«
»

At my parents place, we installed photovoltaic cells. The produced electricity is converted to AC power and is coupled with the normal grid: if we produce too little, the grid provides the remaining power; overproduction is given to the grid.

The inverter (the device that converts DC into AC) is a SolarMax C-series. It has a 2-line LCD display that gives out some basic information: current, voltage, power; produced energy today, this month, this year, … This is very useful information, but is a bit hard to access. The instruction manual reveals that there is a computer interface available to read out its data. Naturally, I wanted to explore this!

The interface is physically an 8P8C (usually called RJ45). Electrically it’s a serial interface. The manual isn’t exactly clear whether it’s an RS-232 or an RS-485 interface. After some mailing and calling, the people at Sputnik Engineering just mailed us the pinout diagram and document (both in German); it appeared to be RS-232. Their website even has a free utility called MaxTalk to read out the data!

The MaxTalk program is very basic. It only reads out the data, but does not process it in any way. However, it showed that the PC communicated with the inverter, which is great news!
maxtalk-1

Reverse engineering the protocol

I wanted to get access to this data myself. This would allow me to run some statistics and/or graphing tools on them. I did not find any documentation on the protocol on the Internet, so I started to reverse engineer it myself.

I’m not sure of the legal aspect of this. Some facts to keep me safe: the software did not present a EULA; I only inspected the bytes traveling over the serial interface and did not touch the application in any way.

There is a wonderful tool called socat that allows me do some plumbing with a data stream: The MaxTalk application is running inside a VMware machine. The serial port of this machine is connected to a unix-domain socket by VMware itself. Socat connects this socket to the real serial interface and spits out a copy of the stream as a bonus. You can even bridge the serial line over TCP if you want to!

Since RS-232 is a fairly easy protocol, the easyest way is just to try out the different settings. I figured out that the SolarMax talked at 19200bps, using 8 databits, no parity and a single stop bit (19200 8N1 for short). The corresponding socat line thus became:

# socat -v /dev/ttyS1,b19200,cs8,parenb=0,cstopb=0 UNIX-CONNECT:/tmp/serial

Here is (some of) the output I got. I re-assembled the fragments together to make it more readable:

<  {FB;05;4E|64:E1D;E11;E1h;E1m;E1M;E2D;E21;E2h;E2m;E2M;E3D;E31;E3h;E3m;E3M|1270}
>  {05;FB;7C|64:E1D=16;E11=8002;E1h=12;E1m=39;E1M=3;E2D=1C;E21=8004;E2h=E;E2m=21;
>  E2M=3;E3D=6;E31=8004;E3h=10;E3m=23;E3M=4|1C4E}
--
<  {FB;05;36|64:CAC;KHR;KDY;KMT;KYR;KT0;KLD;KLM;KLY|0D34}
>  {05;FB;59|64:CAC=1F3E;KHR=26D6;KDY=8E;KMT=8D;KYR=221;KT0=18C7;KLD=78;KLM=F8;
>  KLY=A8F|154C}
--
<  {FB;05;3E|64:ADR;DDY;DMT;DYR;PIN;SWV;THR;TMI;TYP;FRD;LAN|0FC4}
>  {05;FB;61|64:ADR=5;DDY=E;DMT=4;DYR=9;PIN=1428;SWV=7B;THR=13;TMI=A;TYP=BC2;
>  FRD=7D60905;LAN=1|178D}

The socat output shows that the messages are pure ASCII, which is a lot easier to figure out than raw binary.

From this point on, it’s just some trail-and-error to figure out what the message format looks like, how the responses are formatted and what they mean.

The message format

Each message has the following format:

  • ‘{‘ : start of message indicator
  • 2 characters source address in hex
  • ‘;’
  • 2 characters destination address in hex
  • ‘;’
  • 2 characters message length in hex
  • ‘|64:’
  • data
  • ‘|’
  • 4 characters checksum in hex
  • ‘}’ : end of message indicator

The computer seems to have address 0xFB. The SolarMax has address 0x05, which is what we configured.

The length field is over the complete message, including the curly braces.

The checksum field is a standard 16-bit checksum over the body: the first character is the source address, the last character is the ‘|’ before the checksum.

In messages from computer to SolarMax, the data consists of one or more question-codes, separated by a ‘;’. The response contains the same codes, but includes the answers after an ‘=’ sign.

The codes

The meaning of the codes was largely educated guessing. Grab all known codes several times and compare what differs. Also compare this with what the Windows-interface shows.

This perl-script enumerates all codes that I found. I figured out the meaning of most of them.

# ./solarmax-test.pl /dev/ttyS1 5
Opening serial port /dev/ttyS1
Setting 19200 8N1
Reading all pending bytes
Address (ADR): 5
Type (TYP): 0xBC2
Software version (SWV): 12.3
Date day (DDY): 15
Date month (DMT): 4
Date year (DYR): 9
Time hours (THR): 18
Time minutes (TMI): 11
Error 1, number (E11): 32770
Error 1, day (E1D): 22
Error 1, month (E1M): 3
Error 1, hour (E1h): 18
Error 1, minute (E1m): 57
Error 2, number (E21): 32772
Error 2, day (E2D): 28
Error 2, month (E2M): 3
Error 2, hour (E2h): 14
Error 2, minute (E2m): 33
Error 3, number (E31): 32772
Error 3, day (E3D): 6
Error 3, month (E3M): 4
Error 3, hour (E3h): 16
Error 3, minute (E3m): 35
Operating hours (KHR): 9953
Energy today [Wh] (KDY): 12900
Energy yesterday [Wh] (KLD): 14200
Energy this month [kWh] (KMT): 154
Energy last monh [kWh] (KLM): 248
Energy this year [kWh] (KYR): 558
Energy last year [kWh] (KLY): 2703
Energy total [kWh] (KT0): 6356
Language (LAN): 1
DC voltage [mV] (UDC): 344700
AC voltage [mV] (UL1): 239400
DC current [mA] (IDC): 330
AC current [mA] (IL1): 520
AC power [mW] (PAC): 89000
Power installed [mW] (PIN): 2580000
AC power [%] (PRL): 3
??? Start ups ??? (CAC): 8004
??? (FRD): 0x7D60905
??? (SCD): 0x3C
??? (SE1): 0x0
??? (SE2): 0x0
??? (SPR): 0x1
#

The result

sm_power20090415

For those interested: the above graph (with the exception of the ‘Showing from […] to […]’ lines) was generated using the following rrdtool command:

rrdtool --imgformat PNG --start "06:00" --end "21:00" --upper-limit 3100 --lower-limit 0 --rigid \
DEF:Pac=/var/lib/rrdtool/solarmax.1.rrd:Pac:AVERAGE \
DEF:Energy=/var/lib/rrdtool/solarmax.2.rrd:energy:AVERAGE \
VDEF:Pac_cur=Pac,LAST \
VDEF:Pac_avg=Pac,AVERAGE \
VDEF:Pac_peak=Pac,MAXIMUM \
CDEF:Pac_Wh=Pac,3600,/ \
VDEF:Eac=Pac_Wh,TOTAL \
VDEF:Eac2=Energy,TOTAL \
"AREA:Pac#0000ff:Pac    " \
"GPRINT:Pac_cur:%6.2lf%sW" \
"COMMENT:\\n" \
"HRULE:Pac_avg#bbbbff:Average" \
"GPRINT:Pac_avg:%6.2lf%sW" \
"COMMENT:\\n" \
"HRULE:Pac_peak#ff0000:Peak   " \
"GPRINT:Pac_peak:%6.2lf%sW" \
"COMMENT:\\n" \
"GPRINT:Eac:int(Pac)   %6.2lf%sWh\\n" \
"GPRINT:Eac2:meas       %6.2lf%sWh\\n" \
--vertical-label "Watt" --title "Power"

The total energy for the day is calculated in two ways: ‘int(Pac)’ uses the sampled power-gauge to calculate the total; ‘meas’ uses the energy-counter of the inverter. The latter one should be more accurate, but can’t be read out with as much precision.

Update 2009-10-09

Chris has made his own variant of the above Perl script:

Hi Niobos,

here we go… find attached to this mail my modification to
your script (a very helpful piece of code :-).

Since i am not the perl-crack i’ve not yet implemented the
command “SYS” and the translation of the returned value
into a readable Operation-State.

At the moment i don’t know how to convert the returned
value i.e. of “SYS=4E24,0” which is 20004,0 in decimal
and means an “Operation at MPP”.

ThX…
Chris

This entry was posted by Niobos on 2009-04-15 at 18:22 under Uncategorized. Tagged , , . You can skip to the end and leave a response. Pinging is currently not allowed. Follow any responses to this entry through the RSS 2.0 feed.

93 Comments

  1. Ho says:

    Hi,

    I’am also reverse-engineering-ing the protocol and commands for my SM3000S.

    So far, I’ve been able to capture the TCP frames between Maxtalk and the inverter and to write some basic utilities which allow me to send commands and read returned values from the inverter.
    I have discovered several other interesting values by means of a brute force utility, namely access to the long term production data : 31 last days, 12 last monthes ands 10 last years and other interesting values.

    What I am after at the present time is the engineer acces code which is asked before you can send manual orders or enter extended set-up in Maxtalk.

    I hope we can share our discoveries !
    You can email me if you prefer. 😉

    Regards,
    A. Ho

    2009-04-18, 14:51

  2. Niobos says:

    Our SolarMax is a 3000C, which only has a serial interface. I didn’t find any reference to TCP or even IP in the manuals. So I’m guessing the 3000S uses a completely different protocol…

    I gather the long term production data simply by checking the current production data every minute and storing this info on the computer.

    2009-04-18, 15:05

  3. Ho says:

    I’m positive in S series, they have just implemented a TCP wrapping around their previous serial protocol.
    I have a document from Sputnik which partially describes the protocol, it’s exactly what you discovered + 😉
    If you have some kind of universal solarmax command sender (ie : something able to form and send a correct request and retrieve the answer), try “DD00” to “DD30”, or “DM00” to “DM11”, or “DY00” to “DY09”

    2009-04-18, 17:05

  4. Niobos says:

    If I add the “DD00” command to my list (in the perl-script that I posted) I get an empty answer back; looks like they added this in the S-series.

    2009-04-18, 17:10

  5. Ho says:

    Arrrggghhh !!
    Quite possible ! 🙁

    The protocol in itself is the same, but they may have added some new commands.
    What about “EC00” to “EC19” the 20 lasts events ?

    Are you able to see the long term stats on the display ?

    2009-04-18, 17:33

  6. Niobos says:

    When I ask the parameters “EC00” I get an empty answer as well…

    The display only shows:
    * Current power, AC and DC voltage, AC and DC current
    * Total energy today, yesterday, this month, last month, this year, last year, total; also total running hours
    * Temperature and fan state
    * Last 3 errors with date and time
    * various settings: minimum and maximum Uac, minimum and maximum frequency, impedance checks, leak checks, …

    2009-04-18, 17:43

  7. Ho says:

    Looks like there is no long term stats, I mean 12 last months for example …
    Too bad !
    Anyway, if you liked to have the document from sputnik, just drop me an email, I’d gladly send it to you ! 😉

    2009-04-18, 18:07

  8. Bruce says:

    Hi,
    have you been able to find out a way to read the past 30 day earnings from a S-Inverter. I tried DD00 but had no luck. Other values I got back.

    Best,
    Bruce

    2009-05-28, 16:40

  9. Yves says:

    hallo,

    I try to communicate with my Solarmax 6000S from VB 2008.
    I can’t get it working with the TcpListener or TcpClient.
    Can someone help me?

    2009-07-16, 18:05

  10. Niobos says:

    Yves,
    I have a 3000C, so I’m unable to assist you. Perhaps Ho will read your comment and answer.

    Some basic troubleshooting tips:
    * Does it work with the official software? If not, start by getting this to work
    * Download Wireshark and see what TCP-traffic is generated by the official software; compare that with the traffic of your VB application. Find the differences and try to correct these to mimic the official application exactly.

    Niobos

    2009-07-16, 19:09

  11. Bruce says:

    Hi Yves,
    that shouldn’t be a problem. But you must send a valid query to the inverter. If for instance the checksum is not correct you won’t get any answer from the inverter. Also be aware that you have to initate the connection and actively query the inverter.

    Best,
    Bruce

    2009-07-21, 14:55

  12. Amaa says:

    Hi, i try to write a little testprog in c#. is there anybody how had same sample code to communicate with solarmax 6000S?

    thx

    2009-10-04, 17:36

  13. Chris says:

    Hey,

    just worked a little bit on the perl script on top of page.
    It gets now some values from my SolarMax 6000S by Ethernet.

    Where/ how to post??

    Chris

    2009-10-08, 16:03

  14. Niobos says:

    Hi,

    Since my code is shared under the Creative Commons license, you may post it wherever you like, as long as you maintain a link back to my blog.
    However, if you mail (niobos at dest-unreach.be) the changed script, I’ll post it on this page.

    Niobos

    2009-10-08, 16:11

  15. Dario Greggio says:

    Hello everybody, interesting thread 🙂

    I’m implementing Communication with a SolarMax 2000C and my domotic system, basically interfacing the internal netwoork to its 485. I got a Document by Solarmax – guess i was happy enough 🙂
    So I guess i can add some info on the above reverse engineering.

    But i’m here to ask “how” can I set an address on my inverter… it’s 255 right now and I can’t find a Menu in order to change it…

    thank you very much!
    Dario

    2009-10-24, 17:46

  16. Niobos says:

    Dario,

    It’s been a while since I researched this, but if I recall correctly, I changed the address on the inverter itself by entering the setup menu. I recommend just going through every menu on the device.

    Niobos

    2009-10-25, 12:01

  17. Dario Greggio says:

    thank you Niobos, unfortunately I’ve already tried this several times…

    There are 4 sub-menus, and i can rotate through them with a long keypress over the button; once in Setup Menu, a short keypress shows me all of the settings, and a long press carries me to the next submenu (again).
    I even tried dbl-click 🙂 with no success.

    Should I push the button at power up?
    (will try now)

    2009-10-25, 12:48

  18. Niobos says:

    Dario,

    Indeed, I just checked it on our SolarMax. I guess I changed the address with the Windows software.
    Is there a reason to change the address from 255?

    Niobos

    2009-10-25, 14:35

  19. Dario Greggio says:

    Oh, I had that feeling 🙂
    That I needed to use the software. I will try downloading it somewhere, but then I’ll also need a 232-485 converter for the PC – right now, as I said, I’m using a little remote I/O board that does 485.

    Yeah, in my opinion 255 is reserved – the doc says it’s “standard unitialized address” so I guess it won’t reply to my commands: I tried a TYP command and get no response, at address 255.

    The packet should be correct, I’m posting it here so maybe you can tell me if there’s anything wrong.

    thank you!

    {FA;FF;16|64:TYP|0489}

    (22 chars)

    2009-10-25, 20:40

  20. Niobos says:

    Dario,

    According to my information, the packet is correct. The only difference is that I use 0xFB as source address for the computer and use RS232 (so the addresses aren’t useful).

    Our SolarMax can also talk RS232, as shown in the diagram in the post. We don’t use a 485 to 232 converter.

    Niobos

    2009-10-26, 12:07

  21. Dario Greggio says:

    ok, many thanks!

    which model of Inverter are you using, by the way?

    2009-10-26, 13:14

  22. Dario Greggio says:

    3000C 🙂 I found it!

    2009-10-27, 9:59

  23. Yves says:

    I have a Solarmax 6000S

    the unit is responding to the next commands
    but i don’t hnow what they mean

    BU1,BU2,BU3,CSU,ENS,ETH,FAN,FID,FRD,IAM,IEA,IED,IEE,IM1,IM2,
    IW1,IW2,IDCP,KFS,KHS,KTS,MDT,PAE,PBC,PDC,PWB,PWF,RCH,RND,SAL,
    SDV,SL1,SL2,SL3,SRD,SRS,TB1,TB2,TCP,THR,TI1,TI2,TL1,TL2,TL3,
    TMI,TSH,TV0..TV9,UGD,UHA,UHD,UI1,UI2,UI3,UM1,UM2,UM3,URH,URL,
    UZK,UDCP

    the other commands where it’s respons to , i hnow what they mean.
    but these command i can not find any reference.

    Can anyone help me ?

    thx

    2009-10-28, 16:35

  24. Greg says:

    Hi,

    I’m trying to setup a samll emeded box to monitor my inverter. I wonder what commands did you use to generate your RRDTool graph ?

    thx in advance for sharing

    2009-12-23, 19:33

  25. Niobos says:

    Greg,

    I added the used RRDtool command to the post, just below the graph. If you need more info, don’t hesitate to ask!

    Niobos

    2009-12-24, 10:37

  26. coldtobi says:

    Hallo, I started solarpowerlog as open source project for having an open source logging progamm for the inverters. Maybe you want to team up?

    Drop me a note!

    http://solarpowerlog.coldtobi.de

    2009-12-29, 17:34

  27. Mr.G! says:

    The protocol is structured as follows:
    STX Src-Add FS Dest-Add FS Length FRS Port US Data FRS Crc ETX

    STX Start of Text; indicates the start of a data packet {
    ETX End of Text; indicates the end of a data packet if no further packets associated with
    this transmission follow }
    FRS Frame Separator; indicates start / end of frame data |
    US Union Separator; separator between unions :
    FS Field Separator; separator for fields within a union ;
    Src-Add Address of the sending device 00 … FF
    Dest-Add Address of the target device 00 … FF
    Length Length of all characters of the data packet 00 … FF
    Crc Sum of the ASCII values of all characters from the address up to and including the
    FRS, before the Crc 0000 … FFFF
    Port Port number for determining the target or the origin of the user data 0 … FFFF
    Data User data,

    The Src-Add field contains the device address of the data packet source. The Dest-Add
    field contains the address of the device for which the data packet is intended. There are
    several predefined addresses which cannot be assigned to SolarMax devices.
    Address (dec) Designation Description
    0 Broadcast The Broadcast address can only occur as a destination address. All devices connected to the
    bus respond to it. It may only be used for point-point connections.
    250 Network master The address of the network master (MaxComm Basic, MaxWeb).
    251 Host The address of an alternative network master that is connected in addition to the network
    master.1)
    252 MaxDisplay Reserved address for large displays with the MaxDisplay interface.
    253 reserved –
    254 reserved –
    255 Uninitialized Default value for non-configured network nodes

    The address range of the MaxComm protocol is 0 (0x00) to 255 (0xFF). Each address
    may only occur once in the network. For SolarMax devices, addresses between 1 and 249
    can be used. In respect of SolarMax devices, the network address is set either via their
    display or a DIP switch.

    AC output PAC Power
    Operating hours KHR
    Date year DYR
    Date month DMT
    Date day DDY
    Energy year KYR
    Energy month KMT
    Energy day KDY
    Energy total KT0
    Installed capacity PIN
    Mains cycle duration TNP
    Network address ADR
    Relative output PRL
    Software version SWV
    Solar energy year RYR
    Solar energy day RDY
    Solar energy total RT0
    Solar radiation RAD
    Voltage DC UDC
    Voltage phase 1 UL1
    Voltage phase 2 UL2
    Voltage phase 3 UL3
    Current DC IDC
    Current phase 1 IL1
    Current phase 2 IL2
    Current phase 3 IL3
    Temperature power unit 1 TKK
    Temperature power unit 2 TK2
    Temperature power unit 3 TK3
    Temperature solar cells TSZ
    Type Type
    Time minute TMI
    Time hour THR

    The TYPE key provides a value for identifying the device type associated with a network
    node. The following values are currently defined:
    Device type TYPE (dec)
    SolarMax 2000 E 2001
    SolarMax 20C 20
    MaxMeteo 10210
    SolarMax 3000 E 3001
    SolarMax 25C 25
    MaxCount 10300
    SolarMax 4000 E 4000
    SolarMax 30C 30
    SolarMax 6000 E 6000
    SolarMax 35C 35
    SolarMax 2000C 2010
    SolarMax 50C 50
    SolarMax 3000C 3010
    SolarMax 80C 80
    SolarMax 4000C 4010
    SolarMax 100C 100
    SolarMax 4200C 4200
    SolarMax 300C 300
    SolarMax 6000 C 6010
    SolarMax 20S 20100
    SolarMax 2000 S 20010
    SolarMax 35S 20110
    SolarMax 3000 S 20020
    SolarMax 4200 S 20030
    SolarMax 6000 S 20040
    SolarMax 6000C 6010

    2010-01-03, 1:07

  28. jvergara says:

    Good evening,

    I write because I have to ask for information to a device for SolarMax MaxConnect. http://www.solarmax.com/pub/download.php?file=317

    What command is this device? I know that offers 16 values from the string 1 to string 16 …… What words should I order?

    2010-02-08, 16:16

  29. Niobos says:

    Hi jvergara,
    I don’t understand your question. This post only describes what I figured out about the protocol used by the SolarMax Invertor. It’s likely that the MaxConnect uses the same protocol, but I don’t know this for sure.
    I’d advise you to start from a working setup (in my case, I used the provided Windows software) and sniff the wire. This will probably get you a list of valid commands. The meaning of these commands is guesswork.

    Niobos

    2010-02-08, 16:22

  30. Covex says:

    I am using Chriss’ perl version on SolarMax 2000S thru Ethernet and it is working OK. Sometimes I get
    Exiting subroutine via next at ./solarmax.pl line 214.
    Exiting subroutine via next at ./solarmax.pl line 214.
    Can’t “next” outside a loop block at ./solarmax.pl line 214.
    and it is not yet clear to me why. This mainly happens in time when inverter is wakeing up.

    2010-02-15, 9:37

  31. Poul-Henning Kamp says:

    Those of you who have received documentation from Sputnik:

    Can you share the documents with us, or if they are confidential, tell us the title of the documents and what kind of restrictions Sputnik put on them, so we can ask for a copy ourselves ?

    Thanks in advance,

    Poul-Henning

    phk (a) FreeBSD (o) ORG

    2010-03-14, 20:58

  32. Kai says:

    Can someone please post the script that uses Ethernet rather than RS232?

    Thanks,
    Kai

    2010-03-17, 9:24

  33. steve says:

    hi!

    i try out chris’ perl script on my 6000S over ethernet and get the same error as covex.
    ————-
    Timeout
    Exiting subroutine via next at ./solarmax.pl line 214.
    Exiting subroutine via next at ./solarmax.pl line 214.
    Can’t “next” outside a loop block at ./solarmax.pl line 214.
    ————-

    2010-03-30, 18:08

  34. jvergara says:

    I have a question. What a inverter returns if I ask something that has not? I believe that returns a byte with a blank space. Is it normal? Do you happened?

    2010-04-14, 15:00

  35. Marc says:

    Hello there,

    nice job. But do you also have a description of the errors that can occur in the invertor?
    Thx,

    Marc

    2010-04-17, 8:48

  36. Niobos says:

    jvergara,

    It just ignores that question if it doesn’t know what you’re asking:
    > {FB;05;17|64:EC00|044F}
    2010-04-26, 18:20

  37. Niobos says:

    Marc,

    No, I don’t have the error descriptions…

    Niobos

    2010-04-26, 18:21

  38. Dusan says:

    Hi Ho,

    I am able to communicate with 6000S. Can you send me the document from sputnik to get all available commands ?

    2010-05-13, 2:16

  39. Niobos says:

    Dusan,

    The only documents I have are available as download in the post above. I don’t have a document describing the commands; the perl-script contains a list of commands I reverse-engineered for my 3000C, maybe you can start from there.

    Niobos

    2010-05-14, 10:03

  40. Dusan says:

    Niobos,

    I can’t see a downloadable link. Am I missing st ?
    Probably I will sniff MaxTalk communication.
    Does anyone communicate with MaxConnect ?

    2010-05-17, 16:19

  41. Niobos says:

    Dusan,

    It’s in the 3rd paragraph: “pinout diagram” and “document”; the perl-script is right above the long console output.

    Niobos

    2010-05-17, 16:26

  42. HO says:

    Here is a list of errors and status codes that Maxtalk understands and translates to human reading form.
    Some are not implemented in all inverters, MT can speak to different models …
    It was obtained by brute force answering, ie: yes, having MT query a solarmax inverter simulator of my own !

    Sorry, they are in French but online translators could help.

    SYS

    * 20001,0 En service
    * 20002,0 Rayonnement trop faible
    * 20003,0 Démarrer
    * 20004,0 Exploitation MPP
    * 20005,0 Ventilateur tourne
    * 20006,0 Exploitation Puissance max
    * 20007,0 Limitation température
    * 20008,0 Sur secteur
    * 20009,0 Courant DC limité
    * 20010,0 Courant AC limité
    * 20011,0 Mode test
    * 20012,0 Télécommandé
    * 20013,0 Retard au démarrage

    * 20110,0 Tension cct interm. trop élevée
    * 20111,0 Surtension
    * 20112,0 Surcharge
    * 20114,0 Courant de fuite trop élevé
    * 20115,0 Pas de secteur
    * 20116,0 Fréq. secteur trop élevée
    * 20117,0 Fréq. secteur trop basse
    * 20118,0 Fonctionnement en îlot
    * 20119,0 Mauvaise qualité du secteur
    * 20122,0 Tension secteur trop élevée
    * 20123,0 Tension secteur trop basse
    * 20124,0 Température trop élevée
    * 20125,0 Courant secteur dissym.
    * 20126,0 Erreur entrée ext. 1
    * 20127,0 Erreur entrée ext. 2
    * 20129,0 Sens de rotation incorrect
    * 20130,0 Faux type d’appareil
    * 20131,0 Commut. général hors
    * 20132,0 Diode de surtempérature
    * 20134,0 Ventilateur défectueux

    SAL Ces codes sont en binaire bit par bit. Si plusieurs bits sont présents, les alarmes se combinent
    These codes are binary per bit. If more than one bit is set, alarms combine.

    Exemple : SAL=9 (8 + 1) => Alarme externe 1, Rupture fusible de la terre centrale

    * 0 = OK
    * 1 = Alarme externe 1
    * 2 = Erreur d’isolation côté DC
    * 4 = Courant fuite de terre top élevé
    * 8 = Rupture fusible de la terre centrale
    * 16 = Alarme externe 2
    * 32 = Limitation température longue
    * 64 = Erreur d’alimentation AC
    * 128 = Alarme externe 4
    * 256 = Ventilateur défectueux
    * 512 = Rupture de fusible
    * 1024 = Panne du capteur temp.
    * 2048 = Alarm 12
    * …
    * 65536 = Alarm 17

    Je me suis arrêté là …
    I stopped here …

    2010-05-22, 11:14

  43. HO says:

    > Can you send me the document from sputnik to get all available commands ?
    2010-05-13, 2:16
    Ask the hotline, they will provide you with a basic protocol description, including a set of the most important commands. That’s a good start 😉

    2010-05-22, 18:27

  44. André says:

    Hi,

    I have made a little script to show my solar production.

    Here you have the source, it needs Perl and Zenity under linux (only) :
    H*t*t*p :// mystercoco.free.fr/opensource/photovoltaique/maxtalk_linux

    It works on my installation but I don’t know it it’s generic or not.

    If you have some suggestion or code to add, email me at mystercoco@gmail.com

    2010-10-02, 18:53

  45. ZZ says:

    Hi Niobos,
    can I ask you something about coding of various variables? You have written that you have obtained packet

    > {05;FB;59|64:CAC=1F3E;KHR=26D6;KDY=8E;KMT=8D;KYR=221;KT0=18C7;KLD=78;KLM=F8;
    > KLY=A8F|154C}

    After that you have written that means:
    KHR = 9953
    KDY = 12900
    KMT = 154
    KYR = 558
    KTO = 6356
    KLD = 14200

    I have thought that all variables are displayed in hex code in packet. If yes, I think there should be:

    KHR = 9942
    KDY = 142
    KMT = 141
    KYR = 545
    KTO = 6343
    KLD = 120

    Am I wrong? If yes, can somebody tell me where? How to decode these variables?
    Thank you very much for answers.

    2010-10-25, 15:17

  46. Niobos says:

    Hi ZZ,

    Wow, you really did read my post very thoroughly, thanks! I see why you are confused: I didn’t use the same input for the verbatim message-dump and for the parsed output, but I agree that it’s not clearly marked as such.

    You are right that the message contains the values in hex, so your decoding is probably correct (I didn’t check them, though)

    Niobos

    2010-10-25, 15:41

  47. ZZ says:

    Yeah, I’ve tried 🙂 I’d like to create a SW for my PLC with this protocol and presently I don’t have a chance to try it on real HW 🙁 I have only a few packets which have been captured on RS485. But now I have to resolve another problem. I’ve caught these two packets:

    Request:
    {FA;65;6B|64:SM00;SM01;SM02;SM03;SM04;SM05;SM06;SM07;SM08;SM09;SM0A;SM0B;SM0C;SM0D;
    SM0E;SM0F;MCSY;SYS|1A44}

    Answer:
    {65;FA;FA|64:SM00=E6,1D5,1725,D4BC,D517,3E8,1,0,0;SM01=122,235,1937,DD45,DDBF,3E8,1,0,0;
    SM02=F0,1D2,16F6,D6BF,D725,3E8,1,0,0;SM03=118,232,18C4,D035,D095,3E8,1,0,0;
    SM04=10E,21D,17B3,C480,C4C9,3E8,1,0,0;SM05=118,237,18F8,D49F,D50E,3E8,1,0,0;SM06=|34FA)
    {65;FA;F4|122,23B,1928,D67E,D6EE,3E8,1,0,0;SM07=118,22B,1885,CF43,CF99,3E8,1,0,0;
    SM08=118,221,17DE,C64A,C68C,3E8,1,0,0;SM09=10E,209,17A7,C76A,C7B8,3E8,1,0,0;
    SM0A=10E,20C,182A,D12F,D18D,3E8,1,0,0;SM0B=118,230,1892,CC68,CCBA,3E8,1,0,0;SM0C=|33D6)
    {65;FA;DA|118,225,1872,CFCD,D032,3E8,1,0,0;SM0D=118,22F,1898,CCC2,CD20,3E8,1,0,0;
    SM0E=118,225,183E,CEF1,CF45,3E8,1,0,0;SM0F=FA,200,1737,CAFB,CB52,3E8,1,0,0;
    MCSY=1108,21A7,832E,CF99B,CFF62,3E80,FFFF,0,0;SYS=5209,0|2EF2}

    Does anybbody know the meaning of these parameters?? (SM00;SM01;SM02;SM03;SM04;SM05;SM06;SM07;SM08;SM09;SM0A;SM0B;SM0C;SM0D;SM0E;SM0F;MCSY;
    SYS)

    Thanks a lot for any information.

    2010-10-26, 11:51

  48. lasser says:

    Hi there!
    Last days I tried to figure out what some answers of my Solarmax 6000S mean. I requested e.g. DD00 and DM05:
    DD00=7DB0111,3C,2002,30
    DM05=7DA0800,1168,2ED6,DD6

    The first two values are clear: date (7DB=2011, 01=january, 11=17th) and energy. But what the heck do the other ones mean? Can’t find a solution, do you know more?

    greetings from Germany

    2011-01-18, 10:03

  49. yves wuytens says:

    DD00 ansers : date,total watt,piek watt,houres sunshine , all on day base
    DM05 ansers : idem on month base

    2011-01-18, 19:41

  50. junkete says:

    Hi. I’m trying to connect to a SolarMAX 3000S using directly RS-232 port on the computer. My problem is that I can’t create the complete message because I don’t know how the CRC number is created. Can anyone help me? How is the algorithm of the checksum?
    Thanks in advance.

    J.

    2011-02-08, 12:15