Featured in this blog is a tear down of the EPSolar MT-5. The aim of the tear down was to assist in determining the communication protocol between the
MT-5 display and main EPSolar MPPT unit.
Hardware
Although the Tracer MPPT and display models shown below are no longer sold by EPSolar, there were still numerous re-seller sites with stocks which raised my interest in using one for garden lighting control. This would require manual control of the load output.
 |
| EPSolar - Tracer MPPT Module |
There are more than a dozen sites with example code for the communications however none of it is complete. In order to determine the protocol the only two methods that came to mind were connecting with the EPSolar PC Monitoring software or monitoring the communications between the MPPT and display. The latter of the two methods was used.
MT-5 Teardown
The MT-5 from the rear appeared as a sealed unit, so removing the front window (lexan) was the first step to gain access.
After the window was removed, there were four screws to retain the main board and a few melted plastic posts to hold a secondary board containing the buttons.
After removing the boards both the main microcontroller ST - STM8S903K and LCD driver from Holtek - HT1621 were visible on the rear of the board. On the top side of the board was the LCD and LED light box serving as the LCD backlight.
 |
| EPSolar MT-5 with front cover removed |
After the window was removed, there were four screws to retain the main board and a few melted plastic posts to hold a secondary board containing the buttons.
 |
| EPSolar MT-5 PCB |
After removing the boards both the main microcontroller ST - STM8S903K and LCD driver from Holtek - HT1621 were visible on the rear of the board. On the top side of the board was the LCD and LED light box serving as the LCD backlight.
MT-5 Protocol
Initial documentation for the EPSolar communications protocol was reviewed from Steve Pomeroy, John Geek and a document site with concise documentation by Marc Dilasser.
Validation of the CRC16 was made using a site from Bastian Molkenthin.
MT-5 Hardware
To determine the protocol, a test system consisting of an MPPT connected to an MT-5 display with a pair of USB to TTL converters were used in conjunction with RealTerm.
Upon measuring the supply for the ST micro the voltage was confirmed to be 3.3VDC. A Prolific PL2303 adaptor, such as the unit from Core Electronics shown in the image below, was interfaced with the transmit and receive lines on the RJ45 connector.
Pin 5 and 6 of the EPSolar RJ45 were receive and transmit respectively. Additionally it was noted that the transmit line was not driven from rail to rail but between 1.2V and 3.3V. This resulted in incorrect or no data seen by RealTerm in most cases. After consulting the datasheet for the driver in the USB adaptor (PL2303RA) it was noted that this specified 0.3 * 3V3 as the maximum voltage for a CMOS low (VIL). To resolve this a resistor divider with two 22K resistors was added to lower the amplitude of the signal.
Data Collection
Initial documentation for the EPSolar communications protocol was reviewed from Steve Pomeroy, John Geek and a document site with concise documentation by Marc Dilasser.
Validation of the CRC16 was made using a site from Bastian Molkenthin.
MT-5 Hardware
To determine the protocol, a test system consisting of an MPPT connected to an MT-5 display with a pair of USB to TTL converters were used in conjunction with RealTerm.
Upon measuring the supply for the ST micro the voltage was confirmed to be 3.3VDC. A Prolific PL2303 adaptor, such as the unit from Core Electronics shown in the image below, was interfaced with the transmit and receive lines on the RJ45 connector.
 |
| Prolific USB to TTL Adaptor |
Pin 5 and 6 of the EPSolar RJ45 were receive and transmit respectively. Additionally it was noted that the transmit line was not driven from rail to rail but between 1.2V and 3.3V. This resulted in incorrect or no data seen by RealTerm in most cases. After consulting the datasheet for the driver in the USB adaptor (PL2303RA) it was noted that this specified 0.3 * 3V3 as the maximum voltage for a CMOS low (VIL). To resolve this a resistor divider with two 22K resistors was added to lower the amplitude of the signal.
Data Collection
The MT-5 sent two request packets to the MPPT on startup:
EB 90 EB 90 EB 90 01 AC 01 00 82 7B 7F Current Battery, Modes Request *
* It should be noted that the battery and mode request is performed only once where as the real time data is updated on a regular basis.
EB 90 EB 90 EB 90 01 A0 01 03 BD BB 7F Real Time Data Request
The responses for the unit under test were:
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F
EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 68 0B 00 00 00 26 00 00 00 00 38 00 00 00 E6 26 7F
Each of the settings on the MT-5 menu were changed and the packet exchange recorded.
Battery Type
EB 90 EB 90 EB 90 01 AD 07 00 00 03 01 14 10 12 3D 22 7F Sealed
EB 90 EB 90 EB 90 01 AD 07 00 00 03 02 14 10 12 CD 21 7F GEL
EB 90 EB 90 EB 90 01 AD 07 00 00 03 03 14 10 12 9D 20 7F Flooded
Battery Capacity (AH)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 01 10 12 05 4A 7F 10AH min
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 10 12 84 AC 7F 900AH max
Battery Compensation (mV/C)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 14 10 12 51 1F 7F 0mV/C
EB 90 EB 90 EB 90 01 AD 07 00 00 0A 03 14 10 12 D9 1F 7F -10mV/C
Timer 1 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 00 12 80 F9 7F Setting 0
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 11 12 D1 FD 7F Setting 17
Timer 2 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 01 0A 9C 7F Setting 1
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 11 1E CD 7F Setting 17
For any change in settings the MPPT responded with a confirmation.
EB 90 EB 90 EB 90 00 AD 00 B0 5C 7F
To determine the battery and modes packet on startup some of the settings were changed to determine the packet structure.
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F Timer 1 17, Timer 2 n
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 5A 11 12 58 AC 7F Battery capacity 900AH
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 01 5A 11 12 F8 AE 7F Battery type sealed
EB 90 EB 90 EB 90 00 AC 07 00 00 01 01 5A 11 12 34 BB 7F Battery compensation 1mV/C
There appeared to be some additional data in the packet however it was not identified at the time.
From the MT-5 manual load control was enabled with Timer 1 set to Manual (On/Off Mode). The Power/Esc button on the MT-5 was presses and the packets recorded.
EB 90 EB 90 EB 90 01 AA 01 01 1D 9B 7F Load ON
EB 90 EB 90 EB 90 01 AA 01 00 0D DA 7F Load OFF
To verify the position of the load status in the real time data packet this was also collected.
EB 90 EB 90 EB 90 00 A0 18 B2 09 09 00 00 00 00 00 AC 08 16 0B 01 00 00 2A 00 00 00 00 37 00 00 00 15 1A 7F Load ON
EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 16 0B 00 00 00 2B 00 00 00 00 37 00 00 00 A3 29 7F Load OFF
Downloads
An updated version of the Protocol (Ver5) available with an additional example of a software CRC16.
EB 90 EB 90 EB 90 01 AC 01 00 82 7B 7F Current Battery, Modes Request *
* It should be noted that the battery and mode request is performed only once where as the real time data is updated on a regular basis.
EB 90 EB 90 EB 90 01 A0 01 03 BD BB 7F Real Time Data Request
The responses for the unit under test were:
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F
EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 68 0B 00 00 00 26 00 00 00 00 38 00 00 00 E6 26 7F
Each of the settings on the MT-5 menu were changed and the packet exchange recorded.
Battery Type
EB 90 EB 90 EB 90 01 AD 07 00 00 03 01 14 10 12 3D 22 7F Sealed
EB 90 EB 90 EB 90 01 AD 07 00 00 03 02 14 10 12 CD 21 7F GEL
EB 90 EB 90 EB 90 01 AD 07 00 00 03 03 14 10 12 9D 20 7F Flooded
Battery Capacity (AH)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 01 10 12 05 4A 7F 10AH min
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 10 12 84 AC 7F 900AH max
Battery Compensation (mV/C)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 14 10 12 51 1F 7F 0mV/C
EB 90 EB 90 EB 90 01 AD 07 00 00 0A 03 14 10 12 D9 1F 7F -10mV/C
Timer 1 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 00 12 80 F9 7F Setting 0
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 11 12 D1 FD 7F Setting 17
Timer 2 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 01 0A 9C 7F Setting 1
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 11 1E CD 7F Setting 17
For any change in settings the MPPT responded with a confirmation.
EB 90 EB 90 EB 90 00 AD 00 B0 5C 7F
To determine the battery and modes packet on startup some of the settings were changed to determine the packet structure.
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F Timer 1 17, Timer 2 n
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 5A 11 12 58 AC 7F Battery capacity 900AH
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 01 5A 11 12 F8 AE 7F Battery type sealed
EB 90 EB 90 EB 90 00 AC 07 00 00 01 01 5A 11 12 34 BB 7F Battery compensation 1mV/C
There appeared to be some additional data in the packet however it was not identified at the time.
From the MT-5 manual load control was enabled with Timer 1 set to Manual (On/Off Mode). The Power/Esc button on the MT-5 was presses and the packets recorded.
EB 90 EB 90 EB 90 01 AA 01 01 1D 9B 7F Load ON
EB 90 EB 90 EB 90 01 AA 01 00 0D DA 7F Load OFF
To verify the position of the load status in the real time data packet this was also collected.
EB 90 EB 90 EB 90 00 A0 18 B2 09 09 00 00 00 00 00 AC 08 16 0B 01 00 00 2A 00 00 00 00 37 00 00 00 15 1A 7F Load ON
EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 16 0B 00 00 00 2B 00 00 00 00 37 00 00 00 A3 29 7F Load OFF
Updated Protocol Document
With the jumble of packets collected, the original MPPT Protocol PDF document, Ver 3, "Protocol-Tracer-MT-5.pdf" by Alex Ruhmann was updated.
The protocol document was reformatted into "Protocol-Tracer-MT-5 V5.pdf". An example of the new layout in the V4 PDF shown below.
The protocol document was reformatted into "Protocol-Tracer-MT-5 V5.pdf". An example of the new layout in the V4 PDF shown below.
Battery / Timer
Control Settings Request
Request
|
Command
|
Data Size
|
Data
|
Checksum
|
0x1
|
0xAC
|
0x01
|
0x00
|
CRC-16 0x1041
|
Example: EB 90 EB
90 EB 90 01 AC 01 00 82 7B 7F
Battery / Timer
Control Settings Reply
Reply
|
Command
|
Data Size
|
Data
|
Checksum
|
0x0
|
0xAC
|
0x07
|
Byte 1: Load type (unused, 0x00)
|
CRC-16 0x1041
|
Byte 2: Charging mode (unused, 0x00)
|
||||
Byte 3: Battery temperature
compensation voltage. Range from 0 to 10. Units -mV/V
|
||||
Byte 4: Battery Type, 1 – Sealed, 2 –
Gel, 3 – Flooded
|
||||
Byte 5: Battery Capacity, Range from 1
to 90 decimal. Units AH. Multiplied by 10 for actual AH battery rating.
|
||||
Byte 6: Timer 1 setting, Range 0 to 18
|
||||
Byte 7: Timer 2 setting, Range 1 to 18
|
Example: EB 90 EB
90 EB 90 00 AC 07 00 00 0A 03 01 10 12 8C 1B 7F
Downloads
An updated version of the Protocol (Ver5) available with an additional example of a software CRC16.
 |
| Protocol-Tracer-MT-5 V5.pdf |
Thx for the perfect documentation!
ReplyDeletethanks
ReplyDeleteProtocol-Tracer-MT-5 V5.pdf and Protocol-Tracer-MT-5 V4.pdf seems to be equal? Typo in the name?
ReplyDeleteThe link has been fixed to the V5 file, thanks for picking that up!!
DeleteGlad to be helpfull, thanks for the information
Delete