pairing APsystem YC600

[petsch9]

Hi,

Did someone manage to connect/pair with the APsystem YC600 micro omvormer.
They should connect with zigbee but it is not pairing at all.

Any sugestions are welcom.

Kind regards,
Peter

[kadzsol]

Looking for the same information... There is no reset button, powering off/on does not help either. I suspect we have to send a proprietary signal to trigger pairing. Maybe somene with an official ECU-R gateway can do a test and sniff?

[Poquaruse]

Hi all!

Here is what I've found out (with my limited knowledge of Zigbee).

• The inverter is only active when it's powered via DC (e.g. the sun must be shining). AC alone is not enough. This is consistent with what I've read on other forums: the inverter itself is only powered via DC!
• Once the inverter is powered via DC, I see "Link Status" packets on Channel 16. Otherwise the channel is empty. If I'm too far away from the inverter, no packets are received. Therefore, I'm fairly certain that the inverter is the source of these packets.
• In these packets there is a specific PAN ID. I assume that this means that the inverter is trying to join a "private" network. That's why it doesn't join the "normal" zigbee2mqtt network I'm running.

Next steps I'll try:

• Start another instance of zigbee2mqtt using Channel 16 and the specific PAN ID. (Waiting for another 2531 to arrive...)
• Checking if the inverter connects to that network.

[kadzsol]

Nice stuff! Now we are one little step further and seem to understand why some people cannot see any packets. I have read on internet that the YC600 has a zigbee communication range of 10-20m. Also, AP systems has confirmed to someone posting on a forum, that they use a proprietary zigbee protocol. This also seems to be in line with your finding. We have to crack this stuff! I am going to order my own 2531 now :-)

[petsch9]

Great i cant wait

[Poquaruse]

Unfortunately, I had just a few minutes of sunlight left today... But here is what I did.
In the config, I set the following parameters:

advanced: pan_id: 0xae14 # sniffed from the link status packets channel: 16 log_level: debug

The I started zigbee2mqtt and sniffed the traffic using another 2531.

44 185.546362 0x0000 Broadcast ZigBee ZDP 108 Permit Join Request

45 198.038446 Broadcast IEEE 802.15.4 70 Beacon Request

46 198.040590 0x26c7 ZigBee 88 Beacon, Src: 0x26c7, EPID: 03:00:12:11:10:90:ff:ff

And that's about it... Then, the "link status" packets continued. No device joined. :-( What puzzles me a bit is that 0x26c7 responds with a Beacon?! I thought that the device trying to join sends a beacon request and then the coordinator answers with a beacon?!

Any ideas where to go from here?

Tomorrow, I'll try and enable zigbee-herdsman debugging, too.

[Poquaruse]

Apparently, the ECU-R (APSystem device to connect to the inverters) needs the inverters' UID. So perhaps there is some kind of authentication going on there?! See https://youtu.be/3UGMGZRTJQI?t=868

[kadzsol]

My zigbee knowledge is very limited, so I was reading some documentation to jump start my knowledge :-) What I understand is that it is always a zigbee device which is sending beacon requests and coordinator is responding with a beacon frame. If coordinator enables permitjoin and is shown in beacon frame, the device can decide to send association request to coordinator to join the network. So it is always the device who decides which network to join from the available/permitted networks. It seems, that the YC600 decides not to join your network, despite the fact that you coordinator permits it. Feeding in the ID of the inverter in the ECU APP (as shown in the video you have linked) is probably the key, I guess the ID somehow needs to be included in the beacon response frame of the coordinator. When de device recognizes the own ID in the frame, it will join.

[Poquaruse]

With herdsman logging enabled: still no luck. Nothing to see...

What I understand is that it is always a zigbee device which is sending beacon requests and coordinator is responding with a beacon frame.

Yes, that is my understanding, too. However, here we see that the inverter (e.g. NOT the coordinator) seems to respond with a beacon! From the sniffing logs you cannot see which device sent the beacon request, but you can see that the inverter answers immediately.

I too assume that you need to tell the inverter a "secret" (probably related to the UID). I don't have any idea how to accomplish this... A sniff from a successful pairing with a physical ECU-R would be very helpful, I guess...

[kadzsol]

Yes, we have to find someone owning an ECU-R and able to make a sniff. Other option is we do some crowd-funding to buy an ECU-R for testing purposes. It costs around the 200 euro, I would not mind to donate some money if we can crack this thing.

[kadzsol]

There is a German forum out there with people that are also interested in having home brewed solution for the YC600 so I have posted a message there to join our forces: https://knx-user-forum.de/forum/%C3%B6ffentlicher-bereich/knx-eib-forum/diy-do-it-yourself/1409938-pv-micro-inverter-diy-auswertung-m%C3%B6glich

[manoficons]

'franck102' in this discussion
https://community.openenergymonitor.org/t/zigbee-inputs/11166/10
seems to have an ECU device. Perhaps he is willing to help with some sniffing.

[kadzsol]

Thanks for the thread. He seems to have an ECU-C and not an ECU-R. Nevertheless, I have registered there and i am going to post a question about sniffing. An ECU-C sniff might also give some hints for us how to proceed.

[Poquaruse]

That would be great! I guess there isn't much of a difference between the ECU-C and -R when it comes to the zigbee connection.

[manoficons]

ECU-C seems to be the "bigger" device. With swiching output options and more.
https://global.apsystems.com/wp-content/uploads/2018/04/4271801031_APsystems-Energy-Communication-Unit-ECU-C-User-manual_Rev1.5_2018-1-16.pdf

Zigbee section should work in the same way as in ECU-R.

[Poquaruse]

In case somebody who owns an ECU-R (or ECU-C) stumbles across this thread and is willing to help, I'll try to summarize the steps to obtain a successful sniff of the connection between the YC600 and ECU-R...

• Set up a CC2531 for sniffing. See https://www.zigbee2mqtt.io/how_tos/how_to_sniff_zigbee_traffic.html for details. In case the CC2531 has the TI sniffing firmware (instead of the ZBOSS one): TI offers a software to stream the sniffed packets to WireShark.
• Use the APSystems app and remove one inverter from the ECU-C. This should disconnect the inverter from the ZigBee network so that as a next step we can observe the joining process.
• Start sniffing on channel 16. (At least for me, channel 16 seems to be the only channel that the YC600 is sending Link Status packets on...)
• Re-add the inverter to the ECU-C using its UID.
• Check that the inverter has successfully been added in the app.
• Wait until values show up in the app. (So now we know for sure that the inverter is back in the ZigBee network.)
• Stop the sniffing process and export/save the PCAP file.
• Upload the PCAP file here for dissecting. :-) (Please be aware that the ZigBee key is -- hopefully -- included in the PCAP file...) It would also be very helpful to know the entered UID so that we can check how it is used to authenticate.

To anybody who is willing to help: Thanks a lot in advance!

[samr037]

I'd like to order it from some trustworthy website like Amazon, opening it without leaving any marks, sniff the trafic, and then ship it back ;). Amazon doesn't have it, only PV retailers, but there's shipping costs and they're not very clear about return policies...

[manoficons]

Some statement from the manufacturer (not very useful)
https://community.smartthings.com/t/apsystems-yc600-microinverter-monitored-by-the-samsung-hub/166100

[manoficons]

One more guy having the ECU-R and wants to use zigbee connection
https://domoticz.com/forum/viewtopic.php?f=28&t=22368&start=140

[kadzsol]

One more guy having the ECU-R and wants to use zigbee connection
https://domoticz.com/forum/viewtopic.php?f=28&t=22368&start=140

Thanks for the info. Registered there and posted a message :-)

[kadzsol]

I'd like to order it from some trustworthy website like Amazon, opening it without leaving any marks, sniff the trafic, and then ship it back ;). Amazon doesn't have it, only PV retailers, but there's shipping costs and they're not very clear about return policies...

Creative :-) Let us hope someone out there with an ECU will voluntair to make a sniff. If no, I do nnot mind to help with the shipping costs.

[iboot700]

One more guy having the ECU-R and wants to use zigbee connection
https://domoticz.com/forum/viewtopic.php?f=28&t=22368&start=140

Thanks for the info. Registered there and posted a message :-)

And there I am...

Hope I can help out, I have a CC2531 available and the ECU-R paired with a YC600 and QS1. I’ll try the procedure above to sniff the traffic and post the results here. Might take a few days.

[kadzsol]

Great, thx!

[Poquaruse]

I’ll try the procedure above to sniff the traffic and post the results here. Might take a few days.

Great, thank you very much! Let us know if any problems arise during logging where we might be able to help!

[boons605]

One of my friends has a bunch of YC600's and en ECU-R. I've only got 4 YC600's, but I do have a CC2531 stick with sniffer firmware. We're planning to sniff next weekend (2020-10-03, CEST time zone, looking at how much of a morning person I am, I'd say in the afternoon).

[kadzsol]

Great, I cannot wait!

[petsch9]

Great, I can not wait either.

[iboot700]

In case somebody who owns an ECU-R (or ECU-C) stumbles across this thread and is willing to help, I'll try to summarize the steps to obtain a successful sniff of the connection between the YC600 and ECU-R...

* Set up a CC2531 for sniffing. See https://www.zigbee2mqtt.io/how_tos/how_to_sniff_zigbee_traffic.html for details. In case the CC2531 has the TI sniffing firmware (instead of the ZBOSS one): TI offers a software to stream the sniffed packets to WireShark.

* Use the APSystems app and remove one inverter from the ECU-C. This should disconnect the inverter from the ZigBee network so that as a next step we can observe the joining process.

* Start sniffing on channel 16. (At least for me, channel 16 seems to be the only channel that the YC600 is sending Link Status packets on...)

* Re-add the inverter to the ECU-C using its UID.

* Check that the inverter has successfully been added in the app.

* Wait until values show up in the app. (So now we know for sure that the inverter is back in the ZigBee network.)

* Stop the sniffing process and export/save the PCAP file.

* Upload the PCAP file here for dissecting. :-) (Please be aware that the ZigBee key is -- hopefully -- included in the PCAP file...) It would also be very helpful to know the entered UID so that we can check how it is used to authenticate.

To anybody who is willing to help: Thanks a lot in advance!

I gave it a try tonight but I'm not sure I've succeeded. I've not been able to find the Zigbee key. Removing the inverter is easy but to add it again I had to power cycle the ECU and inverters to get the process to 100% but still the automatic system check in the app fails. As it is dark right now I'm not able to check if the inverter is back in the network, I'll try tomorrow if it is light.

Anyhow, I've attached the file so you can have a look. If there is anything interesting in there it is probably around line 327, here the connection process was finished according to the app.

YC600_zigbee.zip

[kadzsol]

Thanks a lot! Let us see what we can learn from this sniff.

[krikk]

please be aware that the yc600 is powered from dc, so it is only working when you have enough sun... (no sniffing at night )

[kadzsol]

I went through the sniff but could not find anything from the YC600 (similar like "46 198.040590 0x26c7 ZigBee 88 Beacon, Src: 0x26c7, EPID: 03:00:12:11:10:90:ff:ff"). Maybe it was not powered any more (no sun)?

[nlienard]

what is the zigbee command to retreive the APS Inverter Firmware version (ex for a DS3L) ? thks

[PLCHome]

U Ma s Öhgwzun ymw na mt ist ein

[mi-hol]

You may use the latest cc2531 firmware available in this thread.

@kadzsol Thank you so much for this firmware to connect to APSystems inverters.
Due to the performance related comments on your repository for cc2530 I'd like to buy a more powerful & future proof hardware for a fresh start (related is patience4711/RPI-APS-inverters#73).
Unfortunately I'm unclear if changes specific to APSystems inverters have been applied to the forked source repository.
Could you please shed some light on this topic?

[kadzsol]

@mi-hol > > You may use the latest cc2531 firmware available in this thread.

@kadzsol Thank you so much for this firmware to connect to APSystems inverters. Due to the performance related comments on your repository for cc2530 I'd like to buy a more powerful & future proof hardware for a fresh start (related is patience4711/RPI-APS-inverters#73). Unfortunately I'm unclear if changes specific to APSystems inverters have been applied to the forked source repository. Could you please shed some light on this topic?

It is not applied and also not going to happen as APS does not use standard zigbee protocol.

Why cannot you just use the set of available devices (CC2530+cc259x)?

[mi-hol]

you may use the latest cc2531 firmware available in this thread.

@kadzsol I understand that, but would like to understand "how is this specific firmware build" in order to:

• make contributions that benefit the community
• be able to fix issues encountered over time
• be prepared for obsolescence of old software versions

It is not applied and also not going to happen as APS does not use standard zigbee protocol.

Does your statement imply that code of this specific firmware is not open source?

[kadzsol]

@mi-hol

@kadzsol I understand that, but would like to understand "how is this specific firmware build" in order to:

It is based on the standard zigbee 3.0.2 firmware. You may find build instructions here: https://github.com/Koenkk/Z-Stack-firmware/blob/master/coordinator/Z-Stack_3.0.x/COMPILE.md

If you want to develop you need to setup your own development environment.

* make contributions that benefit the community
* be able to fix issues encountered over time
* be prepared for obsolescence of old software versions

Sounds good, but for now there are no known issues with the firmware.

It is not applied and also not going to happen as APS does not use standard zigbee protocol.
Does your statement imply that code of this specific firmware is not open source?

Correct. However, if there is a real use case we can talk about it.

[mi-hol]

Correct.

Well, then this firmware is a dead-end for me as it violates basic principles of open source collaboration.
I've seen too many "one man shows" loosing interest in their solution after some time and leaving their user base "in the rain".
Just like in commercial products when a product is end-of-life without an upgrade path.

@patience4711 I'd suggest to add this important note "proprietary firmware with unavailable source code" to readme in your repository.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days

[kadzsol]

Updated package with support for DS3.
discord-09-12-2022.zip

[meufeu]

HI
I just try the new code with the last version (3.6) with the APS DS3 (actually a DS3-L .. I don't know if it's important), cc2530 updated ..
zigbee is working (test procedure runs well) but no pairing answer .. (does it means it answers but not as expected?) .. so impossible to pair my two inverters.
I tried with the second ECU_ID found on the WIKI but it's the same ..

running script inverterPair.pl...
argument is 1
sudo /usr/lib/cgi-bin/ecu/inverterPair.cgi 1
Content-type:text/html
running inverterPair.cgi
inverterpair running with arg1
wiringPi started
opened port serial0
fileToread = /var/www/ecu_data/ecuProperties
json from file = { 'idinvers': "80971B01B3D6", 'id': "D6B3011B9780" }
idinvers from file = 80971B01B3D6
ecushort = B3D6
fileToread = /var/www/ecu_data/inverters/invProperties1
json from file = { 'panels': [ 1, 1, 0, 0 ], 'idx': "", 'id': "unpaired", 'name': "", 'type': 2, 'serial': 703000352492 } serial from file = 703000352492
trying to pair inverter1
send cmd 0 2524020FFFFFFFFFFFFFFFFF14FFFF140D0200000F1100703000352492FFFF10FFFF80971B01B3D6A6
inMessage = FE0164020067
send cmd 1 1A24020FFFFFFFFFFFFFFFFF14FFFF140C0201000F0600703000352492F6
inMessage = FE0164020067
no pairing answer, returning...
proceeding with the next cmd
send cmd 2 2524020FFFFFFFFFFFFFFFFF14FFFF140F0102000F1100703000352492B3D610FFFF80971B01B3D6C0
decode inMessage = FE0164020067
no pairing answer, returning...
no pairing answer, returning...
proceeding with the next cmd
send cmd 3 1A24020FFFFFFFFFFFFFFFFF14FFFF14010103000F060080971B01B3D651
decode inMessage = FE0164020067
no pairing answer, returning...
all pair cmds done
info = 5
pairing failed, try again...
inverterPair ready
pair command processed
HTTP:1/1 200 OK

I Don't understand the error .. look like there is a communication but not the correct one .. Am I right ?
Where can I ensure I have a certain amount of data received from the inverter ? is it spied somewhere ?

To finish, I really want to thank you for the brilliant job you did and wish you an happy new year!

[meufeu]

Hi
I thought it could be better to pair the sunny day when the inverters are "producting" ..
It still does not work but the error message is different 👍

running` script inverterPair.pl...
argument is 2
sudo /usr/lib/cgi-bin/ecu/inverterPair.cgi 2
Content-type:text/html
running inverterPair.cgi
inverterpair running with arg2
wiringPi started
opened port serial0
fileToread = /var/www/ecu_data/ecuProperties
json from file = { 'idinvers': "80971B01C2C1", 'id': "C1C2011B9780" }
idinvers from file = 80971B01C2C1
ecushort = C2C1
fileToread = /var/www/ecu_data/inverters/invProperties2
json from file = { 'panels': [ 0, 1, 0, 0 ], 'idx': "inv2", 'id': "unpaired", 'name': "inv2", 'type': 2, 'serial': 703000410777 } serial from file = 703000410777
trying to pair inverter2
send cmd 0 2524020FFFFFFFFFFFFFFFFF14FFFF140D0200000F1100703000410777FFFF10FFFF80971B01C2C172
inMessage = FE0164020265
send cmd 1 1A24020FFFFFFFFFFFFFFFFF14FFFF140C0201000F060070300041077744
inMessage = FE0164020265
no pairing answer, returning...
proceeding with the next cmd
send cmd 2 2524020FFFFFFFFFFFFFFFFF14FFFF140F0102000F1100703000410777C2C110FFFF80971B01C2C172
decode inMessage = FE0164020265
no pairing answer, returning...
no pairing answer, returning...
proceeding with the next cmd
send cmd 3 1A24020FFFFFFFFFFFFFFFFF14FFFF14010103000F060080971B01C2C137
decode inMessage = FE0164020265
no pairing answer, returning...
all pair cmds done
info = 5
pairing failed, try again...
inverterPair ready
pair command processed
HTTP:1/1 200 OK

[swbouman]

Correct.

Well, then this firmware is a dead-end for me as it violates basic principles of open source collaboration. I've seen too many "one man shows" loosing interest in their solution after some time and leaving their user base "in the rain". Just like in commercial products when a product is end-of-life without an upgrade path.

@patience4711 I'd suggest to add this important note "proprietary firmware with unavailable source code" to readme in your repository.

What do you mean @mi-hol ? Every coördinator product is closed source at the beginning? Or did Philips provide the whole data to the platform?

In my opinion the codes are open on the internet and many people want to integrate the values of the inverters in their home automation.

Is there a way to implement these inverters in zigbee2mqtt? Hope you are willing to help!!

[patience4711]

Hi @kadzsol
long time no see.
I have a small question regarding the zigbee firmwares you shared. We have

CC2530ZNP-with-SBL.hex

CC2531ZNP-with-SBL.hex.

It seems that both modules cc2530 and cc2531 work with CC2530ZNP-with-SBL.hex while the cc2531 doesn't work with CC2531ZNP-with-SBL.hex. I can't remember the reason for this, maybe CC2531ZNP-with-SBL.hex is the sniffer?

Thank you in advance

[kadzsol]

What do you mean by "not working"? Op 16 feb. 2023 12:49 schreef patience4711 ***@***.***>: Hi @kadzsol long time no see. I have a small question regarding the zigbee firmwares you shared. We have CC2530ZNP-with-SBL.hex CC2531ZNP-with-SBL.hex. It seems that both modules cc2530 and cc2531 work with CC2530ZNP-with-SBL.hex while the cc2531 doesn't work with CC2531ZNP-with-SBL.hex. I can't remember the reason for this, maybe CC2531ZNP-with-SBL.hex is the sniffer? Thank you in advance —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[patience4711]

Several people reported that, when flashed with CC2531ZNP-with-SBL.hex the cc2531 does not react on zigbee commands, there seem to be no serial communication. Maybe they did something else wrong but when they flashed the CC2530ZNP-with-SBL.hex all works as expected.

An example here

So the question is why we have CC2531ZNP-with-SBL.hex as it seems to be unnecessary.

[kadzsol]

The cc2531 firmware has usb serial support added. If something is not working I advice to test setup with ztool. Also, the cc2531 needs some more time to wake up. So wait at least 1 minute before sending commands.Op 16 feb. 2023 13:37 schreef patience4711 ***@***.***>: Several people reported that, when flashed with CC2531ZNP-with-SBL.hex the cc2531 does not react on zigbee commands, there seem to be no serial communication. Maybe they did something else wrong but when they flashed the CC2530ZNP-with-SBL.hex all works as expected. An example here So the question is why we have CC2531ZNP-with-SBL.hex as it seems to be unnecessary. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[patience4711]

@kadzsol Oke clear. Thanks

[FloriH]

Hi @kadzsol ,
thanks for your work at the specific FW for the APS inverter.
I own a CC2530 (+ CC2591), successfully flashed it with your firmware and connect it now with my raspberry Pi 3B.
I try to use it with zigbee2mqtt, is this possible or works it only with the software-package from this repo (for ESP or complete Img for RPi)?

[kadzsol]

Hi @kadzsol , thanks for your work at the specific FW for the APS inverter. I own a CC2530 (+ CC2591), successfully flashed it with your firmware and connect it now with my raspberry Pi 3B. I try to use it with zigbee2mqtt, is this possible or works it only with the software-package from this repo (for ESP or complete Img for RPi)?

I think you are looking for this: https://github.com/patience4711/RPI-APS-inverters

Uses my firmware for the radio device but application is running on a Pi .

APS protocol is not standard zigbee and it will not work with zigbee2mqtt.

[FloriH]

Thanks, okay, I though with your Firmware I have „standard zigbee-communication on the serial UART port “ to the connected Host (RPi, ESP…).
I want to integrate it on a already running raspberry OS and not with a additional raspberry (zero).
But when there is no other way (i am not able to build the public code on my own), I have to get a another RPi and use the linked repo.
Thanks so much an kind regards from Berlin-Germany

[kadzsol]

Thanks, okay, I though with your Firmware I have „standard zigbee-communication on the serial UART port “ to the connected Host (RPi, ESP…). I want to integrate it on a already running raspberry OS and not with a additional raspberry (zero). But when there is no other way (i am not able to build the public code on my own), I have to get a another RPi and use the linked repo. Thanks so much an kind regards from Berlin-Germany

On the serial port you have serial communication. Zigbee is in the air :-) You can use an ESP too to drive the radio device.

https://github.com/patience4711/read-APSystems-YC600-QS1-DS3

[FloriH]

On the serial port you have serial communication. Zigbee is in the air :-)

that’s clear ;-), I thought the serial communication is compatible to zigbee2mqtt

okay, I got it… thanks

[grseidel]

I want to integrate it on a already running raspberry OS and not with a additional raspberry (zero).

If you are capable to do some python programming you could use the library https://github.com/No13/ApsYc600-Pythonlib which is based in the work outlined on this page. I use it with my "volkszaehler" RPi3 to add inverter data to my power usage database for almost a year now.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days