diy solar

diy solar

Decoding the DALY SmartBMS protocol

tanoshimini said:
I took some inspiration from the SimpBMS for tesla modules, and I now have the Daly sending BMS.Can messages that my Victron equipment is reading successfully. Yay! From what I understand this would make my little adapter work with any inverter that is compatible with the SimpBMS or the ones from REC.

I'm going to streamline the code and push it to GitHub in the next day or so.
Click to expand...

Have you already published the code you have on GitHub? I am very interested in it. Thanks.
 

Attachments

  • The list of compatibility between battery and Growatt Off-grid Inverter 2021.05 V1.9 (1) (1).pdf
    62.1 KB · Views: 103
  • PYLON LFP Battery communication protocol - RS485 V2.8 20161216.pdf
    226.6 KB · Views: 96
TheDude130 said:
This is awesome work. What is the possibility of expanding this effort in order to enable the Dalys to talk to the Growatt inverters? It seems that emulating the Pylon BMS protocol would be the most practical way.

github.com

GitHub - juamiso/PYLON_EMU: Python script to emulate the outgoing CAN bus traffic from a Pylontech LFP battery pack (48V)

Python script to emulate the outgoing CAN bus traffic from a Pylontech LFP battery pack (48V) - juamiso/PYLON_EMU
github.com github.com
Click to expand...
That's actually pretty doable. I'm playing around with pulling the data from multiple Daly's over the BLE (different packs, wired in parallel) and collating that to send to my victron quattro. Doing the same for PylonTech-speak shouldn't be all that difficult, and would still work with my inverter. Lemme look into this.
 
tanoshimini said:
That's actually pretty doable. I'm playing around with pulling the data from multiple Daly's over the BLE (different packs, wired in parallel) and collating that to send to my victron quattro. Doing the same for PylonTech-speak shouldn't be all that difficult, and would still work with my inverter. Lemme look into this.
Click to expand...
That would be awesome. I know there are many of us that could benefit from this. Attached a few docs that might be helpful.
 

Attachments

  • The list of compatibility between battery and Growatt Off-grid Inverter 2021.05 V1.9 (1) (1).pdf
    62.1 KB · Views: 58
  • PYLON LFP Battery communication protocol - RS485 V2.8 20161216.pdf
    226.6 KB · Views: 49
  • CAN-Bus-protocol-PYLON-low-voltage-V1.2-20180408.pdf
    250.4 KB · Views: 100
I did some diggin into the Charge/Discharge Control feature, i.e. options to enable/disable charging or discharging of a specific battery. As I have several batteries in parallel and hence need to do some grooming of each battery (e.g. to allow for balancing), this feature is crucial to let one battery charge to the limit in order to reach its balancing SoC level.
The Charge/Discharge status is shown on the "Data Monitoring" sheet, the controls however are on the "Engineering model" sheet.
 

Attachments

  • R16T-FK03 Monitor as Board2.gif
    R16T-FK03 Monitor as Board2.gif
    151.3 KB · Views: 79
  • R16T-FK03 Engineering Model Board2.gif
    R16T-FK03 Engineering Model Board2.gif
    124 KB · Views: 85
Command 0xDA appears to address the Charge Control feature with this command switching the MOSFET on
Code: 
-> A540DA080100000000000000C8
<- A501DA0801xxxxxxxxxxxxxxyy
As it seems replies the BMS only with the first byte (0x01) as the following bytes are remains of the previous message.

To switch the charging MOSFET off again:
Code: 
-> A540DA080000000000000000C7
<- A501DA0800xxxxxxxxxxxxxxyy

And here the example for board 2 (check out my post on changing board numbers). As you can see, the address from PC to BMS changes from 0x40 for Board1 to 0x41 for Board2. The BMS Board2 replies with 0x02 after 0xA5.

Switch Charge MOSFET On:
Code: 
-> A541DA080100000000000000C9
<- A502DA0801xxxxxxxxxxxxxxyy
Switch Charge MOSFET Off:
Code: 
-> A541DA080000000000000000C8
<- A502DA0800xxxxxxxxxxxxxxyy
 
Last edited:
Command 0xD9 appears to address the Discharge Control feature with this command switching the MOSFET on

Code: 
-> A540D9080100000000000000C7
<- A501D90801xxxxxxxxxxxxxxyy
As it seems replies the BMS only with the first byte (0x01) as the following bytes are remains of the previous message.

To switch the charging MOSFET off again:
Code: 
-> A540D9080000000000000000C6
<- A501D90800xxxxxxxxxxxxxxyy

And here the example for board 2. As you can see, the address from PC to BMS changes from 0x40 for Board1 to 0x41 for Board2. The BMS Board2 replies with 0x02 after 0xA5.

Switch Charge MOSFET On:
Code: 
-> A541D9080100000000000000C8
<- A502D90801xxxxxxxxxxxxxxyy
Switch Charge MOSFET Off:
Code: 
-> A541D9080000000000000000C7
<- A502D90800xxxxxxxxxxxxxxyy
 
Hi Guys,
you are all doing a great work! I'm currently trying just to read the temperature senor from the daly BMS but i didn't get it right. (Sorry i'm totaly new to the stuff).

I think i get it right how to adress the temperature sensor, but i'm not sure how to adress the correct handle. Maybe some of you guys can give me a short hint. (I'm trying now for the hole day but i think i'm missing some essential knowledge about bluetooth connections...).

gatttool -b XX:XX:XX:XX:XX:XX --char-write -a 0x0010 -n a5409408000000000000000081
--> i don't get a response

So i think it's only the wrong handle but i can not figure out which handle to write to...

I appreciate every response or hint what i'm doing wrong!
 
Last edited:
I don't know your tool. All I can say is, you are sending the right message. Check again if your tool sends the message as hex (and not ASCII).
 
KaFun said:
I don't know your tool. All I can say is, you are sending the right message. Check again if your tool sends the message as hex (and not ASCII).
Click to expand...
At the moment i try to do it directly in the terminal, from my raspberry with venus OS, later on i will sent the request using node-red (exec). So from the terminal should i use another syntaxe?
 
Marv085 said:
At the moment i try to do it directly in the terminal, from my raspberry with venus OS, later on i will sent the request using node-red (exec). So from the terminal should i use another syntaxe?
Click to expand...
Again, I don’t know your tool! But start try monitoring what you send with another machine (e.g. a RS485-to-USB adaptor on a laptop). Most probably you’re sending not in Hex. To monitor I use hterm in Windows and I have to select “View in hex” not to see garbled stuff.
You can compare what you’re sending to something the Daly-software is sending!
 
Hey guy's,

i now figured out how to send the hex values correct via the "gatt" write command. it has to be formated like this:

0xa5 0x40 0x94 0x08 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x81

But now i still have a problem to adress the right handle. If i list all attributes i don't find a handle "0x0010" to write to. Have some else done this via "gatt"? These are all handles i get from the list command.

Primary Service (Handle 0x83cc)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000a
00001801-0000-1000-8000-00805f9b34fb
Generic Attribute Profile
Characteristic (Handle 0x6dc8)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000a/char000b
00002a05-0000-1000-8000-00805f9b34fb
Service Changed
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000a/char000b/desc000d
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Primary Service (Handle 0x7568)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000e
0000fff0-0000-1000-8000-00805f9b34fb
Unknown
Characteristic (Handle 0xb628)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000e/char000f
0000fff2-0000-1000-8000-00805f9b34fb
Unknown
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000e/char0011
0000fff1-0000-1000-8000-00805f9b34fb
Unknown
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service000e/char0011/desc0013
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Primary Service (Handle 0x8990)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014
0000180a-0000-1000-8000-00805f9b34fb
Device Information
Characteristic (Handle 0x19e8)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0015
00002a29-0000-1000-8000-00805f9b34fb
Manufacturer Name String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0017
00002a24-0000-1000-8000-00805f9b34fb
Model Number String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0019
00002a25-0000-1000-8000-00805f9b34fb
Serial Number String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char001b
00002a27-0000-1000-8000-00805f9b34fb
Hardware Revision String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char001d
00002a26-0000-1000-8000-00805f9b34fb
Firmware Revision String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char001f
00002a28-0000-1000-8000-00805f9b34fb
Software Revision String
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0021
00002a23-0000-1000-8000-00805f9b34fb
System ID
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0023
00002a2a-0000-1000-8000-00805f9b34fb
IEEE 11073-20601 Regulatory Cert. Data List
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service0014/char0025
00002a50-0000-1000-8000-00805f9b34fb
PnP ID
Primary Service (Handle 0x55a8)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b
f000ffc0-0451-4000-b000-000000000000
Vendor specific
Characteristic (Handle 0x6d80)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char002c
f000ffc1-0451-4000-b000-000000000000
Vendor specific
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char002c/desc002e
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char002c/desc002f
00002901-0000-1000-8000-00805f9b34fb
Characteristic User Description
Characteristic (Handle 0xfec0)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char0030
f000ffc2-0451-4000-b000-000000000000
Vendor specific
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char0030/desc0032
00002902-0000-1000-8000-00805f9b34fb
Client Characteristic Configuration
Descriptor (Handle 0x0000)
/org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX/service002b/char0030/desc0033
00002901-0000-1000-8000-00805f9b34fb
Characteristic User Description
 
KaFun said:
Are you trying this via Bluetooth? GATT is in my understanding a BT protocol profile
(https://learn.adafruit.com/introduction-to-bluetooth-low-energy/gatt: "GATT is an acronym for the Generic Attribute Profile, and it defines the way that two Bluetooth Low Energy devices transfer data back and forth ...")

I can't help you with that! I am using UART or RS485 ...
Click to expand...
Yes im tryin it via bluetooth and the "gatt" protocol. As far as i understand it should be possible to get the values with "gatt", adressing the right service. So if i get it right the "a5409408000000000000000081" request is only for UART or RS485....

Nevertheless already many thanks for your support, now i'm already a little bit smarter.

I will further keep trying to figure out if it's possible somehow to get tha values via bluetooth.
 
Have you tried logging the Bluetooth protocol that is sent between the BMS and e.g. your phone with an ordinary Bluetooth sniffer/logger? I've heard, there are a few good sniffer out there and you might be able to see, what protocol the BMS BT adapter is actually using. As the Bluetooth adapter connects to the same port as the UART, I'd assume, at least the messages are the same. But no guarantee on that ...
 
KaFun said:
Have you tried logging the Bluetooth protocol that is sent between the BMS and e.g. your phone with an ordinary Bluetooth sniffer/logger? I've heard, there are a few good sniffer out there and you might be able to see, what protocol the BMS BT adapter is actually using. As the Bluetooth adapter connects to the same port as the UART, I'd assume, at least the messages are the same. But no guarantee on that ...
Click to expand...
With my phone i don't get any usable results. With for example the "nrRF Connect" app i only see the values i already know from the gatt commands from my raspberry. I now ordered a "Adafruit Bluefruit LE Sniffer", we'll see if i get some more informations out of that. I will let you know if I'm succesfull.
 
Marv085 said:
With my phone i don't get any usable results. With for example the "nrRF Connect" app i only see the values i already know from the gatt commands from my raspberry. I now ordered a "Adafruit Bluefruit LE Sniffer", we'll see if i get some more informations out of that. I will let you know if I'm succesfull.
Click to expand...
Hi,
Have you had luck reading the parameters using BLE ?

I have four Sterling Power 150Ah LiFePO4 batteries that come with Daly SmartBMS BLE builtin. As I use these on a boat I would like to set up either RasberryPi or Arduino to monitor the batteries and gather information that can be used to send alerts, turn off inverter should the SoC drop to low etc.

Cheers and Seasons Greetings!
 
I wish all these chinese BMS brands would just use standard protocols like Modbus or SMbus, would make things so much easier!
Click to expand...
I have the MODBUS protocol that they use... It is a ods spreadsheet and won't load here...
 
I am looking for someone to parse the DALY or HEYO Smart BMS data (I have identified it and have all of the addresses etc...) and make it display on a Intelligent LCD like Nextion or??? It is for a product I manufacture and I will pay appropriate rates to get it done right. Interested??? Anyone???
A little clever averaging for smooth current readouts while loading with an inverter will be necessary... But it should be a slam dunk. Has to be fast, modern, and beautiful... And preferably use (virtually) no power. I also want to be able to display pictures (slides) and/or video for on board manual and product info.
 
SoLithBoy said:
I have the MODBUS protocol that they use... It is a ods spreadsheet and won't load here...
Click to expand...
Thanks for uploading the protocol description in the Resources section.
Some comments:
  1. The document you posted does say "MODBUS" protocol but MODBUS is a specific protocol that definitely looks different (see MODBUS on Wikipedia). So I assume the author used this name because it probably uses the RS485 hardware layer (as MODBUS does in most cases - see RS485 on Wikipedia).
  2. Can you please specify the BMS that follow this protocol as the "standard" DALY RS485 protocol for 8S and up BMS is here in the Resource Section. I have a couple of DALY R16T and R16A BMS that I interface using this protocol in a Python script.
Can you please add your BMS type for which you received this document?
 
i want to use the daly bluetooth module it sends d2 03 00 80 00 29 96 5f i made software to set all the data on the lcd display that works with the normal protocol that was explained here in the forum. but when i connect the bluetooth module and send the same data as i send to the display nothing happend. but the bluetooth module sends sometimes d2 03 00 80 00 29 96 5f. does anybody has a idea to decode the bluetooth protocol ? i use the display and bluetooth to monitor the seplos bms. like a protocol converter.
 
Not sure it help ... I did monitor the UART (bluethooth modul) and this is the result

Sending of D2:03:00:80:00:29:96:5F →
D2:03:52:04:1A:0C:80:00:01:00:04:00:00:00:00:00:01:00:00:00:00:00:00:1C:20:0D:AC:0D:AC:0A:28:0A:28:00:8C:00:8C:00:68:00:68:74:CC:74:CC:74:90:75:D0:00:55:00:55:00:28:00:28:00:6E:00:6E:00:27:00:27:00:FF:00:FF:00:FF:00:FF:0C:80:00:14:00:01:00:01:02:A8:00:57:7F:8B

Sending: D2:03:00:A9:00:20:87:91→
D2:03:40:32:30:34:30:31:32:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:53:48:33:39:46:30:30:33:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:B8:F5

Sending: D2:03:00:C9:00:03:C6:56 ( Name und Battery type )
D2:03:06:31:32:33:34:35:36:4C:69:D2:03:06:31:32:33:34:35:36:4C:69

Sending: D2:03:00:00:00:3E:D7:B9 ->
D2:03:7C:0D:06:0D:09:0D:09:0D:07:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:3C:00:28:00:00:00:00:00:00:00:00:00:00:00:00:00:85:75:30:02:A8:0D:09:0D:06:00:3C:00:3C:00:00:02:CA:00:04:00:01:00:00:00:00:00:01:00:01:0D:07:00:03:00:00:00:00:00:00:00:00:00:00:E0:44

20Grad + 40 = 60 = 003C
0085 = 133 = 13.3V
02A8 = 680 = 68% SOC
0D09 + 0D06 = 3.337V + 3.334V (Max Min voltage of cell)
00:3C Tempr?
Click to expand...

(

D2:03:7C:0D:06:0D:09:0D:09:0D: Voltage of each cell
07:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:3C:00:
28:00:00:00:00:00:00:00:00:00:
00:00:00:00:85:75:30:02:A8:0D:
09:0D:06:00:3C:00:3C:00:00:02:
CA:00:04:00:01:00:00:00:00:00:
01:00:01:0D:07:00:03:00:00:00:00:00:00:00:00:00:00:E0:44



D2:03:7C:0D:07:0D:0A:0D:0A:0D:
06:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:00:00:
00:00:00:00:00:00:00:00:38:00:
28:00:00:00:00:00:00:00:00:00:
00:00:00:00:85:75:71:02:A8:0D:
0A:0D:06:00:38:00:38:00:01:02:
CA:00:04:00:01:00:00:00:00:00:
01:00:01:0D:08:00:04:00:54:00:00:00:00:00:00:00:00:2A:3A

00:54 = Actual current?
Click to expand...


Still busy do decode this frame but found SOC Voltage, ...

Corrections, Ideas ?
 
This discussion is interesting and helpful. We are trying to integrate a teensy processor with a Daly BMS (72V 100A) via CAN bus. Has anyone here successfully used CAN Bus to communicate with Daly BMS? If so, grateful if you can indicate details about the specific CAN bus protocol that Daly BMS make use of. We could not find this information in the limited manufacturer documentation.
 
Last edited:
You must log in or register to reply here.

Similar threads

R
a new uart protocol for a Daly Smart 150A BMS?
Replies
3
Views
315
russt
R
R
Failed to connect via JK-BMS-Monitor
Replies
7
Views
612
Gibo
G
E
Victor Max 10.2 Kw rs-232 protocol
Replies
1
Views
334
elproko
E
A
Writing Data to JKBMS USB-TTL / RS-485
Replies
9
Views
2K
dovervric
D
E
DDSU666 "METER TYPE" value in the 00Bh register
Replies
0
Views
389
ee99rsp
E

diy solar

diy solar
Back
Top