Pylontech protocol

[riogrande75]

I'm currently working on reverse engineering of the bms box/card for MPI/Infinisolar hybrid inverters.
Unfortunately I do not have a real pylontech battery (this is the reason for this project), so I need to simulate the the rs485 port of it.
From the RS485 protocol description I do not see example reply's, only the commands itself are mentionend and obviously not all of them.

I digged in some forums but did not find any reply for this commands so far:

ASCII:
~0002464F0000FD9A
~0012464F0000FD99

Also for the cyclic query for firmware version sent to all possible ID's I did not find a answer so far:

HEX:
07030001000755AE
0803000100075551
0903000100075480
0A030001000754B3
0B03000100075562

Can someone help me please getting the correct reply's from a real pylontech?

[Steve87]

Not sure if this helps but I uploaded the Pylontech BMS RS485 protocol document in the downloads section...If you require the CANBUS protocol I have that too. However, the Infinisolar does not make use of CAN Comms so largely that will be useless for your project. 

[riogrande75]

Thx, but off course I have this document. As mentioned, I need the reply for those commands not the commands themselves.

[riogrande75]

I'm one step ahead.

Found in another forum a short log which I implemented in my research scripts:

>> ~0002464F0000FD9A // query protocol of ID02
<< ~200246000000FDB2 // reply with protocol 20

>> ~20024661E00202FD32 // query ??
<< ~200246008062CFCDFF8E510001000164640CFA000F0CF900100BB50BB900020BB200040BC30BC300010BC300010BC20BC200010BC20001E897

>> ~20024663E00202FD30 //query ??
<< ~20024600D012E100AF0003B603B6C0F9B5

The protocol starting with the "~" character seems to be really pylontech rs485, but uses undocumented functions (CID2 0x61 and 0x63 in this case).

Anyhow, on the RS232 side (inverter side) the following string appears now:

^D054BMS0531,081,1,0011,0,0,0576,0576,0950,0,0,0448,0560

So far I don't know the meaning, but I guess I'll have that soon.

 

The other strings on the rs485 side seem to be voltronic's "LIB" protocol, but I did not find any documentation so far.

00 03 00 01 00 07 54 19
01 03 00 01 00 07 55 C8
02 03 00 01 00 07 55 FB
03 03 00 01 00 07 54 2A
...

I expect the bms box understands both protocols but I'll better focus on pylontech.

[Wiebo]

Did you log the datatraffic with a spy at the RS232 port of the inverter? Would be very interested. You could simulate the battery with Docklight.

Maybe i can help

Edited October 14, 2022 by Wiebo

[riogrande75]

Hi!

Thx for the reply.

In the meantime I found out most of the values in that string that needs to be send to the inverter.

My JK-BMS 'speaks' already with my infinisolar 10kW inverter, even without the official bms box/card.

Most information about this was posted in a german forum: BMS Kommunikation Infini-/MPP-Solar MPI / FSP Hybrid 10k und DIY Batterie

BTW: This is for the 10/15k versions only, smaller infini inverters (3k,5k,...) with PI16 need different commands. I also reavealed them mainly and posted my findings there.

[Wiebo]

Thank you very much for that link Rio! Have the same inverter, the 3 phase 10kW version. Indeed, exists in also 15kW version and connected with JK BMS, so we're working at the same project

 

[Wiebo]

So Rio, to be brief...

The only thing the BMS box does is sending the ^D054BMS(+BatteryData) string to the inverter at fixed intervals?

In that case you actually don't need the Pylontech protocol if you translate directly from the JK BMS to Voltronic protocol.

Is that correct?

 

EDIT:

Nevermind, already got it working thnx 2 U!

 

Edited October 15, 2022 by Wiebo

[BritishRacingGreen]

On 2022/07/08 at 5:05 PM, riogrande75 said:

The protocol starting with the "~" character seems to be really pylontech rs485, but uses undocumented functions (CID2 0x61 and 0x63 in this case).

Hi @riogrande75  were you able to resolve the undocumented  CID2 0x61 and 0x63 , or do you just silently ignore them?

[riogrande75]

@Wiebo Yes, in fact it's just this simple string that gets sent to the inverter perodically. So it's pretty easy to build a communication with any other BMS.

@BritishRacingGreen Yes, I was able to find the descripcion of the missing CID2's in the sunsky/deye comms protocol.

[BritishRacingGreen]

4 minutes ago, riogrande75 said:

@Wiebo Yes, in fact it's just this simple string that gets sent to the inverter perodically. So it's pretty easy to build a communication with any other BMS.

@BritishRacingGreen Yes, I was able to find the descripcion of the missing CID2's in the sunsky/deye comms protocol.

My Goodness me , missing protocol info plus examples under a Sunsynk document under a title called 'BATTERY COMPATIBILY' ,  how is that for a diamond in the ruff , or otherwise a misleading title!.

Many thanks friend  , this puts some winds in my sails as I need to write a protocol for @Steve87   .

[BritishRacingGreen]

4 minutes ago, BritishRacingGreen said:

My Goodness me , missing protocol info plus examples under a Sunsynk document under a title called 'BATTERY COMPATIBILY' ,  how is that for a diamond in the ruff , or otherwise a misleading title!.

Many thanks friend  , this puts some winds in my sails as I need to write a protocol for @Steve87   .

Which begs a question, why is there not official Pylon documentation, yet Sunsynk offers more? . I guess there are later Pylon docs which is not out there in the wild. 

[riogrande75]

This is my opinion too.

If you have some code/project ready, pls. let me know.

Maybe my implementation helps a bit, even it's very bad coding:
Infinipoll10k_BMS
readmqttbms

Edited March 20, 2023 by riogrande75

[DonovanKr]

On 2022/06/26 at 9:40 AM, Steve87 said:

Not sure if this helps but I uploaded the Pylontech BMS RS485 protocol document in the downloads section...If you require the CANBUS protocol I have that too. However, the Infinisolar does not make use of CAN Comms so largely that will be useless for your project. 

Could you possibly share the link for the CAN protocol

[Steve87]

Please ask Britishracinggreen he is in possession of this document. 

[Coulomb]

This may not be the latest version of the  protocol manual. It's version 1.2.

PYLON BMS CAN-Bus-protocol-PYLON-low-voltage-V1.2-20180408.pdf

Edited May 23, 2023 by Coulomb

[JJFduPlessis]

Hi I also one of the people trying to communicate with my inverter BMS. I am using Kodek 7.2MAX inverter if I set it up as pylon battery I cannot past the first step. I using ESP32 to send the signal to my inverter the inverter ask for get protocal version ~0002464F0000FD9A I reply to it ~200246000000FDB2 but it seems that the inverter does not pick up that signal. because it keep on asking that but just on different address ~0052464F0000FD95 I don't know why it done that. If I use PBMStool on my PC with the same ESP32 loaded with all the battery info it work that tool think that that are the battery with the correct settings. if some one have did have the same problem and get it fixed can you please help.

Thanks

Francois   

[riogrande75]

Attached updated pylontech protocol descriptions with additional CID2's that are used by 3pty manufacturers like voltronic, deye, seplos, etc.
With that you might be able to understand and fix your ESP32 code.

RS485-protocol-pylon-low-voltage-V3.3-20180821.pdf Sunsynk_BatteryCompatibility_v16_English_j1196.pdf

[JJFduPlessis]

Thank you for documents I check it and the command I send back to the inverter look correct, but the inverter does not accept it or I don't know if he does read it. I die wonder if it cannot be a firmware problem of my inverter display. U2 of my inverter are 12.13. Is there someone hoe done this on and have the same problem and get it fixed.

Thanks 

[JJFduPlessis]

I did manage to get it right. It was firmware problem on my inverter. after I updated U2 to 12.21 it start working and read my commands. 

[Wiebo]

Meanwhile got the whole thing running on a small PCB standard trough-hole PCB. Still wired bc my final PCB needs to be drawn first. It's based on a PIC16F88 and draws its power directly from the serial connector of the inverter. Just plug it in in the inverter, and the RS485 cable and it works.

4 LED's:

- Green = Power (Power blinking = no BMS connected, constantly on = communication is OK)

- Yellow 1 = Communication with BMS

- Yellow 2 = Communication with Inverter

- Red = Error

Still bebugging tough. Some values need to be calculated but the main code works flawlessly.

Does anybody know how you handle the warnings? My inverter does not respond on any inputs i tried

[Wiebo]

Riogrande, how do you read those high currents from the BMS? I have a JK inverter BMS, configured as Pylontech, protocol v3.3 but struggeling to read the max charge and discharge currents. All goes well untill 68 Amps. Above that i get the strangest values... Have you seen this before?

I sent this string: ~201246630000FDA8 + /0x0D and get the response, but the values of the current also starts to jump around above 68 Amps. I have to note that the ASCII values are minus 5%, the BMS does this and is normal behavior.

The current seems to be in mA, 16 bits, so that's 65,635 Amp in the max current i can read. But i need to go to 200Amp. Is this even possible with Pylontech?

Nevermind! I used a JK BMS and there's a bug in it, found it and reported it to JiKong.

Edited January 6 by Wiebo