Beruflich Dokumente
Kultur Dokumente
0
Modbus Applications Guide
2
Contents
SCADA Data Link ................................................................................................................................................................................................... 4
Introduction............................................................................................................................................................................................................ 4
Setpoints.................................................................................................................................................................................................................. 29
Setpoint Data Type............................................................................................................................................................................................... 31
3
Appendices
Appendix A The ASCII character set ............................................................................................................................................................... 32
The host device connects to the PowerWizard using a half-duplex RS-485 serial link. The data is transmitted in a binary format over the serial
connection. The host device acts as Modbus Master, and the PowerWizard electronic controller acts as the Modbus Slave, also called a Remote
Terminal Unit (RTU). The host device initiates all communication, sending commands or requests for information to the PowerWizard. The
PowerWizard then takes action based on the query and/or sends a response to the query over Modbus.
Hardware installation
The modbus network should be configured as per Fig 1. Installation requirements are outlined below.
Installation requirements
Note 1 0.2 mm2 (AWG 24), balanced, screened pair cable with characteristic impedance of 120 Ohm should be used to construct the network
Note 3 Multiple nodes may be connected, in a daisy chain formation, on the same modbus network
Each control panel connected to the network needs to be configured. To access the control panels SCADA configuration:
Main Menu
Configure
Setpoints
Network
Data Link - SCADA
Node address
Each slave node requires an individual address on the network. Node addresses can be in the range of 1-247. DO NOT USE THE SAME ADDRESS
MORE THAN ONCE ON THE SAME NETWORK
Baud rate
The recommended baud rate is 19,200 bps. All control panels on the network must be configured with the same baud rate.
Parity
Parity can be either none, odd or even.
Bias resistors
Bias resistors are provided for use where a polarized line is required. They should normally be disabled. If trouble is experienced establishing
communication it may be necessary to enable the bias resistors on one of the control panels.
N.B. the network must only ever be biased at one point on the network.
7
Connect Timeout Interval
The connect timeout interval is the amount of time the PowerWizard will continue to attempt to send a reply over the RS-485 network before giving
up, the default value is 30 seconds.
In addition to these setpoints, SCADA access can be restricted by means of assigning a SCADA password.
8
Modbus register addresses are referenced starting with register 1, whereas data link requests begin at 0. This results in an offset of 1 bit in the register
address. For example, to request the parameter Generator Overall Power Factor, which resides in Modbus register number 103 ($67), a register
address of $66 must be sent.
Send this Function Code to read data, single or up to 123 contiguous registers, from the PowerWizard. Note that the query will contain the register
count, while the response will contain the byte count (byte count = register count x 2). Note also that the query has a fixed length of 4 bytes, whereas the
response has a variable length depending on the number of registers requested.
Slave function starting address starting address no. of registers no. of registers CRC
address code hi lo hi lo
Send this Function Code to write data to a single register on the PowerWizard. Note that the PowerWizard will attempt to write the data, and then
respond with the new value in the register. If the query inadvertently attempted to write data to a read-register, the response data bytes will not match
the query data bytes. This Function Code may be broadcast, in which case no response will be sent.
Slave function starting address starting address Preset data Preset data CRC
address code hi lo hi lo
Slave function starting address starting address Preset data Preset data CRC
address code hi lo hi lo
A list of all write registers is given see the write register table on page 15.
For a walkthrough example see appendix C.
16
16 ($10) Write Multiple Registers
Send this Function Code to write data to up to 123 contiguous registers on the PowerWizard. Note that the query will contain both the register count
and the byte count (byte count = register count x 2). Note also that the query has a variable length depending on the number of registers being written,
whereas the response has a fixed length of 4 bytes. The PowerWizard will not respond with any data, only the starting address and the register count as
sent in the query. The entire Write will fail, and the slave will return an Exception Response, if any register in this span is a Read register. This
Function Code may be broadcast, in which case no response will be sent.
Slave function starting address starting address no. of registers no. of registers Byte Data Data Data Data CRC
address code hi lo hi lo count hi lo hi lo
Slave function starting address starting address no. of registers no. of registers CRC
address code hi lo hi lo
Error Checking
In PowerWizard SCADA communications, various levels of error checking are performed.
The Modbus data link protocol allows for byte-level error checking and packet-level error checking. Byte level error checking refers to parity checks,
where the parity is set to either odd or even. For packet-level error checking, the Modbus protocol dictates that a Cyclic Redundancy Check be
performed to catch transmission errors; that is, verify that the packet received is identical to the packet that was sent. These occur in the Modbus data
link layer. More information on the CRC is given below.
Once the packet is verified, the addresses and function codes are checked. This is handled using simple logic, determining whether the function code is
supported and determining whether or not the address range or count is within range. If not, an exception response is sent. This occurs in the Modbus
application layer. More information on exception responses is given below.
Once the addresses and function codes are checked, the data is ready to be handled by the PowerWizard application software. There is error checking
at this level to determine whether there are any application-specific errors. For example, if you are attempting to write 101% into a register that is
defined to hold 0-100%, then even though the data may fit into the register (and therefore passes the previous error-checking), the application does not
accept an input of 101%, and therefore a fault response is sent. This fault response is called a Fault IDentifier, or FID. A fault response is data that is
valid over the Modbus data link, but the PowerWizard and the Modbus Master device agree to reserve for use as an FID. More information on Fault
Identifiers is given below in the Fault Identifiers section.
Parity Check
Parity checking uses standard even or odd parity. The parity can be set in the PowerWizard to even, odd, or none. Parity checking occurs at the byte-
level. Upon successful parity check, the checked byte is accepted as part of the transmitted message. If the parity check fails, the byte is discarded.
19
A detailed description as well as sample code and a calculation example are given in the Modbus Serial Line Implementation Guide version 1.0 or the
most current version, available at www.modbus.org.
20
Exception Responses
Upon a parity or CRC error, the byte or message (respectively) is discarded. If neither of these errors occurs, the read/write status is checked. An
Exception Response will be sent if there is a read/write error.
If the register cannot be read from or written to at a particular time due to some application software state, it will not generate an Exception Response.
Instead, the application layer will respond with data that is in the Fault Identifiers (FID) range. See Fault Identifiers (FID) section for more
information.
An Exception Response contains a function code that is related to the function code the PowerWizard is responding to; its value is [128 + Function Code for
Query]. Any function code 128 ($80) or higher is an Exception Response. If the Exception Response is not listed below, it is in response to an
unsupported function code in a query, and should contain an exception code of 01.
The following chart shows the transmitted signal ranges, including the ranges that comprise Fault Identifiers (FIDs).
Note that 2-bit data is not transmitted individually, but rather within a register.
23
The first level of the SCADA data link security is the SCADA password. The SCADA password is to disable/enable all SCADA access. If SCADA
access is not granted, the control will return all FF data for read requests, and fail with an exception response for write requests. By default the
SCADA password is disabled.
Level 1, Level 2, and Level 3 passwords are used to disable/enable corresponding levels of access to the control. Each level grants functionality that is
a subset of that granted by the higher levels of access. The Level 3 password uses the same system as the level 3 password on the PowerWizard
control panel.
All of the passwords, as well as the phone-in prompt, use the 1-byte ASCII format and character set. Each string is variable in length, so in order to
enter a shorter password, the rest of the field may be padded with the space character $20. The SCADA password and the Level 1 and 2 passwords are
8 bytes long and should be padded with the space character ($20). A NULL character, $00, terminates the string. All other nonprinting characters ($01
through $1F and $7F) are not accepted as valid data, and will result in a FID response.
There are a couple of built in timeout features to reset the security level after a period of inactivity. One is the Level 0 Timeout, which resets the
security access level to level 0 (or the lowest unprotected level above level 0) after 10 minutes without any successful write commands over the
SCADA data link. Writing to the Key Press register will reset this timer, preventing it from expiring.
The second timeout is the SCADA Timeout, which resets SCADA access completely at the SCADA password level (or level 0, if the SCADA
Password is disabled). The timeout for this is configurable from 0.1 seconds to 1 hour it is the SCADA Data Link Connection Timeout Interval
setpoint, and will only trigger after a period without any activity on the SCADA data link.
For a list of the all security associated registers see the following table.
For an example of writing passwords see Appendix E.
25
26
Event System
The PowerWizard displays both internal events and those transmitted over the J1939 data link. Over SCADA, the status of the warning and shutdown
lamps on the display can be viewed, and events can be acknowledged. Events can be acknowledged individually or as a group. Details of both
PowerWizard and supported optional module events can be read over SCADA.
The PowerWizard module uses the j1939 standard format for events, where by an event is defined as a combination of a suspect parameter number
(SPN) and a fault mode identifier (FMI). The SPN defines what is at fault and the FMI defines how it is at fault. A list of SPN/FMI combinations can
be found in appendix F.
Event Breakdown
Event information is distributed over 14 registers, these 14 registers being read as 1 block of information. The breakdown of these registers and their
contained information are as below.
Setpoints
All of the configuration possible at the PowerWizard control panel can be done over the data link, by reading from and writing to PowerWizard
setpoints. As on the display, each setpoint has a minimum security level required to change it associated with it. That required security level can be
read by reading the Setpoint Information register for a particular setpoint.
Setpoints are grouped in the PowerWizard into Blocks. These Blocks are actually pieces of software that, in some cases, may occur more than once in
the software. Blocks are uniquely identified by the combination of their Block Number and Instance Number, and this unique identifier is called the
Block ID. This, in combination with the Setpoint Number that identifies the setpoint within that block, is called the Setpoint ID. This Setpoint ID
uniquely identifies a setpoint in the PowerWizard. .
To read a setpoint data or related information, first the Setpoint ID for Read parameter must be set to the appropriate Setpoint ID. Then, either the
Setpoint Information parameter or Setpoint Data Value parameter can be read. Setpoint Information contains various pieces of information
regarding the setpoint, as detailed below. In order to write to a setpoint, the Setpoint Write parameter must be sent, which contains both the Setpoint
ID and the data value. Immediately prior to reading setpoint information, the Setpoint ID field should be checked to verify that the correct setpoint is
being read.
The Setpoint ID and Setpoint Information parameters contain multiple pieces of information, and span multiple Modbus registers. The registers
may be read separately, but caution should be taken to maintain integrity of the data being read.
The following table lists the registers associated with the setpoint system.
30
31
Setpoints are stored as a 32-bit signed integer value, using 2s complement to represent negative values. This is a standard data type in computer
programming, termed INT32. It can represent integer values from negative 2,147,483,648 to positive 2,147,483,647; that is, hexadecimal $ 80 00 00
00 to $ 7F FF FF FF. Other conversion examples:
Decimal -1 = $ FF FF FF FF
Decimal 0 = $ 00 00 00 00
Decimal 1000 = $ 00 00 03 E8
Decimal -1000 = $ FF FF FC 18
Query: 01 03 00 63 00 01 74 14
Breakdown: node: 01
function code: 03
starting address hi: 00
starting address lo: 63 (offset by 1)
no. of registers hi: 00
no. of registers lo: 01
CRC hi: 74
CRC lo: 14
Response: 01 03 02 01 90 B9 B8
Breakdown: node: 01
function code: 03
byte count: 02
data hi: 01
data lo: 90
CRC hi: B9
CRC lo: B8
34
The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value.
scale: 1V/bit
range: 0-64255
offset: 0V
1. convert the received data from hex into decimal: 0190 (hex) = 400 (decimal)
4. now check that the value falls within the acceptable range: 0 <= 400 <= 64255
Query: 01 03 00 69 00 02 14 17
Breakdown: node: 01
function code: 03
starting address hi: 00
starting address lo: 69 (offset by 1)
no. of registers hi: 00
no. of registers lo: 02
CRC hi: 14
CRC lo: 17
Response: 01 03 04 77 35 94 00 9F 49
Breakdown: node: 01
function code: 03
byte count: 04
Data hi: 77
data lo: 35
Data hi: 94
data lo: 00
CRC hi: 9F
CRC lo: 49
36
The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value:
scale: 1W/bit
range: -2000000000 to 2211081215
offset: -2000000000
3. now check that the value falls within the acceptable range:
2000000000 <= 0 <= 2211081215
From the table (page 15) we can see that to stop the set we need to write a value of 0, similarly if we wished to start the set we would write a value of 2.
Query: 01 06 01 2D 00 00 18 3F
Breakdown: node: 01
function code: 06
starting address hi: 01
starting address lo: 2D (offset by 1)
preset data hi: 00
preset data lo: 00
CRC hi: 18
CRC lo: 3F
Response: 01 06 01 2D 00 00 18 3F
Breakdown: node: 01
function code: 06
starting address hi: 01
starting address lo: 2D (offset by 1)
preset data hi: 00
preset data lo: 00
CRC hi: 18
CRC lo: 3F
Note that if the write is successful the response is the same as the query.
38
From the table (page 15) we can see that the real time clock value is encoded as a series of bytes, each with its own scale range and offset. For this example we will
set the time and date to 10:15 AM on the 15-March-2007.
1. check that the value we wish to enter is within range: 0 <= 0 <= 250
1. check that the value we wish to enter is within range: 0 <= 15 <= 250
1. check that the value we wish to enter is within range: 0 <= 10 <= 250
1. check that the value we wish to enter is within range: 0 <= 3 <= 250
1. check that the value we wish to enter is within range: 0 <= 15 <= 62.5
1. check that the value we wish to enter is within range: 1985 <= 2007 <= 2235
Using all the above information we can construct the query to set the time.
Query: 01 10 03 86 00 03 06 00 0F 0A 03 3C 16 39 24
Breakdown: node: 01
function code: 10
starting address hi: 03
starting address lo: 86
no. registers hi: 00
no. registers lo: 03
byte count: 06
preset data hi: 00
preset data lo: 0F
preset data hi: 0A
preset data lo: 03
preset data hi: 3C
preset data lo: 16
CRC hi: 39
CRC lo: 24
42
Response: 01 10 03 86 00 03 61 A5
Breakdown: node: 01
function code: 10
starting address hi: 03
starting address lo: 86
no. registers hi: 00
no. registers lo: 03
CRC hi: 61
CRC lo: A5
Query: 01 03 02 DB 00 01 F5 89
Breakdown: node: 01
function code: 03
starting address hi: 02
starting address lo: DB (offset by 1)
no. of registers hi: 00
no. of registers lo: 01
CRC hi: F5
CRC lo: 89
Response: 01 03 02 00 02 39 85
Breakdown: node: 01
function code: 03
byte count: 02
Data hi: 00
data lo: 02
CRC hi: 39
CRC lo: 85
44
The data must then be interpreted. From the table (page 22) we can get the scale, range and offset and subsequently interpret the transmitted value.
Scale : 1/bit
Range : 0-3
Offset : 0
1. convert the received data from hex into decimal: 02 (hex) = 400 (decimal)
4. now check that the value falls within the acceptable range: 0 <= 2 <= 3
Query: 01 03 02 DD 00 08 D5 8E
Breakdown: node: 01
function code: 03
starting address hi: 02
starting address lo: DD (offset by 1)
no. of registers hi: 00
no. of registers lo: 08
CRC hi: D5
CRC lo: 8E
45
Response: 01 03 10 31 30 35 31 37 36 37 34 38 31 39 35 30 37 39 32 72 3D
Breakdown: node: 01
function code: 03
byte count: 10
data hi: 31 ASCII CHARACTER 1
data lo: 30 ASCII CHARACTER 0
data hi: 35 ASCII CHARACTER 5
data lo: 31 ASCII CHARACTER 1
data hi: 37 ASCII CHARACTER 7
data lo: 36 ASCII CHARACTER 6
data hi: 37 ASCII CHARACTER 7
data lo: 34 ASCII CHARACTER 4
data hi: 38 ASCII CHARACTER 8
data lo: 31 ASCII CHARACTER 1
data hi: 39 ASCII CHARACTER 9
data lo: 35 ASCII CHARACTER 5
data hi: 30 ASCII CHARACTER 0
data lo: 37 ASCII CHARACTER 7
data hi: 39 ASCII CHARACTER 9
data lo: 32 ASCII CHARACTER 2
CRC hi: 72
CRC lo: 3D
So in the above example the L3 phone in prompt is 1051 7674 8195 0792
46
Write access password (0x02BC)
This register is used to enter a level 1 or level 2 or level 3 password. Passwords can be 16 characters long. the control panel automatically matches the password to
the appropriate security level. This does mean that level 1 and level 2 passwords must be different.
The below example shows how to write a level 1 or level 2 security password of 0123 4567 8901 2345.
Query: 01 10 02 BB 00 08 10 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 61 C9
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: BB (offset by 1)
no. registers hi: 00
no. registers lo: 08
byte count: 10
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 31 ASCII CHARACTER 1
preset data hi: 32 ASCII CHARACTER 2
preset data lo: 33 ASCII CHARACTER 3
preset data hi: 34 ASCII CHARACTER 4
preset data lo: 35 ASCII CHARACTER 5
preset data hi: 36 ASCII CHARACTER 6
preset data lo: 37 ASCII CHARACTER 7
preset data hi: 38 ASCII CHARACTER 8
preset data lo: 39 ASCII CHARACTER 9
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 31 ASCII CHARACTER 1
preset data hi: 32 ASCII CHARACTER 2
preset data lo: 33 ASCII CHARACTER 3
preset data hi: 34 ASCII CHARACTER 4
preset data lo: 35 ASCII CHARACTER 5
CRC hi: 61
CRC lo: C9
47
Response: 01 10 02 BB 00 08 B0 52
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: BB (offset by 1)
no. registers hi: 00
no. registers lo: 08
CRC hi: B0
CRC lo: 52
Query: 01 10 02 C3 00 08 10 30 30 30 30 31 31 31 31 30 30 30 30 31 31 31 31 89 8D
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: C3 (offset by 1)
no. registers hi: 00
no. registers lo: 08
byte count: 10
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
preset data hi: 31 ASCII CHARACTER 1
CRC hi: 89
CRC lo: 8D
49
Response: 01 10 02 C3 00 08 30 4B
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: C3 (offset by 1)
no. registers hi: 00
no. registers lo: 08
CRC hi: 30
CRC lo: 4B
Query: 01 10 02 CB 00 08 10 30 30 30 30 32 32 32 32 30 30 30 30 32 32 32 32 37 CE
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: CB (offset by 1)
no. registers hi: 00
no. registers lo: 08
byte count: 10
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
preset data hi: 32 ASCII CHARACTER 2
CRC hi: 37
CRC lo: CE
51
Response: 01 10 02 CB 00 08 B1 89
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: CB (offset by 1)
no. registers hi: 00
no. registers lo: 08
CRC hi: B1
CRC lo: 89
Query: 01 10 02 BB 00 08 10 30 30 30 30 31 32 33 34 20 20 20 20 20 20 20 20 F8 DA
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: BB (offset by 1)
no. registers hi: 00
no. registers lo: 08
byte count: 10
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data hi: 30 ASCII CHARACTER 0
preset data lo: 31 ASCII CHARACTER 1
preset data hi: 32 ASCII CHARACTER 2
preset data lo: 33 ASCII CHARACTER 3
preset data hi: 34 ASCII CHARACTER 4
preset data hi: 20 ASCII CHARACTER 'space'
preset data lo: 20 ASCII CHARACTER 'space'
preset data hi: 20 ASCII CHARACTER 'space'
preset data lo: 20 ASCII CHARACTER 'space'
preset data hi: 20 ASCII CHARACTER 'space'
preset data lo: 20 ASCII CHARACTER 'space'
preset data hi: 20 ASCII CHARACTER 'space'
preset data lo: 20 ASCII CHARACTER 'space'
CRC hi: F8
CRC lo: DA
53
Response: 01 10 02 BB 00 08 B0 52
Breakdown: node: 01
function code: 10
starting address hi: 02
starting address lo: BB (offset by 1)
no. registers hi: 00
no. registers lo: 08
CRC hi: B0
CRC lo: 52
From the table (page 22) we can see that to stop the set we need to write a value of 0 to drop to minimum security level, note that if no level 1 or level 2 passwords
have been setup the minimum security level will be 2.
Query: 01 06 02 DC 00 00 49 88
Breakdown: node: 01
function code: 06
starting address hi: 02
starting address lo: DC
preset data hi: 00
preset data lo: 00
CRC hi: 49
CRC lo: 88
Response: 01 06 02 DC 00 00 49 88
Breakdown: node: 01
function code: 06
starting address hi: 02
starting address lo: DC
preset data hi: 00
preset data lo: 00
CRC hi: 49
CRC lo: 88
Note that if the write is successful the response is the same as the query.
55
in order to read the events raised by the PowerWizard control panel we must select event log module selection 0. to do this write the value 0 to register 1498
(0x05DA)
Query: 01 06 01 2D 00 00 18 3F
Breakdown: node: 01
function code: 06
starting address hi: 05
starting address lo: D9
preset data hi: 00
preset data lo: 00
CRC hi: 18
CRC lo: 3F
Response: 01 06 01 2D 00 00 18 3F
Breakdown: node: 01
function code: 06
starting address hi: 01
starting address lo: 2D
preset data hi: 00
preset data lo: 00
CRC hi: 18
CRC lo: 3F
Note that if the write is successful the response is the same as the query.
59
Event log entries - having selected the appropriate modules event log it is possible to pull the event information for the 20 events from register 1500 to 1780. The
below example only reads the first event and explains how to interpret the information.
Query: 01 03 05 DB 00 0E B4 F9
Breakdown: node: 01
function code: 03
starting address hi: 05
starting address lo: DB (offset by 1)
no. of registers hi: 00
no. of registers lo: 0E
CRC hi: B4
CRC lo: F9
60
Response: 01 03 1C C4 31 0B 03 52 16 90 05 0E 04 17 15 00 0025 9E 00 00 00 00 F5 09 FF 01 F4 FF 00 00 07 89
The data must then be interpreted. From the table (page 25) we can get the scale, range and offset and subsequently interpret the transmitted information.
61
Register 13 contains the log entry index. Converting 0x0000 into decimal gives 0, as such this is the first event in the event log (the log has 20 entries, 0-19)
Registers 12 and 11 contain the SPN/FMI information. Firstly convert the value from hex into binary.
hex = 0xFF01F4FF
binary = 11111111000000011111010011111111
binary = 0000000111110100111
decimal = 4007
binary = 11111
decimal = 31
now we have the SPN/FMI combination we can check this with the SPN/FMI list (Appendix F) and we find that
Register 10 contains the event status and occurrence count information. Firstly convert the information into binary.
hex = 0xF509
binary = 1111010100001001
binary = 00001001
decimal = 9
range : 0-210554060.75
scale : 0.000278 hour/bit
offset : 0
for last hour meter (register 7:6) 0000259E (hex) = 9630 (decimal)
Byte 5 contains the year information. From the event breakdown section:
scale : 1 year/bit
range : 1985-2235
offset : 1985
Byte 4 contains the day information. From the event breakdown section:
scale : 0.25 days/bit
range : 0-62.5
offset : 0
as such the day is the 5 full days of the month had passed and the event occurred on the 6th day
65
Byte 3 contains the month information. From the event breakdown section:
scale : 1 month/bit
range : 0-250
offset : 0
Byte 2 contains the hour information. From the event breakdown section:
scale : 1 hour/bit
range : 0-250
offset : 0
Byte 0 contains the second information. From the event breakdown section:
scale : 0.25 minute/bit
range : 0-62.5
offset : 0
so the first timestamp for this event was 14:05:36 on the 6th April 2006
67
for the last timestamp
Byte 5 contains the year information. From the event breakdown section :
scale : 1 year/bit
range : 1985-2235
offset : 1985
Byte 4 contains the day information. From the event breakdown section :
scale : 0.25 days/bit
range : 0-62.5
offset : 0
as such the day is the 20 full days of the month had passed and the event occurred on the 21st day
68
Byte 3 contains the month information. From the event breakdown section :
scale : 1 month/bit
range : 0-250
offset : 0
Byte 2 contains the hour information. From the event breakdown section :
scale : 1 hour/bit
range : 0-250
offset : 0
Byte 0 contains the second information. From the event breakdown section:
scale : 0.25 minute/bit
range : 0-62.5
offset : 0
so the last time stamp for this event was 11:49:49 on the 21st March 2007
70
So the setpoint ID is 00 00 00 06 00 00
71
To view or modify a setpoint we must first select the relevant setpoint (register 0x03EA)
Query 05 10 03 E9 00 03 06 00 00 00 06 00 00 D3 38
Breakdown: node: 05
function code: 10
starting address hi: 03
starting address lo: EA (offset by 1)
no. registers hi: 00
no. registers lo: 03
byte count: 06
preset data hi: 00 setpoint id
preset data lo: 00
preset data hi: 00 setpoint id
preset data lo: 06
preset data hi: 00 setpoint id
preset data hi: 00
CRC hi: D3
CRC lo: 38
Response: 05 10 03 E9 00 03 50 3C
Breakdown: node: 05
function code: 10
starting address hi: 03
starting address lo: E9 (offset by 1)
no. registers hi: 00
no. registers lo: 03
CRC hi: 50
CRC lo: 3C
Query 05 03 03 EC 00 0C 85 FA
Breakdown: node: 05
function code: 03
starting address hi: 03
starting address lo: EC (offset by 1)
no. registers hi: 00
no. registers lo: 0C
CRC hi: 85
CRC lo: FA
Response 05 03 18 00 00 00 01 00 00 01 5E 00 00 00 5F 00 00 00 7E 00 03 00 00 00 06 00 00 A5 DC
00 00 00 01 resolution
00 00 01 5E maximum value
00 00 00 5f minimum value
00 00 00 7E actual value
00 00 00 06 00 00 setpoint I.D.
A5 DC CRC
73
Using the information in the setpoints list we can interpret the information. For this example we will only interpret the actual value.
Scale = 0
Resolution = 1
Query: 05 10 03 F8 00 05 0A 00 00 00 06 00 00 00 00 00 60 9F 28
Breakdown: node: 05
function code: 10
starting address hi: 03
starting address lo: F8
no. registers hi: 00
no. registers lo: 05
byte count: 0A
preset data hi: 00 setpoint id
preset data lo: 00 setpoint id
preset data hi: 00 setpoint id
preset data lo: 06 setpoint id
preset data hi: 00 setpoint id
preset data lo: 00 setpoint id
preset data hi: 00 new value
preset data lo: 00 new value
preset data hi: 00 new value
preset data lo: 60 new value (96 in hex)
CRC hi: 9F
CRC lo: 28
75
Response: 05 10 03 86 00 0A A0 27
Breakdown: node: 05
function code: 10
starting address hi: 03
starting address lo: 86
no. registers hi: 00
no. registers lo: 0A
CRC hi: A0
CRC lo: 27