Bluetti AC500/B300S hacking

Some videos of mine  :

Using for home backup in UK

I've been messing around with this system to make it part of an automatic solar  car charger.

One thing needed for this is to get it to tunrn on the AC output when State of Charge (SoC) reaches a certain limit, and turn off at a lower limit.

I found some usful info on https://diysolarforum.com/threads/monitoring-bluetti-systems.37870/

It can be controlled over Bluetooth or Wifi with the Bluetti App, but I'm looking to control it directly, ultimately using an ESP32 based bluetooth device, but for now I found that internally it uses RS485 to communicate between the Bluetooth/Wifi board and the main unit, which is much easier to talk to, and allows sniffing of the Bluetooth data to the Bluetti App.

This is the wifi/Bluetooth board -basically little more than an ESP32 module with RS485 transceiver. Connector is a 3.81mm pluggable terminal block, same at both ends of the cable.

This board acts as a master, periodically sending commands to the main AC500 board to retreive data. I believe the over-the-air protocol is basically the same as the RS485 data, maybe with some wrapping. The AC500 is quite happy to run with this board disconnected. The board lives under the top cover, and is a pain to get to as it needs a lot of disassembly, including use of a hilariously long allen key for the bolts holding the top & bottom case halves together. Fortunately the RS485 connector on the main PCB can be accessed by removing only the back cover (inc. 2 screws under each label)

Connecting this to a PC RS485 interface allows for easier experimentation and reverse-engineering, as well as sniffing the comms to the Bluetti App.
Comms are at 9600 baud,8N1. there is a 16 byte CRC but this doesn't need to be known - commands can copy a fixed CRC sniffed from teh Bluetooth App, and it can  be ignored for received data

I reverse-enineered the protocol by sniffing commands from the Bluetooth App, and observing returned data. most of the data is listed below

Output control commands :

AC On : 01 06 0B BF 00 01 7B CA
AC Off : 01 06 0B BF 00 00 BA 0A
DC On : 01 06 0B C0 00 01 4A 12
DC Off : 01 06 0B C0 00 00 8B D2

The Bluetti App uses five commands to retreive data. The spread of data over the different sommands suggest this interface has had bits added on over time to add features for newer models.