Getting data from inverters via an RS485 connection

I know this post is old but I am in the same boat with a Megarevo inverter and a Solarman wifi data logger.

I am working through trying to get the RS-485 connection working and running into the same issues you were having which is how I found your post.

Would using the pi to control a DPDT relay to break the connection to the data logger when the pi is sending / receiving the data be working solution to prevent the data collisions? I’m sure the opening/ closing of the contacts may make noise though.

Greetings @boydo

I installed a Solis S5-EH1P-6K with pylontech batteries. I’ve been talking to it via modbus. I’m interested in the mysterious registers mentioned in your screenshot, because so far it’s been quite difficult to find a complete list of registers for this inverter!

So far I reverse engineered a few registers, basically anything that can be modified by the onscreen user interface, which means it’s not very interesting. It is also possible to monitor battery SOC and turn the inverter off at night when the battery is discharged, to prevent it from idling and doing nothing useful besides drain the battery further.

In order to control it, I’m trying a different approach, that does not requires knowing anything about modbus registers: spoofing the data between inverter and smartmeter.

At the moment, I have written a simple modbus server using pymodbus, and this pretends to be an Eastron smartmeter. The inverter happily talks to it (via the meter port, not the COM port) and my program replies with fake smartmeter data. Using this method it is possible to control all the useful things: if the fake smartmeter reports that the house is exporting power, Solis will try to absorb it and charge from grid. If it reports the house is importing power, Solis will try to generate that power from solar or batteries. So it is full control over inverter power management, routing, and battery charging/discharging.

I am still waiting for a bunch of USB-RS485 adapters to MITM the smartmeter protocol, that is, put the computer between the smartmeter and the inverter so it can modify smartmeter data then forward it to the inverter. Right now it’s just a test because I only have one RS485 dongle, so my program is just sending fake data. But it seems to be a success.

This method should work with any inverter, not just Solis, and it does not depend on NDA “sign in blood” secret documents, because the smartmeter protocol and registers are usually documented in the smartmeter manual, and in any case the wire is available for tapping, so undocumented stuff has nowhere to hide.

1 Like

Solis COM port RS485 connector:

Exceedcon EC04681-2014-BF

also @slvrsky07

You can’t have more than 1 master on the bus.

Solution:

Put 2 RS485 dongles on your Pi. I recommend Waveshare isolated RS485.

On the dongle connected to the inverter, the Pi is master.

On the dongle connected to the Solis wifi stick, the Pi is slave and pretends to be the inverter.

Therefore it can forward commands from the wifi stick to the inverter, and also forward replies, without collisions. Basically you’re making a proxy.

I think pymodbus can do this by deriving ModbusSlaveContext as in this example: pymodbus/main.py at dev · riptideio/pymodbus · GitHub

I mean the example is a modbus slave that generates test data when queried. So you could replace the test data generation by querying the inverter instead and returning the data. The wifi stick would think it is connected to the inverter directly.

That’s an interesting solution. With using a relay to physically disconnect the 2 masters there still would only be 1 master connected at a time. Not saying it would be the correct way of doing that for communication or not.

A relay should work if you can predict the time when the other master will transmit, or rather when it will not transmit… An analog switch chip would probably be better, due to no bouncing contacts.

@boydo

I received the USB-RS485 interfaces and implemented the smartmeter proxy.

The laptop is connected to the Solis meter port and pretends to be a smartmeter. Using another interface, it queries the actual meter. It forwards the data to the Solis after tampering with it. The laptop will be replaced by an Orange Pi Lite when it arrives.

Solis will try to bring power reported by the meter to zero. So, if I add a constant value to power reported by the meter, Solis adjusts its output power in the other direction. It works absolutely fine and can also be used to control charging from grid. Using this method, export control with two inverters should also work fine. You asked about controlling the inverter, this looks like it’s going to work :wink:

2 Likes

@peufeu Thanks for the update. I gave up on my approach after I managed to brick an inverter due to writing to fixed memory registers which evenly went over the write limit! I did get feedback from Solus directly to say that they where working on making other registers available but this is a wile ago as I have moved onto other projects.

Changing the approach to modify the smart meter data inline sounds interesting and would like to hear more if you can sign-post me. Starting to think about move towards trying out GIvEnergy kit instead as they seem to have a good API which looks promising.

I will post the code, but I need to polish it a bit first (it was written yesterday). I’m testing. Right now I’m using a laptop as the Orange Pi I want to use hasn’t arrived yet. The plan is to use the Pi for low consumption. I’m not currently using any home automation, so this is stand-alone.

I am using one Solis hybrid and one Fronius grid tied inverter. I plan to replace the Fronius with a second Solis hybrid and link them both to the same batteries, which will need some CAN bus hacking. The Fronius is currently located in an inconvenient place, so I will have to pull a bit of wiring through the house to put all the solar stuff in the intended spot.

What do you want to achieve?

Code on github

2 Likes

Hi, do you have the list of registers that are affected by this? I’d like to ensure I don’t hit this same issue of exceeding write limits and bricking the inverter!

hi @pgwg sorry its been a wile since I logged into this forum! Unfortunately I don’t have a list of registers which are in this part of memory.