Pylontech sc0500 protocol "hacking" - Page 1
Forum section: electronics / general

author: ArCoN
author_rank: Contributor
timestamp: October 12, 2021, 03:12:16 pm
content: Hello Good people of the worldI need some reverse engineering expertise to decode some CANbus data.Maybe there is some smart eev's that can help.I have a SPH10000TL3 BH and a diy battery i love to get working.We have the pylontech battery system at work, so i have sniffed some data between the inverter and BMS.I made a C# program to try help decode the data, but i have a little trouble figuring out where the data is located. i need to find battery voltage and state of charge as a minimum, for the inverter to function (i think).The files:Program (use as you like, not pretty but kinda works, C# is not my main expertise)inverter tx.log - the CAN tgm's from inverter onlyinv-bat-stby_full.log - The battery is approx 90% SOC, log is done over night without load.batt full discharge.log - The battery is approx 90% SOC, log is done over night with load to around 0% SOC.Thanks ArCoN

author: ArCoN
author_rank: Contributor
timestamp: October 14, 2021, 08:26:35 am
content: Maybe it's worth mentioning that the battery system consists of sc0500 + 3 x H48050. so voltage range should be somewhere between 135- 162Vdc. minor details

author: buovjaga
author_rank: Newbie
timestamp: December 06, 2021, 12:21:21 pm
content: Example from inv-bat-stby_full.logone line a respond to CAN ID: 0x4200  02 00 00 00 00 00 00 0000:42:35:6880 Rx 1 0x7320 x 8 2D 00 03 0F 90 00 32 00to interprete this CANBUS answer we haveObs! Byte#4==0x90 and Byte#5==0x00 by swapping them we have 0x0090==144 decimalAlso Byte#6==0x32 and Byte#7==0x00 by swapping them we have 0x0032==50 decimalByte#0 = 0x2D Battery Module Qty or Total number of batteries 0x2D = 45 or 3 packs of 15 cellsByte#1 = 0x00 reserveByte#2 = 0x03 Battery Module in series Qty.Number of battery modules in series in one cabinet = 3Byte#3 = 0x0F 15 Cell Qty. in one battery module Number of battery cells in a module = 15Byte#4 = 0x90 144=45*3.2 Voltage Level or Voltage platform, resolution: 1VByte#5 = 0x00 Offset: 0Byte#6 = 0x32 50 AH number Resolution 1AH Charging capacityByte#7 = 0x00 Offset: 0The other canbus lines can be interpreted in a similar waycheers b

author: manny87
author_rank: Newbie
timestamp: March 31, 2022, 08:59:44 pm
content: Hello ArCoN,Bin working on a dbc file for the battery communication.I have some questions:What whas the discharge power?Ambient temperature?Full-charge voltage?Discharge voltage?Already found the soc data and high and low cell voltage needs a scaling factor.Thanks Manny

author: ArCoN
author_rank: Contributor
timestamp: April 01, 2022, 05:53:46 am
content: Hi MannyOk, its a long time ago now ;PSorry I can't remember what inverter it was. maybe a SPH3600. ~3.6Kw18-21dC"voltage range should be somewhere between 135- 162Vdc"Try ask buovjaga. I think he has a good understanding of what the data meansBR ArCoN

author: blesk
author_rank: Newbie
timestamp: April 02, 2022, 11:01:06 pm
content: Hello everyoneI am sniffing same setup: SC0500 + 4x H48050but I recieving only 9 IDs each one second:Code:interface ID lenght datacan1 00004200  00 FF FF FF FF FF FF FF (Goodwe 8k-ET)can1 00004210  C2 07 2F 75 28 05 45 64can1 00004220  70 08 CC 06 2A 76 36 74can1 00004230  F1 0C ED 0C 04 00 05 00can1 00004240  D8 04 C4 04 0F 00 0A 00can1 00004250  02 00 00 00 00 00 00 00can1 00004260  08 C2 FA C1 03 00 00 00can1 00004270  D8 04 CA 04 03 00 00 00can1 00004280  00 00 D4 30 00 00 00 00can1 00004290  00 00 00 00 00 00 00 00can1 000042A0  00 00 00 00 00 00 00 00I am missing your ID "0x7320" but I saw it once durning initialization of the battery through PV Master (goodwe android app)can anyone have some hints which ID or byte means what value?Anyway, I am big fan of your analysis and passion for this DIY.

author: buovjaga
author_rank: Newbie
timestamp: April 04, 2022, 01:54:03 pm
content: Hi blesk,check-out this, might help a bit.UPDATE 14.09.2022https://u.pcloud.link/publink/show?code=XZCKP5VZGOrK3QVaYLuy4XWqcwWvsJUUpO4ycheers buovjaga

author: hr_eev
author_rank: Newbie
timestamp: April 06, 2022, 12:35:59 pm
content: I wonder if you can use your DIY High voltage Battery in the lead acid mode of the Growatt Inverter for the first tests,then you dont need a working communication. With good active balancers from JK BMS the LFP cells should stay in the safe rangeI am planning to build such a HV battery, in the first step without communication.Hopefully i can learn from your protocol hacking and port it to a raspberry pi.I think Growatt is a rare exception among the new hybrid inverter which allows a lead acid high voltage configuration, all other inverters have only Low voltage lead acid batteries.

author: hr_eev
author_rank: Newbie
timestamp: April 06, 2022, 12:38:44 pm
content: missed attachment

author: buovjaga
author_rank: Newbie
timestamp: April 11, 2022, 05:41:51 pm
content: Hi hr_eev,i think it is ok to use your configuration with Growatt and Lead-Acid mode.Our Growatt is Three-phase Growatt SPH10000TL3-BH.We have focused on Lithium mode, but I think we have run it also in Lead-Acid-modewithout any problems.We have other problems, we try to solve. (I let you know when this is solved)Your JK BMS will take care about the SOC and SOH valuesand react accordingly, when for example SOC value 100% is reached.Maybe there are many other parameters you can adjust with JK BMS.?We developed the communication interface program (Python3) in Raspberry 4to communicate between Growatt and our Battery System.When you read my previous documentation, you can easily find how simpleit is actually.cheers r

author: StefanRied
author_rank: Newbie
timestamp: November 14, 2022, 04:13:24 pm
content: Hi,I think this is what you are looking for:https://onlineshop.gcsolar.co.za/wp-content/uploads/2021/07/CAN-Bus-Protocol-Sermatec-high-voltage-V1.1810kW.pdfI am trying to assemble stationary high voltage battery out of EV modules.I'll keep you posted.Stefan

author: manny87
author_rank: Newbie
timestamp: May 14, 2023, 08:39:04 pm
content: Made a DBC file for the SC0500 CAN communications. Works on the log files posted in the first post.Manny

author: keodo
author_rank: Newbie
timestamp: June 16, 2023, 03:11:19 pm
content: Hi, I am very interested in this topic. I am also facing a similar situation. I use bms pace, does not support pylontech communication. However, I have found a project that supports reading battery information via rs232 porthttps://github.com/Tertiush/bmspace. Also I found a project to emulate pylontechhttps://github.com/juamiso/PYLON_EMU, but this version uses an old version so I can't find a value for battery capacity.I'm not good at coding, hope you can help.Currently I use a linux computer connected to the battery via rs232 port (usb rs232) and send information via CAN (usb can) but now I still can't write the complete code. :'( :'(

author: pantagruel
author_rank: Newbie
timestamp: June 19, 2024, 04:20:45 pm
content: Quote from: keodo on June 16, 2023, 03:11:19 pmTake a look at this for the rs232 Pace BMS . I use it and works great - all info in the wikihttps://github.com/ClassicDIY/PylonToMQTT