marc-fischer / bluetti-ac200p

hacking the bluetti ac200p to add outside communication for integration in smart home

bluetti-ac200p

hacking the bluetti ac200p to add outside communication for integration in smart home

Idea

i got a bluetti ac200p for a quite cheap price (600€) from an ebay auction. To include the pv generator in my smart home and use it to provide all smart home components with the free solar energy generated by 2 470W panels on my balcony, i need a reliable way to read the current battery level of the generator. Additionally it would be nice to be able to track the solar intake for statistic reasons.

Problem

In controversy to other Bluetti generators, the ac200p has neither bluetooth nor mqtt nor any other integration to bluettis app, therefor also the existing bluettii2mqtt converters don't work, as they rely on a bluetooth serial connection.

Hacking

To open the generator, the grey decoration panels must be removed (partially). The top side is covering several screws, most obviously the long full-body screws for both handles. The decoration panels are partially glued and partially clipped, so removing with 2 screwdrivers and some force was required. This can destroy some of the clips, i didn't mind - i don't care too much about the looks of this device.

When opening the top cover, the 2 Qi chargers can be disconnected to remove the top cover completely. Take care - exposed mains and battery voltage is now touchable. I assume you know what you're doing if you've gone as far as ripping that thing open.

Pictures of relevant PCBS

Main Controller Board

• Connects to all periphery, 2 direct connections to interface with inverter & battery board
• 2 BUS connections to battery management board (1 CAN, 1 to be defined)
• Additional AUX Connection (assumed also a BUS connector, IO is opto-coupled)
• 1 differential power supply out (+- 12V)
• 2 µC on board
• display connection:
  • 2x UART

Display

Touchdisplay board, located in the front of the device.

Communicates via 2 UART ports to main controller.

UART2:

• Uses assumed: 115200 baud, 8 data bits, no Parity, 1 stop bit, no flow control

UART4:

• tbd

Idea

1. Check if BT/Wifi Uart is working and has implemented MQTT protocol (like ac200max). If so, add a bt/wifi bridge - failed
2. Sniff communication between display and main board. The display board can control and show all information which is available from the mainboard. It must be communicated via the UART connection in between.
3. Check the Auxillary communication port on the mainboard.

Idea 1: Check if BT/Wifi Uart is working

Other Bluetti generators use Modbus RTU between the bluetooth app and the generator. If the spec-down of ac200p is just removing the BT module, the UART might be alive and capable of answering modbus requests.

warhammerkid/bluetti_mqtt contains a documentation of sniffed and available commands for ac200m.

Tested:

baud_rates = [ 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200 ]

without success, flipped tx/rx, using 3v3 FTDI UART TTL cable.

Its likely the port is not alive, even though the default pull-up is applied at RX pin.

(taken from: https://www.youtube.com/watch?v=dRjFJPFkYZw). It seems the BT module is located on a carrier board seperately to the main control board. Chance reduced we get modbus on the display...

Idea 2: Sniff the communication between display and main controller

Display and Main controller seem to communicate via a serial connection using 115200 baud via UART2. I couldn't sniff any packets on UART4 yet.

I sniffed from display side:

	E3 B2 	  A5 41 82 10 30 01 F7 00 01 00 02 00 38 01 3A 01 	3A 01 3A 01 3A 01 7A 01 	EE 09 3A 01 3A 01 3A 01 3A 01 3A 01 7A 01 3A 01 3A 01 3A 01 3A 32 60 32 30 2D 30 31 2D 31 39 20 31 37 3A 33 34 3A 31 39 00 8B 2A 5A A5 63 82 10
	4B E3 5A 	A5 41 82 10 30 01 F7 00 01 00 02 00 18 01 3A 01 	72 01 3A 01 3A 01 3A 01 3B 01 3A 01 3A 01 3A 01 3A 01 39 01 3A 01 3A 01 3A 01 3A 01 3A 32 60 32 30 2D 30 31 2D 31 39 20 31 37 7A 33 34 3A 31 38 00 8A BA 5A A5 63 02 10
	4D E3 5A 	A5 41 82 10 30 01 F7 00 01 00 03 00 18 01 3A 01 	3A 01 3A 01 3A 01 3A 01 3B 01 3A 01 3A 01 3A 01 3A 01 3A 01 3A 01 3A 01 3A 01 3A 01 3A 62 30 32 30 4D 30 31 2D 31 39 20 4C 93 A7 26 93 A7 4C 13 8F 4A 5A 45 63 82 10

There are blocks that seem to be re-appearing, ie. A5 41 82 10 30 01 F7 00 01 00 02 00 38 01 3A 01

Some part of it seems to be a date in ascii format:

b 0 2 0 M 0 1 - 1 9 - thats the same date the display shows. The main board contains either a supercap (my unit) or a Cr2032 (unit from yt video), so the main board may keep track of the time. Other than displaying the time it makes no sense to have the RTC on that board, there is no communication that would rely on UTC time constants.