Kohler generator

[k5map]

Has anyone successfully connected genmon to a Kohler generator?

[jgyates]

Yes, the Kohler APM603 controller has been tested. This page has more info:

https://github.com/jgyates/genmon/wiki/Appendix-N-Genmon-Supporting-Other-Controller-Types

[k5map]

@jgyates ... first of all, you wrote a GREAT program and thanks for the prompt reply. The link was very helpful. The only other thing I am struggling with is how to connect the RPi to the APM603. I haven't been able to find any documentation or videos. Any suggestions?

[jgyates]

I don't have specific info but can add some details in this thread.

I think the AMP603 supports a RS-485 serial interface communicating at at data rate set in the controller with no stop bits, 8 data bits and 1 stop bits. If you set the controller to 9600 serial rate it will work with genmon without modifying the genmon rate. You can get a RS-485 serial HAT for your pi to communicate with the controller via serial modbus RS-485 or you can get a RS-485 serial to TCP converter and then communicate with the pi over your local network via Modbus over TCP. Somethign like this would work: https://www.amazon.com/USR-TCP232-306-Serial-Ethernet-Device-Server/dp/B07G5P4CPR/

RS-485 HAT
AMP604 <---> pi

Serial to TCP
AMP604 <--> Serial TCP converter <--> pi

Also, user @mstackler may have more info to add on this topic as he has done some of the testing with a Kohler.

[k5map]

@jgyates ... MUCH thanks for the info and link. Once I get knee deep into it, if I have any questions/issues, I'll reach out to @mstackler.

[k5map]

@mstackler... I purchased a Kohler 26kW generator and would like to connect a RPi running genmon. jgyates indicated in this thread, you have done some testing with the Kohler. If so, I would like to exchange a few emails with you.

[mstackler]

APM603 controller supports RS485 and Modbus over ethernet. I used the ethernet as I already had network cabling ran to the unit. You assign your generator and email address and you then program the pi to look at that IP for the register data. Let me know if you need anything further. I have another kohler to try with RS485 when i get time. I ordered a USB to RS485 adapter cable and should be able to use it just like the RS232 version

mark

message me here mstackler@gmail

[Bristerboy911]

Has anybody been able to get genmon to work with the Kohler RDC2 controllers?
I'm in the process of purchasing a new Kohler 20KW set, but am unsure what kind of pinouts are seen on the RDC2, similar to the Generacs with the Molex plug?

Thanks, all!

[jgyates]

No, only on the APM603. I would be happy to help getting this one working if you have one to test with.

The steps for supporting a new controller are outlined here: https://github.com/jgyates/genmon/wiki/Appendix-N-Genmon-Supporting-Other-Controller-Types#the-process-of-creating-a-new-controller-support-within-genmon

I can do step 3 if you can provide the other steps. Let me know if you have any questions.

[k5map]

@Bristerboy911 did you ever get your Kohler RDC2 connected to genmon? If so, did you connect via serial or network?

[k5map]

Reopening to see if anyone has a Kohler RDC2 communicating to genmon

[arw00d]

I just started digging into this topic as well given the recent Oncue sunset. My immediate concern has been that perhaps Kohler's residential units are not using the same Modbus/RS485 approach as the industrial ones featuring the APM603. Thumbing through manuals, it looks like my unit uses this proprietary RBUS thingy. Not encouraging...

[arw00d]

Got it. I may contact my dealer as well anyway, but I was hoping I could double the pressure on one dealer. Best of luck with getting something out of yours.

[Pauljp55]

Sorry about me keep asking about the Wireshark program.
I thought the idea of it is to intercept packets on your lan to analyze.
But if I want to see what is happening on my smart tv, or my x-box or anything else in the house, I have to either connect in the middle or mirror the port it is on??
When I have Wireshark on wide open capture, I see hundreds of packets going by. But if I filter for just the x-box IP, even though it is being used, nothing is coming through.
Am I missing something? Is this how it is done in government offices?

[jgyates]

How it is done with a switch depends greatly on the features of the switch. A switch by default will only send network traffic out the port is is intended to go. This optimizes the network traffic and reduces packet collisions allowing greater throughput when data is sent over multiple packets. If your switch is unmanaged (i.e. no mirroring features), then you have to get get to the data before the switch does, for example, with a splitter or man in the middle type setup, but this will still only give you the path that is before the switch, not the whole network. Some lower end manage switches give you the ability to mirror the traffic on one port to another (again, not the whole network), other higher end manage switches give you the ability to mirror multiple port outputs to a single port (could be the whole or part of the network, depending on the size of the network). If you want to look at everything on an entire network (like government offices) then you would use a higher end router with multiple levels of packet inspection (e.g. a faster CPU in the router that can inspect each packet without significantly slowing down the entire network). Higher end equipment can corrdinate multiple levels of switching and routing across multiple pieces of equipment, yet manage in one interface.

[arw00d]

It may also be worth mentioning that the requirements for being able to see the data are different depending on whether you are trying to monitor a wireless or wired device. Setting up monitor or promiscuous mode might be enough for wifi-based capture but won't do it for wired connections. You can check the Wireshark pages for more details.

As a definite non-expert, I find it useful to analogize wired setups to letters in the mail and wifi setups to people hollering across the room. You simply are not going to see the contents of those letters (or even know they exist) unless you position yourself as a mail carrier.

As for the stuff you are observing in your current setup, I would bet much of that is "Broadcast" traffic, which as the name suggests, is a bit closer to the hollering across a room. Every device does a bit of that, but it's not the substantive traffic you are interested in - that traffic is addressed and for the recipient only.

[Pauljp55]

Excellent. That gives me a better picture of what is happening.
When I installed Wireshark, I expected to see all data from everything on my network and I sould be able to simply filter what I want. That was probably how it was done back in the day of hubs, which were slow and full of collisions. But with todays basic home switches, you won't see the info meant for something else.
I am beginning to understand this.
Thanks you all once again, I appreciate all the info.

[arw00d]

1. The server is Kohler's Oncue server and the traffic is going out over the internet. As far as I can tell, this communication is initiated by the controller through a DNS query for devices.kohler.com - which is at 40.117.195.28. After that, the controller makes a SYN request and the server responds. After a few exchanges we seem to settle in to a constant stream of messages that have a very similar structure as the latter ones I provided - which look to me like the controller providing sensor updates to the server.

2. I don't see anything in the docs about proxy settings for the controller. Nor do I see anything in the menus of the wireless kit I am using to connect the generator to my network. I can look through the menus on the generator tomorrow - can't say I recall ever seeing anything about a proxy in those menus though...

Just so I understand, what would be the difference between this proxy-based approach and what I am doing now - reading packets by having my laptop set up as a bridge between the controller and my router? Does you approach help us see the data even if, e.g., the internet is down and the Oncue server is not around to accept the sync request?

Thanks again for your help here. I am truly WAY over my head with this stuff and only understand half of it. But it's been fun, and the guidance helps.

[jgyates]

what you are doing is great for research. I was thinking about a solution that might intgrate with genmon in real time.

1. one option is to use the oncue API and pull the data from the internet (i.e. genmon would be given a login info and the data would be pulled from the internet oncue site)
2. another is to set the proxy address (if supported) to a pi running genmon, then have genmon accept the request to devics.kohler.com as it would be sent to the proxy IP instead, then the pi would relay messages between the controller an the actual devices.kohler.com. This would only require the IP address of the pi be given to the controller and then genmon could be modified to accept proxy traffic then forward it to devices.kohler.com
3. a third would be to passively sniff the packet traffic, but this requires more expertise to setup from the perspective of a genmon users.

[arw00d]

Makes sense.

Option 1 sounds like what Home Assistant's integration with Oncue probably does. However, part of why I am investigating this is because the current indication from Kohler is that that API won't be available much longer due to their transition to a new app (and maybe server setup). It's all pretty unclear, honestly, and I don't think anyone from Home Asssitant has been able to connect with Kohler about what is or will be happening.

Option 2 makes a lot of sense. I'll definitely dig around more on settings and options related to a proxy server.

Understood with respect to Option 3. That seems like a much more complicated affair compared to the regular genmon setup.

[arw00d]

No luck on proxy settings as far as I can tell. Both the generator and the wifi kit only have the standard internet options like DHCP, IP address, subnet, gateway, and DNS. My guess is that none of that is really helpful.

[arw00d]

@k5map, in some of my digging I found a manual covering the RDC2 controllers and it shows that there is a "Is Modbus Master" parameter that can be adjusted by a dealer using the Kohler SiteTech software. If your contact can turn that on they might find something useful - though I'm not sure how we would wire in...perhaps back through the ethernet?

[k5map]

@arw00d ... that is a GREAT find... I will email the Dealer Service Manager now with this information as well as inquire as to the status of obtaining the information we requested.

[k5map]

@jgyates & @arw00d ... I was working on one of my Node Red projects and found this modbus solution for NR:

https://github.com/BiancoRoyal/node-red-contrib-modbus

I was going to see if I could get it to connect to my Kohler RDC2. Either of you have any suggestions or guideance?

[jgyates]

I am not familiar with that node red tool. Here are a few points off the top of my head:

• Assuming the RDC2 acts as a modbus slave device
• If you are using TCP then you need to know the port number and IP address
• If you are using serial you must have the wired connections setup properly
• You will need to know the modbus ID or address the RDC2 uses

The modbusdump tool in the genmon repository will allow you to cycle through all modbus addresses and use serial or TCP.

If you use the modbusdump tool, let me know if you have any questions.

[Mehrdadg]

After 3+ years struggling with a brand new 48KW liquid generac, I finally ditched it and swapped out with Kohler 48KW model. I used Genmon so I can see and configure the generac remotely which in my view hands Genmon is the best thing for that and that saved me many times when I had to remotely reset the faults.
Now that I have the Kohler for few days, I am getting more excited to do the same with the Kohler and I can’t wait for a support for this generator and connecting hardware information.

[arw00d]

I've been reflecting on a lot of what we've discussed and have a few thoughts rolling around that I'm just going to dump here.

1. It may be worth a shot to connect up the ethernet and probing with modbusdump again. @jgyates, can you help me plan this out given what I know about the controller?

For instance, from work in another thread, we seem to know that the "ID" of the "Exercise Runtime" parameter is 3601. Is that then a candidate for a register we should specify in the modbusdump run?

Similarly, while I can see from my Wireshark captures that communication with the server is happening on some random port (like 9898), I'm not sure if that is the port I should specify in modbusdump or whether we expect a different port to run the modbus communication. If the latter, do we have any idea which port to use?

Finally, I can also see from the other thread here that my ATS likely has a rbus/modbus "ID" of 2, but I'm not sure if that then is the "address" I should specify in modusdump.

2. I guess basically all of 1 above also applies to somehow wiring up to the rbus terminal directly and seeing if we can get a response. I'd still need to determine address and registers, not to mention determine how to connect to the terminals without destroying something...

3. I also noticed from the readout in the other thread that the server host name is a read/write field. Does that mean it is theoretically possible to re-route the tcp communications to a custom host name in a way that would let us do something similar to the "proxy" approach we have previously discussed? That seems absurdly convoluted, but I'm trying not to rule anything out.

4. Yet another convoluted approach would seem to be to reverse engineer the rbus protocol and read it directly from the wiring block. We can see a signal capture in the other thread and it does indeed look like an ugly cousin of modbus. If I run through the same process of adjusting the exercise runtime and staring at the captures, maybe I can make some sense of it.

I'm not doing anything for now because I've got some other stuff locking me up, but I figured I would put all this out here.

[kash04]

You can also find the modbus id under the following:
Networking Information
--> RBus information
---> Remote Devices
----> ModBus Id:

[silverfun9989]

Hey guys, I came here looking to see the progress to hook up to a Kohler DC2 controller. What sucks is my controller is more restricted in settings than the RDC2 but…. I have access to production network tap devices, I am in IT/OT and understand networks and programming. How can I help?

[jgyates]

Hi @silverfun9989

What we need it some info on the communication protocol the Kohler units are using. Best case is that uses is modbus and we need the modbus ID, TCP port number and captured data so we can reverse engineer the modbus registers and their values.

Some models, like the RC2, imply that it is RBus, which is rumored to be a protocol derived from modbus but proprietary. the DC2 may be strictly modbus.

Let us know if you have questions.

[silverfun9989]

Ok so you have tap data already on the Ethernet side then? If so, I am thinking of tapping the rs-485 side then. I might talk to SEL and see if they can communicate with Kohler RBUS today.

[arw00d]

I have looked at the tcp communication between the generator and the Oncue server for the rdc2. I just watched it in Wireshark, but did not try probing for a modbus tcp connection.

We don't have anything on a dc2 to my knowledge. I suggest you try everything anew on your controller.

I have a long list of things I am going to try on my generator, but I have been underwater at work and haven't progressed any of this.

Thank you for bumping!