Solax / Pylontech Protocol?

[thoro]

Hi,

I saw you reversed some parts of the G4 Protocol, I do have a X3 G3 with Working Pylontechs and reversed most of the protocol.

https://secondlifestorage.com/index.php?threads/three-phase-hv-hybrid-inverter-solax-x3-hybrid-8-0-solax-triple-power-t58-hv-battery.10747/page-3

Have you got any further details on the protocol? Especially error states that might happen?

The 0x1877 is the most interesting since it should be the BMS Watchdog message.

[70p4z]

The protocol is actually fairly simple and well described by the thread you mentionned. I have a dump of the bridge I made with tparse.

inv >>>     |  0x00001871 e 030617030311140a
inv >>>     |  0x00001871 e 0100010000000000
    >>> inv |  0x0100a001 e 
    >>> inv |  0x00001801 e 0100010000000000
    >>> bms |  0x00001871 e 0100010000000000
bms >>>     |  0x00001872 e 7008cc060000fa00
    >>> inv |  0x00001872 e 7008cc060000fa00
bms >>>     |  0x00001873 e df0700006400c003
    >>> inv |  0x00001873 e df0700006400c003
bms >>>     |  0x00001874 e fa00f00021002100
    >>> inv |  0x00001874 e fa00f00021002100
bms >>>     |  0x00001875 e 3601040001001b00
    >>> inv |  0x00001875 e 3601040001001b00
bms >>>     |  0x00001876 e 0100000000000000
    >>> inv |  0x00001876 e 0100000000000000
bms >>>     |  0x00001877 e 0000000001000205
    >>> inv |  0x00001877 e 0000000052000000

I hope the dump is self explanatory. And you're pretty right with the 0x1877 message being decisive. It indicate the kind of battery. In the example above, I translate the wrong response from pylontech to the expected solax version. I've also found another thread describing deeper the 0x1877:

• https://github.com/rand12345/solax_can_bus/tree/dbc_codegen
• https://secondlifestorage.com/index.php?threads/three-phase-hv-hybrid-inverter-solax-x3-hybrid-8-0-solax-triple-power-t58-hv-battery.10747/post-83930

I hope this would help you fix your problem. Don't hesitate if you need more insights. Cheers,

[thoro]

Thanks for the further links, I actually already found what I was looking for:

https://us.v-cdn.net/6034073/uploads/332AREWTEB0X/can-bus-protocol-pylon-low-voltage-v1-2-20180408.pdf

The message 0x359 has the definitions for byte 0 - 3 which seem to be the same based on my sniffing.

[thoro]

Oh, and I actually am starting to believe that the Pylontech BMS implements multiple protocols, for each of the supported inverter there should be a protocol, and if the inverter sends to a specific address a packet, the BMS locks in on that protocol and communicates over it.

• but haven't tested it

[70p4z]

I agree ; I've seen that it replies in many ways. I've not tested it neither. But I'm pretty sure the pylontech protocol has a widespread adoption in HV inverter as it was kind of first on the field.

Also, about solax x1/g4, I've dug into the pocketwifi frame encoding, and I added an issue to that project https://github.com/xdubx/Solax-Pocket-USB-reverse-engineering/issues/4 Maybe you could find this useful.