Inverter Huawei I23002G1 / I23003G1 - Embedded Telecom Power (ETP) - 48V 42~58V 3000w

[Hyperelectronic]

Hello all of you,

Short introduction from my side, I am an electrical engineer / electronics developer / firmware programmer from Austria who likes to deal with all kind of electrical components / electronics / battery storage systems ranging from very small power levels (uCs) up to very large ones (EVs). I also over the years have gained a lot of experience in the field of reverse engineering.

Currently I am working on reverse engineering the "Embedded Telecom Power" (ETP) modules from Huawei to get them working standalone and I already managed to get the rectifier modules fully working (complete remote control, status communication, diagnostic data (including fan management) via can bus, etc.) and currently already use them to charge my powerwall with the excess power of my solar system (3x R4875G1 modules connected to 3 phase ac power and managed by a central ESP32 board with fully automated load management / power control). Additionally I also have the super high efficiency variant of this modules (R4850S1) for testing purposes.

I am now working specifically on the inverter type of modules but simply can not get them to work so far. I tried measuring and manipulating all possible data signals on the connector, but can not get it to communicate via can bus and therefore can not control it / enable the output.
I already found out, that this kind of module seems to do not have the auto addressing functionality that the rectifier modules have and therefore need static addressing (set via resistors, which I could not exactly determine because I do not have an original enclosure for it, but by a bit of trial and error found a combination where the module does not simply signal an slot error but still no communication is possible)
The main problem is, that there is zero communication comming from the module (as there is with the rectifier modules), also sending a lot of different messages to it made no difference, I even tried to brute force it, but with 29 bit of possible addresses and a nearly infinite amount of possible data combinations, there is really no big chance to get it working this way. I tried the northbound and southbound can bus at different states at the other pins, I am also 100% sure the whole communication chain is working properly, as if i plug a rectfier module into the same connector everything is working perfectly and with both types of modules only at the correct 125 kbit/s there is no immediate can bus error if I send messages to it.

The last thing I did is let the GPT do a deep resarch but that also did not result in anything useful. The only reference I got are some videos of a guy (on a chinese video platform) that seem to be a engineer at huawei and he has posted some short videos on the module working externally (from the comments it seems to be very likely that it was done with some special firmware on it).

I believe there must be some kind of unlocking sequence build into it (I am not sure if it is implemented in hardware via pins or software via can bus) or if it is only to protect people from mains output voltage or to lock us out from using it externally.
So the only way and hope I have, is you guys, as I am currently quite stuck.
Does anyone of you have an ETP23003 or ETP23006 enclosure and can reach out to me, so we can do a few measurements? (I think we will be able to get it working in a very short time)

I also have a lot more detailed informations / measurement values and images of the electronics of the modules that I could / will provide if needed, but as I am always very bussy, I do not have a lot of time for documenting it online in detail.

Thanks a lot to all of you in advance!

 

[amberwolf]

I don't have experience with these, but there is significant discussion about telecom PSU repurposing here. If you haven't already you might look at the other here (mostly in the battery technology section) to see if any of the stuff done on those applies to yours. This is perhaps the biggest:

Rectifier Huawei R4850G2 48V 42~58V 3000w

What do you think of this rectifier? High efficiency > 96% Ouput voltage 42~58VDC, default value 53,5VDC Ouput Power 3000w (176~300VAC) Weigh =< 2 KG The datasheet...

endless-sphere.com

 

[Hyperelectronic]

I don't have experience with these, but there is significant discussion about telecom PSU repurposing here. If you haven't already you might look at the other here (mostly in the battery technology section) to see if any of the stuff done on those applies to yours. This is perhaps the biggest:

Rectifier Huawei R4850G2 48V 42~58V 3000w

What do you think of this rectifier? High efficiency > 96% Ouput voltage 42~58VDC, default value 53,5VDC Ouput Power 3000w (176~300VAC) Weigh =< 2 KG The datasheet...

endless-sphere.com

Thanks for your comment, i really appreciate it, this is quite a good thread as there are also a lot of pictures posted, but I already knew it (I have even read it multiple times already) and I believe also nearly everything I could find anywhere about it.

 

[ironhamster]

I would also be very interested in any information about getting this inverter working outside the enclosure. I have the I23003G1, and naively assumed it would just start pumping out CAN messages like R4850/4875. I haven't done any testing yet, other than power it on connected to CAN...

By slot error, do you mean all three LEDs lighting up? If so, what did you do to solve that? And do you get any AC output at this point?

I assumed the unit needed some kind of AC signal to sync to, and maybe that was the problem based on the presence of "Parallel signal" pins: I23003G1 Inverter Module User Manual V1.0 | PDF | Power Inverter | Power Supply

 

[Hyperelectronic]

I originally had expected the same and before I bought it, I was quite sure, that it would behave exactly the same as the rectifier modules do, which unfortunately seems to be everything else than true.

Correct, if nothing is connected to address pins 1 or 2, all three leds are lit (the red led is signaling an slot detect / address error), even if the pskill pin is connected to dc- to signal a fully plugged-in module, but this connection at least half way starts the module (it's starting the conversion from input voltage to the dc bus voltage (internaly measured at around 396 VDC) (only pulsating because no power gets drawn and therefore no discharge of dc bus except the bleeder resistors) but no communication via can bus and also no output is present).
If you additionally connect address pin 1 to dc- and address pin 2 to an external supply of greater than 2.2 VDC (for my testing I keept at 2.8 VDC but tried ranges up to arround 25 VDC as I have found some loose informations on a chinese forum, that on the ETP48xxx enclosures the range for the reference circuit might go up to arround half the dc input (not sure if it is true, but there really should not be any harm to it, even if it is way to high, because the module is compliant with international emc standard (with which I am very familiar with) and therefore gets tested with such and even higher levels on any exposed pins at certification) and then supply the module with power the red fault indicator led stays off (only the yellow and green leds are on) but still no communication or output.

From what I have found out so far, I am also not expecting that any of the sync signals need to be present for a single module to work (this section is also separated on the user manual), but I also have already tried hooking up a lot of different signals onto the parallel signal pins, unfortunately with no luck or change in behaviour.

I am really wondering if there must be a special signal / communication present on the DIO+ and DIO- pins to unlock the module.

 

[Hyperelectronic]

For everyone that is curious, some informations specified in the original user manuals of the module and enclosure:

1.) Pinout of the I23003G1 inverter module

2.) Description of the dip switches that set the levels of the address pins 1 and 2
I believe they are directly (with some simple ciruit) connected to the 2 individual address pins on the module (so first group address pin 1 and second group address pin 2) but can not verify it as I do not have an enclosure for it.
But from my understanding, it would make sense why it is indicating an error without a connection of the second address pin, because it would maybe think it is in slave mode and therefore needs the parallel signals, which are not present.