[Mi5ke]

I have a Rolec 32A 7.2kW WallPod EV HomeCharge charger. Wondering what the various unused connections to the controller (ACSE0020) are for. Rolec (Gary Frost) won't tell me, he says "it's a secret, like the formula to Cocoa-Cola". Very odd/stupid/annoying. So...

Here is a list of connections, with those I know(?) annotated. Can you help me complete the picture?

L - Live
N - Neutral
E - Earth
COM - Common, for relay outputs?
RL2 - Relay 2, to power the main switching relay
RL1 - Relay 1?
HL1 - Hatch Lock 1?
HL0 - Hatch Lock 2?
MRI(?) - ?
12V - 12V supply out
5V - 5V supply out
0V - 0V supply out
R - red light, active low(?)
G - green light, active low(?)
B - blue light, active low(?)
EN - Enable??
SDN - .... Neutral?
SDL - ......Live?
TX - Transmit... what/how?
RX - Receive... what/how?
GND - Ground for comms?
CP - Control Pilot (data from car cable)
PX - Maximum current/power setting

tethered: via a resistor to GND, Red: 32A, Black: 16A;
socketed: via cable​

ERR - Error....what/how?

Will edit as more info arrives.

Thanks,

Mike

 

[HandyAndy]

Have a google for Mainpine Viridian ECU - if your ECU is the same clip-on that I have in my basic Rolec, then they are pin-compatible, apart from the LED outputs. You'll find (somewhere) a doc detailing the Mainpine connections, plus circuit diagram of how that works, so should be able to figure out what's what. Must dash now, but I'll try to remember to check inside my Rolec tomorrow for you.

 

[MusicLoverUK]

I'm interested in this too, but haven't had chance to investigate yet. The part of me that wishes I had time to indulge in hobby activities would love to have a go at hooking the Rx/Tx up to a little module that could turn the Rolec into a smart device...

 

[robbz23]

I don't think they are the same as a Mainpine Viridian units as they have a different pinout. After investigating it a bit it seems like they used the Openevse design and modified it a bit. The Rx and Tx seem to be serial lines which I want to investigate more. I found a page on the openevse site that shows what commands you can type to get some information back about firmware. So if it is openevse I should be able to report that back. My end goal is to upgrade it to the latest openevse firmware with a lcd screen and wifi via a ESP8266 board.

 

[robbz23]

I got a used unit that was reported as being bad and it turns out the fault was the solenoid for the socket was drawing too much power over a long period of time for the power supply in the unit. For now I have just disconnected the solenoid which is connected to HL0 and 12v. It works fine without the solenoid and I know not to unplug it while its charging.

 

[Patlon]

This is all very interesting, but I am just swapping from a Type 1 to Type 2 to a Type 2 to Type 2 and simply want to know the wiring for the new Type 2 tethered cable. Photo and/or wiring diagram link would be appreciated, even though I have an electrician doing the work. My unit is a Rolec Wallpod ACEQ0180 RCBO B40. The old cable seems to have only one 'data' wire and the new Type 2 has two, grey and black.

 

[EVSEDOC CANE]

tethered cables only use one CP wire, use a multi meter and buzz out the CP wire (Likely the black one), ALWAYS make sure the cable is rated to at least that of the charger!

 

[barneyd]

I have a Rolec 32A 7.2kW WallPod EV HomeCharge charger. Wondering what the various unused connections to the controller (ACSE0020) are for. Rolec (Gary Frost) won't tell me, he says "it's a secret, like the formula to Cocoa-Cola". Very odd/stupid/annoying. So...

Here is a list of connections, with those I know(?) annotated. Can you help me complete the picture?

L - Live
N - Neutral
E - Earth
COM - Common, for relay outputs?
RL2 - Relay 2, to power the main switching relay
RL1 - Relay 1?
HL1 - Hatch Lock 1?
HL0 - Hatch Lock 2?
MRI(?) - ?
12V - 12V supply out
5V - 5V supply out
0V - 0V supply out
R - red light, active low(?)
G - green light, active low(?)
B - blue light, active low(?)
EN - Enable??
SDN - .... Neutral?
SDL - ......Live?
TX - Transmit... what/how?
RX - Receive... what/how?
GND - Ground for comms?
CP - Control Pilot (data from car cable)
PX - Maximum current/power setting

tethered: via a resistor to GND, Red: 32A, Black: 16A;​

socketed: via cable​

ERR - Error....what/how?

Will edit as more info arrives.

Thanks,

Mike

Has anyone got anywhere with this?

I had a crack at it today using this guide: OpenEVSE Serial Communications Guide but I got absolutely no response from the controller.

A few possibilities:

• My FTDI adapter is not working (I don't think so because it works on other things and the Tx LED is flashing when I type)
• The FTDI adapter was set to the wrong voltage (I think it would be 5v)
• The TX/RX are the wrong way around (I followed the convention in the guide and tried swapping them)
• The GND connection isn't reference ground for the serial port (I tied also with the 0v on the top of the unit)
• The baud rate is different to OpenEVSE (I tried a couple of other rates, 9600 and 19200, also you usually get random characters in that case rather than nothing.
• The number of bits is wrong
• The serial port is disabled in the Rolec version.

It would be amazing if you could control the Rolec controller with the OpenEVSE RAPI because you can add WiFi connected smart features for under £35, less if you buy a generic ESP32 and load the hardware yourself.

 

[sasquatch]

I had a quick play around this afternoon - I have one of the new 'Smart' wallpods - this has an off the shelf GPRS modem (appears to be a 'Quasar GPRS modem') hooked up to the tx/rx/gnd pins on the mode 3 controller - unfortunately even though there was clearly some comms happening between the modem and the Rolec controller, my serial terminal didn't pick anything up.

 

[barneyd]

I guess the first question is what voltage the serial port is using TTL or RS232. If it’s TTL, you probably wouldn't pick it with a normal serial port. Quick look at Quasar data sheet suggests it’s RS232, which is probably why I didn’t get anything trying it with TTL. Next challenge is baud rate.
They might also have specific firmware in the controller for the smart version, leaving those of us with old units with disabled serial ports.
I suppose it could be a current loop but I doubt it because that would make it hard to use a standard modem.

 

[barneyd]

Might also be worth checking the orientation of tx and rx. Is it tx/rx on the controller or the name of the pins you connect to on the modem?

 

[barneyd]

Bit more research and the smart unit data sheet says it contains an Ethernet to rs232 converter so probably standard serial line voltages.

Im stuck because I have nothing connected to the terminals so nothing to sniff. Interested to see if you can capture any activity. Even more interesting would be if anyone has the solar version because that will be varying the available current signal up and down.

 

[sasquatch]

I had a bit more of a play - I could get some noise from the controller when it powered on, but couldn't obviously see anything sensible in the data stream, so I'm guessing either random noise or a baud rate mismatch. I could issue standard AT commands to the GPRS modem though, although again nothing really useful came of it (other than the fact the SIM isn't enabled for voice calling! )

I needed an excuse, and this was it, to pick up a dirt cheap logic analyser from Amazon which should be here tomorrow - hoping that will help with seeing what's actually happening on the wire - the problem with tapping into the serial line with a normal converter is that I can only 'see' one side of the conversation.

On the 'smart' chargepoint the tx/rx/gnd lines on the Mode 3 controller are wired into a cut-in-half serial cable, presumably the one that comes in the box with the modem, with all the other lines just flapping in the breeze so I'm hoping that whatever is going on is standard RS232 level signalling, especially as the modem doesn't appear to have any real capabilities for special behaviours/protocols.

Depending on how I get on with the logic analyser, next step is to try setting up a serial-bridge with socat on Linux and see if I can sit between the two devices. Hoping the LA will solve the baud/parity/etc. issue - I get the feeling its not something standard with 8/n/1, especially based on comments from others that Rolec favour 'security through obscurity'!

 

[sasquatch]

They might also have specific firmware in the controller for the smart version, leaving those of us with old units with disabled serial ports.

Just on that point - if I can crack it with the smart controller I can test with a potentially-dumb controller, too - I have one in the old charging point. Curiously, it has the same model number as the 'smart' one (ACSE0020).

 

[barneyd]

I could issue standard AT commands to the GPRS modem though, although again nothing really useful came of it (other than the fact the SIM isn't enabled for voice calling! )

Sounds like a fun project. From what I’ve read on both the modem Datasheet and the smart charger Datasheet, I’m 99% sure it’s RS232.

AT&V0 any help on the config?
There could also be something in the S registers. AT&V1

It’s a lot of years since I’ve looked at AT commands but there might be a clue. Shouldnt be too hard to pick it out with the logic analyser.

The big challenge with reverse engineering is deciphering the protocol. I wonder if the start/stop comes via the modem or if the controller is smart enough to download a schedule and manage it internally - if so, there must be some messages to synchronise a real time clock.

 

[barneyd]

I had a look at this as far as I can with a dumb charger. This is what I found:

• Tx and Rx on the controller are as seen from the controller's point of view
• Pulse width is 104uS so 9600 Baud
• Voltage level is +/- 2.5v (5v pk-pk). I guessing that's why the serial interface has its own GND terminal. It's probably biased 2.5v above the controller's 0v.
• I can receive data on my laptop with a USB-Serial (RS232) adaptor set up with 8/n/1.
• When the unit powers up I get: "Rolec Mode3 Controller Software Version 1.0.0.007"

I had to invert the channel in the PulseView UART config to get it to correctly decode the text because the controller Tx line idle state is low whereas the UART decoder was expecting idle high.

I was planning to use one of these: WiFi to RS232 converters so I could connect to the serial port by TCP over WiFi but they use a common ground for the signal and the power supply, which may be a problem here. How is the modem powered?

The alternative is an HLK-RM04 which operates at TTL level and connecting to Tx/Rx and the 0v terminal on top of the controller rather than the biased serial GND terminal.

 

[sasquatch]

That's very interesting - I've not had a chance to play with this properly since my last post but you've given me hope there might be something normal being spat out! I had a play with the AT commands for the modem (following a random PDF I found via Google) but it didn't really tell me anything particularly interesting/noteworthy (i.e. the modem was running what seemed to be standard/off the shelf firmware, nothing Rolec specific).

The modem is powered from a DIN mounted PSU in the Wallpod, which takes 240v in and spits out something approximately 12v. The Rolec charge controller has both 5v and 12v outputs, I'm not sure if the controller 0v rail is common with the signal ground though, I'll see if I can buzz it out and let you know.

 

[sasquatch]

OK, I had a few mins so hooked the logic analyzer up to the modem/Rolec controller, and it's revealed some interesting info. The controller talks to the modem via standard AT commands (as expected), and thanks to @barneyd posting above we know its 9600/8/n/1.

So, first things first, I'm not seeing the same Rolec banner as above - the controller appears to jump straight into talking to the modem - I've got a dump of the comms sequence which looks a bit like this to start with:

AT
OK
AT+CSQ
+CSQ: 22,0

OK
AT+CIPSTATUS
OK

STATE: IP INITIAL
AT+CREG?
+CREG: 0,5

OK
AT+CGATT=1
OK
AT+CSTT="em"
OK
AT+CIICR
OK
AT+CIFSR
10.xx.xx.xx [[redacted]]
AT
OK
AT+CSQ
+CSQ: 22,0

OK
AT+CIPSTATUS
OK

STATE: IP STATUS
AT+CIPSTART="TCP","rolec.api.evapi.co.uk","50099"
OK

Once the TCP connection has been established, the controller appears to authenticate with the remote host, before starting their chatter in what appears to be plain text with fixed string lengths:

CONNECT OK
AT+CIPSEND=45

[EVHS9999/ARXXXXA]

SEND OK
[AUTH]
AT+CIPSEND=45

[A02_EVHS9999_0000_000000_22_RA_32320011_000]

SEND OK

It then looks like remote commands are issued from the server which appear as a 4 letter 'word' in brackets, for example I've seen [FIRM], [POLL], [DISA] and [ENAB]. Replies are sent in the same format as the above, with most of the payload remaining the same. Here's a dump from enabling/disabling 'Smart Charging' via the app:

[DISA]
AT+CIPSEND=45

[U05_EVHS9999_0000_000000_22_RA_32320010_000]

SEND OK
[POLL]
[ENAB]
AT+CIPSEND=45

[V06_EVHS9999_0000_000000_22_RA_32320011_000]

That's as far as I got so far... hope that helps someone!

Oh, and one final point, if people think they can pretend to be a charge controller:

$ host rolec.api.evapi.co.uk
rolec.api.evapi.co.uk has address 10.0.226.11

 

[barneyd]

Thanks for grabbing all of that.

The fact that you don't get the Rolec banner suggests you have a different version of firmware and the dumb controller isn't looking for the modem.

As you say, the initial part is checking the connection to the mobile network, establishing an AP, opening a GPRS call and then initiating a TCP session. The interesting bit is what goes backwards and forwards over that session. I think in the above, the bits in blue are what the controller sends to the server because the AT+CIPSEND=45 is the controller readying the modem for a 45 character string to send over the TCP connection.

When I get a minute, I'm going to try to transmit some of the four letter word messages to the controller and see if it responds. Just because the controller doesn't try to use a modem to establish a TCP connection to a remote server doesn't mean it can't be controlled locally using the protocol that arrives over TCP so there could be one last hope.

 

[sasquatch]

I've just hooked my "dumb" controller up to the serial port on my laptop and I get the same banner as you, albeit a slightly older version:

Rolec Mode3 Controller
Software Version 1.0.0.008

The formatting in my original post is a bit 'meh', and the blue bits are because the forum took the first characer (>) to mean a quote, but that's actually the prompt back from the modem for the data to send. The controller always seems to send 45 bytes of data - the initial "login" packet is padded out with spaces to make it 45 bytes long.

I tried firing various things at my 'dumb' controller, but to no avail. I had a quick prod at the innards and its an Atmel ATMega328 chip - I'm not sure if its possible to dump the firmware from these or not but that might be a good place to start. If you pop the front cover off the controller there's what seems to be a programming header (a 2x3 dupont style) soldered to the board. There's also a MAX232 chip which seems to handle the serial comms.

Oh, and the 0V, Gnd and Mains Earth terminals are all commoned together.