The BQ76907 device includes support for direct commands and subcommands. The direct commands are accessed using a 7-bit command address that is sent from a host through the device serial communications interface and either triggers an action, or provides a data value to be written to the device, or instructs the device to report data back to the host. Subcommands are additional commands that are accessed indirectly using the 7-bit command address space and provide the capability for block data transfers.

When a subcommand is initiated, a 16-bit subcommand address is first written to the 7-bit command addresses 0x3E (lower byte) and 0x3F (upper byte). The device initially assumes a read-back of data is needed and auto-populates existing data into the 32-byte transfer buffer (which uses 7-bit command addresses 0x40–0x5F), and writes the checksum for this data into address 0x60. If the host instead intends to write data into the device, the host overwrites the new data into the transfer buffer, a checksum for the data into address 0x60, and the data length into address 0x61.

As soon as address 0x61 is written, the device checks the checksum written into 0x60 with the data written into 0x40-0x5F, and if this is correct, it proceeds to transfer the data from the transfer buffer into the device's memory. The checksum is the 8-bit modulo-256 sum of the subcommand bytes (0x3E and 0x3F) and the bytes used in the transfer buffer, then the result is bit-wise inverted. The verification cannot take place until the data length is written, so the device realizes how many bytes in the transfer buffer are included. Write the data length last, after the checksum has been written (they do not need to be written together as a word). The data length includes the two bytes in 0x3E and 0x3F, the two bytes in 0x60 and 0x61, and the length of data in the transfer buffer. Therefore, if the entire 32-byte transfer buffer is used, the data length is 0x24.

When the data length in 0x61 is read, the device automatically increments the address presently in 0x3E and 0x3F by 0x0020, and populates the transfer buffer with new readback data. This allows large portions of data memory to be read by continuous reading of the address space 0x40 to 0x61. If the host attempts to read the transfer buffer data starting at 0x40 while the device is still loading the data into the transfer buffer, the device clock stretches the I2C read transaction until the data is available.

Some subcommands are only used to initiate an action and do not involve sending or receiving data. In these cases, the host can simply write the subcommand into 0x3E and 0x3F, it is not necessary to write the length and checksum or any further data. Note that if an auto-incremented address corresponds to a subcommand that does not involve data, the auto-incrementing does not cause that subcommand to be initiated.

The commands supported in the device are described in Commands and Subcommands. Single-byte commands are direct commands, while two-byte commands are subcommands. Data formats are described in Data Formats.

The most efficient approach to read the data from a subcommand (to minimize bus traffic) is shown below:

1. Write lower byte of subcommand to 0x3E.
2. Write upper byte of subcommand to 0x3F.
3. Read back the subcommand from 0x3E and 0x3F, which echoes back the subcommand address sent in steps 1 and 2 (or the auto-incremented address from step 6).
4. Read buffer starting at 0x40 for the expected length (reading the full 32 bytes is also acceptable).
5. Read the checksum at 0x60 and verify it matches the data read over the length specified by the subcommand.
6. If auto-incrementing is desired, read the data length at 0x61, at which point the device increments the address in 0x3E and 0x3F by 32 and repopulate the buffer with the next 32 bytes of data, then go to step 2.

The checksum is calculated over 0x3E, 0x3F, and the length of buffer data specified by the subcommand, it does not include the checksum or length in 0x60 and 0x61.

Write command or subcommand bits denoted RSVD_0 only as a "0". Write bits denoted RSVD_1 only as a "1".