gemini://ur.gs/blog/battery-time/

In my last post I talked a little bit about the newly installed solar panels, and a lot about home automation. Since then, the solar install has been completed, although the scaffolding is still up (grumble grumble). I have nine panels on the roof, and today was a new generation record - 17.1kWh, with 4kWh of import from the grid!

Of course, we didn't use 21.1kWh overall; instead, we exported a large amount of it. For free, since I don't yet have the paperwork required to sign up to an export tariff.

All of this is being fed into MQTT (the mosquitto server), then exported into victoria-metrics via mqtt2prometheus. The CAD speaks MQTT natively; the air quality sensor is currently being filtered through zigbee2mqtt on the laptop while ShimmeringBee gets support for that specific device; and the Solax inverter is being scraped via some custom code I put together. More on that shortly.

With the time series in victoria metrics, I can generate pretty dashboards in grafana at will:

Being able to scrape the inverter was a bit of a surprise - the plan was a Zigbee pulse counter on the generation meter. When the installers put the inverter in, however, they equipped it with a hideously insecure and hostile "PocketWIFI" module, which acts as both a WIFI AP and client. The AP is unsecured and cannot be turned off, but the client can at least do WPA2-PSK, and is connected to a WIFI Home Automation Network I've set up with no internet.

Either way, once you've got an IP address for the adapter, you can query it over HTTP and get data about the inverter it's plugged into. It's also listening on port 502 (Modbus-TCP), although I've not managed to get it to respond to anything mbpoll can send. Still, it's slightly scary to think that anyone in the vicinity of my house can speak modbus directly to the inverter by connecting to the unsecured AP.

If this is what they put in someone's house when they explicitly request Luddite mode, I can't imagine what "full cloud connectivity mode" looks like.

The adapter also tries to connect to an MQTTS (TLS, port 8883) server in The Cloud. This is used for aforementioned cloud connectivity and offers exciting features like "push arbitrary firmware to the inverter/adapter", alongside "view your inverter data with a 5-minute delay". Of course, they're not verifying certificates, so the MQTTS connection is trivial to hijack for harvesting data - or pushing said arbitrary firmware.

Programmes like "Leverage" present hackers as modern-day wizards, able to do anything with any computer, take over any system, and exert absolute control over network-connected devices. It seems far-fetched until you run into actual real-world systems like this...

Anyway, the plan is to replace the "PocketWIFI" module - either with a direct Modbus-RTU connection, as with the heat pump, or with a "PocketLAN" device if that proves infeasible. Both are significantly more secure, since they require physical access to take over the device.

Meanwhile, the MQTTS stream proved to be inconveniently formatted for use with matt2prometheus, since it pushes binary data rather than JSON. I removed the interceptor and knocked together a tiny bit of code that scrapes the HTTP endpoint instead.

This gives a JSON response that contains a 100-element array of uint16 values, which is the sensor/status data. There's a lot of Solax projects and integrations already that had made headway on interpreting this in general, but none for my specific inverter/firmware combination, so I got to do some detective work, helped along enormously by the squishykid/solax GitHub project. The result is solax2mqtt, a small (ca. 250LOC) Rust program that does the HTTP scrape, transform, and MQTT push, all in one.

It's been a while since I've written anything in Rust, and this was an easy project, but I enjoyed it greatly and managed to get into a tight loop with the compiler to build out the whole thing without once running it against the actual inverter. Once the compiler was happy, and all my TODOs had been implemented, I did that and it worked first time, with no bugs, which was a great feeling. I should do more in Rust.

Despite all the data, I don't yet have a reliable export number. I do have live export in watts, but not accumulated kWh, despite both the inverter and glow CAD being able to provide it in theory. Perhaps it will start working once I'm signed up to an export tariff.

The first point will be the subject of another article. The second follows from the energy stats, but there are a few other considerations.

First, sizing, efficiency, and pricing - I'm looking at a 3.3kWh system (DIY-expandable in 3.3kWh modules), which will have ~90-95% efficiency and cost around £3750, fully installed. This has to compete with the grid, which, per my previous post, has infinite capacity and is free, but only has ~50% efficiency when round-tripping through money at current unit prices.

My original plan was to leave thinking about batteries until next year, and only to do it in conjunction with a larger solar array. Since then, the UK has started talking about 3-hour rolling blackouts over winter (perhaps a 10% chance of this happening), and paying people £10/day to avoid using energy from the grid 4pm-7pm (much higher chance of this happening). The former affects me far more than it should - I've spent enough time without electricity, thank you - but the latter is very helpful.

The no-grid bribe from November - February would be £1,200 - and much easier and more pleasant to collect with a battery installed. If it extended into March as well, that would be £1,500 - 40% of the total cost of the battery, in just five months.

The more traditional benefit is that overnight usage can come from the battery, reducing daily import. Assuming I avoid 3kWh/day of import, the saving is £0.50/day compared to the grid-battery option. It really puts the size of that 4pm-7pm bribe into perspective! Paying back the remaining 60% of the battery cost from that would take 12 years - and the battery is only rated to last for ten. Without the grid bribe? 28 years for full payback.

The no-grid scenario exercises me greatly, though. Without the battery system, the solar panels are useless - the inverter has "anti-islanding protection", which prevents line workers from getting fried by shutting the panels down. The house is also much more dependent on electricity now that it's powered by a heat pump (although it's worth noting that gas boilers do need a small amount of energy to function, although it could conceivably be provided with a plug-in UPS).

The batteries we're looking at are AC-coupled and provide an "EPS" circuit - basically a UPS. Most of the time, the circuit is powered by the mains, but the batteries can put 3kW of power into it if the grid goes down. The heat pump, home server + internet + HAN, lights, and a couple of sockets in the kitchen, can be powered from there.

Without solar, 3kW of load would empty the batteries in 1 hour, but the batteries allow the solar to keep working, so there's up to 3kW of power flowing into the system. On a good day, it could run for long as the sun is shining, plus the capacity of the battery. Load is also likely to be less than peak - overnight, including the heat pump set to 18'C, we do about 100W at current temperatures. On a cold winter's day, with the heat pump maintaining 21'C, we might do 500W before taking cooking into account, so the battery covers us for six hours. I suppose we could always turn the heat pump off to extend it further, but I've also had enough of being cold.

So, despite the poor payback calulation, we're still getting them. Being able to function without the grid is more important than having them pay for themselves, even if the grid has a 90% chance of making it through winter unscathed. I look forward to writing more rust to scrape this inverter, too! I'll place the order tomorrow; the plan is to get it all done before November. Since the scaffolding is still up, Switched On won't be getting this contract; instead, I'm giving Big Green Beard a go.

Battery time

Reasonable Home Automation (cont)

Solax inverter deep dive

Batteries