Miscellaneous additions to the Megatec protocol variants

[dvdesolve]

I want to add some extra info about Megatec protocol. That's a partial translation of this web page - some obvious and well-known parts are omitted, as well as dubious points. Also some info obtained from RS232 sniffering is added too. NB: not all UPSes are capable to answer/consume these commands!

EDIT: for Q2, Q6 and WA commands see update in this comment

Command	Description
AR?, AR0, AR1	Querying/disabling/enabling auto power-on feature (known as auto restart for some Ippon UPSes). Enabled by default (AR1). If option is off (AR0) then UPS will stay powered off even after mains return and should be switched on manually by using power button
AT?, AT0, AT1	Querying/disabling/enabling auto test feature
BL?, BL	Battery level (in percents), usually represented as 3-digit number with explicit 0 at the beginning
BPS	Query bypass status. Typical answer: (230.4 000.0 000.0 49.9. Fields 1--3 should be L1-N, L2-N and L3-N input bypass voltages, field 4 is input bypass frequency
EB?, EBnn	Query/set number of external battery packs
EF?	Acceptable frequency deviations for HE/ECO mode (in percents)
EV?	Acceptable voltage deviations for HE/ECO mode (in percents)
FW?	Firmware version
GR?, GR0, GR1	Query/disable/enable green mode (WinPower provides Energy Saving feature to control this mode). Some UPSes switch itslef off after 5 mins without load
IP?, IPN, IPW, IPG	Query/set acceptable deviations for different modes: normal (IPN), wide (IPW), generator (IPG). Corresponding LEDs will be toggled for Smart Winner UPS
M	Query protocol type: the answer is usually P, T, V, C and some others
Q2	Query UPS status (analogous to Q1). Typical answer: (226.6 224.3 228.0 226.6 229.9 000.0 000.0 000 000 000 49.9 327.6 18.0 00000000 999.24 100 02 00 00 00 00 00000000 11. As far as I was able to decipher this first three fields correspond to the L1-N, L2-N and L3-N input voltages, fifth field is output voltage (3/1 Ippon UPS was tested though, may be fields 5--7 correspond to the L1-N, L2-N and L3-N output voltages) eleventh field seems to be frequency (don't know, input or output), twelfth field is battery voltage, thirteenth field is temperature, 15th field may be estimated runtime (in minutes?) and 16th field is battery level (in percents, with leading zero). However, I'm not sure about fields 4, 6--11, 14--23
Q4	Yet another UPS status query. Typical answer: (MMM.M ???.? ???.? NNN.N PPP.P ??? QQQ RR.R ??? ??? SS.S TT.T flags. Some flags: E - test in progress, A - mains fault, on battery, C - bypass/AVR mode
Q6	Query UPS status, especially useful for three phase models. Typical answer: (227.0 225.6 230.0 50.0 229.9 000.0 000.0 49.9 007 000 000 327.8 000.0 23.0 06932 100 32 00000000 00000000 11. Fields 1--3 are L1-N, L2-N and L3-N input voltages, field 4 is input frequency, fields 5--7 should be L1-N, L2-N and L3-N output voltages, field 8 is output frequency, field 9 is load (in percents, with leading zero), field 12 is battery voltage, field 14 is temperature, field 15 is estimated runtime (in seconds), field 16 is battery level (in percents, with leading zero)
QBL	Query battery stats. Typical answer: (026.5 02 01 068 255. Field 1 is battery voltage, field 2 is a number of batteries connected in series, field 3 is a number of batteries connected in parallel, field 4 is battery level (in percents, with leading zero), field 5 is estimated runtime (in minutes?)
QI	Query serial number info
QLDL	Query min and max load stats
QMD	Query nominal UPS stats such as power capacity, number of batteries etc
QMF	Query manufacturer info
QMOD	Query current status code
QOF	Query output frequency info
QP	Query acceptable bypass limits. Typical answer: (45.0 55.0 176 264 EpbraDokc. Fields 1 and 2 are low and high limits for input bypass frequency, fields 3 and 4 are the same but for the voltage, field 5 is flags
QRI	Yet another query for nominal UPS stats
QVFW	Yet another firmware version query
SASV07?	Query for serial number. Typical answer starts with GASV07D string
TC?	Query for temperature
V	Query for AVR mode settings. Typical answer: 165 200 220 240 275. Field 1 is low limit for battery transition, field 2 is low limit for engaging AVR boost, field 3 is nominal voltage, field 4 is high limit for engaging AVR buck, field 5 is high limit for battery transition
V?	Query for output voltage mode
V220, V230, V240	Set output voltage mode (corresponding LED may be toggled)
WH	Query for model info and nominal specs. Typical answer: (00 00.00 00.00 INN3T20K 2 3/1 6 230 50.00 024 02.00 005.00 015.00 005 00 40 110 276 45.00 55.00. Seems to be model code (field 4), topology (field 6), nominal voltage (field 8) and frequency (field 9), number of batteries (field 10)
WA	Query for power/load stats. Typical answer: (001.4 000.0 000.0 001.4 000.0 000.0 001.4 001.4 006.5 000.0 000.0 007 00000000. Fields 1 and 7 seems to be real power measurements on output while fields 4 and 8 - the full one. This example a bit clumsy because in that case cos(phi) was about 1, but in another measurements I was able to get different readings. Not sure why these fields are in pairs (m. b. rolling average?). Field 9 is a current (amps), field 12 - load (percents)

[jimklimov]

@dvdesolve : thanks!

V | Query for AVR mode settings. Typical answer: 165 200 220 240 275 <...>

Do you know if there is really no leading parenthesis, or is this a typo? (It is same way in original document)

[dvdesolve]

I'm not sure, because this is the info which I got on that web page. However I think that it should start with ( - seems like the most of the answers start with left parenthesis (F request is an exception)

[dvdesolve]

Also I want to enlist some other commands which I was able to sniff during WinPower testing. However, my UPS (Innova RT 3/1 20K) answered NAK to all of these requests (SASV07? is an exception). Interesting enough that requests are always in sequence when Scan for devices function is called in GUI. After that sequence WinPower decides to use Q6 protocol variant (after SASV07? being successful).

Command	Answer
CB24	NAK
SASV07?	GASV07D + serial number
PISV07?	NAK
WHSV07?	NAK
Q4SV07?	NAK
F4SV07?	NAK
Q1SV07?	NAK

I can also try to check conversations between WinPower and 850, 1500 and 2200 Back Basic models, if it would be useful

[jimklimov]

I think it might be, thanks

[dvdesolve]

Checked for 850 version (I think that 650 will behave the same) via USB sniffer. In case of unknown request 650/850 model answers that request back.
WinPower starts device discovery with SASV07?, like with Innova RT 3/1 20K (may be standard way to discover devices). This command is unknown for UPS. Then periodical polling takes place. I was able to catch the following commands: M (the answer was C), F, Q1, SASV07?, Z, BT?, BL?. UPS understands only first three and answers in a well-known manner. The rest of the list is unknown.

EDIT: checked 1500/2200 as well. The behavior is exactly the same. So, it looks like 650/850/1500/2200 models are just siblings from the firmware point of view.

Looking at the whole info that I was able to get I can conclude that, at least, WinPower tries to discover device type by issuing some sort of ping requests (*SV07? family of them). If device answers request back then WinPower may decide that it's just plain Megatec Q1 variant and rely purely on Q1 and F requests. GUI confirms it indirectly - all info presented in main window is just processed Q1/F answers. No battery count, no serial info, no more info at all.

May be other families with additional properties (3/1, 3/3, with bypass, ECO/HE models etc) will answer to the *SV07? requests properly so WinPower will discover them in a right way too. So, maybe it worth to check PISV07?, WHSV07?, Q4SV07?, F4SV07? and Q1SV07? requests on UPS models which are supported by WinPower...

[jimklimov]

Well, polling by device model does make sense, as long as there is some classifier of models to their concept of what NUT would call protocols in nutdrv_qx or subdrivers in usnhid-ups...

[dvdesolve]

I think that the very first classifier is *SV07? query - if the device answers one of them properly, then it can be attributed to one of the base classes (e. g., back UPSes, line-interactive, inverters, 3/1, 3/3, etc...). Then issuing some specific commands, such as WH, can give us even more info about specific device model.

BTW I was able to grep huge list of commands which are known to the WinPower software. It already contains a lot of well-known queries, though it lacks some of sniffed ones. Here it is:

AR
AR?
AT
AT?
BA
BA?
BB
BB?
BF
BF?
BL?
BM
BM?
BO
BO?
BPS
BS
BS?
BT?
BUS?
BUSN
BUSN?
BUSP
BUSP?
BUZW=
BV
BV?
C
CA
CA?
CB
CB?
CF50
CF60
CL
CLS
CP
CP?
CT
CU
CU?
DAD
DI
DS
DS
EB
EB?
EF
EF?
EPO
EV
EV?
F
FH
FM
FR
FR?
FS
FS?
FT
FUNC?
FUNCD 
FUNCE 
FW
GPD
GR
GR?
IP
IP?
LF
LF?
LM
LM?
LSARD01,
LSARD01?
LSARD02,
LSARD02?
LSASD01,
LSASD01?
LSASD02,
LSASD02?
LSOFF00?
LSOFF01,
LSOFF01,
LSOFF01?
LSOFF02,
LSOFF02?
LSON01,
LSON01?
LSON02,
LSON02?
LVHL
LVHL?
LVS
LVS?
M
MANUFW=
MASTERW=
MD
MODW=
MS
MT
MT?
MV
MV?
MW
MW?
NB
NB?
OUT
OVS
PA
PA?
PD
PE
PF
PI
PLS
PLS?
PSmGnLpHqExxxxDxxx
Q
Q
Q1
Q2
Q4
Q6
Q7
QA
QC
QF
QI
QLSS01?
QLSS02?
QMT
QN
QOF
QP
QR
QS
QS
QU
RST
RT
S
S1
S2
SASV07?
SCE
SD?
SETDLYTIMEW=
SETNOMVW=
SETSYNWINW=
SF
SF?
SFADJW=
SI
SI?,
SIHLS
SILLS
SL
SL?
SMHLS
SMLLS
SNW=
SPI
SPI?
SR
SR
SR
SR?
ST
STS
SVADJW=
T
T
TC?
TD
TD?
TL
UL
V
V
V?
VHLS
VHLS?
VLLS
VLLS?
VS
VS?
VSR
VT
VT?
WA
WA
WC
WF
WH
WH
WHI
WHR
WHS
WHT
WM
Z

[dvdesolve]

LSARD* commands are related to the outlet control onDelay, LSASD* - to the offDelay, LSON* - to the manualOn and LSOFF* - to the manualOff.

[dvdesolve]

Many thanks to the @shangjiaxuan for Santek command list. I was able to translate it and compare with my current findings about new Qx protocol dialects (namely Q2 and Q6). Here are the updates.

Q2

(MMM.M MMM.M MMM.M NNN.N PPP.P PPP.P PPP.P QQQ QQQ QQQ RR.R SSS.S TT.T b7b6b5b4b3b2b1b0 ttt.tt CCC BB ff ff ff ff wwwwwwww YO

• First three groups of MMM.M correspond to the input voltages on phases R (input.L1-N.voltage), S (input.L2-N.voltage) and T (input.L3-N.voltage). For single phase input systems readings for S and T will be 0. Units: V.
• According to the translation of the PDF NNN.N stays for "last voltage during discharge" and for some models may be set to 000.0 in a force manner. However, I think this value is the same like "input fault voltage" in Q1 (for phase R in three phase system). Units: V.
• Three groups of PPP.P correspond to the output voltages on phases R (output.L1-N.voltage), S (output.L2-N.voltage) and T (output.L3-N.voltage). For single phase output systems readings for S and T will be 0. Units: V.
• Next three groups of QQQ stay for load percentages on phases R, S and T. These values are just siblings for output current in Q1 variant. I'm not sure if we can assign these readings to the output.L1.load, output.L2.load and output.L3.load. For single phase systems it's very easy to assign QQQ from Q1 reading to the ups.load, I don't know what is the proper way to do so in 3 phase system. Units: %.
• RR.R is an input.frequency. Units: Hz.
• SSS.S is a battery.voltage. In contrast to the similar reading with Q1 that's the full battery voltage and not divided by the cell number (according to the translation). Units: V.
• TT.T is a ups.temperature reading. Units: C.
• Bit pattern b7b6b5b4b3b2b1b0 seems like to be exactly the same as in case of Q1 protocol variant (according to the translation).
• ttt.tt is an battery.runtime estimation. Units: s.
• CCC is a battery.charge. Units: %.
• BB is a battery test status. Possible values: 00 (idle), 01 (in progress), 02 (finished: no failure), 03 (finished: failure/warning), 04 (not possible/inhibite), 05 (cancel), 06 (reserved), 07 (other values).
• ff ff ff ff encodes up to 4 error codes simultaneously and reserved for servicemans only.
• wwwwwwww encodes up to 4 warning codes simultaneously and reserved for servicemans only.
• Y can be 0 or 1 and indicates input transformer type - Y or delta (I assume that refers to the three phase topology - star or delta). If Y is 1 then we have star topology and LCD shows us input phase voltages. In case of Y being 0 we have delta topology and LCD shows us input line voltages.
• O is the same as Y but for output voltages.

Q6

(MMM.M MMM.M MMM.M NN.N PPP.P PPP.P PPP.P RR.R QQQ QQQ QQQ SSS.S VVV.V TT.T ttttt CCC KB ffffffff wwwwwwww YO

• First three groups of MMM.M correspond to the input voltages on phases R (input.L1-N.voltage), S (input.L2-N.voltage) and T (input.L3-N.voltage). For single phase input systems readings for S and T will be 0. Units: V.
• NN.N is an input.frequency. Units: Hz.
• Three groups of PPP.P correspond to the output voltages on phases R (output.L1-N.voltage), S (output.L2-N.voltage) and T (output.L3-N.voltage). For single phase output systems readings for S and T will be 0. Units: V.
• RR.R is an output.frequency. Units: Hz.
• Next three groups of QQQ stay for load percentages on phases R, S and T. These values are just siblings for output current in Q1 variant. Again, like in case of Q2, I'm not sure how to properly assign these readings to the NUT's variables. Units: %.
• SSS.S is a positive (not sure what that means - may be some models have two separate battery packs inside for some sophisticated inverter topologies) battery.voltage. In contrast to the similar reading with Q1 that's the full battery voltage and not divided by the cell number (according to the translation). Units: V.
• VVV.V is a negative sibling for SSS.S. Units: V.
• TT.T is a ups.temperature reading. Units: C.
• ttttt is an battery.runtime estimation. Units: s.
• CCC is a battery.charge. Units: %.
• K is a "system mode" designation. Possible values: 0 (power on state), 1 (standby), 2 (bypass), 3 (line), 4 (battery), 5 (battery test), 6 (fault), 7 (converter; inverter works to provide very stable output frequency), 8 (HE/ECO), 9 (shutdown).
• B is a battery test status. Possible values: 0 (idle), 1 (in progress), 2 (finished: no failure), 3 (finished: failure/warning), 4 (not possible/inhibite), 5 (cancel), 6 (reserved), 7 (other values).
• ffffffff encodes up to 4 error codes simultaneously and reserved for servicemans only.
• wwwwwwww encodes up to 4 warning codes simultaneously and reserved for servicemans only.
• Y can be 0 or 1 and indicates input transformer type - Y or delta (I assume that refers to the three phase topology - star or delta). If Y is 1 then we have star topology and LCD shows us input phase voltages. In case of Y being 0 we have delta topology and LCD shows us input line voltages.
• O is the same as Y but for output voltages.

WA

(WWW.W WWW.W WWW.W VVV.V VVV.V VVV.V TTT.T SSS.S AAA.A AAA.A AAA.A QQQ b7b6b5b4b3b2b1b0

• First three groups of WWW.W correspond to the output real power on phases R (output.L1.realpower), S (output.L2.realpower) and T (output.L3.realpower). For single phase input systems readings for S and T will be 0. Units: kW.
• Next three groups of VVV.V correspond to the output power on phases R (output.L1.power), S (output.L2.power) and T (output.L3.power). For single phase input systems readings for S and T will be 0. Units: kVA.
• TTT.T is an ups.realpower. Units: kW.
• SSS.S is an ups.power. Units: kVA.
• Three groups of AAA.A correspond to the output current on phases R (output.L1.current), S (output.L2.current) and T (output.L3.current). For single phase input systems readings for S and T will be 0. Units: A.
• QQQ is an ups.load. Units: %.
• Bit pattern b7b6b5b4b3b2b1b0 seems like to be exactly the same as in case of Q1 protocol variant (according to the translation).

[dvdesolve]

Also need to add: according to the Santak specs the meaning of status bits b1 and b0 in both Q1 and Q2 answers a bit different from classic Megatec Q1 variant: b1 is internally reserved to be 1 and b0 is reserved to be 0. So because of b1 being forcibly set to 1 "Shutdown Active" will always be set too. That seems to be the case where ignoresab comes to play.
Even more to add: during testing innovart31 protocol driver I've noticed that beeper status not being properly indicated in Q1 request even when alarm sound worked fine. That also might be because of advanced UPS versions tends to work via Q2/Q6 instead of Q1 so Santak's status bit table is right.