S100 map

[Nicknack1234]

So using the information I have used modbus master to dump the first 100 registers.
I will monitor the values throughout the day to generate a proper map. So far I can see register 24 is grid frequency and 6 is grid voltage.
The S100 slave ID is 32 and the value of register 0 is 64 and doesn't seem to change.

[Linux-RISC]

Right, the map is what I need because I haven't got any S100.

If I had the map, I could simulate a S100 using a PLC with a 485 interface and later a Raspberry Pi with a 485.

I also could read these values from a Shelly EM using a RBPi and send them back to the inverter.

[Linux-RISC]

By the way, I'm using diagslave (https://www.modbusdriver.com/diagslave.html) on my RBPi and no success, it seems that the inverter is not requesting for slave 32:

./diagslave -a 32 -b 9600 -p none /dev/ttyUSB0
diagslave 3.4 - FieldTalk(tm) Modbus(R) Diagnostic Slave Simulator
Copyright (c) 2002-2021 proconX Pty Ltd
Visit https://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: Modbus RTU, frame tolerance = 0ms
Slave configuration: address = 32, master activity t/o = 3.00s
Serial port configuration: /dev/ttyUSB0, 9600, 8, 1, none

Server started up successfully.
Listening to network (Ctrl-C to stop)
......................................................................................................................................................................................................................................................................................................................

But if I change the slave number ... What is happening here?
./diagslave -a 254 -b 9600 -p none /dev/ttyUSB0
diagslave 3.4 - FieldTalk(tm) Modbus(R) Diagnostic Slave Simulator
Copyright (c) 2002-2021 proconX Pty Ltd
Visit https://www.modbusdriver.com for Modbus libraries and tools.

Protocol configuration: Modbus RTU, frame tolerance = 0ms
Slave configuration: address = 254, master activity t/o = 3.00s
Serial port configuration: /dev/ttyUSB0, 9600, 8, 1, none

Server started up successfully.
Listening to network (Ctrl-C to stop)
Slave 254: readHoldingRegisters from 64, 1 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 11, 12 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 98, 3 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 120, 1 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
Slave 254: readHoldingRegisters from 357, 8 references
... request for addresses 11, 98, 120 and 357 is repeated.

[Linux-RISC]

After answering the slave 254, a new device appeared, my default language is Spanish. You could check your inverter to generate a proper map. I don't understand why your device is 32 and mine 254, my inverter model is SG5.0RS.

[Nicknack1234]

Yea ok some differences there. SG5D is my inverter, Its ID is 1 and my S100 is definitely 32, There are some different models of smart meter, maybe thats why you are seeing a different ID? I have checked the registers of my S100 that you are seeing and there is nothing there, All of my values are in 0-12.

[Linux-RISC]

Yes, the MODBUS ID changes according to smart meter model. I'm going to try to cheat the inverter.

I found the way to change the language:

[Linux-RISC]

I have cheated the inverter!

I need to know what every MODBUS register is, check some false data:

[Linux-RISC]

Project succeeded!! Please check the documentation to emulate a S100 meter

[lexleite]

Hi. Is there any trick to make diagslave to get the inverter messages? Im trying to see which address my inverter is looking for the meter but i get no response...

[Linux-RISC]

Hi. Is there any trick to make diagslave to get the inverter messages? Im trying to see which address my inverter is looking for the meter but i get no response...

Yes, you can use ./diagslave -a 254 -b 9600 -p none /dev/ttyUSB0 to get the messages from the inverter.

If you need more detailed information, please use cheater.sh instead, it displays the entire request.

I'm still using Sungrow-Meter-cheater to send the power consumption to my SunGrow SG5.0RS :-), so that I obtain the right graph of production vs consumption.

[lexleite]

what i meant is, have you turned off the inverter and turn on to make it query the meter? or with the inverter already on, just by plugging it, makes the inverter detect the meter?

[Linux-RISC]

what i meant is, have you turned off the inverter and turn on to make it query the meter? or with the inverter already on, just by plugging it, makes the inverter detect the meter?

The inverter is always sending requests, just connect the Cheater (or meter) and will be recognized by the inverter.

[lexleite]

I am having issues on detecting the inverter requests. I am not sure if i am connecting the pins correctly or if inverter is not sending the requests at all. Do you know who requests the meter information? Is it the inverter or the dongle?

[Linux-RISC]

My inverter is a SG5.0RS, you should check the documentation of your inverter to check if the procedure is different: "Do you know who requests the meter information? Is it the inverter or the dongle?" --> The inverter, of course, it's a MODBUS master https://github.com/Linux-RISC/Sungrow-Meter-cheater - Connect two wires from COM2 terminals (A2,B2) to 485 adapter terminals (D+,D-). Read the documentation of you inverter, I have used the page 20 of this manual: https://aus.sungrowpower.com/upload/file/20210707/SG2.0-6.0RS-UEN-Ver11-202106.pdf - If you run cheater.sh, you should obtain something like this: answer=FE0310000000D80000000000000000000000D8E0DA (216 W) answering to fe03016400081020 answer=FE0310000000D80000000000000000000000D8E0DA (216 W) answering to fe03016400081020 answer=FE0310000000D80000000000000000000000D8E0DA (216 W) answering to fe03016400081020 answer=FE0310000000D80000000000000000000000D8E0DA (216 W) unknown request fffe030164000810 answering to fe03016400081020 answer=FE0310000000DA0000000000000000000000DA6659 (218 W) answering to fe03016400081020 answer=FE0310000000DB0000000000000000000000DBA518 (219 W) unknown request fffe030164000810 answering to fe03016400081020 answer=FE0310000000DB0000000000000000000000DBA518 (219 W) answering to fe03016400081020 ... - You could use another MODBUS client to get similar results El dom, 15 ene 2023 a las 23:04, lexleite ***@***.***>) escribió:

…

I am having issues on detecting the inverter requests. I am not sure if i am connecting the pins correctly or if inverter is not sending the requests at all. Do you know who requests the meter information? Is it the inverter or the dongle? — Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFBZRZG4AV3ZLJ2KRIBUSVLWSRX5NANCNFSM6AAAAAARAHKN7Y> . You are receiving this because you commented.Message ID: ***@***.***>

[octera]

Have you been able to to further on other register ?
Thanks to your work I'm able to send my current power in register starting 356 to 363 (the answser to register 356+8 register).
For the record the register are build in the following way :
356+357 = Power Phase A, big endian
358+359 = Power Phase B, big endian
360+361 = Power Phase C, big endian
362+363 = Power All Phases , big endian

Now I'm trying to understand registrers :

• 10 +12 : look like to impact the Active energy injected and consumed, but don't get how data are encoded, moreover it look like that not all value are accepted by the system, sometimes I change the value (all set to 0 for instance) and it don't reflect in the mobile app ==> can be OKish to have this kind of behavior for index (it should always increase, never decrease)
• 97 + 3 : wierd to have an odd number of register : not able to understand what is it for
• 119 : ??

Did you have any insight to help me to decypher thoses register ?

For the record, the code I have made in Golang inspired from your bash one :

		var powerB = make([]byte, 4)
		binary.BigEndian.PutUint32(powerB, uint32(gridPower))
		// Copy in first position
		data[1] = powerB[0]
		data[2] = powerB[1]
		data[3] = powerB[2]
		data[4] = powerB[3]
		// Copy in 4th position
		data[13] = powerB[0]
		data[14] = powerB[1]
		data[15] = powerB[2]
		data[16] = powerB[3]

[octera]

@Nicknack1234 could you make a new screenshot of your registers please ? it will help me to understand how the index are increasing.
I will be grateful!
In the same way if you can do the registrer 97, 98, 99 and 119 it will be really great!