Awesome

FoxESS-Canbus-Protocol

FoxESS Canbus Protocol between BMS and H series inverter (extended V1 supporting cell mV and temps)

Can bus @ 500k - all Extended ID, little endian

For the BMS to HV2600 Battery RS485 protocol, see the following repo FoxESS BMS Battery RS485

Basic Protocol

When starting up, the Foxess battery storage system unlike other systems does not have a formal adoption process, the inverter 'polls' the BMS every 1 second and if the BMS responds with a valid message then it is assumed available.

The BMS responds to the inverter polls, but only after it has sent the inverter one copy of the BMS data and all pack data will it close it's contactor and become operational.

The inverter sends a number of different requests with specific time intervals and the BMS responds with the data requested.

Frames

Received frame

0x1871 [0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00]

This is sent by the inverter every 1 second and appears to be the poll for bms_send_pack_statistics.

Response frames (complete pack statistics)

** Note1: FLAGS are binary bits

bits 0,1 & 2 are status, bit 3 set if discharging, bit 4 set if charging, bit 5 is 1 if on-line, bit 7 so far always 0

** Note2: Error Code are binary bits

don't now what all states mean yet, x03 generated when forced pack comms error and contactor dropped out - inverter reports bat volt volt.

** Note3: 0x1877 b6 this is firmware version, the top nibble is major version, bottom nibble is minor version however BMS and packs represent it differently i.e.

for the packs (b7 =10,20,30,40,50,60,70,80) then b6 0x1F = 0001 1111, version is v1.15, and if b6 was 0x20 = 0010 0000 then = v2.0,

for the BMS (b7=01) then convert b6 hex to decimal 0x12 = 018 , and if b6 was 0x14 then = 020

** Note4: 0x1876 cell volts min / max - these appear to be used by the inverter to populate Home Assistant sensors (0x1874 b4-b7 are the BMS cut voltages usually a steady 3,200mV hi/lo)

** Note5: 0x1875 b2 contains status for operational packs (responding) in binary so 01111111 is pack 8 not operational, 11101101 is pack 5 & 2 not operational

** Note6: 0x1876 b0 bit 0 is 1 when maxsoc is observed and/or BMS master instructs charge is not permitted. Charge is permitted if 0. This is a critical safety element for inhibiting battery charging, KH series relies on this bit and ignores 100% SoC limits

** Note7: 0x1877 b0 appears to be an error code, 0x02 when pack is in error

** Note8: 0x1877 b4 defines BMS master modules/battery type, where 0x52 is HV2600 V2 BMS master, 0x82 is HV2600 V1 slave, 0x83 is ECS4100 v1 slave, 0x84 is HV2600 V2 slave

Screenshot

Received frames

0x1871 [0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00]

This is sent 0.5 seconds after the bms_send_pack_statistics appears to be a bms_stop_sending (or an 'ack'), it does not elicit a BMS response

Received frames

0x1871 [0x05, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00]

This is only sent after BMS communications is established (a valid response to a poll request) and occurs 0.5 seconds after the bms_stop_sending message, the BMS responds with BMS and each battery pack serial numbers.

Response frames (pack serial numbers)

repeats up [num_packs]

Received frame

0x1871 [0x01, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00]

This is only sent after BMS communications is established (a valid response to a poll request) and occurs 6 seconds, the BMS responds with the individual battery pack status.

Response frames (individual pack data)

Screenshot

Received frame

0x1871 [0x01, 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00]

0x1871 [0x01, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, 0x00]

These messages are only sent after BMS communications is established (a valid response to a poll request), they are sent together as a pair (100mS apart). They are sent by the inverter every 3 seconds and is the poll message for the bms to send extended data for individual cell data - bms_send_pack_cell_volts and bms_send_pack_cell_temps.

Response frames (cell mv values)

repeats up [144_cells]

then immediately followed by cell temps (decimal 50 offset)

Screenshots

Received frame

0x1871 [0x03, 0x06, 0x17, 0x05, 0x09, 0x09, 0x28, 0x22]

This message is sent by the inverter every '6' seconds (0.5s after the pack serial numbers) and contains a timestamp in bytes 2-7 i.e. <YY>,<MM>,<DD>,<HH>,<mm>,<ss>

.....................

. . . . .

**Disclaimer**: Any information on this wiki is informal advice, and is not supported nor endorsed by FoxESS.
There is no warranty expressed or implied: you take sole responsibility for everything you do with this information and your equipment.
There is no warranty to the accuracy of the content, nor any affiliation, or in any way a connection to FoxESS Co. Ltd