Protocol exploration (4)
Post date: Nov 14, 2019 10:40:47 PM
Identified message data
In the last days I systematically identified more and more parameters in the stream. My Python script now builds and updates a dict with the states below, and I can switch the outlets, set the on-battery runtime limits and the voltage sensitivity.
apparent_power_pctused = 0.0
apparent_power_rating = 1000
battery_sku = APCRBC142
battery_soc = 100.0
battery_voltage = 27.1875
comm_state = online
current_out = 0.0
frequency_in = 50.0
frequency_out = 49.984375
fw_version_1 = UPS 12.0
fw_version_2 = MCU 06.0
fw_version_3 = UBL 01.4
fw_version_4 = MBL 06.0
input_status = ['ACCEPTABLE']
input_status_raw = 1
interaction_config = 0
interaction_setting = 5
interaction_status = 0
msg_size = 16
num_ids = 128
outlet_config = 0
outlet_name = UPS Outlets
outlet_status = ['OUTLET ON']
outlet_status_raw = 1
protocol_version? = 10
real_power_pctused = 0.0
real_power_rating = 600
runtime_limit_outletoff = 60.0
runtime_minimum_shown = 0.0
runtime_remaining = 308
runtime_remaining_2 = 308
runtime_remaining_outletoff = 2.0
serial_nb = 3S1607X00588
temperature = 27.890625
unknown_1 = 9
unknown_2 = 0
ups_name = APCUPS
ups_sku = SMC1000I
ups_status = ['ONLINE', 'GREEN MODE']
ups_status_raw = 8194
ups_type = Smart-UPS C 1000
voltage_accept_max = 265
voltage_accept_min = 195
voltage_config = 230
voltage_config_raw = 32
voltage_in = 231.796875
voltage_out = 231.796875
voltage_sensitivity = 1
Product cross-referencing
Besides a large 'empty space' in the message field, some messages have values that do not appear anywhere in PowerChute or the SMC1000 documentation. However, they are sometimes mentioned in other product line manuals. For example, in message 0x47 there are 2 fields with the value 183 and 14 respectively. By accident I recognized these numbers in the SRT1000XLA manual, as defaults for the Battery Near-End-Of-Life alarm and reminder, specified as a number of days. So probably the firmware is very similar but more 'locked down' in the SMC product line. This finding now allows me to identify even more messages and giving them 'proper' names :)
Furthermore, I only now discovered the APC Modbus manual and a reference sheet. The Modbus data formatting of the parameters, such as the binary point representation, is the same as what is used by the serial Microlink and identified in a previous post. Some values are now clearly understandable. Slowly the whole puzzle is coming together...