I have a Vevor EM5500-48 inverter with battery and I would like to get the status of the battery and all available information via Modbus. A modbus connection via Waveshare modbus is realised but I don’t know how to obtain data. Probably via Solax inverter but I don’t know how to coninue. I have received the modbus documentation via Vevor. Can somebody help?
MeatimeI have build the mobus.yaml and also verified with a separate app that my device is communicating. I can define entities but they all are ‘unavalable’.
The main part of modbus .yaml looks like:
- name: modbus_hub
type: tcp
host: 192.168.22.120
port: 502
sensors:
- name: Mains voltage effective value
slave: 1
address: 202 # <- Register address
input_type: input
data_type: int16 # or maybe int16
unit_of_measurement: "V"
scale: 0.1
scan_interval: 5
- name: Mains frequency
slave: 1
address: 203 # <- Register address
input_type: input
data_type: int16 # or maybe int16
unit_of_measurement: "Hz"
scale: 0.01
scan_interval: 5
Can somebody advicewhat to do? The logfile states ‘Pymodbus: modbus_hub: Error: device: 1 address: 202 → Modbus Error: [Input/Output] No response received after 3 retries, continue with next request’
Thanks in advance!
I figured it out. Seems that the registers are no input registers but holding registers!
Example:
- name: modbus_hub
type: tcp
host: 192.168.22.120
port: 502
sensors:
- name: "Mains voltage effective value"
slave: 1
address: 202 # <- Register address
input_type: holding
data_type: int16 # or maybe int16
unit_of_measurement: "V"
scale: 0.1
scan_interval: 5
- name: "Mains frequency"
slave: 1
address: 203 # <- Register address
input_type: holding
data_type: int16 # or maybe int16
unit_of_measurement: "Hz"
scale: 0.01
scan_interval: 5
- name: "Battery percentage"
slave: 1 # <- Device address
address: 229 # <- Register address
input_type: holding
data_type: int16 # or maybe int16
unit_of_measurement: "%"
Hi bosmanrja,
I have the Vevor EM3500-24L model and have the wifi enabled but port 502 doesn’t seem to be open (using nmap from a Linux box on same IP net to test). I have also now tried the Waveshare USB TO RS485 (B) adapter and used a Rj45 cable to connect (pin 1 to B and 2 to A and swapped) to the RS-485 port, but no luck in connecting. I am testing using Galdalf Modbus Wizard to test whether I can get modbus via the USB Waveshare. Any hints?
Hi everyone,
I saw the existing thread regarding Modbus access for the Vevor EM5500/EM6200 hybrid inverters. I contacted Vevor directly and received what appears to be the Chinese communication protocol document (“1号通讯协议”).
Thats the Link Vevor send me: 1号通讯协议
Disclaimer:
The Modbus register map below is derived from an AI-generated translation of the Vevor inverter’s internal communication protocol (‘1号通讯协议’). Due to the nature of automated translation for technical documentation, the accuracy of register definitions, data formats, and error codes cannot be guaranteed. Always cross-reference this data before deploying it in a live system.
Communication Data Format 
During communication, data is sent back in the form of words (WORD - 2 bytes). In each word sent back, the high byte comes first and the low byte comes last. If two words are sent back consecutively (e.g., long integer), the high word comes first and the low word comes last.
| Data Type | Number of Registers | Byte Count | Illustration |
|---|---|---|---|
| Character Type | 1 | 1 | Send back two characters at a time, padded with 0 if necessary. |
| Plastic Surgery | 1 | 2 | Send back in one go, with the high byte first and the low byte last. |
| Long plastic surgery | 2 | 4 | Send back in two words, with the higher word first and the lower word second. |
Frame Format 
Register Content Lookup (Function Code 03H)
The start and end addresses of the query must be the start and end addresses of a complete data block; otherwise, the returned data will be incorrect. For example, if the starting address of the device serial number register is 186 and the length is 12, then the starting address during the query cannot be between 186 and 198, and similarly, the ending address (starting address + number of registers read) cannot fall within this range.
Frame Format Sent by the Host Computer
| Byte Order | Code | Example | Illustration |
|---|---|---|---|
| 0 | Device address | 01H | Device address (1~247) |
| 1 | 03H | 03H | Function code |
| 2 | High byte of start register address | 00H | High 8 bits of register address |
| 3 | Start register address low byte | 10H | Lower 8 bits of register address |
| 4 | Number of registers (high byte) | 00H | High 8 bits of the register count |
| 5 | Number of registers (low byte) | 02H | The lower 8 bits of the register count |
| 6 | CRC16 checksum of high byte | C0H | CRC16 checksum high 8 bits |
| 7 | CRC16 checksum of low byte | CBH | CRC16 checksum low 8 bits |
Frame Format Successfully Parsed and Sent Back by the Lower-Level Machine
| Byte Order | Code | Illustration |
|---|---|---|
| 0 | Device address | Device address (1~247) |
| 1 | 03H | Function code |
| 2 | Number of bytes of data sent back (N) | N = number of requested registers * 2 |
| 3 | The first register data high byte | |
| 4 | The low byte of the first register data | |
| … | … | … |
| N+2 | The high byte of data in the Nth register | |
| N+3 | The low byte of data in the Nth register | |
| N+4 | CRC16 checksum of high byte | All bytes preceding the CRC checksum must be included in the verification. |
| N+5 | CRC16 checksum of low byte |
Lower-Level Machine Parsing Error Feedback Frame Format
| Byte Order | Code | Illustration |
|---|---|---|
| 0 | Device address | Device address (1~247) |
| 1 | 03H | Function code |
| 2 | Number of bytes of data sent back (N) | N = number of requested registers * 2 |
| 3 | The first zero | A total of N zeros were sent back. |
| 4 | The second zero | |
| … | … | … |
| N+2 | The (N-1)th zero | |
| N+3 | The Nth zero | |
| N+4 | CRC16 checksum of high byte | All bytes preceding the CRC checksum must be included in the verification. |
| N+5 | CRC16 checksum of low byte |
Register Read Example:
Read the effective value of the mains voltage (start register 202) to the average value of the mains power, where the mains voltage returns 230.0V, the mains frequency returns 50.0Hz, and the average mains power returns 1200W.
- Host computer:
01 03 00 CA 00 03 25 F5 - Lower-level machine:
01 03 06 08 FC 13 88 04 B0 F7 F3
Register Content Settings (Function Code 10H)
Frame Format Sent by the Host Computer
| Byte Order | Code | Example | Illustration |
|---|---|---|---|
| 0 | Device address | 01H | Device address (1~247) |
| 1 | 10H | 10H | Function code |
| 2 | High byte of start register address | 01H | High 8 bits of register address |
| 3 | Start register address low byte | 10H | Lower 8 bits of register address |
| 4 | Number of registers (high byte) | 00H | The number of registers is always equal to 0 in the high 8 bits. |
| 5 | Number of registers (low byte) | 02H | The lower 8 bits of the register count |
| 6 | Number of bytes to be written (N) | N = number of registers * 2 | |
| 7 | The first register data high byte | ||
| 8 | The low byte of the first register data | ||
| … | … | … | … |
| N+6 | The high byte of data in the Nth register | ||
| N+7 | The low byte of data in the Nth register | ||
| N+8 | CRC16 checksum of high byte | CRC16 checksum high 8 bits | |
| N+9 | CRC16 checksum of low byte | CRC16 checksum low 8 bits |
Frame Format Successfully Parsed and Sent Back by the Lower-Level Machine
| Byte Order | Code | Example | Illustration |
|---|---|---|---|
| 0 | Device address | 01H | Device address (1~247) |
| 1 | 10H | 10H | Function code |
| 2 | High byte of start register address | 01H | High 8 bits of register address |
| 3 | Start register address low byte | 10H | Lower 8 bits of register address |
| 4 | Number of registers (high byte) | 00H | The number of registers is always equal to 0 in the high 8 bits. |
| 5 | Number of registers (low byte) | 02H | The lower 8 bits of the register count |
| 6 | CRC16 checksum of high byte | 41H | CRC16 checksum high 8 bits |
| 7 | CRC16 checksum of low byte | F1H | CRC16 checksum low 8 bits |
Lower-Level Machine Parsing Error Feedback Frame Format
| Byte Order | Code | Illustration |
|---|---|---|
| 0 | Device address | Device address (1~247) |
| 1 | 90H | Function code |
| 2 | Error code | Error code |
| 3 | CRC16 checksum of high byte | CRC16 checksum high 8 bits |
| 4 | CRC16 checksum of low byte | CRC16 checksum low 8 bits |
Error Code Description
| Code | Illustration |
|---|---|
| 01H | The read-only register was manipulated. |
| 03H | Writing data beyond the acceptable range |
| 07H | Registers that cannot be modified in the current operating mode |
Register Write Example:
Set the output voltage (start register 320) to 220V.
- Host computer:
01 10 01 40 00 01 02 08 98 BE 3A - Lower-level machine:
01 10 01 40 00 01 01 E1
Device Register Address 
- R: Indicates readability, meaning it supports the 03H command.
- W: Indicates writeability, meaning it supports the 10H command.
- Int: Integer; Long: Long integer; UInt: Unsigned integer; ULong: Unsigned long integer; ASC: ASCII code.
- Max: Retrieves the maximum value; Min: Retrieves the minimum value.
- All addresses in the table below are represented in decimal.
| Data Name | Unit | Data Format | Starting Address | Number of Registers | Reading and Writing | Remark |
|---|---|---|---|---|---|---|
| Equipment Fault Codes | Long | 100 | 2 | R | The fault codes are 32 bits, with each bit corresponding to a specific fault code. See the fault code table for details. Fault code 1 corresponds to bit 1, fault code 2 corresponds to bit 2, and so on. | |
| Reserved | 102 | 2 | Reserved address | |||
| Obtaining warning codes without masking | 104 | 2 | For details on 32-bit warning codes, please refer to the warning code description. | |||
| Reserved | 106 | 2 | Reserved address | |||
| Get the warning code after blocking | Long | 108 | 2 | R/W | For details on 32-bit warning codes, please refer to the warning code description. | |
| Reserved | 110 | 61 | Reserved address | |||
| Equipment type | UInt | 171 | 1 | R | ||
| Equipment Name | ASC | 172 | 12 | R/W | Device name, written or read in ASCII format | |
| Invalid data | UInt | 184 | 1 | R | Protocol number, this protocol returns 1 | |
| Reserved | 185 | 1 | Reserved address | |||
| Device serial number | ASC | 186 | 12 | R | ||
| Reserved | 198 | 2 | Reserved address | |||
| Invalid data | UInt | 200 | 1 | Internal commands | ||
| Work mode | UInt | 201 | 1 | R | 0: Power-on mode; 1: Standby mode; 2: AC power mode; 3: Off-grid mode; 4: Bypass mode; 5: Charging mode; 6: Fault mode. | |
| Effective value of mains voltage | 0.1v | Int | 202 | 1 | R | |
| Mains frequency | 0.01Hz | Int | 203 | 1 | R | |
| Average mains power | 1w | Int | 204 | 1 | R | |
| Inverter voltage RMS value | 0.1v | Int | 205 | 1 | R | |
| Inverter current RMS value | 0.1A | Int | 206 | 1 | R | |
| Inverter frequency | 0.01Hz | Int | 207 | 1 | R | |
| Average inverter power | 1w | Int | 208 | 1 | R | Positive numbers represent inverter outputs, and negative numbers represent inverter inputs. |
| Inverter charging power | 1w | Int | 209 | 1 | R | |
| Output voltage RMS value | 0.1v | Int | 210 | 1 | R | |
| Output current RMS value | 0.1A | Int | 211 | 1 | R | |
| Output frequency | 0.01Hz | Int | 212 | 1 | R | |
| Output active power | 1w | Int | 213 | 1 | R | |
| Output apparent power | 1VA | Int | 214 | 1 | R | |
| Average battery voltage | 0.1v | Int | 215 | 1 | R | |
| Average battery current | 0.1A | Int | 216 | 1 | R | |
| Average battery power | 1w | Int | 217 | 1 | R | |
| Invalid data | 218 | 1 | Internal commands | |||
| PV voltage average | 0.1v | Int | 219 | 1 | R | |
| Average PV current | 0.1A | Int | 220 | 1 | R | |
| Reserved | 221 | 2 | Reserved address | |||
| Average PV power | 1w | Int | 223 | 1 | R | |
| Average PV charging power | 1w | Int | 224 | 1 | R | |
| load percentage | 1% | Int | 225 | 1 | R | |
| DCDC temperature | 1℃ | Int | 226 | 1 | R | |
| Inverter temperature | 1℃ | Int | 227 | 1 | R | |
| Reserved | 228 | 1 | Reserved address | |||
| Battery percentage | 1% | UInt | 229 | 1 | R | |
| Invalid data | 230 | 1 | Internal commands | |||
| Electricity flow status | UInt | 231 | 1 | R | See the description of the current flag for details. | |
| Battery current filtered average value | 0.1A | Int | 232 | 1 | R | Positive numbers indicate charging, and negative numbers indicate discharging. |
| Average inverter charging current | 0.1A | Int | 233 | 1 | R | |
| Average PV charging current | 0.1A | Int | 234 | 1 | R | |
| Invalid data | 235 | 1 | Internal commands | |||
| Invalid data | 236 | 1 | Internal commands | |||
| Reserved | 237 | 63 | Reserved address | |||
| Output mode | Uint | 300 | 1 | R/W | 0: Single unit; 1: Parallel unit; 2: Three-phase combination - P1; 3: Three-phase combination - P2; 4: Three-phase combination - P3 | |
| Output priority | Uint | 301 | 1 | R/W | 0: Mains - PV - Battery (UTI); 1: PV - Mains - Battery (SOL) [Inverter preferred]; 2: PV - Battery - Mains (SBU); 3: PV - Mains - Battery (SUB) [Mains preferred] | |
| Input voltage range | Uint | 302 | 1 | R/W | 0: APL; 1: UPS; | |
| Buzzer mode | Uint | 303 | 1 | R/W | 0: Mute in all situations; 1: Sounds when the input source changes, or when there is a specific warning or malfunction; 2: Sounds when there is a specific warning or malfunction; 3: Sounds when there is a malfunction; | |
| Reserved | 304 | 1 | R/W | Reserved address | ||
| LCD backlight | Uint | 305 | 1 | R/W | 0: Timed shutdown; 1: Always on; | |
| The LCD automatically returns to the homepage. | Uint | 306 | 1 | R/W | 0: Do not return automatically; 1: Return automatically after 1 minute; | |
| Energy Saving Mode Switch | Uint | 307 | 1 | R/W | 0: Energy saving mode off; 1: Energy saving mode on; | |
| Overload automatic restart | Uint | 308 | 1 | R/W | 0: No restart for overload fault; 1: Automatic restart for overload fault; | |
| Automatic restart when overheating | Uint | 309 | 1 | R/W | 0: No restart for over-temperature fault; 1: Automatic restart for over-temperature fault; | |
| Overload bypass enable | Uint | 310 | 1 | R/W | 0: Disable; 1: Enable; | |
| Reserved | 311 | 2 | Reserved address | |||
| Battery Eq mode enabled | Uint | 313 | 1 | R/W | 0: Disable; 1: Enable; | |
| Warning mask [I] | Long | 314 | 2 | R/W | Warnings with a value of 1 are displayed normally, while warnings with a value of 0 are blocked. | |
| dry contact | Uint | 316 | 1 | R/W | 0: Normal mode; 1: Grounding box mode; | |
| Reserved | 317 | 3 | Reserved address | |||
| Output voltage | 0.1v | Uint | 320 | 1 | R/W | 2200: 220V output; 2300: 230V output; 2400: 240V output; |
| Output frequency | 0.01Hz | Uint | 321 | 1 | R/W | 5000: 50Hz output; 6000: 60Hz output; |
| Battery Type | Uint | 322 | 1 | R/W | 0: AGM; 1: FLD; 2: USER; 3: Li1; 4: Li2; 5: Li3; 6: Li4 | |
| Battery overvoltage protection point [A] | 0.1v | Uint | 323 | 1 | R/W | Range: ( B + 1v * J ) ~ 16.5v * J |
| Maximum charging voltage [B] | 0.1v | Uint | 324 | 1 | R/W | Range: C ~ ( A - 1v) |
| Float charging voltage [C] | 0.1v | Uint | 325 | 1 | R/W | Range: (12v * J ) ~ B |
| Battery discharge recovery point in AC power mode [D] | 0.1v | Uint | 326 | 1 | R/W | Range: ( B - 0.5V * J ) ~ Max(12V * J , E ) Setting it to 0 indicates full recovery. |
| Mains power mode battery low voltage protection point [E] | 0.1v | Uint | 327 | 1 | R/W | Range: Min(14.3v * J , D ) ~ Max(11v * J , F ) |
| Reserved | 328 | 1 | Reserved address | |||
| Off-grid mode battery low voltage protection point [F] | 0.1v | Uint | 329 | 1 | R/W | Range: (10V * J ) ~ Min(13.5V * J , E ) |
| Waiting time for constant voltage to float charging | min | Uint | 330 | 1 | R/W | Range: 1~900min. Setting it to 0 will default to 10min. |
| Battery charging priority | Uint | 331 | 1 | R/W | 0: Mains power priority; 1: PV priority; 2: PV and mains power are of equal priority; 3: Only PV charging is allowed. | |
| Maximum charging current [G] | 0.1A | Uint | 332 | 1 | R/W | Range: Max(10A, H ) ~ 80A |
| Maximum AC charging current [H] | 0.1A | Uint | 333 | 1 | R/W | Range: 2A ~ G |
| Eq charging voltage | 0.1v | Uint | 334 | 1 | R/W | Range: C ~ ( A - 0.5v * J ) |
| bat_eq_time | min | Uint | 335 | 1 | R/W | Range: 0 ~ 900 |
| Eq timed out and exited | min | Uint | 336 | 1 | R/W | Range: 0 ~ 900 |
| Interval between two Eq charges | day | Uint | 337 | 1 | R/W | Range: 1 ~ 90 |
| Automatic mains output enable | Uint | 338 | 1 | R/W | 0: No AC power output without pressing the power button; 1: AC power output will automatically occur even without pressing the power button. | |
| Reserved | 339 | 2 | Reserved address | |||
| Mains power mode battery discharge SOC protection value [K] | 1% | Uint | 341 | 1 | R/W | Range: 5%~96% |
| Mains power mode battery discharge SOC recovery value | 1% | Uint | 342 | 1 | R/W | Range: 10%~100% |
| Off-grid mode battery discharge SOC protection value | 1% | Uint | 343 | 1 | R/W | Range: 0%~Min( K , 95%) |
| Reserved | 344 | 7 | ||||
| Maximum discharge current protection | 1A | Uint | 351 | 1 | R/W | Maximum discharge current protection value in single-machine mode |
| Reserved | 352 | 3 | ||||
| Mains power identification times | Uint | 355 | 1 | R/W | The time required for the machine to detect mains power and then determine that mains power is available. Range: 5 ~ 300 | |
| Lithium battery activation times | Uint | 356 | 1 | R/W | Range: 6 ~ 300 | |
| Lithium battery stops charging SOC | 1% | Uint | 357 | 1 | R/W | After successful communication with the lithium battery, the SOC value is obtained. Charging stops when the set SOC is reached. Range: 20 ~ 100 |
| BMS Follow Mode | Uint | 358 | 1 | R/W | 0: Charging voltage and current do not follow BMS values. 1: CV and Float voltage follow BMS and cannot be set; charging current does not follow BMS. 2: CV, Float voltage, and maximum charging current follow BMS and cannot be set. 3: Charging stops based on the set SOC, not the voltage; charging current does not follow BMS. 4: Charging stops based on the set SOC, not the voltage; maximum charging current follows BMS and cannot be set. | |
| EEPROM maximum charging voltage | 0.1v | Uint | 359 | 1 | R | |
| EEPROM float charge voltage | 0.1v | Uint | 360 | 1 | R | |
| EEPROM maximum charging current | 0.1A | Uint | 361 | 1 | R | |
| Reserved | 362 | 38 | ||||
| Power-on method | Uint | 406 | 1 | R/W | 0: Can be powered on locally or remotely; 1: Can only be powered on locally; 2: Can only be powered on remotely. | |
| Reserved | 407 | 13 | Reserved address | |||
| Remote switch | Uint | 420 | 1 | R/W | 0: Remote shutdown; 1: Remote power on | |
| Invalid data | 421 | 1 | Internal commands | |||
| Reserved | 422 | 3 | Reserved address | |||
| Forced Eq charging | Uint | 425 | 1 | IN | 1: Manually force EQ to charge once. | |
| Exit fault lockout state | Uint | 426 | 1 | IN | 1: Exit fault lockout state (this will only take effect if the machine enters fault mode) | |
| Invalid data | 427 | 1 | Internal commands | |||
| Reserved | 428 | 22 | Reserved address | |||
| Invalid data | 450 | 7 | Internal commands | |||
| Reserved | 457 | 3 | Reserved address | |||
| Clear records | 460 | 1 | IN | 0xAA: Clear operation and fault records (effective in non-offline mode) | ||
| Reset user parameters | 461 | 1 | IN | 0xAA: Restores user parameters to default values (works in non-offline mode) | ||
| Invalid data | 462 | 6 | Internal commands | |||
| Reserved | 468 | 32 | Reserved address | |||
| Invalid data | 500 | 34 | Internal commands | |||
| Reserved | 534 | 66 | Reserved address | |||
| Invalid data | 600 | 34 | Internal commands | |||
| Program version | ASC | 626 | 8 | R | ||
| Reserved | 634 | 7 | Reserved address | |||
| Rated power | In | UInt | 643 | 1 | R | |
| Rated number of battery cells [J] | PCS | UInt | 644 | 1 | R | |
| Reserved | 645 | 55 | Reserved address | |||
| Fault log storage information [K] | Long | 700 | 2 | R | High 16 bits: Position of the latest record; Low 16 bits: Total number of existing fault messages. | |
| Fault Information Query Index [L] | Uint | 702 | 1 | R/W | Set the index for the fault information to be queried, ranging from 0 to the total number of existing fault information entries. | |
| Fault Log [M] | 703 | 26 | R | See the fault log format for details. | ||
| Run log | 729 | 16 | R | See the running log for details. | ||
| Reserved | 745 | 5 | Reserved address |
Fault Code Table 
| Fault Codes | Illustration |
|---|---|
| 1 | Inverter overheating |
| 2 | DCDC overheating |
| 3 | Battery overvoltage |
| 4 | PV overheating |
| 5 | Output short circuit |
| 6 | Inverter overvoltage |
| 7 | Output overload |
| 8 | Busbar overvoltage |
| 9 | Busbar soft start timeout |
| 10 | PV overcurrent |
| 11 | PV overvoltage |
| 12 | Battery overcurrent |
| 13 | Inverter overcurrent |
| 14 | Busbar Low Voltage |
| 15 | Reserve |
| 16 | Inverter DC component too high |
| 17 | Reserve |
| 18 | Output current zero bias is too large |
| 19 | Inverter current zero bias too large |
| 20 | Excessive battery current zero bias |
| 21 | PV current zero bias is too large |
| 22 | Inverter low voltage |
| 23 | Inverter negative power protection |
| 24 | Parallel system main unit lost |
| 25 | Synchronization signal abnormality in parallel system |
| 26 | Battery type incompatible |
| 27 | Parallel version incompatible |
Warning Code Explanation 
System warnings are 32-bit unsigned long integers, with each bit corresponding to a warning. Each bit can also be masked using a warning mask I. If a warning is masked, it will not be read on the LCD or through commands.
Warning Code Table
| Bit | Illustration |
|---|---|
| bit 0 | Mains power zero crossing loss |
| bit 1 | Abnormal mains waveform |
| bit 2 | Mains overvoltage |
| bit 3 | Undervoltage of mains power |
| bit 4 | Overfrequency mains power |
| bit 5 | Mains power frequency |
| bit 6 | PV undervoltage |
| bit 7 | Overheating |
| bit 8 | Low battery voltage |
| bit 9 | Battery not connected |
| bit 10 | Overload |
| bit 11 | Battery Eq charging |
| bit 12 | The battery is discharging at a low voltage and has not yet been charged back to its recovery point. |
| bit 13 | Output power derating |
| bit 14 | Fan stall |
| bit 15 | PV energy is too low to use |
| bit 16 | Parallel communication interrupted |
| bit 17 | Inconsistent single and parallel output modes |
| bit 18 | Excessive voltage difference between parallel batteries |
| bit 19 | Lithium battery communication anomaly |
| bit 20 | Battery discharge current exceeds set value |
| bit 21~31 | Reserve |
Current Symbol Explanation 
Electric current is represented by a 16-bit unsigned integer, and the meaning of each bit is shown in the table below:
Power Flow Table
| Bit | Illustration |
|---|---|
| bit 0~1 | 0: PV not connected to the system; 1: PV connected to the system |
| bit 2~3 | 0: Mains power not connected to the system; 1: Mains power connected to the system. |
| bit 4~5 | 0: Battery neither charging nor discharging; 1: Battery charging; 2: Battery discharging. |
| bit 6~7 | 0: System does not output load; 1: System outputs load. |
| bit 8 | 0: Not charging via AC power; 1: Charging via AC power |
| bit 9 | 0: PV not charging; 1: PV charging |
| bit 10 | 0: Battery icon lit; 1: Battery icon off. |
| bit 11 | 0: PV icon lit; 1: PV icon off. |
| bit 12 | 0: Power icon lit; 1: Power icon off |
| bit 13 | 0: Load icon is on; 1: Load icon is off. |
CRC Check Algorithm 
Parametric model: CRC-16/MODBUS $X^{16} + X^{15} + X^2 + 1$
C code
`Cconst char auchCRCHi = {
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1,
0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1,
0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40,
0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1,
0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40,
0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40,
0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1,
0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40
} ;
const char auchCRCLo = {
0x00, 0xC0, 0xC1, 0x01, 0xC3, 0x03, 0x02, 0xC2, 0xC6, 0x06,
0x07, 0xC7, 0x05, 0xC5, 0xC4, 0x04, 0xCC, 0x0C, 0x0D, 0xCD,
0x0F, 0xCF, 0xCE, 0x0E, 0x0A, 0xCA, 0xCB, 0x0B, 0xC9, 0x09,
0x08, 0xC8, 0xD8, 0x18, 0x19, 0xD9, 0x1B, 0xDB, 0xDA, 0x1A,
0x1E, 0xDE, 0xDF, 0x1F, 0xDD, 0x1D, 0x1C, 0xDC, 0x14, 0xD4,
0xD5, 0x15, 0xD7, 0x17, 0x16, 0xD6, 0xD2, 0x12, 0x13, 0xD3,
0x11, 0xD1, 0xD0, 0x10, 0xF0, 0x30, 0x31, 0xF1, 0x33, 0xF3,
0xF2, 0x32, 0x36, 0xF6, 0xF7, 0x37, 0xF5, 0x35, 0x34, 0xF4,
0x3C, 0xFC, 0xFD, 0x3D, 0xFF, 0x3F, 0x3E, 0xFE, 0xFA, 0x3A,
0x3B, 0xFB, 0x39, 0xF9, 0xF8, 0x38, 0x28, 0xE8, 0xE9, 0x29,
0xEB, 0x2B, 0x2A, 0xEA, 0xEE, 0x2E, 0x2F, 0xEF, 0x2D, 0xED,
0xEC, 0x2C, 0xE4, 0x24, 0x25, 0xE5, 0x27, 0xE7, 0xE6, 0x26,
0x22, 0xE2, 0xE3, 0x23, 0xE1, 0x21, 0x20, 0xE0, 0xA0, 0x60,
0x61, 0xA1, 0x63, 0xA3, 0xA2, 0x62, 0x66, 0xA6, 0xA7, 0x67,
0xA5, 0x65, 0x64, 0xA4, 0x6C, 0xAC, 0xAD, 0x6D, 0xAF, 0x6F,
0x6E, 0xAE, 0xAA, 0x6A, 0x6B, 0xAB, 0x69, 0xA9, 0xA8, 0x68,
0x78, 0xB8, 0xB9, 0x79, 0xBB, 0x7B, 0x7A, 0xBA, 0xBE, 0x7E,
0x7F, 0xBF, 0x7D, 0xBD, 0xBC, 0x7C, 0xB4, 0x74, 0x75, 0xB5,
0x77, 0xB7, 0xB6, 0x76, 0x72, 0xB2, 0xB3, 0x73, 0xB1, 0x71,
0x70, 0xB0, 0x50, 0x90, 0x91, 0x51, 0x93, 0x53, 0x52, 0x92,
0x96, 0x56, 0x57, 0x97, 0x55, 0x95, 0x94, 0x54, 0x9C, 0x5C,
0x5D, 0x9D, 0x5F, 0x9F, 0x9E, 0x5E, 0x5A, 0x9A, 0x9B, 0x5B,
0x99, 0x59, 0x58, 0x98, 0x88, 0x48, 0x49, 0x89, 0x4B, 0x8B,
0x8A, 0x4A, 0x4E, 0x8E, 0x8F, 0x4F, 0x8D, 0x4D, 0x4C, 0x8C,
0x44, 0x84, 0x85, 0x45, 0x87, 0x47, 0x46, 0x86, 0x82, 0x42,
0x43, 0x83, 0x41, 0x81, 0x80, 0x40
} ;
unsigned short sModbusCrc16(INT8U *chMsg, INT16U dataLen)
{
unsigned char ubCRCHi = 0xFF;
unsigned char ubCRCLo = 0xFF;
unsigned char duwIndex;
while ( dataLen – )
{
duwIndex = 0xff&(ubCRCHi ^ *chMsg++);
ubCRCHi = 0xff&(ubCRCLo ^ auchCRCHi[duwIndex]);
ubCRCLo = auchCRCLo[duwIndex];
}
return (ubCRCHi << 8 | ubCRCLo);
}`
I have used Waveshare RS485 to POE Eth.
In Homeassistant I added Modbus interface, line in configuration.yaml:
modbus: !include modbus.yaml
Contents Modbus.yaml:
- name: modbus_hub
type: tcp
host: 192.168.22.120
port: 502
sensors:
- name: "Equipment fault code"
slave: 1
address: 100
input_type: holding
data_type: int32
- name: "Obtain the warning code after shield processing"
slave: 1
address: 108
input_type: holding
data_type: int32
- name: "Device type"
slave: 1
address: 171
input_type: holding
data_type: int16
- name: "Device name"
slave: 1
address: 172
input_type: holding
data_type: string
count: 12
- name: "Device serial number"
slave: 1
address: 186
input_type: holding
data_type: string
count: 12
- name: "Mains voltage effective value"
slave: 1
address: 202
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Mains frequency"
slave: 1
address: 203
input_type: holding
data_type: int16
unit_of_measurement: "Hz"
scale: 0.01
- name: "Average mains power"
slave: 1
address: 204
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Effective value of inverter voltage"
slave: 1
address: 205
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Effective value of inverter current"
slave: 1
address: 206
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Inverter frequency"
slave: 1
address: 207
input_type: holding
data_type: int16
unit_of_measurement: "Hz"
scale: 0.01
- name: "Inverter power average"
slave: 1
address: 208
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Inverter charging power"
slave: 1
address: 209
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Effective value of output voltage"
slave: 1
address: 210
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Effective value of output current"
slave: 1
address: 211
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Output frequency"
slave: 1
address: 212
input_type: holding
data_type: int16
unit_of_measurement: "Hz"
scale: 0.01
- name: "Average battery voltage"
slave: 1
address: 215
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Average battery current"
slave: 1
address: 216
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Average battery power"
slave: 1
address: 217
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Average PV voltage"
slave: 1
address: 219
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Average PV current"
slave: 1
address: 220
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Average PV power"
slave: 1
address: 223
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Average PV Charging power"
slave: 1
address: 224
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Percent of load"
slave: 1
address: 225
input_type: holding
data_type: int16
unit_of_measurement: "%"
scale: 1
- name: "DCDC temperature"
slave: 1
address: 226
input_type: holding
data_type: int16
unit_of_measurement: "⁰C"
scale: 1
- name: "Inverter temperature"
slave: 1
address: 227
input_type: holding
data_type: int16
unit_of_measurement: "⁰C"
scale: 1
- name: "Battery percentage"
slave: 1
address: 229
input_type: holding
data_type: int16
unit_of_measurement: "%"
scale: 1
- name: "Power flow status"
slave: 1
address: 231
input_type: holding
data_type: int16
- name: "Battery current filter average"
slave: 1
address: 232
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Average value of inverter charging current"
slave: 1
address: 233
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Average PV charging current"
slave: 1
address: 234
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Output mode"
slave: 1
address: 300
input_type: holding
data_type: int16
- name: "Output priority"
slave: 1
address: 301
input_type: holding
data_type: int16
- name: "Input voltage range"
slave: 1
address: 302
input_type: holding
data_type: int16
- name: "Buzzer mode"
slave: 1
address: 303
input_type: holding
data_type: int16
- name: "LCD Backlight"
slave: 1
address: 305
input_type: holding
data_type: int16
- name: "LCD automatically returns to the homepage"
slave: 1
address: 306
input_type: holding
data_type: int16
- name: "Energy saving mode switch"
slave: 1
address: 307
input_type: holding
data_type: int16
- name: "Overload automatic restart"
slave: 1
address: 308
input_type: holding
data_type: int16
- name: "Overtemperature automatic restart"
slave: 1
address: 309
input_type: holding
data_type: int16
- name: "Overload bypass enable"
slave: 1
address: 310
input_type: holding
data_type: int16
- name: "Battery Eq mode enable"
slave: 1
address: 313
input_type: holding
data_type: int16
- name: "Warning mask (I)"
slave: 1
address: 314
input_type: holding
data_type: int32
- name: "Dry contact"
slave: 1
address: 316
input_type: holding
data_type: int16
- name: "Output voltage"
slave: 1
address: 320
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Output frequency set"
slave: 1
address: 321
input_type: holding
data_type: int16
unit_of_measurement: "Hz"
scale: 0.01
- name: "Battery type"
slave: 1
address: 322
input_type: holding
data_type: int16
- name: "Battery overvoltage protection point [A]"
slave: 1
address: 323
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "Maximum charge voltage [B]"
slave: 1
address: 324
input_type: holding
data_type: int16
- name: "Maximum charge voltage [C]"
slave: 1
address: 325
input_type: holding
data_type: int16
- name: "Mains mode battery discharge recovery point [D]"
slave: 1
address: 326
input_type: holding
data_type: int16
- name: "Battery low voltage protection point inmains mode [E]"
slave: 1
address: 327
input_type: holding
data_type: int16
- name: "Off-grid mode battery low voltage protection point [F]"
slave: 1
address: 329
input_type: holding
data_type: int16
- name: "Waiting time from constant voltage to floating charge"
slave: 1
address: 330
input_type: holding
data_type: int16
- name: "Battery charging priority"
slave: 1
address: 331
input_type: holding
data_type: int16
- name: "Maximum charge current [G]"
slave: 1
address: 332
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "Maximum mains charging current [H]"
slave: 1
address: 333
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 0.1
- name: "The charging voltage of Eq"
slave: 1
address: 334
input_type: holding
data_type: int16
unit_of_measurement: "V"
scale: 0.1
- name: "bat_eq_time"
slave: 1
address: 335
input_type: holding
data_type: int16
unit_of_measurement: "min"
scale: 1
- name: "EQ timed out"
slave: 1
address: 336
input_type: holding
data_type: int16
unit_of_measurement: "min"
scale: 1
- name: "Two-time EQ charge interval"
slave: 1
address: 337
input_type: holding
data_type: int16
unit_of_measurement: "day"
scale: 1
- name: "Automatic mains output enable"
slave: 1
address: 338
input_type: holding
data_type: int16
- name: "Mains mode battery discharge SOC protectionvalue [K]"
slave: 1
address: 341
input_type: holding
data_type: int16
unit_of_measurement: "%"
scale: 1
- name: "Mains mode battery discharge SOC recovery value"
slave: 1
address: 342
input_type: holding
data_type: int16
unit_of_measurement: "%"
scale: 1
- name: "Battery discharge SOC protection in off-grid mode"
slave: 1
address: 343
input_type: holding
data_type: int16
unit_of_measurement: "%"
scale: 1
- name: "Maximum discharge current protection"
slave: 1
address: 351
input_type: holding
data_type: int16
unit_of_measurement: "A"
scale: 1
- name: "remote switch"
slave: 1
address: 420
input_type: holding
data_type: int16
- name: "Forcing the charge of Eq"
slave: 1
address: 425
input_type: holding
data_type: int16
- name: "Exits the fail-locked state"
slave: 1
address: 426
input_type: holding
data_type: int16
- name: "Program version"
slave: 1
address: 626
input_type: holding
data_type: string
count: 8
- name: "Rated power"
slave: 1
address: 643
input_type: holding
data_type: int16
unit_of_measurement: "W"
scale: 1
- name: "Number of cells [J]"
slave: 1
address: 644
input_type: holding
data_type: int16
unit_of_measurement: "PCS"
scale: 1
- name: "Fault record storage information [K]"
slave: 1
address: 700
input_type: holding
data_type: int32
- name: "Fault information Query Index"
slave: 1
address: 702
input_type: holding
data_type: int16