ComAp|> SNMP notifications Except the request-tesponse communication model. in which the communication is controlled by the Manager, there are also messages that the Agent sends without any requests. These messages are called .Notifications* and inform the Manager about significant events occurred in the Agent. The controller can send notifications to two different SNMP Managers (two different IP addresses). The addresses are to be adjusted in the CM-Ethemet setpoint group by the setpoints SNMP Traps IP Address 1 (page 406) and SNMP Traps IP Address 2 (page 407). If the Manager address is not adjusted the particular ‘notification channel is off. The controller will send the notifications in format adjusted by the setpoint SNMP- Trap Format > Each notification (kind of event) is identified by an unique identifier (Trap ID in SNMPv1 or Notification OID in SNMPv2). This unique identifier gives the specific meaning to the notification message, e.g. Protection 4 level - Fuel Level - alarm activated. > All possible notifications and their identifiers are listed in the MIB table > The notification message also contains controller name, serial number and textual description of the event, 6.2.2 MODBUS-RTU, MODBUS/TCP MODBUS protocol is used for integration of the controller into a building management system or for remote ‘monitoring via 3rd party monitoring tools. > MODBUS-RTU can be used on serial interfaces (CM-RS232-485 module is required). The MODBUS-RTU server must be activated by switching the setpoint COM1 Mode (page 367) or COM2 Mode (page 369) into the Modbus position. The serial speed for MODBUS-RTU communication is to be adjusted by the setpoint COM1 MODBUS Communication Speed (page 368) or COM2 MODBUS Communication Speed (page 370). > MODBUSITCP can be used on the ethemet interface (CM-Ethemet module is required). Up to 2clients can be connected simultaneously. The MODBUSITCP server must be activated by the setpoint MODBUS Server (page 405). MODBUS, MODBUS/TCP protocol can be used simultaneously with Web connection and direct, ethemet/AirGate connection. IMPORTANT: Do not write setpoint repeatediy(e.g. power control form a PLC repeated writing of baseload setpoint via Modbus). The setpoints are stored in EEPROM memory. which can be ‘overwritten up to 10° times without risk of damage or data loss, but may become damaged, when the allowed number of writing cycles is exceeded! Note: Modbus-RTU serial communication mode is 8-N-1 - startbit 1, 8 data bits, no parity and 1 stopbit. Address space The object address space is separated into several areas as described in the table below. The actual mapping of specific controller data objects to specific MODBUS addresses, which depends on configuration, can be exported into a text file from the appropriate controller archive using InteliConfig. There are several special registers with fixed meaning (reserved registers) which are listed in a separate table in this chapter. IntesLite Global Guide 168MoDBUS address | Meaning Access 0000..0999 Binary objects Read only 1000..2999 Values Read only 3000. 3999 Setpoints Read/Write az00.. 7167 Reserved Read/Write, depends on registers each specific register Mapping data types to registers ComAp|> MODICON object ype MODBUS function Discrete Inputs Read: 01, 02 Input Registers Read: 03, 04 Read: 03, 04 Holding Registers We 6 16 Input Registers Read: 03, 04 Holding Registers Write: 06, 16 AAs there are multiple data types in the controller but only one data type in MODBUS (the register, whichis 2 byte long), a mapping table is necessary to compose and decompose the MODBUS messages correctly. ao a Number of type leaning registers Integer8 _t-byte signed integer 1 Unsigned8 —1-byte unsigned integer 1 Integert6 _2-byte signed integer 1 Unsigned16 2-byte unsigned integer 1 Integer82_4-byte signed integer 2 Unsigned32_ 4-byte unsigned integer 2 Binary8 Bit binary value 1 Binary16 16-bit binary value 1 Binary32 32-bit binary value 2 Char ‘-byte ASCII character 1 IntesLite Global Guide Data maping MSB = sign extension LSB = value mse = LSB = value MSB = value, MSB LSB = value, LSB MSB = value, MSB LSB = value, LSB MSB1 = value, byte 3 (MSB) LSB1 = value, byte2 MSB2 = value, byte 1 LSB2= value, byte 0 (LSB) MSB1 = value, byte 3 (MSB) LSB1= value, byte2 MSB2 = value, byte 1 LSB2 = value, byte 0 (LSB) MSB =0 LSB = value, bits 0-7 MSB = value, bits 8-15 LSB = value, bits 0-7 MSB1 = value, bits 24-31 LSB1 = value, bits 16-23, MSB2 = value, bits 8-15 LSB2 = value, bits 0-7 MsB=0 169ComAp|> Number of Data Meanin: Data mapin, ‘ype registers me LSB = ASCII value ofthe character MSB=0 StiList Index into list of strings 1 LSB = index into thelist MSB1 = ASCII value of the 1. character LSB1 = ASCII value ofthe 2. character Zero-terminated stn Shortsir __7roterminated string of 8 __MSB2= ASCII value of the 3. character max 15 ASCII characters. LSB2= ASCII value of the 4. character sat LSB1 = ASCII value of the 2. character 16 MSB2= ASCII value of the 3. character LSB2= ASCII value of the 4. character ASCII value of the 1. character Zero-terminated string of LongSt ongStr jax 31 ASCII characters. MSB1 = BCD (dd) LSB1 = BCD (mm) MSB2= BCD (yy) LSB2=0 MSB1 = BCD (hh) LSB1 = BCD (mm) MSB2= BCD (ss) LSB: MSB1 = reserved for future use Date Date (dd-mm-yy) 2 Time Time (hh-mm-ss) 2 LSB1 = reserved for future use MSB2 = Alarm level *) LSB: ‘Alam status ™) ‘Alam Anitem of the Alarmiist 27 MSB3= alarm string") LSB3 = alarm string MSB4-= alarm string LSBS = alarm string *)1.. level 1 (yellow), 2.. level 2 (red), 3. sensor fail *) Bit0 — alarm is active, Bit —alarm is confirmed “*) String encoding is UTF-8 Error codes (exception codes) Exception code is returned by the controller (server) if the query sent from the client could not be completed successfuly. The controller responds with the error codes in as follows: IntesLite Global Guide 170ComAp|> > 01 —Ilegal function is retumed if an incompatible type of operation is applied for a specific object, e.g. if function 03 is applied to a binary object. > 02-illegal address is retumed if the client tries to perform an operation with a object address that is not related to any existing object or that is located inside an object which is composed by multiple addresses (registers). > 04 —device erroris retumed in all other erromeous situations. More detailed specification of the problem can be consequently obtained by reading the registers 4205 — 4206. Reserved registers There are several registers with specific meaning. These registers are available in all controllers regardless of the configuration, Register Number of addresses registers -ACORSS ata typo Meaning 4200 - 4201 2 read/write Time RTC Timein BCD code 4202 - 4203 2 read/write Date RTC Date in BCD code Index of the language that is used for text 4204 1 read/write _Unsigned8_—_data provided by MODBUS (e.g. alarmiist messages). Last application error. To be read after the 4205 - 4208 2 read Unsigned32 device retums the exception code 04. It contains specific information about the error. Writing:command argument 4207 - 4208 2 read/write Unsigned32 Reading: command retum value 4209 1 write Unsigned16 Command code 4010 1 5 : Not implemented 4211 1 write Unsigned16 Password 4212-4213 2 read Unsigned32__ Communication status 424 1 read Unsigned8 Number of items in the Alarmiist 4215-4241 ey read Alarm 1. record in alarm list 4242-4268 Py read Alarm 2. recordin alarm list 4269 - 4295 ar read Alarm 3. recordin alarm list 4296 - 4322 Py read Alarm 4, record in alarm list 4323 - 4349 a read Alarm 5. record in alarm list 4350 - 4376 a read Alarm 6. record in alarm list 4377 - 4403 ar read ‘Alam 7. record in alarm list 4404 - 4430 a read Alam 8. recordin alarm list 4431 - 4457 a read Alam 9. record in alarm list 4458 - 4484 a read Alam 10. record in alarm list, 4485-4511 a read Alam 11. record in alarm list, 4512-4538 a read Alam 12. record in alarm list, IntesLite Global Guide 71ComAp|> Register Number of addresses registers ACCRSS Datatype Meaning 4539 - 4565 a read Alam 13. record in alarm list, 4566 - 4592 a read Alam 14. record in alarm list, 4593 - 4619 a read Alam 16. record in alarm list, 4620 - 4646 a read Alam 16. record in alarm list, List of commands and arguments "Commands" are used to invoke a specific action in the controller via the communication channel. The list of available actions is in the table below. The general procedure of writing a command via MODBUS is as follows: 1. (Optional) Write required level of password into the register 44212 (register address 4211). Use function 6. If the password is required or not depends on configuration of access rules. It can be adjusted/modified by Intelicontig, 2. Write the command argument into the registers 44208-44209 (register addresses 4207-4208). Use function 16. Write the command code into the register 44210 (register address 4209). Use function 6. 4. (Optional) Read the command retum value from the registers 44208-44209 (register addresses 4207-4208). Use function 3, 5. If the command was executed the retum value is as listed in the table. If the command was accepted but there was an error during execution the retum value indicates the reason: a. 0x00000001 — invalid argument b. 0x00000002— command refused (e.g. controller not in MAN, breaker can not be closed in the specific situation etc.) Action Command code Argument Return value Engine start *) 0x01 (0x01FE0000 0x000001FF Engine stop *) x01 (0x02FD0000 0x000002FE Fault reset *) 0x01 (0x08F 70000 ox000008F8 Hom reset *) 0x01 (0x04FB0000 ox000004FC. GCB toggle *) x02 0x11EE0000 0x000011EF GCBon 0x02 0x11€F0000 (0x000011FO GCB off 0x02 0x11F00000 (0x000011F1 MCB toggle *) 0x02 0x12ED0000 0x000012EE McB on x02 0x12EE0000 (0x000012EF MCB off x02 0x12EF0000 (0x000012F0 *) This action is an equivalent of pressing the front panel button IntesLite Global Guide 172MODBUS examples Modbus RTU examples > Reading of Battery voltage ‘© Export table of values from InteliConfig Table: Values Allowed MODBUS functions: 03, 04 Register(s) Com. Obj Name Dimension Type 01053 8213 BatteryVoltage = V-—_Integer Request: (Numbers in Hex) o1 03 04 10 Register address Controller address Modbus function 041D pox = 10536c Response: (Numbers in Hex) o1 03 02 Length of data Controller address Modbus function O2hex = Zbytes read Len ComAp|> Dec Min Max — Group 2 40 409 Controller vo 00 a1 15 3c Number of registers. CRC. 00 FO B8 00 Data cRC OOF Ope, = 240400 We read value 240 from register 01053. From table of modbus registers we get dimension of read value and "Dec". Dec=1 means shift one decimal place to the right. So battery voltage is 24.0 V. > Reading Nominal power ‘© Export table of values from InteliConfig Table: Values Allowed MODBUS functions: 03, 04 Register(s) _Com.Obj Name Dimension Type Len 01228 ©=—-9018_— Nominal Power KW — Integer 2 Request: (Numbers in Hex) ot tr o4 cc Controlleraddress Modbus function as 04C Chey = 1228 joc Response: (Numbers in Hex) on 03 02 Length of data O2pex = Zbytes read Controller address Modbus function Read nominal power is 200 kW. IntesLite Global Guide Dec Min Max Group 0 0 32767 Generator 00 or 45 05 Numberof registers CRC 00 cs Bo D2 Data cRC 00CB joy = 200406 173ComAp|> > Reading all binary inputs as modbus register Table: Values Allowed MODBUS functions: 03, 04 Register's) Com.0bj. Name Dimension Type Len Dec Min Max Group oto6s = azas, Ss Y Binary#2 2 0 - - Controllerl/O Inputs Request: (Numbers in Hex) o1 03 04 2c 00 44 FB Register address Controller address Modbus function Number of registers CRC 042Chiey = 10680 Response: (Numbers in Hex) o1 03 o2 00 2 3849 Length of data Data Controller address Modbus function cRC O2px = 2 bytes read 0012pox = 00010010}, Binary inputs is 00010010. It means Binary input 2 and binary input 5 are active, Not : You can use modbus function 4 insted of 3, rest of data remain same (CRC differs). IntesLite Global Guide 174> Reading binary inputs as coil status. Table: Binaries Allowed MODBUS functions: 01, 02 Addresses Source ComAp|> C.0.# Nameof Value Bit Name Modbus Addr. = Value Bit Group State# Name of State ‘Activated by protection(s): Prot.Addr, = State ‘00000 Value 8235 Binary Inputs. 1 GCB Feedback Controller VO 00001 Value 8235 Binary Inputs 2 MCB Feedback Controller iO ooo02 Value 8235 Binary Inputs 3 Emergency Stop Controller iO Weill read state of MCB Feedback binary input, Request: (Numbers in Hex) 1 a1 00 o1 00 or AC OA Register address Controlleraddress Modbus function Number of registers CRC Response: (Numbers in Hex) ot o 000 hex = 0004 Ge Controller address Modbus function ‘The readed datas 01, it means this binary input is active. Othex Length of data byte read Note: You can use modbus function 2 insted of 1, rest of data remains same (CRC differs). IntesLite Global Guide 175ComAp|> > Starting the engine Before starting engine you may need to write password. Depends on your settings in controller. Table Reserved registers (page 171) Registeraddresses Numberofregisters Access Datatype Meaning \Writing:command argument 4207 - 4208 2 read/write Unsigned32, Reading: command retum value 4209 1 write Unsigned16 Command code Table List of commands and arguments (page 172) Action Command code ‘Argument Retum value Engine start x01 (0x01FE0000 (0x000001FF Engine stop x01 0x02FD0000 (ox000002FE, Request 1/2: (Numbers in Hex) on 10 10 oF 00 03 06 ‘Modbus function Register address. hex = 16je¢ 106 hex = 4207 tec Controller address Number of registers Data length in bytes Request 2/2: (Numbers in Hex) a1 FE 00 00 00 on 68 0B, ‘Argument ‘Command code RC Note: Command and argument may be written as one “packet” (function 16) or you can split it and write argument (function 16) and after that write command code (function 6). IntesLite Global Guide 176> Password ComAp|> This password is the same as in InteliContig or directly in controller. Table Reserved registers (page 171) Register addresses aan 1 Note: Default password is "0". In this example the password is "1234". Request: (Numbers in Hex) on 06 Controller address Modbus function Response for success: (Numbers in Hex) on 06 Controller address Modbus function Response for bad password: (Numbers in Hex) a1 86 Controller Modbus exception address —_forfunction 6. IntesLite Global Guide Number of registers Access Datatype Meaning write Unsigned16 Password 40 73 04 p20 7c 1 Register address. Password RC 1073pex=42M1go¢ 04D pox = 1234400 10 3 00 0 7c Ot Register address Allways zero. CRC. 1073hex = 42M doc 04 43 a3 04 — device error RC see Error codes (exception codes) on page 170 177> Nominal Power—writing Table: Setpoints Allowed MODBUS functions: 03, 04, 06, 16 Registers) Com.Obj. Name Dimension Type Len 03008 sare Nominal kW Unsigned 2 Power Request: (Numbers in Hex) on 06 0B co Register address 0BCOpex = 3008 joc Controller address Modbus function Response: (Numbers in Hex) a 06 ) co Register address OBCO hex = 3008oc Controller address Modbus function Writen setpoint nominal power is 100 kW. > CRC calculation ComAp|> Dec Min Max Group Basic Settings o 4 00 00 8B (D2 Allways zero CRC ‘The check field allows the receiver to check the validity of the message. The check field value is the Cyclical Redundancy Check (CRC) based on the polynomial x18+x'5+x2+1. CRC is counted from all message bytes preceding the check field. Online CRC calculator: http://www.lammertbies.nl/commiinfolcre-calculation.html Use CRC-16 (Modbus) Write LSB first. For writing nominal power 100 kW the CRC is calculated from this data: 010608C00064nox IntesLite Global Guide 178ComAp|> Modbus TCP examples > Reading of Battery voltage ‘© Export table of values from InteliConfig Table: Values ‘Allowed MODBUS functions: 03, 04 Registers) Com.0bj Name Dimension Type Len Dec Min Max Group 1053 8219 BatterWVoltage = VS integer 210 agg, Contain Request: (Numbers in Hex) 0 0 0 0 0 06 m1 3 oO 1D 00 ot transact tocol —_Lengthof ane | cnc 27athof Controller Modbus -Registeraddress.-—- Number of identior identifier databytes a ea een OND... 1a mee (usually 0) (usually0) following TPhox= 1058iec Tt Request: (Numbers in Hex) 00 =00 «©0000 a1 03 04 41D oo ot transaction protocol -—_Lengthof fn egister address identifier identifier data bytes Contoller Modbus 3 Number of (Usually 0) (usually 0) following PA0"ESS Function ODay = 10589e resistors Response: (Numbers in Hex) 00 00 00 00 «(0005 o1 03 02 00 FO Length of dat terecten oes eh car an Laat vas funeti hex = 2 bytes: 5 (usually 0) (usually 0) following %40"°88 ‘Function read OOF Onex = 240ec We read value 240 from register 01053. From table of modbus registers we get dimension of read value and "Dec. Dec=1 means shift one decimal place to the right. So battery voltage is 24.0 V. © back to Connection to 3rd party systems IntesLite Global Guide 179