← Back to blog
IoT Projects2 May 2022·5 min read·Tom Sharwood

Solar Controller Hacking

The manufacturer wouldn't share the protocol docs, so I grabbed an ADAM-4561 and figured it out myself. A solar regulator, a Pi Zero, Node-RED, and a bit of stubbornness.

I've got a Raspberry Pi Zero W in the van. It started out just monitoring fridge temperatures and sending me alerts via Telegram. Pretty standard stuff.

But then I wanted to know what was going on with the solar panel and battery. How much charge is coming in, what's the battery voltage, that sort of thing. The solar regulator on the wall had an RS485 port on it. That's promising. So I reached out to the manufacturer and asked for the protocol docs.

They said no.

Figuring it out anyway

So I grabbed an ADAM-4561 (RS485 to USB converter) and started poking around. Used IO-Ninja to look at what was being transmitted. After a bunch of research and comparing register values against specs from other brands that use similar hardware, I worked out it was Modbus RTU.

To confirm, I fired up some Windows software made for a different brand of regulator that uses the same chipset. Connected up, set the Modbus settings, and it worked. Could read every register. Battery voltage, solar panel voltage, charge current, load current, the lot.

Building it out

With the protocol sorted I moved everything over to Node-RED on the Pi Zero. Found some great work from Adam Welch (github.com/AdamWelchUK/NodeRedEPEverDashboard) that gave me a solid starting point for the flows.

The setup connects through to my AWS infrastructure. Data gets published via MQTT to a broker, into a database, and I built a Telegram bot so I can query it all from my phone. Battery voltage, daily charge totals, whatever I need.

The numbers

  • 5 data points every 30 minutes plus a 30-second heartbeat
  • ~3MB per month of data usage
  • PiZero draws up to 98mA, powered directly off the solar regulator
  • RS485 using Modbus RTU
  • Why it matters

    A $15 Pi Zero, some open-source tools, and a bit of stubbornness. The manufacturer didn't want to help but the data was there, it just needed someone willing to figure out the protocol.

    This is the same kind of thinking that led to Process Link. There's a lot of equipment out there with useful data locked behind proprietary protocols and uncooperative vendors. We get that data flowing to where it's actually useful.

    Want to learn more about Process Link?

    See how our platform can help your operation.