Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[FR] Voltronic /Axpert Invertors Bluetooth support #293

Open
Saentist opened this issue Dec 31, 2022 · 25 comments
Open

[FR] Voltronic /Axpert Invertors Bluetooth support #293

Saentist opened this issue Dec 31, 2022 · 25 comments

Comments

@Saentist
Copy link
Contributor

Is there any information how to read status over Bluetooth in Voltronics / Axpert and clones
All they are controlled by WatchPower app on android
Mostly all Inverters with this control panel.
image
image

@jblance
Copy link
Owner

jblance commented Jan 8, 2023

Do you have this setup working (with the app)?
Have you logged the bluetooth traffic from the app?

@Saentist
Copy link
Contributor Author

Saentist commented Jan 8, 2023

Do you have this setup working (with the app)? Have you logged the bluetooth traffic from the app?

Yes I have Bluetooth compatible inverter.
But for second part accept any suggestions how to do it.
I can connect to inverter with standard PIN 123456 under Linux/Windows,
but no COM port emulation is enabled on it as on phones.

Guess something as this.
https://support.honeywellaidc.com/s/article/How-to-capture-Bluetooth-traffic-from-and-to-an-Android-Device

@jblance
Copy link
Owner

jblance commented Jan 8, 2023

Yep thats the way - then post the log and/or try to decode it yourself
It takes a lot of trial and error to reverse engineer the ble log, but I am building a new battery at the moment and have a similar inverter, so will take a look once i get it running

@jblance jblance added this to the Improve BLE support milestone Jan 8, 2023
@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

btsnoop_hci(1).zip

Its not so human readable, but ID55355535553555 is inverter

@jblance
Copy link
Owner

jblance commented Jan 9, 2023 via email

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

I try to analyse via Wireshark but no success yet not see values.
capture is made with very low spec android 6 phone (Alcatel Pixi 4)
Will try to make new capture with screen recording,
to be more easy to compare actions and responses.

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

there is some long repeating string in peyload with lenght 671
Event 0x13

806001060002428000000000059cbd357d0000000000000000007776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db9cbd357d0000000000000000007776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db9cbd357d0000000000000000007776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db9cbd357d0000000000000000007776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db9cbd357d0000000000000000007776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db7776db6eedb6dbbbb6db776db6ddddb6dbbb6db6eeedb6dddb6db

guessing by repeating logic can be something as this

806001060002428000000000059
cbd357d000000000000000000
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db9
cbd357d000000000000000000
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db9
cbd357d000000000000000000
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db9
cbd357d000000000000000000
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db9
cbd357d000000000000000000
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db
7776db6eedb6dbbbb6db
776db6ddddb6dbbb6db6eeedb6dddb6db

repeating segments aka possibly not changed setting from report

first 8 symbols are growing ... guess time or timer.

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

one more log with video for comparsion
hci_snoop20230109214525.zip

Video.2023-01-09.22-06-08-1.mp4

@jblance
Copy link
Owner

jblance commented Jan 9, 2023

it looks like an encrypted setup
image
but some info is clearly visible in the trace, eg product info in frame 396 response on handle 0x0017
image
image

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

There is a encryption key after connecting.

@jblance
Copy link
Owner

jblance commented Jan 9, 2023

response on handle 0x001d might have basic info
image
image
image
image

image

@jblance
Copy link
Owner

jblance commented Jan 9, 2023

There is a encryption key after connecting.

yes, but the encryption will make connecting with python harder

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

image

No battery connected to inverter.

adding *0.1 for correct values needed

@jblance
Copy link
Owner

jblance commented Jan 9, 2023

No battery connected to inverter.

yes, just trying to see the same values (after decode) in the log file

@Saentist
Copy link
Contributor Author

Saentist commented Jan 9, 2023

first log have PV voltage, MPPT make it flat ~120Vdc

@jblance
Copy link
Owner

jblance commented Jan 10, 2023

handle 0x0023 rated info
image
image
handle 0x0023
fc08d900fc08f401d90088138813e00101000000

fc08 2300
d900 217
fc08 2300
f401 500
d900 217
8813 5000
8813 5000
e001 480
0100 1
0000 0

@Saentist
Copy link
Contributor Author

0x0023 inverter rated specs
0x0017 firmware versions
0x001a serial number
0x001d ???
0x0020 ???
0x0026 ???
0x0029 ??? only zeros
0x002c ???
0x002f ???
0x0035 ???
0x0038 ??? * small changes
0x003b ??? *
0x003e ??? zeros
0x0042 ???
0x0045 ???
0x0048 ???
0x004b ???

  • respond on value changing in settings.

@Saentist
Copy link
Contributor Author

I try some ble scan tool and this is strange results.
Screenshot_20230111-232045

Screen-20230111-234217-1.mp4

hci_snoop20230109214525 (2).zip
hci_snoop20230109214525 (2)_.zip

sniffing is larger and in two parts

Interesting if inverter s paired via android /not app/ it cannot be scanned

@jblance
Copy link
Owner

jblance commented Jan 11, 2023

Interesting if inverter s paired via android /not app/ it cannot be scanned

Wonder if this the encryption?

I thought the inverter I just got was one of the ble ones, turns out it's just wifi

20230112_114942

@jblance
Copy link
Owner

jblance commented Jan 11, 2023

On the git repo there is a ble-scan.py can you try running that somewhere in range of the inverter (you'll need pip install bleak if you don't have it)

@Saentist
Copy link
Contributor Author

Saentist commented Jan 12, 2023

Yes will try


TI recommend this tool
https://www.ti.com/lit/an/swpa234/swpa234.pdf?ts=1673270553469
https://github.com/Hari-Nagalla/BT-HCI-Logging


Wondering how many time will take to "close source payed monitoring" made from "free software" to monetize your code
Enable donations in repo ;)

@jblance
Copy link
Owner

jblance commented Jan 12, 2023

The log capture is the easy part, the hard bit is figuring out what the data corresponds to.

I don't think there's money in this code. Helpful for some maybe but that about it

@Saentist
Copy link
Contributor Author

ble-scan.py

Can you post link to this file?

@jblance
Copy link
Owner

jblance commented Jan 15, 2023

@DonDavici
Copy link

DonDavici commented Jul 13, 2024

I have an Outback SPC III which looks exactly like the picture in the first post. I figured out how to decode data. My implementation is not ready and I am not good at coding at all. But maybe it helps. I use the code with VenusOS to simulate a Victron Device. For my purposes it works quite well.

https://github.com/DonDavici/OutbackSPC/blob/main/outbackbt.py

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: No status
Development

No branches or pull requests

3 participants