Switchting inverter back ON errors out (SUN2000-30KTL-M3)

[olebowle]

Hi, playing around with the inverter configuration switch.inverter_inverter_on_off I noticed, that I can turn OFF the inverter, but can't turn it ON again. Writing the register 40200 leads to Exception Code: Illegal data address (2).

I got confirmation from another user on the photovoltaikforum.com. Trying to renable the inverter using both the FusionSolar portal and the app will error out in this state. The only way to reenable the inverter is via the local WiFi network of the inverter using the SUN2000 app.

2023-12-29 09:46:03.419 DEBUG (MainThread) [pymodbus.logging] [0]
2023-12-29 09:46:03.420 DEBUG (MainThread) [huawei_solar.huawei_solar] Writing to register startup value [0] on slave 1
2023-12-29 09:46:03.420 DEBUG (MainThread) [pymodbus.logging] [0]
2023-12-29 09:46:03.421 DEBUG (MainThread) [huawei_solar.huawei_solar] Writing to 40200: [0] on slave 1
2023-12-29 09:46:03.421 DEBUG (MainThread) [pymodbus.logging] send: 0x0 0xdb 0x0 0x0 0x0 0x6 0x1 0x6 0x9d 0x8 0x0 0x0
2023-12-29 09:46:03.423 DEBUG (MainThread) [pymodbus.logging] Adding transaction 219
2023-12-29 09:46:03.525 DEBUG (MainThread) [pymodbus.logging] recv: 0x0 0xdb 0x0 0x0 0x0 0x3 0x1 0x86 0x2 old_data:  addr=None
2023-12-29 09:46:03.525 DEBUG (MainThread) [pymodbus.logging] Processing: 0x0 0xdb 0x0 0x0 0x0 0x3 0x1 0x86 0x2
2023-12-29 09:46:03.525 DEBUG (MainThread) [pymodbus.logging] Factory Response[134]
2023-12-29 09:46:03.526 DEBUG (MainThread) [pymodbus.logging] Getting transaction 219
2023-12-29 09:46:03.527 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [546972323264] Failed to write value [0] to register 40200: IllegalAddress
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 238, in handle_call_service
    response = await hass.services.async_call(
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/core.py", line 2067, in async_call
    response_data = await coro
                    ^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/core.py", line 2104, in _execute_service
    return await target(service_call)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/helpers/entity_component.py", line 272, in handle_service
    return await service.entity_service_call(
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 878, in entity_service_call
    single_response = await _handle_entity_call(
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 948, in _handle_entity_call
    result = await task
             ^^^^^^^^^^
  File "/config/custom_components/huawei_solar/switch.py", line 241, in async_turn_on
    await self.bridge.set(rn.STARTUP, 0)
  File "/usr/local/lib/python3.11/site-packages/huawei_solar/bridge.py", line 365, in set
    return await self.client.set(name, value, slave=self.slave_id)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/huawei_solar/huawei_solar.py", line 523, in set
    return await _do_set()
           ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/backoff/_async.py", line 151, in retry
    ret = await target(*args, **kwargs)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/huawei_solar/huawei_solar.py", line 519, in _do_set
    return await self._write_registers(reg.register, builder.to_registers(), slave)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/huawei_solar/huawei_solar.py", line 551, in _write_registers
    raise WriteException(
huawei_solar.exceptions.WriteException: Failed to write value [0] to register 40200: IllegalAddress

Please find attached a corresponding Wireshark dump. I wonder if this is limited to the bigger SUN2000 inverters or affects all of them.

In the latter case it might make sense not exposing the switch, especially since AFAIK one can only reenable the inverter with "physical" access. It took me quite some time to figure out how to get the inverter up and running again.

[wlcrs]

The logic to turn the inverter on and off is not documented very clearly in the documentation:

I have resorted to reverse engineering the app to deduce which values I need to write to the registers mentioned in the documentation:

Apparently, your inverter does not like that 0 value that the integration tries to write to the startup-register. AFAIK, there is no way to detect if the inverter will support this request, so hiding this switch depending on whether the inverter actually supports it is not possible.

Can you wireshark what the app sends to your inverter over WiFi? If you bridge your home network to the inverter wifi network, and make sure to relay messages broadcast to port 6600 to facilitate the inverter discovery logic of the app, you should be able to connect with your smartphone to the inverter with your router in between and sniff the traffic there.

[olebowle]

Interesting, I can certainly do tcpdumps on a network device. Do you mean like:

Inv <-> Switch/AP
    <-> Phone (App)

or like: Inverter <-> Switch/AP <-> Phone (App)

I.e. is the phone still conected to the Inverter SSID or to a fake one with the same name provided by the Switch / AP?

Another possibilty would be using a PCAP app on the phone, like https://f-droid.org/de/packages/com.emanuelef.remote_capture/

Is the traffic between the SUN2000 app and the inverter not end-to-end encrypted? Is the app talking ModbusTCP with the inverter or what kind of protocol is used?

I should be able to try it on the weekend.

[wlcrs]

I've been able to sniff the modbus traffic with the Switch/AP in between the inverter and the phone (so your second scenario).

If you are able to capture traffic on the phone itself with the PCAP app, then that is obviously much simpler. However, I've started to have trouble doing so since my phone upgraded to Android 13. YMMV?

The "device commissioning" part of the FusionSolar app uses ModbusTCP to communicate with the inverter. It mostly uses the documented modbus registers, but I've had to reverse engineer the app to understand some quirks (most importantly the login sequence to gain elevated permissions). That works with a challenge-response system with a salt, so you don't need to worry about your installer password being exposed when you upload a PCAP file.

[olebowle]

I was able to use tcpdump directly via adb on a rooted Android phone. Please find attached a dump for turning the inverter off and another one for turning it on again. Prior to this I changed the installer password to changeme0 in case you want to check your challenge-response algorithm. It looks like there is a write to register 49999 before the actual command.

I did not filter any traffic in the dumps. Let me know if you need anything else. I can provide it on short notice until Monday evening.

[wlcrs]

I've added an explicit heartbeat (=the write to 49999) before attempting to do the write to the inverter.

Can you please test by adapting the version of the huawei-solar library in manifest.json to "2.3.0b1" and restarting your HA? This will install the beta library and allow you to test the new code.

[olebowle]

Thanks for the quick response! Unfortunately that didn't help. Interestingly the fan turned on when I turned off the inverter via HA. I couldn't turn it back on though. It seems to be the same error message. Please find attached the debug log. I just replaced my serial number with SERIALNUM in the log.