Sunamp Heat Battery and ModBus

Have been polling the ModBus on a Sunamp heat battery (phase change material, for domestic hot water), with the hope of reading data from 3 internal temp sensors. Unfortunately Sunamp do not want end users to have this information.

Using ModPoll, we began with RTU and then moved on to ASCii

Unfortunately no response to any combination of baud, parity, bits over all 247 addresses. Believe this totalled some 40k enquiries.

Four other known ModBus devices have all responded positively to same interrogation.

Is there any further methods we can try?

Or to put it another way, if you were designing this product, what hurdles could you put in place so the ModBus would not be reverse engineered?
 
What makes you believe the device uses the Modbus protocol? Does Sunamp state that it supports Modbus?

Based on a quick Google search, it seems like someone has successfully interfaced to a Sunamp heat battery using only the TX and Ground pins (which means it's not Modbus because Modbus requires both TX and RX, since it uses a request/response model). My guess is this device simply broadcasts data periodically on the TX line (perhaps in ASCII text that you could see using a terminal emulator).

http://whatsnormal.org/sunamp-logger/sunamp-logger.html
https://forum.buildhub.org.uk/topic/17260-sunamp-temp-vs-charge/
 
What makes you believe the device uses the Modbus protocol? Does Sunamp state that it supports Modbus?

I haven't heard of anyone yet that has interfaced with ModBus, the word "Modbus" is printed on the PCB with A/B thru holes, a picture of the PCB is on the 2nd link you posted.

Several others have successfully used the serial connection to get the temp data. Unfortunately Sunamp do not support any of these antics.
 
I assume during your tests you connected an RS-485 adapter from a computer to the A and B thru holes on the Sunamp? Did you connect ground?

If the device did support Modbus, it should at least reply with an exception response when the baud rate, parity, and address are correct, even if you are reading data that does not exist. The Chipkin CAS Modbus Scanner is a good tool for this:
https://store.chipkin.com/products/tools/cas-modbus-scanner

While it seems obvious that if a product has Modbus printed on it, it would communicate Modbus, but that may not necessarily be the case. That may only indicate that the designers planned on supporting Modbus eventually (as it is much quicker and easier for a manufacturer to make software changes later rather than change the hardware).
 
Also, note that there is no industry-agreed-upon standard for the polarity of 'A' and 'B' for RS-485, so assuming you're using those thru holes, you may need to try swapping your A and B wires and perform your tests again. Having the polarity swapped does no harm, but communication won't work.
 
I assume during your tests you connected an RS-485 adapter from a computer to the A and B thru holes on the Sunamp? Did you connect ground?
Correct, no ground connected

The Chipkin CAS Modbus Scanner is a good tool for this:
I began with the CAS scanner but found it limiting. No option to alter Parity, bits or RTU/ASCII. Moved onto ModPol with Powershell.

While it seems obvious that if a product has Modbus printed on it, it would communicate Modbus, but that may not necessarily be the case. That may only indicate that the designers planned on supporting Modbus eventually (as it is much quicker and easier for a manufacturer to make software changes later rather than change the hardware).
Yes, I fear this may be the case in this instance.

Also, note that there is no industry-agreed-upon standard for the polarity of 'A' and 'B' for RS-485, so assuming you're using those thru holes, you may need to try swapping your A and B wires and perform your tests again.
Thanks, that is something worth trying
 
Correct, no ground connected
Just in case there was confusion on this, you should connect ground in addition to A and B to make sure a common reference for the RS-485 signals is established. Your RS-485 converter should have a ground (it may be called signal reference, common, ref, etc.) and this should be connected to the Ground terminal on the Sunamp device.
 
There is no obvious place on the Sunamp to connect the ground.

With the 4 other known devices Ive interrogated with my RS-485 converter, ground was not attached to any and all still returned a reply so I dont think it is fundamentally necessary.
 
It appears from the PCB pictures from the previous links that the RS-485 circuitry on the Sunamp is not isolated, therefore, I would connect to "GND" on J8 of the Sunamp for the ground connection.

RS-485 grounding is a much larger topic to cover here, but suffice it to say, yes it may work when not using a ground (assuming the local grounds of the devices are always within 7V of one another), but when you have so many unknowns, why not eliminate a potential issue that is within your control and make a proper ground connection.
 
Top