Author Topic: Pylontech sc0500 protocol "hacking"  (Read 966 times)

0 Members and 1 Guest are viewing this topic.

Offline ArCoN

  • Contributor
  • Posts: 12
  • Country: dk
Pylontech sc0500 protocol "hacking"
« on: October 12, 2021, 03:12:16 pm »
Hello Good people of the world

I need some reverse engineering expertise to decode some CANbus data.
Maybe there is some smart eev's that can help. ;D

I have a SPH10000TL3 BH and a diy battery i love to get working.

We have the pylontech battery system at work, so i have sniffed some data between the inverter and BMS.

I made a C# program to try help decode the data, but i have a little trouble figuring out where the data is located. i need to find battery voltage and state of charge as a minimum, for the inverter to function (i think).

The files:
Program (use as you like, not pretty but kinda works, C# is not my main expertise ;D)
inverter tx.log - the CAN tgm's from inverter only
inv-bat-stby_full.log - The battery is approx 90% SOC, log is done over night without load.
batt full discharge.log - The battery is approx 90% SOC, log is done over night with load to around 0% SOC.

Thanks ArCoN

Offline ArCoN

  • Contributor
  • Posts: 12
  • Country: dk
Re: Pylontech sc0500 protocol "hacking"
« Reply #1 on: October 14, 2021, 08:26:35 am »
Maybe it's worth mentioning that the battery system consists of sc0500 + 3 x H48050. so voltage range should be somewhere between 135- 162Vdc. minor details  ;)

Offline buovjaga

  • Newbie
  • Posts: 1
  • Country: fi
Re: Pylontech sc0500 protocol "hacking"
« Reply #2 on: December 06, 2021, 12:21:21 pm »
Example from inv-bat-stby_full.log
one line a respond to CAN ID: 0x4200   [8]  02 00 00 00 00 00 00 00

00:42:35:6880 Rx 1 0x7320 x 8 2D 00 03 0F 90 00 32 00

to interprete this CANBUS answer we have
Obs! Byte#4==0x90 and Byte#5==0x00 by swapping them we have 0x0090==144 decimal
Also  Byte#6==0x32 and Byte#7==0x00 by swapping them we have 0x0032==50   decimal

Byte#0 = 0x2D Battery Module Qty or Total number of batteries 0x2D = 45 or 3 packs of 15 cells
Byte#1 = 0x00 reserve
Byte#2 = 0x03 Battery Module in series Qty.Number of battery modules in series in one cabinet = 3
Byte#3 = 0x0F 15 Cell Qty. in one battery module Number of battery cells in a module = 15
Byte#4 = 0x90 144=45*3.2 Voltage Level or Voltage platform, resolution: 1V
Byte#5 = 0x00 Offset: 0
Byte#6 = 0x32 50 AH number Resolution 1AH Charging capacity
Byte#7 = 0x00 Offset: 0

The other canbus lines can be interpreted in a similar way

cheers b
« Last Edit: December 07, 2021, 01:21:42 pm by buovjaga »
The following users thanked this post: ArCoN

Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo