Missing sensors for additional battery packs on Marstek Venus D

[sphings79]

Description

When using a Marstek Venus D with multiple battery packs connected, the integration only exposes sensors for battery pack 1.

Sensors for the additional battery packs are missing, even though they are physically present and active.

Environment

• Home Assistant version: 2024.4.4
• Marstek Modbus integration version: 2026.4.1.b2
• Device: Marstek Venus D
• Battery setup: 2 additional battery packs connected

Expected behavior

For a Marstek Venus D with multiple battery packs, the integration should expose sensors for all connected battery packs, such as:
Each battery pack should be represented individually (Battery Pack 1, Battery Pack 2, etc.).

Actual behavior

Only sensors for battery pack 1 are created and visible in Home Assistant.

No sensors are available for the additional battery packs, even though they are connected and used by the system.

Additional context

This limits visibility into the full battery system and makes it difficult to:

• monitor individual battery pack health
• diagnose unbalanced packs
• accurately track battery behavior in larger setups

[ViperRNMC]

Which sensors do you mean, soc values are still unknown but cell values should be in them.

[sphings79]

in custom_components/marstek_modbus/registers/d.yaml there are only battery_1_cell_1_voltage to battery_1_cell_16_voltage. There are no sensors for additional packs.

[esszopo]

I've a Venus A with the same problem, if it's a problem. When I'm using the app I can touch the circle and I get to see the charge of all the packs + the pack that's being used for charge/discharge.

[sphings79]

I have hands on an fw file.
I can say, that there are 231 modbus registers adressed.
The file is still under review.
It's a VNSE file. But i think the VNSE FW is smilar to the VNSD.
There are also some other interesting things.
There is a serial console, RS485 is at 47.400 Baud, seems there are at least 2 vulnerabilities, with one of them it would be possible to flash custom fw.
The device has a seriel Debug-CLI (seems to be UART, 115200 Baud)

command	Chinese	Function
change_soc	修改soc	SOC-Wert manuell ändern
reset	重启系统	System neu starten
flash_test	flash分页写入测试	Flash-Speicher-Seitentest
eeprom_flash_test	外部eeprom测试	Externer EEPROM-Test
ch395_get_ip	ch395_get_ip	Ethernet-Chip IP ausgeben
ch395q_test	ch395q_test	Ethernet-Chip Test
rtc_show	rtc_show	RTC-Zeit anzeigen
rtos_status	RTOS状态	FreeRTOS Task-Status
update_ems	update_ems	EMS OTA manuell starten
ctl_mppt_power	ctl_mppt_power	MPPT-Leistung steuern
update_vns	update_vns	VNS (diese Firmware) OTA
update_bms	update_bms	BMS Firmware-Update
update_mppt	update_mppt	MPPT Firmware-Update
Resume_task	唤醒被挂起的所有任务	Alle Tasks wieder aktivieren
restore_factory	恢复出厂设置（中控）	Factory-Reset: 1=alles; 2=Kumulativ behalten; 3=nur Zertifikate
debug_mode	开关逆变器调试功能	Inverter-Debugmodus umschalten
venus_poweroff	休眠设备	Gerät schlafen: 0=normal; 1=sleep
venus_rfd	恢复出厂设置（逆变器）	Inverter-Factory-Reset: 0=alle; 1=meiste; 2=ohne Kumulativleistung
get_mppt_data	get_mppt_data	MPPT-Rohdaten ausgeben
get_venus_data	get_venus_data	Venus-Rohdaten ausgeben
get_main_bms_data	get_main_bms_data	BMS-Hauptdaten ausgeben
get_all_bms_data	get_all_bms_data	Alle BMS-Daten
delate_ssl_cert	删除SSL证书	TLS-Zertifikat löschen
check_ssl_cert	查询SSL证书版本号	Zertifikat-Version prüfen
set_wifi	设置WIFI信息	WiFi-Credentials setzen
mac_ble	查询蓝牙信息	BLE MAC-Adresse ausgeben
ver_fc	查询FC41D模组固件版本	FC41D Firmware-Version
fc41d_reset	复位FC41D模组	FC41D WiFi-Modul reset
trace_debug	2025:打印数据；其他：关闭打印	Debug-Trace: 2025=ein; andere=aus
modbus	进入modbus	Modbus-Test-Modus
show_modbus	显示modbus地址	Modbus Slave-Adresse anzeigen
get_log	获取日志记录信息	Logs: 0=Fehlerlog; 1=Eventlog
wifi_info	查询WIFI信息	WiFi-Status
api_set	Local API 设置	Lokale API: 0=aus; 1=ein
api_port	Local API 端口号设置	API-Port setzen (1-65535)
get_time	获取时间信息	RTC-Zeit
vns_ate_test	vns ate 测试指令	ATE-Test (Werkstest)
ctrl_led_light	控制led灯亮度	LED-Helligkeit: 0=max; 7=min
energy_show	显示充放电总能量	Gesamtenergie anzeigen
err_code	打印中控错误码	Fehlercodes ausgeben
ext_info	打印g_ext_info	Erweiterungsinfo ausgeben
reset_reason	打印重启原因	Neustart-Grund
button_ctrl	控制按钮	Taste: 0=low; 1=high
led_continue_ctrl	控制类型	LED dauerhaft: 0=an; 1=aus; +Dauer ms
recon_ch395	重置ch395	Ethernet-Chip software-reset
hard_reset_395	硬件重置ch395	Ethernet-Chip hardware-reset: 0=low; 1=high
ch395_ver	获取ch395版本	Ethernet-Chip Version
key_state	按钮状态	Tastenstatus lesen
code_test	编码测试	Kodierungstest
lck_bms	bms锁	BMS-Lock: 0=entriegeln; 1=sperren
ems_rtrl_info	打印中控下发给mppt和vns的数据	EMS→MPPT+VNS Steuerdata
full_dischrg	余电上网功能	"Überschuss-Einspeisung": 0=aus; 1=ein
free_mqtts	主动释放mqtts	MQTT-Verbindung zwangsweise freigeben
get_meter_mac	获取设置电表mac	Stromzähler MAC abfragen/setzen
get_backup_datas	设置获取backupdata标记位	Backup-Daten-Flag
get_ota_log	获取http升级log	OTA-Update-Log

I also tried to get an FW file for the VNSD with a modified request via nginx and mitmproxy.

Some System specs:
STM32 MCU (ARM Cortex-M, Thumb-2, Little-Endian)
├── FreeRTOS (Tasks: rs485, ch395, fc41d, Modbus_tcp, udp, ch_mqtts, ems, ...)
├── mbedTLS (AES-128/256, RSA, ECDH secp256r1)
├── CH395Q (Ethernet, SPI → Modbus TCP Port 502)
├── FC41D (WiFi 802.11b/g/n + BLE 5.0, UART AT-Befehle)
└── RS485 (47.400 Baud, Modbus RTU → Inverter/EMS)

┌─────────────────────────────────────────────────────────┐
│ STM32 MCU │
│ │
│ ┌──────────────┐ SPI ┌─────────────┐ │
│ │ CH395Q │◄─────────►│ Ethernet │ Kabel/LAN │
│ │ TCP/IP Chip │ └─────────────┘ │
│ │ (MQTT+TLS) │ │
│ └──────────────┘ │
│ │
│ ┌──────────────┐ UART ┌─────────────┐ │
│ │ FC41D │◄─────────►│ WiFi/BLE │ 2.4GHz │
│ │ Quectel │ └─────────────┘ │
│ │ Modul │ │
│ └──────────────┘ │
│ │
│ ┌──────────────┐ │
│ │ RS485 │◄── Modbus RTU ──► Wechselrichter │
│ │ (47400 Baud)│ EMS / MPPT │
│ └──────────────┘ │
│ │
│ ┌──────────────┐ │
│ │ CAN Bus │◄── CAN ─────────► BMS / Intern │
│ └──────────────┘ │
│ │
│ ┌──────────────┐ │
│ │ CH395Q │◄── Ethernet ────► Modbus TCP :502 │
│ │ (auch TCP) │ │
│ └──────────────┘ │
└─────────────────────────────────────────────────────────┘

[ViperRNMC]

Nice, if you know how to find out more register with the firware I would love to hear it

[sphings79]

Nice, if you know how to find out more register with the firware I would love to hear it

There is no static table. Seems to be build dynamically.
I'm still investigating :) But it's clear that there are 231 registers :) would upload my investigations to GitHub, but I'm sure Marstek will not be fine with that. Especially cause there is a way to upload modified fw.

[sphings79]

But it's still a very early stage