Reverse engineering the BYD Battery-Box Premium LVS CAN Protocol for Victron Venus OS

On my goal, to build a battery with a Venus OS compatible CAN interface I decided to have a look at he BYD CAN protocol – for several reasons:

1. It is supported with Victron and Venus OS.
2. I happen to have a BYD Battery-Box Premium LVS dual battery system.
3. I heard mixed information about the Pylontech CAN protocol implementation.

So, I got myself a Kvaeser Memorator Light, in order to be able to sniff the CAN traffic between a Venus OS and the BYD BMS. For whatever reason, I did not get it to work, so I ended up with candump – which proved to be more that sufficient for what I needed.

Note: of course, before I started reverse engineering the protocol, I made some effort to find resources and someone who might have already done that – but no luck. However, there were some fragments regarding HVS systems. But they did not seem to be compatible with the LVS implementation.

If you are interested in the result, you can head right here. Otherwise, stay with me and I explain my approach to correlate the identifiers and data pieces.

1. First, I just started candump to check the general message flow and to see some recurring patterns (working/normal operation, UseCase A).
2. I then verified that the communication (which runs at 500kb/s) only consists of 11bit identifiers and no FD frames.
3. I then identified the several message ids based on sender (TX, Venus OS) and receiver (RX, BYD).
4. I then monitored the message flow, when I disconnected the BYB BMS temporarily (UseCase B).
5. And then I monitored the message flow, when there was no BYD BMS present at start and then powered it on (UseCase C).
6. Have alarms and warnings being sent by the BYD BMS (UseCase D). (see note below)

Things to consider:

1. What are the units of the data being sent (e.g. temperature came in Kelvin/K)?
2. What is the byte ordering (e.g for WORDs expect the low byte first and then the high byte)?
3. Is there a scaling on the data being sent (e.g. 1/10mV)?
4. Is information distributed over different messages? Or does one message have a special meaning in correlation to another message? (e.g. cell voltage and temperature)

For most of the parts, I *knew* what data to expect or to look for. I just looked at the BMS device inside the Venus OS and looked for data that matched the information shown on the GUI.

In the end, I identified most of the messages. For alarms and events, I will verify them once I have a working prototype on my ESP32 by simulating and sending them to Venus OS. [Edit: Alarms and Warnings are now identified and described. Events seem to be not supported. With 17 frames/messages I can now setup a complete BYD battery simulation towards a Venus OS.]

Here is a Summary: BYD Battery-Box Premium LVS CAN Protocol. There you find also some image of Venus OS with the correspnding information as shown on the GUI.

Hope you find this useful.