contactor Malfunction	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
37	4	Discharge Contactor Malfunction	CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
38	4	Balancing Over Temperature Warning	WARNING	No path is switched off; balancing stops.

Bits 39–63 are not used. The class describes what the firmware does when the bit is set.

Table.1.2.2.3: Error Classes

Class	Meaning
WARNING	Reports that a warning limit is exceeded. No path is switched off.
PROTECT	Switches off the listed path while the condition lasts and back on when it clears; see the retry note below.
CRITICAL	Switches off both paths and sets User Attention; the paths stay off until the BMS restarts.
STATUS	Reports a state of the BMS. No path is switched off.
MULTI-MASTER	Used in multi-master systems; acts on the power output of another pack.
UNUSED	Defined but not set by the current firmware.

PROTECT faults switch the path back on by themselves once the condition clears. Each trip of the same fault is counted; when the count reaches Max Retry Limit (LiMon Peripheral Settings, default 5, 0 = no limit) the BMS sets User Attention and no longer switches the path back on by itself. CRITICAL faults keep both paths off until the BMS restarts.

1.2.2.8 Multi-Master Parameters (0xB0)

Master-side configuration of the multi-master mode and the active overwatch output command issued to slave packs.

Sent only by a BMS configured as Multi-Master Main Controller, one frame to each configured slave pack at that pack's own base address.

DLC: 2 (the DBC declares 5; bytes 2–4 are not sent).

Signal	Byte	Bit	Type	Scale	Unit	Description
Multi-Master Mode Master Configuration	0	0–7	uint8	1	—	Selects the multi-master role of this BMS. 0 = Multi-Master Disabled, 1 = Multi-Master Main Controller, 2 = Multi-Master Slave in Series, 3 = Multi-Master Slave in Parallel
Multi-Master Mode Master Overwatch Outputs	1	8–15	uint8	1	—	Master-driven action issued to all slaves in the array. 0 = None, 1 = Enable Power Out Sequence, 2 = Disable Power Out, 3 = Enable Resistive Limited Battery Charge, 4 = Enable Resistive Limited Battery Discharge

1.2.2.9 Report Device Multi-Master Parameters Status (0xB1)

Slave-side reporting of the configured multi-master role, the current slave state machine value, and the input command received from the master.

Sent by every BMS that is not a Multi-Master Main Controller, including a BMS with multi-master disabled.

DLC: 4 (the DBC declares 8; bytes 4–7 are not sent).

Signal	Byte	Bit	Type	Scale	Unit	Description
Multi-Master Mode Master Configuration	0	0–7	uint8	1	—	Echo of the slave's configured multi-master role. 0 = Multi-Master Disabled, 1 = Multi-Master Main Controller, 2 = Multi-Master Slave in Series, 3 = Multi-Master Slave in Parallel
Multi-Master Mode Slave States	2	16–23	uint8	1	—	0 = None, 1 = Initiated, 2 = Power Out Disabled Due to Error, 3 = Power Out Disabled User Attention, 4 = Power Out Enable Ready, 5 = Power Out Enabled by Multi-Master, 6 = Power Out Disabled by Multi-Master, 7 = Power Out Disabled Parallel Voltage Mismatch, 8 = Parallel Voltage Equalization Enabled
Multi-Master Mode Slave Inputs	3	24–31	uint8	1	—	Most recent input command received from the master. 0 = None, 1 = Enable Power Out Sequence, 2 = Disable Power Out, 3 = Enable Resistive Limited Battery Charge, 4 = Enable Resistive Limited Battery Discharge

1.2.2.10 Device Info (0xB2)

Firmware version (24-bit triple), hardware revision byte, and the real-time clock as Unix time.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Firmware Version	0–2	0–23	uint24	1	—	24-bit firmware version: byte 0 major, byte 1 minor, byte 2 patch.
Hardware Version	3	24–31	uint8	1	—	8-bit hardware version: high nibble major, low nibble minor.
System Time	4–7	32–63	uint32	1	—	Real-time clock as Unix time (seconds since 1970-01-01 00:00).

1.2.2.11 System Info (0xB3)

Device serial number and bootloader version.

DLC: 8

Signal	Byte	Bit	Type	Scale	Unit	Description
Serial Number	0–3	0–31	uint32	1	—	32-bit factory-programmed device serial number.
Bootloader Version	4–7	32–63	uint32	1	—	32-bit bootloader version code. LiMon shows it as two groups of four decimal digits, e.g. 20002013 = 2000.2013.

1.2.2.12 Module Voltages (0x10–0x17)

Frame n (opcode 0x10 + n) carries modules 2n and 2n+1. The layout below is frame 0x10 (modules 0 and 1); every other frame is identical with its own module numbers.

DLC: 8 when the second module of the pair exists, otherwise 4 (bytes 4–7 are not sent). An absent module reads 0xFFFF; a frame whose two modules are both absent is still sent and should be ignored.

Signal	Byte	Bit	Type	Scale	Unit
Module Voltage (Module 0)	0–1	0–15	uint16	0.01	V
Slave Parallel Group (Module 0)	2	16–18	uint3	1	—
Total Number of Connected Cells (Module 0)	2	19–23	uint5	1	—
Total Number of Cells (Module 0)	3	27–31	uint5	1	—
Module Voltage (Module 1)	4–5	32–47	uint16	0.01	V
Slave Parallel Group (Module 1)	6	48–50	uint3	1	—
Total Number of Connected Cells (Module 1)	6	51–55	uint5	1	—
Total Number of Cells (Module 1)	7	59–63	uint5	1	—

1.2.2.13 Cell Voltages (0x25 + module × 5 + group)

Each module sends up to five frames, four cells per frame; a module with fewer cells sends fewer frames. Groups 0–3 carry cells 1–16 and group 4 carries cells 17–18. Module 0 is shown; the other modules use the same layout.

DLC: 8 for every full frame of four cells. The last frame carries the remaining cells, 2 bytes each, so an 18-cell module sends group 4 with DLC 4. A cell that is not present reads 0xFFFF.

Cell Voltages Group 0, Module 0 (0x25)

Signal	Byte	Bit	Type	Scale	Unit
Cell Voltage 1 (Module 0)	0–1	0–15	uint16	1	mV
Cell Voltage 2 (Module 0)	2–3	16–31	uint16	1	mV
Cell Voltage 3 (Module 0)	4–5	32–47	uint16	1	mV
Cell Voltage 4 (Module 0)	6–7	48–63	uint16	1	mV

Cell Voltages Group 1, Module 0 (0x26)

Signal	Byte	Bit	Type	Scale	Unit
Cell Voltage 5 (Module 0)	0–1	0–15	uint16	1	mV
Cell Voltage 6 (Module 0)	2–3	16–31	uint16	1	mV
Cell Voltage 7 (Module 0)	4–5	32–47	uint16	1	mV
Cell Voltage 8 (Module 0)	6–7	48–63	uint16	1	mV

Cell Voltages Group 2, Module 0 (0x27)

Signal	Byte	Bit	Type	Scale	Unit
Cell Voltage 9 (Module 0)	0–1	0–15	uint16	1	mV
Cell Voltage 10 (Module 0)	2–3	16–31	uint16	1	mV
Cell Voltage 11 (Module 0)	4–5	32–47	uint16	1	mV
Cell Voltage 12 (Module 0)	6–7	48–63	uint16	1	mV

Cell Voltages Group 3, Module 0 (0x28)

Signal	Byte	Bit	Type	Scale	Unit
Cell Voltage 13 (Module 0)	0–1	0–15	uint16	1	mV
Cell Voltage 14 (Module 0)	2–3	16–31	uint16	1	mV
Cell Voltage 15 (Module 0)	4–5	32–47	uint16	1	mV
Cell Voltage 16 (Module 0)	6–7	48–63	uint16	1	mV

Cell Voltages Group 4, Module 0 (0x29)

Signal	Byte	Bit	Type	Scale	Unit
Cell Voltage 17 (Module 0)	0–1	0–15	uint16	1	mV
Cell Voltage 18 (Module 0)	2–3	16–31	uint16	1	mV

Table.1.2.2.4: Cell Voltage Opcodes

Module	Group 0	Group 1	Group 2	Group 3	Group 4
0	0x25	0x26	0x27	0x28	0x29
1	0x2A	0x2B	0x2C	0x2D	0x2E
2	0x2F	0x30	0x31	0x32	0x33
3	0x34	0x35	0x36	0x37	0x38
4	0x39	0x3A	0x3B	0x3C	0x3D
5	0x3E	0x3F	0x40	0x41	0x42
6	0x43	0x44	0x45	0x46	0x47
7	0x48	0x49	0x4A	0x4B	0x4C
8	0x4D	0x4E	0x4F	0x50	0x51
9	0x52	0x53	0x54	0x55	0x56
10	0x57	0x58	0x59	0x5A	0x5B
11	0x5C	0x5D	0x5E	0x5F	0x60
12	0x61	0x62	0x63	0x64	0x65
13	0x66	0x67	0x68	0x69	0x6A
14	0x6B	0x6C	0x6D	0x6E	0x6F
15	0x70	0x71	0x72	0x73	0x74

1.2.2.14 Temperatures (0x85 + module × 2 + group)

Each module sends two frames: group 0 carries sensors 1–4 and group 1 carries sensor 5. Module 0 is shown; the other modules use the same layout.

A sensor 1–4 that is not fitted reads 0xBDC1 (−1695.9 °C); leave it out of any calculation. Group 1 is sent only when sensor 5 is fitted.

DLC: 8 for group 0 and 2 for group 1.

Temperatures Group 0, Module 0 (0x85)

Signal	Byte	Bit	Type	Scale	Unit
External Temperature 1 (Module 0)	0–1	0–15	int16	0.1	C
External Temperature 2 (Module 0)	2–3	16–31	int16	0.1	C
External Temperature 3 (Module 0)	4–5	32–47	int16	0.1	C
External Temperature 4 (Module 0)	6–7	48–63	int16	0.1	C

Temperatures Group 1, Module 0 (0x86)

Signal	Byte	Bit	Type	Scale	Unit
External Temperature 5 (Module 0)	0–1	0–15	int16	0.1	C

Table.1.2.2.5: Temperature Opcodes

Module	Group 0	Group 1
0	0x85	0x86
1	0x87	0x88
2	0x89	0x8A
3	0x8B	0x8C
4	0x8D	0x8E
5	0x8F	0x90
6	0x91	0x92
7	0x93	0x94
8	0x95	0x96
9	0x97	0x98
10	0x99	0x9A
11	0x9B	0x9C
12	0x9D	0x9E
13	0x9F	0xA0
14	0xA1	0xA2
15	0xA3	0xA4

1.2.2.15 OEM Type 1 Digital Charger (0x1806E5F4)

External digital charger interface, sent by the BMS: target voltage and current setpoints, the charger enable/disable status and the pack SoC. NOTE: this is the only frame in the protocol that uses Motorola (big-endian) byte order for two of its signals.

The BMS sends this frame to the charger at the Canbus data period set in Interface Settings, and sends nothing while that period is Disabled; the charger does not send it. Its identifier is outside the BMS base address, can be changed in LiMon under Integration Settings and can be a standard (11-bit) or extended (29-bit) ID; 0x1806E5F4 is the default.

The BMS requests charging (Charger Status = 0) with a current taken from its SoC and temperature table. It sends Charger Status = 1 while pre-charging and when the SoC reaches 100 %, and, if the stop-charger-on-error option is set, also on a BMS error with the target current set to 0.

The BMS detects the charger by a separate frame that the charger sends, with an ID also set in LiMon. If that frame stops for longer than the configured delay, the BMS treats the charger as disconnected.

This layout is Charger Type OEM Type #1 in LiMon. Byte 5 carries the pack SoC in % (uint8); bytes 6–7 are sent as 0x00.

Signal	Byte	Bit	Type	Scale	Unit	Description
Charger Target Voltage	0–1	MSB 7	uint16 (Motorola)	0.1	V	Target output voltage commanded to the charger. MOTOROLA (BE) byte order.
Charger Target Current	2–3	MSB 23	uint16 (Motorola)	0.1	A	Target output current commanded to the charger. MOTOROLA (BE) byte order.
Charger Status	4	32–39	uint8	1	—	Charger enable command. INTEL (LE) byte order. 0 = Charger Enabled, 1 = Charger Disabled
Charger SoC	5	40–47	uint8	1	%	Pack state of charge in % (Charger Type OEM Type #1).