BritishRacingGreen

The 'assassinated' main PSU temporary repair now looks even more scarier after I repaired the -12V . This mess will only be addressed when the repair has met critical mass , i.e. if the board will become serviceable.
It reminds me of my engineering mentor back in the day . He insisted you must not over design or over repair something . If you design an F1 car , it must be able to win a race , but just after passing the chequered flag , the car must overheat, the gearbox must disintegrate , the suspension must fall apart , and the wheels must fall off with only a thin layer of rubber left on tires. Otherwise its over-designed and over-engineered !

Scope : 
I have been inspired by @Steve87 to embark on repairing , as he facilitated  3 x faulty MAX7.2 machines  for which I am very grateful . We repaired one machine , but that was really just repairing on module level (faulty  MPPT) . The second machine has two AC side IGBT devices shorted , but the rest of the main board seems ok , it gives fault code 09 (soft start fail). The third one was as dead as a doornail and this is the one that prompted me to repair and document my progress in order to help myself and others , because already I have so much to thank to @Coulomb and @maxo for some powerful partial / full schematics and in general the documentation available on the AUS forum of Coulomb and Weber .   So this machine  I am going to use to  repair in stages , as you will see it has some spectacular nasty faults/failures . It would probably not be economically viable to repair this board , but the focus is on learning how to repair other boards. In the process it will probably take me weeks to repair this one , if it can be repaired at all , but the end goal is learning and to possibly attract more gurus and expertise on repair/support.
The journey started when I switched on the Machine 3 for the last time  ,  then smoke escaped from the machine itself . I decided to disassemble it . The Machine still looks very neat inside , I believe its not an old machine as there is no dust layers etc etc and really looks new .   game on.
 
Chapter 1a :  The Baby Face Assassin 
So I tried to check for visual burns and damage , and finally saw a power diode that had burn marks . This is the diode that feeds the ac side igbt driver transformer and is fed via the SPS 12V secondary transformer . so I reckon this could be a shorted transformer primary causing the diode to burn. So I de-soldered the diode , and switched  the main board on via the SPS module , in anticipation that I have relieved the main power supply from a short circuit.  But , instead , all hell broke loose when I switched on again  ,  devices just started to explode and stink and smoke . Something on this board was just shooting from the hip for fun to make a fool of me. So I remember that old Eagles lyrics : ' .... I had to find the passage back to he place I had been before . Goodnight says the night man , you are programmed to receive , you can check out any time you like , but you can never leave ..."
The blown devices were all electrolytic capacitors on the 5V , 12V ,15V and -12V rails. So it became apparent the the SPS power supply on he main board  was a fault. Before of all of this I had removed the control board and as many removable modules , as I possibly could. Fortunately no damage o the boards themselves . Even the capacitors did not open up their shells , although the explosions at times had been horrendous. 
So I had to drill down and study the partial schematics . I redraw the sps power supply as shown below :

 
The SPS+ primary supply comes from three sources really , that is mains , battery or PV , they are wired OR together , that is not shown on the schematic. I limited my damage by introducing a variable 60V bench PSU courtesy of @Steve87. Current limited it to 500mA and set dc to 40V.   removed faulty capacitors and tried to isolate load circuits as far as i can , e.g. removing filter inductor to mosfet drive supply , cutting a track carefully to the bus soft start circuit etc.  
Switched on again , and long story short  , the SPS flyback converter around TX9 and U10 was just shoveling out as much DC on the 12V output as it received from the primary .  I measured the duty cycle of U10 and found it to be at 50% (50% by the way is the max limited by UC3845 type ). The 12V output was roughly as high as the supply DC input. So there is the cause of our explosions , 12VDC probably went as high as 50V !!!!. To limit this I merely turned down the DC input to about 16V in order to minimize my losses further. Note that the U10 chip will only bootstrap at 35V , so you must have that initially then you can ramp down again . In the future I will wire OR a separate 12V supply to the U10 VCC to bypass the bootstrapping.
So I studied the voltage closed loop feedback circuit . It basically samples the 12V output (R209/R210 on the schematic) and then controls a precision shunt regulator U9 , which in turn   controls the diode current thru opto-isolator U8 . U8 transistor is connected to the COMP input of the PWN controller , which in layman's terms will decrease duty cycle the more the COMP pin is pulled towards ground (GND) . Initially I checked if the COMP input works by shorting U9 output to ground. Indeed the PWM controller switched off. So at least some of the feedback circuitry is working . Then I discover that the VREF input of U9 is fixed at 0.00V . Which is shouldn't because of the R209,R210 divider across the 12v output . But it is just a simple divider , so I removed U9 in the hope that it has failed and pulled down the divider . Again I was made a fool of , as that divider midpoint stayed at 0V . In other words there was no feedback voltage provided to  decrease the duty cycle of the PWM . I tested both R209 and R210 . R209 showed 10K , R210 showed 10.5K in-circuit. The resistance of 12V down to GND is about 500 ohms , so this was a giveaway that R210 is open circuit. But how the hell, this is a 38.3K resistor how can it go open circuit .  Out of desperation I soldered a 39K resistor across R210 pads , with the original one still in situ . 
Switch on again , and the SPS was regulating at exactly 12.15VDC . I varied the input and even took it all the way up to 56VDC . Perfect . Short circuited the 12v output , limited perfect.
Can you believe a tiny 38.3K resistor R210 going open circuit !!!!!!!!!!!!!! . This resistor will henceforth be known as the Baby-Face Assassin.
Need to do a lot of cleanup around the SPS  before I am going to address the load circuits and repairing each section bit by bit . 
 
 Why such a big margin on the open loop transfer ? . Also there is no transzorb or voltage crowbar . I am going to breadboard a programmable crowbar around the TL431 and a triac and have it onto the 12V output as long as  am repairing the rest of the circuits. Below you can see my point , pulse width is 800ns to regulate at 12V from 56V input. That is about one fifth of 50% pulse width , which will indeed equate to around 60V with max duty cycle.
 

Yes that is normal , because the initial bootstrap is only there for short while. In that period the SMPS should produce , and amongst other , will generate the +15VDC supply over C75 , which will power U10 via D49  even after the bootstrap via D50 falls away. But because your SMPS does not deliver , when the bootstrap via D49 falls away , everything collapses.
 
The following test is provided to statically test the SMPS negative feedback loop. While no attempt is made to verify the linearity of the transfer function , it is adequate to test the extreme low point of feedback (resulting in highest output duty cycle) , as well as the high point of feedback (resulting in lowest possible output duty cycle) . To do so , we will manually power up the U10 and support circuitry with a power supply of 15V , and manually inject a variable 12V supply on the +12V output rail in order to fool the U10 that it is 'regulating'.
1. Remove all ancillary connections external from the main board , including controller board , fans , mppt , battery , everything.
2. You will require 2 x 12V variable bench supplies and an oscilloscope . Both of them must be current limited and both must be able to vary up to +15VDC.
3. Connect psu 1  positive to D57 cathode and negative to BAT- and set to +15VDC  . Current limit to 100mA or so. This will provide a steady VCC  on U10 pin 7 and power the chip .
4. Check there is steady +5V on U10 pin 8.
5. Check with oscilloscope that there is frequency and 50% (max) duty cycle on the gate of mosfet Q36 .  
6. Connect psu 2 set to 11.7 V between D54 cathode and GND . Set current limit to 800mA. This will false feed the +12V bus. At 11.7V the U10 output duty cycle should still max out at 50%. Check that the voltage drop over U8 diode is well below 1.1V . PLEASE NOTE : by injecting this 12V supply remember that the 12V loads on the main board is still connected . So please make sure that you dont push this voltage higher than say 12.8V.
7. Increase the psu to 12V and measure the TL431 bias voltage over R209 . It should be very close to 2.5V . Increase the psu to 12.5V and make sure the bias voltage is above 2.5V. at this stage TL431 turns hard on and current flows thru the U8 diode. The voltage across this diode should saturate at approximately 1.1V. This will in turn turn the U8 transistor hard on on the SMPS primary side . In turn this will pull the COMP pin 1 of U10 well down to 0V . As a result of this , U10 must correspond by outputting  its lowest duty cycle on its output  to the mosfet gate.
8. If all of this passes , the feedback loop circuit is pretty much in order.
... I will continue with this in another post  whereby you can bring the SMPS up with starting with a small 10V voltage at its dc input and working our way up to 40V if all goes well ...
 

One spike, 6mm insulated (green with yellow tracer) in pvc piping is good. 

Hi @wael_fathe I trust you are well . I have been quiet on this front for a while , apologies for that ,  and I owe you some answers to earlier posts as well, but lets start here.
The older generations of Voltronics Axpert inverters are dependant on battery operation . Therefore , the only way to power up the inverter's internal supplies is via the battery terminals , regardless if MPPT or Mains (AC input)  power is available.
The MAX range , as well as the later 5kW models are so called Battery Independent. So the system SMPS can be powered up by either Battery , MPPT or Mains (AC input). The MPPTs are therefore self-powered , as opposed to older MPPTs that relied on the host battery to power them. 
Please find below a crude schematic of the various power sources available to the main SMPS input. 
 

You will notice that a seperate SPS power supply board is introduced as shown in green. This board is separate to the main board and it has 3 connector cables.  The Mains input is rectified to create a dc bus and this dc feeds a 60V SPMS that produces a regulated 60V output .  A second SMPS are powered from the MPPT DC feed and also produces 60VDC. Note that the two seperate sources of 60vDC are wired or by the 2 steering diodes. This combined dc output is now fed to the main board (BAT+).
Inside the Main board the Battery+ is  internally routed to the SMPS input via a steering diode , and as you can see this is combined with the composite output of the SPS. 
This configuration allows MAx to operate batteryless. In other word you can generate 220VAC from only PV  if you want to.
So to bring up the MAX system supplies without powering the battery terminals , I merely remove the SPS BAT+ cable , and feed into the main board with my current limited power supply. You can of course power the main board via feeding the SPS that is 'hot- wired with mains input . In fact I have done so originally , but I do prefer to use a current limited bench power supply instead.
 
Below is an image of the MAX 1 SPS board .  On the top right is the MPPT / Solar DC input connector, just below it is the BAT+ 60VDC output that goes to the main board , and at the bottom of the board is the Mains (AC Input) input connector. You will notice that the board real estate is mainly occupied by the two 60VDC SMPSs as described earlier on.
 

 
EDIT : There are some additional steering control that is not shown in the schematic . The battery supply is only available to the SMPS if the  Inverter Switch is ON , while the SPS output powers the inverters regardless of the state of the switch. I think this is to allow PV and Mains to charge a connected battery with the load output remaining off. I am not too sure .
 
EDIT2 : I have never actually measured the voltage of the MPPT input to the SPS . All I can say is that the fly back transformers are identical in product number , in fact both smps's are identical. So I assume that the mppt feeds a dc input in the range of 300-400VDC into the smps , as does the ac input do via its bridge rectifier. But I am getting seriously off-topic now 🙂
 
 

Thank you for your quick response, I have not been to site yet, I just have this information to work on, it's an HPS150-HV, batteries, grid and Solar Panels. I will be going to site on Tuesday, then I can check certain spec's myself, take some photos of the system, particularly the Circuit Breakers and The EMS, then when I have the required information do you mind if I tap into your knowledge once more.
I didn't install it and haven't worked on the Atess before, I have worked installation on some other products, so I'm not new to solar. I started installing solar about 9 years ago on the farms near us, due to cable theft, they used to sit up to 6 out of 8 days without power sometimes. A bit about my background, from school I joined the South African Air Force(1981), and studied through them and obtained my Diploma. The training was excellent as I worked with the aircraft equipment, not just Ground Radio & Radar, we were exposed to ILS systems, radio, radar, Decca Systems etc. Then after leaving I obtained a Diploma in software development. The reason I mention this is because we have so many systems damaged by Electricians not understanding the DC component of the system, so I'm I'm not some handyman trying to make a buck, and boy, we have plenty in South Africa, we call them the bakkie brigade. These people are paying good money and not getting the service or a working system before they vanish. Apologies about the long story but at least you know a bit about my background, I understand what I'm doing, I just have the problem of not being able to sign off the grid connection, because I studied Electronics, not Electrical.
Regards
Baden

for sending data , you shift all the bytes thru the checksum below starting from the first 0x7C/0x7E character to the end of payload. You then append the checksum byte as well as an 0x0D  character.
uint8_t nerada_485_checksum(uint8_t *buf, uint8_t len)
{
    uint8_t b = 0;
    uint8_t b2 = 0;
    int num = 0;
    for (b = 0; b < len; b++)
    {
        b2 ^= buf[b];
        num += buf[b];
    }
    return (uint8_t)((uint)(b2 ^ num) & 0xFFu);
} 
When receiving data , you shift all the bytes thru the checksum starting at the first character up to and excluding the checksum byte and the 0x0D character. You then compare your calculated checksum against the received check sum , and also check that the last character is indeed 0x0D.

Short version of my automation - always wanted to post details but did not find time to do it properly.
Here a draft version, hope it helps some of you if you wanted to perform something similar.
 
Overview
  99% Off-grid with 23kwH Pylontech storage ; 3x Kodak OG Plus 5.48 Inverters and 8x Canadian 600w + 6x JA Solar 450w panels.
Inverter 1+2 = Parallel feeding home, stock firmware.
Inverter 3 = Borehole , pressure pump and irrigation (and generator charging).   Coulumb firmware and fans turned around.
 
January 2025 not a great start, but yearly usage as below.

 
1. ICM Software - built-in automation as below.
1.1 Swimming Pool automation
Device:  Sonoff Basic R2, Tasmotized

 
1.2. Geyser automation (day)
Device: SONOFF POWR3, Tasmotized

 
1.3. Geyser automation (early morning)
Same device as above, just additional heating time early mornings until SOC less than 44.

 
2.  Geyser
  2.1  Solar geyser 300l  ->  Used for main bathroom, kitchen etc , mainly for kids showering early evenings.  
     Also has another SONOFF POWR3, but not scheduled  - plan to move this device.
  2.2 Solar geyser 150l  ->  With a Gas-gayser in series to ensure that if this geyser temp < 55 that Gas heats it up to 57 degrees.
   DewHot valve as follows - the TakeAlot version is expensive rather shop around for this one.
  

 
 Then a standard solar valve to ensure that output is consistent at 56 degrees, (by adding cold water)
 

Pipe bottom right is coming from the 150l geyser.   
This setup ensures that I'm utilizing as much PV to always have warm water - and use gas ONLY when necessary. For at least 90% of all days gas is not used and geyser is heated up to 70 degrees using PV.
 
3. Timers and switches
3.1  Inverter 3 is managed by ESP8266 and auto-switched-off every day between 23h00 and 05.30.  This enables a 12v solenoid (with battery) to enable municipal water to ensure water during the night.   (Tasmotized)
3.2  Borehole is on timeswitch + floatswitch and only active between 08h30 and 17h30  (Standard 220v digital timer and float switch)
3.3  Another 2x ESP8266 devices with Timers to perform switch irrigation on and off.
3.4  Also installed a ESP8266 to open the gate.
 
4.  Scripting
4.1  Mosquitto-sub ; Check battery SOC every morning at 08h45 and if less than 44% it disables timers for irrigation.
 
 

 
5. Concepts
5.1   When SOC less than 22 percent, Inverter 1 and 2 switch to Eskom
5.2  I try to never charge from Eskom, only PV charging
5.3  Inverter 3 is connected to 4kwH generator -> If batteries are less than 20 percent and Eskom down, this Inverter charges the battery and Inverter 1+2 runs as usual.
      Red Rhino Dual Fuel Inverter Generator RGLIV4500 -> connected to gas, I don't like storing petrol.  This is a proper inverter-based generator, I'm considering moving my older generator in this setup.
     This is still done manually - don't want to automate this as it is really exceptional cases.
5.4  Also running Gas oven and stove , also energy efficient LED and lights.
 
 
6. Most likely the best functionality - MQTT Dash app on my phone, can overwrite automation and check details as above.
 
 

 

 
 

 

 

Hi. I have the same problem with Pylontech US 5000. Thank you for the clear explanation and solution to this issue.

Thank you so much for your input , and confirming  . One thing is for sure , you know your Pylontech 👌

Hi Mike, 
This is purely through observation of my own solar lab setup & from paralleling FreedomWons of different capacities: 
The only thing the BMS is sending the inverters is % SoC, CCL, DCL & alarms. Besides that the Sunsynk & for that matter any other inverter doesn't make heads or tails of anything else. Ok in the ATESS it also shares the Max & Min cell voltage & temps. 
But you can setup anything on Comms in the chain & then DC couple more on the same DC bus & as long as you can verify the batteries are working well & on & moving together there won't be any problems at all. 
I have paired 2 x 10/8s with 2 x 15/12s to this day they all working well with their respective master & slaves & keep the same SoC values. This is paired with 2 x Deye 12kW machines...Been in operation for close to 15 months without issue. 

Attached is a schematic copy  of the current design :
 
BRG_BMS_gateway_1xB.pdf
 
I think it doesn't get simpler than this , apart from the isolated dc-dc power supply , which in any case is a low cost MornSun module. I have never worked out a bill total , but will be surprised if this goes beyond R300-00 , excluding enclosure .

UPDATE : REPAIR : MKS2  AXPERT CLONE
So once I repaired the machine , I dispatched it back to CapeTown , and the owner hooked it up again . Alas , something weird happened . The machine would power all the plug points as normal , but no lights  during load shedding. Yet when Eskom grid got back , the lights came on !!!!!!!!!!!!  Solar is not For Sissies , was my first thoughts.
So I kept my cool and reckoned if inverter is providing output power within specs ,   there must be a path from the lights that is not returning to the inverter. So I requested to measure the voltage between neatral and earth . 110VAC. I asked him to disconnect the inverter from everything and check static resistance between output neutral and earth . Nothing (!). So I am assuming now that during the phase of inverter fault the inadvertent and frequent clicking affected the bond relay and degraded its ability to bond neutral to earth.
Next I asked him to reconnect the inverter and introduced a hard bond between neutral and earth. Fortunately he has the input ac not via ELD. And the light came on!!!!!!!!!! Yeah , but why ??????
Long story short , it turned out that the lights was not connected to the output ELD, but before it. So that's why this ELD never tripped. It turns out that the lights return path was partially returning via earth  and not 100% via neutral . So he has a nasty fault in his house , and as we speak , they are investigating this issue.
The bad news is , I did not test everything during test and verification cycle. Good thing is this revealed a legacy problem the owner had.
So one thing i have learned , is to even check all ancillary / supervisory functionality of the inverter before you dispatch .
And by the way , and equally important , it is my opinion that as many , if not all circuits should go thru ELD .Earth return is for fault current but which can be detected , not a long term return path. At home I even have my inverter AC Input on ELD , not to protect myself from harm , but to allow it to detect leaks, and low and behold , I get trip on extreme rainy burst, which means i am leaking on the roof to pv. Remember this : we all talk about nuisance tripping , but what prove have we got the ELD is not telling somethin important.
 
Next up : there is 4 machines on its way from Malawi !!!!!!!!!!!!!!!!!!!!!!
 
EDIT : the owner also informed me that in the past he experienced being shocked by plumbing and metal structures . This to me is something to do with a combination of earth fault current and bad earthing .
 
 
 
 
 

This image below reminds me of a very old Afrikaans song : 
 twee-mosfets-met-een-skoot-middeldeur-geskiet-fontein
 

Chapter 5 : Beginning of the End 
I am definitely not out of the woods yet , not sure yet if the fan controls and relay switching logic , control board and display will work , but I decided last night to introduce the control board and display. I have no way of verifying the operation of the control board , other than to make sure that there i no bad resistance between rail supply inputs etc.
So I inserted the control board and realized early that one can actually misalign when docking it to the main board , which I reckon could cause havoc , and undo all our hard work. I wired up the bare minimum , including the display .
Switch on , and after the usual startup timer timed out , it gave me Warning 01 , fortunately that is fan locked , so i plugged in the 3 fans . The machine then started up  without any further warning or error . obviously the battery icon flashing as well because I have not connected battery or grid to the power chain.
I was satisfied with the progress and decided to  add battery power  in the early morning , which will be an indicator whether all my hard work was worth the while.
No PV  modules added as that is the very last thing i will do in the final analysis . PV1 metrics does show up on the display though , but that is hogwash. I have seen it before on other machines as well when pv mppt module removed .
Today I decided to take the big step to add current limited DC power  to the battery port and bring up the power chain. A bit nervous though .I have two 30V variable supplies I cascaded to set to aggregate of 51V.
Here is me pre-charging the MAX battery input with suitable resistor.
 

and here is me going firing  51V DC , attacking the MAX full-on , no more 'Mr Nice Guy' :

 
The MAX submitted  immediately , produced about 380V on the BUS , opened its front porch with a beautiful sine wave 228VAC .  I also checked the IGBT gate drives and saw the magic in action . One half bridge had a continuously changing PWM to produce sine , wheras the other part of the half-bridge was constant at 50% duty cycle @50HZ.

Have I won the war ? not yet , but many battles yes , still has lots of work lying ahead . So the journey continues ....
 

The 'assassinated' main PSU temporary repair now looks even more scarier after I repaired the -12V . This mess will only be addressed when the repair has met critical mass , i.e. if the board will become serviceable.
It reminds me of my engineering mentor back in the day . He insisted you must not over design or over repair something . If you design an F1 car , it must be able to win a race , but just after passing the chequered flag , the car must overheat, the gearbox must disintegrate , the suspension must fall apart , and the wheels must fall off with only a thin layer of rubber left on tires. Otherwise its over-designed and over-engineered !

yes , that is the main reason for the pico microcontroller. The DC-AC full bridge must be controlled from first principles via this pico in order to test the igbt switching. In the same manner will I individually switch the DC-DC mosfets and igbts on the new 5kW designs. I am currently developing a command line interface to control the pico controller from a serial terminal .  So you can for example inject a test pulse onto an igbt of arbitrary duration in order to verify that the frequency response of the mosfet/igbt driver is compliant.  So the pico will actually emulate the working of the 3525 pwm ic.

Hi @John, @PurePower, @Youda  , I had a third visit to site and managed to non-intrusively gain access to the inside the battery box . The image below of BMS refers.

I measured negative 50V at points 1,2.3,5 and 6. Nothing at 7.    I deducted the following simplified schematic as seen below :
EDIT : please note that the orientation of my CFET is wrong , it should be mirrored horizontally:

The readings inferred that both  CFET (ChargeMOSfet) and DFET (DischargeMOSfet)  had been turned on (there was no forward voltage drops from the body diodes inside the mosfets). Please note that the components are actually duplicated in parallel , eg. there are 8 cfets,8dfets,8 sets of fuses.
There was no reading on 7 , which inferred the second fuse array had blown. This is an interesting fuse in that it has 4 pins instead of 2. You can note that in the image as well. Turns out  this is a very interesting fuse  , some of you might be familiar with it , but me , never knew it even existed. Following is a link from a helpful guy that identified the fuse type and explained the working and meaning of it.
 
http://www.karosium.com/2016/09/the-weird-fuses-in-laptop-batteries.html?m=1
 
I will continue this post in a next post. 

is this good enough for grounding ? Asking for a friend.
 

is this good enough for grounding ? Asking for a friend.
 

I repaired my neighbour's Nemtek Wizzord recently.  I have also noticed that the 12V battery had been run down to 0V. After repair of the low voltage board, I  substituted the battery with a 12V bench psu and found when lowering this voltage that the unit 'cuts off' when voltage goes below 11V. This looks promising, except the microcontroller does not switch off and a current of 45mA is still being drawn. This of course depletes the battery over weeks or months,  and destroys the battery. Please take note of this when energizer is unattended for long periods of time. 
Also the mains charging voltage is 14.0V. Isnt this a bit high for a continuous float charge? 

The partial schematic of the Axpert MAX family (7.2/8/10/11 ,OGx) below shows the relationship between GRID IN Neutral AC OUT Neutral and Earth. The blue routes are neutrals. Notice the relay 3 ( contacts RLY3A and RLY3B) .  There are 2 changeover contacts in parallel in order to share the load current requirements of the output neutral. 

The relay is energized by the DSP controller when the  machine is in LINE mode (e.g. Grid available and SUB/USB nominated as output source priority )
The wiper of each contact is connected to the load output neutral. The normally open contact is made when in line mode , and ensures the grid neutral is passed thru to the load neutral. When you have load shedding , grid falls away , machine is now in BATTERY MODE (islanding) ,  this relay drops and the normally close contact anchors the load neutral to earth as can be seen.
Please note that this internal bonding is NOT available on older machines , only generations 3 and 4 (eg MKSIII , MKSIV etc).
The arrangement is optimum as the changeover action of the relay is break before make. Such is its simplicity and gracefulness that my own MAX has an RCD grid bound as well as RCD  load bound . The grid bound RCD is not fuzzed by the changeover action of the relay when grid is restored.
 

I am currently working on a MPI10k aka Infinisolar 10k hybrid inverter, that doesn't boot up correctly and shows only ERROR 18 in display (=mismatch master/slave firmware):

I expect that the controller board was flashed with master firmware only, slave firmware was probably forgotten to update.

So I tried to catch up that and upgrade the slave firmware to the correct version via serial too, but unfortunately the IAP (in-application programming) commands of the flash tool for setting the µC into flash mode seem not to work:
I tried some different ReflashTools, but non of them worked.
As the customer support of mpp-solar will 4 sure suggest to replace the board, I want to give it a try with a XD100v2 JTAG programmer.
Master cpu is a TMS320F28335PGF DSP, slave is a 320F2808PZA. So I guess it would be sufficient to flash the slave cpu in my case.
As the firmware updates for the 10+15k hybrid inverters come along with the .out files, I guess I would simply have to flash the Inv_slave.out via the JTAG pins near the 2808 cpu, just like posted above. Memory map seems to be almost identical to 2809:

@Coulomb
As you seem to be the most experienced tech here, do you have any hints or suggestions for me? Do I have to take care of the password (according to posts above no) and how I make sure that I don't destroy the bootloader?
How do I set the "Flash Sectors to be Erased" correctly for my cpu - should I set it to "b" to "h" like posted above?
 
 

is this good enough for grounding ? Asking for a friend.
 

is this good enough for grounding ? Asking for a friend.