Modbus Protocol Manual for SIL-A Relay
Modbus Protocol Manual for SIL-A Relay
EN_FANOXTD_MANU_SIL_MODBUS_SILA_R006.Doc
1. MODBUS PROTOCOL .................................................................................................... 3
1.1. Modbus RTU pachage format ........................................................................................ 4
1.2. Function Codes............................................................................................................... 5
1.3. Exceptions Responses .................................................................................................. 5
1.4. Data type .......................................................................................................................... 6
1.5. General Memory Map ..................................................................................................... 7
1.5.1. States Map ................................................................................................................... 8
1.5.2. Measurements Map.................................................................................................... 18
1.5.3. Fault report measurements Map ................................................................................ 18
1.5.4. Settings Map .............................................................................................................. 19
1.6. Command List ............................................................................................................... 26
1.7. Setting-up the session: Password and access levels .............................................. 26
1.8. Example of Modbus Frames ........................................................................................ 27
Modbus TCP/IP:
This document describes the steps to follow to read and write data on the SIL-A relay, as per the
Modbus protocol. This memory map is only valid for one piece of equipment and one version of the
memory. The positions of existing objects in the memory remain fixed from one version to the next, but
new objects will naturally have new addresses which will, in turn, remain fixed in future versions. The
memory map is described further on.
The standard Modbus protocol is used, so any program or PC can communicate easily with the
equipment.
The SIL-A always acts as a slave, which means that it never initiates communications. The master is
always responsible for initiating communications.
Only a subset of the Modbus functions is implemented:
• Reading function 3.
• Writing function 16.
The MODBUS/RTU protocol is independent from the hardware. Therefore, the physical layer can exist in
different hardware configurations: RS232, RS485, fibre optic or Ethernet.
Specifically, the relay has a front RS232 port and, as an option, a rear RS485 port. The data stream in
any of the configurations is “half-duplex”.er
Each byte of data is transmitted asynchronously and is made up of: 1 start bit, 8 data bits, 1 stop bit and
1 parity bit, if this is how it is programmed. Therefore, the data has 10 or 11 bits, depending on whether it
includes parity.
If the relay only offers with Modbus on the front port, the address (1 to 247) is configurable but the rest of
the paarmeters are fixed and equal to: baudrate 19200, No parity and stop bit 1.
If the relay offers RS485 Modbus protocol the the address (1 to 247) and the baudrate (4800, 9600,
19200 or 38400) con be but the rest of the parameters are fixed: without parity and with 1 stop bit.
The master must know the address of the slave that it is going to communicate with. No unit will act on
requests from the master if the message is not addressed to them. The exception is when the 0 address,
or “broadcast” address, is used, in which case the relay will act but will not send an answer of any type.
FUNCTION 1 byte This is one of the function codes supported by the equipment. In this case, the
CODE only function codes supported are 3 to read and 16 to write. When the slave has
to reply with an exception one of these frames, it is indicated by putting 1 in the
most important bit of the correspondent function. Thus, an exception for the
function 3, will be indicated with a 83 as a function code; and an exception for the
function code 16 or 0x10 in hexadecimal, will be indicated with an 0x90.
DATA N bytes This part consists of a variable number of bytes, depending on the function code.
It may include: addresses, data lengths, settings, commands or exception codes
sent by the user.
CRC 2 bytes Control code of two bytes. The ModBus/RTU includes a 16-bit CRC in each
frame, to detect errors. If the slave detects an erroneous frame, based on a CRC
that is not correct, it won’t take any action, nor will reply anything to the master.
The management of the CRC is LSB-MSB.
DEAD TIME Necessary time A frame is terminated when nothing is received for a period of 3,5 bytes. It means:
to transmit 3,5 15 ms at 2400 bps
Bytes 2 ms at 19200 bps
...etc.
0x03 Read Holding Reading of Any Value This function allows the master to read 1 or
more consecutive addresses of a relay. The
3 Registers registers always are of 16 bits, with the most
important byte at first. The maximum number
of registers to be read in a package are 60.
HEX
DEC MODBUS NAME DEFINITION COMMENT
CODE
0x10 Preset Multiple Script This function allows to write one or more
registers that represent one or more settings.
16 Registers The registers are values of 2 bytes of length,
transmitted with the most important byte at
first. The maximum number of registers to be
written in a package is 60.
The slave does not support any function with the function code received in
01 ILLEGAL FUNCTION
this message.
03 ILLEGAL DATA VALUE The slave has detected that the value sent by the master is not valid.
Indicates an error occurred in the slave while trying to execute the request
04 SLAVE DEVICE FAILURE
of the master.
06 SLAVE DEVICE BUSY The slave is busy and unable to perform the required operation.
When the data format takes up more than one BYTE, the most important BYTE is sent through the
communications first, and the least important BYTE is sent last.
ENUM 1 Integer without sign of 16 bits. Each of the possible values of the integer will have
a correspondence in the auxiliary list of the database. This list is the
correspondence chain which must be shown for each of the values. Memory will
only receive an integer value.
E. g.: 0, 1 Correspondence to “CLOSED”, “OPEN”
FLOAT 2
Number in FLOAT INVERSEing decimal point “FLOAT INVERSE” of 4 bytes
INVERSE
ASCIIxx xx/2 String: In length variable character chain. Final of String marked with ‘\0’.
E. g.: “ABC” 0x41x42x43x00....
FH 5 Year(UINT).month(UCHAR).day(UCHAR).hour(UCHAR).minutes(UCHAR).second
s(UCHAR).hundredth(UCHAR).thousandth(UINT)
EVENT 9 Criteria Directory (UINT). Event Identifier (UINT). Value (UINT). Associated
Measure (UINT).Date and Time(FH)
CCRIT 6 Criteria Number (UINT). Criteria Directory (UINT). Descriptive text (ASCII8)
GAJU 61 Number of Groups (UINT). Index of the Criteria-1(UINT). Index of the first setting of
the Criteria-1(UINT). … Index of the Criterion-30(UINT). Index of the first setting of
the Criteria-30(UINT).
When the data format takes up more than one BYTE, the most important BYTE is sent through the
communications first, and the least important BYTE is sent last.
Start Number of
Function Description Format Reference
address registries
Accumulated
03 & 16 Counters 204 2 CONT
Amperes
03 07 50 Hz
05 16 Measurement error
06 17 Ready
07 19 Change of settings
08 21 Set date/time
09 22 Local Control
10 23 Factory Settings
11 24 Error Eeprom
12 28 Eeprom changed
13 32 Events error
15 15 Reset
17 Phase A Pickup
18 Phase B Pickup
19 Phase C Pickup
20 Ground Pickup
21 Phase A Trip
22 Phase B Trip
23 Phase C Trip
24 Ground Trip
25 50 Trip
26 50N/G Trip
27 Phase Trip
- 30 New DFR
Event SIL-A
Address Description Bit Status Adapatation C
NO
√
00 01 Trip
03 07 50 Hz
05 16 Measurement error
06 17 Ready
07 19 Change of settings
08 21 Set date/time
09 22 Local Control
10 23 Factory Settings
11 24 Error Eeprom
12 28 Eeprom changed
13 32 Events error
15 15 Reset
17 50 Phase A Pickup
18 51 Phase B Pickup
19 52 Phase C Pickup
20 53 Ground Pickup
21 54 Phase A Trip
22 55 Phase B Trip
23 56 Phase C Trip
24 - Ground Trip
25 58 50 Trip
26 59 50N/G Trip
27 - Phase Trip
- 30 New DFR
01 - HMI Activity
17 02 Open breaker
18 03 Close breaker
19 04 79 Block
502 Local COM
20 05 79 Unblock
21 06 Local control
22 07 Remote Control
23 09 Reset
25 08 Reset TI
SIL-A SIL-A
Address Description Bit Event NO Status Adapatation B Adapatation C
√ √
00 01 50-1 Phase A Pickup
03 04 50-1 Pickup
504 50-1
08 05 50-1 Phase A Trip
11 08 50-1 Trip
01 02 51 Phase B Pickup
02 03 51 Phase C PIckup
03 04 51 Pickup
506 51
08 05 51 Phase A Trip
09 06 51 Phase B Trip
10 07 51 Phase C Trip
11 08 51 Trip
01 18 Input 2
02 19 Input 3
512 Inputs
03 20 Input 4
04 21 Input 5
05 22 Input 6
09 02 Output 2
514 Outputs
10 03 Output 3
11 04 Output 4
01 02 Phase B Block
516 Trip Block
02 03 Phase C Block
03 04 Phase Block
01 02 52 Error
02 03 52 Open
03 04 52 Opening time
04 05 52 Opening error
05 06 52 Closed
07 08 52 Closing error
08 09 52 Excessive total
openings
09 10 52 Excessive accumulated
amperes (I2t).
10 11 52 Excessive openings in a
time window
11 12 52 a
12 13 52 b
17 02 Open breaker
18 03 Close breaker
19 04 79 Block
21 06 Local control
22 07 Remote Control
23 09 Reset
25 08 Reset TI
01 02 79 Reclosing time
02 03 79 Is 52 Open?
03 04 79 Hold time
04 05 79 Closing time
526 79
05 06 79 Reset time.
06 07 79 Lockout
07 08 79 Safe time
09 - 79 Enabled
01 2
50-2 Phase B Pickup
02 3
50-2 Phase C Pickup
03 4
50-2 Pickup
528 50-2
08 5
50-2 Phase A Trip
09 6
50-2 Phase B Trip
10 7
50-2 Phase C Trip
11 8
50-2 Trip
01 52 Closed
02 52 Open
18 03 Close breaker
19 04 79 Block
22 07 Remote Control
23 09 Reset
25 08 Reset TI
01 - Led 2
02 - Led 3
03 - Led 4
542 Leds
04 - Led 5
05 - Led 6
06 - Led 52
07 - Led 79
√
29 31 74TCS Continuity B
√
30 - Logic signal 1
√
31 - Logic signal 2
01 02 Phase B Block -
552 SHB
02 03 Phase C Block -
03 04 Phase Block -
600 (*) √ √
Identification ASCII20 -
800 (**)
610 (*) 0 → 60 Hz √ √
Frequency DENUM
810 (**) 1 → 50 Hz
612 (*) √ √
Serial Number LONG -
812 (**)
672 (*) √ √
Alarm Level LONG -
872 (**)
(*) Read/Write Address (FC = 03 / 16).
(**) Address for Confirmation (FC = 16)
√ √
2 UINT16 Open Breaker
√ √
3 UINT16 Close Breaker
√ √
4 UINT16 79 Block
√ √
5 UINT16 79 Unblock
√ √
6 UINT16 Local Control
√ √
7 UINT16 Remote Control
√ √
8 UINT16 Reset
√ √
10 UINT16 Reset Thermal Image
ACCESS Read-only Function Function Function Function Function Enable Function Enable
LEVEL Enable: Enable to: Enable to: Enable to: to: to:
Status and Change Delete Execute Change Change
measurements settings Events Commands Configuration Protected
Settings
Settings Delete DFR
Configuration
Events/DFR
3 YES NO NO YES NO NO
2222 2
3333 3
4444 4
5555 5
Number
H Pickup L Pickup Number of Number of Checksum
Address Function of Password Checksum L
Address Address H Registers L Registers H
Bytes
0x35
0x35
0x01 0x10 0x00 0xA8 0x00 0x02 0x04 0x30 0xF4
0x35
0x35