Connecting to Huawei SUN2000 via Modbus

Compare RS-485, SDongle TCP, Wi-Fi AP, and SmartLogger connection options for Huawei SUN2000 inverters, including the FC 0x41 log file transfer protocol.

Huawei SUN2000 inverters support several physical and logical paths to Modbus. Choosing the right one depends on your inverter generation, whether an SDongle is fitted, and how many simultaneous clients you need. The table below summarizes every supported method, then the sections that follow give you step-by-step connection instructions and the full FC 0x41 file-transfer protocol.

Connection method comparison

Method	Physical layer	Port	Slave ID	Parameters	Limitations
RS-485 RTU (direct)	RS-485 cable	—	1	9600 baud, 8N1	Unstable when SDongle is connected simultaneously
Modbus TCP — SDongle, old firmware	Ethernet / Wi-Fi	502	1	TCP	—
Modbus TCP — SDongle, new firmware	Ethernet / Wi-Fi	6607	1	TCP	Requires activation in FusionSolar App
Modbus TCP — Inverter Wi-Fi AP	Wi-Fi, 192.168.200.1	6607	1	TCP	Only 1 simultaneous connection allowed
SmartLogger (via network)	Ethernet	502	Per inverter	TCP	Requires SmartLogger hardware

V3 inverters with updated SDongle firmware changed the default Modbus TCP port from 502 to 6607. If your connection attempt to port 502 fails, enable third-party Modbus access in the FusionSolar App under the SDongle settings, then connect on port 6607.

SDongle TCP connection (Python)

Use this method when your inverter has an SDongle connected to your local network (Ethernet or Wi-Fi) and you have activated third-party Modbus access in the FusionSolar App.

1. Find the SDongle's IP address

   Open the FusionSolar App, navigate to your plant, and locate the SDongle device details. Alternatively, check your router’s DHCP client list for a device whose MAC prefix matches Huawei.

2. Activate Modbus TCP in the FusionSolar App

   In the App, go to Settings → SDongle → Advanced and enable Modbus TCP access. This step is required for new-firmware SDongles.

3. Install pymodbus

   pip install pymodbus
   
4. Connect and read registers

   from pymodbus.client import ModbusTcpClient
   
   HOST = "192.168.1.100"  # Replace with your SDongle's IP address
   PORT = 6607             # Use 502 for old-firmware SDongles
   SLAVE_ID = 1
   
   client = ModbusTcpClient(HOST, port=PORT, timeout=10)
   client.connect()
   
   # Read active power (register 32080, I32 — 2 registers)
   result = client.read_holding_registers(32080, count=2, slave=SLAVE_ID)
   raw = result.registers
   
   # Combine two 16-bit registers into a signed 32-bit integer (big-endian)
   value = (raw[0] << 16) | raw[1]
   if value >= 0x80000000:
       value -= 0x100000000
   
   print(f"Active power: {value} W")  # >0 generation, <0 consumption
   
   client.close()
   

RS-485 RTU connection (Python)

Use this method on V2 inverters or any installation without an SDongle. Connect an RS-485 USB adapter to the inverter’s COM port.

1. Wire the RS-485 adapter

   Connect the adapter’s A(+) and B(−) terminals to the corresponding RS-485 terminals on the inverter. Use shielded twisted-pair cable and keep the run under 1200 m.

2. Install pymodbus and pyserial

   pip install pymodbus pyserial
   
3. Connect and read registers

   from pymodbus.client import ModbusSerialClient
   
   client = ModbusSerialClient(
       port="/dev/ttyUSB0",  # Adjust for your OS (e.g. COM3 on Windows)
       baudrate=9600,
       bytesize=8,
       parity="N",
       stopbits=1,
       timeout=10,           # Use 5–10 s — ARM needs time to load data from Flash
   )
   client.connect()
   
   SLAVE_ID = 1
   
   # Read PV1 voltage (register 32016, I16)
   result = client.read_holding_registers(32016, count=1, slave=SLAVE_ID)
   raw = result.registers[0]
   voltage = (raw if raw < 0x8000 else raw - 0x10000) / 10
   print(f"PV1 voltage: {voltage} V")
   
   client.close()
   

When reading large log files over RS-485 using FC 0x41, set your response timeout to 5–10 seconds. The ARM processor needs time to retrieve data from the inverter’s internal Flash storage before it can fill the transmit buffer.

FC 0x41: proprietary log file transfer

Standard Modbus function codes (FC 03 and FC 04) are limited to 252 bytes per packet, which is not practical for multi-megabyte EMAP log files. Huawei introduced FC 0x41 (User Defined Function) to turn the inverter into a file server.

Catalog files

Before requesting a log, you retrieve a catalog that lists available files and their sizes:

File	Contents
AD.bin	Master catalog — names, IDs, and sizes of all available logs
LD.bin	Log data group
PD.bin	Performance data group
CD.bin	Configuration data group

Sub-function protocol

FC 0x41 uses three sub-functions to transfer a file:

1. Sub-function 0x05 — Start Upload

   The master sends a Start Upload request specifying the file type (for example, 0x04 for logs). The inverter responds with the total file size and confirms it will deliver data in 240-byte chunks. The 240-byte chunk size fits neatly inside a 256-byte Modbus frame including headers, ensuring stability even on older V2 RS-485 links.

2. Sub-function 0x06 — Upload Data

   The master iterates through the file by requesting chunks sequentially by Frame SN (sequence number). Each packet carries a CRC checksum. If a packet fails its CRC check, the master re-requests the same Frame SN — no need to restart the transfer.

3. Sub-function 0x07 — End Upload

   After receiving the final chunk, the master sends an End Upload request to close the session. This releases resources on the inverter side.

Integrity and timing

• CRC per packet — every 240-byte chunk is individually checksummed. A corrupt packet is re-requested by its Frame SN rather than restarting the full transfer.
• Frame SN — monotonically increasing sequence numbers let the master detect and recover from dropped packets.
• Timeouts — on V2 over RS-485 the first response can take 5–10 seconds while the ARM processor loads data from Flash into the send buffer. Always configure a generous response timeout; subsequent chunks typically arrive faster once the buffer is primed.

Do not attempt FC 0x41 file transfers while another Modbus client is actively polling registers. The inverter’s ARM processor handles both tasks on a single communication stack, and concurrent access can cause timeouts or corrupt chunk sequences.