This register mapping was already developed and exploited earlier. See (https://github.com/joyfulhouse/pylxpweb).
And specifically (https://github.com/joyfulhouse/pylxpweb/blob/c75d6784f663b50c596799bc69585f7a5441c931/src/pylxpweb/registers/battery.py#L116)
GREAT WORK!
These are casual research results for locating generally undisclosed detailed battery data stored in EG4 18KPV Solar-hybrid inverters. The deliverable is a mapping of modbus registers discovered.
The EG4 monitoring center website (https://monitor.eg4electronics.com/) collects and displays data for their branded inverters and batteries operating in closed loop configuration. Data is polled at about 1 minute intervals using a form of modbus/tcp protocol. Much of the status/operating data displayed can be found in publicly released documents describing the modbus register assignments adopted by the manufacturer (Luxpower). At this time, not all register assignments have been found publicly. Of particular interest are the battery pack-level data.
These data are present within the inverter registers, but where and how they are formatted may not have been disclosed. The data are useful for pack management and particularly for optimal inter-pack balancing.
This research describes knowledge developed from a brief examination of communication behavior on a single system. The hope is to facilitate incorporation of these data into private monitoring platforms and aid further work to better complete an understanding of the battery pack-level data.
Only a single inverter has been examined. Firmware version fAAB-2525.
A RJ45 communication module is actively monitored by the eg4 monitor server.
Four identical batteries are monitored in a closed-loop configuration using EG4 protocol by this inverter. The batteries are early EG4 All Weather wall mount models.
FYI-there is another inverter acting as slave sharing these batteries.
Data were collected using wireshark on the local network.
Any additional observations or input will be appreciated and shared. Beyond verifying and finishing out these status words, there possibly may be some control functions implemented though HR registers.
The pack-level data maintained by the inverter are stored in a linear array beginning at IR 5000. There are 30 words allocated to each pack. The first pack data are at IR5000, the next pack at IR5030, and continuing.
Reference the Register Map file for the register assignments known so far
Some battery data have been defined in the Inverter mapping documents. Not verified in this work, but appearing in multiple modbus register map disclosures. See IRs 80-112. This mapping hints that a maximum of 10 parallel battery packs are supported. But, I am skeptical since one of the 10 BMS status registers contains suspicious data.
IR80 (BatComType) = 0 (CAN bus).
IR80 (BatTypeAndBrand) = 6.
IR90 (BatStatus5_BMS) = 0xC0. This seems an anomaly for BMS status. There is no Battery 5, and the 0xC0 appears in an unknown section of the newly mapped IR5000 array.
IR95 may indicate this mapping data exists. In this case, IR95 (BatStatus_INV) = 3.
IR96 may identify how many parallel packs are available in the mapping found here. In this case, IR96 (BattParallelNum) = 4
[EG4 Inverter Mapping](EG4-18kPV-12LV - MODBUS Communication Protocol v2.pdf)
I have only one battery type, and one inverter model. Likely the data include battery model data/identifiers, and different battery firmware versions may generate different data. One expected field is missing - pack temperature. My packs appear to not have functioning PCB thermistors.
Without insignts into the BMS design or internal coding, status and alarm indicators are unknown. There are enough unknown areas within the registers for these important signals to locate. I would expect some cell-level faults, which could be indicated by bits within words. I also expect some pack level status and alarm/fault fields.
Check out the Sunspec Alliance standardization work. Secrets become public disclosure requirement. Modbus and IEEE-1547 certifications. EG4 noted the 1547 certification in a recent inverter firmware update, but there are alternate communication options and comms are only in a later revision.
Model definitions are the disclosure https://github.com/sunspec/models Model 805 most closely matches the data types sought in this research.
Luxpower (claiming for EG4 18KPv-12LV) example of Sunspec Alliance model complete with modbus registers defined: Luxpower Model This model is not the mapping in released 18KPVs I have scanned, and it does not include the battery data mapped here. This model states it applies to firmware version fA1.0 (or FA1.0).
Software for testing https://github.com/sunspec/pysunspec