Basler Electric BE1-700 User Manual

INSTRUCTION MANUAL

FOR

DIGITAL PROTECTIVE RELAY

BE1-700

MODBUS™ PROTOCOL

Publication: 9376700991

Revision: D 01/12

INTRODUCTION

This instruction manual provides detailed information about the BE1-700 Digital Protective Relay with the
Modbus™ protocol.

Disclaimer of Liability and Warranty

Basler Electric provides links to third-party Web sites as a convenience in locating relative information and
services for our users. The existence of these links is not to be construed as an endorsement by Basler
Electric of the content of any of these third-party sites. BASLER ELECTRIC MAKES NO EXPRESS,

IMPLIED OR STATUTORY WARRANTY, INCLUDING BUT NOT LIMITED TO WARRANTY OF
MERCHANTABILITY, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, warranty of non-

infringement or the like, or warranty of title. Basler Electric makes no representation of freedom from
computer viruses or of the accuracy of the information and/or the quality of products or services provided
by or advertised on these third-party Web sites. Basler Electric disclaims, to the fullest extent

permissible by applicable law, any and all liability, and responsibility for any claims or damage
that may arise as a result of use of any Web sites maintained by third parties and linked to the
Basler Electric Web site. Basler Electric advises site visitors that links to Web sites not controlled by

Basler Electric are not subject to the privacy notice associated with the Basler Electric Web site and,
therefore, are advised to read the privacy policies of any third-party sites accessed through this site.

9376700991 Rev D BE1-700 Modbus™ Protocol i

First Printing: June 2004

Printed in USA

© 2004-2012 Basler Electric, Highland Illinois 62249 USA

All Rights Reserved

January 2012

CONFIDENTIAL INFORMATION

of Basler Electric, Highland Illinois, USA. It is loaned for confidential use,
subject to return on request, and with the mutual understanding that it will not
be used in any manner detrimental to the interest of Basler Electric.

It is not the intention of this manual to cover all details and variations in equipment, nor does this manual
provide data for every possible contingency regarding installation or operation. The availability and design
of all features and options are subject to modification without notice. Should further information be
required, contact Basler Electric.

BASLER ELECTRIC

12570 STATE ROUTE 143

HIGHLAND IL 62249 USA

http://www.basler.com, [e-mail]

PHONE [phone] FAX [phone]

ii BE1-700 Modbus™ Protocol 9376700991 Rev D

REVISION HISTORY

The following information provides a historical summary of the changes made to this instruction manual
(9376700991). Revisions are listed in reverse chronological order.

Manual

Revision and Date

D, 01/12

C, 05/10

B, 10/08

A, 09/04

—, 06/04

 Updated procedure and replaced screenshots to reflect latest version

 Added Appendix A, Setting Up A DHCP Server Between BE1-700 and

 Under Modbus/TCP, added Change from DHCP to Static IP Address

 Added manual part number and revision to page footers.
 Minor text edits.
 Initial release.

Change

of Tftpd32 v4.00 in Appendix A.

PC.

on a Single Wire Network…

9376700991 Rev D BE1-700 Modbus™ Protocol iii

iv BE1-700 Modbus™ Protocol 9376700991 Rev D

CONTENTS

SECTION 1 • GENERAL INFORMATION ................................................................................................ 1-1

SECTION 2 • REGISTER TABLE ............................................................................................................. 2-1

SECTION 3 • REGISTER DETAILS ......................................................................................................... 3-1

SECTION 4 • ASCII CROSS REFERENCE ............................................................................................. 4-1

APPENDIX A • SETTING UP A DHCP SERVER BETWEEN BE1-700 AND PC .................................... A-1

9376700991 Rev D BE1-700 Modbus™ Protocol v

vi BE1-700 Modbus™ Protocol 9376700991 Rev D

SECTION 1 • GENERAL INFORMATION

TABLE OF CONTENTS

SECTION 1 • GENERAL INFORMATION ................................................................................................ 1-1

Introduction ............................................................................................................................................ 1-1

Message Structure ............................................................................................................................. 1-1

Modbus™ Modes of Operation ............................................................................................................... 1-2

Modbus™ RTU .................................................................................................................................... 1-2

Modbus/TCP ...................................................................................................................................... 1-3

Communications Hardware Requirements .......................................................................................... 1-10

RTU Communication Requirements ................................................................................................ 1-10

TCP Communication Requirements ................................................................................................. 1-10

Detailed Message Query and Response ............................................................................................. 1-10

Read Holding Registers ................................................................................................................... 1-10

Return Query Data ........................................................................................................................... 1-11

Restart Communications Option ...................................................................................................... 1-11

Listen Only Mode ............................................................................................................................. 1-11

Preset Multiple Registers ................................................................................................................. 1-12

Preset Single Register (Write Single Holding Register) ................................................................... 1-13

Data Formats ....................................................................................................................................... 1-13

Floating Point Data Format (FP) ...................................................................................................... 1-13

Long Integer Data Format (LI) .......................................................................................................... 1-14

Integer Data Format (INT) ................................................................................................................ 1-14

Short Integer Data Format (SI) ......................................................................................................... 1-14

ASCII String Data Format (ASC(x)) ................................................................................................. 1-14

Bit Mapped Data Format (BM(x)) ..................................................................................................... 1-15

CRC Error Check ............................................................................................................................. 1-15

Session Access Registers ................................................................................................................ 1-15

Template Registers .......................................................................................................................... 1-16

Fault Summary Registers ................................................................................................................. 1-16

Report Generation Registers ........................................................................................................... 1-17

Contiguous Poll Block Registers ...................................................................................................... 1-17

Exception Code Enhancement Registers ........................................................................................ 1-17

Figures

Figure 1-1. Basler Modbus/TCP Device Discovery Screen ...................................................................... 1-4

Figure 1-2. DOS Configuration Utility Screen - Login
Figure 1-3. DOS Configuration Utility Screen - Password
Figure 1-4. DOS Configuration Utility Screen – Enable DHCP Client
Figure 1-5. DOS Configuration Utility Screen – Don’t Enable DHCP Client
Figure 1-6. DOS Configuration Utility Screen – Enter IP Address
Figure 1-7. DOS Configuration Utility Screen – Enter Subnet Mask
Figure 1-8. DOS Configuration Utility Screen – Enter Default Gateway
Figure 1-9. DOS Configuration Utility Screen – Return to Main Menu
Figure 1-10. DOS Configuration Utility Screen – Enable DHCP Client
Figure 1-11. DOS Command Shell
Figure 1-12. DOS Command Example with DHCP Server
Figure 1-13. DOS Command Example without DHCP Server
Figure 1-14. DOS Command Example of Default IP Address Detected

Tables

Table 1-1. Timing Considerations .............................................................................................................. 1-3

Table 1-2. Supported Exception Response Codes
Table 1-3. Floating Point Format

9376700991 Rev D BE1-700 Modbus™ Protocol i

................................................................................ 1-4

......................................................................... 1-5

....................................................... 1-5

............................................. 1-6

............................................................ 1-6

......................................................... 1-6

................................................... 1-7

...................................................... 1-7

..................................................... 1-8

............................................................................................................ 1-9

....................................................................... 1-9

.................................................................. 1-9

................................................. 1-10

................................................................................... 1-3

............................................................................................................. 1-13

ii BE1-700 Modbus™ Protocol 9376700991 Rev D

SECTION 1 • GENERAL INFORMATION

Introduction

This document describes the Modbus™ communications protocol employed by BE1-700 relays and how
to exchange information with BE1-700 relays over a Modbus network. The BE1-700 communicates by
emulating a subset of the Modicon 984 Programmable Controller.

Modbus communications use a master-slave technique in which only the master can initiate a transaction.
This transaction is called a query. When appropriate, a slave (BE1-700) responds to the query. When a
Modbus master communicates with a slave, information is provided or requested by the master.
Information residing in the BE1-700 is grouped categorically as follows:

• Session Parameters

• Global Parameters

• Control Parameters (Select Before Operate)

• Setting Parameters

• Report Parameters

• Metering Parameters

All supported data can be read as specified in the Register Table. Abbreviations are used in the Register
Table to indicate the register type. Register types are:

• Read/Write = RW

• Read Only = R –

Select Before Operate (SBO) functions are used to change active settings groups and control outputs.
There are two settings groups in the BE1-700, one of which may be selected as active using SBO
commands.

When a slave receives a query, the slave responds by either supplying the requested data to the master
or performing the requested action. A slave device never initiates communications on the Modbus and will
always generate a response to the query unless certain error conditions occur. The BE1-700 is designed
to communicate on the Modbus network only as a slave device.

Message Structure

Device Address Field

The device address field contains the unique Modbus address of the slave being queried. The addressed
slave repeats the address in the device address field of the response message. This field is 1 byte.

Although Modbus protocol limits a device address from 1 - 247, a BE1-700 can be assigned a device
address in the range of 1 - 65534. The address is user-selectable at installation and can be altered during
real-time operation.

Function Code Field

The function code field in the query message defines the action to be taken by the addressed slave. This
field is echoed in the response message and is altered by setting the most significant bit (MSB) of the
field to 1 if the response is an error response. This field is 1 byte in length.

The BE1-700 maps all available data into the Modicon 984 holding register address space (4XXXX) and
supports the following function codes:

• Function 03 (03 hex) - read holding registers

• Function 06 (06 hex) - preset single register (write single holding register)

• Function 08 (08 hex), subfunction 00 - diagnostics: return query data

• Function 08 (08 hex), subfunction 01 - diagnostics: restart communications option

• Function 08 (08 hex), subfunction 04 - diagnostics: force listen only mode

• Function 16 (10 hex) - preset multiple registers, non-broadcast and broadcast

Data Block Field

The query data block contains additional information needed by the slave to perform the requested
function. The response data block contains data collected by the slave for the queried function. An error

9376700991 Rev D BE1-700 Modbus™ Protocol 1-1

response will substitute an exception response code for the data block. The length of this field varies with
each query. See the paragraphs on Register Definitions in this manual for interpretation of data.

Error Check Field

The error check field provides a method for the slave to validate the integrity of the query message
contents and allows the master to confirm the validity of response message contents. This field is 2 bytes.

Modbus™ Modes of Operation

A standard Modbus network offers one of three possible transmission modes for communication: ASCII,
remote terminal unit (RTU) or Modbus/TCP. The BE1-700 relay supports the RTU or Modbus/TCP modes
depending on communication options for the relay. For example, the RTU mode is employed when Com
Protocol Option 1 (Modbus over RS485 without Ethernet) or Option 5 (Modbus over RS485 with Ethernet)
is ordered. See Figure 1-1, Style Chart, in Section 1, General Information of Instruction Manual for the
BE1-700 (Basler Electric part number 9376700990). The BE1-700 also supports the Modbus/TCP
protocol when the relay is ordered with the Com Protocol Option #7. These two optional modes of
operation are described below. The ASCII mode is not supported with the BE1-700.

Modbus™ RTU

This is a serial transmission interface.

A master can query slaves individually or universally. A universal ("broadcast") query, when allowed,
evokes no response from any slave device. If a query to an individual slave device requests actions
unable to be performed by the slave, the slave response message contains an exception response code
defining the error detected. Exception response codes are quite often enhanced by the information found
in the "Error Details" block of holding registers.

Message Structure

Master initiated queries and BE1-700 responses share the same message structure. Each message is
comprised of four message fields. They are:

• Device Address (1 byte)

• Function Code (1 byte)

• Data Block (n bytes)

• Error Check field (2 bytes)

Each 8-bit byte in a message contains two 4-bit hexadecimal characters. The message is transmitted in a
continuous stream with the LSB of each byte of data transmitted first. Transmission of each 8-bit data
byte occurs with one start bit and either one or two stop bits. Parity checking is performed, when enabled,
and can be either odd or even. The transmission baud rate is user-selectable, and can be set at
installation and altered during real-time operation. The BE1-700 Modbus supported baud rates are 2400,
4800, 9600 and 19200. The factory default baud rate is 9600.

BE1-700 supports both RS-232-C and RS-485 compatible serial interfaces. Both interfaces are
accessible from the rear panel of the BE1-700. The RS-232-C interfaces (front and rear) are configured
for ASCII command mode while the RS-485 interface is configured for Modbus communication when this
option is installed. The sixth character of the relay style number must be “1”, “5”, or “7” for the relay to be
configured for Modbus RTU.

Message Framing and Timing Considerations

When receiving a message via the RS-485 communication port, the BE1-700 requires an inter-byte
latency of 3.5 character times before considering the message complete.

Once a valid query is received, the BE1-700 waits a specified amount of time before responding. This
time delay is set in the remote delay time parameter with the SG-COM ASCII command. This parameter
contains a value from 10 - 200 milliseconds. The default value is 10 milliseconds.

Table 1-1 provides the response message transmission time (in seconds) and 3.5 character times (in
milliseconds) for various message lengths and baud rates.

1-2 BE1-700 Modbus™ Protocol 9376700991 Rev D

Table 1-1. Timing Considerations

Baud Rate

2400 16.04 0.59 1.17

4800 8.021 0.29 0.59

9600 4.0104 0.15 0.29

19200 2.0052 0.07 0.15

3.5 Character Time
(ms)

128 Bytes 256 Bytes

Message Tx Time(s)

Error Handling and Exception Responses

Any query received that contains a non-existent device address, a framing error or CRC error is ignored.
No response is transmitted. Queries addressed to a BE1-700 with an unsupported function or illegal
values in the data block result in an error response message with an exception response code. The
exception response codes supported by the BE1-700 are provided in

Table 1-2. Supported Exception Response Codes

Code Name Description

01 Illegal Function

02 Illegal Data Address

03 Illegal Data Value

The query Function/Subfunction Code is unsupported; query
read of more than 125 registers; query preset of more than 100
registers.

A register referenced in the data block does not support queried
read/write; query preset of a subset of a numerical register
group.

A preset register data block contains an incorrect number of
bytes or one or more data values out of range.

Table 1-2.

Modbus/TCP

This is an optional Ethernet-enabled interface using the Transmission Control Protocol/Internet Protocol
(TCP/IP) as described below. Emphasis is placed on the initial setup of the relay. Should questions arise,
please contact your sales representative or Technical Services at Basler Electric, Highland, Illinois. The
BE1-700 relay comes with DHCP (Dynamic Host Configuration Protocol) enabled. Refer to Appendix
A, Setting Up a DHCP Server Between BE1-700 and PC, for information on setting up a DHCP server
between the BE1-700 and your PC using third-party software. To set a static IP address (recommended),
follow the instructions below. To verify or set DHCP, see the following description.

Change from DHCP to Static IP Address on a Hubbed/Switched Network with a DHCP Server Running

Make sure that the relay is connected to the network. Start the Basler Modbus/TCP Device Discovery
application that can be found on the CD provided with the relay. Wait at least 90 seconds after powering
on the relay and then click the Refresh button. A screen similar to
the Modbus/TCP-enabled units connected to your network.

Figure 1-1 will appear and display all

9376700991 Rev D BE1-700 Modbus™ Protocol 1-3

Figure 1-1. Basler Modbus/TCP Device Discovery Screen

Obtain the factory test report which is included with each BE1-700 relay and locate the MAC address.
Highlight the IP address of the relay that you wish to configure. The IP address of interest will correspond
with the MAC address shown on the factory test report. After highlighting the appropriate IP address, click
the Configure button. This will launch a telnet connection between your PC and the corresponding relay.
See Figure 1-2.

Figure 1-2. DOS Configuration Utility Screen - Login

The default parameters to log in are:
Login: root <Enter>
Password: Netsilicon

The password is case sensitive, so only the first letter should be capitalized. Press the Enter key. Once
login is successful, the screen shown in Figure 1-3 will appear.

1-4 BE1-700 Modbus™ Protocol 9376700991 Rev D

Figure 1-3. DOS Configuration Utility Screen - Password

Type 3 (Enable DHCP Client) and press the Enter key. Figure 1-4 will appear. Note: This process (i.e.,
Enable DHCP Client)

You will be prompted to enable the DHCP client with a YES (1) or disable it with a NO (2). Type 2 to
disable the DHCP Client and press the Enter key. After a few seconds, the following screen (Figure 1-5)
is displayed.

must

be followed to assign a static IP address.

Figure 1-4. DOS Configuration Utility Screen – Enable DHCP Client

9376700991 Rev D BE1-700 Modbus™ Protocol 1-5

Figure 1-5. DOS Configuration Utility Screen – Don’t Enable DHCP Client

Type 1 and press the Enter key. Then type the static IP Address for the BE1-700 and press the Enter
key. A screen similar to Figure 1-6 will appear.

Figure 1-6. DOS Configuration Utility Screen – Enter IP Address

Type 2 and press the Enter key. Then type the Subnet Mask for the BE1-700 and press the Enter key. A
screen such as that shown in Figure 1-7 will appear.

Figure 1-7. DOS Configuration Utility Screen – Enter Subnet Mask

1-6 BE1-700 Modbus™ Protocol 9376700991 Rev D

Type 3 and press the Enter key. See Figure 1-8. Then type the Default Gateway address for the BE1­700 and press the Enter key.

Figure 1-8. DOS Configuration Utility Screen – Enter Default Gateway

Type 4 and press the Enter key. After a few seconds a screen similar to the one shown in Figure 1-9 will
appear.

Figure 1-9. DOS Configuration Utility Screen – Return to Main Menu

At this time, the screen refreshes with the new IP parameters. The information that was changed is saved
but it will take a few seconds for the save operation to complete. Also, from the Main Menu, the user is
encouraged to change the password from the default value.

To quit and exit the DOS window, type 4 and press the Enter key or click the X in the upper right hand
corner of the screen. In order to finish the IP setting procedure, it will be necessary to cycle the relay
power. This resets the parameters. Once this is completed, as a self-check, wait about 90 seconds and
run the Discovery program again to verify that the IP parameters are correct. Then exit the configuration
utility program. The relay is now ready to communicate with the PC.

Verifying or Setting the DHCP

This protocol assigns a dynamic IP addresses to devices on a network. With dynamic addressing, a
device can have a different IP address every time it connects to the network. Since this may not be
desirable within a company’s local area network, the IP address may have to be set statically. That is,
DHCP will have to be disabled and a permanent IP assigned as previously discussed. Previously shown
figures will be referenced in the following discussion on enabling the DHCP.

9376700991 Rev D BE1-700 Modbus™ Protocol 1-7

Start the Basler Modbus/TCP Device Discovery application that can be found on the CD provided with the
relay. See Figure 1-1. Using the Ethernet port on the relay, make sure the relay is connected to the
company network. Be aware that it takes about 90 seconds after powering up a relay before it can be
discovered.

Clicking the Refresh button displays all Web-enabled units connected to the network. Highlight the
connection (i.e., your IP address) that you wish to configure. The IP address of interest will be related to
the MAC address shown on the factory test report. After highlighting the appropriate IP Address, click the
Configure button. This will launch a telnet application connected to the corresponding relay. See Figure
1-2.

The default parameters to login are:
Login: root <Enter>
Password: Netsilicon

The password is case sensitive, so only the first letter should be capitalized. Press the Enter key. Once
login is successful, a screen similar to the one shown in Figure 1-3 will come up.

Type 3 (Enable DHCP Client) and press the Enter key. Figure 1-4 will appear.

You will be prompted to enable the DHCP client with a YES (1) or disable it with a NO (2). Type1 and
press the Enter key. The response will be “DHCP is Enabled” as shown in Figure 1-10.

Figure 1-10. DOS Configuration Utility Screen – Enable DHCP Client

In addition, from the Main Menu, the user is encouraged to change the password from the default value.
Once the new password is changed, type 4 and press the Enter key to exit the program or click the X in
the upper right hand corner of the screen. The information that was changed is saved but it will take a few
seconds for the save operation to complete. In order to finish the setup procedure, it will be necessary to
cycle the relay power. This resets the parameters. Once this is completed, as a self-check, wait about 90
seconds and run the Discovery program again to verify that the DHCP client has been enabled. Then exit
the configuration utility program. The relay is now ready to communicate with the PC.

Change from DHCP to Static IP Address on a Single Wire Network (Between PC and BE1-700)

1) To discover the IP address of a single BE1-700 relay on an Ethernet network, the BE1-700 must be
connected to a hub or network switch that your PC’s NIC (Network Interface Card) is also connected
to. This is typically done by connecting a CAT 5 (Category 5) Ethernet cable from your PC’s NIC to a
network hub or switch and connecting the Ethernet port of the BE1-700 to the same network hub or
switch with a second CAT 5 Ethernet cable.

2) Your PC’s NIC can also be directly connected to the Ethernet port on the BE1-700 if you use a
Crossover CAT5 Ethernet cable between them.

3) In most Ethernet networks, a DHCP (Dynamic Host Configuration Protocol) server from a router or
another PC is connected to your Ethernet network through the hub or switch mentioned in step 1
above. If there is NO DHCP server, then a default 169.254.xxx.xxx IP address will be set by your PC
and by the BE1-700 after connecting the Ethernet cables. This may take a few minutes after the
cables are connected.

1-8 BE1-700 Modbus™ Protocol 9376700991 Rev D

4) Testing your network can be done from your computer’s DOS command shell. To open a DOS
command shell in Windows®, select the Start RUN Open: cmd. (Figure 1-11).

Figure 1-11. DOS Command Shell

5) Example WITH a DHCP server

In the DOS command shell type ipconfig to see the available networks (Figure 1-11):

Figure 1-12. DOS Command Example with DHCP Server

6) Example WITHOUT a DHCP server

In the DOS command shell type ipconfig to see the available networks (Figure 1-13):

Figure 1-13. DOS Command Example without DHCP Server

After a few minutes (when a DHCP server is not detected) a default IP address with the format

169.254.xxx.xxx address will be reported. (Figure 1-14)

9376700991 Rev D BE1-700 Modbus™ Protocol 1-9

Figure 1-14. DOS Command Example of Default IP Address Detected

7) Once your PC has an IP address, the BE1-700 BESTCOMS™ PC software program or the Digi
Discovery program (dgdiscvr.exe) can be used to determine the IP address of the BE1-700. A BE1­700 with style number xxxxx7x (Modbus/TCP over Ethernet) must use the Modbus ping software
program (ruiping.exe)

8) In the Basler Modbus/TCP Device Discovery program, click on Refresh to discover the IP address.

Communications Hardware Requirements

RTU Communication Requirements

The BE1-700 RS-485 physical interface is three positions of a terminal strip with locations for
Send/Receive A (A), Send/Receive B (B) and Signal Ground (C). Refer to the BE1-700 Instruction Manual
(9376700990) for further details.

TCP Communication Requirements

The BE1-700 Ethernet port (RJ-45) is used with the Ethernet option. The relay supports 10BaseT using
Cat 5 / Cat 5e shielded twisted pair. Refer to the BE1-700 Instruction Manual (9376700990) for further
details.

Detailed Message Query and Response

A detailed description of BE1-700 supported message queries and responses is provided in the following
paragraphs.

Read Holding Registers

Query

This query message requests a register or block of registers to be read. The data block contains the
starting register address and the quantity of registers to be read. A register address of N will read holding
register N+1. If the query is a broadcast (device address = 0), no response message is returned.

Device Address
Function Code = 03 (hex)
Starting Address Hi
Starting Address Lo

No. of Registers Hi
No. of Registers Lo
CRC Hi error check
CRC Lo error check

The number of registers cannot exceed 125 without causing an error response with the exception code
for an illegal function.

1-10 BE1-700 Modbus™ Protocol 9376700991 Rev D

Response

The response message contains the data queried. The data block contains the block length in bytes
followed by the data (one Data Hi byte and one Data Lo byte) for each requested register.

Reading an unassigned holding register returns a value of zero.

Device Address
Function Code = 03 (hex)
Byte Count
Data Hi (For each requested register, there is one Data Hi and one Data Lo.)
Data Lo
.
.
Data Hi
Data Lo
CRC Hi error check
CRC Lo error check

Return Query Data

This query contains data to be returned (looped back) in the response. The response and query
messages should be identical. If the query is a broadcast (device address = 0), no response message is
returned.

Device Address
Function Code = 08 (hex)
Subfunction Hi = 00 (hex)
Subfunction Lo = 00 (hex)
Data Hi = xx (don't care)
Data Lo = xx (don't care)
CRC Hi error check
CRC Lo error check

Restart Communications Option

This query causes the remote communications function of the BE1-700 to restart, terminating an active
listen only mode of operation. No effect is made upon primary relay operations. Only the remote
communications function is affected. If the query is a broadcast (device address = 0), no response
message is returned.

If the BE1-700 receives this query while in the listen only mode, no response message is generated.
Otherwise, a response message identical to the query message is transmitted prior to the
communications restart.

Device Address
Function Code = 08 (hex)
Subfunction Hi = 00 (hex)
Subfunction Lo = 01 (hex)
Data Hi = xx (don't care)
Data Lo = xx (don't care)
CRC Hi error check
CRC Lo error check

Listen Only Mode

This query forces the addressed BE1-700 to the listen only mode for Modbus communications isolating it
from other devices on the network. No responses are returned.

While in the listen only mode, the BE1-700 continues to monitor all queries. The BE1-700 does not
respond to any other query until the listen only mode is removed. All write requests with a query to Preset
Multiple Registers (Function Code = 16) are also ignored. When the BE1-700 receives the restart
communications query, the listen only mode is removed.

Device Address
Function Code = 08 (hex)

9376700991 Rev D BE1-700 Modbus™ Protocol 1-11

Subfunction Hi = 00 (hex)
Subfunction Lo = 04 (hex)
Data Hi = xx (don't care)
Data Lo = xx (don't care)
CRC Hi error check
CRC Lo error check

Preset Multiple Registers

A preset multiple registers query could address multiple registers in one slave or multiple slaves. If the
query is a broadcast (device address = 0), no response message is returned.

Query

A Preset Multiple Register query message requests a register or block of registers to be written. The data
block contains the starting address and the quantity of registers to be written followed by the Data Block
byte count and data. The BE1-700 will perform the write when the device address is the same as the
BE1-700's remote address or when the device address is 0. A device address is 0 for a broadcast query.

A register address of N will write Holding Register N+1.

Data will cease to be written if any of the following exceptions occur:

• Queries to write to Read Only registers result in an error response with Exception Code of "Illegal

Data Address.”

• Queries attempting to write more than 100 registers cause an error response with Exception

Code "Illegal Function.”

• An incorrect Byte Count will result in an error response with Exception Code of "Illegal Data

Value.”

• There are several instances of registers that are grouped together to collectively represent a

single numerical BE1-700 data value (i.e., floating point data and 32-bit integer data). A query to
write a subset of such a register group will result in an error response with Exception Code
"Illegal Data Address.”

• A query to write a not allowed value (out of range) to a register results in an error response with

Exception Code of "Illegal Data Value.”

Device Address
Function Code = 10 (hex)
Starting Address Hi
Starting Address Lo
No. of Registers Hi
No. of Registers Lo
Byte Count
Data Hi
Data Lo
.
.
.
Data Hi
Data Lo
CRC Hi error check
CRC Lo error check

Response

The response message echoes the starting address and the number of registers. There is no response
message when the query is a broadcast (device address = 0).

Device Address
Function Code = 10 (hex)
Starting Address Hi
Starting Address Lo
No. of Registers Hi
No. of Registers Lo
CRC Hi Error Check
CRC Lo Error Check

1-12 BE1-700 Modbus™ Protocol 9376700991 Rev D

Preset Single Register (Write Single Holding Register)

A Preset Single Register query message requests a single register to be written. The BE1-700 will
perform the write when the device address is the same as the BE1-700's remote address.

Query

Data will cease to be written if any of the following exceptions occur:

• Queries to write to Read Only registers result in an error response with Exception Code of Illegal

Data Address.

• A query to write an unallowed value (out of range) to a register results in an error response with

Exception Code of "Illegal Data Value.”

Device Address
Function Code = 06 (hex)
Address Hi
Address Lo
Data Hi
Data Lo
CRC Hi error check
CRC Lo error check

Response

The response message echoes the Query message after the register has been altered.

Data Formats

BE1-700 data varies from one to four bytes in length. Single byte data resides in the holding register
least-significant byte with the most-significant byte set to zero. Floating point data and long integer data
(each 32-bits in length) place the two most-significant bytes in the higher holding register address of the
associated register pair.

Floating Point Data Format (FP)

The Modbus floating point data format uses two consecutive holding registers to represent a data value.
The first register contains the low-order 16 bits of the following 32 bit format:

• MSB is the sign bit for the floating point value (0 = positive).

• The next 8 bits are the exponent biased by 127 decimal.

• The 23 LSBs comprise the normalized mantissa. The most-significant bit of the mantissa is

always assumed to be 1 and is not explicitly stored, yielding an effective precision of 24 bits.

The value of the floating point number is obtained by multiplying the binary mantissa times two raised to
the power of the unbiased exponent. The assumed bit of the binary mantissa has the value of 1.0, with
the remaining 23 bits providing a fractional value. Table 1-3 shows the floating point format.

Table 1-3. Floating Point Format

Sign Exponent +127 Mantissa

1 bit 8 bits 23 bits

The floating point format allows for values ranging from approximately 8.43X10-37 to 3.38X1038. A
floating point value of all zeroes is the value zero. A floating point value of all ones (not a number)
signifies a value currently not applicable or disabled.

Example: The value 95,800 represented in floating point format is hexadecimal 47BB1C00. This number
will read from two consecutive holding registers as follows:

Holding Register
K (Hi Byte) hex 1C
K (Lo Byte) hex 00
K+1 (Hi Byte) hex 47
K+1 (Lo Byte) hex BB

9376700991 Rev D BE1-700 Modbus™ Protocol 1-13

Value

The same byte alignments are required to write.

Long Integer Data Format (LI)

The Modbus long integer data format uses two consecutive holding registers to represent a 32 bit data
value. The first register contains the low-order 16 bits and the second register contains the high-order 16
bits.

Example: The value 95,800 represented in long integer format is hexadecimal 0x00017638. This number
will read from two consecutive holding registers as follows.

Holding Register
K (Hi Byte) hex 76
K (Lo Byte) hex 38
K+1 (Hi Byte) hex 00
K+1 (Lo Byte) hex 01

The same byte alignments are required to write.

Value

Integer Data Format (INT)

The Modbus integer data format uses a single holding register to represent a 16 bit data value.

Example: The value 4660 represented in integer format is hexadecimal 0x1234. This number will read
from a holding register as follows:

Holding Register
K (Hi Byte) hex 12
K (Lo Byte) hex 34

The same byte alignments are required to write.

Value

Short Integer Data Format (SI)

The Modbus short integer data format uses a single holding register to represent an 8 bit data value. The
holding register high byte will always be zero.

Example: The value 132 represented in short integer format is hexadecimal 0x84. This number will read
from a holding register as follows:

Holding Register
K (Hi Byte) hex 00
K (Lo Byte) hex 84

The same byte alignments are required to write.

ASCII Character Data Format (ASC(1))

The Modbus ASCII character data format uses a single holding register to represent a single character
value. The holding register high byte will always be zero with the ASCII character code in the low byte.

Example: The character 'D' represented in ASCII character format is hexadecimal 44. This number will
read from a holding register as follows:

Holding Register
K (Hi Byte) hex 00
K (Lo Byte) hex 44

The same byte alignments are required to write.

Value

Value

ASCII String Data Format (ASC(x))

The Modbus ASCII string data format uses one or more holding registers to represent a sequence or
string of character values. If the string contains a single character, the holding register high byte will
contain the ASCII character code and the low byte will be zero.

Example: The string "PASSWORD" represented in ASCII string format will read as follows:

1-14 BE1-700 Modbus™ Protocol 9376700991 Rev D

Holding Register
K (Hi Byte) 'P'
K (Lo Byte) 'A'
K+1 (Hi Byte) 'S'
K+1 (Lo Byte) 'S'
K+2 (Hi Byte) 'W'
K+2 (Lo Byte) 'O'
K+3 (Hi Byte) 'R'
K+3 (Lo Byte) 'D'

Example: If the above string is changed to "P", the new string will read as follows:

Holding Register
K (Hi Byte) 'P'
K (Lo Byte) hex 00
K+1 (Hi Byte) hex 00
K+1 (Lo Byte) hex 00
K+2 (Hi Byte) hex 00
K+2 (Lo Byte) hex 00
K+3 (Hi Byte) hex 00
K+3 (Lo Byte) hex 00

The same byte alignments are required to write.

Value

Value

Bit Mapped Data Format (BM(x))

The bit mapped data format uses two or more holding registers to represent a sequence of bit values. The
Modbus Bit Map data format can represent an 8 bit, 16 bit, 32 bit or 64 bit value.

Example: The Bit Map value of the hexadecimal number 0x123456789ABCDEF0 using a BM64 format
will read as follows:

Holding Register
K (Hi Byte) 0x12
K (Lo Byte) 0x34
K+1 (Hi Byte) 0x56
K+1 (Lo Byte) 0x78
K+2 (Hi Byte) 0x9A
K+2 (Lo Byte) 0xBC
K+3 (Hi Byte) 0xDE
K+3 (Lo Byte) 0xF0

Value

CRC Error Check

This field contains a two-byte CRC value for transmission error detection. The master first calculates the
CRC and appends it to the query message. The BE1-700 recalculates the CRC value for the received
query and performs a comparison to the query CRC value to determine if a transmission error has
occurred. If so, no response message is generated. If no transmission error has occurred, the slave
calculates a new CRC value for the response message and appends it to the message for transmission.

The CRC calculation is performed using all bytes of the device address, function code and data block
fields. A 16-bit CRC-register is initialized to all 1's. Then each eight-bit byte of the message is used in the
following algorithm:

First, exclusive-OR the message byte with the low-order byte of the CRC-register. The result, stored in
the CRC-register, will then be right-shifted eight times. The CRC-register MSB is zero-filled with each
shift. After each shift, the CRC-register LSB is examined. If the LSB IS a 1, the CRC-register is then
exclusive-ORed with the fixed polynomial value A001 (hex) prior to the next shift. Once all bytes of the
message have undergone the above algorithm, the CRC-register will contain the message CRC value to
be placed in the error check field.

Session Access Registers

The ACCESS REQUEST and the EXIT registers are used to access and release write privileges while
changing relay settings, resetting report registers, or using control commands through the Modbus port.
This feature is important because it prevents changes from being made concurrently from two areas. For

9376700991 Rev D BE1-700 Modbus™ Protocol 1-15

example, a user cannot make changes from COM0 at the same time a remote user is making changes
via Modbus from COM2.

Changing the settings through the Modbus port requires that the operator write to the ACCESS
REQUEST register to obtain programming access. This must follow writing the ACCESS PASSWORD
register(s) with a password to obtain access to change settings associated with the password. Different
passwords give the ability or access to perform different operations. The relay will deny access if an
invalid password is entered or if another user has already been granted programming access through
another serial port or at the front panel. Only one user can have access at any one time.

If no password protection is used, it is still necessary to obtain access in order to protect against
accidental changes. If password protection is disabled, then writing the ACCESS REQUEST register will
be accepted in place of a password. The relay will transmit a valid response message if the access query
was received and executed. The relay will respond with an error message if the access query could not
be executed.

Changing settings through a Modbus communication port consists of the following sequence:

Step 1. Preset Multiple Registers query to ACCESS PASSWORD register(s) to specify password.
Step 2. Preset Multiple Registers query to ACCESS REQUEST register to access write privileges.
Step 3. Preset Multiple Registers queries to change the current settings.
Step 4. Preset Multiple Registers query to EXIT register to clear access and save.

Changes are not made to the working settings but to a scratch-pad copy of the settings. After the
change(s) are made, the new data will be copied to the working settings and saved to non-volatile
memory when the EXIT register is written with a 'Y.' It is important to make all changes to relay
parameters before writing the EXIT register. This prevents a partial or incomplete protection scheme from
being implemented.

Template Registers

The BE1-700 uses three templates. A template is a block of holding registers to which the user assigns
one of a number of similar groups of parameters. Templates are used for settings groups, fault
summaries, and report generation. Modbus Template Registers 40036 (Settings Group Selection), 40038
(Fault Number Selection), 40039 (Report Selection) and 40040 (Report Focus) do not require any Write
Password Access level before they can be written to.

The BE1-700 has two settings groups. The GRP template is assigned the parameters of a settings group.
Therefore, before reading or writing settings group values, a user must first specify which settings group
is to be associated with the template. This is accomplished by writing the desired settings group number
(0 or 1) into the SETTINGS GROUP SELECTION Template holding register.

The BE1-700 stores up to 12 faults. Each fault is accessed by its fault number which ranges from 1 to

255. The FLT template is assigned the parameters of a particular fault occurrence. Therefore, before
reading fault summary values, a user must first specify which fault number is to be associated with the
template. This is accomplished by writing the desired fault number (1-255) into the FAULT SELECTION
Template holding register.

The BE1-700 generates 10 ASCII reports. The RPT template is assigned the text of a report. Therefore,
before reading report text, a user must first specify which report is to be associated with the template.
This is accomplished by writing the desired report number into the REPORT SELECTION Template
holding register along with the associated report identifier, if any, into the REPORT FOCUS Template
holding register.

Fault Summary Registers

The user can enter any fault number (1 - 255) into the FAULT SELECTION Template holding register to
associate summary parameters for that fault number with the FLT Template. The Fault Template Status
register (47513) indicates whether or not that fault number specifies a recent fault (one of 12 stored
faults). If so, the Fault Template Status register value is the fault number. Otherwise, it is zero and all FLT
template values will read zero.

The Fault Indicator register (47512) value is the fault number (1 - 255) of the most recent fault. The user
may construct his front-end GUI to link this register value into the FAULT SELECTION Template holding
register, thereby automatically associating the FLT template with the most recent fault occurrence.

1-16 BE1-700 Modbus™ Protocol 9376700991 Rev D

Report Generation Registers

The BE1-700 generates numerous ASCII reports available via serial commands. Several of these reports
are available intact via the Modbus communication port. The desired report is first specified by writing the
REPORT SELECTION holding register. If the report requires a number to be specified such as a fault
number or number of events, that number is written into the REPORT FOCUS holding register. The report
is then available via the RPT template. The report can be read from 1 to 125 registers at a time, with each
register containing 2 ASCII characters of information. The report read queries can be interspersed among
other query types. The RPT template is continually re-read until the report has completed. Once the
report is complete, reading from the RPT template will continually return the ASCII character code of 127
("7F" hexadecimal). The report cannot be re-read or another report read until the REPORT SELECTION
holding register is re-written.

Contiguous Poll Block Registers

The user may allocate up to 125 holding registers to the Contiguous Poll Block (49875-999). This
allocation allows dispersed registers which are frequently read to be polled via a single read query. A
register is assigned to a position in the Poll Block by writing its address value into the corresponding
position in the Contiguous Poll Block Assignments registers (40746-870). Writing a zero value leaves that
Poll Block position unassigned. Once assignments are made, the values of the assigned registers may be
read by polling the Contiguous Poll Block. Polling an unassigned position will return a value of zero.

For example, if you wanted to continuously monitor the Date (47364), Time (47365-66), Fault Indicator
(47512) and Breaker Status (47390g) Holding Registers, you would first configure the Contiguous Poll
Block Registers by writing the desired register address values 7364, 7365, 7366, 7512 and 7388 into the
Contiguous Poll Block Assignment registers 40746 thru 40750, respectively. You may now begin
monitoring the specified registers by reading the first 5 locations in the Contiguous Poll Block; i.e., reading
register 49875 for the Date (as specified in it's corresponding assignment register 40746), reading
register 49876 and 77 for the Time (as specified in their corresponding assignment registers 40747 and

48), reading register 49878 for the Fault Indicator (as specified in it's corresponding assignment register

40749) and reading register 49879 for the Breaker Status (as specified in it's corresponding assignment
register 40750).

Exception Code Enhancement Registers

When a BE1-700 responds to a Preset Multiple Register query with an error response message,
additional information detailing the cause of the error may be available in the ERROR DETAILS block of
holding registers (49835-54). The information is in ASCII format and available by reading the message
string from the ERROR DETAILS block. The message remains available until the next Preset Multiple
Register query is executed unless that query is to the FAULT SELECTION Template holding register.
Since this register can be written automatically and randomly in time, the ERROR DETAILS block will not
be updated.

The ERROR DETAILS block will also contain the exit status following a Preset Multiple Register query to
the EXIT (40001) register. You may clear the ERROR DETAILS message at any time without affecting
system operation by sending a Preset Multiple Register query to any unassigned holding register.

9376700991 Rev D BE1-700 Modbus™ Protocol 1-17