Tracer MT-5 Protocol. Communications to Tracer MPPT

Summary
Featured in this blog is a tear down of the EPSolar MT-5. The aim of the tear down was to assist in determining the communication protocol between the
MT-5 display and main EPSolar MPPT unit. 

Hardware
Although the Tracer MPPT and display models shown below are no longer sold by EPSolar, there were still numerous re-seller sites with stocks which raised my interest in using one for garden lighting control. This would require manual control of the load output.

EPSolar - Tracer MPPT Module

EPSolar - MT-5 Display

There are more than a dozen sites with example code for the communications however none of it is complete. In order to determine the protocol the only two methods that came to mind were connecting with the EPSolar PC Monitoring software or monitoring the communications between the MPPT and display. The latter of the two methods was used.

MT-5 Teardown

The MT-5 from the rear appeared as a sealed unit, so removing the front window (lexan) was the first step to gain access.

EPSolar MT-5 with front cover removed

After the window was removed, there were four screws to retain the main board and a few melted plastic posts to hold a secondary board containing the buttons.

EPSolar MT-5 PCB

After removing the boards both the main microcontroller ST - STM8S903K and LCD driver from Holtek - HT1621 were visible on the rear of the board. On the top side of the board was the LCD and LED light box serving as the LCD backlight.

MT-5 Protocol
Initial documentation for the EPSolar communications protocol was reviewed from Steve Pomeroy, John Geek and a document site with concise documentation by Marc Dilasser. 

Validation of the CRC16 was made using a site from Bastian Molkenthin.

MT-5 Hardware
To determine the protocol, a test system consisting of an MPPT connected to an MT-5 display with a pair of USB to TTL converters were used in conjunction with RealTerm.

Upon measuring the supply for the ST micro the voltage was confirmed to be 3.3VDC. A Prolific PL2303 adaptor, such as the unit from Core Electronics shown in the image below, was interfaced with the transmit and receive lines on the RJ45 connector. 

Prolific USB to TTL Adaptor

Pin 5 and 6 of the EPSolar RJ45 were receive and transmit respectively. Additionally it was noted that the transmit line was not driven from rail to rail but between 1.2V and 3.3V. This resulted in incorrect or no data seen by RealTerm in most cases. After consulting the datasheet for the driver in the USB adaptor (PL2303RA) it was noted that this specified 0.3 * 3V3 as the maximum voltage for a CMOS low (VIL). To resolve this a resistor divider with two 22K resistors was added to lower the amplitude of the signal.

Data Collection

The MT-5 sent two request packets to the MPPT on startup:

EB 90 EB 90 EB 90 01 AC 01 00 82 7B 7F      Current Battery, Modes Request *

* It should be noted that the battery and mode request is performed only once where as the real time data is updated on a regular basis.

EB 90 EB 90 EB 90 01 A0 01 03 BD BB 7F      Real Time Data Request


The responses for the unit under test were:
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F


EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 68 0B 00 00 00 26 00 00 00 00 38 00 00 00 E6 26 7F

Each of the settings on the MT-5 menu were changed and the packet exchange recorded.

Battery Type
EB 90 EB 90 EB 90 01 AD 07 00 00 03 01 14 10 12 3D 22 7F         Sealed
EB 90 EB 90 EB 90 01 AD 07 00 00 03 02 14 10 12 CD 21 7F GEL
EB 90 EB 90 EB 90 01 AD 07 00 00 03 03 14 10 12 9D 20 7F         Flooded

Battery Capacity (AH)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 01 10 12 05 4A 7F   10AH min

EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 10 12 84 AC 7F 900AH max

Battery Compensation (mV/C)
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 14 10 12 51 1F 7F         0mV/C
EB 90 EB 90 EB 90 01 AD 07 00 00 0A 03 14 10 12 D9 1F 7F         -10mV/C

Timer 1 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 00 12 80 F9 7F         Setting 0

EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 11 12 D1 FD 7F Setting 17

Timer 2 Setting
EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 01 0A 9C 7F         Setting 1

EB 90 EB 90 EB 90 01 AD 07 00 00 00 03 5A 12 11 1E CD 7F         Setting 17

For any change in settings the MPPT responded with a confirmation.
EB 90 EB 90 EB 90 00 AD 00 B0 5C 7F

To determine the battery and modes packet on startup some of the settings were changed to determine the packet structure.

EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 11 12 D9 4A 7F         Timer 1 17, Timer 2 n
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 5A 11 12 58 AC 7F Battery capacity 900AH
EB 90 EB 90 EB 90 00 AC 07 00 00 0A 01 5A 11 12 F8 AE 7F         Battery type sealed
EB 90 EB 90 EB 90 00 AC 07 00 00 01 01 5A 11 12 34 BB 7F         Battery compensation 1mV/C

There appeared to be some additional data in the packet however it was not identified at the time.

From the MT-5 manual load control was enabled with Timer 1 set to Manual (On/Off Mode). The Power/Esc button on the MT-5 was presses and the packets recorded.

EB 90 EB 90 EB 90 01 AA 01 01 1D 9B 7F Load ON


EB 90 EB 90 EB 90 01 AA 01 00 0D DA 7F       Load OFF

To verify the position of the load status in the real time data packet this was also collected.

EB 90 EB 90 EB 90 00 A0 18 B2 09 09 00 00 00 00 00 AC 08 16 0B 01 00 00 2A 00 00 00 00 37 00 00 00 15 1A 7F        Load ON

EB 90 EB 90 EB 90 00 A0 18 B9 09 00 00 00 00 00 00 AC 08 16 0B 00 00 00 2B 00 00 00 00 37 00 00 00 A3 29 7F         Load OFF

Updated Protocol Document

With the jumble of packets collected, the original MPPT Protocol PDF document, Ver 3, "Protocol-Tracer-MT-5.pdf" by Alex Ruhmann was updated.

The protocol document was reformatted into "Protocol-Tracer-MT-5 V5.pdf". An example of the new layout in the V4 PDF shown below.

Battery / Timer Control Settings Request

Request	Command	Data Size	Data	Checksum
0x1	0xAC	0x01	0x00	CRC-16 0x1041

Example: EB 90 EB 90 EB 90 01 AC 01 00 82 7B 7F

Battery / Timer Control Settings Reply

Reply	Command	Data Size	Data	Checksum
0x0	0xAC	0x07	Byte 1: Load type (unused, 0x00)	CRC-16 0x1041
			Byte 2: Charging mode (unused, 0x00)
			Byte 3: Battery temperature compensation voltage. Range from 0 to 10. Units -mV/V
			Byte 4: Battery Type, 1 – Sealed, 2 – Gel, 3 – Flooded
			Byte 5: Battery Capacity, Range from 1 to 90 decimal. Units AH. Multiplied by 10 for actual AH battery rating.
			Byte 6: Timer 1 setting, Range 0 to 18
			Byte 7: Timer 2 setting, Range 1 to 18

Example: EB 90 EB 90 EB 90 00 AC 07 00 00 0A 03 01 10 12 8C 1B 7F

Downloads
An updated version of the Protocol (Ver5) available with an additional example of a software CRC16.

Protocol-Tracer-MT-5 V5.pdf

Protocol-Tracer-MT-5 V4.pdf

Cypress PSoC VT100 Code Example

Summary
As an alternative interface to one of my projects, basic VT100 functionality was implemented across serial (USB) on a Cypress PSoC4 BLE device. The Cypress iprintf code was used with a wrapper to implement basic VT100 features.

The screen capture below shows basic control of text and colour.

VT100 Example in TeraTerm

As a starting reference the Bash Hackers website was used for the VT100 escape codes. A plethora of information can be found at sites such as Technopedia, TermSys, NorthEastern Uni, ASCII-Table and ISP to name a handful. What has been provided is only a portion of the total VT100 commands available.

Code for the PSoC

For Cypress Creator development environment a separate VT100 source and header file were created with the necessary escape commands.

VT100 Commands

Foreground and background colors.

VT100 Colours

Cypress already provide a PSoC Creator example project with iprintf, which works effectively as the low level interface. A reference to this library was included in VT100 code.

To use a number of commands at once or to configure the location of the cursor a few functions were written, prototypes below. There is room to improve these functions but for testing they function as required.

VT100 Function Prototypes

Usage in the software main shown below.

VT100 Example Usage

Testing

Testing was also performed with other terminal packages such as PuTTY and RealTerm.

VT100 Example in PuTTY (Windows)

TermPuTTY under Ubuntu Mate, customised settings

VT100 Example in PuTTY (Ubuntu Mate)

RealTerm was placed in ANSI mode with good results, except for the colours.

VT100 Example in RealTerm

Downloads

vt100.c

vt100.h

PSoC Creator 3.3 VT100 Project

Change Summary

Version 1.02 (15 March 2017)

• Added GPL details
• Corrected two text command enumerations
• Updated PSoC Creator project

Version 1.01 (11 March 2017)

• Added defines for background colour
• Changed names of foreground colour defines
• Updated PSoC Creator project

Version 1.00 (26 February 2017)

• Created PSoC Creator project for initial vt100 commands

MCP23S17 IO Port Expander Header File / Register

Summary
For a recent project the 16bit IO Expander, MCP23S17, from Microchip was enlisted for low voltage input scanning. 

Searching online, at the time of writing this blog, there were no projects using this part with sample code. 

Below is the header file that may be of use.

Microchip IO Expander QFN Package

Downloads

mcp23s17.h

Code

/******************************
* mcp23s17.h
******************************/

#ifndef mcp23s17_h
#define mcp23s17_h

typedef unsigned char   uint8;
    
#define MCP_READ   0x41     /* Read */
#define MCP_WRITE   0x40     /* Write */
#define Mode_8Bit     1         /* Addressing 8/16bit */
#define Mode_16bit    0

#ifdef Mode_16Bit
    /******************************
    * Control register for BANK=0
    ******************************/
    #define IODIRA        0x00      /* Data Direction Register for PORTA */
    #define IODIRB        0x01      /* Data Direction Register for PORTB */ 
    #define IPOLA         0x02      /* Input Polarity Register for PORTA */ 
    #define IPOLB         0x03      /* Input Polarity Register for PORTB */ 
    #define GPINTENA      0x04      /* Interrupt-on-change enable Register for PORTA */ 
    #define GPINTENB      0x05      /* Interrupt-on-change enable Register for PORTB */ 
    #define DEFVALA       0x06      /* Default Value Register for PORTA */    
    #define DEFVALB       0x07      /* Default Value Register for PORTB */      
    #define INTCONA       0x08      /* Interrupt-on-change control Register for PORTA */  
    #define INTCONB       0x09      /* Interrupt-on-change control Register for PORTB */      
    #define IOCON         0x0A      /* Configuration register for device */                      
    #define GPPUA         0x0C      /* 100kOhm pullup resistor register for PORTA (sets pin to input when set) */    
    #define GPPUB         0x0D      /* 100kOhm pullup resistor register for PORTB (sets pin to input when set) */      
    #define INTFA         0x0E      /* Interrupt flag Register for PORTA */        
    #define INTFB         0x0F      /* Interrupt flag Register for PORTB */    
    #define INTCAPA       0x10      /* Interrupt captured value Register for PORTA */  
    #define INTCAPB       0x11      /* Interrupt captured value Register for PORTB */    
    #define GPIOA         0x12      /* General purpose I/O Register for PORTA */  
    #define GPIOB         0x13      /* General purpose I/O Register for PORTB */ 
    #define OLATA         0x14      /* Output latch Register for PORTA */ 
    #define OLATB         0x15      /* Output latch Register for PORTB */
#endif

#ifdef Mode_8Bit
    /******************************
    * Control register for BANK=1
    ******************************/
    #define IODIRA        0x00      /* Data Direction Register for PORTA */
    #define IPOLA         0x01      /* Input Polarity Register for PORTA */  
    #define GPINTENA      0x02      /* Interrupt-on-change enable Register for PORTA */     
    #define DEFVALA       0x03      /* Default Value Register for PORTA */    
    #define INTCONA       0x04      /* Interrupt-on-change control Register for PORTA */     
    #define IOCONA        0x05      /* Configuration register for device */          
    #define GPPUA         0x06      /* 100kOhm pullup resistor register for PORTA (sets pin to input when set) */     
    #define INTFA         0x07      /* Interrupt flag Register for PORTA */
    #define INTCAPA       0x08      /* Interrupt captured value Register for PORTA */
    #define GPIOA         0x09      /* General purpose I/O Register for PORTA */  
    #define OLATA         0x0A      /* Output latch Register for PORTA */ 
    #define IODIRB        0x10      /* Data Direction Register for PORTB */ 
    #define IPOLB         0x11      /* Input Polarity Register for PORTB */ 
    #define GPINTENB      0x12      /* Interrupt-on-change enable Register for PORTB */
    #define DEFVALB       0x13      /* Default Value Register for PORTB */      
    #define INTCONB       0x14      /* Interrupt-on-change control Register for PORTB */
    #define IOCONB        0x15      /* Configuration register for device */  
    #define GPPUB         0x16      /* 100kOhm pullup resistor register for PORTB (sets pin to input when set) */        
    #define INTFB         0x17      /* Interrupt flag Register for PORTB */    
    #define INTCAPB       0x18      /* Interrupt captured value Register for PORTB */    
    #define GPIOB         0x19      /* General purpose I/O Register for PORTB */ 
    #define OLATB         0x1A      /* Output latch Register for PORTB */
#endif
    
/* Config bits - IOCON */
#define BANK  0x80
#define MIRROR  0x40
#define SEQOP  0x20
#define DISSLW  0x10
#define HAEN  0x08
#define ODR      0x04
#define INTPOL  0x02

/******************************
* Prototypes
******************************/
void MCP23S17_init();
void MCP23S17_write(uint8 address, uint8 value);
uint8 MCP23S17_read(uint8 address);
uint8 MCP23S17_verify(uint8 address, uint8 verify_data);
    
#endif
/* END */



Change Summary

Version 1.00 (10 February 2017)

• Created register mapping for MCP23S17, 8 and 16 bit modes