Request format

Byte	Value
0	0xAA
1	0x55
2	source (0xC0 by default)
3	target (0x7F by default)
4	control code
5	function code
6	length
7 - n	data
(n+1) - (n+2)	plain sum of all data bytes

E.g. :

 `0xAA 0x55 0xC0 0x7F 0x01 0x02 0x00 0x02 0x41`

Response

The response format is the same, but the source and target is swapped and the function code is incremented by 128.

If the response is not sent within 1 - 2 seconds, it was either lost (it happens in approx 1% cases) or the request was not recognized.

Known commands

The supported commands for various inverters are described elsewhere, e.g.: http://yamasun.com.tw/upload/F_20170313191367UrC8jo.PDF.

Probably all inverters support the inverter system info command, using control code 1 and function code 2.

The response for the system info request is:

Byte	Value
0 - 4	version string
5 - 14	model string
15 - 30	manufacture or empty
31 - 46	serial number