Growatt BMS Emulator

[csoni]

I’ve seen a couple threads on this but haven’t found a definitive solution, and before I went ahead and did all the research I figured I’d see if anyone came up with this already.

I have a Growatt 12k SPF inverter with a custom battery bank (Tesla modules with the EVTV BMS).

I’m looking to take advantage of the percentage options on the Growatt when it can receive values from a Lithium BMS.

Thus far I’ve found:
Growatt and Lithium batteries use RS485 to communicate.
I found a document from Growatt on their rs485 communication.


I wanted to see if anyone had come up with some code (don’t really care about the language) to talk to one of these inverters over the BMS/RS485 port to send battery metrics to it.

I already have code that pulls the cell/battery voltages from the EVTV BMS so I need to be able to transform that and send it to the Growatt. I can do this myself but haven’t run anything over RS485 before so I figured I’d see if anyone here had something they had used/written that I could build off of.

Thanks!

 

[octal_ip]

I'm interested in doing the same thing. Like you, I've found lots of talk about this but no evidence that anyone has been able to get it working end-to-end yet.

I've done plenty of work with RS485 before so all it should take is some experimentation and time.
I have a SPF 3500 ES as my target, not sure if it uses the same protocol as the 12K?

 

[octal_ip]

A quick update: I've successfully programmed an ESP8266 to retreive data from my BMS (JBD/Overkill) and translate it into emulated Pylon CAN bus messages. The output looks identical to what the inverter would expect when configured with Option 5 - Li and Option 36 - L52.
When I have a moment I'll hook it all up to see how it behaves.

 

[csoni]

I look forward to hearing what you have! I’m using solar-assistant right now and trying to find a usb sniffer to grab the protocol info it’s using to manage the inverter.

 

[octal_ip]

I'm pretty sure they'd be using the MODBUS protocol for that, I used the read registers extensively in one of my other projects.
I've attached the documentation for your reference.

 

[octal_ip]

I've decided to add a TFT display to the project so it's clear what the BMS is reporting to the inverter. With any luck I'll have a bit of time this weekend to start testing with the CAN bus active.

 

[DryZus]

A quick update: I've successfully programmed an ESP8266 to retreive data from my BMS (JBD/Overkill) and translate it into emulated Pylon CAN bus messages. The output looks identical to what the inverter would expect when configured with Option 5 - Li and Option 36 - L52.
When I have a moment I'll hook it all up to see how it behaves.

Have you done anything with the rs485 bms port or just with the can communication? I am also interested in emulating a pylontech battery but via rs485

 

[octal_ip]

I've hit dead-end with the CAN communication. I've completed all the code and hardware to implement it according to the protocol documentation, however the inverter simply won't accept communication over its CAN bus. I've validated the output against other examples of the Pylontech protocol and added a listener to the bus to ensure all the traffic is flowing as it should be in realtime, but no success. The inverter just throws BMS communication faults.

The next logical step is to move on to RS485, however my setup is working quite well without the BMS to inverter communications, so at this stage further investment of time is of questionable value.

There's a good example of the Pylontech RS485 protocol over on Github, along with the protocol documentation: https://github.com/Frankkkkk/python-pylontech

 

[maxx-v0]

Does anybody has real pylon battery?
I have pylon emulator via can and want to add RS485 support to my emulator. I have implemented RS485 protocol, i able to query battery with https://github.com/Frankkkkk/python-pylontech library. I have connected this emulator to voltronic inverter. I see version request for betteries with adresses 52, 42, 32, 22, 21, 02. I send responce but no any reactions from inverter on my responce.
I need to execute these requests on real battery to see real answers.
Requests from inverter:
52 => 7E 30 30 35 32 34 36 34 46 30 30 30 30 46 44 39 35 0D
42 => 7E 30 30 34 32 34 36 34 46 30 30 30 30 46 44 39 36 0D
32 => 7E 30 30 33 32 34 36 34 46 30 30 30 30 46 44 39 37 0D
22 => 7E 30 30 32 32 34 36 34 46 30 30 30 30 46 44 39 38 0D
12 => 7E 30 30 31 32 34 36 34 46 30 30 30 30 46 44 39 39 0D
02 => 7E 30 30 30 32 34 36 34 46 30 30 30 30 46 44 39 41 0D

If somebody has battery you can use Hterm app and just paste 7E..OD line and press enter
If somebody want to test - this project use STM32F407 board now. I am waiting STM32F103C8T6 board from ali to move project to cheapest board.

 

[uksa007]

Does anybody has real pylon battery?
I have pylon emulator via can and want to add RS485 support to my emulator. I have implemented RS485 protocol, i able to query battery with https://github.com/Frankkkkk/python-pylontech library. I have connected this emulator to voltronic inverter. I see version request for betteries with adresses 52, 42, 32, 22, 21, 02. I send responce but no any reactions from inverter on my responce.
I need to execute these requests on real battery to see real answers.
Requests from inverter:
52 => 7E 30 30 35 32 34 36 34 46 30 30 30 30 46 44 39 35 0D
42 => 7E 30 30 34 32 34 36 34 46 30 30 30 30 46 44 39 36 0D
32 => 7E 30 30 33 32 34 36 34 46 30 30 30 30 46 44 39 37 0D
22 => 7E 30 30 32 32 34 36 34 46 30 30 30 30 46 44 39 38 0D
12 => 7E 30 30 31 32 34 36 34 46 30 30 30 30 46 44 39 39 0D
02 => 7E 30 30 30 32 34 36 34 46 30 30 30 30 46 44 39 41 0D

If somebody has battery you can use Hterm app and just paste 7E..OD line and press enter
If somebody want to test - this project use STM32F407 board now. I am waiting STM32F103C8T6 board from ali to move project to cheapest board.

Did find any answers?

I'm see the same thing and sending response as per the specification, but the inverter is not happy and just asking for the same get version from the different group/address.

Receive: <<< 7E:30:30:35:32:34:36:34:46:30:30:30:30:46:44:39:35:0D
Send:    >>> 7E:32:30:30:32:34:36:30:30:30:30:30:30:46:44:42:32:0D
// VER 2.0
// Address 0x02

 

[maxx-v0]

Did find any answers?

I'm see the same thing and sending response as per the specification, but the inverter is not happy and just asking for the same get version from the different group/address.

No, i didn't

 

[uksa007]

No, i didn't

I got it sorted, it was a timing issue, you need to reply quickly(50ms) or it ignores you.

Start: Received new data
<<< 7E:30:30:30:32:34:36:34:46:30:30:30:30:46:44:39:41:0D
>>> 7E:32:30:30:32:34:36:30:30:30:30:30:30:46:44:42:32:0D
Start: Received new data
<<< 7E:32:30:30:32:34:36:36:31:45:30:30:32:30:32:46:44:33:32:0D
Send Pylon System analog data, send static values
>>>7E:32:30:30:32:34:36:30:30:38:30:36:32:43:43:45:32:30:37:44:30:35:36:30:30:30:34:30:30:30:34:36:32:36:32:30:44:45:36:30:30:30:32:30:43:43:30:30:30:30:32:30:42:41:41:30:42:42:37:30:30:30:32:30:42:39:44:30:30:30:32:30:42:41:41:30:42:42:38:30:30:30:32:30:42:39:43:30:30:30:32:30:42:41:41:30:42:42:36:30:30:30:32:30:42:39:45:30:30:30:32:45:38:42:38:0D

See here for more info: https://github.com/Uksa007/esphome-jk-bms-can/discussions/27

 

[G€€RT]

I look forward to hearing what you have! I’m using solar-assistant right now and trying to find a usb sniffer to grab the protocol info it’s using to manage the inverter.

Hi csoni,

Do you have any news on this "Growatt BMS Emulator" project ?

Please keep us up to date.

 

[ee99rsp]

Did you ever get any further in emulating the RS485 link for the BMS?

I have a growatt SP1000 which I hope to connect to a custom build 48V lithium battery running a JBD BMS.
I've logged the RS485 traffic from the inverter in lithium mode (not lead acid) and I got a constant request message every second
00 7F 7E BE FE BE 5D 1E
This doesn't seem to match any of the battery protocols that are documented on the web e.g. pylontech.

It would be useful if anyone could provide the Growatt battery (GBIL5001 or GBIL2701) response to this message so maybe it can be reverse engineered?

Thanks

 

[rthorntn]

For batteries without a BMS with comms, is this able to create a "fake" Canbus BMS to send battery info (perhaps supplied from a SmartShunt via MQTT) to a (GoodWe) inverter?

 

[ee99rsp]

I made a bit of progress on my growatt since the last post to update anyone interested.

It seems my serial sniffing program was showing the wrong bytes before. So I set up an Arduino with RS485 converter on a software serial port, the data I got off of that matches with normal modbus message structure. There is a document on the internet that defines the Growatt BMS registers, if you search 1xSxxP_ESS_protocal_rev_01 you should find it.

Now I can see that the inverter sends a message request :-
>> 01 03 00 10 00 10 45 C3
which is read 16 Holding Registers, starting at 16

I set up some bogus data as on the arduino simulating the BMS using ModbusRTU.h and based on the refernced documment. It sends a responce back
<< 01 03 20 12 C0 00 00 00 12 00 00 86 A0 86 A0 01 01 00 00 00 00 00 01 00 00 00 2F 00 00 00 64 00 00 0F A0

however I get a BMS error 464, so clearly I am sending some bad information, its not easy to interptret the document
The inverter also tries to clear Max. charge bits with this message
>> 01 10 00 13 00 01 02 00 00 A4 F3

any help or advice is appreciated...

 

[ee99rsp]

Just if anyone is interested I purchased a faulty GBLI2701 battery off ebay a while ago and the BMS pcb was working, so I hooked it up to some spare cells to get some comms out of it.

Below is the result. I think the error with my original message was that I didn't add the CRC bytes at the end, doh!

13:57:33.621 [-------->] SEND: 01 03 00 10 00 10 45 C3

13:57:33.733 [<--------] RECV: 01 03 20 00 00 00 00 00 00 00 48 00 00 00 42 13 C4 00 00 00 13 08 98 06 38 09 6E 6A 66 00 2A 03 21 00 00 EC 62

13:57:33.733 [ID: 00024] DONE: Read Holding Registers (code $03)
13:57:33.733 [ID: 00024] PASS: Normal response
13:57:33.749 16 holding registers were processed.
13:57:33.749 Value of holding register 16 is 0 (Gauge IC - Current 0mA)
13:57:33.749 Value of holding register 17 is 0 (Date & Time)
13:57:33.764 Value of holding register 18 is 0 (Date & Time)
13:57:33.764 Value of holding register 19 is 72 (Status)
13:57:33.764 Value of holding register 20 is 0 (Error)
13:57:33.780 Value of holding register 21 is 66 (SOC 66%)
13:57:33.780 Value of holding register 22 is 5060 (Voltage 50.6V)
13:57:33.780 Value of holding register 23 is 0 (Current 0mA)
13:57:33.780 Value of holding register 24 is 19 (temperature 19 ℃)
13:57:33.780 Value of holding register 25 is 2200 (Max. charge Amps)
13:57:33.780 Value of holding register 26 is 1592 (Gauge RM - Remaining capacity 15920mAh)
13:57:33.780 Value of holding register 27 is 2414 (Gauge FCC - full charge capacity = Rated capacity 24140mAh)
13:57:33.796 Value of holding register 28 is 27238 (YW /FW)
13:57:33.796 Value of holding register 29 is 42 (Delta cell voltage 42mV)
13:57:33.796 Value of holding register 30 is 801 (Cycle Count)
13:57:33.796 Value of holding register 31 is 0 (Reserved For Master Box)

 

[Rocker123]

do you have a copy of the PIC firmware? i want to upload it to my GBLI 5001. thanks