Victron Lithium NG on NMEA 2000: reading the Lynx Smart BMS NG PGNs
A Lithium NG bank is easy to see on a chartplotter and surprisingly hard to read from your own code: the batteries don't talk on the network at all, the BMS sends four standard messages, and a GX device may send a second copy under a different instance. This guide goes through what is actually on the wire, byte by byte, with frames you can paste into the CAN frame decoder or a whole log into the log analyzer.
For the system side — wiring, parallel BMSes, and reading the same values over Modbus TCP, MQTT and D-Bus — see the companion guide, Victron Lithium NG and the Lynx Smart BMS NG.
Who is on the bus
Lithium NG batteries connect to the Lynx Smart BMS NG with BMS cables, daisy-chained from battery to battery, not to VE.Can. The BMS has a VE.Can port, which is NMEA 2000-compatible: connect it to a GX device with an RJ45 cable, or to an NMEA 2000 backbone with Victron's VE.Can to NMEA 2000 cable. The GX's CAN-bus profile must be one that includes VE.Can at 250 kbit/s.
So there can be two senders of battery data:
| Sender | What it is | Class / function |
|---|---|---|
| Lynx Smart BMS NG | the BMS's own messages, from its own network address | Electrical Generation / Battery |
| GX device, NMEA2000-out on | a virtual device re-transmitting the system battery | 35 Electrical Generation / 170 Battery, Device and Battery instance 239 |
NMEA2000-out is off by default. When it is on, the GX makes every battery monitor and inverter/charger it knows available on the CAN bus as its own virtual device, each with its own address and instances. The battery selected as the system battery always goes out on instance 239, so the main battery keeps the same instance whether it is a Lynx Smart BMS or a SmartShunt.
Step 1: find the BMS's address
Every NMEA 2000 device announces itself with PGN 60928 ISO Address Claim. Look for Victron's manufacturer code (358) with class 35 and function 170. An example — the unique number is made up, the rest is what a Victron battery device claims:
ID 18EEFF22 priority 6, PGN 60928, from address 0x22, to all
data 34 12 C0 2C 00 AA 46 C0
Decode this frame: manufacturer Victron Energy, device function Battery, device class Electrical Generation. Addresses can change when devices join the network, so track the device by its address claim (unique number and device instance), not by a hard-coded address. PGN 126996 Product Information from the same address carries the model name and firmware as text.
Step 2: Battery Status — PGN 127508
A single 8-byte frame:
| Bytes | Field | Encoding |
|---|---|---|
| 0 | Battery instance | 0–252 |
| 1–2 | Voltage | signed 16-bit, 0.01 V |
| 3–4 | Current | signed 16-bit, 0.1 A |
| 5–6 | Temperature | unsigned 16-bit, 0.01 K |
| 7 | SID | sequence number tying related PGNs together |
ID 19F21422 priority 6, PGN 127508, from 0x22
data 00 55 0A 85 FF 4B 73 01
0x0A55 = 2645 → 26.45 V. 0xFF85 = −123 → −12.3 A (discharging). 0x734B = 29515 → 295.15 K = 22 °C. Decode it. The top of a field's range means "not available": FF 7F in the current field, for example, is 32767, not 3276.7 A.
Step 3: DC Detailed Status — PGN 127506
State of charge, state of health, time remaining and capacity. This PGN is 11 bytes, so it travels as an NMEA 2000 fast-packet in two frames:
19F21222 40 0B 01 00 00 57 64 E0 frame 0: sequence 2, 11 bytes follow
19F21222 41 01 FF FF C8 00 FF FF frame 1
Byte 0 of every frame is a 3-bit sequence counter and a 5-bit frame counter; frame 0 then gives the total length (0x0B = 11). Reassembled, the payload is 01 00 00 57 64 E0 01 FF FF C8 00:
| Bytes | Field | Example |
|---|---|---|
| 0 | SID | 1 |
| 1 | DC instance | 0 |
| 2 | DC type | 0 = Battery |
| 3 | State of charge, % | 0x57 = 87 % |
| 4 | State of health, % | 0x64 = 100 % |
| 5–6 | Time remaining, minutes | 0x01E0 = 480 min = 8 h |
| 7–8 | Ripple voltage, 0.001 V | FF FF = not available |
| 9–10 | Remaining capacity, Ah | 0x00C8 = 200 Ah |
Paste the reassembled payload into the frame decoder, or the two raw frames into the log analyzer, which reassembles fast-packets by PGN, source and sequence.
Step 4: Switch Bank Status — PGN 127501
The BMS reports five states as 2-bit indicators (00 off, 01 on, 11 unavailable):
| Indicator | Lynx Smart BMS NG meaning |
|---|---|
| 1 | Contactor |
| 2 | Alarm |
| 3 | Battery voltage low |
| 4 | Battery voltage high |
| 5 | Programmable relay status |
ID 19F20D22
data 00 01 FD FF FF FF FF FF
Byte 1 0x01 → indicator 1 on, 2–4 off. Byte 2 0xFD = 11 11 11 01 → indicator 5 on, the rest unavailable. So: contactor closed, no alarm, voltage normal, relay on. Decode it.
Instances, and parallel BMSes
- Data instances (Battery instance in 127508, DC instance in 127506) only have to be unique within one device. Victron's GX manual quotes the NMEA 2000 specification: data instances "shall be unique in the same PGNs transmitted by a device" and "shall not be globally unique on the network". Most MFDs and monitoring software tell devices apart by Device instance or by the address-claim NAME instead; Raymarine is the exception that may need unique Data instances, depending on LightHouse version.
- With several Lynx BMSes, each is its own device on the bus sending its own PGNs. The GX groups BMSes that share a VE.Can instance into one virtual battery bank; that bank is part of the GX's own data, not a message from any one BMS.
- The instance 239 copy from the GX is a separate device with its own address. If your software sees "two batteries", check the source address before assuming a wiring fault.
What is not in the PGNs — and VREGs
The four PGNs carry pack voltage, current, temperature, SoC, SoH, time remaining, capacity and five states. Cell voltages, per-battery data, charge-current and charge-voltage limits are not among them; the practical route to those is the GX (see the programmer's section of the companion guide).
Victron devices also carry values that have no standard PGN in proprietary VREG messages on PGN 61184, sent to a node as 0x1CEF<to><from> or broadcast as 0x1CEFFF<from>, starting with Victron's code 66 99. The Lynx Smart BMS NG manual doesn't list which VREGs it answers, so ask: a request for register 0x0FFF (state of charge, 0.01 %) to the BMS at 0x22 from address 0x01 is
ID 1CEF2201
data 66 99 01 00 FF 0F FF FF VREQ (0x0001) for register 0x0FFF, mask 0xFFFF
Decode the request. A device that has the register broadcasts its value; one that doesn't answers to you with ACK code 0x8000, invalid request. Requests and replies are documented in Victron's VE.Can registers document.
Capturing your own frames
Any CAN logger on the VE.Can / NMEA 2000 network at 250 kbit/s will do: a Linux machine with a CAN adapter (candump -l can0), a PCAN-USB with PCAN-View, a Yacht Devices YDWG-02 or an Actisense NGT-1. Open the file in the log analyzer; filter on src34 (0x22 = 34) to see one BMS, or on the PGN number.
Sources
Checked on 25 October 2026:
- Victron Energy — Lynx Smart BMS NG manual, appendix 9.2 "Supported NMEA 2000 PGNs", installation and paralleling Lynx BMSes
- Victron Energy — Cerbo GX manual, "Marine MFD integration by NMEA 2000": NMEA2000-out, virtual devices, classes and functions, instances, system battery on 239
- Victron Energy — VE.Can registers (public): VREG message format, VREQ, VACK, register 0x0FFF
- Victron Energy — Data communication with Victron Energy products: Battery and DC instance numbering, VREGs
- canboat v9.0.0 — field layouts of PGNs 60928, 127501, 127506 and 127508 (the layouts the frame decoder uses)
We are not affiliated with Victron Energy.
Related reading
- Victron Lithium NG and the Lynx Smart BMS NG — wiring, parallel banks, Modbus TCP / MQTT / D-Bus
- Victron inverter/chargers and chargers on NMEA 2000 — AC, charger and inverter PGNs
- MG Energy Systems batteries on NMEA 2000 — the same standard PGNs plus Electric Energy Storage messages
- Motor drives on a Cerbo GX — CANopen and NMEA 2000 e-drives