SUN2000-6KTL-L1 Modbus TCP

Hi there,

I would like to get data from my SUN2000-(2KTL-6KTL)-L1 series PV inverter.

I’ve found @Emilv2 HuaweiSolar API but it seems to be to much an effort to get it running with my openhab docker installation.

So i tried to mix it with Reading data from Huawei inverter SUN 2000 (3KTL-10KTL) via modbus RTU, but i can’t even read a single register.

Using QModMaster i can for example read from Address 32090.
I could read with MODBUS Binding from MODRSSIM2.
But not from Inverter.
“Inverter” Thing is showing as Online however…

Bridge modbus:tcp:slave100 "Inverter" [ host="xxx.xxx.xxx.xxx", port=502, id=0 , connectMaxTries=3, reconnectAfterMillis=60000, timeBetweenReconnectMillis=1000] { //Showing as ONLINE
   Bridge poller slave101holding "Inverter Data" [ start=32090, length=2, refresh=10000, type="holding" ]{
        Thing data testvalue [ readStart="32090", readValueType="int16",readTransform="JS(divide1.js)",updateUnchangedValuesEveryMillis="5000000" ]
   }
}

Try 1 out of 3 failed when executing request (ModbusReadRequestBlueprint@139872b0[slaveId=0,functionCode=READ_MULTIPLE_REGISTERS,start=32090,length=1,maxTries=3]). Will try again soon. Error was I/O error, so reseting the connection. Error details: net.wimpi.modbus.ModbusIOException I/O exception: SocketTimeoutException Read timed out [operation ID 18e64bd7-4ba7-48be-86f5-fafb444d6a84]

What might be causing this?
There seems to be no way to increase the timeout in MODBUS Binding for TCP

Just as TCP connections are handled by the host operating system, so is the TCP timeout. Don’t worry about it.

Let’s see the settings you used there.

You’re using one of these dongle thingys to provide the TCP connection?

I’m no expert in Modbus but I have been reading up on it for a future project.

From what I can see, the registers aren’t always addressed by their register number. They sometimes seem to be addressed by an offset from a base address rather than their full address. Are both using Modbus TCP, which is different from Modbus RTU over TCP? OpenHAB only handles the former.

Is there a way to see exactly what QModMaster is sending so you can compare it to the message OpenHAB sends in case one or the other did some sort of translation?

I’ll be following this because I have a similar error trying to read from my Solis inverter but in that case, I’ve yet to prove it can be done even with a test tool.

Small correction: latest versions of openHAB supports rtu over tcp, using the rtuEncoded parameter

I added the parameter rtuEncoded=true, but the result is the same.

Bridge modbus:tcp:slave100 "Inverter" [ host="xxx.xxx.xxx.xxx", port=502, id=0 , rtuEncoded=true, connectMaxTries=3, reconnectAfterMillis=60000, timeBetweenReconnectMillis=1000] { //Showing as ONLINE
   Bridge poller slave101holding "Inverter Data" [ start=32090, length=2, refresh=10000, type="holding" ]{
        Thing data testvalue [ readStart="32090", readValueType="int16",readTransform="JS(divide1.js)",updateUnchangedValuesEveryMillis="5000000" ]
   }
}

Does the modubus binding maybe have problem with id=0?

This is the output when connecting from MODBUS binding with corrected ip and id=1

This is the reading from the SUN2000

1 Like

Thanks, that’s great news as I it looks like I’m going to need that for my next project.

If nothing else is polling the inverter, could you change the ID=1 so that is in the valid range? If something does poll the inverter, can you give it a new address to find the inverter in there so that you can change ID=1?

Why? Are you using the development binding version?
Why? Have you any reason to think anything involved is using RTU over TCP?
You won’t fix this with random guesses.

No, but the Modbus protocol does.
It’s considered a broadcast. The rules say, that slaves may listen to messages addressed to id 0 but you must never respond.
It’s not uncommon for any given device to break the rules, but don’t expect it to work.
A few designs use id=0 as a sort of factory test tool or suchlike.

That’s good. So why not use the same settings in openHAB?

1 Like

I thought it was worth a try. I’ve installed 3.0.2.

It seems no to be possible to change the inverters Modbus TCP id, this was just a test with a simulator.

I would be happy with that, and as it seems to respond to other MODBUS masters i was hoping it would work with MODBUS binding as well.

Let’s go back a step. The SUN2000-(2KTL-6KTL)-L1 has no native TCP capability. But there are optional dongles you can fit for that. Which dongle do you have?

I have no dongle, but i understood from

that it should work without a dongle.
In the same topic they are talking about MODBUS RTU serial connection. So I was hoping to be able to get the needed data without adding a dongle.
Is there maybe a way to bypass the MODBUS Binding limitation to be able to read the data as QModMaster does?

Thanks for highlighting this, I should have emphasised that this might not be included in latest stable releases

Modbus “broadcasts” (using id=0) have been considered before

In essence, you can make broadcasts to id=0 from the binding but may get warnings. (no response expected, of course)
I don’t think the changes needed to handle broadcasts warning-free have been put it place yet, but they would certainly stop you doing what you’re trying to do, use id=0 as ordinary read poll.

I see no reason to break the rules of Modbus protocol for everyone else in order to accommodate one person.
Put it another way, other people have made this device work with no such fiddling. I believe that has been done via connection to the RS-485 serial instead, though.

If your device modbus id=0 and cannot be changed, then it would be broken and useless. So we can figure out from that, that maybe the problem is that you haven’t found out how to change it…

I think you’re already well aware of this -

which seems to boil down to “you can’t change the id from 0 (on the onboard WiFi)”.
It’s quite possible that Huawei deliberately do this to discourage access this way.
Probably related to the onboard WiFi being in AP mode (own SSID) - how have you worked around that?

Background;
From what I can gather, the nnKTL-L1 series comes with an onboard WiFi, but it runs in AP mode (i.e. makes its own wifi network, not joining yours) for use with a proprietary app for setting up etc.
Because that’s a private network, Huawei can use any rules they like - which may be incompatible with a normal network where other systems may exist.

I have updated my tutorial with modbus TCP but you need the Huawei Smart Dongle-WLAN-FE with the latest update.Without a Dongle is possible if you have flashed your router with Tomato or DD wrt software.And make a bridge from the inverters wifi to your local network.

1 Like

I’ve tried to understand what I need to do to get it working with id=0,
but i didn’t …

You are right, but as i can see I’m not the only one who’s problem would be solved with this option!

There are 2 identical inverters in our house, and I would like to read from both.
They are connected / joined to our WiFi, and do also have the AP mode active.

I’ve tried this, but i wasn’t yet able to setup a port forward through OpenWRT.
However, i tried to connect my laptop to the inverter AP and the id is still 0

So the options are:

  1. modbus binding with id=0 (in theory the simplest and preferred option, but i don’t get it to work)
  2. Python script (seems to be much complicated)
  3. install a Ethernet-MODBUS RTU gateway and connect the 2 inverters

I have had a think about this, I’m sure that binding modification to deal with this case will mess things up for other people/systems using Modbus broadcast in the ordinary way. Basically, we can either expect responses or not, but not both.

Huawei need not care about that, because this part is supposed to be private to their products.


Having said all that, you’ve almost certainly got the un-fixed binding version which might well stumble through an exchange with id=0.
I wonder if you’re actually falling down at cross-domain issues, your test software is targetting a funny looking IP.

You’d have to be sure you can change the Modbus id for that to work :crazy_face:, so that they are unique on the one wire, but I don’t think that is a problem for the serial interface side.

I’ve no experience, but would not have thought too difficult using libraries. You only need a gateway function, passing messages to some localhost port to and from the real IP, but with an id fiddle factor. Let the usual binding do the heavy lifting with decoding.

or maybe not, if there was a “switch” parameter to enable/disable this behaviour?

I’ve got the 3.0.2 binding version and i tried to put the 3.1.0 into addons folder (which worked fine before migration to oh3, but now the *.jar file doesn’t seem to be read).

192.168.200.1 is the default inverter accesspoint’s IP, changed one to 192.168.201.1 as i have 2.

I’ve found that option on the installer app, so this should be ok.

i suppose the python script will have the same “problem” with id=0, right?

Retrofitting may or may not work. Pretty sure there are major framework changes from 3.0.2 to current development versions.
What are you hoping to gain here? An older version is more likely to work for you in this situation.

Sure, my point is what’s the IP of your host, are you trying to communicate cross-domain from openHAB?

Well in this imagined script that’s under your control. I would envisage something that simply accepts modbus messages from openHAB binding, substitutes id byte,passes out to network.
And, listens for messages from network for similar treatment before passing to openHAB.

However,now that I think of it, this might ruin any other modbus use you might want in future. I presume your Huawei target port cannot be adjusted, and is the standard port 502, so the script would have to grab that. Forcing the modbus binding to use non-standard port (which it can do) … but not all other devices allow port adjustment either.

Can you please tell how i could get this working and with which version?

I was trying to port forward through OpenWRT to the 2 inverters, but as the id=0 problem is still there, it makes no sense.

I’ve tried to connect through USB-RS485 to the Inverter-Battery-PowerMeter Bus (COM port 3=485B2 and 4=485A2), but I don’t seem to get response from the inverter (set to modbus address 2) 0B=11 is the PowerMeter.


Sometimes the answer comes from 05 which may be the battery.

So i’ll have to go through MODBUS TCP…

If you are trying modbus RTU did you remove the Dongle because they dont work together?