g
DEH41181
SMR2 Modbus User Manual
Rev01
SMR2 Modbus User Manual
Table of Contents Introduction .......................................................................................................................2 RTU Transmission Mode .......................................................................................................................... 2 Message frame............................................................................................................................................ 2 RTU Mode Message Frames ...................................................................................................................... 2 Message Format.......................................................................................................................................... 2
Electrical Interface .............................................................................................................2 Communication Environment...........................................................................................3 Register Map .....................................................................................................................2 Fixed Value Registers ................................................................................................................................. 2 Dynamic Value Registers............................................................................................................................ 7 Interpretation of SOS values ...................................................................................................................... 9 Setpoint Registers....................................................................................................................................... 9 Event Registers ......................................................................................................................................... 13 Interpretation of Event Codes.................................................................................................................. 15 Bit position in Bit map............................................................................................................................. 16
i
SMR2 Modbus User Manual know when the message is completed. It also allows partial messages to be detected and errors flagged as a result.
Introduction The SMR2 trip unit has an optional communications module that facilitates monitoring of the trip unit via a master Modbus device. Monitoring features include breaker settings and the breaker status. Communication with the SMR2 trip unit requires a FAMECM module powered externally that provides isolation and protection.
A MODBUS message is placed in a message frame by the transmitting device. Each word of this message (including the frame) is also placed in a data frame that appends a start bit, stop bit, and parity bit. In ASCII mode, the word size is 7 bits, while in RTU mode; the word size is 8 bits. Thus, every 8 bits of an RTU message is effectively 11 bits when accounting for the start, stop, and parity bits of the data frame.
The Modbus communication protocol is a single master multi-slave protocol that is hardware independent and it interfaces with a 2-wire RS485 interface. A single master device initiates and controls all communication with the other slave devices on the network. A computer with a serial port and an external RS-232/RS-485 converter can be used as the mastermonitoring device. The SMR II trip unit is always the slave and cannot initiate communication. The maximum number of devices on a Modbus network is 32, i.e. only 31 slave devices can be connected to a master.
RTU Mode Message Frames RTU mode messages start with a silent interval of at least 3.5 character times. Implemented as a multiple of character times at the baud rate being used on the network. The first field transmitted is the device address. The allowable characters transmitted for all fields are hexadecimal values 0-9, A-F. A networked device continuously monitors the network, including the silent intervals, and when the first field is received (the address) after a silent interval of at least 3.5 character times, the device decodes it to determine if it is the addressed device. Following the last character transmitted, a similar silent interval of 3.5 character times marks the end of the message and a new message can begin after this interval.
MODBUS devices usually include a Register Map. MODBUS functions operate on Register map registers to monitor, configure, and control module I/O. You should refer to the Register map for your device to gain a better understanding of its operation. The transmission mode defines the bit contents of the message bytes transmitted along the network, and how the message information is to be packed into the message stream and decoded.
The entire message must be transmitted as a continuous stream. If a silent interval of more than 1.5 character times occurs before completion of the frame (not a continuous stream), the receiving device flushes the incomplete message and assumes the next byte will be the address field of a new message.
Standard MODBUS networks employ one of two types of transmission modes: i) ASCII Mode ii) RTU Mode The mode of transmission is usually selected along with other serial port communication parameters (baud rate, parity, etc.) as part of the device configuration.
In similar fashion, if a new message begins earlier than 3.5 character times following a previous message, the receiving device assumes it is a continuation of the previous message. This will generate an error, as the value in the final CRC field will not be valid for the combined messages.
RTU Transmission Mode In RTU (Remote Terminal Unit) Mode, each 8-bit message byte contains two 4-bit Hexadecimal characters, and the message is transmitted in a continuous stream. The greater effective character density increases throughput over ASCII mode at the same baud rate.
Message Format The Modbus RTU Protocol is strictly based upon a transaction scheme where a master device generates a query and a slave device replies with a response. Each query and response message transaction consists of the following four parts
Message frame A message frame is used to mark the beginning and ending point of a message allowing the receiving device to determine which device is being addressed and to 2
SMR2 Modbus User Manual The resulting value is compared to the error check field.
MODBUS ADDRESSES
Transmission errors occur when the calculated checksum is not equal to the Checksum stored in the incoming packet. The receiving device ignores a bad packet.
The master device addresses a specific slave device by placing the 8-bit slave address in the address field of the message (RTU Mode). The address field of the message frame contains two characters (in ASCII mode), or 8 binary bits (in RTU Mode). Valid addresses are from 1-247. When the slave responds, it places its own address in this field of its response to let the master know which slave is responding.
Electrical Interface The electrical interface is 2-wire RS485 where data flow is bi-directional and half duplex. RS-485 lines from the master device should be connected to a FAMECM module, which is powered externally using a 19-29 VDC power supply. Refer Figure 1 and 2.
MODBUS FUNCTIONS The function code field of the message frame will contain two characters (in ASCII mode), or 8 binary bits (in RTU Mode) that tell the slave what kind of action to take. Valid function codes are from 1-255, but not all codes will apply to a module and some codes are reserved for future use.
The following wire types are recommended for network wiring: Belden 3074F – Data Tray 600 V industrial twinax 18 AWG (7X26); or Belden 9841 – 300 V communication cable 24 AWG (7X32); or Alpha 6412 – 300 V Communication cable 24 AWG (7x32). Shielded wire should always be used to minimize noise. Polarity is important in RS485 communications and each '+' terminal of every device must be connected together for the system to communicate.
MODBUS DATA FIELD The data field provides the slave with any additional information required by the slave to complete the action specified by the function code. The data is formed from a multiple of character bytes (a pair of ASCII characters in ASCII Mode), or a multiple of two hex digits in RTU mode, in range 00H-FFH. The data field typically includes register addresses; count values, and written data. If no error occurs, the data field of a response from a slave will return the requested data. If an error occurs, the data field returns an exception code that the master's application software can use to determine the next action to take.
CRC Error Checking RTU Mode message frames include an error checking method that is based on a Cyclical Redundancy Check (CRC). The error-checking field of a message frame contains a 16-bit value (two 8-bit bytes) that contains the result of a Cyclical Redundancy Check (CRC) calculation performed on the message contents. The checksum field lets the receiving device determine if a packet is corrupted with transmission errors. In Modbus RTU mode, a 16-bit Cyclic Redundancy Check (CRC-16) is used. The sending device calculates a 16bit value, based on every byte in the packet, using the CRC-16 algorithm. The calculated value is inserted in the error check field. Figure1. Connection between ETU and FAMECM module
The receiving device performs the calculation, without the error check field; on the entire packet it receives.
2
SMR2 Modbus User Manual The communication happens at 19200bps with a Modbus address of 100
Figure3. Communication modules used with trip unit
Modbus Message Frames Master’s Query
Figure2. Connection between Breaker and FAMECM module
Slave Address (1 byte)
Communication Environment
Function Code (1 byte)
Data (n bytes) Start No. of Address Registers
(2 bytes)
CRC (2 bytes)
(2 bytes)
•
(1 byte)
Number of Bytes
Data (n bytes)
CRC
(1 byte)
(2bytes)
Byte n
(1byte)
Functio n Code
..
Slave Address
Byte2
• Communication Protocol RTU Modbus Master-Slave protocol Commandresponse (half-duplex) Min delay between messages is 3.5 char time Max delay within message is 1.5 char time. Slave Response time: minimum 3.5 char; maximum 50mS + 1mS per register Register order: MSB first, then LSB
Examples : Read Holding Registers (Function Code 03)
•
In the presence of a communication module on Trip unit A pair of rotary switch decides the Modbus address (0 to 255) A pair of slide switch decides the baud rate (2400, 4800, 9600 or 19200bps). These switches are available on the backside of the module •
Slave’s Response
Byte1
The trip unit is always the slave and cannot initiate communication • All the registers are read-only • Hardware layer RS485: Data moves serially on a 2-wire differential line (used for TX as well as Rx i.e.; half- duplex) N-8-1, no parity, 1 start bit, 8 data bits & 1 stop bit (10 bits per character)
In the absence of a communication module on Trip unit
Use this command to read setpoint or fixed value registers. It specifies the starting register and the number of registers to be read. Read the registers 30103012 from device 100:
Slave Addres s (1 byte)
3
Function Code (1 byte)
Data (n bytes) Start No. of Address Registers (2 bytes)
(2 bytes)
CRC (2 bytes)
SMR2 Modbus User Manual 64h
03h
0Bh C2h
00h 03h
64h
CRCl CRCh
05h
00h 04h
FFh 00h
CRCl CRCh
Response: (register contents: 3010 = 022Bh, 3010 = 0000h, 3012 = 0066h)
64h
03h
06h
CRC
Byte n
(1byte)
Response: (echo query message)
Data (n bytes) -------
(1 byte)
Numbe r of Bytes
Byte2
(1byte)
Functio n Code
Byte1
Slave Addres s
02h 2Bh 00h 00h 00h 66h
(2 bytes ) CRCl CRC h
Data (n bytes) Start No. Of Address Registers
(1 byte)
(1 byte)
(2 bytes)
(2 bytes)
64h
04h
04h 22h
00h 03h
Data (n bytes) Coil Data Address (2
(1 byte)
(1 byte)
(2 bytes)
64h
05h
00h 04h
CRC (2 bytes)
bytes)
FFh 00h
CRCl CRCh
Query:
Query:
Function Code
Function Code
Preset Single Register (Function Code 06) Use this command to write to a register. This presets a value into a single holding register. Preset register 0002 to 00 03 hex in slave device 17.
Read Input Registers (Function Code 04) Use this command to read dynamic value or event registers. Read the registers 1058 – 1060 from device 100:
Slave Address
Slave Address
CRC (2 bytes)
Slave Address
Function Code
Data (n bytes) Register No. of Address Registers
(1 byte)
(1 byte)
(2 bytes)
11h
06h
00h 02h
CRC (2 bytes)
(2 bytes)
00h 03h
CRCl CRCh
CRCl CRCh Response (echo query message)
Response: (register content: 1058 = FFFFh, 1059 = A01Ah, 1060 11B1h)
64h
(1 byte)
04h
06h
CRC
Byte n
(1 byte)
-------
Number of Bytes
Byte2
(1 byte)
Function Code
Byte1
Slave Addres s
Data (n bytes)
(2 bytes)
Slave Address
Function Code
Data (n bytes) Register No. of Address Registers
(1 byte)
(1 byte)
(2 bytes)
11h
06h
00h 02h
CRC (2 bytes)
(2 bytes)
00h 03h
CRCl CRCh
Retransmit Last Message (Function Code 56) Query:
FFh FFh A0h CRCl 1Ah 11h B1h CRCh Force Single Coil (Function Code 05) Use this command to perform remote control. This command sets a single coil to enter ON or OFF. Force coil 4 of device 100 ON (FF00h force on, 0000h force off)
Slave Address
Function Code
CRC
(1 byte)
(1 byte)
(2 bytes)
64h
38h
CRCl CRCh
Query: Slave Address (1 byte)
Function Code (1 byte)
Data (n bytes) Coil Data Address (2
(2 bytes)
Response
CRC
Slave
(2 bytes)
bytes)
4
Function
Data (n bytes)
CRC
SMR2 Modbus User Manual Addres s (1 byte)
Code (1 byte)
64h
38h
Previous transmitted data
(2 bytes)
xxh xxh xxh xxh xxh xxh xxh xxh xxh
CRCl CRCh
Exception Response
If the slave receives a message without a communications error, but is unable to process it, the slave will return an exception response to inform the master of the error. The high order bit will be set in the function code and returned with the characterizing exception response code: 01h - Invalid Function Code The Function Code is not recognized or defined by the SMR2. 02h - Invalid register The Register address is not recognized or defined by the SMR2 05h – Acknowledge The SMR2 has accepted the request and is processing it, but a long duration of time will be required to do so. This response is returned to prevent a timeout error from occurring in the master.
The SMR2 is busy processing a long duration command. The master should retransmit the message latter when the slave is free.
84h - Partial register access error Command reads or writes to a register that represents only part of the SMR2 register address. The multiple register addresses must be read or written together. Example: Long Time SOS consumes 2 register addresses, thus both must be read together. 85h - Write protect violation Command writes to a valid Register, which is defined as Read Only. 88h - Invalid coil The Coil address is not recognized or defined by the SMR2.
Function Codes The Modbus functions listed in below are supported:
06h - Slave busy Function Code
Command
Purpose
Register Group
03
Read Holding Registers
Reading the setpoint registers
Setpoint registers, Fixed value registers
04
Read Input Registers
Reading actual value registers
Actual value registers and event registers
05
Force Single Coil
Setting the signal coil or executing single command
Command coils
06
Preset Single Register
Write Data into single Register
Setpoint registers, Fixed value registers
16 10 hex
Preset Multiple Registers
Write Data into multiple Registers
Setpoint registers, Fixed value registers
56
Retransmit last message
Retransmit last message
N/A
5
SMR2 Modbus User Manual Event registers start at 2000 and are read by Function Code 04. Setpoint registers start at 3000 and are read by Function Code 03.
Register Map While modbus communication with Target Communication Accessory module, all the registers are read only registers. None of them can be written. But while Modbus communication with Test Kit, most of the Fixed value & Setpoint registers can be read as well as written.
Writing to the Coil registers, implement supervisory control through remote commands All registers composed of 16 bit integers, values less than 256 stored in lower byte
Fixed Value Registers
Fixed value registers start at 0000 and are read by Function Code 03. Actual value registers start at 1000 and are read by Function Code 04.
Register address 0000
Fixed value registers address starts at 0000, read by Function Code 03. Written with Function code 06/16 (decimal) The data stored in these registers are the data stored during trip unit optioning.
Contents
Range
Type R/W
Format
Product Id
0-65535
Unsigned Int
0001
ETU Serial Number high
0-65535
0002
ETU Serial Number low
0-65535
0003
ETU Date Code high
0-9999
0004
ETU Date Code low
0-9999
Frame Size
1 to 3
Amp Rating
1 to 13
Normal mode –RO Test mode --- RW Normal mode -- RO Test mode -- RW Normal mode --- RO Test mode --- RW Normal mode --- RO Test mode --- RW Normal mode --- RO Test mode --- RW Normal mode --- RO Test mode --- RW Normal mode--- RO
0005
0006
2
Unsigned Int
Unsigned Int
Unsigned Int
Unsigned Int
Unsigned Int 1 G400 2 G630 3K Unsigned Int 1 7/7 2 25/25 3 60/63 4 125/125
SMR2 Modbus User Manual
Test mode -- RW
0007
Information Memory Option Byte 1
Bitmappe d 0 to FFFFh
Normal mode--- RO
___________
Test mode --- RW
0008 0009 0010
Software revision number Product revision number
0000 to 9999 0000 to 9999
Max Number of events stored
Always 8
5 150/160 6 250/250 7 400/400 8 600/630 9 800/800 10 1200/1250 11 1600/1600 12 350 13 500 b0 Instantaneous 0 enabled 1 disabled b1 Short Time 0 enabled 1 disabled b2 Long Time 0 enabled 1 disabled b3 Watchdog 0 enabled 1 disabled b4 Zone Select Interlock 0 enabled 1 disabled b5 50-60/400 Hz Operation 0 50/60 Hz 1 400 Hz b6 Thermal Watchdog 0 disabled 1-99 enabled b7 Unused
RO
4 digit BCD
Normal mode --- RO Test mode --- RW RO
4 digit BCD
Unsigned Int
Example: To find out Phase-A SOS, A Modbus query to read 1002 and 1003 registers need to be sent to SMR2 by the master. There are 32 bits in this data. The upper-16 bits would appear in register 1002 and lower-16 bits in register 1003 as a part of the response.
Dynamic Value Registers
Actual value registers start at 1000, read by Function Code 04.All the dynamic value registers are 32-bit in length. Hence, query of any variable results in two Modbus register reads, each of 16-bit length. Even numbered register holds upper-16 bits; Odd numbered register holds lower –16 bits 7
SMR2 Modbus User Manual with 10,000 and sent out on Modbus for reading purposes.
LT Accumulators (A, B, C & N) give normalized values and are typically max 1.25. Hence, they are multiplied Reg.
Contents
Range 0 - 4294967295
Type R/W RO
1000-01 1002-03 1004-05 1006-07 1008-09 1010-11 1012-13 1014-15 1016-17 1018-19 1020-21 1022-23
Number of pending event SOS Current Phase A SOS Current Phase B SOS Current Phase C SOS Current Phase N LT Accumulator A*104 LT Accumulator B*104 LT Accumulator C*104 LT Accumulator N*104 ST Accumulator GF Accumulator PL Accumulator
1024-25
Breaker Status
Format Unsigned Int
0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295 0 - 4294967295
RO RO RO RO RO RO RO RO RO RO RO
Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int Unsigned Int
Bitmapped 0 to FFFFh
RO
1026-27
Push-Button Status
0-1
RO
1028-29
Measured ETU Temperature ETU Trip Count LT Trip Count ST Trip Count Instantaneous Trip Count GF Trip Count PL Trip Count Software Fault Trip Count Remote Trip Count RP Missing Trip Count Flash Erased Count No module Trip Count Over temperature Trip Count
0 - 100
RO
B0: Unused B1: ST Pickup B2: GF Pickup B3: PL Pickup B4 (unused) B5: LT 105 Pickup (PU >= 105) B6: LT 95 Pickup (95