First venture into MODBUS, how to send a password?

Since the App is terrible and slow, I have no problem removing the Wi-Fi module. Would have been nice with a direct MQTT output though :)
It seems that the WiFi module and Aqua Temp app may already communicate MQTT to the vendor's cloud server. Many cloud servers have API's that allow other devices and clouds access to the data. On the Home Assistant forums, it seems someone has written a script to do exactly this.

Take a look here:
@jschulze You're completly spot-on.
The Wi-Fi module (mine is a HF-LPB100-0) does use MQTT to communicate with a server (in China). Well spotted!
Using Wireshark I can see that the MQTT Topic is easy, payload needs quite a lot of digging into as it's 210 bytes long.
If I can recirect the traffic to my own MQTT server, then I see possibilities. If I need to query an API in China, I think your Mirius suggestion might be better :)
They have 2 version's of the WiFi module, old V1 and new V2. The Home Assistant scripts is for the new V2 version, and ofcourse we have the V1 version. :(

We are now testing the MQTT from the V1 it is usable.
@jschulze No luck with MQTT so far... :(

Still trying to get something with modbus now.

I can't get any data in modbus slave, I can see in the Communication window there is dat flowing. But can't get is to show...

Also tried pyModSlave. Same result.

So now only data in Simply Modbus slave, and qModMaster. But no sending of commands.

Any thing other to try ?
Or maybe you can directly do some testing with a Teamviewer or similar session. I have connected a standalone Windows PC to it now.
I was able to simulate this successfully and can use the Modbus Slave software to both see broadcasts (register addresses 2001 - 2090) and send data (register addresses 3001 - 3090).

Here is how I have Modbus Slave configured

Perform this test with both the display and WiFi module DISCONNECTED from the network.

You may first want to configure the Slave ID to something other than 1 or 2 (say 3, for example) to confirm that Modbus Slave is successfully receiving the broadcast data in register addresses 2001 - 2090. Then you can change the Slave ID to 1 or 2 so it will send the register values from register addresses 3001 - 3090.

Again, though, you may have to pre-populate the values for the 3001 - 3090 registers with the values that the display would send when the display is connected. Follow my instructions from post #50 to read the data from the display (with only the display connected to your computer).
Again some progress, the modbus slave software works with you settings, I can see data on the 2011 to 2080 registers. But that is on slave id 3. So before setting it to 2 ( instead of the WiFi module ) I wanted to be sure what the other register data I need to put in the slave software.

So I disconnected the datalines of the display, leaving it powered on. I tried to read the 3001 registers and up. The only data it gives is the same as the 2001 register. So the status information of the heatpump. Reading the 1011 register to 1178 works and gives met the settings of the heatpump. On / off, setpoint and so on. So that works also.

So should I put the data from the master readout in the slave software also in register 1011 to 1178 ? As the 3001 and up do not contain any settings of the device. I am not sure what to use where now. Before I destroy the settings of the device with the incorrect registers. I have a backup of the value's now. But then I have to enter everything in the display by hand...

I have added a document with the registers according to the company that build the heatpump. The settings in that list are correct with the 1011 registers I have read from the display with the master software on id 1. I have added those values in the PDF to verify everything.


You may want to capture packets again with IO Ninja while the display is connected to the heat pump and you change settings on the display.

From the captures last time, the heat pump only reads registers 3001 - 3090 from the display. There was never a request from the heat pump to read registers in the 1001-1090 range.

When you were reading the 3001-3090 registers on the display, did you change settings, but no register values changed?
Ok, I mailed the heat-pump guys in China, and it turns out we used the wrong port on the mainboard. It has a dedicated port where the device is simply a slave. So now I can use modbus poll software for example and see and change everything. Turn the pump on or off and so on.

The connection we thought was correct is only used for their own display and wifi module with a strange modbus system.,

I feel a bit stupid I did not see that before / asked them. So @jschulze a BIG thank you for all your time and idea's. We did figure some fun stuff out in this process..... But in the end it was very simple...

Now to get ESPhome configured so is it usable with this pump. But that is a big thing now anymore... :)
Good to know the heat pump has 2 RS-485 ports and that the other RS-485 port is strictly a slave.

1. Please confirm that there is only one and only one RS-485 port on this heat pump.

2. Please confirm that the Wi-Fi access point is connected to a USB/485 dongle which is connected to the one and only one RS-485 port.
I'm guessing this is exactly what David was attempting to figure out way back in post #15
Update after lots of trials and errors: My specific heatpump has an older controller board (PC1002) which only has two RS485 ports. One is connected to display + Wi-Fi module (And seems difficult to interact with), the other seems to be reserved to a frequency converter. If the heater has a newer board, then the CN13 connector acts as a Modbus Slave and can be used to control the heater (Just like @mr_sjappie has found out). I'm currently in dialogue with the supplier to see if my board can be replaced by the new version.

@David_2, @jschulze: Thank you for all your input and suggestions!