Miscellaneous additions to the Megatec protocol variants

[dvdesolve]

I want to add some extra info about Megatec protocol. That's a partial translation of this web page - some obvious and well-known parts are omitted, as well as dubious points. Also some info obtained from RS232 sniffering is added too. NB: not all UPSes are capable to answer/consume these commands!

EDIT: for Q2, Q6 and WA commands see update in this comment

Command	Description
AR?, AR0, AR1	Querying/disabling/enabling auto power-on feature (known as auto restart for some Ippon UPSes). Enabled by default (AR1). If option is off (AR0) then UPS will stay powered off even after mains return and should be switched on manually by using power button
AT?, AT0, AT1	Querying/disabling/enabling auto test feature
BL?, BL	Battery level (in percents), usually represented as 3-digit number with explicit 0 at the beginning
BPS	Query bypass status. Typical answer: (230.4 000.0 000.0 49.9. Fields 1--3 should be L1-N, L2-N and L3-N input bypass voltages, field 4 is input bypass frequency
EB?, EBnn	Query/set number of external battery packs
EF?	Acceptable frequency deviations for HE/ECO mode (in percents)
EV?	Acceptable voltage deviations for HE/ECO mode (in percents)
FW?	Firmware version
GR?, GR0, GR1	Query/disable/enable green mode (WinPower provides Energy Saving feature to control this mode). Some UPSes switch itslef off after 5 mins without load
IP?, IPN, IPW, IPG	Query/set acceptable deviations for different modes: normal (IPN), wide (IPW), generator (IPG). Corresponding LEDs will be toggled for Smart Winner UPS
M	Query protocol type: the answer is usually P, T, V, C and some others
Q2	Query UPS status (analogous to Q1). Typical answer: (226.6 224.3 228.0 226.6 229.9 000.0 000.0 000 000 000 49.9 327.6 18.0 00000000 999.24 100 02 00 00 00 00 00000000 11. As far as I was able to decipher this first three fields correspond to the L1-N, L2-N and L3-N input voltages, fifth field is output voltage (3/1 Ippon UPS was tested though, may be fields 5--7 correspond to the L1-N, L2-N and L3-N output voltages) eleventh field seems to be frequency (don't know, input or output), twelfth field is battery voltage, thirteenth field is temperature, 15th field may be estimated runtime (in minutes?) and 16th field is battery level (in percents, with leading zero). However, I'm not sure about fields 4, 6--11, 14--23
Q4	Yet another UPS status query. Typical answer: (MMM.M ???.? ???.? NNN.N PPP.P ??? QQQ RR.R ??? ??? SS.S TT.T flags. Some flags: E - test in progress, A - mains fault, on battery, C - bypass/AVR mode
Q6	Query UPS status, especially useful for three phase models. Typical answer: (227.0 225.6 230.0 50.0 229.9 000.0 000.0 49.9 007 000 000 327.8 000.0 23.0 06932 100 32 00000000 00000000 11. Fields 1--3 are L1-N, L2-N and L3-N input voltages, field 4 is input frequency, fields 5--7 should be L1-N, L2-N and L3-N output voltages, field 8 is output frequency, field 9 is load (in percents, with leading zero), field 12 is battery voltage, field 14 is temperature, field 15 is estimated runtime (in seconds), field 16 is battery level (in percents, with leading zero)
QBL	Query battery stats. Typical answer: (026.5 02 01 068 255. Field 1 is battery voltage, field 2 is a number of batteries connected in series, field 3 is a number of batteries connected in parallel, field 4 is battery level (in percents, with leading zero), field 5 is estimated runtime (in minutes?)
QI	Query serial number info
QLDL	Query min and max load stats
QMD	Query nominal UPS stats such as power capacity, number of batteries etc
QMF	Query manufacturer info
QMOD	Query current status code
QOF	Query output frequency info
QP	Query acceptable bypass limits. Typical answer: (45.0 55.0 176 264 EpbraDokc. Fields 1 and 2 are low and high limits for input bypass frequency, fields 3 and 4 are the same but for the voltage, field 5 is flags
QRI	Yet another query for nominal UPS stats
QVFW	Yet another firmware version query
SASV07?	Query for serial number. Typical answer starts with GASV07D string
TC?	Query for temperature
V	Query for AVR mode settings. Typical answer: 165 200 220 240 275. Field 1 is low limit for battery transition, field 2 is low limit for engaging AVR boost, field 3 is nominal voltage, field 4 is high limit for engaging AVR buck, field 5 is high limit for battery transition
V?	Query for output voltage mode
V220, V230, V240	Set output voltage mode (corresponding LED may be toggled)
WH	Query for model info and nominal specs. Typical answer: (00 00.00 00.00 INN3T20K 2 3/1 6 230 50.00 024 02.00 005.00 015.00 005 00 40 110 276 45.00 55.00. Seems to be model code (field 4), topology (field 6), nominal voltage (field 8) and frequency (field 9), number of batteries (field 10)
WA	Query for power/load stats. Typical answer: (001.4 000.0 000.0 001.4 000.0 000.0 001.4 001.4 006.5 000.0 000.0 007 00000000. Fields 1 and 7 seems to be real power measurements on output while fields 4 and 8 - the full one. This example a bit clumsy because in that case cos(phi) was about 1, but in another measurements I was able to get different readings. Not sure why these fields are in pairs (m. b. rolling average?). Field 9 is a current (amps), field 12 - load (percents)

[jimklimov]

@dvdesolve : thanks!

V | Query for AVR mode settings. Typical answer: 165 200 220 240 275 <...>

Do you know if there is really no leading parenthesis, or is this a typo? (It is same way in original document)

[dvdesolve]

I'm not sure, because this is the info which I got on that web page. However I think that it should start with ( - seems like the most of the answers start with left parenthesis (F request is an exception)

[dvdesolve]

Also I want to enlist some other commands which I was able to sniff during WinPower testing. However, my UPS (Innova RT 3/1 20K) answered NAK to all of these requests (SASV07? is an exception). Interesting enough that requests are always in sequence when Scan for devices function is called in GUI. After that sequence WinPower decides to use Q6 protocol variant (after SASV07? being successful).

Command	Answer
CB24	NAK
SASV07?	GASV07D + serial number
PISV07?	NAK
WHSV07?	NAK
Q4SV07?	NAK
F4SV07?	NAK
Q1SV07?	NAK

I can also try to check conversations between WinPower and 850, 1500 and 2200 Back Basic models, if it would be useful

[jimklimov]

I think it might be, thanks

[dvdesolve]

Checked for 850 version (I think that 650 will behave the same) via USB sniffer. In case of unknown request 650/850 model answers that request back.
WinPower starts device discovery with SASV07?, like with Innova RT 3/1 20K (may be standard way to discover devices). This command is unknown for UPS. Then periodical polling takes place. I was able to catch the following commands: M (the answer was C), F, Q1, SASV07?, Z, BT?, BL?. UPS understands only first three and answers in a well-known manner. The rest of the list is unknown.

EDIT: checked 1500/2200 as well. The behavior is exactly the same. So, it looks like 650/850/1500/2200 models are just siblings from the firmware point of view.

Looking at the whole info that I was able to get I can conclude that, at least, WinPower tries to discover device type by issuing some sort of ping requests (*SV07? family of them). If device answers request back then WinPower may decide that it's just plain Megatec Q1 variant and rely purely on Q1 and F requests. GUI confirms it indirectly - all info presented in main window is just processed Q1/F answers. No battery count, no serial info, no more info at all.

May be other families with additional properties (3/1, 3/3, with bypass, ECO/HE models etc) will answer to the *SV07? requests properly so WinPower will discover them in a right way too. So, maybe it worth to check PISV07?, WHSV07?, Q4SV07?, F4SV07? and Q1SV07? requests on UPS models which are supported by WinPower...

[jimklimov]

Well, polling by device model does make sense, as long as there is some classifier of models to their concept of what NUT would call protocols in nutdrv_qx or subdrivers in usnhid-ups...

[dvdesolve]

I think that the very first classifier is *SV07? query - if the device answers one of them properly, then it can be attributed to one of the base classes (e. g., back UPSes, line-interactive, inverters, 3/1, 3/3, etc...). Then issuing some specific commands, such as WH, can give us even more info about specific device model.

BTW I was able to grep huge list of commands which are known to the WinPower software. It already contains a lot of well-known queries, though it lacks some of sniffed ones. Here it is:

AR
AR?
AT
AT?
BA
BA?
BB
BB?
BF
BF?
BL?
BM
BM?
BO
BO?
BPS
BS
BS?
BT?
BUS?
BUSN
BUSN?
BUSP
BUSP?
BUZW=
BV
BV?
C
CA
CA?
CB
CB?
CF50
CF60
CL
CLS
CP
CP?
CT
CU
CU?
DAD
DI
DS
DS
EB
EB?
EF
EF?
EPO
EV
EV?
F
FH
FM
FR
FR?
FS
FS?
FT
FUNC?
FUNCD 
FUNCE 
FW
GPD
GR
GR?
IP
IP?
LF
LF?
LM
LM?
LSARD01,
LSARD01?
LSARD02,
LSARD02?
LSASD01,
LSASD01?
LSASD02,
LSASD02?
LSOFF00?
LSOFF01,
LSOFF01,
LSOFF01?
LSOFF02,
LSOFF02?
LSON01,
LSON01?
LSON02,
LSON02?
LVHL
LVHL?
LVS
LVS?
M
MANUFW=
MASTERW=
MD
MODW=
MS
MT
MT?
MV
MV?
MW
MW?
NB
NB?
OUT
OVS
PA
PA?
PD
PE
PF
PI
PLS
PLS?
PSmGnLpHqExxxxDxxx
Q
Q
Q1
Q2
Q4
Q6
Q7
QA
QC
QF
QI
QLSS01?
QLSS02?
QMT
QN
QOF
QP
QR
QS
QS
QU
RST
RT
S
S1
S2
SASV07?
SCE
SD?
SETDLYTIMEW=
SETNOMVW=
SETSYNWINW=
SF
SF?
SFADJW=
SI
SI?,
SIHLS
SILLS
SL
SL?
SMHLS
SMLLS
SNW=
SPI
SPI?
SR
SR
SR
SR?
ST
STS
SVADJW=
T
T
TC?
TD
TD?
TL
UL
V
V
V?
VHLS
VHLS?
VLLS
VLLS?
VS
VS?
VSR
VT
VT?
WA
WA
WC
WF
WH
WH
WHI
WHR
WHS
WHT
WM
Z

[dvdesolve]

LSARD* commands are related to the outlet control onDelay, LSASD* - to the offDelay, LSON* - to the manualOn and LSOFF* - to the manualOff.