Huawei Ups Alarm Table

UPS2000-(6 kVA-20 kVA)
Modbus Protocol Development

Guide
Issue 02
Date 2016-03-10
HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2016. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Huawei Technologies Co., Ltd.
Trademarks and Permissions
and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective
holders.
Notice
The purchased products, services and features are stipulated by the contract made between Huawei and
the customer. All or part of the products, services and features described in this document may not be
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,
information, and recommendations in this document are provided "AS IS" without warranties, guarantees or
representations of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base
Bantian, Longgang
Shenzhen 518129
People's Republic of China
Website: http://e.huawei.com
Issue 02 (2016-03-10) Huawei Proprietary and Confidential i

Copyright © Huawei Technologies Co., Ltd.
Modbus Protocol Development Guide About This Document
About This Document
Overview
This document describes the Modbus protocol used between the RMS-MODBUS01A card, an
optional component of the UPS2000-(6 kVA-20 kVA), and its host and provides examples of
communication establishment processes.
Intended Audience
This document is intended for:
 Technical support engineers
 Maintenance engineers
 Users
Symbol Conventions
The symbols that may be found in this document are defined as follows.
Symbol Description
Indicates an imminently hazardous situation which, if not
avoided, will result in death or serious injury.
Indicates a potentially hazardous situation which, if not

avoided, could result in death or serious injury.

avoided, may result in minor or moderate injury.

avoided, could result in equipment damage, data loss,
performance deterioration, or unanticipated results.
NOTICE is used to address practices not related to personal
injury.
Calls attention to important information, best practices and
tips.
NOTE is used to address information not related to personal
Issue 02 (2016-03-10) Huawei Proprietary and Confidential ii

Modbus Protocol Development Guide About This Document
Symbol Description
injury, equipment damage, and environment deterioration.
Change History
Changes between document issues are cumulative. The latest document issue contains all the
changes made in earlier issues.
Issue 02 (2016-03-10)
The product type UPS2000A was added. The collection signal and alarm signal lists were
updated. The examples of communication processes with the host were changed.
Issue 01 (2015-07-14)
This issue is the first release.
Issue 02 (2016-03-10) Huawei Proprietary and Confidential iii

Modbus Protocol Development Guide Contents
Contents
About This Document .................................................................................................................... ii

1 Communication Protocol ............................................................................................................. 1
1.1 Protocol Description ..................................................................................................................................................... 1
1.2 Glossary ........................................................................................................................................................................ 1
1.3 Physical Interface .......................................................................................................................................................... 2
1.3.1 Serial Communication Electrical Standards............................................................................................................... 2
1.3.2 Data Transmission Speed ........................................................................................................................................... 2
1.3.3 Cable Connection....................................................................................................................................................... 2
1.4 Communication Mode at the Physical Layer ................................................................................................................ 8
1.5 Command Type and Format at the Application Layer .................................................................................................. 9
1.5.1 Function Code List .................................................................................................................................................... 9
1.5.2 CRC Checking Algorithm .......................................................................................................................................... 9
1.5.3 Definition and Format for the Read Device Identifier Command ........................................................................... 10
1.5.3.1 Frame Format........................................................................................................................................................ 10
1.5.3.2 Command Definition ............................................................................................................................................ 10
1.5.3.3 Frame Format Examples ....................................................................................................................................... 13
1.5.3.4 Query Device Identification Information Command ............................................................................................ 15
1.5.3.4.1 Request Frame Format ....................................................................................................................................... 15
1.5.3.4.2 Response Frame Format .................................................................................................................................... 15
1.5.4 Definition and Format of Read Command ............................................................................................................... 16
1.5.4.1 Read Command Definition ................................................................................................................................... 16
1.5.4.2 Read Command Format ........................................................................................................................................ 16
1.5.5 Definition and Format for the Write Single Register Command ............................................................................. 16
1.5.5.1 Definition for the Write Single Register Command .............................................................................................. 16
1.5.5.2 Format for the Write Single Register Command ................................................................................................... 17
2 Modbus Card Signal List ........................................................................................................... 18

2.1 Collection and Configuration ...................................................................................................................................... 18
2.1.1 Signal List Description ............................................................................................................................................ 18
Issue 02 (2016-03-10) Huawei Proprietary and Confidential iv

Modbus Protocol Development Guide Contents
2.1.2 Collection Signal List .............................................................................................................................................. 18

2.1.3 Configuration and Control Signal List ..................................................................................................................... 25
2.2 Alarms ......................................................................................................................................................................... 28
2.2.1 Signal List Description ............................................................................................................................................ 28
2.2.2 Alarm Signal List ..................................................................................................................................................... 28
3 Examples for the Host Communication Process ................................................................... 34

A Acronyms and Abbreviations .................................................................................................. 37
Issue 02 (2016-03-10) Huawei Proprietary and Confidential v

Modbus Protocol Development Guide 1 Communication Protocol
1 Communication Protocol
1.1 Protocol Description

This section describes the Modbus protocol used between the RMS-MODBUS01A card and
its host for command control and data exchange.
The specified functions of the Modbus protocol are:
1. The host sends a read device identifier command to obtain the UPS information.
2. The host sends a read command to obtain the specified UPS information.
3. The host sends a write command to set the relevant parameters and control actions.
The host is the master device. The information exchange is done by a request and response
method. The information and parameters of the slave devices are stored in the target registers.
The host executes the read or write command by accessing the registers. This protocol
supports one host networked with multiple slave devices. The slave devices are distinguished
by address. The address setting range is from 1 to 247. Different slave nodes correspond to
different addresses. The slave nodes connected to the same communication bus must not have
the same address.
1.2 Glossary
Master node: runs in the background and is responsible for communicating with slave nodes.
It is also the upper computer.
Slave node: in this guide, it is the RMS-MODBUS01A card. It collects information from the
UPS power modules, and is used for responding to the master node.
RS485: a serial communication standard, and supports the half-duplex serial short-range
communication.
Read device identifier command: the command is sent from the master node to the slave
nodes, and the slave nodes return the relevant UPS information.
Read command: the command is sent from the master node to the slave nodes, and the slave
nodes return the relevant register content.
Write command: the relevant parameters are packed at the master node and sent to the slave
nodes to finish the parameter setting.
Issue 02 (2016-03-10) Huawei Proprietary and Confidential 1

Register address: Every signal or parameter of the slave devices corresponds to an address.
The host obtains the relevant information or sets the relevant parameters. These processes are
completed by accessing these register addresses.
Slave node address: this address is the RMS-MODBUS01A card address, set by the dual
in-line package (DIP) switch. The range is from 1 to 247.
1.3 Physical Interface

1.3.1 Serial Communication Electrical Standards
The slave nodes communicate with the master node through the RS485 or RS232 serial ports.
Information transmission method:
1. Use the RTU transmission mode of the Modbus.
2. The transmission mode for the character information is asynchronous mode using a
frame format of one start bit, eight data bits (information byte), and one stop bit. (10 bits
in total.)
1.3.2 Data Transmission Speed

The data transmission baud rate is fixed at 9600 bit/s.
When connecting to a network management system (NMS), use an RS485/232 converter with the
isolation function. A hot-swap RS485/232 converter is not recommended.
1.3.3 Cable Connection

Step 1 Set a hardware address for the Modbus card.
The hardware address is set over S2 (RS485 address DIP switch) shown in Figure 1-1. As
shown in Figure 1-2, the address contains eight digits. If a toggle switch is set to ON, it stands
for 0. If a toggle switch is set to OFF, it stands for 1.

Figure 1-1 DIP switch
Figure 1-2 Describes the address DIP switch S2
You can use the binary method to set the DIP switch. Table 1-1 lists the mapping between
addresses and toggle switches.
Table 1-1 Mapping between addresses and toggle switches

Addre Toggle Toggle Toggle Toggle Toggle Toggle Toggle Toggle
ss Switch Switch Switch Switch Switch Switch Switch Switch
1 2 3 4 5 6 7 8
1 OFF ON ON ON ON ON ON ON
2 ON OFF ON ON ON ON ON ON
3 OFF OFF ON ON ON ON ON ON
4 ON ON OFF ON ON ON ON ON
5 OFF ON OFF ON ON ON ON ON
6 ON OFF OFF ON ON ON ON ON
7 OFF OFF OFF ON ON ON ON ON

Addre Toggle Toggle Toggle Toggle Toggle Toggle Toggle Toggle

ss Switch Switch Switch Switch Switch Switch Switch Switch
1 2 3 4 5 6 7 8
8 ON ON ON OFF ON ON ON ON
9 OFF ON ON OFF ON ON ON ON
10 ON OFF ON OFF ON ON ON ON
11 OFF OFF ON OFF ON ON ON ON
12 ON ON OFF OFF ON ON ON ON
13 OFF ON OFF OFF ON ON ON ON
14 ON OFF OFF OFF ON ON ON ON
15 OFF OFF OFF OFF ON ON ON ON
16 ON ON ON ON OFF ON ON ON
17 OFF ON ON ON OFF ON ON ON
18 ON OFF ON ON OFF ON ON ON
19 OFF OFF ON ON OFF ON ON ON
20 ON ON OFF ON OFF ON ON ON
21 OFF ON OFF ON OFF ON ON ON
22 ON OFF OFF ON OFF ON ON ON
23 OFF OFF OFF ON OFF ON ON ON
24 ON ON ON OFF OFF ON ON ON
25 OFF ON ON OFF OFF ON ON ON
26 ON OFF ON OFF OFF ON ON ON
27 OFF OFF ON OFF OFF ON ON ON
28 ON ON OFF OFF OFF ON ON ON
29 OFF ON OFF OFF OFF ON ON ON
30 ON OFF OFF OFF OFF ON ON ON
31 OFF OFF OFF OFF OFF ON ON ON
32 ON ON ON ON ON OFF ON ON
Table 1-1 provides the methods for setting 1–32 addresses. You can follow binary DIP switch setting
rules to set 33–247 addresses.
Step 2 Set the communication form for the Modbus card.

Set toggle 4 to ON, as shown in Figure 1-3. This indicates that the Modbus protocol is
enabled. If both toggles 5 and 6 are set to ON, it indicates a two-wire system. If both of them
are set to OFF, it indicates a four-wire system.
Figure 1-3 Functional DIP switch S1
Table 1-2 Description of the functional DIP switch S1
Toggle Switch Definition Settings Remarks

1 Reserved ON: 0 Toggle switches 1, 2, and 3 are
OFF: 1 used together to set a 3-bit baud
rate.
2 Reserved ON: 0 Currently, the software version
OFF: 1 supports only a baud rate of 9600
bits/s (in this case, toggle switches
3 Reserved ON: 0 1, 2, and 3 are ON).
OFF: 1
4 RS485 ON: 0 0: Modbus protocol
protocol toggle OFF: 1
switch
5 Toggle switch ON: two-wire Toggle switches 5 and 6 must be
for selecting a system both ON or both OFF.
two-wire or OFF: four-wire
four-wire system
system
6 Toggle switch
for selecting a
two-wire or
four-wire
system
7 Control area ON: match None
network OFF: no match
(CAN)
build-out
resistor toggle
switch
8 RS485 ON: match None
build-out OFF: no match

Toggle Switch Definition Settings Remarks

resistor toggle
switch
If the RS485 build-out resistor toggle switch is set to ON, it indicates that there is a build-out resistor.
Set the toggle switch as required.
Step 3 Insert the Modbus card into the extended card slot of the UPS, and tighten the screws, as
shown in Figure 1-4.
Figure 1-4 Inserting the Modbus card into the optional card slot
Step 4 Set up a network, as shown in Figure 1-5.

1. Connect the COM_1 port (the COM_2 port is used for cascading) on the Modbus card to
the RS485 port on the RS232-RS485 adapter over a network cable (a shielded twisted
pair is recommended) that meets pin sequence requirements.
2. Connect the RS232 port on the RS232-RS485 adapter to the RS232 port on the PC over
a network cable (a shielded twisted pair is recommended) that meets pin sequence
requirements.
Connecting cables for the Modbus card.

Figure 1-5 Connecting cables for the Modbus card
Figure 1-6 shows the RJ45 port pins. For port pin definitions and cable connections, see Table
1-3.
Figure 1-6 RJ45 ports
Table 1-3 Pins on an RJ45 port
Pin Signal Corresponding Signal of RS232-RS485

No. Adapter
Two-wire system Four-wire system
1 Four-wire system: RS485 TX+ A RS485 RX+

Two-wire system: A
2 Four-wire system: RS485 TX– B RS485 RX-
Two-wire system: B
3 None N/A N/A
4 Four-wire system: RS485 RX+ N/A RS485 TX+
5 Four-wire system: RS485 RX– N/A RS485 TX–
6 GND N/A N/A

Pin Signal Corresponding Signal of RS232-RS485

No. Adapter
Two-wire system Four-wire system

7 None N/A N/A
8 None N/A N/A
----End
1.4 Communication Mode at the Physical Layer

After the slave nodes are powered on or reset, and run steadily, the slave nodes respond to the
read or write commands. When the slave nodes receive the relevant command, the slave
nodes return the queried information to the master node under normal conditions. Under
abnormal conditions, the slave nodes return the specific error codes corresponding to the error
types.
Table 1-4 lists the error codes.
Table 1-4 Error code list
No. Name Description
0x01 Invalid function code Slave nodes received

unsupported or incorrect
function codes.
0x02 Invalid parameter Slave nodes received invalid
function code parameters.
0x03 Invalid data Slave nodes received invalid
data such as CRC checking
error.
0x04 Slave node execution failed Slave nodes failed to
respond to the command.
0x05 Reload the start command Slave nodes are busy.

1.5 Command Type and Format at the Application Layer

1.5.1 Function Code List
Function Code Meaning Remarks
0x03 Read command Continuously read a single
or multiple registers.
0x06 Write single register Write commands to a single
command register.
0x2B Read device identifier N/A
command
1.5.2 CRC Checking Algorithm

unsigned short count_CRC(unsigned char *addr, int num)
{
unsigned short CRC = 0xFFFF;
int i;
while (num--)
{
CRC ^= *addr++;
for (i = 0; i < 8; i++)
{
if (CRC & 1)
{
CRC >>= 1;
CRC ^= 0xA001;
}
else
{
CRC >>= 1;
}
}
}
return CRC;
}

1.5.3 Definition and Format for the Read Device Identifier

Command
1.5.3.1 Frame Format
Command frame:
Byte 0 1 2 3 4 5 6
Field ADDR CMD MEI ReadDev Target ID LSB MSB

ID
Desc Controlle Functio MEI ReadDev Object CRC checking

ripti r address n code type ID ID
on
Response frame:
The response frame is not fixed. The frame depends on the object ID.
1.5.3.2 Command Definition

This command code allows reading identifiers and added packages that are relevant to the
physical and function description of the remote devices.
Simulate the port of the read device identifier as an address space. This address space consists
of a set of addressable data elements. The data elements are objects to be read, and the object
IDs determine these data elements.
A data element consists of three elements:
 Basic device identifier: All objects are mandatory such as the manufacturer name,
product code, and revision version.
 Normal device identifier: Except the basic data objects, the device provides additional
and optional identifiers and data object description. Define all types of objects according
to standard definitions, but the execution of this type of objects is optional.
 Extension device identifier: Except the basic data objects, the device provides additional
and optional identifiers and special data object description. All these data are related to
the device.
Object ID Object Name Type Mandatory or Category

or Optional
Description (M/O)
0x00 Manufacturer ASCII character M Basic
name string
0x01 Product code ASCII character M
string
0x02 Main revision ASCII character M
version string
0x03-0x7F N/A N/A N/A Normal

Object ID Object Name Type Mandatory or Category

or Optional
Description (M/O)
0x80-0xFF N/A N/A N/A Extension
Request PDU:
Function Code 1 byte 0x2B
MEI Type 1 byte 0x0E
ReadDevID Code 1 byte 0x01/0x02/0x03/0x04
Object ID 1 byte 0x00 to 0xFF
Request parameter description:

 Function code: 43 (decimal), 0x2B (hexadecimal).
 MEI type: The MEI type of 14 (0x0E) assigned to the device identifier port.
 The ReadDevID has four access types:
− 0x01: request to obtain the basic device identifier (stream access)
− 0x02: request to obtain the normal device identifier (stream access)
− 0x03: request to obtain the extension device identifier (stream access)
− 0x04: request to obtain the special device identifier (special access)
If the identifier data is not suitable for individual responses, you can require several request
and response transactions. The object ID byte provides the first identifier code obtained. For
the first transaction, the client must set the object ID to 0x00 to obtain the start of the device
identifier data. For the subsequent transactions, the client must set the object ID to the value
returned by the previous responded server.
If the object ID does not match any known object, the server points to the object numbered
0x00 (from the start).
For single access, the ReadDevID code is 0x04. The object ID in the requesting process
provides the obtained object identifier code.
If the object ID does not match any known object, the server returns an abnormal code
numbered 0x02 (invalid data address).
Response PDU:
ReadDevID Code 1 byte 0x01/0x02/0x03/0x04
Consistency Level 1 byte N/A
More 1 byte 0x00/0xFF

Next Object ID 1 byte Object ID number
Object Number 1 byte N/A
Object ID List 1 byte N/A
Object Length 1 byte N/A
Object Value 1 byte N/A
Response parameter description:

 Function code: 43 (decimal), 0x2B (hexadecimal).
 MEI type: The MEI type of 14 (0x0E) assigned to the device identifier port.
 ReadDevID code: same as the request ReadDevID, 0x01, 0x02, 0x03, or 0x04.
 Consistency level: The consistency level for the device identifiers and types of supported
accesses.
− 0x01: basic identifier code (stream access only)
− 0x02: normal identifier code (stream access only)
− 0x03: extension identifier code (stream access only)
− 0x81: basic identifier code (stream access and single access)
− 0x82: normal identifier code (stream access and single access)
− 0x83: extension identifier code (stream access and single access)
 More: If the identifier code is 0x01, 0x02, or 0x03 (stream access) and the identifier data
does not match the single response, you can require several request and response
transactions.
− 0x00: The object is no longer usable
− 0xFF: Other identifier objects are usable, and more Modbus transactions are
required
For the ReadDevID code 0x04 (single access), this field must be set to 0x00.
 Next object ID: If more is 0xFF, require the next object identifier code. If more is 0x00,
set to 0x00 (unused).
 Object number: returned object identifier number in the response process.
For single access, the object number is 0x01.
 Object 0.ID: the first object identifier code (stream access) or requested object identifier
code (single access) returned by the PDU.
 Object 0.length: the byte length of the first object.
 Object 0.value: the value of the first object (the byte of the object 0.length).
…
 Object N.ID: the last object identifier code in the response process.
 Object N.length: the byte length of the last object.
 Object N.value: the value of the last object (the byte of the object N.length).
Abnormal response PDU:
Function Code 1 byte 0xAB

Exception Code 2 byte N/A
1.5.3.3 Frame Format Examples

The following are some request examples of the read device identifiers of the basic device
identifiers:
In this example, all objects are returned to one response PDU.
Request Response
Domain Value Domain Value
Function Code 0x2B Function Code 0x2B
MEI Type 0x0E MEI Type 0x0E
ReadDevID Code 0x01 ReadDevID code 0x01
Object ID 0x00 Consistency Level 0x01
More 0x00
Next Object ID 0x00
Object Number 0x03
Object ID 0x00
Object Length 0x16
Object Value "Company
identifier"
Object ID 0x01
Object Length 0x0A
Object Value "Product code"
Object ID 0x02
Object Length 0x05
Object Value "V2.11"
If one device needs several transactions to process responses, execute the following
transactions.
First transaction:
Request Response


Request Response
More 0xFF
Next Object ID 0x02
Object Number 0x03
Object ID 0x00
Object Length 0x16
Object Value "Company
identifier"
Object ID 0x01
Object Length 0x1A
Object Value "Product code"
Second transaction:
Request Response
More 0x00
Next Object ID 0x00
Object Number 0x03
Object ID 0x02
Object Length 0x05
Object Value "V2.11"

1.5.3.4 Query Device Identification Information Command

1.5.3.4.1 Request Frame Format
ReadDevID Code 1 byte 0x01
Object ID 1 byte 0x00
1.5.3.4.2 Response Frame Format

ReadDevID Code 1 byte 0x01
Consistency Level 1 byte 0x01

More 1 byte N/A
Next Object ID 1 byte N/A

Object Number 1 byte N/A
Object List First Object Object ID 1 byte 0x00

Object Length 1 byte N
Object Value N byte N/A
… … … …
Object ID Object Name or Description Category

Description
0x00 Manufacturer name "HUAWEI" Basic

0x01 Product code  "UPS2000"
 "UPS2000A"
0x02 Main revision ASCII character string,
version software version
The product code UPS2000 or UPS2000A will be returned. The signal lists for these two products are
different. For details, see section 2 Modbus Card Signal List.

1.5.4 Definition and Format of Read Command

1.5.4.1 Read Command Definition
This command can be used to read a single or multiple registers.
1.5.4.2 Read Command Format

Byte 0 1 2 3 4 5 6 7
Field ADDR CMD MSB LSB MSB LSB LSB MSB
Descri Control Comma Register starting Number of CRC checking

ption ler nd type address registers n
address
For example, the request frame is 11 03 2A F8 00 01 0F 73.

11 is the slave device address. 03 is the read command. 2AF8 is the register address. 0001 indicates the
number of registers to be read is 1. 0F73 is the CRC checking value.
Byt 0 1 2 3 4 5 6 … L+1 L+2 L+3 L+4

e
Fiel AD CM Len MS LSB MS LSB … MS LSB LSB MS

d DR D gth B B B B
Des Con Co Dat First Second … Last CRC

crip troll mm a register register register checking
tion er and leng value value value
addr type th L
ess =n
x2
For example, the response frame is 11 03 02 00 01 B8 47.

11 is the slave device address. 03 is the read command. 02 is the length of data to be read. 0001 indicates
the first register value to be read. B847 is the CRC checking value.
1.5.5 Definition and Format for the Write Single Register

Command
1.5.5.1 Definition for the Write Single Register Command
This command is used to write to a single register.

1.5.5.2 Format for the Write Single Register Command

Byte 0 1 2 3 4 5 6 7
Descri Control Comma Register address Data CRC checking

ption ler nd type
address
For example, the request frame is 11 06 2B 15 00 01 52 BA.

11 is the slave device address. 06 is the write single register command. 2B15 is the register address.
0001 is the setting value. 52BA is the CRC checking value.
Byte 0 1 2 3 4 5 6 7
Descri Control Comma Register address Data CRC checking

ption ler nd type
address
The format of the request and response frames is the same for the write single device command.
For example, the response frame is 11 06 2B 15 00 01 52 BA.
11 is the slave device address. 06 is the write single register command. 2B15 is the register address.
0001 is the setting value. 52BA is the CRC checking value.

Modbus Protocol Development Guide 2 Modbus Card Signal List
2 Modbus Card Signal List
2.1 Collection and Configuration

2.1.1 Signal List Description
The signal names are the meanings of the signals.
The parameter types are the internal storage states of the signals in the RMS-MODBUS01A
card.
The gains are to ensure that in the Modbus communication, all data are transmitted in the
format of unsigned short integers to avoid the Modbus frames transmitting overly complex
data.
For the R/W attributes, R is read only, W is write only, and RW is read and write.
For the register addresses, N is the UPS number with a range from 1 to 4. This number is
assigned by the RMS-MODBUS01A card. You can identify any UPS number by its
corresponding ESN number.
For example, the register address of the UPS 1 phase A input voltage is 11000 = 0x2AF8.
2.1.2 Collection Signal List

Signal Parameter Gain Unit or Register Address R/W
Namee Type Range Address Length Attribute
(Number
of Digits)
Input phase Floating 10 V N1000 1 R
voltage (A) point
voltage (B) point
voltage (C) point


(Number
of Digits)
Input frequency Floating 10 Hz N1003 1 R

point
Bypass phase Floating 10 V N1004 1 R
voltage (A) point
voltage (B) point
voltage (C) point
Bypass Floating 10 Hz N1007 1 R
frequency point
Output phase Floating 10 V N1008 1 R
voltage (A) point
voltage (B) point
voltage (C) point
Output current Floating 10 A N1011 1 R
(A) point
(B) point
(C) point
Output Floating 10 Hz N1014 1 R
frequency point
Output active Floating 10 kW N1015 1 R
power (A) point
power (B) point
power (C) point
Output Floating 10 kVA N1018 1 R
apparent power point
(A)
(B)


(Number
of Digits)
(C)
Load ratio (A) Floating 10 % N1021 1 R
point
Load ratio (B) Floating 10 % N1022 1 R
point
Load ratio (C) Floating 10 % N1023 1 R
point
Power status Unsigned 1 0: No N1024 1 R
short integer power
(16 bits) supplied
1:
Bypass
mode
2: Mains
mode
3:
Battery
mode
5: Mains
ECO
6:
Battery
ECO
Input mode Unsigned 1 0: N1025 1 R
short integer single-p
(16 bits) hase
1:
three-ph
ase
The
input
system
determi
nes
whether
the
mains
mode is
single-
or
three-ph
ase.


(Number
of Digits)
Output mode Unsigned 1 0: N1026 1 R

short integer single-p
(16 bits) hase
1:
three-ph
ase
The
output
system
determi
nes
whether
the
bypass
and
output
modes
are
single-
or
three-ph
ase.
Inside-UPS Floating 10 °C N1027 1 R
temperature point
Redundant Unsigned 1 0–3 N1041 1 R
number short integer
(16 bits)
Battery voltage Floating 10 V N2000 1 R
point
Battery current Floating 10 A N2001 1 R
point
Battery status Unsigned 1 2: N2002 1 R
short integer hibernat
(16 bits) ing
3:
floating
charging
4:
equalize
d
charging
5:
discharg
ing


(Number
of Digits)
Remaining Unsigned 1 % N2003 1 R
capacity short integer
(16 bits)
Battery backup Unsigned 1 s N2004 2 R
time integer (32
bits)
Battery Floating 10 °C N2006 1 R
temperature point
Parallel output Floating 10 kW N4000 1 R
active power point
(A)
active power point
(B)
active power point
(C)
Parallel output Floating 10 kVA N4003 1 R
(A)
(B)
(C)
Parallel load Floating 10 % N4006 1 R
ratio (A) point
ratio (B) point
ratio (C) point
Device list Unsigned 1 N/A N9004 1 R
change serial short integer
number (16 bits)
Configuration Unsigned 1 N/A N9005 1 R
signal change short integer
serial number (16 bits)
Energy flow Unsigned 1 00: N9006 1 R
diagram short integer


(Number
of Digits)
segment 1 (16 bits) hollow (bit 1, 0)
01: solid
10: flow
to the
right
diagram short integer hollow (bit 3, 2)
segment 2 (16 bits) 01: solid
10: flow
to the
right
10: flow
to the
right
10: flow
downwa
rds
11: flow
upwards
10: flow
to the
right
diagram short integer hollow (bit 11,
segment 6 (16 bits) 01: solid 10)
10: flow
to the
right
10: flow


(Number
of Digits)
to the
right
10: flow
to the
right
UPS hardware Unsigned 1 16: 6 N9007 1 R
power level short integer kVA
(16 bits) 32: 10
kVA
64: 20
kVA
UPS device Unsigned 1 1: N9008 1 R
connection short integer normal
state (16 bits) 0:
disconn
ect
2:
normal
commun
ication,
invalid
service
function
s
Not
used to
determi
ne
whether
the UPS
is
online.
UPS model Floating 10 (0,100] N9009 1 R
point
UPS version Character 1 N/A N9011 10 R
string
The relationship between the state registers' serial numbers and the energy flow diagram are shown in
the following figure.

 When the RMS-MODBUS01A card is connected to only one UPS, you can use 0 as the UPS number.
That is, you can directly use the basic register address to query the corresponding value.
 Some registers may return the following invalid values:
0x7FFF: invalid value of the floating point type returned by one register
0xFFFF: invalid value of a type other than the floating point type returned by one register
0xFFFFFFFF: invalid value returned by two registers
2.1.3 Configuration and Control Signal List

Signal Parameter Range Gain Register Address R/W
Name Type Address Length Attribute
(Number
of
Digits)
Startup Unsigned 00: Shutdown 1 N1028 1 R
state short integer (you can start)
(16 bits) 01: Starting
(intermediate
state, unable to
perform any
actions, LCD is
locked)
10: startup
failed (you can
power on)
11: startup
completed (you
can power off)
Startup Unsigned The register 1 N1029 1 W
short integer value is fixed at
(16 bits) 1.


(Number
of
Digits)
Shutdow Unsigned The register 1 N1030 1 W
n short integer value is fixed at
(16 bits) 1.
Single Unsigned 0: disabled 1 N1031 1 R
UPS short integer 1: enabled
ECO (16 bits)
Only
configurable
when the
startup state is
00 or 10.
EPO Unsigned The register 1 N1042 1 W
short integer value is fixed at
(16 bits) 1.
Shallow Unsigned 0: disabled 1 N2008 1 RW
discharg short integer 1: enabled
e test* (16 bits)
Time Unsigned 30 ~90 Day 1 N2009 1 RW
interval* short integer
(16 bits)
Discharg Unsigned 10~50% 1 N2010 1 RW
e ratio* short integer
(16 bits)
Battery Unsigned 0: yes 1 N2011 1 R
conversi short integer Non-zero: no
on from (16 bits)
floating
charging
to
equalize
d
charging
*
Battery Unsigned The register 1 N2012 1 W
conversi short integer value is fixed at
on from (16 bits) 1.
manual
charging
to
equalize
d
charging
*


(Number
of
Digits)
conversi short integer Non-zero: no
on from (16 bits)
equalize
d
charging
to
floating
charging
*
Battery Unsigned The register 1 N2016 1 W
conversi short integer value is fixed at
on from (16 bits) 1.
manual
charging
to
floating
charging
*
Battery Unsigned 0: Both a 1 N2019 1 R
test* short integer shallow
(16 bits) discharge test
and a capacity
test can be
conducted.
If bit 15 is 1
and bits 14–8
are 0: Only a
shallow
discharge test
can be
conducted.
Other cases:
No test can be
conducted.
Shallow Unsigned The register 1 N2020 1 W
discharg short integer value is fixed at
e test* (16 bits) 1.
Capacity Unsigned The register 1 N2021 1 W
test* short integer value is fixed at
(16 bits) 1.
test short integer Non-zero: no
stop* (16 bits)


(Number
of
Digits)
Stop Unsigned The register 1 N2023 1 W
test* short integer value is fixed at
(16 bits) 1.
The UPS2000A does not support battery tests or the switching between equalized charging and float
charging. The signal name is marked with * to differentiate.
2.2 Alarms
2.2.1 Signal List Description
The definitions for the UPS alarm register addresses comply with the following rules:
Register address: basic register address + UPS number x 1024
The range of the UPS number is from 1 to 4.
 For example, the register address of the UPS 1 mains abnormal voltage alarm is 40155 + 1024 =
41179 = 0xA0DB; the register address of the UPS 2 mains abnormal voltage alarm is 40155 + 2 x
1024 = 42203 = 0xA4DB.
 When the RMS-MODBUS01A card is connected to only one UPS, you can use 0 as the UPS number.
That is, you can directly use the basic register address to query the corresponding value.
If the query is across registers, and a register is not defined in this table, the returned register
value is 0.
2.2.2 Alarm Signal List

Alarm Alarm Alarm Basic Bit
ID Cause Register Value
ID Address
0041 1 Rectifier fault 40155 0
0045 3 Charger alarm 40155 4


ID Address
0001 1 Abnormal mains voltage 40155 10

0006 1 Mains undervoltage 40155 11
0004 1 Mains phase reverse 40155 14
0005 1 Mains neutral loss 40155 15
0007 1 Battery transfer overlimit 40156 0
0008 1 Rectifier start overlimit 40156 1
0009 1 Mains overload 40156 2
0030 1 UPS internal overtemperature 40156 3
0065 2 Power segment 40156 5
0061 1 Inverter alarm 40158 0
0061 2 Inverter alarm 40158 1
0065 1 Power segment 40159 0
0067 1 Parallel set failure 40159 1
0084 2 Parallel cable alarm 40159 2
0084 3 Parallel cable alarm 40159 3
0094 1 Redundancy failure 40159 4
0131 1 Ambient overtemperature 40160 0
0133 1 Ambient undertemperature 40160 1
0134 1 Ambient overhumidity 40160 2
0135 1 Ambient underhumidity 40160 3
0136 1 Faulty temperature and humidity 40160 4
module
0340 1 Maintenance breaker ON 40160 5
0010 1 Abnormal bypass voltage 40161 1
0010 2 Abnormal bypass voltage 40161 2
0011 1 Bypass phase reverse 40161 3
0023 1 Battery overtemperature 40163 0


ID Address
0024 1 Battery undertemperature 40163 2

0025 1 Battery overvoltage 40163 3
0027 1 Battery overcurrent 40164 0
0029 1 Maintain battery 40164 1
0036 1 Battery maintenance notification 40164 2
0026 1 Battery undervoltage 40164 3
0086 1 Bypass transfer overlimit 40165 2
0012 1 Bypass neutral loss 40165 6
0096 1 Abnormal ECO voltage 40165 13
0028 1 Breaker OFF 40168 0
0028 2 Breaker OFF 40168 1
0028 3 Breaker OFF 40168 2
0105 5 Communication failure 40168 3
0125 1 Inconsistent parallel parameters 40168 4
61440 1 Flash fault 40168 5
0042 1 Internal fault 40169 13
0044 1 Incompatible version 40169 15
0020 1 Battery reverse 40170 2


ID Address
0022 1 No battery 40170 4

0043 1 Fan fault 40170 10
0032 1 Battery OTP 40170 13
0043 6 Fan fault 40171 0
0159 1 Battery mode alarm 40171 8
0060 1 Inverter fault 40172 0
0064 1 Overload timeout. 40173 3
0066 1 Output overload 40173 5
0014 1 Startup timeout 40174 0
0064 2 Overload timeout 40174 2
0070 1 Bypass fault 40174 4


ID Address
0070 2 Bypass fault 40174 5

0071 1 Bypass backfeed 40174 6
0083 1 Parallel cable fault 40174 7
0107 1 Module internal fault 40174 12
0158 1 Bypass mode alarm 40174 13
0031 1 Battery OTP 40179 3
0035 1 Replace battery 40180 0


ID Address

0085 1 EPO 40182 5
0043 2 Fan fault 40182 11
0058 1 Flash fault 40182 12
0059 1 Maintenance breaker ON 40182 15
0034 1 Remaining cap. warning 40183 2

Modbus Protocol Development Guide 3 Examples for the Host Communication Process
3 Examples for the Host Communication

Process
According to the command types of the communication protocols, you can identify the
register addresses of every UPS semaphore. There is a need for the UPS serial number offset.
Before collecting and setting the UPS semaphores, query the condition of the southbound
connections between the RMS-MODBUS01A card and the UPS, and confirm the number
assigned to every UPS by the RMS-MODBUS01A card, ensuring normal query of
semaphores needed.
The following diagram shows a communication process for reference.

A. Query device identification information.

Query frame: 11 2B 0E 01 00 B1 B4
Response frame (for the convenience of viewing, the response frame is shown in segments):
11 2B 0E 01 01 00 00 03 00 06 48 55 41 57 45 49 01 07 55 50 53 32 30 30 30
02
13 55 50 53 32 30 30 30 20 56 31 30 30 52 30 30 31 43 30 30 D9 03
According to section 1.5.3.4 Query Device Identification Information Command the
following information can be obtained.
Object ID Object Name or Description Description

0x00 Manufacturer name HUAWEI
0x01 Product code UPS2000
0x02 Main revision version UPS2000 V100R001C00

B. Query the status of UPSs 1–4 on a regular basis.

Take querying the status of UPS 1 as an example. The signal collecting register address of the
UPS 1 phase A input voltage is 11000, which is 0x2AF8 in hexadecimal format.
Query frame: 11 03 2A F8 00 01 0F 73
Response frame: 11 03 02 08 9D BF EE
When there is response data, it means that UPS 1 exists. If there is no response data, it means
that No. 1 does not connect to a UPS, or the connected UPS fails in communication.
Continue to query the registers of No. 2 (0x5208), No. 3 (0x7918), and No. 4 (0xA028) to
obtain the status of UPSs 2–4.
Next, according to the UPS number, you can query and set the corresponding semaphores.
C. Query the phase A input voltage of UPS 1:
Query frame: 11 03 2A F8 00 01 0F 73
Response frame: 11 03 02 08 9D BF EE
According to section 2.1.2 Collection Signal List, the register address of the UPS 1 phase A
input voltage is 11000, which is 0x2AF8 in hexadecimal format. The response data is 0x089D,
which is 2205 in decimal format. Divided by the gain 10, the value is 220.5, which indicates
the phase A input voltage of UPS 1 is 220.5 V.
D. Control UPS 2 to switch from manual charging to equalized charging:
Set frame: 11 06 55 FC 00 01 9B 66
Response frame: 11 06 55 FC 00 01 9B 66
E. Query UPS 3 battery undervoltage alarm state:
Query frame: 11 03 A8 E4 00 01 E6 CD
Response frame: 11 03 02 00 08 78 41
The basic register address of the battery undervoltage alarm is 40164. Add the UPS 3 offset
address to get:
40164 + 3 x 1024 = 43236 = 0xA8E4
The response data is 0x0008, and the bit3 value is 1, indicating the battery undervoltage alarm
exists.

Modbus Protocol Development Guide A Acronyms and Abbreviations
A Acronyms and Abbreviations
C
CRC Cyclical Redundancy Check
E
ECO Economic Control Operation
EOD End Of Discharge
EPO Emergency Power Off
U
UPS Uninterruptible Power Supply


Huawei Ups Alarm Table

Uploaded by

Copyright:

Available Formats

Huawei Ups Alarm Table

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Huawei Ups Alarm Table

Uploaded by

Copyright:

Available Formats

UPS2000-(6 kVA-20 kVA)

Modbus Protocol Development

HUAWEI TECHNOLOGIES CO., LTD.

Trademarks and Permissions

Huawei Technologies Co., Ltd.

Issue 02 (2016-03-10) Huawei Proprietary and Confidential i

About This Document

Indicates a potentially hazardous situation which, if not

Indicates a potentially hazardous situation which, if not

Indicates a potentially hazardous situation which, if not

Issue 02 (2016-03-10) Huawei Proprietary and Confidential ii

Issue 02 (2016-03-10) Huawei Proprietary and Confidential iii

About This Document .................................................................................................................... ii

2 Modbus Card Signal List ........................................................................................................... 18

Issue 02 (2016-03-10) Huawei Proprietary and Confidential iv

2.1.2 Collection Signal List .............................................................................................................................................. 18

3 Examples for the Host Communication Process ................................................................... 34

Issue 02 (2016-03-10) Huawei Proprietary and Confidential v

1.1 Protocol Description

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 1

1.3 Physical Interface

1.3.2 Data Transmission Speed

1.3.3 Cable Connection

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 2

Figure 1-1 DIP switch

Figure 1-2 Describes the address DIP switch S2

Table 1-1 Mapping between addresses and toggle switches

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 3

Addre Toggle Toggle Toggle Toggle Toggle Toggle Toggle Toggle

Step 2 Set the communication form for the Modbus card.

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 4

Figure 1-3 Functional DIP switch S1

Table 1-2 Description of the functional DIP switch S1

Toggle Switch Definition Settings Remarks

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 5

Toggle Switch Definition Settings Remarks

Step 4 Set up a network, as shown in Figure 1-5.

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 6

Figure 1-5 Connecting cables for the Modbus card

Figure 1-6 RJ45 ports

Table 1-3 Pins on an RJ45 port

Pin Signal Corresponding Signal of RS232-RS485

Two-wire system Four-wire system

1 Four-wire system: RS485 TX+ A RS485 RX+

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 7

Pin Signal Corresponding Signal of RS232-RS485

Two-wire system Four-wire system

1.4 Communication Mode at the Physical Layer

Table 1-4 Error code list

No. Name Description

0x01 Invalid function code Slave nodes received

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 8

1.5 Command Type and Format at the Application Layer

1.5.2 CRC Checking Algorithm

Issue 02 (2016-03-10) Huawei Proprietary and Confidential 9

1.5.3 Definition and Format for the Read Device Identifier

Field ADDR CMD MEI ReadDev Target ID LSB MSB

Desc Controlle Functio MEI ReadDev Object CRC checking

1.5.3.2 Command Definition