charlez

Hi all, I thought I would document my findings of the Tian Power BMS protocol used in my Narada 48NPFC100 battery whilst I was attempting to establish why it did not work with my Deye inverter. Of note is that the exact same battery model is known to use a Shinwa BMS as well, but mine uses a Tian Power one, specifically TP-ND1530.
Firstly I wanted to thank @shanghailoz for documenting the same thing here for the Revov batteries, which also use a Tian Power BMS, without which I would have struggled a lot more. Also thank you @zivva for pointing me in the right direction for the BMS manufacturer.
I also peeked at the code of the BMS software to decipher how certain fields are calculated.
The protocol follows.
 
Preamble
Firstly, all data sent appears to have a header, body and CRC check. For example:
7e 01 01 00 fe 0d The first byte is either 7c or 7e according to the software. In my case it is always 7e.
The second byte is the DIP switch setting on the battery and corresponds to the following in the software:

The third byte is the function code, which you will see several examples of below, such as "read data", "read BMS time", "read BMS version", "read serial number".
The fourth byte is the length of the payload supplied as part of the function call - most "read" type functions will not include a payload and this parameter will be 00, but the "write" functions would have a payload. If there is a payload, it would follow this byte.
The last two bytes are the CRC check.
The response is structured in a similar way:
7e 01 01 56 ... f2 0d The first three bytes are an echo of what the request was, the fourth byte indicates the response length followed by the response bytes, and finally we have the CRC check.
 
Function 1 - Read data
7e 01 01 00 fe 0d This allows you to read almost everything that is displayed on the first tab of the BMS software.
The response will look as follows:
7e 01 01 56 01 0f 0c e1 0c e2 0c e2 0c e3 0c e3 0c e5 0c e5 0c e4 0c e4 0c e4 0c e2 0c e2 0c e2 0c e3 0c e5 02 01 75 30 03 01 16 74 04 01 27 10 05 06 00 44 00 45 00 45 00 44 40 46 20 45 06 05 00 00 00 00 00 00 00 00 00 00 07 01 00 81 08 01 13 54 09 01 27 10 0a 01 00 00 f2 0d The response body for this function is a data map structured as follows: data entry index, number of high/low byte pairs, the high/low byte pairs.
Data 1 - Cell count and cell voltages
01 0f 0c e1 0c e2 0c e2 0c e3 0c e3 0c e5 0c e5 0c e4 0c e4 0c e4 0c e2 0c e2 0c e2 0c e3 0c e5 The second byte is the number of cells - this is 15 for a 15 cell battery like mine or 16 cells for Revov. The individual cell voltages follow as high/low pairs which need to be divided by 1000, for example, 0ce1 maps to 3297 which means 3.297V. Since my battery has 15 cells, there would be 15 individual cell voltages.
Data 2 - Current
02 01 75 30 This is a tricky one. 7530 hex maps to 30000 decimal. The BMS software works it out as:
current_in_amps = (30000 - value_of_item_2) / 100 This item therefore has an offset of 30000 and a scaling factor of 0.01. So when the charge current is 0, the BMS will return 30000, therefore (30000 - 30000) / 100 = 0 amps. When the charge current is 10 amps, the BMS would return 29000, therefore (30000 - 29000) / 100 = 10 amps. When the charge current is -10 amps, the BMS would return 31000, therefore (30000 - 31000) / 100 = -10 amps. Furthermore, charge/discharge time remaining is calculated based on max battery capacity in amps divided by current in amps.
Data 3 - Remaining capacity
03 01 16 74 This value needs to be divided by 100 to get Ah. In this case I have 1674 hex or 5748 decimal, so 57.48Ah left of my 100Ah battery, therefore the SOC is 57.48%.
Data 4 - Full capacity
04 01 27 10 Divide by 100 to get full battery capacity in Ah. 2710 in hex is 10000 in decimal, so I have a 100Ah battery.
Data 5 - Temperatures
05 06 00 44 00 45 00 45 00 44 40 46 20 45 In my case there are 6 temperatures corresponding to the following screenshot:

In the Revovs the number of temperatures listed are different. The last two appear to be important ones.
Each temperature value is calculated as:
temp_value = (bms_temp_value & 0xFF) - 50 Data 6 - Alarm bits
06 05 00 00 00 00 00 00 00 00 00 00 These can be mapped to (a) very specific alarm code(s). I can get these if there is interest.
Data 7 - Cycles
07 01 00 81 This represents the number of cycles of the battery, so 129 in my case.
Data 8 - Voltage
08 01 13 54 The total voltage of the battery. The number needs to be divided by 100, so 49.48V in my case.
Data 9 - State of Health
09 01 27 10 The SOH of the battery. Needs to be divided by 100, so 100% in my case.
Data 10 - ALM bytes
0a 01 00 00 This corresponds to the ALM light on the battery and what it means.
 
Function 67 - Read protection parameters
Request:
7e 01 43 00 fe 0d Response:
7e 01 43 94 00 02 0e 10 01 02 03 e8 02 02 0d ac 03 02 0a f0 04 02 03 e8 05 02 0c 1c 06 02 15 4a 07 02 03 e8 08 02 14 c8 09 02 11 94 0a 02 03 e8 0b 02 13 88 0c 02 1f 40 0d 02 03 e8 0e 02 1b 58 0f 02 1f 40 10 02 03 e8 11 02 1b 58 12 02 00 69 13 02 0f a0 14 02 00 5f 15 02 00 32 16 02 0f a0 17 02 00 3c 18 02 00 69 19 02 0f a0 1a 02 00 5f 1b 02 00 32 1c 02 0f a0 1d 02 00 3c 1e 02 00 8c 1f 02 0f a0 20 02 00 87 21 02 00 0a 22 02 00 0f 23 02 03 20 24 02 01 f4 de 0d This is another data map which ultimately gets translated into the following, with the necessary scaling factors applied:
{ "cell_ov_start": 3.6, "cell_ov_delay": 1000, "cell_ov_stop": 3.5, "cell_uv_start": 2.8, "cell_uv_delay": 1000, "cell_uv_stop": 3.1, "pack_ov_start": 54.5, "pack_ov_delay": 1000, "pack_ov_stop": 53.2, "pack_uv_start": 45.0, "pack_uv_delay": 1000, "pack_uv_stop": 50.0, "charge_oc_start": 80.0, "charge_oc_delay": 1000, "charge_oc_stop": 70.0, "discharge_oc_start": 80.0, "discharge_oc_delay": 1000, "discharge_oc_stop": 70.0, "cell_ot_start": 55, "cell_ot_delay": 4000, "cell_ot_stop": 45, "cell_ut_start": 0, "cell_ut_delay": 4000, "cell_ut_stop": 10, "env_ot_start": 55, "env_ot_delay": 4000, "env_ot_stop": 45, "env_ut_start": 0, "env_ut_delay": 4000, "env_ut_stop": 10, "mos_ot_start": 90, "mos_ot_delay": 4000, "mos_ot_stop": 85, "capacity_low_start": 10, "capacity_low_stop": 15, "volt_diff_start": 800, "volt_diff_stop": 500 }  
Function 51 - Read BMS version
The request is as follows:
7e 01 33 00 fe 0d The response body is a string, such as:
7e 01 33 18 54 50 2d 4e 44 31 35 33 30 2d 31 35 53 31 30 30 41 2d 56 31 2e 30 2e 30 2e 0d Which in my case maps to: TP-ND1530-15S100A-V1.0.0
 
Function 66 - Read PCB barcode
Request:
7e 01 42 00 fc 0d Response body is a string as above.
 
Function 220 - Read serial number
Request:
7e 01 dc 03 06 00 00 c2 0d Response body is a string as above.
 
Function 69 - Read BMS time
Request:
7e 01 45 00 fe 0d Response:
7e 01 45 06 16 07 08 14 3b 16 48 0d To convert the above to a valid date time, prepend "20" and then concatenate the rest of the bytes which represent yy, MM, dd, hh, mm, ss, so in the above example: 2022-07-08 20:59:22.
 
There are many "write"-type functions too but I would be wary of using those.
I hope the above is useful to someone. I will post more useful ones if I find any.

The issue has been described a few times- you have to drop utility charging to minimum (2A?) and the problem should go away.
It's an inherent design problem, unless you solder resistors on, changing Util charging to 2A is the only workaround that helps. It has nothing to do with panels, grounding etc.
It does make it almost unusable - as 2A charging is very low - but at least better than it tripping.
to

Hi Smirresa,
Yes, setting 11 set to 2A and setting 16 set to CSO.  In CSO the inverter will only charge from utility in bypass mode when there no solar.  If you are in bypass mode, but there is solar (cloudy day with batteries low), then the AC charge will not occur.  If you are running from batteries and no solar (at night time) then the AC charge will not occur.  AC charging will only work when you are in bypass mode and no solar.
Regards
 

Thanks Herman
Implemented this solution on two separate systems in two different parts of the country on the 1st of December, when I first saw the post.
No error 08 messages on either of the systems since then, despite intermittent cloudy and wet weather.
Seems like a lasting solution. If anything changes I will give feedback

Yes they are poly crystalline and Class A. See data sheet attached. Model Number is CS6U-330P.
Canadian_Solar-Datasheet-MaxPower-CS6U-P-v5.52en.pdf

If the problem disappears when you disconnect your panels, you need to build an auto-isolator like I designed and posted - that was the only solution that worked for me. It is only applicable to the following situation:
<SPAN STYLE='background:dddd00;'> 1. Inverter in bypass mode AND 2. Solar panels are wet. </SPAN> Regards
A

@charlez, I'm using Hassio Home Assistant in my computer. I m not progamer guy so I just follow some tutorials in the internet. I gues the code is not Python, it's written in yaml file. You can find it in Google by keyword. "hassio mpp solar inverters". 

No, none of the solar charge controllers are isolated. The only isolation is between the battery and the DC bus. So for the 145 V max SCCs, they get isolation from the AC-out because they connect to the battery. But Axpert MKS IIs (as discussed in this topic) have a boost converter that connects directly to the DC bus. So you'll see chopped 230 V on the panel wires (with the high frequency component attenuated a little by a common mode choke). So you must be getting leakage from some panel wire / connector / inline fuse / panel junction box) to earth when it rains, causing the trip.
Huh. Who said Axpert MKS IIs don't have insulation monitoring? 😮  Of course, if it was proper insulation monitoring, it presumably could just show a warning and disconnect the PV, rather than black out the whole house. Though I'm not certain that the MKS II SCCs have a relay that can disconnect their output from the DC bus. [ Edit: it looks like there isn't. Sigh. ]

I can only speak from my experience, stay away from Manie's ICC, support is a nightmare and is almost always given tardive and with a bitter taste. I have tried many time to give feedback about the program to developer but in his wisdom has taken as herasment. I wait another player in this league.
About @Centurionsolar only good words, I have benefit from his support many times despite the fact that my copy of icc was bought from Manie. Respect and consideration.

Firstly, are you using the model with the very high PV input (up to 450V)? The circuit will only work for these models with PV panels attached.
As @Coulomb has mentioned (more than once), the problem can also occur when the battery voltage is too high.  Have you taken any measurements when you ran into error 08?

Well, most other inverters with hazardous PV voltages have insulation monitoring (testing, and alarm if there is a failure). It doesn't overcome panel leaks, but it might have prompted installers to know to use different brands of panels long before yours got installed.
Edit: most modern inverters are "transformerless" grid tie types, which would have the same sort of voltages at the PV terminals. Of course, other than the safety hazard and alarm, they might cope with the leakage just fine (i.e. continue operating).

Hi @Classna I searched on "LD03-16B12" and it seems there are many options internationally to source this component.

Hallo @charlez
Why 40A?  A 335W panel has a short circuit current of less than 10A.  With 2 strings, you need less than 20A.  I am using 405W panels (7x2) and used a 30A relay. 
You can get a 30A from Communica  - https://www.communica.co.za/products/jqx30f-2z-dc12v-flange
I also got the DC-DC converter from them
JQX30F-2Z-DC12V FLANGE
Relay • Flange • Form 2C • VCoil= 12V DC • IMax Switching= 30A • RCoil= 96Ω • 6.3mm Terminal SKU: JQX30F-2Z-DC12V FLANGE
BRAND: Asiaon
 
IN STOCK
R 152.38 (inc VAT)

@charlez - I don't think the suppliers are even aware of this issue with the inverter!
Here is the circuit

The heart of the isolater, is the LD03-16B12 (AC/DC Converter Vin = 90-528VAC (100-745VDC) Vout = 12V 250MA).  Since I have 2 banks of panels consisting of 400W panels capable of delivering more than 20A in total, I had to use a 30A relay.  If you have smaller panels, you can use a smaller relay.  Just make sure that the coil resistance of the relay is more than 70 Ohms to limit the current draw from the AC/DC converter.
Of course you can also use any other type of DC/DC (or AC/DC) converter.  As long as it can handle a relatively high input voltage with an output current of around 250mA at 12V (Or whatever voltage you desire to trigger the relay)
I hope this is useful for everybody who experiences Error 08 while the PV panels are very wet and the inverter is in bypass mode...

Hi Everyone
are not these commands for the BMS box that is apparently available from RCT as Rectron has a RCT-Axpert BMS box that is apparently made by Voltronic for Axpert MKS2 with the latest firmware that connects to the Modbus on the Inverter.

That is bad news @charlez :(  If (and only if) moisture is part of the problem, it could be that the cables were not completely dry after laying on the roof. So maybe there still was some leakage in your case... I have to tie mine up like you did in any case, since rain causes my earth leakage to trip.  So my system is even worse than yours :)

@charlez Yes, it goes without saying   I guess I should have mentioned it for completeness sake, but from the beginning of my contribution towards this thread, I have stated that my problems only occur when the unit is in bypass mode...
 

Unfortunately the PV input of the Axpert is not isolated as @Coulomb pointed out.  So this means any leakage to earth on the panels, whether through connectors or the panels itself, can be a contributing factor towards our problems.  However as @JustinSchoeman pointed out, it definitely is not the only factor.  He uses the Axpert as a UPS only, so there are no panels involved!!!  I hope his setup is the exception to the rule.  The earth leakage issue does seem to be very relevant in the other cases, since you ( @charlez ) have also managed to prevent further occurrences of Error 08 by simply isolating the panels (after the first occurrence of the error).

OK, so now there are 3 of us with the same type of installation and the same issue - I smell a rat
 

Hallo @charlez I believe that simply lifting them from the surface of the roof with cable ties (or whatever) should be fine.   It will be quite a mission for me to modify my wiring, since I have grouped the panes in a chunk of 8x2 with only a 1cm gap between them.  Hopefully I can reach the cables from the lower and upper sides of the array...
 My problems only occur in fairly heavy rains.  I use the CANADIAN SOLAR 405W SUPER HIGH POWER POLY PERC HIKU panels with MC4 connectors, so it is the same brand...

This morning got Error 08 again after some rain. Thanks to @APV by isolating the PV array I was able to restart the inverter without it crashing again. With the PV array connected the bus voltage would have spike again requiring multiple starts. My earth leakage did not trip.

I was going to post that I didn't find any differences in the handling of the bus voltage, but there are so many parts of the code involved that I thought I'd wait for confirmation of a change.
It looks like they've just sent the latest firmware, in the hope that there was a fix in there somewhere, without having to actually sit down and solve the problem. A cynic might have said this was just to keep the customer quiet, but let's assume they wanted to confirm that there really is a problem even after the latest firmware, before they devote significant resources to it.

Only a pleasure !   Feedback would be greatly appreciated. I also used this forum as a reference to Voltronic to convince them to look into the problem.
Today is certainly a very cloudy day where I live . . .

Great work BvR!  I don't know how you managed to communicate with Voltronic, but I am very impressed!  So now my inverter is running 7.80.  We now have to wait for a cloudy day to see if the issue is resolved....
 

Hi Manie 
I spoke to Energy since I am not the one to enforce etiquette on the forum - Energy is. If you feel I was chicken I was just wanting to nudge you in the right direction and avoid the unpleasantness that I know is going to ensue.  I feel you have crossed the line. The supplier supplies you with the protocol and yet you feel that you would not like to pass it on- your prerogative. The idea of this forum is to help each other. If you had spent hours working out the protocol fine it would be your intellectual material. Someone gave you the protocol and you not willing to pass it on. That takes a special kind of meanness.
Coulomb's attitude is so refreshing different to yours.