BMS protocol and read-out

[NikArc]

Hello all!

I just had to register because I am stuck with my problem.
I get me a LiFePO4 battery from aliexpress (I can post a link if needed), it's quite nice, but it only communicates using the windows software you get from the vendor.
The battery can communicate with diverse inverters, so I suppose there is some kind of standard protocol for RS485 communication.
But I did not find anything and hacking serial communication is new to me, too

I don't know the type of BMS, the software shows DR-HUANY04, but I can't find anything with that name.
After looking at forum posts here, I don't think its seplos compatible. Converted to ASCII the request looks different.
The software also says "Protocol: DR-1363", nothing relevant found with google.

I sniffed the communication and I found that the software sends
7E 32 32 30 31 34 41 34 32 45 30 30 32 30 31 46 44 32 38 0D
to get data back.

The BMS replies with
7E 32 32 30 31 34 41 30 30 45 30 43 36 30 30 32 37 31 30 31 34 46 35 31 30 30 44 32 30 30 44 30 39 30 44 30 41 30 44 30 42 30 44
30 39 30 44 31 36 30 44 30 39 30 44 31 36 30 44 32 39 30 44 32 45 30 44 30 45 30 44 30 39 30 44 30 41 30 44 30 43 30 44 34 41 30
44 34 36 30 31 34 41 30 31 32 43 30 31 34 30 30 34 30 31 32 43 30 31 32 43 30 31 33 36 30 31 33 36 30 30 30 30 30 30 30 30 30 30
36 34 30 31 32 38 43 41 32 38 43 41 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 33 30 30 30 30 30 30 30
30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 44 35 33 35 0D

7E 32 32 30 31 34 41 30 30 45 30 43 36 30 30 32 37 31 30 31 34 46 35 31 30 30 44 32 30 30 44 30 39 30 44 30 41 30 44 30 42 30 44
30 41 30 44 31 37 30 44 30 39 30 44 31 35 30 44 32 39 30 44 32 45 30 44 30 46 30 44 30 41 30 44 30 41 30 44 30 42 30 44 34 39 30
44 34 36 30 31 34 41 30 31 32 43 30 31 34 30 30 34 30 31 32 43 30 31 32 43 30 31 33 36 30 31 33 36 30 30 30 30 30 30 30 30 30 30
36 34 30 31 32 38 43 41 32 38 43 41 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 33 30 30 30 30 30 30 30
30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 44 35 32 44 0D

7E 32 32 30 31 34 41 30 30 45 30 43 36 30 30 32 37 31 30 31 34 46 35 31 30 30 44 32 30 30 44 30 39 30 44 30 41 30 44 30 42 30 44
30 39 30 44 31 36 30 44 30 39 30 44 31 35 30 44 32 39 30 44 32 45 30 44 30 45 30 44 30 41 30 44 30 41 30 44 30 42 30 44 34 39 30
44 34 35 30 31 34 30 30 31 32 43 30 31 34 30 30 34 30 31 32 43 30 31 32 43 30 31 33 36 30 31 33 36 30 30 30 30 30 30 30 30 30 30
36 34 30 31 32 38 43 41 32 38 43 41 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 33 30 30 30 30 30 30 30
30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 44 35 34 39 0D
(3 examples)

I can do this much, but I don't know how to get the data I want to know from the BMS.
I don't really need cell voltages, but I don't mind to "know" every data I can get out of this data reply.

I use a raspberry pi and node red and I need to know battery current and voltage, also charging states to be able to write the code for my charging script.
And of course temperatures etc would be interesting, too.

Does anyone recognize the protocol by looking at the data above? Google is no help, but since the battery can communicate with different inverter brands out of the box, there must be some standard?

One way to go could be getting a lot of these replies and compare what has changed and maybe calculate 16/32 bit values out of it and then compare them with screenshots of the BMS windows software, but I suppose that's a lot of trouble.

Thanks for hints and with best regards,
Nik

 

[Dave21]

The most common value is 30 hex (which is 0 in ASCII table). All values between the initial 7E (~) and trailing CR looks like ASCII values. Maybe, it can help to translate these packets into their ASCII forms and you will see much more from the data. Chinese developers like textual protocols even they are usually too verbose compared to binary ones.

 

[NikArc]

ok, that's interesting

the hex values (of a new data packet) are

~22014A00E0C600271014E5100D130D070D080D0A0D080D0E0D070D0C0D180D1A0D090D080D070D080D280D23012C0122012C04012C012C012201220000000000640128CA28CA0006000000000000000000230000000000000000000000000000000000000000000000D56C

in ASCII

 

[Dave21]

Ok, now in ACII representation, it is clear that there are hex numbers. It seems tha you have 16 cells in the system. The sequence of 16-bit numbers like this:

0D13
0D07
0D08
0D0A
0D08
0D0E

represent cell voltages. For example the second value 0D07 seems to be decimal number 3335 where BMSes usually sent out values in mV precession thus I assume that some cell in your pack has 3.335V at that moment. Numbers seems to be encoded using big-endian style. All others will be encoded the same way. You can now easily decode positions of all fields using existing application and searching data packet. Aside of cell voltages, I suppose there will be: SoC, total voltage, charging/discharding current, remaining capacity, cycle AH, temperature sensors if there are some and possibly other values. The very last 16-bit number D56C in hex is highly probably 16-bit check sum of all previous values. I assume it will be one of the standard approach like CRC16.

 

[NikArc]

since it is new to me and to understand it better:
So it is as you said? I have to convert the buffer to ASCII which then contains hex values which I have to decode to 16bit numbers? (well, it might contain status bits somewhere, too, no idea yet)

I think I made some progress, 2 data packages:

~22014A00E0C6002
71014E510

0D13 cell01 3347V
0D07 cell02 3335V
0D08 cell03 3336V
0D0A cell04 3338V
0D08 cell05 3336V
0D0E cell06 3342V
0D07 cell07 3335V
0D0C cell08 3340V
0D18 cell09 3352V
0D1A cell10 3354V
0D09 cell11 3337V
0D08 cell12 3336V
0D07 cell13 3335V
0D08 cell14 3336V
0D28 cell15 3368V
0D23 cell16 3363V

012C temp 30.0
0122 temp 29.0
012C temp 30.0

0401
2C012C012201220000
000000640128CA
28CA SoC/Capacity 104.42Ah
0006000000000000000000230000000000000000000000000000000000000000000000D56C


~22014A00E0C6002
39A150D10

0D27 cell01 3367V
0D29 cell02 3369V
0D2B cell03 3371V
0D29 cell04 3369V
0D28 cell05 3368V
0D29 cell06 3369V
0D2A cell07 3370V
0D28 cell08 3368V
0D28 cell09 3368V
0D29 cell10 3369V
0D28 cell11 3368V
0D2A cell12 3370V
0D29 cell13 3369V
0D2A cell14 3370V
0D28 cell15 3368V
0D26 cell16 3366V

0118 temp 28.0
010E temp 27.0
0118 temp 28.0

0401
0E010E010E010E0285
000000640128CA
252D SoC/Capacity 95.17Ah
0006000000010000000000230000000000000000000000000000000000000000000000D520



That means I have to work with substrings after decoding to ASCII, I guess.

 

[NikArc]

okay, I'm really close now, there are only a few places left to find out

~22014A00E0C600
2710 SoC value 10000%/100
14E5 batt volt 5349mV*10
10 cell count 16

0D13 cell01 3347mV
0D07 cell02 3335mV
0D08 cell03 3336mV
0D0A cell04 3338mV
0D08 cell05 3336mV
0D0E cell06 3342mV
0D07 cell07 3335mV
0D0C cell08 3340mV
0D18 cell09 3352mV
0D1A cell10 3354mV
0D09 cell11 3337mV
0D08 cell12 3336mV
0D07 cell13 3335mV
0D08 cell14 3336mV
0D28 cell15 3368mV
0D23 cell16 3363mV

012C temp 300°C*10
0122 temp 290°C*10
012C temp 300°C*10

04 ?

012C Tmp1 300°C*10
012C Tmp2 300°C*10
0122 Tmp3 290°C*10
0122 Tmp4 290°C*10

FE5C current -420A*100

000000640128CA ?
28CA SoC/capacity 10442mAh/10
00060 ?
0 error state
0 OverVoltage error state
0 error state
000 ?
0 charging states (0, 1, 2, idle, charge, discharge)
0000000000230000000000000000000000000000000000000000000000D56C ? probably error states which are all 0 right now + checksum

 

[DrSolar]

Hi,

Just last week I received the same type of battery as you and will be figuring out this protocol soon, just as you are. Thus far I have found one very useful document. Search for and download this pdf: "PYLON LFP Battery communication protocol - RS485 V2.8 20161216.pdf" It contains the basics of the communications protocol this battery seems to be using including how to decode numbers and compute the necessary checksums.

In addition to reading the current state, cell voltages, etc., I hope I can also read and possibly change settings as well.

Cheers.

 

[Jaxonwood]

okay, I'm really close now, there are only a few places left to find out

~22014A00E0C600
2710 SoC value 10000%/100
14E5 batt volt 5349mV*10
10 cell count 16

0D13 cell01 3347mV
0D07 cell02 3335mV
0D08 cell03 3336mV
0D0A cell04 3338mV
0D08 cell05 3336mV
0D0E cell06 3342mV
0D07 cell07 3335mV
0D0C cell08 3340mV
0D18 cell09 3352mV
0D1A cell10 3354mV
0D09 cell11 3337mV
0D08 cell12 3336mV
0D07 cell13 3335mV
0D08 cell14 3336mV
0D28 cell15 3368mV
0D23 cell16 3363mV

012C temp 300°C*10
0122 temp 290°C*10
012C temp 300°C*10

04 ?

012C Tmp1 300°C*10
012C Tmp2 300°C*10
0122 Tmp3 290°C*10
0122 Tmp4 290°C*10

FE5C current -420A*100

000000640128CA ?
28CA SoC/capacity 10442mAh/10
00060000000 ?
0 charging state (I saw 0, 1, 2)
0000000000230000000000000000000000000000000000000000000000D56C ? probably error states which are all 0 right now

Are you planning to do anything with the data like supply a monitoring app?

 

[NikArc]

@DrSolar I see, I still have one or 2 unknown parts in the information packet from the BMS, maybe it's listed there, I have to check it
It looks like mine is similar to the Pylon protocol, but actually different order and partly different data

@Jaxonwood: currently I have planned nothing like this. Since I use node-red, everything needed is there, you just have to split the data into substrings and you have the values for everything you might need. So I just do this and I'm able to work with the values to charge the battery with my PSU.

 

[kanenas]

Hi,
I also bought one with 48v and 120Ah. The BMS seems to be the same.
I have the software for where some things become visible.
I can sent it to you if you want.

Regards
Kanenas

 

[NikArc]

I have the software, too
but since it runs on windows, I can not use it with my Raspberry Pi

but beside this, do you know more about the settings you can adjust using the software?
I did not play around with it yet because I don't want to f*ck something up :>
I also noticed that some fields are password protected.

 

[kanenas]

The PW from my BMS is 666666. But be carefully with changes.
I am searching for a solution to readout the Parameters. I test the "solaranzeige.de" with a Pylontech Batterie Protokoll but the protocols are not compatible.

After i put the PW i became more Informations in the menu "Help":



And know the big question: If i change the protocol to pylon1363 then maybe then the "solaranzeige.de" software can read the parameters. If that is the case, then it will be possible to read the data via the MQTT server from solaranzeige.de

On the other hand i am afraid that it will be not more possible to have a communication with the own software to change the parameters of the BMS.

I will inform you if i have some news ...
Many Regards

 

[NikArc]

ohh, I will try that password later, can't do it right now

for me it works fine now with node red.
the few missing (or unknown) values are not important for normal use

 

[kanenas]

ohh, I will try that password later, can't do it right now

for me it works fine now with node red.
the few missing (or unknown) values are not important for normal use

I right you the same here: https://forum.drbacke.de/viewtopic.php?t=5510&sid=f05fa9ee9457ecd383db731a0a695fd4&start=30.
With your comments here i use now node red too. I never used bevor and it takes some days to understand how it works and to fount a solution for me. I node red send the data over MQTT to FHEM for automatikaly charge - discharge.
Know it works for me fine too.

 

[dingbsums]

Hello and sorry for digging up this thread. But it seems I have a similar or same battery only without software or cables or a manual.

May I ask what the software is called for the PC? I would also like to get the data into my smarthome later to monitor the akuu somewhat.

 

[kanenas]

Hello and sorry for digging up this thread. But it seems I have a similar or same battery only without software or cables or a manual.

May I ask what the software is called for the PC? I would also like to get the data into my smarthome later to monitor the akuu somewhat.

Hi, I hoppe it helps.
if you need the Code for Node Red, give me a feedback.

PW: 48V_LIFEPO4_BATTERY

Regards

 

[dingbsums]

Hello, thank you very much, I will try it. Thanks to @NikArc I have now also two three data from the battery can read and display them via Node Red.

 

[msawalhi]

Hi, I hoppe it helps.
if you need the Code for Node Red, give me a feedback.

PW: 48V_LIFEPO4_BATTERY

Regards

hello, can you please confirm the password since it doesn't work?
many thanks

 

[kanenas]

hello, can you please confirm the password since it doesn't work?
many thanks

PW it works (48V_LIFEPO4_BATTERY). I used 7-Zip 22.01 ->

7-Zip

 

[kanenas]

Hello, thank you very much, I will try it. Thanks to @NikArc I have now also two three data from the battery can read and display them via Node Red.
View attachment 119637

my Overview: