A simple PHP TCP listener for passive Modbus sniffing.
Usage : report data from a modbus energy meter, used by a Wallbox charger.
Used for troubleshooting WallBox PowerBoost behaviour.
This setup may also be used to sniff Solar inverters - Energy meter combinations
(If you want it faster/easier, see the arduino/C++ script for an ESP8266 that pushes the Current value of the N1-CT that is reported to the wallbox to an MQTT broker)
You will need :
- a Wallbox Pulsar Plus charger
- a power/current meter, in this case the Ineprometering N1-CT
- an Elfin EW11 serial/modbus wifi bridge/converter
- a device able to run PHP
Connections (see image):
Wallbox charger --> 12V power --> Powermeter N1-CT
Wallbox charger --> modbus --> Powermeter N1-CT
modbus --> Elfin EW11
Elfin EW11 -> WIFI Access point ----> PC running PHP tcp listener
A typical home installation has a maximum contracted power, and the corresponding current. A charger may prioritise the regular use over charging, for this it needs to know this maximum.
In this case, with a Wallbox Pulsar plus using PowerBoost, you set the maximum in your wallbox using a (tiny) rotary switch
POSITION 0 1 2 3 4 5 6 7 8 9
MAX CURRENT *PS 6 10 13 16 20 25 32 *PS *PS
E.g. the max contracted power is 5.7KW -----> 5700 WATT / 230 V = 25 Amps ---> setting 6
Using the PowerBoost function, we assume that whenever home appliances use energy, the charger is throttled down or even switched off.
In that case it should show "Waiting for energy"
In order to perform that function, a power meter is connected to the charger via modbus.
The charger polls the meter continuously, and the meter responds to the charger.
The meter measures the current in the whole system, so both the current of the charger AND other users.
Even when using Powerboost with correct settings, the main fuse may trip for various reasons, like clamp misfit, cable losses etc. The charger knows the current that is flowing in the whole system, and the current it charges with, but Wallbox so far does not bother providing that detail in any interface, nor the web interface, nor the mobile app.
This makes debugging a pain. Furthermore the precise algorithm how powerboost responds is not clear from the documentation. In the wallbox the maximum current is set, but only charging POWER (KW) is visible.
It would be so much easier to see this:
| Unit | Charger | Other | Total | Max |
|---|---|---|---|---|
| A | 9.1 |
3.2 |
12.3 |
25 |
| KW | 2.1 |
0.7 |
2.8 |
5.7 |
To read out the total current, you need to sniff the modbus traffic and decode the responses from the meter.
Preparing the charger
- Install charger and power meter according the official instructions and regulations.
- Keep charger switched off
Preparing the EW11
- Power the EW11. Do not use the 12v provided by your charger, this is untested because we have no specs on the max power it can deliver.
- Set the Serial Port parameters to : 9600 8,n,1 , buffer 512, Flow control disable, Protocol settings NONE
- Create a new "Communication profile" : TCP client, server = 192.168.1.40, port 99, route UART (in this case we presume the monitoring device that runs the sniffer has 192.168.1.40 as the IP address)
Starting the listener
- check the IP address in the php code, change it to your local IP address.
- run the PHP script
Connecting the EW11
- power off both charger and EW11
- Connect the EW11 serial lines (A,B) with the modbus lines D+,D-
- Power on the EW11
- Power on the charger
After an initial startup (see mp4, about 90 secs) every second the current measured should be available.
- N1-CT manual : https://ineprometering.com/wp-content/uploads/2022/01/N1-CT-Short-user-manual-V1.03.pdf
- EMS installation manual : https://support.wallbox.com/wp-content/uploads/2022/12/EN_EMS_Installation_Guide_English.pdf
- activating powerboost : https://support.wallbox.com/en/knowledge-base/how-to-activate-power-boost/
- Modbus decoder helper : https://rapidscada.net/modbus/
- Hex converter : https://www.scadacore.com/tools/programming-calculators/online-hex-converter/
- Realterm : easy to send sample hex data via a USB-RS485 for testing.
- Working on mains equipment is dangerous. Don't electrocute yourself. Know the rules.
- Wallbox, Pulsar and PowerBoost are registered names of Wallbox.com. This repo is not affiliated with or endorsed by Wallbox.
- The initial handshake between Wallbox and N1-CT has not been monitored, it probably reads meter ID, sets comm parameters etc. Take a look at the 90 secs mp4 in this repo.
- The modbus traffic analysed here is based on PowerBoost only.
- Please note, firmware updating may just disable your PowerBoost without any notice, and no way you can troubleshoot via app/web.
- Passively sniffing a modbus should not void any warranty.
- For PowerBoost operation, it is not required that the mains voltage is connected to the N1-CT, hence it will not report any voltage or power data, only current.
- The best solution would be that Wallbox.com would push ALL known data to a user settable MQTT broker. Thank you for asking, but no response.
- No modbus checksum validation is performed, so do not rely on the values reported for automation
- In case of trouble check your modbus termination. It depends on the distance between charger and meter.
- Don't be tempted to add another master to the modbus and query the meter next to the charger.
- For a more permanent solution, a dedicated ESP32 with Tasmota running modbusmonitor would be a much better option. See arendst/Tasmota#18618
- If you want to contribute, please help testing the Tasmota variant
- See the arduino script for a simple (quick and dirty) ESP8266 modbus to MQTT bridge
Once steady after bootup of the wallbox, the following data can be observed:
====================
READ Current at register 500A length 02
01 03 50 0A 00 02 F509
Response 4 bytes : 3FA1 6873 => 1.25 Amps
01 03 04 3F A1 68 73 C9 E0
=========================
READ voltage (5000) length 02
01 03 50 00 00 02 D5 0B
RESPONSE 3D8F 5C29
01 03 04 3D 8F 5C 29 3E AA
========================
READ total active energy (6000) length 02
01 03 60 00 00 02 DA 0B
RESPONSE 0000 0000
01 03 04 00 00 00 00 FA 33
========================
READ total active power (5012) length 02
01 03 50 12 00 02 75 0E
RESPONSE 0000 0000
01 03 04 00 00 00 00 FA 33
=========================
READ REVERSE Active energy (6018) length 02
01 03 60 18 00 02 5A 0C
RESPONSE 0000 0000
01 03 04 00 00 00 00 FA 33
=========================