Repository navigation
Miscellaneous additions to the Megatec protocol variants #58
Description
Activity
@dvdesolve : thanks!
V | Query for AVR mode settings. Typical answer: 165 200 220 240 275 <...>
Do you know if there is really no leading parenthesis, or is this a typo? (It is same way in original document)
I'm not sure, because this is the info which I got on that web page. However I think that it should start with
(- seems like the most of the answers start with left parenthesis (Frequest is an exception)- added a commit that references this issue
on Dec 17, 2024 Also I want to enlist some other commands which I was able to sniff during WinPower testing. However, my UPS (Innova RT 3/1 20K) answered
NAKto all of these requests (SASV07?is an exception). Interesting enough that requests are always in sequence when Scan for devices function is called in GUI. After that sequence WinPower decides to useQ6protocol variant (afterSASV07?being successful).Command Answer CB24NAKSASV07?GASV07D+ serial numberPISV07?NAKWHSV07?NAKQ4SV07?NAKF4SV07?NAKQ1SV07?NAKI can also try to check conversations between WinPower and 850, 1500 and 2200 Back Basic models, if it would be useful
I think it might be, thanks
Checked for 850 version (I think that 650 will behave the same) via USB sniffer. In case of unknown request 650/850 model answers that request back.
WinPower starts device discovery withSASV07?, like with Innova RT 3/1 20K (may be standard way to discover devices). This command is unknown for UPS. Then periodical polling takes place. I was able to catch the following commands:M(the answer wasC),F,Q1,SASV07?,Z,BT?,BL?. UPS understands only first three and answers in a well-known manner. The rest of the list is unknown.EDIT: checked 1500/2200 as well. The behavior is exactly the same. So, it looks like 650/850/1500/2200 models are just siblings from the firmware point of view.
Looking at the whole info that I was able to get I can conclude that, at least, WinPower tries to discover device type by issuing some sort of ping requests (
*SV07?family of them). If device answers request back then WinPower may decide that it's just plain Megatec Q1 variant and rely purely onQ1andFrequests. GUI confirms it indirectly - all info presented in main window is just processedQ1/Fanswers. No battery count, no serial info, no more info at all.May be other families with additional properties (3/1, 3/3, with bypass, ECO/HE models etc) will answer to the
*SV07?requests properly so WinPower will discover them in a right way too. So, maybe it worth to checkPISV07?,WHSV07?,Q4SV07?,F4SV07?andQ1SV07?requests on UPS models which are supported by WinPower...Well, polling by device model does make sense, as long as there is some classifier of models to their concept of what NUT would call protocols in nutdrv_qx or subdrivers in usnhid-ups...
I think that the very first classifier is
*SV07?query - if the device answers one of them properly, then it can be attributed to one of the base classes (e. g., back UPSes, line-interactive, inverters, 3/1, 3/3, etc...). Then issuing some specific commands, such asWH, can give us even more info about specific device model.BTW I was able to grep huge list of commands which are known to the WinPower software. It already contains a lot of well-known queries, though it lacks some of sniffed ones. Here it is:
AR AR? AT AT? BA BA? BB BB? BF BF? BL? BM BM? BO BO? BPS BS BS? BT? BUS? BUSN BUSN? BUSP BUSP? BUZW= BV BV? C CA CA? CB CB? CF50 CF60 CL CLS CP CP? CT CU CU? DAD DI DS DS EB EB? EF EF? EPO EV EV? F FH FM FR FR? FS FS? FT FUNC? FUNCD FUNCE FW GPD GR GR? IP IP? LF LF? LM LM? LSARD01, LSARD01? LSARD02, LSARD02? LSASD01, LSASD01? LSASD02, LSASD02? LSOFF00? LSOFF01, LSOFF01, LSOFF01? LSOFF02, LSOFF02? LSON01, LSON01? LSON02, LSON02? LVHL LVHL? LVS LVS? M MANUFW= MASTERW= MD MODW= MS MT MT? MV MV? MW MW? NB NB? OUT OVS PA PA? PD PE PF PI PLS PLS? PSmGnLpHqExxxxDxxx Q Q Q1 Q2 Q4 Q6 Q7 QA QC QF QI QLSS01? QLSS02? QMT QN QOF QP QR QS QS QU RST RT S S1 S2 SASV07? SCE SD? SETDLYTIMEW= SETNOMVW= SETSYNWINW= SF SF? SFADJW= SI SI?, SIHLS SILLS SL SL? SMHLS SMLLS SNW= SPI SPI? SR SR SR SR? ST STS SVADJW= T T TC? TD TD? TL UL V V V? VHLS VHLS? VLLS VLLS? VS VS? VSR VT VT? WA WA WC WF WH WH WHI WHR WHS WHT WM ZLSARD*commands are related to the outlet control onDelay,LSASD*- to the offDelay,LSON*- to the manualOn andLSOFF*- to the manualOff.Many thanks to the @shangjiaxuan for Santek command list. I was able to translate it and compare with my current findings about new Qx protocol dialects (namely
Q2andQ6). Here are the updates.Q2(MMM.M MMM.M MMM.M NNN.N PPP.P PPP.P PPP.P QQQ QQQ QQQ RR.R SSS.S TT.T b7b6b5b4b3b2b1b0 ttt.tt CCC BB ff ff ff ff wwwwwwww YO- First three groups of
MMM.Mcorrespond to the input voltages on phases R (input.L1-N.voltage), S (input.L2-N.voltage) and T (input.L3-N.voltage). For single phase input systems readings for S and T will be 0. Units: V. - According to the translation of the PDF
NNN.Nstays for "last voltage during discharge" and for some models may be set to 000.0 in a force manner. However, I think this value is the same like "input fault voltage" inQ1(for phase R in three phase system). Units: V. - Three groups of
PPP.Pcorrespond to the output voltages on phases R (output.L1-N.voltage), S (output.L2-N.voltage) and T (output.L3-N.voltage). For single phase output systems readings for S and T will be 0. Units: V. - Next three groups of
QQQstay for load percentages on phases R, S and T. These values are just siblings for output current inQ1variant. I'm not sure if we can assign these readings to theoutput.L1.load,output.L2.loadandoutput.L3.load. For single phase systems it's very easy to assignQQQfromQ1reading to theups.load, I don't know what is the proper way to do so in 3 phase system. Units: %. RR.Ris aninput.frequency. Units: Hz.SSS.Sis abattery.voltage. In contrast to the similar reading withQ1that's the full battery voltage and not divided by the cell number (according to the translation). Units: V.TT.Tis aups.temperaturereading. Units: C.- Bit pattern
b7b6b5b4b3b2b1b0seems like to be exactly the same as in case ofQ1protocol variant (according to the translation). ttt.ttis anbattery.runtimeestimation. Units: s. UPDATE 11.02.2025 seems like units should be minutes, not secondsCCCis abattery.charge. Units: %.BBis a battery test status. Possible values: 00 (idle), 01 (in progress), 02 (finished: no failure), 03 (finished: failure/warning), 04 (not possible/inhibite), 05 (cancel), 06 (reserved), 07 (other values).ff ff ff ffencodes up to 4 error codes simultaneously and reserved for servicemans only.wwwwwwwwencodes up to 4 warning codes simultaneously and reserved for servicemans only.Ycan be 0 or 1 and indicates input transformer type - Y or delta (I assume that refers to the three phase topology - star or delta). IfYis 1 then we have star topology and LCD shows us input phase voltages. In case ofYbeing 0 we have delta topology and LCD shows us input line voltages.Ois the same asYbut for output voltages.
Q6(MMM.M MMM.M MMM.M NN.N PPP.P PPP.P PPP.P RR.R QQQ QQQ QQQ SSS.S VVV.V TT.T ttttt CCC KB ffffffff wwwwwwww YO- First three groups of
MMM.Mcorrespond to the input voltages on phases R (input.L1-N.voltage), S (input.L2-N.voltage) and T (input.L3-N.voltage). For single phase input systems readings for S and T will be 0. Units: V. NN.Nis aninput.frequency. Units: Hz.- Three groups of
PPP.Pcorrespond to the output voltages on phases R (output.L1-N.voltage), S (output.L2-N.voltage) and T (output.L3-N.voltage). For single phase output systems readings for S and T will be 0. Units: V. RR.Ris anoutput.frequency. Units: Hz.- Next three groups of
QQQstay for load percentages on phases R, S and T. These values are just siblings for output current inQ1variant. Again, like in case ofQ2, I'm not sure how to properly assign these readings to the NUT's variables. Units: %. SSS.Sis a positive (not sure what that means - may be some models have two separate battery packs inside for some sophisticated inverter topologies)battery.voltage. In contrast to the similar reading withQ1that's the full battery voltage and not divided by the cell number (according to the translation). Units: V.VVV.Vis a negative sibling forSSS.S. Units: V.TT.Tis aups.temperaturereading. Units: C.tttttis anbattery.runtimeestimation. Units: s.CCCis abattery.charge. Units: %.Kis a "system mode" designation. Possible values: 0 (power on state), 1 (standby), 2 (bypass), 3 (line), 4 (battery), 5 (battery test), 6 (fault), 7 (converter; inverter works to provide very stable output frequency), 8 (HE/ECO), 9 (shutdown).Bis a battery test status. Possible values: 0 (idle), 1 (in progress), 2 (finished: no failure), 3 (finished: failure/warning), 4 (not possible/inhibite), 5 (cancel), 6 (reserved), 7 (other values).ffffffffencodes up to 4 error codes simultaneously and reserved for servicemans only.wwwwwwwwencodes up to 4 warning codes simultaneously and reserved for servicemans only.Ycan be 0 or 1 and indicates input transformer type - Y or delta (I assume that refers to the three phase topology - star or delta). IfYis 1 then we have star topology and LCD shows us input phase voltages. In case ofYbeing 0 we have delta topology and LCD shows us input line voltages.Ois the same asYbut for output voltages.
WA(WWW.W WWW.W WWW.W VVV.V VVV.V VVV.V TTT.T SSS.S AAA.A AAA.A AAA.A QQQ b7b6b5b4b3b2b1b0- First three groups of
WWW.Wcorrespond to the output real power on phases R (output.L1.realpower), S (output.L2.realpower) and T (output.L3.realpower). For single phase input systems readings for S and T will be 0. Units: kW. - Next three groups of
VVV.Vcorrespond to the output power on phases R (output.L1.power), S (output.L2.power) and T (output.L3.power). For single phase input systems readings for S and T will be 0. Units: kVA. TTT.Tis anups.realpower. Units: kW.SSS.Sis anups.power. Units: kVA.- Three groups of
AAA.Acorrespond to the output current on phases R (output.L1.current), S (output.L2.current) and T (output.L3.current). For single phase input systems readings for S and T will be 0. Units: A. QQQis anups.load. Units: %.- Bit pattern
b7b6b5b4b3b2b1b0seems like to be exactly the same as in case ofQ1protocol variant (according to the translation).
- First three groups of
Also need to add: according to the Santak specs the meaning of status bits
b1andb0in both Q1 and Q2 answers a bit different from classic Megatec Q1 variant:b1is internally reserved to be 1 andb0is reserved to be 0. So because ofb1being forcibly set to 1 "Shutdown Active" will always be set too. That seems to be the case whereignoresabcomes to play.
Even more to add: during testinginnovart31protocol driver I've noticed that beeper status not being properly indicated in Q1 request even when alarm sound worked fine. That also might be because of advanced UPS versions tends to work via Q2/Q6 instead of Q1 so Santak's status bit table is right.http://autobase.biz/English/AutoBaseHelp/Help10/Plc_Scan/Megatec_Extend.htm
one more nice link before I forget :)
I want to add some extra info about Megatec protocol. That's a partial translation of this web page - some obvious and well-known parts are omitted, as well as dubious points. Also some info obtained from RS232 sniffering is added too. NB: not all UPSes are capable to answer/consume these commands!
EDIT: for
Q2,Q6andWAcommands see update in this commentAR?,AR0,AR1AR1). If option is off (AR0) then UPS will stay powered off even after mains return and should be switched on manually by using power buttonAT?,AT0,AT1BL?,BLBPS(230.4 000.0 000.0 49.9. Fields 1--3 should be L1-N, L2-N and L3-N input bypass voltages, field 4 is input bypass frequencyEB?,EBnnEF?EV?FW?GR?,GR0,GR1IP?,IPN,IPW,IPGIPN), wide (IPW), generator (IPG). Corresponding LEDs will be toggled for Smart Winner UPSMP,T,V,Cand some othersQ2Q1). Typical answer:(226.6 224.3 228.0 226.6 229.9 000.0 000.0 000 000 000 49.9 327.6 18.0 00000000 999.24 100 02 00 00 00 00 00000000 11. As far as I was able to decipher this first three fields correspond to the L1-N, L2-N and L3-N input voltages, fifth field is output voltage (3/1 Ippon UPS was tested though, may be fields 5--7 correspond to the L1-N, L2-N and L3-N output voltages) eleventh field seems to be frequency (don't know, input or output), twelfth field is battery voltage, thirteenth field is temperature, 15th field may be estimated runtime (in minutes?) and 16th field is battery level (in percents, with leading zero). However, I'm not sure about fields 4, 6--11, 14--23Q4(MMM.M ???.? ???.? NNN.N PPP.P ??? QQQ RR.R ??? ??? SS.S TT.T flags. Some flags:E- test in progress,A- mains fault, on battery,C- bypass/AVR modeQ6(227.0 225.6 230.0 50.0 229.9 000.0 000.0 49.9 007 000 000 327.8 000.0 23.0 06932 100 32 00000000 00000000 11. Fields 1--3 are L1-N, L2-N and L3-N input voltages, field 4 is input frequency, fields 5--7 should be L1-N, L2-N and L3-N output voltages, field 8 is output frequency, field 9 is load (in percents, with leading zero), field 12 is battery voltage, field 14 is temperature, field 15 is estimated runtime (in seconds), field 16 is battery level (in percents, with leading zero)QBL(026.5 02 01 068 255. Field 1 is battery voltage, field 2 is a number of batteries connected in series, field 3 is a number of batteries connected in parallel, field 4 is battery level (in percents, with leading zero), field 5 is estimated runtime (in minutes?)QIQLDLQMDQMFQMODQOFQP(45.0 55.0 176 264 EpbraDokc. Fields 1 and 2 are low and high limits for input bypass frequency, fields 3 and 4 are the same but for the voltage, field 5 is flagsQRIQVFWSASV07?GASV07DstringTC?V165 200 220 240 275. Field 1 is low limit for battery transition, field 2 is low limit for engaging AVR boost, field 3 is nominal voltage, field 4 is high limit for engaging AVR buck, field 5 is high limit for battery transitionV?V220,V230,V240WH(00 00.00 00.00 INN3T20K 2 3/1 6 230 50.00 024 02.00 005.00 015.00 005 00 40 110 276 45.00 55.00. Seems to be model code (field 4), topology (field 6), nominal voltage (field 8) and frequency (field 9), number of batteries (field 10)WA(001.4 000.0 000.0 001.4 000.0 000.0 001.4 001.4 006.5 000.0 000.0 007 00000000. Fields 1 and 7 seems to be real power measurements on output while fields 4 and 8 - the full one. This example a bit clumsy because in that case cos(phi) was about 1, but in another measurements I was able to get different readings. Not sure why these fields are in pairs (m. b. rolling average?). Field 9 is a current (amps), field 12 - load (percents)