Warnings, Cautions, and Notes as used in this publication
Warnings
WARNING!Warning notices are used in this publication to emphasize that hazardous voltages,
currents, or other conditions that could cause personal injury exist in this equipment or may be
associated with its use.
Warning notices are also used for situations in which inattention or lack of equipment knowledge
could cause either personal injury or damage to equipment.
Cautions
CAUTION:Caution notices are used for situations in which equipment might be damaged if care is
not taken.
Notes
NOTE:Notes call attention to information that is especially significant to understanding and
operating the equipment.
This document is based on information available at the time of its publication. While efforts have been
made to ensure accuracy, the information contained herein does not cover all details or variations in
hardware and software, nor does it provide for every possible contingency in connection with
installation, operation, and maintenance. Features may be described in here that are not present in all
hardware and software systems. GE Consumer & Industrial assumes no obligation of notice to holders
of this document with respect to changes subsequently made.
GE Consumer & Industrial makes no representation or warranty, expressed, implied, or statutory, with
respect to, and assumes no responsibility for the accuracy, completeness, sufficiency, or usefulness of
the information contained herein. No warrantees of merchantability or fitness for purpose shall apply.
Entellisys™, EntelliGuard™, and FlexLogic™ are trademarks of the General Electric Company.
Modbus RTU is a registered trademark of AEG Schneider Automation.
Please have your Entellisys System Summary # and Sub # ready when calling. This information can be
found on the Entellisys HMI on the System Health screen by clicking the Job Info button.
Post Sales Service
GE Switchgear
510 Agency Road
West Burlington, IA 52655
PLCs are supported by providing status of all FlexLogic operands and discrete inputs through
the Modbus TCP interface.
PLCs have access to states of FlexLogic operands (protection elements, breaker control, status,
contact inputs/outputs, and virtual inputs/outputs) through the Modbus communication. It shall
be PLC's responsibility to figure out which CPU is running in the primary mode (Modbus register:
“FlexLogic Active”) and FlexLogic health status (Modbus register: “FlexLogic Status Message”).
CPU does not initiate communication with PLC.
1.1.1 PLC Input
PLC inputs provide the ability to manipulate FlexLogic execution. There are 256 PLC inputs, each
of which have a corresponding operand that is accessible in FlexLogic.
Writing to PLC inputs: The PLC must be programmed to write to specific bits in the PLC Input
State registers in the Modbus memory map. See Modbus Memory Map
on page 39)
Events:
If the “Events” parameter for the PLC Input is enabled and event will be logged in the Events
screen when the state has changed. 'x' in the text of event is a placeholder for number from
range 1 to 256. Source of the events is reported as (-1).
“PLC Input x On” - logged when PLC Input transitioned from low to high state.
“PLC Input x Off” - logged when PLC Input transitioned from high to low state.
PLC support7
Page 8
1.1.1.1 Configuration
User must set the parameters for each PLC Input from the PLC Input screen (Main Menu, User
Settings, Control).
Figure 1-1 PLC Input configuration screen
Function: Controls whether the input is either enabled or disabled. When input is disabled,
FlexLogic always reads its state as low. If input is enabled, FlexLogic reads the state from
corresponding Modbus register.
Events: When enabled, if there is transition of state, an event corresponding to the direction of
the transition will be logged.
Integrator’s Guide8
Page 9
1.1.1.2 Status
To view a snapshot of the PLC input states from the HMI, open the PLC Input State screen (Main
Menu, User Settings, Control). Click refresh if update the status.
Figure 1-2 PLC Input States register format
1.1.1.3 PLC Input States
Each bit of the “PLC Input States” register represents one PLC input. Bit value 0 indicates the
corresponding PLC input is in off state; and bit value is 1 indicating corresponding PLC input is in
on state. See Table 1-1.
Table 1-1 PLC Input States register format
PLC Input States register PLC Input States bit fieldPLC Input X
101
2017
…
160241
12
23
……
1516
118
……
1242
……
15256
PLC support9
Page 10
1.1.2 FlexLogic Operand States
After each protection pass, all the information regarding each operand's state is updated in
corresponding Modbus register. The section PLC Interface (Read/Write) on page 110 is the
complete list of registers holding state information of corresponding operand.
1.1.2.1 Breaker Control Flex Operand States
Each breaker has 13 different states shown in Table 1-2. Each one of them corresponds to a
different bit in the data item.
Table 1-2 Breaker Control status bit field
BitValueNotes
0Breaker Opened
1Breaker Closed
2Breaker Locked Out
3Closing Spring Charged
4Primary Disconnect Connected
5Primary Disconnect Disconnected
6Secondary Disconnect Connected
7Breaker Ready
8Breaker Available
9Breaker Open Failed
10Breaker Close Failed
11Breaker Fault
12Breaker RELT StateNot used in this release. It shall be always set to 0.
The breaker states for all 30 breakers span across 25 consecutive modbus registers as shown in
Table 1-3. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-3 Breaker status offsets
Breaker NumberRegister
Offset
Breaker 100N/A
Breaker 2013This breaker’s information spans
Breaker 3110This breaker’s information spans
Bit OffsetNotes
over two adjacent registers
over two adjacent registers
Breaker 427This breaker’s information spans
over two adjacent registers
............
Integrator’s Guide10
Page 11
1.1.2.2 Bus Differential Flex Operand States
Each zone has 6 different states shown in Table 1-4. Each one of them corresponds to a different bit
in the data item.
Table 1-4 Bus Differential status bit field
BitValue
0Trip Dropout
1Alarm Dropout
2Trip Pickup
3Alarm Pickup
4Trip Operated
5Alarm Operated
6Backup Trip Operated
The zone states for all 4 relay instances span across 2 consecutive modbus registers as shown in
Table 1-3. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-5 Bus Differential status offsets
Zone NumberRegister
Offset
Bit OffsetNotes
Zone 100
Zone 207
Zone 3014This zone’s information spans
over two adjacent registers
Zone 415
112Bits from 12 thru 15 are not used
and shall always be set to 0
PLC support11
Page 12
1.1.2.3 Ground Fault Flex Operand States
Each breaker has 5 different states shown in Table 1-6. Each one of them corresponds to a different
bit in the data item.
Table 1-6 Ground Fault status bit field
BitValue
0Trip Pickup
1Trip Operated
2Trip Dropout
3Alarm Pickup
4Alarm Operated
5Alarm Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-7. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-7 Ground Fault status offsets
Breaker NumberRegister
Offset
Bit OffsetNotes
Breaker 100
Breaker 206
Breaker 3012This breaker’s information spans
over two adjacent registers
Breaker 412
............
Integrator’s Guide12
Page 13
1.1.2.4 High Current and High Current Transient Flex Operand States
Each breaker has 3 different states shown in Table 1-8. Each one of them corresponds to a different
bit in the data item.
Table 1-8 High Current status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-9. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-9 High Current status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 203
Breaker 306
Bit OffsetNotes
Breaker 409
............
PLC support13
Page 14
1.1.2.5 HRGF Detection Flex Operand States
Each breaker has 3 different states shown in Table 1-10. Each one of them corresponds to a
different bit in the data item.
Table 1-10 HRGF Detection status bit field
BitValue
0Alarm Dropout
1Alarm Pickup
2Alarm Operated
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-11. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-11 HRGF Detection status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 203
Breaker 306
Bit OffsetNotes
Breaker 409
............
Integrator’s Guide14
Page 15
1.1.2.6 HRGF Location Flex Operand States
Each zone has 2 different states shown in Table 1-12. Each one of them corresponds to a different
bit in the data item.
Table 1-12 HRGF Location status bit field
BitValue
0Locator in On State
1Locator in Off State
The zone states for all 4 location function instances are contained in a single modbus register as
shown in
Table 1-13 HRGF Location status offsets
Zone NumberRegister
Zone 100
Zone 202
Zone 304
Zone 406
Table 1-13. See PLC Interface (Read/Write) on page 110 for memory locations.
Offset
Bit OffsetNotes
08Bits from 8 thru 15 are not used
and shall always be set to 0
PLC support15
Page 16
1.1.2.7 IOC Flex Operand States
Each breaker has 2 different states shown in Table 1-14. Each one of them corresponds to a
different bit in the data item.
Table 1-14 IOC status bit field
BitValue
0Trip Operated
1Trip Dropout
The breaker states for all 30 breakers span across 4 consecutive modbus registers as shown in
Table 1-15. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-15 IOC status offsets
Breaker NumberRegister
Breaker 100
Breaker 202
Breaker 304
Breaker 406
Bit OffsetNotes
Offset
Breaker 508
Breaker 6010
Breaker 7012
Breaker 8014
Breaker 910
.........
Integrator’s Guide16
Page 17
1.1.2.8 LT Overcurrent Flex Operand States
Each breaker has 3 different states shown in Table 1-16. Each one of them corresponds to a
different bit in the data item.
Table 1-16 LT Overcurrent status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-17. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-17 LT Overcurrent status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 203
Breaker 306
Breaker 409
Breaker 5012
Breaker 6015This breaker’s information spans
.........
Bit OffsetNotes
over two adjacent registers
PLC support17
Page 18
1.1.2.9 MSGF Overcurrent Flex Operand States
Each zone has 7 different states shown in Table 1-18. Each one of them corresponds to a different
bit in the data item.
Table 1-18 MSGF Overcurrent status bit field
BitValue
0Trip Dropout
1Alarm Dropout
2Trip Pickup
3Alarm Pickup
4Trip Operated
5Alarm Operated
6Backup Trip Operated
The zone states for all 4 instances span across 2 consecutive modbus registers as shown in
Table 1-19. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-19 MSGF Overcurrent status offsets
Zone NumberRegister
Offset
Zone 100
Zone 207
Zone 3014This zone’s information spans
Zone 415
112Bits from 12 thru 15 are not used
Bit OffsetNotes
over two adjacent registers
and shall always be set to 0
Integrator’s Guide18
Page 19
1.1.2.10 Multi Point RELT Flex Operand States
This relay has 1 state shown in Table 1-20.
Table 1-20 Multi Point RELT status bit field
BitValue
0Multipoint Reduced Let-Thru Mode On
The relay state uses one modbus register as shown in Table 1-21. See PLC Interface (Read/Write)
on page 110 for memory locations.
Table 1-21 Multi Point RELT status offsets
Zone NumberRegister
Offset
RELT State00
01Bits from 1 thru 15 are not used
Bit OffsetNotes
and shall always be set to 0
PLC support19
Page 20
1.1.2.11 Over (and Under) Frequency Flex Operand States
Each breaker has 6 different states shown in Table 1-22. Each one of them corresponds to a
different bit in the data item.
Table 1-22 Over Frequency status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
3Trip Pickup
4Trip Operated
5Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-23. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-23 Over Frequency status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 206
Breaker 3012This breaker’s information spans
Breaker 412
.........
Bit OffsetNotes
over two adjacent registers
Integrator’s Guide20
Page 21
1.1.2.12 Over (and Under) Voltage Flex Operand States
Each breaker has 6 different states shown in Table 1-24. Each one of them corresponds to a
different bit in the data item.
Table 1-24 Over Voltage status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
3Trip Pickup
4Trip Operated
5Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-25. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-25 Over Voltage status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 206
Breaker 3012This breaker’s information spans
Breaker 412
.........
Bit OffsetNotes
over two adjacent registers
PLC support21
Page 22
1.1.2.13 Phase Loss Flex Operand States
Each breaker has 6 different states shown in Table 1-26. Each one of them corresponds to a
different bit in the data item.
Table 1-26 Phase Loss status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
3Trip Pickup
4Trip Operated
5Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-27. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-27 Phase Loss status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 206
Breaker 3012This breaker’s information spans
Breaker 412
.........
Bit OffsetNotes
over two adjacent registers
Integrator’s Guide22
Page 23
1.1.2.14 Power Reversal Flex Operand States
Each breaker has 6 different states shown in Table 1-28. Each one of them corresponds to a
different bit in the data item.
Table 1-28 Power Reversal status bit field
BitValue
0Alarm Pickup
1Alarm Operated
2Alarm Dropout
3Trip Pickup
4Trip Operated
5Trip Dropout
The breaker states for all 30 breakers span across 12 consecutive modbus registers as shown in
Table 1-29. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-29 Power Reversal status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 206
Breaker 3012This breaker’s information spans
Breaker 412
.........
Bit OffsetNotes
over two adjacent registers
PLC support23
Page 24
1.1.2.15 ST Overcurrent Flex Operand States
Each breaker has 3 different states shown in Table 1-30. Each one of them corresponds to a
different bit in the data item.
Table 1-30 ST Overcurrent status bit field
BitValue
0Trip Pickup
1Trip Operated
2Trip Dropout
The breaker states for all 30 breakers span across 6 consecutive modbus registers as shown in
Table 1-31. See PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-31 ST Overcurrent status offsets
Breaker NumberRegister
Offset
Breaker 100
Breaker 203
Breaker 306
Breaker 409
Breaker 5012
Breaker 6015This breaker’s information spans
Breaker 712
.........
Bit OffsetNotes
over two adjacent registers
Integrator’s Guide24
Page 25
1.1.2.16 Summation MSGF Zone Flex Operand States
Each zone has 7 different states shown in Table 1-32. Each one of them corresponds to a different
bit in the data item.
Table 1-32 Summation MSGF Zone status bit field
BitValue
0Trip Dropout
1Alarm Dropout
2Trip Pickup
3Alarm Pickup
4Trip Operated
5Alarm Operated
6Trip Restrained
The zone states for both zones reside in a single modbus register as shown in Table 1-33. See PLC
Interface (Read/Write) on page 110 for memory locations.
Table 1-33 Summation MSGF Zone status offsets
Zone NumberRegister
Offset
Zone 100
Zone 208
Bit OffsetNotes
PLC support25
Page 26
1.1.2.17 Synch Check Flex Operand States
Each relay has 10 different states shown in Table 1-34. Each one of them corresponds to a different
bit in the data item.
Table 1-34 Synch Check status bit field
BitValue
0Dead Source Operated
1Dead Source Dropout
2Synch Operated
3Synch Dropout
4Close Operated
5Close Dropout
6V1 Above Minimum
7V2 Above Minimum
8V1 Below Maximum
9V2 Below Maximum
The relay states for all12 relays span across 8 consecutive modbus registers as shown in Table 1-35.
See
PLC Interface (Read/Write) on page 110 for memory locations.
Table 1-35 Synch Check status offsets
Zone NumberRegister
Offset
Relay 100
Relay 2010This relay’s information spans
Relay 314
Relay 4114This relay’s information spans
Relay 528This relay’s information spans
Relay 632
Relay 7312
Relay 846
Relay 950
Relay 10510
Bit OffsetNotes
over two adjacent registers
over two adjacent registers
over two adjacent registers
Relay 1164
Relay 12614
78Bits from 8 thru 15 are not used
and shall always be set to 0
Integrator’s Guide26
Page 27
2Modbus® protocol implementation
2.1 Introduction
The CPU supports a number of communications protocols to allow connection to the HMI
computer, as well as other equipment which includes personal computers, RTUs, SCADA
masters, and programmable logic controllers. The Modicon Modbus® RTU protocol is the most
basic protocol supported. Modbus is available via ethernet as specified by the Modbus/TCP
specification. Note that:
•The CPU always acts as a slave device, meaning that it never initiates communications; it
only listens and responds to requests issued by a master computer.
•For Modbus, a subset of the Remote Terminal Unit (RTU) protocol format is supported that
allows extensive monitoring, programming, and control functions using read and write
register commands.
•The CPU will support a maximum of 8 concurrent Modbus sessions. Four sessions are
reserved for use by HMI computers. A remote device that attempts to connect when all
sessions are in use will receive a response message indicating the number of maximum
connections has been exceeded. If a remote device does not make a request within
30 seconds, the session will be timed out and made available to the next device that
establishes a session.
2
2.2 Physical layer
The Modbus RTU protocol is hardware-independent so that the physical layer can be any of a
variety of standard hardware configurations. The CPU includes a faceplate (front panel)
100BaseT Ethernet port. Data flow is auto-configuring full or half-duplex. Each data byte is
transmitted in an asynchronous format consisting of 1 start bit, 8 data bits, 1 stop bit , and
possibly 1 parity bit. This produces a 10 or 11 bit data frame. The master device in any system
must know the address of the slave device with which it is to communicate. In the case of
ModbusTCP communications, the CPU will not act on a request from a master if the address in
the request does not match the CPU’s slave address. A single setting selects the slave address
used for ModbusTCP. The default slave address for a CPU is 1.
Introduction27
Page 28
2.3 Data link layer
22
Communications takes place in packets, which are groups of asynchronously framed byte data.
The master transmits a packet to the slave and the slave responds with a packet. The end of a
packet is marked by ‘dead-time’ on the communications line. The following describes general
format for both transmit and receive packets. For exact details on packet formatting, see the
subsequent sections describing each function code.
MODBUS PACKET FORMAT
DESCRIPTIONSIZE
SLAVE ADDRESS1 byte
FUNCTION CODE1 byte
DATAN bytes
CRC2 bytes
DEAD TIME3.5 bytes transmission time
SLAVE ADDRESS
This is the address of the slave device that is intended to receive the packet sent by the master
and perform the desired action. Only the addressed slave will respond to a packet that starts
with its address. Note that since Modbus/TCP also relies on a correct IP address to receive the
packet, and each CPU responds as a single device, it is generally not necessary to change the
Modbus address of the device.
FUNCTION CODE
This is one of the supported function codes of the unit which tells the slave what action to
perform. See Supported function codes
from the slave is indicated by setting the high order bit of the function code in the response
packet. See Exception responses on page 35 for further details.
DATA
This will be a variable number of bytes depending on the function code. This may include actual
values, settings, or addresses sent by the master to the slave or by the slave to the master.
CRC
This is a two byte error checking code. The RTU version of Modbus includes a 16-bit cyclic
redundancy check (CRC-16) with every packet which is an industry standard method used for
error detection. If a Modbus slave device receives a packet in which an error is indicated by the
CRC, the slave device will not act upon or respond to the packet thus preventing any erroneous
operations. See CRC-16 Algorithm
on page 30 for complete details. An exception response
on page 29 for a description of how to calculate the CRC.
Modbus® protocol implementation28
Page 29
2.4 CRC-16 Algorithm
The CRC-16 algorithm essentially treats the entire data stream (data bits only; start, stop and
parity ignored) as one continuous binary number. This number is first shifted left 16 bits and
then divided by a characteristic polynomial (11000000000000101B). The 16-bit remainder of the
division is appended to the end of the packet, most significant byte first. The resulting packet
including CRC, when divided by the same polynomial at the receiver, will give a zero remainder if
no transmission errors have occurred. This algorithm requires the characteristic polynomial to
be reverse bit ordered. The most significant bit of the characteristic polynomial is dropped, since
it does not affect the value of the remainder.
CRC-16 ALGORITHM
SYMBOLS-->data transfer
A16-bit working register
Alowlow order byte of A
Ahighhigh order byte of A
CRC16-bit CRC-16 result
i,jloop counters
(+)logical EXCLUSIVE-OR operator
2
Ntotal number of data bytes
Dii-th data byte (i = 0 to N-1)
G16-bit characteristic polynomial = 1010000000000001 (binary) with
MSbit dropped and bit order reversed
shr (x)right shift operator (th LSbit of x is shifted into a carry flag, a ‘0’ is
shifted into the MSbit of x, all other bits are shifted right one location)
ALGORITHM:
1. FFFF (hex) --> A
2. 0 --> i
3. 0 --> j
4. Di (+) Alow --> Alow
5. j + 1 --> j
6. shr (A)
7. Is there a carry? No: go to 8 Yes: G (+) A --> A and continue.
8. Is j = 8? No: go to 5 Yes: continue
9. i + 1 --> i
10. Is i = N? No: go to 3 Yes: continue
11. A --> CRC
CRC-16 Algorithm29
Page 30
2
2.5 Supported function codes
Modbus officially defines function codes from 1 to 127 though only a small subset is generally
needed. The CPU supports some of these functions, as summarized in the following table.
Subsequent sections describe each function code in detail.
2.5.1 Function Code 03H/04H – Read Actual Values or Settings
This function code allows the master to read one or more consecutive data registers (actual
values or settings) from a relay. Data registers are always 16 bit (two byte) values transmitted
with high order byte first . The maximum number of registers that can be read in a single packet
is 125. See the MODBUS MEMORY MAP table on page 17 for exact details on the data registers.
Since some PLC implementations of Modbus only support one of function codes 03h and 04h,
the CPU interpretation allows either function code to be used for reading one or more
consecutive data registers. The data starting address will determine the type of data being read.
Function codes 03h and 04h are therefore identical. The following table shows the format of the
master and slave packets. The example shows a master device requesting 3 register values
starting at address 4050h from slave device 11h (17 decimal); the slave device responds with
the values 40, 300, and 0 from registers 4050h, 4051h, and 4052h, respectively.
FUNCTION CODEMODBUS DEFINITIONCPU DEFINITION
HEXDEC
03 3 Read Holding RegistersRead Actual Values or Settings
04 4 Read Holding RegistersRead Actual Values or Settings
Master and Slave Device Packet Transmission Example
MASTER TRANSMISSION
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS 11
FUNCTION CODE 04
DATA STARTING ADDR - hi 40
DATA STARTING ADDR - lo 50
NUMBER OF REGISTERS - hi00
NUMBER OF REGISTERS - lo03
CRC - lo A7 DATA #2 - loA7
CRC - hi 4A DATA #3 - hi 4A
SLAVE RESPONSE
PACKET FORMAT EXAMPLE (HEX)
2
SLAVE ADDRESS11
FUNCTION CODE04
BYTE COUNT06
DATA #1 - hi00
DATA #1 - lo28
DATA #2 - hi01
DATA #2 - lo2C
DATA #3 - hi00
DATA #3 - lo00
CRC - lo0D
CRC - hi60
Supported function codes31
Page 32
2
2.5.2 Function Code 05H – Execute Operation
This function code allows the master to perform various operations in the CPU.
The following table shows the format of the master and slave packets. The example shows a
master device requesting the slave device 11H (17 dec) to perform a reset. The hi and lo CODE
VALUE bytes always have the values ‘FF’ and ‘00’ respectively and are a remnant of the original
Modbus definition of this function code.
Master and Slave Device Packet Transmission Example
MASTER TRANSMISSION
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE05
OPERATION CODE - hi00
OPERATION CODE - lo01
CODE VALUE - hiFF
CODE VALUE - lo00
CRC - loDF
CRC - hi6A
SLAVE RESPONSE
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE05
OPERATION CODE - hi00
OPERATION CODE - lo01
CODE VALUE - hiFF
CODE VALUE - lo00
CRC - loDF
CRC - hi6A
Modbus® protocol implementation32
Page 33
2.5.3 Function Code 06H – Store Single Setting
This function code allows the master to modify the contents of a single setting register in a CPU.
Setting registers are always 16-bit (two byte) values transmitted high-order byte first. The
following table shows the format of the master and slave packets. The example shows a master
device storing the value 200 at memory map address 4051h to slave device 11h (17 dec).
Master and Slave Device Packet Transmission Example
MASTER TRANSMISSION
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE06
DATA STARTING ADDR - hi40
DATA STARTING ADDR - lo51
DATA - hi00
DATA - loC8
2
CRC - loCE
CRC - hiDD
SLAVE RESPONSE
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE06
DATA STARTING ADDR - hi40
DATA STARTING ADDR - lo51
DATA - hi00
DATA - loC8
CRC - loCE
CRC - hiDD
Supported function codes33
Page 34
2
2.5.4 Function Code 10H – Store Multiple Settings
This function code allows the master to modify the contents of a one or more consecutive
setting registers in a CPU. Setting registers are 16-bit (two byte) values transmitted high-order
byte first. The maximum number of setting registers that can be stored in a single packet is 60.
The following table shows the format of the master and slave packets. The example shows a
master device storing the value 200 at memory map address 4051h, and the value 1 at memory
map address 4052h to slave device 11h (17 dec).
Master and Slave Device Packet Transmission Example
MASTER TRANSMISSION
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE10
DATA STARTING ADDR-hi40
DATA STARTING ADDR-lo51
NUMBER OF SETTINGS-hi00
NUMBER OF SETTINGS-lo02
BYTE COUNT04
DATA #1 - hi00
DATA #1 - loC8
DATA #2 - hi00
DATA #2 - lo01
CRC – lo12
CRC – hi62
Modbus® protocol implementation34
Page 35
SLAVE RESPONSE
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE10
DATA STARTING ADDR - hi40
DATA STARTING ADDR - lo51
NUMBER OF SETTINGS - hi00
NUMBER OF SETTINGS - lo02
CRC - lo07
CRC - hi64
2.5.5 Exception responses
Programming or operation errors usually happen because of illegal data in a packet. These
errors result in an exception response from the slave. The slave detecting one of these errors
sends a response packet to the master with the high order bit of the function code set to 1. The
following table shows the format of the master and slave packets. The example shows a master
device sending the unsupported function code 39h to slave device 11.
2
Master and Slave Device Packet Transmission Example
MASTER TRANSMISSION
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODE39
CRC - low order byteCD
CRC - high order byteF2
SLAVE RESPONSE
PACKET FORMATEXAMPLE (HEX)
SLAVE ADDRESS11
FUNCTION CODEB9
ERROR CODE01
Supported function codes35
Page 36
2
SLAVE RESPONSE
CRC - low order byte93
CRC - high order byte95
2.5.6 File transfers
2.5.6.1 Obtaining CPU files using Modbus protocol
The CPU has a generic file transfer facility, meaning that you use the same method to obtain all
of the different types of files from the unit. The Modbus registers that implement file transfer are
found in the “Modbus File Transfer (Read/Write)” and “Modbus File Transfer (Read Only)”
modules, starting at address 030Eh in the Modbus Memory Map. To read a file from the CPU, use
the following steps:
1. Write the filename to the “Name of file to read” register using a write multiple registers
command. If the name is shorter than 80 characters, you may write only enough registers to
include all the text of the filename. Filenames are not case sensitive.
2. Repeatedly read all the registers in “Modbus File Transfer (Read Only)” using a read multiple
registers command. It is not necessary to read the entire data block, since the CPU will
remember which was the last register read. The “position” register is initially zero and
thereafter indicates how many bytes (2 times the number of registers) you have read so far.
The “size of...” register indicates the number of bytes of data remaining to read, to a
maximum of 244.
3. Keep reading until the “size of...” register is smaller than the number of bytes you are
transferring. This condition indicates end of file. Discard any bytes you have read beyond the
indicated block size.
4. If you need to re-try a block, read only the “size of...” and “block of data”, without reading the
position. The file pointer is only incremented when you read the position register, so the
same data block will be returned as was read in the previous operation. On the next read,
check to see if the position is where you expect it to be, and discard the previous block if it is
not (this condition would indicate that the CPU did not process your original read request).
The CPU retains connection-specific file transfer information, so files may be read
simultaneously on multiple Modbus connections.
a. Obtaining files from the CPU using other protocols
All the files available via Modbus may also be retrieved using the standard file transfer
mechanisms in other protocols (for example, TFTP).
b. Reading event recorder files
To read the entire event recorder contents in ASCII format (the only available format), use
the following filename:
•EVT.TXT
c. Reading fault report files
The file name for fault report data is faultReport#####.txt. The ##### refers to the
fault report record number. This number is identical to the event record number
associated with the fault report . A request for a non-existent fault report file will yield file
with no data below the header.
Modbus® protocol implementation36
Page 37
d. Reading waveform capture files
Waveform records comply with COMTRADE 1999 format (IEEE Std C37.111-1999). The file
names as required by the standard for waveform capture data are wfc#####.dat and
wfc#####.cfg. The ##### refers to the waveform record number. Note that this number
is not the same as the event number cited in the case of the fault report above. If an
event has a waveform capture associated with it, the waveform number will be shown in
the WF Number field as indicated in the header of the event log.
2.5.7 Modbus password operation
The COMMAND password is set up at memory location 0458h. Storing a value of “0” removes
COMMAND password protection. When reading the password setting, the encrypted value (zero
if no password is set) is returned. COMMAND security is required to change the COMMAND
password.
Similarly, the SETTING password is set up at memory location 045Ah. To gain COMMAND level
security access, the COMMAND password must be entered at memory location 045Ch. To gain
SETTING level security access, the SETTING password must be entered at memory location
045Eh. The entered SETTING password must match the current SETTING password setting, or
must be zero, to change settings or download firmware.
COMMAND and SETTING passwords each have a 30-minute timer. Each timer starts when you
enter the particular password, and is restarted whenever you “use” it. For example, writing a
setting restarts the SETTING password timer and writing a command register or forcing a coil
restarts the COMMAND password timer. The value read at memory location 0460h can be used
to confirm whether a COMMAND password is enabled or disabled (0 for Disabled). The value
read at memory location 0461h can be used to confirm whether a SETTING password is enabled
or disabled.
2
COMMAND or SETTING password security access is restricted to the particular port or particular
TCP/IP connection on which the entry was made. Passwords must be entered when accessing
the relay through other ports or connections, and the passwords must be reentered after
disconnecting and reconnecting on TCP/IP.
Supported function codes37
Page 38
2
2.6 Interfacing to the Alarm Handler
The set of registers beginning at 0648h provides the means to interface to each CPU’s Alarm
Handler functionality. Each pair of 32-bit values represent the current state (read only) and the
acknowledge setting (read/write) for each alarm type. Each value represents the states for all of
the circuit breakers in the system as denoted in Format Code F722, one bit for each. A 1 in the
bit field position for a given circuit breaker in the state register indicates that the alarm
condition is currently active, while a 0 indicates the condition is not currently active.
When a condition passes from inactive to active, the corresponding ACK bit in the next register
will be set to 1. At this point an external program may acknowledge the alarm by writing a 0 to
that bit location. It is important for the external program to first read the ACK register and mask
the new value such that the states represented by the other bits remain intact. The following
state table describes how the HMI interfaces with the CPU to update its indicators.
Figure 2-3 Alarm state transition diagram
Start
System Initialization
ACK: 0
Status: 0
HMI Color:
Green
HMI
ACK
Alarm Condition
Condition
Goes Normal
Occurs
HMI
ACK
ACK: 0
Status: 1
HMI Color:
Solid
Red
ACK: 1
Status: 0
HMI Color:
Yellow
ACK: 1
Status: 1
HMI Color:
Blinking
Red
Condition
Goes Normal
Condition
Recurs
Alarm State Transition Diagram
Modbus® protocol implementation38
Page 39
3Modbus Memory Map
NOTE:A multiplier factor may be necessary in cases where an integer value is returned but the
Range and/or Step imply a greater precision. In these cases, it is necessary to divide the
returned value by 10 for a step of “0.1” or “0.5”; by 100 for a step of “.01”; and so on. Similarly, it is
necessary to multiply by these factors prior to writing a settings value. This note does not apply
to any step value greater than 1 (a step of “10” does not require a multiplier, for example). This
note also does not apply to values returned in floating point format. See the format codes at the
end of the map for more information.
NOTE:Discrete I/O output state registers (Contact Output x State - register range from x9180
to x91FF and Contact Output States - register range from xB256 to 0xB25D) contain correct
information only when FlexLogic Active register (x0034) contains value 1 (yes).
Addr Register Name Range Units Step For-
mat
Product Information (Read Only)
0000FBW Product Type0 to 2---1F7160 (Low Voltage
0001Serial Number---------F203“0”
Factory Default
Switchgear)
3
0009External Ethernet MAC Address---------F0720
000CReserved (3 items)---------F0010
000FCPU Hardware Version0 to 655.35---0.01F001100
0010CPU Firmware Version0 to 655.35---0.01F001100
0011CPU Firmware Boot Code Version0 to 655.35---0.01F001100
0012Build Date---------F200“0”
0026Synchronizer Board Status0 to 1---1F1020 (Disabled)
0027Synchronizer Board Frequency Setting50 to 60Hz10F00160
0028Last Energy Clear Date0 to 4294967295---1F0500
002ALast CPU Commissioned Date0 to 4294967295---1F0500
002CExpected Node Protocol Version0 to 655.35---0.01F0010
002DSummary Number---------F205“0”
0033Line Up0 to 99---1F0011
0034System Frequency Detected0 to 65535Hz1F0010
0035CPU Modbus Map Version0 to 655.35---0.01F001450
39
Page 40
0036Reserved---------F0010
Installation (Read/Write Setting)
0080CPU ID0 to 1---1F7170 (CCPU A)
3
0081CPU Commissioned0 to 1---1F1020 (Disabled)
0082CPU Name---------F200“UNNAMED”
0096System Frequency50 to 60Hz10F00160
0097Phase Rotation0 to 1---1F1060 (ABC)
Clock (Read/Write Setting)
00E0RTC Set Time0 to 4294967295---1F0500
Clock (Read Only)
00E2Date Time Changed0 to 4294967295---1F0500
Communications (Read/Write Setting)
00ECExternal Ethernet IP Address0 to 4294967295---1F0033232235876
00EEExternal Ethernet IP Subnet Mask0 to 4294963200---1F0034294967040
00F0External Ethernet Gateway IP Address0 to 4294967295---1F0030
00F2Reserved (5 items)---------F0010
Event Recorder (Read Only)
0150Events Since Last Clear0 to 4294967295---1F0030
0152Number of Available Events0 to 4294967295---1F0030
0154Event Recorder Last Cleared Date0 to 4294967295---1F0500
Modbus File Transfer (Read/Write)
0156Name of file to read---------F204(none)
Modbus File Transfer (Read Only)
017ECharacter position of current block within
file
0180Size of currently-available data block0 to 65535---1F0010
0181Block of data from requested file (122 items)0 to 65535---1F0010
Modbus File Transfer Area 2 (Read/Write)
01FBName of file to read---------F204(none)
Modbus File Transfer Area 2 (Read Only)
0223Character position of current block within
file
0225Size of currently-available data block0 to 65535---1F0010
0 to 4294967295---1F0030
0 to 4294967295---1F0030
Modbus Memory Map40
Page 41
0226Block of data from requested file (122 items)0 to 65535---1F0010
Passwords (Read/Write)
02A0Reserved (4 items)---------F0010
02A4Command Password Entry0 to 4294967295---1F0030
02A6Setting Password Entry0 to 4294967295---1F0030
Passwords (Read Only)
02A8Command Password Status0 to 1---1F1020 (Disabled)
02A9Setting Password Status0 to 1---1F1020 (Disabled)
02AAReserved (128 items)---------F0010
Zone Manager (Read Only)
032ACurrent Topology State0 to 255---1F0010
032BCurrent Zone1 Topology0 to 255---1F0011
032CCurrent Zone2 Topology0 to 255---1F0011
032DCurrent Zone3 Topology0 to 255---1F0011
032ECurrent Zone4 Topology0 to 255---1F0011
3
032FCurrent Zone1 Topology PT Throwover0 to 255---1F0011
0330Current Zone2 Topology PT Throwover0 to 255---1F0011
0331Current Zone3 Topology PT Throwover0 to 255---1F0011
0332Current Zone4 Topology PT Throwover0 to 255---1F0011
Zone Manager (Read/Write Command)
0333Multipoint Relay Reduced Let Thru Enable0 to 1---1F1260 (No)
0334Multipoint Relay Reduced Let Thru Reset0 to 1---1F1260 (No)
Zone Manager (Read Only)
0335Multipoint Relay Reduced Let Thru State0 to 1---1F1080 (Off)
Zone Manager (Read/Write Setting)
0336Multipoint Reduced Let Thru FlexLogic Trig-
ger
Zone Manager (Read Only)
0337Multipoint Reduced Let Thru Enable Count0 to 65535---1F0010
0 to 65535---1F3000
Event Recorder Commands (Read/Write Command)
0346Event Recorder Clear Command0 to 1---1F1260 (No)
Energy Commands (Read/Write Command)
41
Page 42
3
0347Energy Clear Command0 to 1---1F1260 (No)
Fault And Event Test Trigger (Read/Write Command)
0348Fault Trigger Command0 to 1---1F1260 (No)
Demand (Read/Write Setting)
0349Demand Subinterval Length1 to 60---1F0011
034ADemand Subintervals Per Interval1 to 15---1F0011
Demand (Read/Write Command)
034BDemand Reset All Command 0 to 1---1F1260 (No)
Demand (Read Only)
034CNumber Of Demand Resets All 0 to 4294963200---1F0030
034ELast Demand Reset All DateTime 0 to 4294967295---1F0500
Demand (Read/Write Command)
0350Demand Log Clear All Command0 to 1---1F1260 (No)
Demand (Read Only)
0351Demand Log Last Cleared All Date0 to 4294967295---1F0500
Waveform Capture (Read Only)
035DNumber WF Records Available0 to 65535---1F0010
Waveform Capture (Read/Write Command)
035EWaveform Clear Command0 to 1---1F1260 (No)
Waveform Capture (Read Only)
035FWaveform Last Clear Date0 to 4294967295---1F0500
Waveform Capture (Read/Write Command)
0361Waveform Trigger Command0 to 1---1F1260 (No)
Waveform Capture (Read/Write Setting)
0362Waveform Trigger Mode0 to 1---1F1180 (Automatic
Overwrite)
0363Waveform Trigger Position0 to 119Half
Cycles
Waveform Capture (Read Only)
1F00160
0364Waveforms Since Last Clear0 to 4294967295---1F0030
0366Reserved (2 items)---------F0010
Waveform Capture (Read/Write Setting)
Modbus Memory Map42
Page 43
0368Waveform Trigger Thru FlexLogic0 to 65535---1F3000
Preventive Maintenance (Read/Write Setting)
0370Load Life Rating 800A0 to 65535---1F0012800
0371Load Life Rating 1600A0 to 65535---1F0011200
0372Load Life Rating 2000A0 to 65535---1F0011000
0373Load Life Rating 3200A0 to 65535---1F001600
0374Load Life Rating 4000A0 to 65535---1F001500
0375Load Life Rating 5000A0 to 65535---1F001400
0376Mechanical Life Rating 800A0 to 65535---1F00112500
0377Mechanical Life Rating 1600A0 to 65535---1F0014000
0378Mechanical Life Rating 2000A0 to 65535---1F0014000
0379Mechanical Life Rating 3200A0 to 65535---1F0011500
037AMechanical Life Rating 4000A0 to 65535---1F0011500
037BMechanical Life Rating 5000A0 to 65535---1F0011500
037CLoad Life Max Current 800A1 to 50---1F00115
3
037DLoad Life Max Current 1600A1 to 50---1F00115
037ELoad Life Max Current 2000A1 to 50---1F00115
037FLoad Life Max Current 3200A1 to 50---1F00113
0380Load Life Max Current 4000A1 to 50---1F0019
0381Load Life Max Current 5000A1 to 50---1F0017
Hardware Information (Read Only)
03A0Flash Lifetime1 to 10---1F0011
Source Vectors (Read/Write Setting)
0408Reserved (2 items)---------F0010
040AExpected Nodes X State0 to 4294967295---1F7220
040CSource Node Identifier LED X State0 to 4294967295---1F7220
040ENode Setting Changed X State0 to 4294967295---1F7220
Source Vectors (Read Only)
0410Nodes Communicating X State0 to 4294967295---1F7220
0412Nodes Commissioned X State0 to 4294967295---1F7220
0414Duplicate Nodes X State0 to 4294967295---1F7220
0416Node Internal Diagnostics X State0 to 4294967295---1F7220
0418Node System Diagnostics X State0 to 4294967295---1F7220
43
Page 44
3
041ANode Hardware Diagnostics X State0 to 4294967295---1F7220
041CNode Reflected CPU Diagnostics X State0 to 4294967295---1F7220
041EBreaker Contact Position X State0 to 4294967295---1F7220
0420Breaker Primary Connection X State0 to 4294967295---1F7220
0422Breaker Lockout X State0 to 4294967295---1F7220
0424Summations Suspended X State0 to 4294967295---1F7220
0426Breaker Tripped X State0 to 4294967295---1F7220
Source Vectors (All Ack Vectors are Read/Write Setting; All State Vectors are Read Only)
0428Undervoltage Trip Alarm State0 to 4294967295---1F7220
042AUndervoltage Trip Alarm Ack0 to 4294967295---1F7220
042CUndervoltage Alarm State0 to 4294967295---1F7220
042EUndervoltage Alarm Ack0 to 4294967295---1F7220
0430Overvoltage Trip Alarm State0 to 4294967295---1F7220
0432Overvoltage Trip Alarm Ack0 to 4294967295---1F7220
0434Overvoltage Alarm State0 to 4294967295---1F7220
0436Overvoltage Alarm Ack0 to 4294967295---1F7220
0438Phase Loss Trip Alarm State0 to 4294967295---1F7220
043APhase Loss Trip Alarm Ack0 to 4294967295---1F7220
043CPhase Loss Alarm State0 to 4294967295---1F7220
043EPhase Loss Alarm Ack0 to 4294967295---1F7220
0440Reverse Power Trip Alarm State0 to 4294967295---1F7220
0442Reverse Power Trip Alarm Ack0 to 4294967295---1F7220
0444Reverse Power Alarm State0 to 4294967295---1F7220
0446Reverse Power Alarm Ack0 to 4294967295---1F7220
0448High Current Alarm State0 to 4294967295---1F7220
044AHigh Current Alarm Ack0 to 4294967295---1F7220
044CUnderfrequency Trip Alarm State0 to 4294967295---1F7220
044EUnderfrequency Trip Alarm Ack0 to 4294967295---1F7220
0450Underfrequency Alarm State0 to 4294967295---1F7220
0452Underfrequency Alarm Ack0 to 4294967295---1F7220
0454Overfrequency Trip Alarm State0 to 4294967295---1F7220
0456Overfrequency Trip Alarm Ack0 to 4294967295---1F7220
0458Overfrequency Alarm State0 to 4294967295---1F7220
Modbus Memory Map44
Page 45
045AOverfrequency Alarm Ack0 to 4294967295---1F7220
045CHigh Resistance Ground Fault Alarm State0 to 4294967295---1F7220
045EHigh Resistance Ground Fault Alarm Ack0 to 4294967295---1F7220
0460Breaker Open Failed Alarm State0 to 4294967295---1F7220
0462Breaker Open Failed Alarm Ack0 to 4294967295---1F7220
0464Long Time Overcurrent Trip Alarm State0 to 4294967295---1F7220
0466Long Time Overcurrent Trip Alarm Ack0 to 4294967295---1F7220
0468Short T ime Overcurrent Trip Alarm State0 to 4294967295---1F7220
046AShort Time Overcurrent Trip Alarm Ack0 to 4294967295---1F7220
046CGround Fault Trip Alarm State0 to 4294967295---1F7220
046EGround Fault Trip Alarm Ack0 to 4294967295---1F7220
0470Ground Fault Alarm State0 to 4294967295---1F7220
0472Ground Fault Alarm Ack0 to 4294967295---1F7220
0474Analog IOC Trip Alarm State0 to 4294967295---1F7220
0476Analog IOC Trip Alarm Ack0 to 4294967295---1F7220
3
0478IOC Trip Alarm State0 to 4294967295---1F7220
047AIOC Trip Alarm Ack0 to 4294967295---1F7220
047CNode Control Power Lost State0 to 4294967295---1F7220
047ENode Control Power Lost Ack0 to 4294967295---1F7220
0480Node Communication Lost State0 to 4294967295---1F7220
0482Node Communication Lost Ack0 to 4294967295---1F7220
0484Breaker Load Life 50 State0 to 4294967295---1F7220
0486Breaker Load Life 50 Ack0 to 4294967295---1F7220
0488Breaker Load Life 75 State0 to 4294967295---1F7220
048ABreaker Load Life 75 Ack0 to 4294967295---1F7220
048CBreaker Load Life 90 State0 to 4294967295---1F7220
048EBreaker Load Life 90 Ack0 to 4294967295---1F7220
0490Breaker Accum Service Alarm State0 to 4294967295---1F7220
0492Breaker Accum Service Alarm Ack0 to 4294967295---1F7220
0494Breaker Mechanical Life 12 5 State0 to 4294967295---1F7220
0496Breaker Mechanical Life 12 5 Ack0 to 4294967295---1F7220
0498Breaker Mechanical Life 25 State0 to 4294967295---1F7220
049ABreaker Mechanical Life 25 Ack0 to 4294967295---1F7220
45
Page 46
3
049CBreaker Mechanical Life 37 5 State0 to 4294967295---1F7220
049EBreaker Mechanical Life 37 5 Ack0 to 4294967295---1F7220
04A0Breaker Mechanical Life 50 State0 to 4294967295---1F7220
04A2Breaker Mechanical Life 50 Ack0 to 4294967295---1F7220
04A4Breaker Mechanical Life 62 5 State0 to 4294967295---1F7220
04A6Breaker Mechanical Life 62 5 Ack0 to 4294967295---1F7220
04A8Breaker Mechanical Life 75 State0 to 4294967295---1F7220
04AABreaker Mechanical Life 75 Ack0 to 4294967295---1F7220
04ACBreaker Mechanical Life 87 5 State0 to 4294967295---1F7220
04AEBreaker Mechanical Life 87 5 Ack0 to 4294967295---1F7220
04B0Breaker Mechanical Life 100 State0 to 4294967295---1F7220
04B2Breaker Mechanical Life 100 Ack0 to 4294967295---1F7220
04B4Bus Differential Trip Alarm State0 to 4294967295---1F7220
04B6Bus Differential Trip Alarm Ack0 to 4294967295---1F7220
04B8Bus Differential Alarm State0 to 4294967295---1F7220
04BABus Differential Alarm Ack0 to 4294967295---1F7220
04BCMulti Source Ground Fault Trip Alarm State0 to 4294967295---1F7220
04BEMulti Source Ground Fault Trip Alarm Ack0 to 4294967295---1F7220
04C0Multi Source Ground Fault Alarm State0 to 4294967295---1F7220
04C2Multi Source Ground Fault Alarm Ack0 to 4294967295---1F7220
04C4Hardware Synch Card Lost State0 to 4294967295---1F7220
04C6Hardware Synch Card Lost Ack0 to 4294967295---1F7220
04CACompartment ID Button Missing Alarm State0 to 4294967295---1F7220
04CECompartment ID Button Missing Alarm Ack0 to 4294967295---1F7220
04D0Control Alarm State0 to 4294967295---1F7220
04D2Control Alarm Ack0 to 4294967295---1F7220
04D4Redundant CPU Node Comm Loss State0 to 4294967295---1F7220
04D6Redundant CPU Node Comm Loss Ack0 to 4294967295---1F7220
04D8Redundant CPU Hardware Synch Loss State0 to 4294967295---1F7220
04DARedundant CPU Hardware Synch Loss Ack0 to 4294967295---1F7220
04DCDiscrete IO Misconfigured State0 to 4294967295---1F7220
04DEDiscrete IO Misconfigured Ack0 to 4294967295---1F7220
04E0Reserved (8 items)---------F0010
Modbus Memory Map46
Page 47
04E8HRGF Location Alarm State0 to 4294967295---1F7220
04EAHRGF Location Alarm Ack0 to 4294967295---1F7220
04ECReserved (28 items)---------F0010
0508SRC X Node Ground CT Connected0 to 4294967295---1F7220
050AHigh Current Trigger Alarm State0 to 4294967295---1F7220
050CHigh Current Trigger Alarm Ack0 to 4294967295---1F7220
050EReduced Let Thru Over 8 Hours Alarm State0 to 4294967295---1F7220
0510Reduced Let Thru Over 8 Hours Alarm Ack0 to 4294967295---1F7220
3
0512HRGF Location Contactor Operating Alarm
State
0514HRGF Location Contactor Operating Alarm
Ack
0516HRGF Location Trip Alarm State0 to 4294967295---1F7220
0518HRGF Location Trip Alarm Ack0 to 4294967295---1F7220
Voltage (Read Only) (30 modules)
0542Phase AG Voltage RMS0 to 999999.999V0.001F0600
0544Phase BG Voltage RMS0 to 999999.999V0.001F0600
0546Phase CG Voltage RMS0 to 999999.999V0.001F0600
0548Phase AB or AC Voltage RMS0 to 999999.999V0.001F0600
054APhase BC or BA Voltage RMS0 to 999999.999V0.001F0600
054CPhase CA or CB Voltage RMS0 to 999999.999V0.001F0600
054ESRC X Voltage Reserved (30 items)---------F0010
056C...Repeated for module number 2
0 to 4294967295---1F7220
0 to 4294967295---1F7220
0596...Repeated for module number 3
05C0...Repeated for module number 4
05EA...Repeated for module number 5
0614...Repeated for module number 6
063E...Repeated for module number 7
0668...Repeated for module number 8
0692...Repeated for module number 9
06BC...Repeated for module number 10
06E6...Repeated for module number 11
0710...Repeated for module number 12
47
Page 48
3
073A...Repeated for module number 13
0764...Repeated for module number 14
078E...Repeated for module number 15
07B8...Repeated for module number 16
0700...Repeated for module number 17
080C...Repeated for module number 18
0836...Repeated for module number 19
0860...Repeated for module number 20
088A...Repeated for module number 21
08B4...Repeated for module number 22
08DE...Repeated for module number 23
0908...Repeated for module number 24
0932...Repeated for module number 25
095C...Repeated for module number 26
0986...Repeated for module number 27
09B0...Repeated for module number 28
09DA...Repeated for module number 29
0A04...Repeated for module number 30
Current (Read Only) (30 modules)
0A2EPhase A Current RMS0 to 999999.999A0.001F0600
0A30Phase B Current RMS0 to 999999.999A0.001F0600
0A32Phase C Current RMS0 to 999999.999A0.001F0600
0A34Neutral Current RMS0 to 999999.999A0.001F0600
0A36Ground Current RMS0 to 999999.999A0.001F0600
0A38...Repeated for module number 2
0A42...Repeated for module number 3
0A4C...Repeated for module number 4
0A56...Repeated for module number 5
0A60...Repeated for module number 6
0A6A...Repeated for module number 7
0A74...Repeated for module number 8
0A7E...Repeated for module number 9
0A88...Repeated for module number 10
Modbus Memory Map48
Page 49
0A92...Repeated for module number 11
0A9C...Repeated for module number 12
0AA6...Repeated for module number 13
0AB0...Repeated for module number 14
0ABA...Repeated for module number 15
0AC4...Repeated for module number 16
0ACE...Repeated for module number 17
0AD8...Repeated for module number 18
0AE2...Repeated for module number 19
0AEC...Repeated for module number 20
0AF6...Repeated for module number 21
0B00...Repeated for module number 22
0B0A...Repeated for module number 23
0B14...Repeated for module number 24
0B1E...Repeated for module number 25
3
0B28...Repeated for module number 26
0B32...Repeated for module number 27
0B3C...Repeated for module number 28
0B46...Repeated for module number 29
0B50...Repeated for module number 30
Power (Read Only) (30 modules)
0EAEThree Phase Real Power-1000000000000 to
1000000000000
0EB0Phase A Real Power-1000000000000 to
1000000000000
0EB2Phase B Real Power-1000000000000 to
1000000000000
0EB4Phase C Real Power-1000000000000 to
1000000000000
0EB6Three Phase Reactive Power-1000000000000 to
1000000000000
W0.001F0600
W0.001F0600
W0.001F0600
W0.001F0600
var0.001F0600
0EB8Phase A Reactive Power-1000000000000 to
1000000000000
0EBAPhase B Reactive Power-1000000000000 to
1000000000000
var0.001F0600
var0.001F0600
49
Page 50
3
0EBCPhase C Reactive Power-1000000000000 to
1000000000000
var0.001F0600
0EBEThree Phase Apparent Power-1000000000000 to
1000000000000
0EC0Phase A Apparent Power-1000000000000 to
1000000000000
0EC2Phase B Apparent Power-1000000000000 to
1000000000000
0EC4Phase C Apparent Power-1000000000000 to
1000000000000
0EC6Three Phase Power Factor-0.999 to 1---0.001F0130
0EC7Phase A Power Factor-0.999 to 1---0.001F0130
0EC8Phase B Power Factor-0.999 to 1---0.001F0130
0EC9Phase C Power Factor-0.999 to 1---0.001F0130
0ECASRC X Power Reserved (10 items)---------F0010
0ED4...Repeated for module number 2
0EFA...Repeated for module number 3
0F20...Repeated for module number 4
VA0.001F0600
VA0.001F0600
VA0.001F0600
VA0.001F0600
0F46...Repeated for module number 5
0F6C...Repeated for module number 6
0F92...Repeated for module number 7
0FB8...Repeated for module number 8
0FDE...Repeated for module number 9
1004...Repeated for module number 10
102A...Repeated for module number 11
1050...Repeated for module number 12
1076...Repeated for module number 13
109C...Repeated for module number 14
10C2...Repeated for module number 15
10E8...Repeated for module number 16
110E...Repeated for module number 17
1134...Repeated for module number 18
115A...Repeated for module number 19
1180...Repeated for module number 20
Modbus Memory Map50
Page 51
11A6...Repeated for module number 21
11CC...Repeated for module number 22
11F2...Repeated for module number 23
1218...Repeated for module number 24
123E...Repeated for module number 25
1264...Repeated for module number 26
128A...Repeated for module number 27
12B0...Repeated for module number 28
12D6...Repeated for module number 29
12FC...Repeated for module number 30
Energy (Read Only Non-Volatile) (30 modules)
3
1322Positive Watthour0 to
1000000000000
1324Phase A Positive Watthour0 to
1000000000000
1326Phase B Positive Watthour0 to
1000000000000
1328Phase C Positive Watthour0 to
1000000000000
132ANegative Watthour0 to
1000000000000
132CPhase A Negative Watthour0 to
1000000000000
132EPhase B Negative Watthour0 to
1000000000000
1330Phase C Negative Watthour0 to
1000000000000
1332Positive Varhour0 to
1000000000000
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
Wh0.001F0600
varh0.001F0600
1334Phase A Positive Varhour0 to
1000000000000
1336Phase B Positive Varhour0 to
1000000000000
1338Phase C Positive Varhour0 to
1000000000000
varh0.001F0600
varh0.001F0600
varh0.001F0600
51
Page 52
3
133ANegative Varhour0 to
1000000000000
varh0.001F0600
133CPhase A Negative Varhour0 to
1000000000000
133EPhase B Negative Varhour0 to
1000000000000
1340Phase C Negative Varhour0 to
1000000000000
1342Vahour0 to
1000000000000
1344Phase A Vahour0 to
1000000000000
1346Phase B Vahour0 to
1000000000000
1348Phase C Vahour0 to
1000000000000
134ASRC X Energy Reserved (10 items)---------F0010
1354...Repeated for module number 2
varh0.001F0600
varh0.001F0600
varh0.001F0600
vah0.001F0600
vah0.001F0600
vah0.001F0600
vah0.001F0600
1386...Repeated for module number 3
13B8...Repeated for module number 4
13EA...Repeated for module number 5
141C...Repeated for module number 6
144E...Repeated for module number 7
1480...Repeated for module number 8
14B2...Repeated for module number 9
14E4...Repeated for module number 10
1516...Repeated for module number 11
1548...Repeated for module number 12
157A...Repeated for module number 13
15AC...Repeated for module number 14
15DE...Repeated for module number 15
1610...Repeated for module number 16
1642...Repeated for module number 17
1674...Repeated for module number 18
16A6...Repeated for module number 19
Modbus Memory Map52
Page 53
16D8...Repeated for module number 20
170A...Repeated for module number 21
173C...Repeated for module number 22
176E...Repeated for module number 23
17A0...Repeated for module number 24
17D2...Repeated for module number 25
1804...Repeated for module number 26
1836...Repeated for module number 27
1868...Repeated for module number 28
189A...Repeated for module number 29
18CC...Repeated for module number 30
Source Harmonic Analysis (Read Only) (30 modules)
18FESRC X Phase A Voltage THD0 to 1---0.001F0010
18FFSRC X Phase B Voltage THD0 to 1---0.001F0010
1900SRC X Phase C Voltage THD0 to 1---0.001F0010
3
1901SRC X Phase A Current THD0 to 1---0.001F0010
1902SRC X Phase B Current THD0 to 1---0.001F0010
1903SRC X Phase C Current THD0 to 1---0.001F0010
1904SRC X Phase N Current THD0 to 1---0.001F0010
1905SRC X Phase A K Factor0 to 6553.5---0.1F00110
1906SRC X Phase B K Factor0 to 6553.5---0.1F00110
1907SRC X Phase C K Factor0 to 6553.5---0.1F00110
1908SRC X Phase N K Factor0 to 6553.5---0.1F00110
1909SRC X Harmonic Analysis Reserved (10
items)
1913...Repeated for module number 2
1928...Repeated for module number 3
193D...Repeated for module number 4
1952...Repeated for module number 5
1967...Repeated for module number 6
---------F0010
197C...Repeated for module number 7
1991...Repeated for module number 8
19A6...Repeated for module number 9
53
Page 54
3
19BB...Repeated for module number 10
19D0...Repeated for module number 11
19E5...Repeated for module number 12
19FA...Repeated for module number 13
1A0F...Repeated for module number 14
1A24...Repeated for module number 15
1A39...Repeated for module number 16
1A4E...Repeated for module number 17
1A63...Repeated for module number 18
1A78...Repeated for module number 19
1A8D...Repeated for module number 20
1AA2...Repeated for module number 21
1AB7...Repeated for module number 22
1ACC...Repeated for module number 23
1AE1...Repeated for module number 24
1AF6...Repeated for module number 25
1B0B...Repeated for module number 26
1B20...Repeated for module number 27
1B35...Repeated for module number 28
1B4A...Repeated for module number 29
1B5F...Repeated for module number 30
Source Demand Peaks (Read Only Non-Volatile) (30 modules)
1B74SRC X Maximum kW -1000000000000 to
1000000000000
1B76SRC X Maximum kW DateT ime 0 to 4294967295---1F0500
1B78SRC X Maximum kvar -1000000000000 to
1000000000000
1B7ASRC X Maximum kvar DateTime 0 to 4294967295---1F0500
1B7CSRC X Maximum kVA -1000000000000 to
1000000000000
W0.001F0600
var0.001F0600
VA0.001F0600
1B7ESRC X Maximum kVA DateTime 0 to 4294967295---1F0500
1B80SRC X Demand Peaks Reserved (8 items)---------F0010
1B88...Repeated for module number 2
1B9C...Repeated for module number 3
Modbus Memory Map54
Page 55
1BB0...Repeated for module number 4
1BC4...Repeated for module number 5
1BD8...Repeated for module number 6
1BEC...Repeated for module number 7
1C00...Repeated for module number 8
1C14...Repeated for module number 9
1C28...Repeated for module number 10
1C3C...Repeated for module number 11
1C50...Repeated for module number 12
1C64...Repeated for module number 13
1C78...Repeated for module number 14
1C8C...Repeated for module number 15
1CA0...Repeated for module number 16
1CB4...Repeated for module number 17
1CC8...Repeated for module number 18
3
1CDC...Repeated for module number 19
1CF0...Repeated for module number 20
1D04...Repeated for module number 21
1D18...Repeated for module number 22
1D2C...Repeated for module number 23
1D40...Repeated for module number 24
1D54...Repeated for module number 25
1D68...Repeated for module number 26
1D7C...Repeated for module number 27
1D90...Repeated for module number 28
1DA4...Repeated for module number 29
1DB8...Repeated for module number 30
Power Peaks (Read Only Non-Volatile) (30 modules)
1DCCSRC X Three Phase Power Factor Min-0.999 to 1---0.001F0130
1DCDSRC X Three Phase Power Factor Min Date0 to 4294967295---1F0500
1DCFSRC X Phase A Power Factor Min-0.999 to 1---0.001F0130
1DD0SRC X Phase A Power Factor Min Date0 to 4294967295---1F0500
1DD2SRC X Phase B Power Factor Min-0.999 to 1---0.001F0130
55
Page 56
3
1DD3SRC X Phase B Power Factor Min Date0 to 4294967295---1F0500
1DD5SRC X Phase C Power Factor Min-0.999 to 1---0.001F0130
1DD6SRC X Phase C Power Factor Min Date0 to 4294967295---1F0500
1DD8SRC X Three Phase Power Factor Max-0.999 to 1---0.001F0130
1DD9SRC X Three Phase Power Factor Max Date0 to 4294967295---1F0500
1DDBSRC X Phase A Power Factor Max-0.999 to 1---0.001F0130
1DDCSRC X Phase A Power Factor Max Date0 to 4294967295---1F0500
1DDESRC X Phase B Power Factor Max-0.999 to 1---0.001F0130
1DDFSRC X Phase B Power Factor Max Date0 to 4294967295---1F0500
1DE1SRC X Phase C Power Factor Max-0.999 to 1---0.001F0130
1DE2SRC X Phase C Power Factor Max Date0 to 4294967295---1F0500
1DE4SRC X Last Clear Energy Date0 to 4294967295---1F0500
1DE6SRC X Last Commissioned Date0 to 4294967295---1F0500
1DE8SRC X Power Peaks Reserved (47 items)---------F0010
1E17...Repeated for module number 2
1E62...Repeated for module number 3
1EAD...Repeated for module number 4
1EF8...Repeated for module number 5
1F43...Repeated for module number 6
1F8E...Repeated for module number 7
1FD9...Repeated for module number 8
2024...Repeated for module number 9
206F...Repeated for module number 10
20BA...Repeated for module number 11
2105...Repeated for module number 12
2150...Repeated for module number 13
219B...Repeated for module number 14
21E6...Repeated for module number 15
2231...Repeated for module number 16
227C...Repeated for module number 17
22C7...Repeated for module number 18
2312...Repeated for module number 19
235D...Repeated for module number 20
Modbus Memory Map56
Page 57
23A8...Repeated for module number 21
23F3...Repeated for module number 22
243E...Repeated for module number 23
2489...Repeated for module number 24
24D4...Repeated for module number 25
251F...Repeated for module number 26
256A...Repeated for module number 27
25B5...Repeated for module number 28
2600...Repeated for module number 29
264B...Repeated for module number 30
Setting Enable (Read/Write Setting)
2696GF Tripping Priority Enable0 to 1---1F1020 (Disabled)
2697Reserved (4 items)---------F0010
Source Demand (Read Only) (30 modules)
3
26A2SRC X Previous Internal kW-1000000000000 to
1000000000000
26A4SRC X Previous Interval kvar -1000000000000 to
1000000000000
26A6SRC X Previous Interval kVA -1000000000000 to
1000000000000
Source Demand (Read Only Non-Volatile) (30 modules)
26A8SRC X Last Reset DateT ime0 to 4294967295---1F0500
26AASRC X Number Of Demand Resets 0 to 4294967295---1F0030
Source Demand (Read/Write Command) (30 modules)
26ACSRC X Demand Reset 0 to 1---1F1260 (No)
26ADSRC X Demand Log Clear Command0 to 1---1F1260 (No)
Source Demand (Read Only Non-Volatile) (30 modules)
26AESRC X Demand Log Last Cleared Date0 to 4294967295---1F0500
Source Demand (Read Only) (30 modules)
W0.001F0600
var0.001F0600
VA0.001F0600
26B0SRC X Demand Log Records Since Last Clear0 to 4294967295---1F0030
26B2SRC X Demand Log Interval Records Avail-
able
26B4SRC X Demand Reserved (20 items)---------F0010
0 to 4294967295---1F0030
57
Page 58
3
26C8...Repeated for module number 2
26EE...Repeated for module number 3
2714...Repeated for module number 4
273A...Repeated for module number 5
2760...Repeated for module number 6
2786...Repeated for module number 7
27AC...Repeated for module number 8
27D2...Repeated for module number 9
27F8...Repeated for module number 10
281E...Repeated for module number 11
2844...Repeated for module number 12
286A...Repeated for module number 13
2890...Repeated for module number 14
28B6...Repeated for module number 15
28DC...Repeated for module number 16
2902...Repeated for module number 17
2928...Repeated for module number 18
294E...Repeated for module number 19
2974...Repeated for module number 20
299A...Repeated for module number 21
29C0...Repeated for module number 22
29E6...Repeated for module number 23
2A0C...Repeated for module number 24
2A32...Repeated for module number 25
2A58...Repeated for module number 26
2A7E...Repeated for module number 27
2AA4...Repeated for module number 28
2ACA...Repeated for module number 29
2AF0...Repeated for module number 30
Source Status (Read Only) (30 modules)
2B16SRC X Node ID0 to 29---1F0010
2B17Reserved (3 items)---------F0010
2B1ASRC X Frame Rating0 to 65535---1F0010
Modbus Memory Map58
Page 59
2B1BSRC X CT Rating0 to 65535---1F0010
2B1CSRC X Breaker Type0 to 1---1F7150 (UL)
2B1DSRC X NodeProt Protection Config0 to 65535---1F7050
2B1ESRC X Node Firmware Version0 to 655.35---0.01F0010
2B1FSRC X Hardware Version0 to 255---1F0010
2B20SRC X Message Protocol Version0 to 655.35---0.01F0010
2B21SRC X Product Type0 to 2---1F7160 (Low Voltage
Switchgear)
2B22SRC X NodeProt Rating Switch0 to 65535---1F0010
2B23SRC X NodeProt LT Setting0 to 655.35---0.01F0010
2B24SRC X NodeProt IOC Threshold Setting0 to 655.35---0.01F0010
2B25SRC X NodeProt Ground Fault Setting0 to 1---1F0010
2B26SRC X NodeProt Short T ime Setting0 to 1---1F0010
2B27SRC X Node Internal Diagnostics0 to 65535---1F7010
2B28SRC X Node System Diagnostics 10 to 65535---1F7020
3
2B29SRC X Node System Diagnostics 20 to 65535---1F7030
2B2ASRC X Node Hardware Diagnostics0 to 65535---1F7040
2B2BSRC X Node Physical Status0 to 65535---1F7080
2B2CSRC X Node Logic and Trip Status0 to 65535---1F7090
2B2DSRC X Node Last Trip Sequence Number0 to 4294967295---1F0030
2B2FSRC X Reflected CPU Diagnostics0 to 65535---1F7060
2B30SRC X Reflected CPU 0 Command0 to 65535---1F7070
2B31SRC X Reflected CPU 1 Command0 to 65535---1F7070
2B32SRC X Fan Status0 to 1---1F1080 (Off)
2B33SRC X CT Rating Node Report0 to 65535---1F0010
2B34SRC X Node Serial Number---------F205(none)
2B3ASRC X Phase A Frequency0 to 655.35Hz0.01F0010
2B3BSRC X Phase B Frequency0 to 655.35Hz0.01F0010
2B3CSRC X Phase C Frequency0 to 655.35Hz0.01F0010
2B3DSRC X Topology0 to 15---1F0011
2B3EReserved (2 items)---------F0010
2B40SRC X Node Status Reserved (38 items)---------F0010
2B66...Repeated for module number 2
59
Page 60
3
2BB6...Repeated for module number 3
2C06...Repeated for module number 4
2C56...Repeated for module number 5
2CA6...Repeated for module number 6
2CF6...Repeated for module number 7
2D46...Repeated for module number 8
2D96...Repeated for module number 9
2DE6...Repeated for module number 10
2E36...Repeated for module number 11
2E86...Repeated for module number 12
2ED6...Repeated for module number 13
2F26...Repeated for module number 14
2F76...Repeated for module number 15
2FC6...Repeated for module number 16
3016...Repeated for module number 17
3066...Repeated for module number 18
30B6...Repeated for module number 19
3106...Repeated for module number 20
3156...Repeated for module number 21
31A6...Repeated for module number 22
31F6...Repeated for module number 23
3246...Repeated for module number 24
3296...Repeated for module number 25
32E6...Repeated for module number 26
3336...Repeated for module number 27
3386...Repeated for module number 28
33D6...Repeated for module number 29
3426...Repeated for module number 30
Source Counters (Read/Write Setting) (30 modules)
3476Reserved (840 items)---------F0010
Source Settings (Read/Write Setting) (30 modules)
37BESRC X Node Commissioned0 to 1---1F1020 (Disabled)
Source Settings (Read Only) (30 modules)
Modbus Memory Map60
Page 61
37BFSRC X PT Source Node Identifier0 to 29---1F0010
Source Settings (Read/Write Setting) (30 modules)
37C0SRC X Breaker Connection0 to 1---1F7120 (Forward)