Also, I was thinking about it. @SuperNinja modem id starts with 0xfd R2. @Stephen modem id start with 0xfe R3. You can try @SuperNinja suggestion with @Stephen modem id. In my case, I need a sunny day to test again.
Hello friends, welcome to join,
Yes you got it right, i was on vacation before, now i am back ：）
Let me see what happened recently, maybe I can help you guys
1 Like
Hi @Anson_Guo, hope everything goes well there.
I believe that our information gap is about the protocol for R3. All the hardware is debugged.
We will complete the update of the new monitoring system before April 1. Next, we may cancel the existence of wifi-modem and install the wireless module directly in the inverter, so that consumers will be more convenient. (Currently in new development)
So now I can provide more communication protocol content for your research and discussion. My email is: [email protected]. If you need it, please contact me and let me know from Community
Thank you, there are some differences between the contents of the R2 and R3 protocols. The carriers they use are different (R2 is for computer use and R3 is for mobile phone use). I believe you can analyze them. If you need any help, please tell me 
Yes, you are right. It will be more convenient. You just need to consider the possibility to send the data directly for a private server or computer.
it’s interesting! I was convinced that these 2 form factors were incompatible ?! I was wrong. Sorry.
with my last purchase of HC12, it turned out that they were incompatible. I am interested if you can provide me with one or more HC12s for my tests. That would be great .
Regards
Christian
thank you kindly for the offer - I might take you up on that 
I have a quite a few friends in China stuck at home too. I keep telling not worry- enjoy the free time everything will be back to normal before you know it…
Hi @Anson_Guo, hope everything goes well there.
Summarizing R2 and R3:
R2 format it is clear: F2 code-inverter 65 code-modem, in others words …
F2 xx xx 65 yy yy yy yy
But, what is the format of R3? (my inverters are R3 and my modem is R2…)
Does the HC12 respond if you add another random byte at message end?
F2 40 05 65 fd 08 08 f6 65?
I have tried all these combinations without success.:
$F2$80$55$08$06$40$00$04$A7$65
$F2$40$00$04$A7$80$55$08$06$65
$F2$08$06$40$00$04$A7$65
$F2$80$55$04$A7$80$55$08$06$65
$F2$80$55$08$06$65$40$00$04$A7
$F2$40$00$04$A7$65$80$55$08$06
$F2$08$06$65$40$00$04$A7
$F2$80$55$65$04$A7$80$55$08$06
$F2$80$55$08$06$40$00$04$A7$65$10
$F2$40$00$04$A7$80$55$08$06$65$10
$F2$08$06$40$00$04$A7$65$10
$F2$80$55$04$A7$80$55$08$06$65$10
$F2$80$55$08$06$65$40$00$04$A7$10
$F2$40$00$04$A7$65$80$55$08$06$10
$F2$08$06$65$40$00$04$A7$10
$F2$80$55$65$04$A7$80$55$08$06$10
$F2$80$55$08$06$10$40$00$04$A7$65
$F2$40$00$04$A7$10$80$55$08$06$65
$F2$08$06$10$40$00$04$A7$65
$F2$80$55$04$A7$10$80$55$08$06$65
well got my hc10 simply hooked it up to usbserial and this is the out put from cutecom for wvc1200
[14:51:05:961] %<0x01>z<break>
[14:51:05:961] |<break>
[14:51:05:961] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>><break>
[14:51:09:612] 5<0x01>;<break>
[14:51:09:612] <0x8d><break>
[14:51:09:612] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>U<break>
[14:51:13:115] <0x01>x<break>
[14:51:13:115] |<break>
[14:51:13:115] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>><break>
[14:51:16:765] 6<0x01>;<break>
[14:51:16:765] <0x8d><break>
[14:51:16:765] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>W<break>
[14:51:20:285] <0x12><0x01>v<break>
[14:51:20:285] |<break>
[14:51:20:285] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>><break>
[14:51:23:935] 4<0x01>;<break>
[14:51:23:935] <0x8d><break>
[14:51:23:935] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>[<break>
[14:51:27:471] <0xfd><break>
[14:51:27:471] {<break>
[14:51:27:471] |<break>
[14:51:27:471] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>=<break>
[14:51:31:121] 8<0x01>9<break>
[14:51:31:121] <0x8d><break>
[14:51:31:121] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>X<break>
[14:51:34:640] <0x15><0x01>{<break>
[14:51:34:640] |<break>
[14:51:34:640] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>=<break>
[14:51:38:291] 5<0x01>9<break>
[14:51:38:291] <0x8d><break>
[14:51:38:291] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>Z<break>
[14:51:41:826] <0x06><0x01>y<break>
[14:51:41:826] |<break>
[14:51:41:826] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>=<break>
[14:51:45:461] 4<0x01>:<break>
[14:51:45:461] <0x8c><break>
[14:51:45:461] <0x95><0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84>e<0xfb><0x04><0x11><0x85><0xf2><0xc7><0x84><0x85><0xfb><0x04>X<break>
[14:51:49:001] <0x1a><0x01>}<break>
[14:51:49:001] {<break>
[14:51:49:001] <0x98><0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85><0xf2><0xcb><0x98><0x85><0xfb><0x04>><break>
[14:51:52:629] 5<0x01>9<break>
[14:51:52:629] <0x8c><break>
[14:51:52:629] <0x95><0xfb><0x04><0x11><0x85>
it would seam at the beginning/end of each cycle the modem transmits a "who "
<0x95><0xfb><0x04><0x11><0x85>
then the inverter request ( <0xcb><0x98> or <0xc7><0x84> is the inverter Id – <0xfb><0x04><0x11><0x85> is the modem ID)
<0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85>
then the inverter responds with
<0xf2><0xcb><0x98><0x85><0xfb><0x04>><break>
<0x15><0x01>{<break>
|<break>
<0x98><0xfb><0x04><0x11><0x85>Great!!! But, invertir ID 2 bytes? My invertir R3 has 4 bytes (8 digits)
yes I know. but I was just verifying that it was simply plug and play with hc10 at factory defaults and what the data movement is for sending to the inverter on my newer 1200wvc inverters
<0xf2><0xcb><0x98>e<0xfb><0x04><0x11><0x85>
just need a sample from a newer wvc perhaps @Anson_Guo could provide a sample of the communication between the R3 modem and R3 inverter or just the sample of the R3 modem sending a request to an non existent inverter would suffice…
hi there looking at the response of my inverter and modem it would seam -65- is only a divider between the modem ID and the inverter ID so I would concentrate the effort to keeping it as such
f2 inverterID 65 ModemID ( primary search)
or
f2 modemID 65 inverterID ( secondary search)
just not certain on the lengths of either or whether or not it is reversed (little endian since they used it before) but since Anson said 0000 is put in front for non r3 then it would seam to be the most probably
f2 xx xx xx xx 65 modemID ( undetermined length maybe shorter or longer)
maybe it using mac address length ie xx:xx:xx:xx:xx:xx for the modem since thier new equipment is internet based
@thalesmaia, i test
F2 40 05 65 fd 08 08 f6 65 => no response from inverter !
F2 40 05 65 fd 08 08 f6 => response good from inverter.
Add a random byte after 8 bytes Request message is not good.
Hello everyone,
I am so happy that I found this Thread. I am working on a battery storage with a WVC-300 and therfore I have to deactivate the mpp tracker. Is that also possible by send a massage?
Further i would change the dc-current also by send a massge.
Did anyone do already something like this?
Thanks a lot
René
This is why my brute force is not working. Can you try with delay between words? 1ms, 2ms,…
since the sun is out and the inverter now respond – curious since ( I being calling it hc-10 by mistake). yes added bytes to the modem id or inverter id it will fail to respond on the R2 version so FFFF 0000 are denoter for subroutine for older inverter-- on the newer R3 router- then that could mean the F2 —65 ---- is not valid either as they might of separated the routine
but I see you can send on the R2 – f2 inverterID 65 and it will respond with out a modemID
so you could brute force possibly only using inverterID but to figure out the what the possible F2-----65 could be maybe they use f3 ----65 as people tend to use logical progression