PowerWizard 2.0/3.

0 Modbus Applications Guide

Contents
SCADA Data Link ................................................................................................................................................................................................... 4 Introduction............................................................................................................................................................................................................ 4 Hardware installation .............................................................................................................................................................................................. 4 Installation requirements........................................................................................................................................................................................ 4 Control panel configuration ........................................................................................................................................................................... 5 Control panel configuration ........................................................................................................................................................................... 6 Data Link Layer ....................................................................................................................................................................................................... 8 Data Structure ........................................................................................................................................................................................................ 8 Supported Function Codes ..................................................................................................................................................................................... 9 Error Checking..................................................................................................................................................................................................... 18 Exception Responses............................................................................................................................................................................................ 20 Fault Identifiers (FID) .......................................................................................................................................................................................... 22 Reduced Power Mode .......................................................................................................................................................................................... 23 SCADA Data Link Security .................................................................................................................................................................................. 24 Event System .......................................................................................................................................................................................................... 26 Event Breakdown ................................................................................................................................................................................................. 28 Setpoints.................................................................................................................................................................................................................. 29 Setpoint Data Type............................................................................................................................................................................................... 31

Appendices
Appendix A The ASCII character set ............................................................................................................................................................... 32 Appendix B Read register walkthrough ........................................................................................................................................................... 33 Appendix C Write single register walkthrough ............................................................................................................................................... 37 Appendix D Write multiple register walkthrough........................................................................................................................................... 38 Appendix E Security system walkthrough........................................................................................................................................................ 43 Appendix F SPN/FMI combinations list ........................................................................................................................................................... 55 Appendix G Event system walkthrough ........................................................................................................................................................... 58 Appendix H Setpoint system walkthrough ....................................................................................................................................................... 70 Appendix I Setpoints List ................................................................................................................................................................................... 76 Appendix J Setpoint Values list ......................................................................................................................................................................... 87

SCADA Data Link

Introduction
The PowerWizard 2.0 and PowerWizard 3.0 have a Supervisory Control and Data Acquisition (SCADA) communications link, allowing communication between the controller and a host device using the Modbus protocol. The host device is able to remotely monitor or control any genset package equipped with the PowerWizard 2.0 or 3.0 control panels in much the same way an operator may from the panel. The host device connects to the PowerWizard using a half-duplex RS-485 serial link. The data is transmitted in a binary format over the serial connection. The host device acts as Modbus Master, and the PowerWizard electronic controller acts as the Modbus Slave, also called a Remote Terminal Unit (RTU). The host device initiates all communication, sending commands or requests for information to the PowerWizard. The PowerWizard then takes action based on the query and/or sends a response to the query over Modbus.

Hardware installation
The modbus network should be configured as per Fig 1. Installation requirements are outlined below.

Installation requirements
Note 1 Note 2 0.2 mm2 (AWG 24), balanced, screened pair cable with characteristic impedance of 120 Ohm should be used to construct the network Both ends of the network should be terminated using a 120-Ohm, 350 mW or greater resistor Multiple nodes may be connected, in a daisy chain formation, on the same modbus network N.B. Note 4 Note 5 Each node requires a unique node address

Note 3

Only one modbus master may be connected to a modbus network The modbus reference should be connected to ground at one point

Control panel configuration

Each control panel connected to the network needs to be configured. To access the control panels SCADA configuration: Main Menu Configure Setpoints Network Data Link - SCADA The recommended setup is detailed below. Node address Each slave node requires an individual address on the network. Node addresses can be in the range of 1-247. DO NOT USE THE SAME ADDRESS MORE THAN ONCE ON THE SAME NETWORK Baud rate The recommended baud rate is 19,200 bps. All control panels on the network must be configured with the same baud rate. Parity Parity can be either none, odd or even. Bias resistors Bias resistors are provided for use where a polarized line is required. They should normally be disabled. If trouble is experienced establishing communication it may be necessary to enable the bias resistors on one of the control panels. N.B. the network must only ever be biased at one point on the network.

Connect Timeout Interval The connect timeout interval is the amount of time the PowerWizard will continue to attempt to send a reply over the RS-485 network before giving up, the default value is 30 seconds. In addition to these setpoints, SCADA access can be restricted by means of assigning a SCADA password.

Data Link Layer

Data Structure
Modbus registers are 2 bytes long. A register is the smallest block that can contain a single piece of data. Larger pieces of data occupy consecutive registers, with the most significant word (pair of bytes) in the lowest register, and the least significant word (pair of bytes) in the highest register. Modbus register addresses are referenced starting with register 1, whereas data link requests begin at 0. This results in an offset of 1 bit in the register address. For example, to request the parameter Generator Overall Power Factor, which resides in Modbus register number 103 ($67), a register address of $66 must be sent.
Byte offset Field Field description

Address

Slave address, for both query and response. Every control on the network has a unique slave address between 1 and 247. Use 0 to make a broadcast query, which is supported for Function Codes 6 and 16. The PowerWizard will always respond with its own slave address. Function Code for both query and response. See Supported Function Codes for a list and syntax of supported function codes. Data or exception responses. See Supported Function Codes for the format of address, counts, and data. See Exception Responses for the format of exception responses. Cyclic Redundancy Check to catch transmission errors. The low byte is transmitted first, then the high byte.

1 2 (n-3) (n-2) (n-1)

Function Code

Data

CRC

Supported Function Codes

The PowerWizard supports three standard function codes. If the PowerWizard receives an erroneous request, it can also generate an error function code, called an exception response. See Exception Responses section for descriptions of exception responses.
3 ($03) Read Registers

Send this Function Code to read data, single or up to 123 contiguous registers, from the PowerWizard. Note that the query will contain the register count, while the response will contain the byte count (byte count = register count x 2). Note also that the query has a fixed length of 4 bytes, whereas the response has a variable length depending on the number of registers requested. A read request is structured as below:
Slave function address code starting address hi starting address lo no. of registers hi no. of registers lo CRC

And the response is structured as:

Slave address function code Byte count Data hi Data lo Data hi Data lo CRC

A list of read registers is given in the following table. For a walk through example see Appendix B.

10

11

12

13

14

15

6 ($06) Write Single Register

Send this Function Code to write data to a single register on the PowerWizard. Note that the PowerWizard will attempt to write the data, and then respond with the new value in the register. If the query inadvertently attempted to write data to a read-register, the response data bytes will not match the query data bytes. This Function Code may be broadcast, in which case no response will be sent. A read request is structured as below:
Slave function address code starting address hi starting address lo Preset data hi Preset data lo CRC

And the response is structured as:

Slave function address code starting address hi starting address lo Preset data hi Preset data lo CRC

A list of all write registers is given see the write register table on page 15. For a walkthrough example see appendix C.

16

16 ($10) Write Multiple Registers Send this Function Code to write data to up to 123 contiguous registers on the PowerWizard. Note that the query will contain both the register count and the byte count (byte count = register count x 2). Note also that the query has a variable length depending on the number of registers being written, whereas the response has a fixed length of 4 bytes. The PowerWizard will not respond with any data, only the starting address and the register count as sent in the query. The entire Write will fail, and the slave will return an Exception Response, if any register in this span is a Read register. This Function Code may be broadcast, in which case no response will be sent. A read request is structured as below:
Slave function starting address starting address no. of registers no. of registers Byte Data Data Data Data CRC address code hi lo hi lo count hi lo hi lo

And the response is structured as:

Slave function address code starting address hi starting address lo no. of registers hi no. of registers CRC lo

A list of all write registers is given, see the following table. For a walkthrough example see appendix D.

17

18

Error Checking
In PowerWizard SCADA communications, various levels of error checking are performed. The Modbus data link protocol allows for byte-level error checking and packet-level error checking. Byte level error checking refers to parity checks, where the parity is set to either odd or even. For packet-level error checking, the Modbus protocol dictates that a Cyclic Redundancy Check be performed to catch transmission errors; that is, verify that the packet received is identical to the packet that was sent. These occur in the Modbus data link layer. More information on the CRC is given below. Once the packet is verified, the addresses and function codes are checked. This is handled using simple logic, determining whether the function code is supported and determining whether or not the address range or count is within range. If not, an exception response is sent. This occurs in the Modbus application layer. More information on exception responses is given below. Once the addresses and function codes are checked, the data is ready to be handled by the PowerWizard application software. There is error checking at this level to determine whether there are any application-specific errors. For example, if you are attempting to write 101% into a register that is defined to hold 0-100%, then even though the data may fit into the register (and therefore passes the previous error-checking), the application does not accept an input of 101%, and therefore a fault response is sent. This fault response is called a Fault IDentifier, or FID. A fault response is data that is valid over the Modbus data link, but the PowerWizard and the Modbus Master device agree to reserve for use as an FID. More information on Fault Identifiers is given below in the Fault Identifiers section. Parity Check Parity checking uses standard even or odd parity. The parity can be set in the PowerWizard to even, odd, or none. Parity checking occurs at the bytelevel. Upon successful parity check, the checked byte is accepted as part of the transmitted message. If the parity check fails, the byte is discarded.

19

Cyclic Redundancy Check The Cyclic Redundancy Check (CRC) algorithm checks the contents of the entire message. The CRC field consists of a 16bit value, and is appended to the end of the message. When this is done, the loworder byte of the field is appended first, followed by the highorder byte. The CRC highorder byte is the last byte to be sent in the message. The CRC value is calculated by the sending device, which appends the CRC to the message. The receiving device recalculates a CRC using the same algorithm during receipt of the message, and as it receives the CRC field, compares the calculated value to the received value. If the two values are not equal, the message is discarded. A detailed description as well as sample code and a calculation example are given in the Modbus Serial Line Implementation Guide version 1.0 or the most current version, available at www.modbus.org.

20

Exception Responses
Upon a parity or CRC error, the byte or message (respectively) is discarded. If neither of these errors occurs, the read/write status is checked. An Exception Response will be sent if there is a read/write error. If the register cannot be read from or written to at a particular time due to some application software state, it will not generate an Exception Response. Instead, the application layer will respond with data that is in the Fault Identifiers (FID) range. See Fault Identifiers (FID) section for more information. An Exception Response contains a function code that is related to the function code the PowerWizard is responding to; its value is [128 + Function Code for Query]. Any function code 128 ($80) or higher is an Exception Response. If the Exception Response is not listed below, it is in response to an unsupported function code in a query, and should contain an exception code of 01. 131 ($83) Exception Response to Read Registers Query The exception response contains only 1 byte of data, which is comprised of the exception code. Exception Code 02 03 04 Reason Starting or ending (starting + count) register address invalid Register Count was less than 1 or greater than 123 Read error possibly due to some register(s) in the span not being Read registers

134 ($86) Exception Response to Write Single Register Query The exception response contains only 1 byte of data, which is comprised of the exception code.

21

Exception Code 02 03 04

Reason Register address invalid Register value out of range perhaps because longer than 2 bytes Read error possibly due to not being a Write register

144 ($90) Exception Response to Write Multiple Registers Query The exception response contains only 1 byte of data, which is comprised of the exception code. Exception Code 02 03 04 Reason Starting or ending (starting + count) register address invalid Register Count was less than 1 or greater than 123, or byte count was not (Register Count x 2) Write error possibly due to some register(s) in the span not being Write registers

22

Fault Identifiers (FID)

Fault Identifiers (FIDs) are based on the concept that the entire data space within the register(s) is partitioned in a predefined manner, irrespective of the specific type of data in the register(s). The range of data in the PowerWizard response allows the master device to interpret the data as valid or as an indication of a fault. The following chart shows the transmitted signal ranges, including the ranges that comprise Fault Identifiers (FIDs).
Range Name Boolean Data 1-Register Data 2-Register Data Notes

Valid Data

0, 1 $0000 or $0001

0 64,255 $0000 $FAFF

0 4,211,081,215 $00000000 $FAFFFFFF

Not Used

Error

2 65532 $0010 $FFFC 65533 $FFFD

65,256 65,023 4,211,081,214 $FB00 $FDFF $FB000000 $FDFFFFFF 65,024 65,279 4,261,412,864h 4,278,190,079h $FE00 $FEFF $FE000000 $FEFFFFFF 65280 65535 4,278,190,080 4,294,967,294 $FF00 $FFFF $FF000000 $FFFFFFFF

See individual Parameter Descriptions for units, offset, and scaling to convert to physical units These data ranges are not used. FID: Signal saturated, out of range, or error from source transmitter FID: Parameter is not applicable in the current state, not available from the controller, or not requested

Not Available / 65535 Not Requested $FFFF

Note that 2-bit data is not transmitted individually, but rather within a register.

23

Reduced Power Mode

The data link is disabled in Reduced Power Mode; therefore no data link commands will take the control out of Reduced Power Mode. However, modbus communication will reset the timer to put the control into Reduced Power Mode. For example, if the Key Press event is sent every 9 minutes, then the control, if configured to enter Reduced Power Mode after 10 minutes of inactivity, will not enter Reduced Power Mode.

24

SCADA Data Link Security

The PowerWizard supports five levels of security, which corresponds to Level 0 (basic access, without a password), and four levels of passwords: SCADA, Level 1, Level 2, and Level 3. The first level of the SCADA data link security is the SCADA password. The SCADA password is to disable/enable all SCADA access. If SCADA access is not granted, the control will return all FF data for read requests, and fail with an exception response for write requests. By default the SCADA password is disabled. Level 1, Level 2, and Level 3 passwords are used to disable/enable corresponding levels of access to the control. Each level grants functionality that is a subset of that granted by the higher levels of access. The Level 3 password uses the same system as the level 3 password on the PowerWizard control panel. All of the passwords, as well as the phone-in prompt, use the 1-byte ASCII format and character set. Each string is variable in length, so in order to enter a shorter password, the rest of the field may be padded with the space character $20. The SCADA password and the Level 1 and 2 passwords are 8 bytes long and should be padded with the space character ($20). A NULL character, $00, terminates the string. All other nonprinting characters ($01 through $1F and $7F) are not accepted as valid data, and will result in a FID response. There are a couple of built in timeout features to reset the security level after a period of inactivity. One is the Level 0 Timeout, which resets the security access level to level 0 (or the lowest unprotected level above level 0) after 10 minutes without any successful write commands over the SCADA data link. Writing to the Key Press register will reset this timer, preventing it from expiring. The second timeout is the SCADA Timeout, which resets SCADA access completely at the SCADA password level (or level 0, if the SCADA Password is disabled). The timeout for this is configurable from 0.1 seconds to 1 hour it is the SCADA Data Link Connection Timeout Interval setpoint, and will only trigger after a period without any activity on the SCADA data link.

For a list of the all security associated registers see the following table. For an example of writing passwords see Appendix E.

25

26

Event System
The PowerWizard displays both internal events and those transmitted over the J1939 data link. Over SCADA, the status of the warning and shutdown lamps on the display can be viewed, and events can be acknowledged. Events can be acknowledged individually or as a group. Details of both PowerWizard and supported optional module events can be read over SCADA. The PowerWizard module uses the j1939 standard format for events, where by an event is defined as a combination of a suspect parameter number (SPN) and a fault mode identifier (FMI). The SPN defines what is at fault and the FMI defines how it is at fault. A list of SPN/FMI combinations can be found in appendix F. For a list of event related registers see the following table.

27

28

Event Breakdown
Event information is distributed over 14 registers, these 14 registers being read as 1 block of information. The breakdown of these registers and their contained information are as below.

For a walkthrough example see appendix G.

29

Setpoints
All of the configuration possible at the PowerWizard control panel can be done over the data link, by reading from and writing to PowerWizard setpoints. As on the display, each setpoint has a minimum security level required to change it associated with it. That required security level can be read by reading the Setpoint Information register for a particular setpoint. Setpoints are grouped in the PowerWizard into Blocks. These Blocks are actually pieces of software that, in some cases, may occur more than once in the software. Blocks are uniquely identified by the combination of their Block Number and Instance Number, and this unique identifier is called the Block ID. This, in combination with the Setpoint Number that identifies the setpoint within that block, is called the Setpoint ID. This Setpoint ID uniquely identifies a setpoint in the PowerWizard. . To read a setpoint data or related information, first the Setpoint ID for Read parameter must be set to the appropriate Setpoint ID. Then, either the Setpoint Information parameter or Setpoint Data Value parameter can be read. Setpoint Information contains various pieces of information regarding the setpoint, as detailed below. In order to write to a setpoint, the Setpoint Write parameter must be sent, which contains both the Setpoint ID and the data value. Immediately prior to reading setpoint information, the Setpoint ID field should be checked to verify that the correct setpoint is being read. The Setpoint ID and Setpoint Information parameters contain multiple pieces of information, and span multiple Modbus registers. The registers may be read separately, but caution should be taken to maintain integrity of the data being read. The following table lists the registers associated with the setpoint system.

30

31

Setpoint Data Type

Setpoints have minimum and maximum engineering values. They are stored with a maximum resolution. The parameters can take on non-integer values in some cases, so in order to be stored as integer data types, are scaled (bit-shifted) by the number of bits listed in the SCALING field. Setpoints are stored as a 32-bit signed integer value, using 2s complement to represent negative values. This is a standard data type in computer programming, termed INT32. It can represent integer values from negative 2,147,483,648 to positive 2,147,483,647; that is, hexadecimal $ 80 00 00 00 to $ 7F FF FF FF. Other conversion examples: Decimal -1 = $ FF FF FF FF Decimal 0 = $ 00 00 00 00 Decimal 1000 = $ 00 00 03 E8 Decimal -1000 = $ FF FF FC 18 REGISTER_VALUE = 2RESOLUTION * ENGINEERING_VALUE ENGINEERING VALUE = (0.5)RESOLUTION * REGISTER_VALUE

For a walkthrough example of working with setpoints see appendix H. For a list of setpoints and their associated values see appendices I and J.

32

Appendix A The ASCII character set

33

Appendix B Read register walkthrough

The following example shows how a read single register message and response are constructed and interpreted. The parameter in the example is generator average L-L voltage (register 0x0064) Query: Breakdown: 01 03 00 63 00 01 74 14 node: function code: starting address hi: starting address lo: no. of registers hi: no. of registers lo: CRC hi: CRC lo: 01 03 00 63 00 01 74 14

(offset by 1)

Response: Breakdown:

01 03 02 01 90 B9 B8 node: function code: byte count: data hi: data lo: CRC hi: CRC lo: 01 03 02 01 90 B9 B8

34

The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value. scale: 1V/bit range: 0-64255 offset: 0V 1. convert the received data from hex into decimal: 2. multiply by the scale: 3. add the offset, which in this case is 0: 4. now check that the value falls within the acceptable range: 0190 (hex) = 400 (decimal) 400 x 1 = 400 400 + 0 = 400 0 <= 400 <= 64255

As such the received average generator line - line voltage is 400V

35

The following example shows how a read multiple register message and response are constructed and interpreted. The parameter in the example is generator total real power (register 0x006A) Query: Breakdown: 01 03 00 69 00 02 14 17 node: function code: starting address hi: starting address lo: no. of registers hi: no. of registers lo: CRC hi: CRC lo: 01 03 00 69 00 02 14 17

(offset by 1)

Response:

01 03 04 77 35 94 00 9F 49

Breakdown:

node: function code: byte count: Data hi: data lo: Data hi: data lo: CRC hi: CRC lo:

01 03 04 77 35 94 00 9F 49

36

The data must then be interpreted. From the table (page 8) we can get the scale, range and offset and subsequently interpret the transmitted value: scale: 1W/bit range: -2000000000 to 2211081215 offset: -2000000000 1. convert the received data from hex into decimal: 77359400 (hex) = 2000000000 (decimal) 2. add the offset, which in this case is 0: 2000000000 + (-2000000000) = 0 3. now check that the value falls within the acceptable range: 2000000000 <= 0 <= 2211081215 As such the received generator total real power is 0W

37

Appendix C Write single register walkthrough

The following example shows how a write single register message and response are constructed and interpreted. The parameter in the example is engine operating mode command, used to stop the generator set (register 0x012E) From the table (page 15) we can see that to stop the set we need to write a value of 0, similarly if we wished to start the set we would write a value of 2. Query: Breakdown: 01 06 01 2D 00 00 18 3F node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 01 2D 00 00 18 3F

(offset by 1)

Response: Breakdown:

01 06 01 2D 00 00 18 3F node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 01 2D 00 00 18 3F

(offset by 1)

Note that if the write is successful the response is the same as the query.

38

Appendix D Write multiple register walkthrough

The following example shows how a write multiple register message and response are constructed and interpreted. The parameter in the example is update real time clock (register 0x0387) From the table (page 15) we can see that the real time clock value is encoded as a series of bytes, each with its own scale range and offset. For this example we will set the time and date to 10:15 AM on the 15-March-2007. Byte 0 = seconds we wish to set this to 0, 1. 2. 3. 4. check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex 0 <= 0 <= 250 0-0=0 0/1=0 0 (decimal) = 0 (hex) scale = 0.25/bit, range = 0-62.5, offset = 0

and the value we wish to write to byte 0 is 00

39

Byte 1 = minutes we wish to set this to 15, 1. 2. 3. 4.

scale = 1/bit, range = 0-250, offset = 0

check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex

0 <= 15 <= 250 15 - 0 = 15 15 / 1 = 15 15 (decimal) = F (hex)

and the value we wish to write to byte 1 is 0F

Byte 2 = hour

scale = 1/bit, range = 0-250, offset = 0

we wish to set this to 10, 1. 2. 3. 4. check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex 0 <= 10 <= 250 10 - 0 = 10 10 / 1 = 10 10 (decimal) = A (hex)

and the value we wish to write to byte 2 is 0A

40

Byte 3 = month we wish to set this to 3, 1. 2. 3. 4.

scale = 1/bit, range = 0-250, offset = 0

check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex

0 <= 3 <= 250 3-0=3 3/1=3 3 (decimal) = 3 (hex)

and the value we wish to write to byte 3 is 03

Byte 4 = quarter day we wish to set this to 15, 1. 2. 3. 4.

scale = 0.25/bit, range = 0-62.5, offset = 0

check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex

0 <= 15 <= 62.5 15 - 0 = 15 15 / 0.25 = 60 60 (decimal) = 3C (hex)

and the value we wish to write to byte 4 is 3C

41

Byte 5 = year we wish to set this to 2007, 1. 2. 3. 4.

scale = 1/bit, range = 1985-2235, offset = 1985

check that the value we wish to enter is within range: subtract the offset : divide the value by the scale: convert the value into hex

1985 <= 2007 <= 2235 2007 - 1985 = 22 22 / 1 = 22 22 (decimal) = 16 (hex)

and the value we wish to write to byte 5 is 16 Using all the above information we can construct the query to set the time. Query: 01 10 03 86 00 03 06 00 0F 0A 03 3C 16 39 24 Breakdown: node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 10 03 86 00 03 06 00 0F 0A 03 3C 16 39 24

42

Response: Breakdown:

01 10 03 86 00 03 61 A5 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 01 10 03 86 00 03 61 A5

Note that if the write is successful the response is as above.

43

Appendix E Security system walkthrough

To read the current security level (register 0x02DC) Query: Breakdown: 01 03 02 DB 00 01 F5 89 node: function code: starting address hi: starting address lo: no. of registers hi: no. of registers lo: CRC hi: CRC lo: 01 03 02 DB 00 01 F5 89

(offset by 1)

Response: Breakdown:

01 03 02 00 02 39 85 node: function code: byte count: Data hi: data lo: CRC hi: CRC lo: 01 03 02 00 02 39 85

44

The data must then be interpreted. From the table (page 22) we can get the scale, range and offset and subsequently interpret the transmitted value. Scale : 1/bit Range : 0-3 Offset : 0 1. convert the received data from hex into decimal: 2. multiply the value by the scale 3. add the offset, which in this case is 0: 4. now check that the value falls within the acceptable range: As such the control panel is at security level 2 02 (hex) = 400 (decimal) 2x1=2 2+0=2 0 <= 2 <= 3

To read the level 3 phone in prompt (0x02DE) Query: Breakdown: 01 03 02 DD 00 08 D5 8E node: function code: starting address hi: starting address lo: no. of registers hi: no. of registers lo: CRC hi: CRC lo: 01 03 02 DD 00 08 D5 8E

(offset by 1)

45

Response:

01 03 10 31 30 35 31 37 36 37 34 38 31 39 35 30 37 39 32 72 3D

Breakdown:

node: function code: byte count: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: CRC hi: CRC lo:

01 03 10 31 30 35 31 37 36 37 34 38 31 39 35 30 37 39 32 72 3D

ASCII CHARACTER 1 ASCII CHARACTER 0 ASCII CHARACTER 5 ASCII CHARACTER 1 ASCII CHARACTER 7 ASCII CHARACTER 6 ASCII CHARACTER 7 ASCII CHARACTER 4 ASCII CHARACTER 8 ASCII CHARACTER 1 ASCII CHARACTER 9 ASCII CHARACTER 5 ASCII CHARACTER 0 ASCII CHARACTER 7 ASCII CHARACTER 9 ASCII CHARACTER 2

So in the above example the L3 phone in prompt is 1051 7674 8195 0792

46

Write access password (0x02BC) This register is used to enter a level 1 or level 2 or level 3 password. Passwords can be 16 characters long. the control panel automatically matches the password to the appropriate security level. This does mean that level 1 and level 2 passwords must be different. The below example shows how to write a level 1 or level 2 security password of 0123 4567 8901 2345. Query: Breakdown: 01 10 02 BB 00 08 10 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 61 C9 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 10 02 BB 00 08 10 30 31 32 33 34 35 36 37 38 39 30 31 32 33 34 35 61 C9

(offset by 1)

ASCII CHARACTER 0 ASCII CHARACTER 1 ASCII CHARACTER 2 ASCII CHARACTER 3 ASCII CHARACTER 4 ASCII CHARACTER 5 ASCII CHARACTER 6 ASCII CHARACTER 7 ASCII CHARACTER 8 ASCII CHARACTER 9 ASCII CHARACTER 0 ASCII CHARACTER 1 ASCII CHARACTER 2 ASCII CHARACTER 3 ASCII CHARACTER 4 ASCII CHARACTER 5

47

Response: Breakdown:

01 10 02 BB 00 08 B0 52 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 01 10 02 BB 00 08 B0 52

(offset by 1)

Note that if the write is successful the response is as above.

48

To change level the 1 access password (0x02C4) Passwords can be 16 characters long. Note you must be at level 1 or higher security in order to change this password. The below example shows how to change a level 1 security password to 0000 1111 0000 1111 Query: Breakdown: 01 10 02 C3 00 08 10 30 30 30 30 31 31 31 31 30 30 30 30 31 31 31 31 89 8D node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: preset data hi: preset data hi: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: preset data hi: preset data hi: CRC hi: CRC lo: 01 10 02 C3 00 08 10 30 30 30 30 31 31 31 31 30 30 30 30 31 31 31 31 89 8D

(offset by 1)

ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 1 ASCII CHARACTER 1 ASCII CHARACTER 1 ASCII CHARACTER 1 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 1 ASCII CHARACTER 1 ASCII CHARACTER 1 ASCII CHARACTER 1

49

Response: Breakdown:

01 10 02 C3 00 08 30 4B node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 01 10 02 C3 00 08 30 4B

(offset by 1)

Note that if the write is successful the response is as above.

50

To change level 2 access password (0x02CC) Passwords can be 16 characters long. Note you must be at level 2 or higher security in order to change this password. The below example shows how to change a level 2 security password to 0000 2222 0000 2222 Query: Breakdown: 01 10 02 CB 00 08 10 30 30 30 30 32 32 32 32 30 30 30 30 32 32 32 32 37 CE node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: preset data hi: preset data hi: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: preset data hi: preset data hi: CRC hi: CRC lo: 01 10 02 CB 00 08 10 30 30 30 30 32 32 32 32 30 30 30 30 32 32 32 32 37 CE

(offset by 1)

ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 2 ASCII CHARACTER 2 ASCII CHARACTER 2 ASCII CHARACTER 2 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 2 ASCII CHARACTER 2 ASCII CHARACTER 2 ASCII CHARACTER 2

51

Response: Breakdown:

01 10 02 CB 00 08 B1 89 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 01 10 02 CB 00 08 B1 89

(offset by 1)

Note that if the write is successful the response is as above.

52

Write SCADA password (0x02BC) This register is used to enter a the SCADA password. The SCADA password can be 8 characters long and is padded with 8 space characters. The below example shows how to write a SCADA password of 0000 1234. Query: Breakdown: 01 10 02 BB 00 08 10 30 30 30 30 31 32 33 34 20 20 20 20 20 20 20 20 F8 DA node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 10 02 BB 00 08 10 30 30 30 30 31 32 33 34 20 20 20 20 20 20 20 20 F8 DA

(offset by 1)

ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 0 ASCII CHARACTER 1 ASCII CHARACTER 2 ASCII CHARACTER 3 ASCII CHARACTER 4 ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space' ASCII CHARACTER 'space'

53

Response: Breakdown:

01 10 02 BB 00 08 B0 52 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 01 10 02 BB 00 08 B0 52

(offset by 1)

Note that if the write is successful the response is as above.

54

To write the current security level (0x02DD) From the table (page 22) we can see that to stop the set we need to write a value of 0 to drop to minimum security level, note that if no level 1 or level 2 passwords have been setup the minimum security level will be 2. Query: Breakdown: 01 06 02 DC 00 00 49 88 node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 02 DC 00 00 49 88

Response: Breakdown:

01 06 02 DC 00 00 49 88 node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 02 DC 00 00 49 88

Note that if the write is successful the response is the same as the query.

55

Appendix F SPN/FMI combinations list

56

57

58

Appendix G Event system walkthrough

event log module selection - in order to read the events we must first select which event log we wish to read. please note that the PowerWizard has separate event logs for events raised by the module and those raised by ancillaries such as the engine ECM. (please see note 1, page 24 for a list of event logs) in order to read the events raised by the PowerWizard control panel we must select event log module selection 0. to do this write the value 0 to register 1498 (0x05DA) Query: Breakdown: 01 06 01 2D 00 00 18 3F node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 05 D9 00 00 18 3F

Response: Breakdown:

01 06 01 2D 00 00 18 3F node: function code: starting address hi: starting address lo: preset data hi: preset data lo: CRC hi: CRC lo: 01 06 01 2D 00 00 18 3F

Note that if the write is successful the response is the same as the query.

59

Event log entries - having selected the appropriate modules event log it is possible to pull the event information for the 20 events from register 1500 to 1780. The below example only reads the first event and explains how to interpret the information. To read event log entry #1 (0x05DC) Query: Breakdown: 01 03 05 DB 00 0E B4 F9 node: function code: starting address hi: starting address lo: no. of registers hi: no. of registers lo: CRC hi: CRC lo: 01 03 05 DB 00 0E B4 F9

(offset by 1)

60

Response:

01 03 1C C4 31 0B 03 52 16 90 05 0E 04 17 15 00 0025 9E 00 00 00 00 F5 09 FF 01 F4 FF 00 00 07 89

Breakdown:

node: function code: byte count: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo:

01 03 1C C4 31 0B 03 52 16 90 05 0E 04 17 15 00 00 25 9E

(register 0) (register 1) (register 2) (register 3) (register 4) (register 5) (register 6) (register 7)

data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: data hi: data lo: CRC hi: CRC lo:

00 00 00 00 F5 09 FF 01 F4 FF 00 00 07 89

(register 8) (register 9) (register 10) (register 11) (register 12) (register 13)

The data must then be interpreted. From the table (page 25) we can get the scale, range and offset and subsequently interpret the transmitted information.

61

Register 13 contains the log entry index. Converting 0x0000 into decimal gives 0, as such this is the first event in the event log (the log has 20 entries, 0-19)

Registers 12 and 11 contain the SPN/FMI information. Firstly convert the value from hex into binary. hex binary = = 0xFF01F4FF 11111111000000011111010011111111

now we need to breakdown the information bits 31:24 bits 23:5 bits 4:0 = = = 11111111 0000000111110100111 11111 these are unused and can be ignored this represents the SPN this represents the FMI

now convert the SPN information into decimal (bits 23:5) binary decimal = = 0000000111110100111 4007

subsequently the SPN of the event is 4007 now convert the FMI information into decimal (bits (4:0) binary decimal = = 11111 31

subsequently the FMI of this event is 31 now we have the SPN/FMI combination we can check this with the SPN/FMI list (Appendix F) and we find that SPN/FMI 4007/31 = generator control not in automatic warning

62

Register 10 contains the event status and occurrence count information. Firstly convert the information into binary.

hex binary

= =

0xF509 1111010100001001

now we need to breakdown the information bits 15:12 bits 11:8 bits 7:0 = = = 1111 0101 00001001 these are unused and can be ignored this represents the event status this represents the number of occurrences of the event

using the information in the event breakdown section (page 25) event status 0101 = Present

as such this event is currently present

now convert the occurrence information into decimal (bits 7:0) binary decimal = = 00001001 9

and we see this event has occurred 9 times.

63

register pairs 9:8 and 7:6 give the engine operating hours when the event first and last occurred. from the event breakdown section (page 25) range : scale : offset : 0-210554060.75 0.000278 hour/bit 0 00000000 (hex) 0 * 0.000278 0+0 0 <= 0 = = = <= 0 (decimal) 0 0 210554060.75

for first hour meter (register 9:8) multiplying by the scale adding the offset and checking the range so the first hour meter is 0 hours

for last hour meter (register 7:6) multiplying by the scale adding the offset and checking the range so the last hour meter is 2.68 hours

0000259E (hex) 9630 * 0.00278 481.5 + 0 0 <= 2.68

= = = <=

9630 (decimal) 2.68 2.68 210554060.75

64

registers 5:3 and 2:0 contain the first and last time stamp information the information is divided into byte long sections. for the first timestamp Byte 5 contains the year information. From the event breakdown section: scale : 1 year/bit range : 1985-2235 offset : 1985 byte 5 = 15 (hex), converting this to decimal gives 21 multiplying by the scale adding the offset as such the year is 2006 21 * 1 21 + 1985 = = 21 2006

Byte 4 contains the day information. From the event breakdown section: scale : 0.25 days/bit range : 0-62.5 offset : 0 byte 4 = 17 (hex), converting this to decimal gives 23 multiplying by the scale adding the offset 23 * 0.25 5.75 + 0 = = 5.75 5.75

as such the day is the 5 full days of the month had passed and the event occurred on the 6th day

65

Byte 3 contains the month information. From the event breakdown section: scale : 1 month/bit range : 0-250 offset : 0 Byte 3 = 04 (hex), converting this to decimal gives 4 multiplying by the scale adding the offset 4*1 4+0 = = 4 4

as such the event occurred on the 4th month of the year

Byte 2 contains the hour information. From the event breakdown section: scale : 1 hour/bit range : 0-250 offset : 0 Byte 2 = 0E (hex), converting this to decimal gives 14 multiplying by the scale adding the offset 14 * 1 14 + 0 = = 14 14

as such the event occurred on the 14th hour of the day

66

Byte 1 contains the minute information. From the event breakdown section: scale : 1 minute/bit range : 0-250 offset : 0 Byte 1 = 05 (hex), converting this to decimal gives 5 multiplying by the scale adding the offset 05 * 1 05 + 0 = = 05 05

as such the event occurred on the 5th minute of the hour

Byte 0 contains the second information. From the event breakdown section: scale : 0.25 minute/bit range : 0-62.5 offset : 0 Byte 0 = 90 (hex), converting this to decimal gives 144 multiplying by the scale adding the offset 144 * 0.25 36 + 0 = = 36 36

as such the event occurred on the 36th second of the minute

so the first timestamp for this event was

14:05:36 on the 6th April 2006

67

for the last timestamp Byte 5 contains the year information. From the event breakdown section : scale : 1 year/bit range : 1985-2235 offset : 1985 byte 5 = 16 (hex), converting this to decimal gives 22 multiplying by the scale adding the offset as such the year is 2007 22 * 1 22 + 1985 = = 22 2007

Byte 4 contains the day information. From the event breakdown section : scale : 0.25 days/bit range : 0-62.5 offset : 0 byte 4 = 52 (hex), converting this to decimal gives 82

multiplying by the scale adding the offset

82 * 0.25 20.5 + 0

= =

20.5 20.5

as such the day is the 20 full days of the month had passed and the event occurred on the 21st day

68

Byte 3 contains the month information. From the event breakdown section : scale : 1 month/bit range : 0-250 offset : 0 Byte 3 = 03 (hex), converting this to decimal gives 3 multiplying by the scale adding the offset 3*1 3+0 = = 3 3

as such the event occurred on the 3rd month of the year

Byte 2 contains the hour information. From the event breakdown section : scale : 1 hour/bit range : 0-250 offset : 0 Byte 2 = 0B (hex), converting this to decimal gives 11 multiplying by the scale adding the offset 11 * 1 11 + 0 = = 11 11

as such the event occurred on the 11th hour of the day

69

Byte 1 contains the minute information. From the event breakdown section: scale : 1 minute/bit range : 0-250 offset : 0 Byte 1 = 31 (hex), converting this to decimal gives 49 multiplying by the scale adding the offset 49 * 1 49 + 0 = = 49 49

as such the event occurred on the 49th minute of the hour

Byte 0 contains the second information. From the event breakdown section: scale : 0.25 minute/bit range : 0-62.5 offset : 0 Byte 0 = C4 (hex), converting this to decimal gives 196 multiplying by the scale adding the offset 196 * 0.25 49 + 0 = = 49 49

as such the event occurred on the 49th second of the minute so the last time stamp for this event was 11:49:49 on the 21st March 2007

70

Appendix H Setpoint system walkthrough

In order to identify a setpoint in PowerWizard panels the block number, instance and setpoint number are required, this information forms the setpoint ID. From the setpoints list (Appendix I) we can find this information. For the purpose of this example we will change the number of flywheel teeth (normally locked at Level 3 security). The number of flywheel teeth setpoint is found in the engine speed monitor block. From the setpoints list we find that for flywheel teeth: Block = 6 Instance = 1 Setpoint = 1 The setpoint ID is made as below: Setpoint (1) Block (6) Instance (1) So the setpoint ID is 00 00 00 06 00 00 (offset by 1) (not offset by 1) (offset by 1)

00 00 00 06 00 00

71

To view or modify a setpoint we must first select the relevant setpoint (register 0x03EA) Query Breakdown: 05 10 03 E9 00 03 06 00 00 00 06 00 00 D3 38 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data hi: CRC hi: CRC lo: 05 10 03 EA 00 03 06 00 00 00 06 00 00 D3 38

(offset by 1)

setpoint id setpoint id setpoint id

Response: Breakdown:

05 10 03 E9 00 03 50 3C node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 05 10 03 E9 00 03 50 3C

(offset by 1)

Note that if the write is successful the response is as above.

72

To read the information for a selected setpoint (register 0x03ED) Query Breakdown: 05 03 03 EC 00 0C 85 FA node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 05 03 03 EC 00 0C 85 FA

(offset by 1)

Response Breakdown:

05 03 18 00 00 00 01 00 00 01 5E 00 00 00 5F 00 00 00 7E 00 03 00 00 00 06 00 00 A5 DC 05 03 18 00 00 00 01 00 00 01 5E 00 00 00 5f 00 00 00 7E 00 03 00 00 00 06 00 00 A5 DC slave, function, no. bytes resolution maximum value minimum value actual value access level required setpoint I.D. CRC

73

Using the information in the setpoints list we can interpret the information. For this example we will only interpret the actual value. Scale Resolution = = 0 1

Converting from hex to decimal 7E (hex) = Therefore this set has 126 flywheel teeth.

126 (decimal)

74

To change a setpoint (register 0x03F9) To change the number of flywheel teeth to 96 we enter the following query, Query: Breakdown: 05 10 03 F8 00 05 0A 00 00 00 06 00 00 00 00 00 60 9F 28 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: byte count: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: preset data hi: preset data lo: CRC hi: CRC lo: 05 10 03 F8 00 05 0A 00 00 00 06 00 00 00 00 00 60 9F 28

setpoint id setpoint id setpoint id setpoint id setpoint id setpoint id new value new value new value new value (96 in hex)

75

Response: Breakdown:

05 10 03 86 00 0A A0 27 node: function code: starting address hi: starting address lo: no. registers hi: no. registers lo: CRC hi: CRC lo: 05 10 03 86 00 0A A0 27

Note that if the write is successful the response is as above.

76

Appendix I Setpoints List

77

78

79

80

81

82

83

84

85

86

87

Appendix J Setpoint Values list

88

89

90

91

92