How do you unlock the Classic using modbus?

Started by cpfl, November 28, 2012, 08:01:58 PM

Previous topic - Next topic

cpfl

Having successfully got my Raspberry Pi to read data from the Classic and produce fancy graphs and figures on a web page (many thanks to rosebudd for sharing his code with me), I am now wanting to take the next step and control the Classics behavior over the same web interface.

I know that stephendv had some success by using lock jumpers and alternate firmware, but I was wanting to retain security by using the serial lock code to enable writing to the modbus registers.

How exactly is the serial lock code used in order to write to the Classic? I would guess that an (as yet) undocumented modbus register exists that unlocks it - except that would create a paradox!

Chris.
Off-Grid in a 320 sqft tiny home (plus 320 sqft attached workshop) in Texas, USA: Midnite Solar Classic 150, Magnum Energy MS4448PAE, 9 x Kyocera KD240 (2160 watts) + 9 x Kyocera KU265 (2385 watts), 16 x GC2 (400AH 48V), Raspberry Pi (ethernet & RS485 monitoring).

Vern Faulkner

OK, now I am miffed. I keep going to mymidnite.com, and it refuses my application because I'm not a beta tester. All Iwant to do is spy on my controller when I am at work - how did you get your data online?

cpfl

Hi Vern,

I took a PC and installed a Web Server, Python, Python modbus libraries, Rddtool and wrote a few lines of HTML and Python code.

A much simpler method is to install the Local App on your Windows PC (located at work) and access your Classic over the internet. This option only exists if you have a Windows PC or are willing to run an older version of the Local App on a PC running WINE on Linux.

Both methods also require that you have either a public IP address or use a service such as NO-IP (www.no-ip.com) to make available your home IP address. Then you need to configure your router to allow access to your LAN.

Chris.
Off-Grid in a 320 sqft tiny home (plus 320 sqft attached workshop) in Texas, USA: Midnite Solar Classic 150, Magnum Energy MS4448PAE, 9 x Kyocera KD240 (2160 watts) + 9 x Kyocera KU265 (2385 watts), 16 x GC2 (400AH 48V), Raspberry Pi (ethernet & RS485 monitoring).

Halfcrazy

Quote from: Vern Faulkner on November 28, 2012, 08:23:41 PM
OK, now I am miffed. I keep going to mymidnite.com, and it refuses my application because I'm not a beta tester. All Iwant to do is spy on my controller when I am at work - how did you get your data online?

Vern
Most people use the Local App software and set up port forwarding in there router. Some info can be found in the Local App manual on this: http://dl.dropbox.com/u/31975941/Local%20App%20manual.pdf

My Midnite is getting real close. Andrew is working hard at it and as soon as it is workable he will be opening it up for anyone who wants it. I should have him remove the reference to Beta.

Ryan
Changing the way wind turbines operate one smoke filled box at a time

boB

Quote from: Vern Faulkner on November 28, 2012, 08:23:41 PM
OK, now I am miffed. I keep going to mymidnite.com, and it refuses my application because I'm not a beta tester. All Iwant to do is spy on my controller when I am at work - how did you get your data online?

Don't worry about the beta tester thing.  That is left over from quite  a while ago.
My Midnite is still not ready yet but getting closer.

On that password thing, we're working on some new modbus documentation that should divulge that
paradox...

boB

K7IQ 🌛  He/She/Me

cpfl

Off-Grid in a 320 sqft tiny home (plus 320 sqft attached workshop) in Texas, USA: Midnite Solar Classic 150, Magnum Energy MS4448PAE, 9 x Kyocera KD240 (2160 watts) + 9 x Kyocera KU265 (2385 watts), 16 x GC2 (400AH 48V), Raspberry Pi (ethernet & RS485 monitoring).

boB

Quote from: cpfl on November 28, 2012, 08:01:58 PM

How exactly is the serial lock code used in order to write to the Classic? I would guess that an (as yet) undocumented modbus register exists that unlocks it - except that would create a paradox!

Chris.

Convert the decimal  password to hex and write the 32 bit password to register 0x7000, 0x7001

(Add 1 to these addresses for regular modbus addressing)

Most Significant part in the lower of the two registers.

boB
K7IQ 🌛  He/She/Me

stephendv

Quote from: boB on November 29, 2012, 09:50:30 PM
Convert the decimal  password to hex and write the 32 bit password to register 0x7000, 0x7001
(Add 1 to these addresses for regular modbus addressing)
Most Significant part in the lower of the two registers.

Also, note that AFAIK you have to write the password request and any other modbus write requests as part of the same TCP connection.  I'm using the php modbus libraries and they create a new TCP connection for every modbus write, so this doesn't work with the classic because the password and the write request are sent in 2 different connections.

Chris, have you considered publishing your code as open source?  It would be very handy to have a python class representing the classic :)

boB

Quote from: stephendv on December 04, 2012, 03:22:14 AM
Quote from: boB on November 29, 2012, 09:50:30 PM
Convert the decimal  password to hex and write the 32 bit password to register 0x7000, 0x7001
(Add 1 to these addresses for regular modbus addressing)
Most Significant part in the lower of the two registers.

Also, note that AFAIK you have to write the password request and any other modbus write requests as part of the same TCP connection.  I'm using the php modbus libraries and they create a new TCP connection for every modbus write, so this doesn't work with the classic because the password and the write request are sent in 2 different connections.

Chris, have you considered publishing your code as open source?  It would be very handy to have a python class representing the classic :)


interesting...

K7IQ 🌛  He/She/Me

cpfl

Ah ha! That's the missing snippet of information that I need. I will play around with it and see how it goes. Thanks!
Off-Grid in a 320 sqft tiny home (plus 320 sqft attached workshop) in Texas, USA: Midnite Solar Classic 150, Magnum Energy MS4448PAE, 9 x Kyocera KD240 (2160 watts) + 9 x Kyocera KU265 (2385 watts), 16 x GC2 (400AH 48V), Raspberry Pi (ethernet & RS485 monitoring).

atop8918

Hi, everyone,

In order to unlock the classic you must write the unit's serial number to registers 0x7001 and 0x7002. This is done as follows:

For this example the serial number will be: 0x12345678

0x7001 = MSB(Serial number)  [0x1234]
0x7002 = LSB(serial number)   [0x5678]
{For those not used to C's '0x' notation, this is a hexadecimal representation useful for dealing with binary numbers.}

Note that these registers are "MODBUS" 1-indexed, your actual write-multiple registers command packet will use 0x7000 and 0x7001.

The unlock will work for the duration of the TCP session, once you close the connection the Classic will re-lock itself. You do not need to couple a write to the password register everytime you write, only once when you first open the connection.

Hope this helps,
-Andrew

stephendv


boB

K7IQ 🌛  He/She/Me

cpfl

I never got back to this project, so thanks Steven!

Chris

Off-Grid in a 320 sqft tiny home (plus 320 sqft attached workshop) in Texas, USA: Midnite Solar Classic 150, Magnum Energy MS4448PAE, 9 x Kyocera KD240 (2160 watts) + 9 x Kyocera KU265 (2385 watts), 16 x GC2 (400AH 48V), Raspberry Pi (ethernet & RS485 monitoring).

stephendv

Updated the script so that you can now easily read values from the classic and upload them to xively.com.
Of course you'll need to sign up for a free xively account, then edit the script and change the API key and the Feed ID.
Script here:
https://github.com/stephendv/IslandManager/blob/master/scripts/classic.py

And example of xively output here:
https://xively.com/feeds/1669991140