PowerWizard Modbus Applications Guide.pdf

PowerWizard 2.0/3.0

Modbus Applications Guide

2

Contents

SCADA Data Link ................................................................................................................................................................................................... 4 Introduction............................................................................................................................................................................................................ 4

Hardware installation .............................................................................................................................................................................................. 4 Installation requirements........................................................................................................................................................................................ 4

Control panel configuration ........................................................................................................................................................................... 5

Control panel configuration ........................................................................................................................................................................... 6

Data Link Layer ....................................................................................................................................................................................................... 8 Data Structure ........................................................................................................................................................................................................ 8 Supported Function Codes ..................................................................................................................................................................................... 9 Error Checking..................................................................................................................................................................................................... 18 Exception Responses............................................................................................................................................................................................ 20 Fault Identifiers (FID) .......................................................................................................................................................................................... 22 Reduced Power Mode .......................................................................................................................................................................................... 23

SCADA Data Link Security .................................................................................................................................................................................. 24

Event System .......................................................................................................................................................................................................... 26 Event Breakdown................................................................................................................................................................................................. 28

Setpoints.................................................................................................................................................................................................................. 29 Setpoint Data Type............................................................................................................................................................................................... 31

3

Appendices

Appendix A – The ASCII character set ............................................................................................................................................................... 32

Appendix B – Read register walkthrough ........................................................................................................................................................... 33

Appendix C – Write single register walkthrough ............................................................................................................................................... 37

Appendix D – Write multiple register walkthrough........................................................................................................................................... 38

Appendix E – Security system walkthrough........................................................................................................................................................ 43

Appendix F – SPN/FMI combinations list ........................................................................................................................................................... 55

Appendix G – Event system walkthrough ........................................................................................................................................................... 58

Appendix H – Setpoint system walkthrough ....................................................................................................................................................... 70

Appendix I – Setpoints List ................................................................................................................................................................................... 76

Appendix J – Setpoint Values list ......................................................................................................................................................................... 87

4

SCADA Data Link

Introduction

The PowerWizard 2.0 and PowerWizard 3.0 have a Supervisory Control and Data Acquisition (SCADA) communications link, allowing communication between the controller and a host device using the Modbus protocol. The host device is able to remotely monitor or control any genset package equipped with the PowerWizard 2.0 or 3.0 control panels in much the same way an operator may from the panel. The host device connects to the PowerWizard using a half-duplex RS-485 serial link. The data is transmitted in a binary format over the serial connection. The host device acts as Modbus Master, and the PowerWizard electronic controller acts as the Modbus Slave, also called a Remote Terminal Unit (RTU). The host device initiates all communication, sending commands or requests for information to the PowerWizard. The PowerWizard then takes action based on the query and/or sends a response to the query over Modbus.

Hardware installation

The modbus network should be configured as per Fig 1. Installation requirements are outlined below.

Installation requirements

Note 1 0.2 mm2 (AWG 24), balanced, screened pair cable with characteristic impedance of 120 Ohm should be used to construct the network Note 2 Both ends of the network should be terminated using a 120-Ohm,

350 mW or greater resistor Note 3 Multiple nodes may be connected, in a daisy chain formation, on the same modbus network N.B. Each node requires a unique node address Note 4 Only one modbus master may be connected to a modbus network Note 5 The modbus reference should be connected to ground at one point

6

Control panel configuration

Each control panel connected to the network needs to be configured. To access the control panel’s SCADA configuration:

Main Menu ↵

Configure ↵

Setpoints ↵

Network ↵

Data Link - SCADA ↵ The recommended setup is detailed below.

Node address

Each slave node requires an individual address on the network. Node addresses can be in the range of 1-247. DO NOT USE THE SAME ADDRESS MORE THAN ONCE ON THE SAME NETWORK

Baud rate

The recommended baud rate is 19,200 bps. All control panels on the network must be configured with the same baud rate.

Parity

Parity can be either none, odd or even.

Bias resistors

Bias resistors are provided for use where a polarized line is required. They should normally be disabled. If trouble is experienced establishing communication it may be necessary to enable the bias resistors on one of the control panels.

N.B. the network must only ever be biased at one point on the network.

7

Connect Timeout Interval

The connect timeout interval is the amount of time the PowerWizard will continue to attempt to send a reply over the RS-485 network before giving up, the default value is 30 seconds. In addition to these setpoints, SCADA access can be restricted by means of assigning a SCADA password.

8

Data Link Layer

Data Structure

Modbus registers are 2 bytes long. A register is the smallest block that can contain a single piece of data. Larger pieces of data occupy consecutive registers, with the most significant word (pair of bytes) in the lowest register, and the least significant word (pair of bytes) in the highest register. Modbus register addresses are referenced starting with register 1, whereas data link requests begin at 0. This results in an offset of 1 bit in the register address. For example, to request the parameter “Generator Overall Power Factor”, which resides in Modbus register number 103 ($67), a register address of $66 must be sent.

Byte offset Field Field description

0 Address

Slave address, for both query and response. Every control on the network has a unique slave address between 1 and 247. Use 0 to make a broadcast query, which is supported for Function Codes 6 and 16. The PowerWizard will always respond with it’s own slave address.

1 Function Code

Function Code for both query and response. See Supported Function Codes for a list and syntax of supported function codes.

2

…

(n-3)

Data

Data or exception responses. See Supported Function Codes for the format of address, counts, and data. See Exception Responses for the format of exception responses.

(n-2)

(n-1) CRC

Cyclic Redundancy Check to catch transmission errors. The low byte is transmitted first, then the high byte.

9

Supported Function Codes

The PowerWizard supports three standard function codes. If the PowerWizard receives an erroneous request, it can also generate an error function code, called an exception response. See Exception Responses section for descriptions of exception responses. 3 ($03) – Read Registers

Send this Function Code to read data, single or up to 123 contiguous registers, from the PowerWizard. Note that the query will contain the register count, while the response will contain the byte count (byte count = register count x 2). Note also that the query has a fixed length of 4 bytes, whereas the response has a variable length depending on the number of registers requested. A read request is structured as below:

Slave function starting address starting address no. of registers no. of registers CRC

address code hi lo hi lo

And the response is structured as:

Slave function Byte Data Data Data Data CRC

address code count hi lo hi lo

A list of read registers is given in the following table. For a walk through example see Appendix B.

15

6 ($06) – Write Single Register

Send this Function Code to write data to a single register on the PowerWizard. Note that the PowerWizard will attempt to write the data, and then respond with the new value in the register. If the query inadvertently attempted to write data to a read-register, the response data bytes will not match the query data bytes. This Function Code may be broadcast, in which case no response will be sent. A read request is structured as below:

Slave function starting address starting address Preset data Preset data CRC



Slave function starting address starting address Preset data Preset data CRC


A list of all write registers is given see the write register table on page 15. For a walkthrough example see appendix C.

16

16 ($10) – Write Multiple Registers

Send this Function Code to write data to up to 123 contiguous registers on the PowerWizard. Note that the query will contain both the register count and the byte count (byte count = register count x 2). Note also that the query has a variable length depending on the number of registers being written, whereas the response has a fixed length of 4 bytes. The PowerWizard will not respond with any data, only the starting address and the register count as sent in the query. The entire Write will fail, and the slave will return an Exception Response, if any register in this span is a Read register. This Function Code may be broadcast, in which case no response will be sent.

A read request is structured as below:

Slave function starting address starting address no. of registers no. of registers Byte Data Data Data Data CRC

address code hi lo hi lo count hi lo hi lo


Slave function starting address starting address no. of registers no. of registers CRC


A list of all write registers is given, see the following table. For a walkthrough example see appendix D.

18

Error Checking

In PowerWizard SCADA communications, various levels of error checking are performed. The Modbus data link protocol allows for byte-level error checking and packet-level error checking. Byte level error checking refers to parity checks, where the parity is set to either odd or even. For packet-level error checking, the Modbus protocol dictates that a Cyclic Redundancy Check be performed to catch transmission errors; that is, verify that the packet received is identical to the packet that was sent. These occur in the Modbus data link layer. More information on the CRC is given below. Once the packet is verified, the addresses and function codes are checked. This is handled using simple logic, determining whether the function code is supported and determining whether or not the address range or count is within range. If not, an exception response is sent. This occurs in the Modbus application layer. More information on exception responses is given below. Once the addresses and function codes are checked, the data is ready to be handled by the PowerWizard application software. There is error checking at this level to determine whether there are any application-specific errors. For example, if you are attempting to write 101% into a register that is defined to hold 0-100%, then even though the data may fit into the register (and therefore passes the previous error-checking), the application does not accept an input of 101%, and therefore a fault response is sent. This fault response is called a Fault IDentifier, or FID. A fault response is data that is “valid” over the Modbus data link, but the PowerWizard and the Modbus Master device agree to reserve for use as an FID. More information on Fault Identifiers is given below in the Fault Identifiers section.

Parity Check

Parity checking uses standard even or odd parity. The parity can be set in the PowerWizard to even, odd, or none. Parity checking occurs at the byte-level. Upon successful parity check, the checked byte is accepted as part of the transmitted message. If the parity check fails, the byte is discarded.

19

Cyclic Redundancy Check

The Cyclic Redundancy Check (CRC) algorithm checks the contents of the entire message. The CRC field consists of a 16–bit value, and is appended to the end of the message. When this is done, the low–order byte of the field is appended first, followed by the high–order byte. The CRC high–order byte is the last byte to be sent in the message. The CRC value is calculated by the sending device, which appends the CRC to the message. The receiving device recalculates a CRC using the same algorithm during receipt of the message, and as it receives the CRC field, compares the calculated value to the received value. If the two values are not equal, the message is discarded. A detailed description as well as sample code and a calculation example are given in the Modbus Serial Line Implementation Guide version 1.0 or the most current version, available at www.modbus.org.

20

Exception Responses

Upon a parity or CRC error, the byte or message (respectively) is discarded. If neither of these errors occurs, the read/write status is checked. An Exception Response will be sent if there is a read/write error. If the register cannot be read from or written to at a particular time due to some application software state, it will not generate an Exception Response. Instead, the application layer will respond with data that is in the Fault Identifiers (FID) range. See Fault Identifiers (FID) section for more information. An Exception Response contains a function code that is related to the function code the PowerWizard is responding to; its value is [128 + Function Code for Query]. Any function code 128 ($80) or higher is an Exception Response. If the Exception Response is not listed below, it is in response to an unsupported function code in a query, and should contain an exception code of 01.

131 ($83) – Exception Response to Read Registers Query

The exception response contains only 1 byte of data, which is comprised of the exception code.

Exception Code Reason

02 Starting or ending (starting + count) register address invalid 03 Register Count was less than 1 or greater than 123 04 Read error possibly due to some register(s) in the span not being Read registers

134 ($86) – Exception Response to Write Single Register Query


21


02 Register address invalid 03 Register value out of range perhaps because longer than 2 bytes 04 Read error possibly due to not being a Write register

144 ($90) – Exception Response to Write Multiple Registers Query



02 Starting or ending (starting + count) register address invalid 03 Register Count was less than 1 or greater than 123, or byte count was not (Register Count x 2) 04 Write error possibly due to some register(s) in the span not being Write registers

22

Fault Identifiers (FID)

Fault Identifiers (FIDs) are based on the concept that the entire data space within the register(s) is partitioned in a predefined manner, irrespective of the specific type of data in the register(s). The range of data in the PowerWizard response allows the master device to interpret the data as valid or as an indication of a fault. The following chart shows the transmitted signal ranges, including the ranges that comprise Fault Identifiers (FIDs).

Range Name Boolean Data† 1-Register Data 2-Register Data Notes

0, 1 0 – 64,255 0 – 4,211,081,215

Valid Data

$0000 or $0001

$0000 –$FAFF $00000000 – $FAFFFFFF

See individual Parameter Descriptions for units, offset, and scaling to convert to physical units

2 – 65532 65,256 – 65,023 4,211,081,214 Not Used

$0010 - $FFFC

$FB00 –$FDFF $FB000000 –$FDFFFFFF

These data ranges are not used.

65533 65,024 – 65,279 4,261,412,864h – 4,278,190,079h

Error

$FFFD $FE00 –$FEFF $FE000000 –$FEFFFFFF

FID: Signal saturated, out of range, or error from source transmitter

65535 65280 – 65535 4,278,190,080 – 4,294,967,294

Not Available / Not Requested

$FFFF $FF00 –$FFFF $FF000000 –$FFFFFFFF

FID: Parameter is not applicable in the current state, not available from the controller, or not requested

† Note that 2-bit data is not transmitted individually, but rather within a register.

23

Reduced Power Mode

The data link is disabled in Reduced Power Mode; therefore no data link commands will take the control out of Reduced Power Mode. However, modbus communication will reset the timer to put the control into Reduced Power Mode. For example, if the Key Press event is sent every 9 minutes, then the control, if configured to enter Reduced Power Mode after 10 minutes of inactivity, will not enter Reduced Power Mode.

24

SCADA Data Link Security

The PowerWizard supports five levels of security, which corresponds to Level 0 (basic access, without a password), and four levels of passwords: SCADA, Level 1, Level 2, and Level 3. The first level of the SCADA data link security is the SCADA password. The SCADA password is to disable/enable all SCADA access. If SCADA access is not granted, the control will return all FF data for read requests, and fail with an exception response for write requests. By default the SCADA password is disabled. Level 1, Level 2, and Level 3 passwords are used to disable/enable corresponding levels of access to the control. Each level grants functionality that is a subset of that granted by the higher levels of access. The Level 3 password uses the same system as the level 3 password on the PowerWizard control panel. All of the passwords, as well as the phone-in prompt, use the 1-byte ASCII format and character set. Each string is variable in length, so in order to enter a shorter password, the rest of the field may be padded with the space character $20. The SCADA password and the Level 1 and 2 passwords are 8 bytes long and should be padded with the space character ($20). A NULL character, $00, terminates the string. All other nonprinting characters ($01 through $1F and $7F) are not accepted as valid data, and will result in a FID response. There are a couple of built in timeout features to reset the security level after a period of inactivity. One is the Level 0 Timeout, which resets the security access level to level 0 (or the lowest unprotected level above level 0) after 10 minutes without any successful write commands over the SCADA data link. Writing to the “Key Press” register will reset this timer, preventing it from expiring. The second timeout is the SCADA Timeout, which resets SCADA access completely at the SCADA password level (or level 0, if the SCADA Password is disabled). The timeout for this is configurable from 0.1 seconds to 1 hour – it is the “SCADA Data Link Connection Timeout Interval” setpoint, and will only trigger after a period without any activity on the SCADA data link.

For a list of the all security associated registers see the following table.

For an example of writing passwords see Appendix E.

26

Event System

The PowerWizard displays both internal events and those transmitted over the J1939 data link. Over SCADA, the status of the warning and shutdown lamps on the display can be viewed, and events can be acknowledged. Events can be acknowledged individually or as a group. Details of both PowerWizard and supported optional module events can be read over SCADA. The PowerWizard module uses the j1939 standard format for events, where by an event is defined as a combination of a suspect parameter number (SPN) and a fault mode identifier (FMI). The SPN defines what is at fault and the FMI defines how it is at fault. A list of SPN/FMI combinations can be found in appendix F. For a list of event related registers see the following table.

28

Event Breakdown

Event information is distributed over 14 registers, these 14 registers being read as 1 block of information. The breakdown of these registers and their contained information are as below.

For a walkthrough example see appendix G.

29

Setpoints

All of the configuration possible at the PowerWizard control panel can be done over the data link, by reading from and writing to PowerWizard setpoints. As on the display, each setpoint has a minimum security level required to change it associated with it. That required security level can be read by reading the Setpoint Information register for a particular setpoint. Setpoints are grouped in the PowerWizard into Blocks. These Blocks are actually pieces of software that, in some cases, may occur more than once in the software. Blocks are uniquely identified by the combination of their Block Number and Instance Number, and this unique identifier is called the Block ID. This, in combination with the Setpoint Number that identifies the setpoint within that block, is called the Setpoint ID. This Setpoint ID uniquely identifies a setpoint in the PowerWizard. . To read a setpoint data or related information, first the “Setpoint ID for Read” parameter must be set to the appropriate Setpoint ID. Then, either the “Setpoint Information” parameter or ”Setpoint Data Value” parameter can be read. “Setpoint Information” contains various pieces of information regarding the setpoint, as detailed below. In order to write to a setpoint, the “Setpoint Write” parameter must be sent, which contains both the Setpoint ID and the data value. Immediately prior to reading setpoint information, the Setpoint ID field should be checked to verify that the correct setpoint is being read. The “Setpoint ID” and “Setpoint Information” parameters contain multiple pieces of information, and span multiple Modbus registers. The registers may be read separately, but caution should be taken to maintain integrity of the data being read. The following table lists the registers associated with the setpoint system.

31

Setpoint Data Type

Setpoints have minimum and maximum engineering values. They are stored with a maximum resolution. The parameters can take on non-integer values in some cases, so in order to be stored as integer data types, are scaled (bit-shifted) by the number of bits listed in the SCALING field. Setpoints are stored as a 32-bit signed integer value, using 2’s complement to represent negative values. This is a standard data type in computer programming, termed INT32. It can represent integer values from negative 2,147,483,648 to positive 2,147,483,647; that is, hexadecimal $ 80 00 00 00 to $ 7F FF FF FF. Other conversion examples: Decimal -1 = $ FF FF FF FF Decimal 0 = $ 00 00 00 00 Decimal 1000 = $ 00 00 03 E8 Decimal -1000 = $ FF FF FC 18 REGISTER_VALUE = 2RESOLUTION * ENGINEERING_VALUE ENGINEERING VALUE = (0.5)RESOLUTION * REGISTER_VALUE For a walkthrough example of working with setpoints see appendix H. For a list of setpoints and their associated values see appendices I and J.

32

Appendix A – The ASCII character set

33

Appendix B – Read register walkthrough

The following example shows how a read single register message and response are constructed and interpreted. The parameter in the example is generator average L-L voltage (register 0x0064)

Query: 01 03 00 63 00 01 74 14

Breakdown: node: 01

function code: 03

starting address hi: 00

starting address lo: 63 (offset by 1)

no. of registers hi: 00

no. of registers lo: 01

CRC hi: 74

CRC lo: 14

Response: 01 03 02 01 90 B9 B8

Breakdown: node: 01

function code: 03

byte count: 02

data hi: 01

data lo: 90

CRC hi: B9

CRC lo: B8

34

The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value.

scale: 1V/bit

range: 0-64255

offset: 0V

1. convert the received data from hex into decimal: 0190 (hex) = 400 (decimal)

2. multiply by the scale: 400 x 1 = 400

3. add the offset, which in this case is 0: 400 + 0 = 400

4. now check that the value falls within the acceptable range: 0 <= 400 <= 64255

As such the received average generator line - line voltage is 400V

35

The following example shows how a read multiple register message and response are constructed and interpreted. The parameter in the example is generator total real power (register 0x006A)

Query: 01 03 00 69 00 02 14 17

Breakdown: node: 01

function code: 03


starting address lo: 69 (offset by 1)



CRC hi: 14

CRC lo: 17

Response: 01 03 04 77 35 94 00 9F 49

Breakdown: node: 01

function code: 03

byte count: 04

Data hi: 77

data lo: 35

Data hi: 94

data lo: 00

CRC hi: 9F

CRC lo: 49

36

The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value:

scale: 1W/bit

range: -2000000000 to 2211081215

offset: -2000000000

1. convert the received data from hex into decimal:

77359400 (hex) = 2000000000 (decimal)

2. add the offset, which in this case is 0:

2000000000 + (-2000000000) = 0

3. now check that the value falls within the acceptable range:

2000000000 <= 0 <= 2211081215

As such the received generator total real power is 0W

37

Appendix C – Write single register walkthrough

The following example shows how a write single register message and response are constructed and interpreted. The parameter in the example is engine operating mode command, used to stop the generator set (register 0x012E)

From the table (page 15) we can see that to stop the set we need to write a value of 0, similarly if we wished to start the set we would write a value of 2.

Query: 01 06 01 2D 00 00 18 3F

Breakdown: node: 01

function code: 06


starting address lo: 2D (offset by 1)

preset data hi: 00

preset data lo: 00

CRC hi: 18

CRC lo: 3F

Response: 01 06 01 2D 00 00 18 3F

Breakdown: node: 01

function code: 06


starting address lo: 2D (offset by 1)

preset data hi: 00

preset data lo: 00

CRC hi: 18

CRC lo: 3F

Note that if the write is successful the response is the same as the query.

38

Appendix D – Write multiple register walkthrough

The following example shows how a write multiple register message and response are constructed and interpreted. The parameter in the example is update real time clock (register 0x0387)

From the table (page 15) we can see that the real time clock value is encoded as a series of bytes, each with its own scale range and offset. For this example we will set the time and date to 10:15 AM on the 15-March-2007.

Byte 0 = seconds scale = 0.25/bit, range = 0-62.5, offset = 0

we wish to set this to 0,

1. check that the value we wish to enter is within range: 0 <= 0 <= 250

2. subtract the offset : 0 - 0 = 0

3. divide the value by the scale: 0 / 1 = 0

4. convert the value into hex 0 (decimal) = 0 (hex)

and the value we wish to write to byte 0 is 00

39

Byte 1 = minutes scale = 1/bit, range = 0-250, offset = 0





4. convert the value into hex 15 (decimal) = F (hex)

and the value we wish to write to byte 1 is 0F

Byte 2 = hour scale = 1/bit, range = 0-250, offset = 0





4. convert the value into hex 10 (decimal) = A (hex)

and the value we wish to write to byte 2 is 0A

40

Byte 3 = month scale = 1/bit, range = 0-250, offset = 0







Byte 4 = quarter day scale = 0.25/bit, range = 0-62.5, offset = 0


1. check that the value we wish to enter is within range: 0 <= 15 <= 62.5


3. divide the value by the scale: 15 / 0.25 = 60

4. convert the value into hex 60 (decimal) = 3C (hex)

and the value we wish to write to byte 4 is 3C

41

Byte 5 = year scale = 1/bit, range = 1985-2235, offset = 1985







Using all the above information we can construct the query to set the time.

Query: 01 10 03 86 00 03 06 00 0F 0A 03 3C 16 39 24

Breakdown: node: 01

function code: 10


starting address lo: 86

no. registers hi: 00

no. registers lo: 03

byte count: 06

preset data hi: 00

preset data lo: 0F

preset data hi: 0A

preset data lo: 03

preset data hi: 3C

preset data lo: 16

CRC hi: 39

CRC lo: 24

42

Response: 01 10 03 86 00 03 61 A5

Breakdown: node: 01

function code: 10





CRC hi: 61

CRC lo: A5

Note that if the write is successful the response is as above.

43

Appendix E – Security system walkthrough

To read the current security level (register 0x02DC)

Query: 01 03 02 DB 00 01 F5 89

Breakdown: node: 01

function code: 03


starting address lo: DB (offset by 1)



CRC hi: F5

CRC lo: 89

Response: 01 03 02 00 02 39 85

Breakdown: node: 01

function code: 03

byte count: 02

Data hi: 00

data lo: 02

CRC hi: 39

CRC lo: 85

44

The data must then be interpreted. From the table (page 22) we can get the scale, range and offset and subsequently interpret the transmitted value.

Scale : 1/bit

Range : 0-3

Offset : 0

1. convert the received data from hex into decimal: 02 (hex) = 400 (decimal)

2. multiply the value by the scale 2 x 1 = 2

3. add the offset, which in this case is 0: 2 + 0 = 2

4. now check that the value falls within the acceptable range: 0 <= 2 <= 3

As such the control panel is at security level 2

To read the level 3 phone in prompt (0x02DE)

Query: 01 03 02 DD 00 08 D5 8E

Breakdown: node: 01

function code: 03


starting address lo: DD (offset by 1)



CRC hi: D5

CRC lo: 8E

45

Response: 01 03 10 31 30 35 31 37 36 37 34 38 31 39 35 30 37 39 32 72 3D

Breakdown: node: 01

function code: 03

byte count: 10

data hi: 31 ASCII CHARACTER 1

data lo: 30 ASCII CHARACTER 0















CRC hi: 72

CRC lo: 3D

So in the above example the L3 phone in prompt is 1051 7674 8195 0792

46

Write access password (0x02BC)

This register is used to enter a level 1 or level 2 or level 3 password. Passwords can be 16 characters long. the control panel automatically matches the password to the appropriate security level. This does mean that level 1 and level 2 passwords must be different.

The below example shows how to write a level 1 or level 2 security password of 0123 4567 8901 2345.

Query: 01 10 02 BB 00 08 10 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 61 C9

Breakdown: node: 01

function code: 10


starting address lo: BB (offset by 1)



byte count: 10

preset data hi: 30 ASCII CHARACTER 0

preset data lo: 31 ASCII CHARACTER 1















CRC hi: 61

CRC lo: C9

47

Response: 01 10 02 BB 00 08 B0 52

Breakdown: node: 01

function code: 10





CRC hi: B0

CRC lo: 52


48

To change level the 1 access password (0x02C4)

Passwords can be 16 characters long. Note you must be at level 1 or higher security in order to change this password.

The below example shows how to change a level 1 security password to 0000 1111 0000 1111

Query: 01 10 02 C3 00 08 10 30 30 30 30 31 31 31 31 30 30 30 30 31 31 31 31 89 8D

Breakdown: node: 01

function code: 10


starting address lo: C3 (offset by 1)



byte count: 10

















CRC hi: 89

CRC lo: 8D

49

Response: 01 10 02 C3 00 08 30 4B

Breakdown: node: 01

function code: 10


starting address lo: C3 (offset by 1)



CRC hi: 30

CRC lo: 4B


50

To change level 2 access password (0x02CC)

Passwords can be 16 characters long. Note you must be at level 2 or higher security in order to change this password.

The below example shows how to change a level 2 security password to 0000 2222 0000 2222

Query: 01 10 02 CB 00 08 10 30 30 30 30 32 32 32 32 30 30 30 30 32 32 32 32 37 CE

Breakdown: node: 01

function code: 10


starting address lo: CB (offset by 1)



byte count: 10

















CRC hi: 37

CRC lo: CE

51

Response: 01 10 02 CB 00 08 B1 89

Breakdown: node: 01

function code: 10


starting address lo: CB (offset by 1)



CRC hi: B1

CRC lo: 89


52

Write SCADA password (0x02BC)

This register is used to enter a the SCADA password. The SCADA password can be 8 characters long and is padded with 8 space characters.

The below example shows how to write a SCADA password of 0000 1234.

Query: 01 10 02 BB 00 08 10 30 30 30 30 31 32 33 34 20 20 20 20 20 20 20 20 F8 DA

Breakdown: node: 01

function code: 10





byte count: 10









preset data hi: 20 ASCII CHARACTER 'space'

preset data lo: 20 ASCII CHARACTER 'space'







CRC hi: F8

CRC lo: DA

53

Response: 01 10 02 BB 00 08 B0 52

Breakdown: node: 01

function code: 10





CRC hi: B0

CRC lo: 52


54

To write the current security level (0x02DD)

From the table (page 22) we can see that to stop the set we need to write a value of 0 to drop to minimum security level, note that if no level 1 or level 2 passwords have been setup the minimum security level will be 2.

Query: 01 06 02 DC 00 00 49 88

Breakdown: node: 01

function code: 06


starting address lo: DC

preset data hi: 00

preset data lo: 00

CRC hi: 49

CRC lo: 88

Response: 01 06 02 DC 00 00 49 88

Breakdown: node: 01

function code: 06


starting address lo: DC

preset data hi: 00

preset data lo: 00

CRC hi: 49

CRC lo: 88


55

Appendix F – SPN/FMI combinations list

58

Appendix G – Event system walkthrough

event log module selection - in order to read the events we must first select which event log we wish to read. please note that the PowerWizard has separate event logs for events raised by the module and those raised by ancillaries such as the engine ECM. (please see note 1, page 24 for a list of event logs)

in order to read the events raised by the PowerWizard control panel we must select event log module selection 0. to do this write the value 0 to register 1498 (0x05DA)

Query: 01 06 01 2D 00 00 18 3F

Breakdown: node: 01

function code: 06


starting address lo: D9

preset data hi: 00

preset data lo: 00

CRC hi: 18

CRC lo: 3F

Response: 01 06 01 2D 00 00 18 3F

Breakdown: node: 01

function code: 06


starting address lo: 2D

preset data hi: 00

preset data lo: 00

CRC hi: 18

CRC lo: 3F


59

Event log entries - having selected the appropriate modules event log it is possible to pull the event information for the 20 events from register 1500 to 1780. The below example only reads the first event and explains how to interpret the information.

To read event log entry #1 (0x05DC)

Query: 01 03 05 DB 00 0E B4 F9

Breakdown: node: 01

function code: 03


starting address lo: DB (offset by 1)


no. of registers lo: 0E

CRC hi: B4

CRC lo: F9

60

Response: 01 03 1C C4 31 0B 03 52 16 90 05 0E 04 17 15 00 0025 9E 00 00 00 00 F5 09 FF 01 F4 FF 00 00 07 89

Breakdown: node: 01 data hi: 00 (register 8)

function code: 03 data lo: 00

byte count: 1C data hi: 00 (register 9)

data hi: C4 (register 0) data lo: 00

data lo: 31 data hi: F5 (register 10)

data hi: 0B (register 1) data lo: 09

data lo: 03 data hi: FF (register 11)

data hi: 52 (register 2) data lo: 01

data lo: 16 data hi: F4 (register 12)

data hi: 90 (register 3) data lo: FF

data lo: 05 data hi: 00 (register 13)

data hi: 0E (register 4) data lo: 00

data lo: 04 CRC hi: 07

data hi: 17 (register 5) CRC lo: 89

data lo: 15

data hi: 00 (register 6)

data lo: 00

data hi: 25 (register 7)

data lo: 9E

The data must then be interpreted. From the table (page 25) we can get the scale, range and offset and subsequently interpret the transmitted information.

61

Register 13 contains the log entry index. Converting 0x0000 into decimal gives 0, as such this is the first event in the event log (the log has 20 entries, 0-19)

Registers 12 and 11 contain the SPN/FMI information. Firstly convert the value from hex into binary.

hex = 0xFF01F4FF

binary = 11111111000000011111010011111111

now we need to breakdown the information

bits 31:24 = 11111111 these are unused and can be ignored

bits 23:5 = 0000000111110100111 this represents the SPN

bits 4:0 = 11111 this represents the FMI

now convert the SPN information into decimal (bits 23:5)

binary = 0000000111110100111

decimal = 4007

subsequently the SPN of the event is 4007

now convert the FMI information into decimal (bits (4:0)

binary = 11111

decimal = 31

subsequently the FMI of this event is 31

now we have the SPN/FMI combination we can check this with the SPN/FMI list (Appendix F) and we find that

SPN/FMI 4007/31 = generator control not in automatic warning

62

Register 10 contains the event status and occurrence count information. Firstly convert the information into binary.

hex = 0xF509

binary = 1111010100001001

now we need to breakdown the information

bits 15:12 = 1111 these are unused and can be ignored

bits 11:8 = 0101 this represents the event status

bits 7:0 = 00001001 this represents the number of occurrences of

the event

using the information in the event breakdown section (page 25)

event status 0101 = Present

as such this event is currently present

now convert the occurrence information into decimal (bits 7:0)

binary = 00001001

decimal = 9

and we see this event has occurred 9 times.

63

register pairs 9:8 and 7:6 give the engine operating hours when the event first and last occurred.

from the event breakdown section (page 25)

range : 0-210554060.75

scale : 0.000278 hour/bit

offset : 0

for first hour meter (register 9:8) 00000000 (hex) = 0 (decimal)

multiplying by the scale 0 * 0.000278 = 0

adding the offset 0 + 0 = 0

and checking the range 0 <= 0 <= 210554060.75

so the first hour meter is 0 hours

for last hour meter (register 7:6) 0000259E (hex) = 9630 (decimal)

multiplying by the scale 9630 * 0.00278 = 2.68

adding the offset 481.5 + 0 = 2.68

and checking the range 0 <= 2.68 <= 210554060.75

so the last hour meter is 2.68 hours

64

registers 5:3 and 2:0 contain the first and last time stamp information

the information is divided into byte long sections.

for the first timestamp

Byte 5 contains the year information. From the event breakdown section:

scale : 1 year/bit

range : 1985-2235

offset : 1985

byte 5 = 15 (hex), converting this to decimal gives 21

multiplying by the scale 21 * 1 = 21


as such the year is 2006

Byte 4 contains the day information. From the event breakdown section:

scale : 0.25 days/bit

range : 0-62.5

offset : 0




as such the day is the 5 full days of the month had passed and the event occurred on the 6th day

65

Byte 3 contains the month information. From the event breakdown section:

scale : 1 month/bit

range : 0-250

offset : 0

Byte 3 = 04 (hex), converting this to decimal gives 4



as such the event occurred on the 4th month of the year

Byte 2 contains the hour information. From the event breakdown section:

scale : 1 hour/bit

range : 0-250

offset : 0

Byte 2 = 0E (hex), converting this to decimal gives 14



as such the event occurred on the 14th hour of the day

66

Byte 1 contains the minute information. From the event breakdown section:

scale : 1 minute/bit

range : 0-250

offset : 0




as such the event occurred on the 5th minute of the hour

Byte 0 contains the second information. From the event breakdown section:

scale : 0.25 minute/bit

range : 0-62.5

offset : 0




as such the event occurred on the 36th second of the minute

so the first timestamp for this event was 14:05:36 on the 6th April 2006

67

for the last timestamp

Byte 5 contains the year information. From the event breakdown section :

scale : 1 year/bit

range : 1985-2235

offset : 1985




as such the year is 2007

Byte 4 contains the day information. From the event breakdown section :

scale : 0.25 days/bit

range : 0-62.5

offset : 0




as such the day is the 20 full days of the month had passed and the event occurred on the 21st day

68

Byte 3 contains the month information. From the event breakdown section :

scale : 1 month/bit

range : 0-250

offset : 0




as such the event occurred on the 3rd month of the year

Byte 2 contains the hour information. From the event breakdown section :

scale : 1 hour/bit

range : 0-250

offset : 0

Byte 2 = 0B (hex), converting this to decimal gives 11



as such the event occurred on the 11th hour of the day

69

Byte 1 contains the minute information. From the event breakdown section:

scale : 1 minute/bit

range : 0-250

offset : 0




as such the event occurred on the 49th minute of the hour

Byte 0 contains the second information. From the event breakdown section:

scale : 0.25 minute/bit

range : 0-62.5

offset : 0

Byte 0 = C4 (hex), converting this to decimal gives 196



as such the event occurred on the 49th second of the minute

so the last time stamp for this event was 11:49:49 on the 21st March 2007

70

Appendix H – Setpoint system walkthrough

In order to identify a setpoint in PowerWizard panels the block number, instance and setpoint number are required, this information forms the setpoint ID. From the setpoints list (Appendix I) we can find this information. For the purpose of this example we will change the number of flywheel teeth (normally locked at Level 3 security). The number of flywheel teeth setpoint is found in the engine speed monitor block.

From the setpoints list we find that for flywheel teeth:

Block = 6

Instance = 1

Setpoint = 1

The setpoint ID is made as below:

Setpoint (1) 00 00 (offset by 1)

Block (6) 00 06 (not offset by 1)

Instance (1) 00 00 (offset by 1)

So the setpoint ID is 00 00 00 06 00 00

71

To view or modify a setpoint we must first select the relevant setpoint (register 0x03EA)

Query 05 10 03 E9 00 03 06 00 00 00 06 00 00 D3 38

Breakdown: node: 05

function code: 10


starting address lo: EA (offset by 1)



byte count: 06

preset data hi: 00 setpoint id

preset data lo: 00


preset data lo: 06


preset data hi: 00

CRC hi: D3

CRC lo: 38

Response: 05 10 03 E9 00 03 50 3C

Breakdown: node: 05

function code: 10


starting address lo: E9 (offset by 1)



CRC hi: 50

CRC lo: 3C


72

To read the information for a selected setpoint (register 0x03ED)

Query 05 03 03 EC 00 0C 85 FA

Breakdown: node: 05

function code: 03


starting address lo: EC (offset by 1)


no. registers lo: 0C

CRC hi: 85

CRC lo: FA

Response 05 03 18 00 00 00 01 00 00 01 5E 00 00 00 5F 00 00 00 7E 00 03 00 00 00 06 00 00 A5 DC

Breakdown: 05 03 18 slave, function, no. bytes

00 00 00 01 resolution

00 00 01 5E maximum value

00 00 00 5f minimum value

00 00 00 7E actual value

00 03 access level required

00 00 00 06 00 00 setpoint I.D.

A5 DC CRC

73

Using the information in the setpoints list we can interpret the information. For this example we will only interpret the actual value.

Scale = 0

Resolution = 1

Converting from hex to decimal

7E (hex) = 126 (decimal)

Therefore this set has 126 flywheel teeth.

74

To change a setpoint (register 0x03F9)

To change the number of flywheel teeth to 96 we enter the following query,

Query: 05 10 03 F8 00 05 0A 00 00 00 06 00 00 00 00 00 60 9F 28

Breakdown: node: 05

function code: 10


starting address lo: F8



byte count: 0A


preset data lo: 00 setpoint id





preset data hi: 00 new value

preset data lo: 00 new value

preset data hi: 00 new value

preset data lo: 60 new value (96 in hex)

CRC hi: 9F

CRC lo: 28

75

Response: 05 10 03 86 00 0A A0 27

Breakdown: node: 05

function code: 10




no. registers lo: 0A

CRC hi: A0

CRC lo: 27


76

Appendix I – Setpoints List

87

Appendix J – Setpoint Values list

PowerWizard Modbus Applications Guide.pdf

Documents

Transcript of PowerWizard Modbus Applications Guide.pdf