Eg4 6500ex and mpp Solar lv6548

[3congithub]

Few notes that may help others dealing with Eg4 6500ex and mpp Solar lv6548 inverters:

1. Use pi30max protocol
2. QPGS command produced inaccurate battery capacity and pv voltage readings. QPIGS and QPIGS2 data are better.
3. Use usb-rs232 cable along with RJ45 cable that came with inverters.

Best of luck.

[RoySalisbury]

I have the EG4 6500EX and was just doing some query tests with some software I wrote (C# on Linux). Of all the "get" commands I could find, here are the results (not parsed yet). Not all work, and event though it says PI30, some of the PI30MAX commands work.

Request: QPI		Reply: (PI30
Request: QID		Reply: (96342203102010
Request: QSID		Reply: (1496342203102010005535
Request: QVFW		Reply: (VERFW:00079.02
Request: QVFW2		Reply: (NAK
Request: QVFW3		Reply: (VERFW:00061.00
Request: VERFW		Reply: (NAK
Request: QPIRI		Reply: (120.0 54.1 120.0 60.0 54.1 6500 6500 48.0 46.0 44.0 58.0 56.2 2 030 100 0 0 2 9 01 0 0 56.0 0 1 480 0 000
Request: QFLAG		Reply: (EuvxyzDabjk
Request: QPIGS		Reply: (000.0 00.0 119.7 60.0 0855 0703 013 367 52.50 000 083 0033 00.0 000.0 00.00 00016 00010000 00 00 00000 010
Request: QMOD		Reply: (B
Request: QPIWS		Reply: (100001000000000001000000000000000000
Request: QDI		Reply: (120.0 60.0 0030 44.0 54.0 56.4 46.0 60 0 0 2 0 0 0 0 0 1 1 1 0 1 0 54.0 0 1 224
Request: QMCHGCR	Reply: (010 020 030 040 050 060 070 080 090 100 110 120
Request: QMUCHGCR	Reply: (002 010 020 030 040 050 060 070 080 090 100 110 120
Request: QOPPT		Reply: (0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
Request: QCHPT		Reply: (2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 0 0 0
Request: QT		Reply: (20180726071651
Request: QMN		Reply: (MKS2-6500
Request: QGMN		Reply: (045
Request: QBEQI		Reply: (0 060 030 100 030 58.40 224 120 0 0000
Request: QET		Reply: (01348200
Request: QEY		Reply: (NAK
Request: QEM		Reply: (NAK
Request: QED		Reply: (NAK
Request: QLT		Reply: (01053400
Request: QLY		Reply: (NAK
Request: QLM		Reply: (NAK
Request: QLD		Reply: (NAK
Request: QLED		Reply: (1 1 2 5 3 148000211255255255000255255
Request: Q1		Reply: (00001 16971 01 00 00 026 033 022 029 02 00 000 0036 0000 0000 00.00 10 0 060 030 100 030 58.40 000 120 0 0000
Request: QBOOT		Reply: (NAK
Request: QOPM		Reply: (NAK
Request: QBV		Reply: (NAK
Request: QPGS0		Reply: (0 96342203102010 B 00 000.0 00.00 119.6 60.00 0787 0640 012 52.5 000 083 000.0 000 00787 00640 009 00000110 0 2 100 120 030 00 015 000.0 00
Request: QPGS1		Reply: (0 96342203102010 B 00 000.0 00.00 120.1 60.00 1060 0873 016 52.4 000 082 000.0 000 01060 00873 013 00000110 0 2 100 120 030 00 013 000.0 00
Request: QBV		Reply: (NAK
Request: QDOP		Reply: (0 0 0 0 00.0 00.0 000 00 010 030 000 000 00 00

[jblance]

nice
note the qey will need a year, eg QEY2022, qem needs year and month and qed needs year,month and day - so they may still work (ditto for qly,m,d

[BobbyCannon]

Could you share this script? I'm trying to query a EG4 6000EX-48HV and can only get Q1 to work.

[BobbyCannon]

I'm working on a C# script to query and finding that only Q1 seems to work. Here is my post on it. #309

[BobbyCannon]

Maybe I should ask a specific question.

I noticed that Q1 will not work unless I add the CRC-XMODEM in the query. If I only do "Q1\r" that's not enough. Doing "Q1\x1B\xFC\r" does.

I've tried with and without on other commands like "QPI" and "QID" but neither seem to work. With or without CRC-XMODEM value.

[RoySalisbury]

Ahhhh ... OK... Makes sense. A few of them I found by using a USB sniffer with Watchpower on Windows. Like QDOP ... Cant find any reference to that anywhere.

[jblance]

Yeah documentation and consistency are not a strong point for these inverters Pi30max protocol reports as pi30 but has a different set of command responses compared to pi30. It would have been nice if they'd actually changed the protocol id when they changed the protocols... If you find new commands and figure out the response it would be great to know so it can be included for anyone else that may want to use it

…

On Sat, 24 Dec 2022, 6:25 pm Roy Salisbury, ***@***.***> wrote: Ahhhh ... OK... Makes sense. A few of them I found by using a USB sniffer with Watchpower on Windows. Like QDOP ... Cant find any reference to that anywhere. — Reply to this email directly, view it on GitHub <#284 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJVKNUSSWB5NCBSFCBUWMLWO2CMZANCNFSM6AAAAAATGIOSHY> . You are receiving this because you commented.Message ID: ***@***.***>

[RoySalisbury]

Thats is one of the reasons I posted my output for the inverter here. I figured they may differer from others and you could perhaps use the QMN and QGMN to help in parsing the right structures.

Roy

[RoySalisbury]

I'm also finding some intresting "gotchas" with reading/writing the data. It seems (on Debian Linux using hidraw and C#) that its very particular in how the data packets are sent.

Since the underlying protocol in hidraw is actually to a HID device, things have to be sent in the correct size packet chunks (9 in this case). If not, then an incomplete packet will cause a read/write deadlock. But if you have a packet of say 12 bytes to send, you can send the first 9, flush the buffers, then send the next 3 and flush the buffer again. It likes that.

[jblance]

Yeah it's possible though a bit hard to collect all thebl data I should write a getId command that runs a bunch of the possible identifying commands and builds an ID that could be used for selecting which protocol to use.... hmm gotta think about that one

…

On Sat, 24 Dec 2022, 6:38 pm Roy Salisbury, ***@***.***> wrote: Thats is one of the reasons I posted my output for the inverter here. I figured they may differer from others and you could perhaps use the QMN and QGMN to help in parsing the right structures. Roy — Reply to this email directly, view it on GitHub <#284 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJVKNVXN5VFYSRXMGIXJ53WO2D53ANCNFSM6AAAAAATGIOSHY> . You are receiving this because you commented.Message ID: ***@***.***>

[jblance]

Yeah that's a bit that is causing a problem at the moment. The hidraw code is wrong or buggy at the moment

…

On Sat, 24 Dec 2022, 6:44 pm Roy Salisbury, ***@***.***> wrote: I'm also finding some intresting "gotchas" with reading/writing the data. It seems (on Debian Linux using hidraw and C#) that its very particular in how the data packets are sent. Since the underlying protocol in hidraw is actually to a HID device, things have to be sent in the correct size packet chunks (9 in this case). If not, then an incomplete packet will cause a read/write deadlock. But if you have a packet of say 12 bytes to send, you can send the first 9, flush the buffers, then send the next 3 and flush the buffer again. It likes that. — Reply to this email directly, view it on GitHub <#284 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJVKNSPVD5EDTSNDFU4JBTWO2EUDANCNFSM6AAAAAATGIOSHY> . You are receiving this because you commented.Message ID: ***@***.***>

[RoySalisbury]

I started out on windows using direct USB HID access. That was a nightmare. But now that I understand the hidraw stuff a bit more, I may take another crack at it. I've written my code to have the communications easily abstracted out (USB, serial, file, ect).

Actually with the BMS stuff was this easy :) (relatively speaking of course).

[jblance]

Yeah that's what I tried to do too. I still ended up needing to refactor multiple times...

…

On Sat, 24 Dec 2022, 6:54 pm Roy Salisbury, ***@***.***> wrote: I started out on windows using direct USB HID access. That was a nightmare. But now that I understand the hidraw stuff a bit more, I may take another crack at it. I've written my code to have the communications easily abstracted out (USB, serial, file, ect). Actually with the BMS stuff was this easy :) (relatively speaking of course). — Reply to this email directly, view it on GitHub <#284 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAJVKNTAKYRRTNSJDMWCL5DWO2FXXANCNFSM6AAAAAATGIOSHY> . You are receiving this because you commented.Message ID: ***@***.***>

[RoySalisbury]

Just realized that my date on my inverter is wrong ... LOL... And watchpower wont let me set it without error. Guess that will be my first setting command to send.

Request: QET		Reply: (01348200
Request: QEY2018	Reply: (01348200
Request: QEM201807	Reply: (00337700
Request: QED20180710	Reply: (00011903
Request: QLT		Reply: (01054100
Request: QLY2018	Reply: (01054100
Request: QLM201807	Reply: (00277800
Request: QLD20180710	Reply: (00003339

[RoySalisbury]

Well, not just a Watchpower thing. I cant set the date/time on this device using the protocol. I have tried every combination I can think of:

DAT<YYYYMMDDHHMMSS><CR>
DAT<YYMMDDHHMMSS><CR>
DAT<YYYYMMDDHHMMSS><CRC><CR>
DAT<YYMMDDHHMMSS><CRC><CR>

Its always either a NAK or writing to hidraw crashes.

I have tried it under Linux, Mac and Windows.

Next time I am able, I will hook up the actual serial interface to the inverter and try RS232. If I have to have a cable, either one is fine, and serial would bypass the HID interface (I hope).

Roy

[Saentist]

If enabled debugging on WatchPower you can see all command used to get/set in log folder
http://ftps.voltronic.com.tw/V/ViewPower-C76A89B88C10454AA513/WatchPower/ latest version of WatchPower
in parent folder more interesting factory software

[RoySalisbury]

Intresting.....

I have found the following difference in serial vs hidraw (C# code)....

var command = $"DAT{date.Value:yy}{date.Value.Month:00}{date.Value.Day:00}{date.Value.Hour:00}{date.Value.Minute:00}{date.Value.Second:00}";

// ACK. Works for Serial [ttyUSB00] (no reportId, include CRC)
var request = GenerateGetRequest(command, includeReportId: false, includeCrc: true);

// NAK, but does not crash HID [hidraw1] (include reportId, NO CRC )
var request = GenerateGetRequest(command, includeReportId: true, includeCrc: false);

[RoySalisbury]

Also, I have watched a few videos on youtube about decompiling and understanding firmware files. If you know what your doing, you can almost reconstruct a "readable" version based on specific ASM calls (JMP commands or something). Its been a LONG time since I dealt was ASM. :)

[Saentist]

See this series on YouTube
it's no so easy to reconstruct code because there is a another one part in internal sensors

Analyze with binwalk output interesting Texas Instruments code

[jblance]

Intresting.....

I have found the following difference in serial vs hidraw (C# code)....

var command = $"DAT{date.Value:yy}{date.Value.Month:00}{date.Value.Day:00}{date.Value.Hour:00}{date.Value.Minute:00}{date.Value.Second:00}";

// ACK. Works for Serial [ttyUSB00] (no reportId, include CRC)
var request = GenerateGetRequest(command, includeReportId: false, includeCrc: true);

// NAK, but does not crash HID [hidraw1] (include reportId, NO CRC )
var request = GenerateGetRequest(command, includeReportId: true, includeCrc: false);

what is reportId?

[RoySalisbury]

The code was written initially using the direct HID API calls. During that I discovered the the actual packets that were sent needed to be pre-fixed with the reportId of the HID subreport being requested. For this, its always 0. So thats why the first byte of each packet is 0. This was verified using an analyzer on Windows that spied on the USB traffic when Watchpower was running.

Roy

[3congithub]

John,

I noted that QPIGS in PI30REVO produces daily_power_generated but not with PI30MAX protocol on my LV6500 inverters. Is there an easy way to add this daily_power_generated info for PI30MAX? Thanks

[jblance]

does the QPIGS from PI30REVO work on your inverter? Remember you can any specify any protocol you want - it might not work tho

[3congithub]

Yes PI30REVO works on my inverters however I loose other info such as PV1 and 2 separation.

[jblance]

can you post the debug of QPIGS from PI30REVO and PI30MAX

[3congithub]

pi@raspberrypi:~ $ mpp-solar -P PI30max -c QPIGS -I

2023-01-16 01:06:25,419:INFO:__init__:main@218: Solar Device Command Utility, version: 0.14.12
2023-01-16 01:06:25,420:INFO:__init__:main@347: Creating device "unnamed" (type: "mppsolar") on port "/dev/ttyUSB0 (porttype=None)" using protocol "PI30max"
2023-01-16 01:06:25,433:INFO:__init__:get_port@112: Using serialio for communications
2023-01-16 01:06:25,472:INFO:pi30max:__init__@968: Using protocol b'PI30MAX' with 61 commands
2023-01-16 01:06:25,474:INFO:__init__:main@404: Looping 1 commands
2023-01-16 01:06:25,474:INFO:__init__:main@414: Getting results from device: mppsolar device - name: unnamed, port: <mppsolar.inout.serialio.SerialIO object at 0x7f87695880>, protocol: PI30 protocol handler for LV6048MAX and similar inverters for command: QPIGS, tag: QPIGS, outputs: screen
2023-01-16 01:06:25,475:INFO:device:run_command@274: Running command QPIGS
2023-01-16 01:06:25,476:INFO:abstractprotocol:get_full_command@55: Using protocol b'PI30MAX' with 61 commands
2023-01-16 01:06:25,477:INFO:device:run_command@303: full command b'QPIGS\xb7\xa9\r' for command QPIGS
2023-01-16 01:06:26,039:INFO:abstractprotocol:decode@208: response passed to decode: b'(124.0 60.0 120.0 60.0 0168 0120 002 363 51.80 000 050 0041 00.0 000.0 00.00 00002 00010000 00 00 00000 010\xdaU\r'
2023-01-16 01:06:26,042:INFO:abstractprotocol:decode@250: Processing response of type DEFAULT
2023-01-16 01:06:26,043:INFO:abstractprotocol:decode@261: Processing DEFAULT type responses
2023-01-16 01:06:26,044:INFO:device:run_command@341: Decoded response {'raw_response': ['(124.0 60.0 120.0 60.0 0168 0120 002 363 51.80 000 050 0041 00.0 000.0 00.00 00002 00010000 00 00 00000 010ÚU\r', ''], '_command': 'QPIGS', '_command_description': 'General Status Parameters inquiry', 'AC Input Voltage': [124.0, 'V'], 'AC Input Frequency': [60.0, 'Hz'], 'AC Output Voltage': [120.0, 'V'], 'AC Output Frequency': [60.0, 'Hz'], 'AC Output Apparent Power': [168, 'VA'], 'AC Output Active Power': [120, 'W'], 'AC Output Load': [2, '%'], 'BUS Voltage': [363, 'V'], 'Battery Voltage': [51.8, 'V'], 'Battery Charging Current': [0, 'A'], 'Battery Capacity': [50, '%'], 'Inverter Heat Sink Temperature': [41, '°C'], 'PV1 Input Current': [0.0, 'A'], 'PV1 Input Voltage': [0.0, 'V'], 'Battery Voltage from SCC': [0.0, 'V'], 'Battery Discharge Current': [2, 'A'], 'Is SBU Priority Version Added': [0, 'bool'], 'Is Configuration Changed': [0, 'bool'], 'Is SCC Firmware Updated': [0, 'bool'], 'Is Load On': [1, 'bool'], 'Is Battery Voltage to Steady While Charging': [0, 'bool'], 'Is Charging On': [0, 'bool'], 'Is SCC Charging On': [0, 'bool'], 'Is AC Charging On': [0, 'bool'], 'Battery Voltage Offset for Fans On': [0, '10mV'], 'EEPROM Version': [0, ''], 'PV1 Charging Power': [0, 'W'], 'Is Charging to Float': [0, 'bool'], 'Is Switched On': [1, 'bool'], 'Is Dustproof Installed': [0, 'bool']}
2023-01-16 01:06:26,045:INFO:__init__:get_output@38: attempting to create output processor: screen
2023-01-16 01:06:26,051:INFO:screen:output@19: Using output processor: screen
Command: QPIGS - General Status Parameters inquiry
------------------------------------------------------------
Parameter                       Value           Unit
ac_input_voltage                124.0           V
ac_input_frequency              60.0            Hz
ac_output_voltage               120.0           V
ac_output_frequency             60.0            Hz
ac_output_apparent_power        168             VA
ac_output_active_power          120             W
ac_output_load                  2               %
bus_voltage                     363             V
battery_voltage                 51.8            V
battery_charging_current        0               A
battery_capacity                50              %
inverter_heat_sink_temperature  41              °C
pv1_input_current               0.0             A
pv1_input_voltage               0.0             V
battery_voltage_from_scc        0.0             V
battery_discharge_current       2               A
is_sbu_priority_version_added   0               bool
is_configuration_changed        0               bool
is_scc_firmware_updated         0               bool
is_load_on                      1               bool
is_battery_voltage_to_steady_while_charging     0               bool
is_charging_on                  0               bool
is_scc_charging_on              0               bool
is_ac_charging_on               0               bool
battery_voltage_offset_for_fans_on      0               10mV
eeprom_version                  0
pv1_charging_power              0               W
is_charging_to_float            0               bool
is_switched_on                  1               bool
is_dustproof_installed          0               bool

[3congithub]

pi@raspberrypi:~ $ mpp-solar -P PI30REVO -c QPIGS -I

2023-01-16 01:08:23,426:INFO:__init__:main@218: Solar Device Command Utility, version: 0.14.12
2023-01-16 01:08:23,427:INFO:__init__:main@347: Creating device "unnamed" (type: "mppsolar") on port "/dev/ttyUSB0 (porttype=None)" using protocol "PI30REVO"
2023-01-16 01:08:23,439:INFO:__init__:get_port@112: Using serialio for communications
2023-01-16 01:08:23,473:INFO:__init__:main@404: Looping 1 commands
2023-01-16 01:08:23,474:INFO:__init__:main@414: Getting results from device: mppsolar device - name: unnamed, port: <mppsolar.inout.serialio.SerialIO object at 0x7f91d7b880>, protocol: PI30 protocol handler for REVO and similar inverters for command: QPIGS, tag: QPIGS, outputs: screen
2023-01-16 01:08:23,474:INFO:device:run_command@274: Running command QPIGS
2023-01-16 01:08:23,475:INFO:pi30revo:get_full_command@397: sing protocol b'PI30REVO' with 6 commands
2023-01-16 01:08:23,476:INFO:device:run_command@303: full command b'QPIGS\xb7\xa9\r' for command QPIGS
2023-01-16 01:08:24,039:INFO:abstractprotocol:decode@208: response passed to decode: b'(124.0 60.0 120.1 60.0 0168 0126 002 364 51.80 000 050 0041 00.0 000.0 00.00 00002 00010000 00 00 00000 0102`\r'
2023-01-16 01:08:24,042:INFO:abstractprotocol:decode@250: Processing response of type DEFAULT
2023-01-16 01:08:24,043:INFO:abstractprotocol:decode@261: Processing DEFAULT type responses
2023-01-16 01:08:24,044:INFO:device:run_command@341: Decoded response {'raw_response': ['(124.0 60.0 120.1 60.0 0168 0126 002 364 51.80 000 050 0041 00.0 000.0 00.00 00002 00010000 00 00 00000 0102`\r', ''], '_command': 'QPIGS', '_command_description': 'General Status Parameters inquiry', 'AC Input Voltage': [124.0, 'V'], 'AC Input Frequency': [60.0, 'Hz'], 'AC Output Voltage': [120.1, 'V'], 'AC Output Frequency': [60.0, 'Hz'], 'AC Output Apparent Power': [168, 'VA'], 'AC Output Active Power': [126, 'W'], 'AC Output Load': [2, '%'], 'BUS Voltage': [364, 'V'], 'Battery Voltage': [51.8, 'V'], 'Battery Charging Current': [0, 'A'], 'Battery Capacity': [50, '%'], 'Inverter Heat Sink Temperature': [41, '°C'], 'PV Power': [0.0, 'W'], 'PV Input Voltage': [0.0, 'V'], 'Battery Voltage from SCC': [0.0, 'V'], 'Daily Power Generated': [2, 'WH'], 'Is SBU Priority Version Added': [0, 'bool'], 'Is Configuration Changed': [0, 'bool'], 'Is SCC Firmware Updated': [0, 'bool'], 'Is Load On': [1, 'bool'], 'Is Battery Voltage to Steady While Charging': [0, 'bool'], 'Is Charging On': [0, 'bool'], 'Is SCC Charging On': [0, 'bool'], 'Is AC Charging On': [0, 'bool'], 'RSV1': [0, 'A'], 'RSV2': [0, 'A'], 'PV Input Power': [0, 'W'], 'Is Charging to Float': [0, 'bool'], 'Is Switched On': [1, 'bool'], 'Is Reserved': [0, 'bool']}
2023-01-16 01:08:24,045:INFO:__init__:get_output@38: attempting to create output processor: screen
2023-01-16 01:08:24,050:INFO:screen:output@19: Using output processor: screen
Command: QPIGS - General Status Parameters inquiry
------------------------------------------------------------
Parameter                       Value           Unit
ac_input_voltage                124.0           V
ac_input_frequency              60.0            Hz
ac_output_voltage               120.1           V
ac_output_frequency             60.0            Hz
ac_output_apparent_power        168             VA
ac_output_active_power          126             W
ac_output_load                  2               %
bus_voltage                     364             V
battery_voltage                 51.8            V
battery_charging_current        0               A
battery_capacity                50              %
inverter_heat_sink_temperature  41              °C
pv_power                        0.0             W
pv_input_voltage                0.0             V
battery_voltage_from_scc        0.0             V
daily_power_generated           2               WH
is_sbu_priority_version_added   0               bool
is_configuration_changed        0               bool
is_scc_firmware_updated         0               bool
is_load_on                      1               bool
is_battery_voltage_to_steady_while_charging     0               bool
is_charging_on                  0               bool
is_scc_charging_on              0               bool
is_ac_charging_on               0               bool
rsv1                            0               A
rsv2                            0               A
pv_input_power                  0               W
is_charging_to_float            0               bool
is_switched_on                  1               bool
is_reserved                     0               bool

[3congithub]

It's not too sunny today but yes 2 wh seems wrong. Is there anyway to get the daily power from my inverters? The PI30max produces most of the data I needed to see. Daily power PV sum would be great.

[jblance]

The is a QED command that displays PV energy by the day, format is QEDyyyymmdd. eg QED20230115
See if your inverter responds to that command

[3congithub]

Yes QED with current date works great.

[jblance]

excellent
next youre going to want a way of asking for today without changing the command...

[3congithub]

I would but have seen your conversation with Roy and others so aware that solution is not available.