Pylontech sc0500 protocol "hacking"

[ArCoN]

Hello Good people of the world

I need some reverse engineering expertise to decode some CANbus data.
Maybe there is some smart eev's that can help.

I have a SPH10000TL3 BH and a diy battery i love to get working.

We have the pylontech battery system at work, so i have sniffed some data between the inverter and BMS.

I made a C# program to try help decode the data, but i have a little trouble figuring out where the data is located. i need to find battery voltage and state of charge as a minimum, for the inverter to function (i think).

The files:
Program (use as you like, not pretty but kinda works, C# is not my main expertise )
inverter tx.log - the CAN tgm's from inverter only
inv-bat-stby_full.log - The battery is approx 90% SOC, log is done over night without load.
batt full discharge.log - The battery is approx 90% SOC, log is done over night with load to around 0% SOC.

Thanks ArCoN

[ArCoN]

Maybe it's worth mentioning that the battery system consists of sc0500 + 3 x H48050. so voltage range should be somewhere between 135- 162Vdc. minor details 

[buovjaga]

Example from inv-bat-stby_full.log
one line a respond to CAN ID: 0x4200   [8]  02 00 00 00 00 00 00 00

00:42:35:6880 Rx 1 0x7320 x 8 2D 00 03 0F 90 00 32 00

to interprete this CANBUS answer we have
Obs! Byte#4==0x90 and Byte#5==0x00 by swapping them we have 0x0090==144 decimal
Also  Byte#6==0x32 and Byte#7==0x00 by swapping them we have 0x0032==50   decimal

Byte#0 = 0x2D Battery Module Qty or Total number of batteries 0x2D = 45 or 3 packs of 15 cells
Byte#1 = 0x00 reserve
Byte#2 = 0x03 Battery Module in series Qty.Number of battery modules in series in one cabinet = 3
Byte#3 = 0x0F 15 Cell Qty. in one battery module Number of battery cells in a module = 15
Byte#4 = 0x90 144=45*3.2 Voltage Level or Voltage platform, resolution: 1V
Byte#5 = 0x00 Offset: 0
Byte#6 = 0x32 50 AH number Resolution 1AH Charging capacity
Byte#7 = 0x00 Offset: 0

The other canbus lines can be interpreted in a similar way

cheers b

[manny87]

Hello ArCoN,

Bin working on a dbc file for the battery communication.

I have some questions:
   What whas the discharge power?
   Ambient temperature?
   Full-charge voltage?
   Discharge voltage?

Already found the soc data and high and low cell voltage needs a scaling factor.

Thanks Manny

[ArCoN]

Hi Manny

Ok, its a long time ago now ;P
Sorry I can't remember what inverter it was. maybe a SPH3600. ~3.6Kw
18-21dC
 "voltage range should be somewhere between 135- 162Vdc"

Try ask buovjaga. I think he has a good understanding of what the data means

BR ArCoN

[blesk]

Hello everyone
I am sniffing same setup: SC0500 + 4x H48050
but I recieving only 9 IDs each one second:

Code: [Select]

 
interface   ID    lenght     data
  can1  00004200   [8]  00 FF FF FF FF FF FF FF (Goodwe 8k-ET)
  can1  00004210   [8]  C2 07 2F 75 28 05 45 64
  can1  00004220   [8]  70 08 CC 06 2A 76 36 74
  can1  00004230   [8]  F1 0C ED 0C 04 00 05 00
  can1  00004240   [8]  D8 04 C4 04 0F 00 0A 00
  can1  00004250   [8]  02 00 00 00 00 00 00 00
  can1  00004260   [8]  08 C2 FA C1 03 00 00 00
  can1  00004270   [8]  D8 04 CA 04 03 00 00 00
  can1  00004280   [8]  00 00 D4 30 00 00 00 00
  can1  00004290   [8]  00 00 00 00 00 00 00 00
  can1  000042A0   [8]  00 00 00 00 00 00 00 00I am missing your ID "0x7320" but I saw it once durning initialization of the battery through PV Master (goodwe android app)
can anyone have some hints which ID or byte means what value?
Anyway, I am big fan of your analysis and passion for this DIY.

[buovjaga]

Hi blesk,

check-out this, might help a bit.

UPDATE 14.09.2022
https://u.pcloud.link/publink/show?code=XZCKP5VZGOrK3QVaYLuy4XWqcwWvsJUUpO4y

cheers buovjaga

[hr_eev]

I wonder if you can use your DIY High voltage Battery in the lead acid mode of the Growatt Inverter  for the first tests,
then you dont need a working communication. With good active balancers from JK BMS the LFP cells should stay in the safe range
I am planning to build such a HV battery, in the first step without communication.
Hopefully i can learn from your protocol hacking and port it to a raspberry pi.
I think Growatt is a rare exception among the new hybrid inverter which allows a lead acid high voltage configuration, all other inverters have only Low voltage lead acid batteries.

[hr_eev]

missed attachment

[buovjaga]

Hi hr_eev,

i think it is ok to use your configuration with Growatt and Lead-Acid mode.
Our Growatt is Three-phase Growatt SPH10000TL3-BH.
We have focused on Lithium mode, but I think we have run it also in Lead-Acid-mode
without any problems.
We have other problems, we try  to solve. (I let you know when this is solved)
Your JK BMS will take care about the SOC and SOH values
and react accordingly, when for example SOC value 100% is reached.

Maybe there are many other parameters you can adjust with JK BMS.?

We developed the communication interface program (Python3) in Raspberry 4
to communicate between Growatt and our Battery System.
When you read my previous documentation, you can easily find how simple
it is actually.


cheers r

[StefanRied]

Hi,

I think this is what you are looking for:

https://onlineshop.gcsolar.co.za/wp-content/uploads/2021/07/CAN-Bus-Protocol-Sermatec-high-voltage-V1.1810kW.pdf

I am trying to assemble stationary high voltage battery out of EV modules.
I'll keep you posted.

Stefan

[manny87]

Made a DBC file for the SC0500 CAN communications. Works on the log files posted in the first post.

Manny

[keodo]

Hi, I am very interested in this topic. I am also facing a similar situation. I use bms pace, does not support pylontech communication. However, I have found a project that supports reading battery information via rs232 port https://github.com/Tertiush/bmspace. Also I found a project to emulate pylontech https://github.com/juamiso/PYLON_EMU, but this version uses an old version so I can't find a value for battery capacity.
I'm not good at coding, hope you can help.
Currently I use a linux computer connected to the battery via rs232 port (usb rs232) and send information via CAN (usb can) but now I still can't write the complete code. :'( :'(

[pantagruel]

Hi, I am very interested in this topic. I am also facing a similar situation. I use bms pace, does not support pylontech communication. However, I have found a project that supports reading battery information via rs232 port https://github.com/Tertiush/bmspace. Also I found a project to emulate pylontech https://github.com/juamiso/PYLON_EMU, but this version uses an old version so I can't find a value for battery capacity.
I'm not good at coding, hope you can help.
Currently I use a linux computer connected to the battery via rs232 port (usb rs232) and send information via CAN (usb can) but now I still can't write the complete code. :'( :'(

Take a look at this for the rs232 Pace BMS . I use it and works great - all info in the wiki
https://github.com/ClassicDIY/PylonToMQTT