EG4-LL v2 ID1 Modbus Registers

[mwolter]

TL;DR Has anyone done this already and found what these values are or can you help me guess the modbus register descriptions for 30020 through 30036?

Hello Everyone,
My goal is to use an ESP32 to sniff the modbus data from the inverter as well as the comms between the battery and inverter and pass the info to Home Assistant. There's a few reasons for this but mostly to filter and calibrate the values before being sent to Home Assistant and to also remove a Raspberry Pi. Don't need another computer to monitor and maintain. I'll do a nice write up here regarding all this when it's done and working.

Anyway, poked and prodded and found how to passively sniff the communication between an EG4 3000 EHV-48 v2 and an EG4-LL v2. For those unaware, this is the native closed loop communication between the inverter (in battery mode LI 4) and battery (ID 1). I have the values but unfortunately the descriptions are not documented and I have no idea what some of the values are. Searched the forums here, Google and GitHub and didn't find anything.

In case anyone asks, this communication is not documented in EG4-LL Battery MODBUS Protocol between UPS(SMPS) and BMS (Version V01.06). Not sure what they documented there, maybe its for the v1 battery or possibly the communication between batteries when daisy chained.

Here's where I am so far. The logs below are from sigrok-cli and it's the response from the battery to the inverter with real world values. I only have one EG4-LL battery, not sure if these values would be different with additional batteries daisy chained. Every two seconds the inverter sends a request, and the inverter responds with data from registers 19 to 35. The first value is the hex value, the second is converted to decimal and the text after is a description of the value. Any line with a ? is not confirmed or I have no idea.

Any help would be greatly appreciated. Thanks ?

Frame Byte	Register	Hex / Dec Received	Description
0		0x01	Slave ID 1
1		0x03	Function 3
2		0x22	Byte Count 34
3, 4	0x13 / 19	0x0066 / 102	State -- 101 Standby, 102 Charging, 103 Discharging) - UInt16
5, 6	0x14 / 20	0x0000 / 0	?
7, 8	0x15 / 21	0x0047 / 71	SOC - UInt16
9, 10	0x16 / 22	0x1509 / 5385	Volts x 10 - UInt16
11, 12	0x17 / 23	0x0492 / 1170	Current x 10 - Int16
13, 14	0x18 / 24	0x001F / 31	Battery Temp - UInt16
15, 16	0x19 / 25	0x1388 / 5000	?
17, 18	0x1A / 26	0x1BBC / 7100	SOC x 100 - UInt16
19, 20	0x1B / 28	0x2710 / 10000	? Max Charge or Discharge x100 - UInt16
21, 22	0x1C / 28	0x0205 / 517	?
23, 24	0x1D / 29	0x0000 / 0	?
25, 26	0x1E / 30	0x0019 / 25	Cycle Count - UInt16
27, 28	0x1F / 31	0x0000 / 0	?
29, 30	0x20 / 32	0x0000 / 0	?
31, 32	0x21 / 33	0x15E0 / 5600	?
33, 34	0x22 / 34	0x0000 / 0	?
35, 36	0x23 / 35	0x2710 / 10000	? Max Charge or Discharge x100 - UInt16
37, 38		0x36AB	CRC16/Modbus (least significant byte first, actual CRC is 0xAB36)

230817: updated table with latest data

 

[solarhombre]

They come out of the DEYE factory so probably the same register would be my guess. I have a video on connecting up to Home Assistant using an ESP32, that may help you.

OP is about a battery modbus registers, not an inverter.

Btw, @mwolter I reached pretty much the same point as you did (https://diysolarforum.com/threads/eg4-6500-modbus.54210/page-2#post-837069). I would have saved a lot of time if I had found this thread first

I'm waiting for a RS485 T so I can connect the master inverter on one side, the ID1 EG4LLv2 on the other side and a ESP32 in the middle that can sniff the data sent to the inverter. I will also see if its feasible to query the 16 registers at address 113 (see my post linked above) that have the individual cell voltages in mV. The request and reply for these 16 registers has to happen within the ~500ms of idle time between the EG4 6500 inverter and the ID1 battery.