I have searched hi and low, contacted service of li-time, but no documentation is available for this port, I have done some meqsurements with a multimeter and know that pin 3 and 4 are connected to batt - so are gnd. That leaves 1/2 or 5/6 as data pins for RS485. I measure +3v between the gnd and all pins, so i am at a loss.
I have a waveshare RS485 to Eth connected to pin 1/2 for test and with the multimeter i see no fluctuations in voltage, same goes for pin 5/6.
They seem pulled high i guess, i have tried playing with the baudrate etc and connected to the waveshare with an app and sent data to it trying to get something back but no response.
So here is this message in-case someone has reverse engineered that RS485 RJ12 port.
The BT app to this device works fine, but there is no reference to the hardware port anywhere in this app.
Even if you find the R485 serial line, you are still in dark woods if you don’t know anything about the serial protocol. What you do with data line if you have no idea what to do with that. These serial connections are usually “polling” type, so if you don’t make specific request, there is no communication.
Does the display user interface give some hints, some serial parameter options?
Baud rate settings, server address or anything like that?
I got the document from the supplier but still no success, the supplier claims 9600 n 8 1
MPPT Solar Charge Controller MODBUS Protocol
1、MODBUS RTU Communication protocol format and Command resolution：
1.1、Format：
Starter
Addressfunction
fieldcode
Error
data
check
Terminator
1.2、Instruction：
(all below datas with“H”are Hexadecimal，on the contrary are Decimal)
1)Starter：>10ms
2)Address field：1byte，range：01H～F7H(Decimal1～247)，00H is Broadcast address，All slaves respond,
but do not return commands
3)function code：1byte
Access data
Command name
function codeError code
2byte03H83H
2byte06H86H
2byte10H90H
Restore factory defaultsNo access data78HF8H
Clear historyNo access data79HF9H
type
Read single or multiple
word registers
Write
a
single
word
register
Write consecutive N word
registers
4)data：
Nbyte
5)Error check：2byte is Device address、function code and data byte’s CRC Checksum.
6)Terminator：>10ms
Notes：
1)、data address and data are 2byte，send high byte first，then send low byte；for CRC, pls send low
byte first, then send high byte.
2)、Error code means there’s error under Frame data delivered by the server，Error exception response
returned by the client function code；Error code = function code | 80H
1.3、Processing flow chart：
1Exception code description
a、01H -- unsupported function code
b、02H -- PDU starting address wrong or PDU starting address+data length
c、03H -- Read register’s data or write register’s data is too long
d、04H -- Client failed to read or write register--Unused
e、05H -- The data checksum sent by the server is incorrect--Unused
Note：The server receives the exception code returned by the controller means that The controller received the
command from the server，But the command has an error，The server should resend the command.
1.3.1、Read register flow chart
1.3.2、Write a single register flow chart
21.3.3、Write continuous N register flow chart
1.4、Instance：
1.4.1、Read register
request：
description
Byte
command
number
Device addressBYTE01H～F7H
function codeBYTE03H
starting
address
Number of
words read
Check code
WORD
WORD
WORD
0000H～FFFFH
0001H～007DH
The CRC Checksum for all above
byte
3Normal response：
description
Device
address
function
code
Data length
Data
content
Byte
command
number
BYTE
BYTE
BYTE
WORD
...WORD
Check codeWORD
01H～F7H
03H
01H～FAH
Read data (send high byte first and
send low byte)
Read data (send high byte first and
send low byte)
The CRC Checksum for all above byte
Abnormal response：
description
Device
address
Byte
command
number
BYTE
01H～F7H
Error codeBYTE83H
Abnormal codeBYTEN
Check codeWORD
(N=1，2，3，4)
The CRC Checksum for all above
byte
1.4.2、Write a single register
request：
description
Device
address
function
code
starting
address
Byte
command
number
BYTE
BYTE
WORD
01H～F7H
06H
0000H～FFFFH
Write dataWORD0000H～FFFFH
Check codeWORDThe CRC Checksum for all above byte
Normal response：
description
Device
address
function
code
Byte
command
number
BYTE
BYTE
01H～F7H
06H
4starting
address
WORD
0000H～FFFFH
Write dataWORD0000H～FFFFH
Check codeWORDThe CRC Checksum for all above byte
Abnormal response：
description
Device
address
Error code
Abnormal
code
Check code
Byte
command
number
BYTE
BYTE
BYTE
WORD
01H～F7H
86H
N
(N=1，2，3，4)
The CRC Checksum for all above byte
1.4.3、Write consecutive N registers
request：
description
Device
address
function
code
starting
address
Byte
BYTE
BYTE
WORD
Number of
words
command
number
01H～F7H
10H
0000H～FFFFH
0001H～007DH
WORD
written
Number of
writing
BYTE
Data contentWORD
...WORD
Check codeWORD
1 times of the Byte number
Written data
(send high byte
first and send low byte)
Written data
(send high byte
first and send low byte)
The CRC Checksum for all above byte
Normal response：
description
Device
address
function
Byte
command
number
BYTE
BYTE
01H～F7H
10H
5code
starting
address
Written Byte
number
Check code
WORD
WORD
WORD
0000H～FFFFH
0001H～007DH
The CRC Checksum for all above byte
Abnormal response：
description
Device
address
Error code
Abnormal
code
Check code
Byte
command
number
BYTE
BYTE
BYTE
WORD
01H～F7H
90H
N
(N=1，2，3，4)
The CRC Checksum for all above byte
1.4.4、Restore factory defaults
request：
description
Device
address
function
code
Byte
command
number
BYTE
BYTE
01H～F7H
78H
Make up dataWORD0000H
Make up dataWORD0001H
Check codeWORDThe CRC Checksum for all above byte
Normal response：
description
Device
address
function
code
Byte
command
number
BYTE
BYTE
01H～F7H
78H
Make up dataWORD0000H
Make up dataWORD0001H
Check codeWORDThe CRC Checksum for all above byte
Abnormal response：
description
Byte
command
number
6Device
BYTE
address
Error code
BYTE
Abnormal
BYTE
code
Check code
WORD
01H～F7H
F8H
N
(N=1，2，3，4)
The CRC Checksum for all above byte
1.4.4、Clear history
request：
description
Device
address
function
code
Byte
command
number
BYTE
BYTE
01H～F7H
79H
Make up dataWORD0000H
Make up dataWORD0001H
Check codeWORDThe CRC Checksum for all above byte
Normal response：
description
Device
address
function
code
Byte
command
number
BYTE
BYTE
01H～F7H
79H
Make up dataWORD0000H
Make up dataWORD0001H
Check codeWORDThe CRC Checksum for all above byte
Abnormal response：
description
Device
address
Error code
Abnormal
code
Check code
Byte
command
number
BYTE
BYTE
BYTE
WORD
01H～F7H
F9H
N
(N=1，2，3，4)
The CRC Checksum for all above byte
72、PDUAddress allocation table
Table 1：(all below datas with“H”are Hexadecimal，on the contrary are Decimal)
PDU
address
byte
Read/
description
Write
data(range)
Meaning
Unit
-
Describe
system
information
000CH
～
16RProduct alias
16character
0014H2Rsoftware version2552.55version
0015H2Rhardware version2552.55version
0016H2RProduction year0017H2RNumber of this month
0013H
RAM information
Current system12/24/36/48:Current system
voltagevoltage
0100H2R0101H2Rbattery power
0102H2RBattery voltage
0~100
V
%
Battery voltage*0.1V
charging current*0.01A
Actual valueA
Charging current
0103H
2
R
(flowing into the
battery)
0104H
2
R
Charging power
High 8 bits:
0105H
2
R
controllerActual temperature value
temperature(b7:Sign bit；
Low 8 bits: batteryb0-b6Temperature value)
℃
temperature
Controller
status
0106H2R
0107H2R
0108H2R
0109H2R
010AH2R
010BH2R
information
Street lamp (load)
voltage
Street lamp (load)
current
Street lamp (load)
power
solar panel voltage
Maximum power of the
day
Power generation on
the day
Street lamp voltage*0.1V
Street lamp current*0.01A
Actual valueW
solar panel voltage*0.1V
Actual valueW
Actual valueWH
Actual valueWH
Electricity
010CH
2
R
consumption on the
day
010DH
2
R
Load status
high 8 byte
8
0：load off、
-
Remarks>0:load on
charging status
010EH2R
010FH2R
4R
0110H
0111H
0112H
0113H
4
R
Low 8 byte
-
Annex
alarm informationTable 5
Total running days
Cumulative power
generation
Cumulative power
consumption
days
Actual value
Annex
WH
Table 2
Actual value
WH
Non Constant
2
W
Load forced on
Greater than 0 is on，0 is off
current output
Constant
Test output ratio（0 is output off，50 is
current output
50% proportion）
EEPROM
0201H
2
R/W
controller、Device
address
1～247
0xff is broadcast，
-
12：12V;
0202H
2
R/W
24：24V;
System voltage
36：36V
setting
-
48：48V
FF:auto recognition
Controller
parameter
0203H2R/W Battery type0204H2R/W700～17000.01V
0205H2R/W boost charge voltage 700～17000.01V
0206H2R/W float charge voltage 700～17000.01V
0207H2R/W0208H2R/W0209H2R/W Alarm voltage020AH2R/W020BH2R/W020CH2R/W boost charge time020DH2R/W01H10SS
020EH2R/W Light control voltage 02H10VV
020FH2R/W Load working mode
setting
Table 6
Controller failure,
。。。
0120H
Annex
equalizing charge
voltage
boost charge return
voltage
over discharge return
voltage
over discharge
voltage
equalizing charge
time
Light control delay
time
0~3
Flood，Sealed，GEL，Li
-
700～17000.01V
700～17000.01V
700～17000.01V
700～17000.01V
0-600minMin
0-600minMin
Annex
00~21
9Table 4
Temperature
0210H
2
R/W compensation
3-5-Mv/℃
0-200Days
coefficient
0211H
2
R/W
equalizing charge
duration
Street lamp special parameters
0300H
2
R/W 1st working time
00～12H
0~100%
00～12H
0～100%
00～12H
0～100%
00～12H
0～100%
00～12H
0～100%
00～12H
0～100%
00～12H
0～100%
high 8：1st working
0301H
2
R/W
power
low 8：1st induction
power
0302H
2
R/W 2
nd
working time
high 8：2
0303H
2
R/W
nd
working
power
nd
low 8：2 induction
power
0304H
2
R/W 3
rd
working time
high 8：3
0305H
2
R/W
rd
working
power
rd
low 8：3 induction
power
0306H
2
R/W 4
th
working time
high 8：4
0307H
2
R/W
th
working
power
th
low 8：4 induction
power
0308H
2
R/W 5
th
working time
high 8：5
0309H
2
R/W
th
working
power
th
low 8：5 induction
power
0308H
2
R/W 6
th
working time
high 8：6
0309H
2
R/W
th
working
power
th
low 8：6 induction
power
0308H
2
R/W 7
th
working time
high 8：7
0309H
2
R/W
th
working
power
th
low 8：7 induction
power
100308H
2
R/W 8
th
working time
high 8：8
0309H
2
R/W
th
00～12H
0～100%
00～12H
0～100%
00H～15HH
0～100%
working
power
th
low 8：8 induction
power
0308H
2
R/W 9
th
working time
high 8：9
0309H
2
R/W
th
working
power
th
low 8：9 induction
power
030AH
2
R/W
morning light working
time
high 8：morning light
030BH
2
R/W
working power
low 8：morning light
induction power
030CH2
R/W induction delay time
030DH2030EH2R/W
030FH2R/W
0310H2R/W
R/W
S
LEDLoad current
1mA
setting
Special function
N*mA
BIT0：power management switch
control
Energy management
upper limit
Energy management
lower limit
History（Annex Table 3）
history
0400H2R
0401H2R
History of the dayMust ready
dataday by day
1day before data
…
0412C
2
R
300 days before data
history record is 300 day
3、Command resolution and example：（eg: controller address 01H，belows are unconcerned about the
PDU’s actual adress）
3.1、read load status、battery status，the PDU address is 010D
send：01 03 010D 0001
receive：01 03 02 8002
11Analysis：8002 is (80H | 02H)
80：load on
02：mppt charging
3.16、read failure、alarm，knows the PDU address is 010EH
send:01 03 010D 0001
receive:01 03 02 0002
Analysis：0002 means battery over voltage
3.17、turn on the load（non constant current source），knows the PDU address is 0120H，Write on/off command
to that address
turn on the load：
send:01 06 0120 0001
receive:01 06 0120 0001
turn off the load：
send:01 06 0120 0000
receive:01 06 0120 0000
3.18、test load output 50%（constant current source），knows the PDU address is 0120H
send:01 06 0120 0064
receive:01 06 0120 0064
3.20、set equalizing charge voltage、boost charge voltage、float charge voltage、boost charge return
voltage、
over discharge return voltage、over discharge voltage。knows the PDU address is 0205H～020AH,total
6 words，12byte
0205HR/W
0206HR/W
0207HR/W
0208HR/W
0209HR/W
020AHR/W
equalizing charge
voltage
boost charge
14.8*100 = 05C8
14.4*100 = 05A0
voltage
float charge
13.8*100 = 0564
voltage
boost charge return
voltage
over discharge
13.2*100 = 0528
12.6*100 = 04EC
return voltage
over discharge
11.1*100 = 0456
voltage
send:01 10 0205 0006 000C 05C8 05A0 0564 0528 04EC 0456
receive:01 10 0205 000C
Annex Table1（battery type and default parameter）
battery
type
equaliz
ing
boos
t
float
charg
Boost charge over
return
discharge
12
over
dischargcharge
Fld
GEL
SEL
LI
14.8
14.6
15.2
char e
voltage
return
e voltage
ge
voltage
14.6
13.8
13.2
12.6
11.1
14.4
13.8
13.2
12.6
11.1
14.2
13.8
13.2
12.6
11.1
Adju
stab Adjus
Adjustab
le table
Adjustable
Adjustable
le
Annex Table2（total history parameters）
Total
history
datadefinition
Field1sRunDayCount
Field2sAllChgWH
Field3
sAllLoadWH
type
unit
Shaping（16
byte）
Long Shaping
（32 byte）
Long Shaping
（32 byte）
Precis
description
ion
day1daytotal running day
WH1WHTotal charging WH
1WHTotal discharge WH
（non-discharge
function is 0）
WH
Annex Table3（daily history parameters）
daily
history
datadefinitionField1sCharge_W_H_TodayWH1WH
Field2sLoad_W_H_TodayWH1WH
WH1WH
type
unit
Shaping
（16
byte）
Precis
description
ion
Field3sMaxChargeWHField4sMaxBatVoltV0.1V
Field5sMinBatVoltV0.1V
Daily Cumulative power
generation
Daily discharge WH
（non-discharge
function is 0）
daily max.Power
generation
Daily highest Battery
voltage
Daily lowest Battery
voltage
Annex Table4（load mode parameter）
load mode
Pure light
control
definiti
on
description
Working based on
day/night
0
13Light+time
control 1~14
hour
manual
debug
always-on
no load
Set working time at
night
1~14
Manual on/off
Day off，night on
Load Always on
No load mode
15
16
17
0xff
Annex Table5（malfunction）
malfunctio
n
battery
Appear
over
discharge
battery
over
voltage
Battery
low
voltage alarm
Load
short
circuit
0
1
2
3
Load power too
big
or
Release condition
byte（bit）
load
Battery voltage higher than over
discharge return voltage
Battery voltage lower than over
voltage return voltage
Battery voltage higher than alarm
return voltage
Long press load button or timing
release
Lower load power
4
open circuit
5temperature lowed to
over-temperature return value
6temperature lowed to
over-temperature return value
Controller
temperature
too high
Surroundings
temperature
too high
Input power too
big
Input
side
short circuit
Solarpanel
inputover
Power lowed to return value
7
timing
8
9
Voltage lowed to over voltage
return voltage
voltage
Solar
Correct connect
panel
reverse
12
connected
Correct connect
Battery
reverse
13
connect
Unused
。。
Annex Table6（charging status）
status
value
14No charge0
Open charge mode1
Mppt charge mode2
equalizing charge mode3
boost charge mode4
float charge mode5
Current limit（over power or over
temperature）
15
6
My YAML code for ha: `modbus:
name: litime_mppt
type: tcp
host: 192.168.178.178 # Replace with your Waveshare IP
port: 8888 # Or 8899, depending on your adapter
delay: 1
message_wait_milliseconds: 100
timeout: 5