BYD Battery-Box HVM: SOC and Power to KNX via Inverter Modbus TCP

Why BYD Has No Direct Modbus Port

BYD Battery-Box HVM (403.2V high-voltage system, 2.76-22.1 kWh per stack) communicates with the inverter via a proprietary CAN-bus / EnergyLink protocol on the CAN port between battery and inverter. BYD does not expose a user-accessible Modbus TCP or RS485 port on the battery itself. All battery data must be read indirectly through the certified inverter partner.

SolarEdge StorEdge + BYD: Register Map

SolarEdge SE5K-RWS00BNN4 (StorEdge) with BYD Battery-Box HVM: Modbus TCP port 1502, unit ID 1.

Battery-specific holding registers (FC3, uint16 / int16):

KNX mapping: register 62794 (int16 W) divided by 1000 maps to KNX DPT 9.001 (battery power kW), register 62798 maps to KNX DPT 5.001 (SOC %). Note: register 62794 is a signed integer — MDT Modbus gateway should be configured for signed int16 data type for this register.

Fronius Symo Gen24 + BYD: SunSpec Model 802

Fronius Symo Gen24 5.0-1 with BYD Battery-Box HVM: Modbus TCP port 502, unit ID 1. SunSpec registers start at 40001 (base address).

SunSpec Model 802 (Battery Base Model) is appended after Model 103 (Inverter). To locate Model 802 dynamically: scan the SunSpec block list from base. In practice for Fronius Gen24 with firmware 1.24.x, battery registers start at approximately 40331:

Register 40331: SunSpec Model 802 ID (value 802)
Register 40333: Battery SOC (uint16, SF from register 40372)
Register 40337: Battery instantaneous power (int16, W — positive=charging)
Register 40341: Battery status (enum16: 1=off, 3=charging, 4=discharging, 7=fault)
Register 40361: Battery SOC (float32 alternative, direct %)

For production use: MDT Modbus gateway reads register 40361 (2 registers, float32 big-endian interpretation) for SOC and register 40337 (int16) for power. Map to KNX group addresses.

SMA Sunny Boy Storage + BYD: Register Addresses

SMA SBS6.0-10 with BYD Battery-Box: Modbus TCP port 502, unit ID 3 (SMA typically uses unit ID 3 for storage inverters).

Note: SMA uses uint32 data types (2 registers each) even for percentage values. MDT Modbus gateway: data type 'unsigned 32-bit integer', byte order 'big-endian', divide SOC register value by 1 (already percentage, no scaling needed).

Node-RED Polling Flow

Install Node-RED packages: node-red-contrib-modbus (Modbus TCP polling). Flow structure:

Inject (30s interval)
  → Modbus Read (server: 192.168.1.100, port 1502, unit 1,
      FC3, start 62798, count 1, datatype INT)
  → Function: msg.payload = msg.payload[0]; return msg;
  → KNX-Classic Out (GA: 6/4/1, DPT 5.001 — Battery SOC %)

Second branch from inject (register 62794 — battery power):
  → Modbus Read (same server, start 62794, count 1, datatype INT)
  → Function:
      var value = msg.payload[0];
      if (value > 32767) { value = value - 65536; }
      msg.payload = value / 1000;
      return msg;
  → KNX-Classic Out (GA: 6/4/2, DPT 9.001 — Battery power kW,
      positive = charging)

KNX Self-Consumption Automation

ETS6 logic controller (MDT Logic Controller or Weinzierl IP 731): Rule — If GA 6/4/1 (battery SOC) is above 85 AND GA 7/0/0 (PV export, DPT 9.001) is above 0.5 kW, activate KNX output GA 1/5/4 (domestic hot water boost, 30 min timer). Rule — If GA 6/4/1 (SOC) falls below 20, deactivate KNX output GA 1/6/1 (EV charging enable, DPT 1.001). Hysteresis: SOC must rise above 30 to re-enable EV charging, preventing relay cycling.