Analysing pv’s attempt to work with CMS-5000

There’s a library a wrote a little while ago that was designed to interact with some photovoltaic inverters via the serial port. It was written based on captured communication between the official ProControl software

Reader contribution

Simon’s tried out my code to see if it’ll work on a newer inverter, the CMS-5000. Unfortunately the library as it stands doesn’t quite work. So let’s take a closer look at the packets:

First we reset the inverter:

SEND -> aaaa 0100 0000 0004 00 0159

Discover inverters:

SEND -> aaaa 0100 0000 0000 00 0155

RECV <- aaaa fe00 0000 0080 0a 52353634363033303631 04fd OK

Mostly OK so far, but something that strikes me is that the first byte (0xFE) of what I assumed to be the source address seems to have some other significance (it’s not 0×0000). Moving on…

Register the inverter with address “0001”:

SEND -> aaaa 0100 0000 0001 0c 523536343630333036310001 0384

The inverter acknowledges

RECV <- aaaa fe01 0000 0081 01 06 02db OK

So even though the first byte of the address 0xFE is incorrect, things still seem to be working.

Now we try to find what status fields the inverter gives:

SEND -> aaaa 0100 0001 0101 00 0158

RECV <- aaaa fe01 0000 0181 01 15 02eb OK

This bit here is the interesting bit. First, (if my assumptions about the comms protocol were correct), the inverter only gives 2 fields: 0×01 and 0×15. That’s really few compared with the ones I’ve seen before. Not only that, but we don’t yet know what the field 0×15 is for. Basically I assumed that the reply I get is a listing of the status fields, but instead I get something else.

So let’s query the inverter for its status:

SEND -> aaaa 0100 0001 0104 00 015b

RECV <- aaaa fe01 0000 0184 12 05dc003c071c0abe1290139a009900e8034a 080f OK

So here we have the full status update from the inverter. We can’t decode what it’s saying, because it doesn’t quite match the status field query. This is why the pv library is failing to interpret this packet based on the received structure that was supposedly just 2 fields long.

What does this mean?

In the most basic level, there are a few assumptions + generalisations that I’ve made which turned out to be inaccurate, hence it’s not working for a different model inverter.

What we’d need now is a capture of the raw communication between the official monitoring software and the inverter to get a better understanding of what’s going on.

HP Mini 2140 Netbook gets aftermarket Bluetooth without breaking the bank

I’m quite satisfied with the netbook I’m using at the moment: HP Mini 2140, with a reasonable 2GB RAM and beautiful brushed aluminium chassis. Even though it has a screen people would call "low resolution", I’d say it is very legible. The only thing missing – and one I’d come to love – is Bluetooth connectivity that I had with my Lenovo V100 laptop.

So, I went and bought the module, cracked the netbook open and added Bluetooth, all without spending truckloads of money.

Why Bluetooth?

Why do I like Bluetooth so much? I use it to connect my Microsoft Bluetooth Mobile Keyboard 6000 (it’s a fantastic piece of hardware), my Microsoft Bluetooth Notebook Mouse 5000 and my Microsoft IntelliMouse for Bluetooth. The best thing is, I don’t need to attach any dongles, and when I have everything paired, docking the netbook while working on a desk simply involves putting it down and connecting the external monitor. No USB cables to muck around with.

Bluetooth PAN is also great way to get wireless Internet tethering from my phone, and much more power efficient than using Wi-Fi tethering.

Getting the parts

The first step was to see what I needed to add Bluetooth to the netbook. HP’s specifications say Bluetooth v2.0 was indeed an option for this particular netbook. So it means all I needed to do was find the Bluetooth module’s part number, order it and install it. I love it when PC manufacturers publish the maintenance and service guides for the laptops, because it just makes life much easier to perform DIY post-warranty service.

To my horror, ordering HP’s official Bluetooth module costs an arm and a leg, and it doesn’t even include the connection cable between the system board and the module! So I looked for alternatives on eBay.

It was soon obvious that there are overwhelmingly many different Bluetooth modules for laptops. In general, manufacturers design their computers so that the parts are interchangeable between devices. So I searched for "HP Bluetooth Module" and went through the list. Eventually I found a listing for Broadcom BCM2046 Bluetooth 2.1 module plus the cable for roughly AUD$20. Sweet! What’s more, the listing claims that this part was compatible with the HP Mini 2133 and 2140 netbooks. The fact that it also came with 4 screws was rather curious, because the HP Mini 2140 only uses double-sided adhesives to attach the module.

Anyhow, I was willing to give that a try. The most important thing is that the module was compatible (that I didn’t know in advance; it just should work and looks about right), and that the cable had the correct adapters (I had to take the eBay seller’s word for it).

Installing the module

Receiving the goods after about a week and a half, it was time to perform the surgery and disassemble the netbook. First the keyboard came off, exposing the hard drive and the DDR2 memory.

Unfortunately for the HP Mini 2140, the Bluetooth module was located under the palmrest and left of the touchpad. So it’ll take a little more effort to access it. It turns out that even though my netbook didn’t come with Bluetooth, the double-sided adhesive that holds the Bluetooth module in place actually came with the system board. Excellent. That makes my job so much easier.

Final thoughts

For for a mere $20, my little HP Mini-Note 2140 netbook now has Bluetooth! What’s more, the particular module that I bought was Broadcom BCM2046, which is Bluetooth v2.1. Had I gone with official HP parts, not only would it have costed me more than 5x more money, it was only Bluetooth 2.0. Not that there’s very much difference, but 2.1 is meant to give higher data rates and use less power.

Tech entrepreneurial questions? Ask TVC!

This semester, I’m doing a entrepreneurial course as a finale to my 5 years undergrad at uni. The course is run by Matt Barrie (CEO, Freelancer.com) and Bill Bartee (Managing Partner, Southern Cross Ventures).

A feature of this course is that it is heavily industry-focused, and every week, we have successful real-world entrepreneurs (not just a lecturer) as guest speakers to share their experience and expertise.

Ask TVC is a site our group have launched to share this exclusive opportunity with the world. If you are running a business, or thinking about getting into the game, then fire your questions away. We’ll gather the top rated questions for each speaker and we’ll post the answers after the lecture.

The answers to Tjoos.com (Kim Chen and Bart Jallema) questions are now posted, and we still have Viocorp (Ian Gardiner), Omnisio (now YouTube; Ryan Junee), Atlassian (Mike Cannon-Brookes), and many more to come!

So check us out at asktvc.nfshost.com and let us know what you think.

The story behind my website’s new look

You might have noticed that my blog has a new theme! It’s wonderful that with WordPress, changing to a new theme only takes a few mouse clicks.

However, there was a bit of drama behind why I made the change – unfortunate, but a valuable experience indeed. My website was hacked.

Read more »

pv – a Python library to monitor/control PV Inverters

After having the solar electricity system installed, I can monitor the energy output of the inverter using Pro Control. However, because the software runs on Windows, I’d have to have a PC turned on just for that purpose wasting quite a bit of energy. So, my goal is to use a low-power embedded Debian box (which is usually on) to do the monitoring. Instead of just writing an application to do the job, I’ve decided to write a library others can use to write their own custom logging software.

pv can be found at http://pv.codeplex.com/, and should work for you if you have a Carbon Management Solutions CMS-2000 or Schneider Electric SunEzy 600E (judging from a sample protocol exchange).

I’ll have to give full credit to the folks at http://www.solarfreaks.com/cms2000-inverter-rs232-serial-port-hack-cms-2000-rs232-t271.html who did the initial work on reverse engineering the communication protocols. Building on what has already been done on working out the protocol, and doing a bit of reverse engineering myself, the library supports sending arbitrary data frames for further exploring, as well as the known protocols.

Read more »