That one I didn’t know. I will try to send this message tomorrow. However, how do you know that the protocol is like this? I mean, R3 is not supposed to work with KDM. Besides that, you don’t have a R3 version, correct? How you come up with this message?
If you look to the pdf I’ve attached, it make some sense since modem ID has only 2 bytes.
It would be really nice if you could share it. I was wondering how would be the easiest way to achieve that.
I’m like you, I’m trying to imagine the new R3 on the basis of the R2 that I know perfectly after 1 year of reverse engineer!
according to @Anson_Guo, the protocol is slightly difference between R2 and R3. I think they haven’t changed much. Two big differences are
the ID of the inverter which goes on 8 bits like yours which is 40000168 (mine is 4005 under R2).
The Modem ID also changed is on 4 bits now: 8001 on your pdf (me: FD0808F6).
R3 indicates panel efficiency values that I do not have on my KDM. Is it an extrapolated value or a measure which passes through HC12? Which would be something new compared to R2. (But which does not change the Modem request message).
You have no other choice than to test different ways of placing the modem ID + the Inverter ID in the Modem request message.
If I replace your ID on my Request message it would give: F2 40000168 65 8001. It may be missing a final word … I don’t know…
It will be cool, we will be able to see if the Modem R2 request message is the same whether it is to communicate with an Inverter R2 (ID on 4 bytes) or R3 (ID on 8 bytes).
This is what I’m trying.
msg_wake = [0xf2]
msg_question = [0x65]
msg_modem = [0xfd, 0x08]
msg_inverter_01 = [0x40, 0x00]
msg_inverter_02 = [0x01, 0x68]
msg = [msg_wake, msg_question, msg_modem, msg_inverter_01, msg_inverter_02]
msg_possible = list( itertools.permutations( msg ) ) # Try all different possibilities with permutation.
for msg_s in msg_possible:
msg_aux = [item for sublist in msg_s for item in sublist]
print(msg_aux)
ser.write( bytearray(msg_aux) )
in_hex = ser.read()
print(in_hex)
Not even with permutation. It doesn’t work.
I was thinking about it. If you add, anything, before the message for R2, it really doesn’t matter.
The R2 message was:
F2 40 05 65 FD 08 08 F6
The R2 inverter can respond if you send:
FF FF F2 40 05 65 FD 08 08 F6
R3 can be expecting anything, from a different wake up byte to question. I’m trying again a last bruteforce question permutation.
Did you test : wake, Inverter1, Inverter2, question, modem ?
F2 40000168 65 8001
Yes. However, I can have a missing protocol or even a defect hardware. There is no way to know. Do you suggest any internal hack?
unlikely Anson_Guo will answer --as he bounded by confidentiality not to give any details on the R3-- it seams the only way forward currently , would be to actually sniff the output of the newer modem unless you fluke it off . I would consider buying it… but I will think about it that once I get my HC-12… or if they have a sale on them and I can get cheaper then the current price point. $130 is a bit much for me blow on something I do not really need at the moment …
http://www.thebackshed.com/forum/uploads/robertrozee/2016-01-12_042418_HC12_config.zip
and also because it’s chinese new year 
That is correct.
Yes, I do. However, I’m not planing on using it. As I can see, there are only three of us interested in this topic. Maybe we can try a crowdfunding. You can keep the modem if you want, or @SuperNinja…
I just did tests on HC-12 of different brands:
If we find the right Modem request message, it remains to be seen whether it is compatible with the HC12 in the Inverter!
Hello all, very interesting and clarify thread
I’m dealing with WSC600 inverter and WSC rf433 modem.
I bought WSC600 inverters and WSC RF modem.
Inverters are R3 and modem is R2, then…. they don’t work together.
R3 == 8 dig code = 4 bytes, R2 == 4 dig code = 2 bytes …
I’m thinking in develop a “gateway translator” with one HC-12 and microcontroller.
Receive R3 format and send R2 format and vice versa.
R2 format it is clear: F2 code-inverter 65 code-modem in others words …
F2 xx xx 65 mm yy yy yy yy
But, what is the format of R3?
I am tested several combinations but all without success.
Any suggestion?
Hello @Ducati, that is what we are trying to achieve. We are still waiting @Stephen to test his R3 modem. If that doesn’t work, the new modem is needed for reverse eng.
I am still waiting for hc-10 to arrive was suppose to be here last week still waiting - I ordered another one already just in case that one got lost lets see which one gets here first – but what i can see we will probably need to buy the new modem r3 modem to sniff the signal from it or if someone has one provide a sample from it
Another test ahead…
In my WVC600 R3 inverter, I desolder (removed) the HC-12 module and I tested it alone.
I compared it with other HC-12 that I bought in Alliexpress
Conclusion:
HC-12 WSC = V2.6, HC-12 Alliexpress = V2.4 but both communicate well with each other.
It is possible to dump the flash (WVC600)? Can we try to find the message looking over the hex file?
Both HC-12 are not identical (form factor chip and firmware…) but they communicate perfectly with each other, therefore they are functionally identical.
@Ducati, can you try brute force? It can take some time. You need to change msg_inverter_01 and _02 with your inverter ID.
#!/usr/bin/python
# -*- coding: iso-8859-1 -*-
import serial
import time
import itertools
ser = serial.Serial('/dev/ttyUSB0', 9600, timeout = .5)
time.sleep(2)
msg_wake = [0xf2]
msg_question = [0x65]
msg_ct = [0x01]
msg_modem_01 = [0x80, 0x55]
msg_modem_02 = [0x08, 0xf6]
msg_inverter_01 = [0x40, 0x00]
msg_inverter_02 = [0x01, 0x68]
msg = [msg_ct, msg_wake, msg_wake, msg_question, msg_question, msg_modem_01, msg_modem_02, msg_inverter_01, msg_inverter_02]
msg_possible = list( itertools.permutations( msg ) )
for msg_s in msg_possible:
msg_aux = [item for sublist in msg_s for item in sublist]
for i in range(0,2):
ser.write( bytearray(msg_aux) )
in_hex = ser.read()
print(in_hex, end=" ", flush=True)
ser.close()