frontier modbus protocol user guide · 2018. 1. 23. · 3.6.0-01 4 introduction this document...

Modbus Protocol User Guide

3.6.0-01 2

3.6.0-01 3

Contents

Modbus Protocol User Guide ........................................................................................................................ 1

Introduction .............................................................................................................................................. 4

Specification .............................................................................................................................................. 4

Register Polling Rates ............................................................................................................................ 4

System Overview Register Map ............................................................................................................ 5

String Information Register Map .......................................................................................................... 7

Translating Modbus Registers ................................................................................................................. 12

Decoding 32-bit (2-Register) Values ................................................................................................... 12

Decoding Example ........................................................................................................................... 12

Decoding Flag Registers ...................................................................................................................... 13

Alarm Status, Battery Status, String Status ..................................................................................... 13

String Status (Thermal Runaway) .................................................................................................... 14

Channel Status (Thermal Runaway) ................................................................................................ 15

Channel Status (voltage, temperature, Ohmic value) .................................................................... 15

Channel Status (logical current) ...................................................................................................... 16

Channel Status (FED) ....................................................................................................................... 16

Interpreting Current Readings ............................................................................................................ 17

Decoding Label Registers .................................................................................................................... 17

3.6.0-01 4

Introduction

This document outlines the Modbus communication protocol for communication between Cellwatch

Frontier and third party building management systems. Frontier utilizes this protocol as the basis for

communicating information from the Frontier device to external systems. Note that collecting battery

data alone is not a suitable solution to monitoring batteries. The collected data should be recorded for

historical purposes, evaluated, and trended to help determine how much a cell has changed from

baseline values and whether parameters are within acceptable limits.

Note: This guide may be subject to change with new releases.

The terminology used within Cellwatch Frontier (and throughout this document) can be found below:

Cell A self-contained unit consisting of a single chemical unit for the lead acid chemistry (i.e. 2V nominal).

Jar A self-contained unit containing 2 or more cells.

String A number of series connected cells or jars.

Battery One or many strings of cells or jars.

System The entire array of batteries monitored by one Frontier device.

DCM Data collection module (Optically isolated device with 4 data channels each).

HR Used to identify a Holding Register address. For example, HR53 would correspond to a Holding Register at register offset 53, or 40053.

Specification

The register map below defines where data is found in the Holding Registers (40000 address range). All

data is available at Device 1.

Register Polling Rates Users should not attempt to access more than 100 registers at any given time. The polling rate should be

no more than 250ms between polls, with a suggested polling rate of 4 seconds or longer.

3.6.0-01 5

System Overview Register Map Registers HR01 through HR512 are fixed addresses. The data obtained from these registers remains the

same regardless of the Selected Battery Number (HR53) and Selected String Number (HR54).

Note: A Frontier system can monitor up to four batteries.

Description Register Offset

Range Units Static Writable

Syst

em S

um

mar

y

Name 1 32 Yes

Number of Batteries Configured 33 1 Yes

Number of Current Probes Configured 34 1 Yes

Number of DCMs (Total Actual Detected) 35 1 Yes

Number of Channels (Total Actual Detected) 36 1 Yes

Last Scan Year 37 1

Last Scan Month 38 1

Last Scan Day 39 1

Last Scan Hour 40 1

Last Scan Minute 41 1

Last Scan Second 42 1

Alarm Status (LSW) 43 1

Scan Status (LSW) 44 1

Scan Status (MSW) 45 1

Scanner Software Version 46 1 Yes

Modbus Software Version 47 1 Yes

Scan Control Flags 48 1

Alarm Relay Control Bits (LSW) 49 1

Alarm Relay State 50 1

Ohmic Scan Schedule Hour 51 1

Ohmic Frequency (Days) 52 1

Selected Battery Number ‘B’ 53 1 Yes Yes

Selected String Number ‘S’ 54 1 Yes Yes

TOD Year 55 1

TOD Month 56 1

TOD Day 57 1

TOD Hour 58 1

TOD Minute 59 1

TOD Second 60 1

Alarm Status (MSW) 61 1

Alarm Relay Control Bits (MSW) 62 1

…

Ph

ysic

al C

T

Physical CT1 (LSW) 81 2 mA

Physical CT1 (MSW) 82





3.6.0-01 6


Physical CT4 (MSW) 88 …

Bat

tery

1

Battery1 Label [0,1] 129 32 Yes

[2,3] 130

[4,5] 131

[6,7] 132

[8,9] 133

… …

[62,63] 160

Battery1 String Count 161 1 Yes

Battery1 Status (LSW) 162 1

Battery1 Status (MSW) 163 1

… …

Bat

tery

2


[2,3] 178

[4,5] 179

[6,7] 180

[8,9] 181

… …

[62,63] 208




… …

Bat

tery

3


[2,3] 226

[4,5] 227

[6,7] 228

[8,9] 229

… …

[62,63] 256




… …

Bat

tery

4


[2,3] 274

[4,5] 275

[6,7] 276

[8,9] 277

… …

[62,63] 304




3.6.0-01 7

… … … …

String Information Register Map The string information register map is shown below. The data returned in this map is dependent upon

the Battery and String contained in HR53 (Selected Battery Number) and HR54 (Selected String

Number). By default, the Frontier system will show the data for Battery 1, String 1 in the string

information map. This corresponds to ‘1’ for both HR53 and HR54.

HR53 and HR54 are writable registers; writing values to these registers will display the string information

for the specified Battery and String. For example, if a ‘1’ is written to HR53 and a ‘2’ is written to HR54,

then the string information map below will return the data for Battery 1, String 2. If a hardware

component (such as a CT or TP) is not assigned to a String, then it will not show up in the string

information map.

The components or resources assigned to a String are viewed in logical order. If TP2 and TP3 are

assigned to Battery 1, String 2, then the data for TP2 will be found in “Temperature Probe 1” and the

data for TP3 will be found in “Temperature Probe 2” on the map below.

Data Register Offset

Range Units Static

Stri

ng

Label 513 32 Yes

… … …

Number of DCMs Configured 545 1 Yes

Channels Count Detected 546 1 Yes

Input Bit Count Configured 547 1 Yes

Logical Current Probe Configured 548 1 Yes

Temperature Probe Count Configured 549 1 Yes

Voltage (calculated) 550 1 cV

Average Voltage (calculated) 551 1 cV

Number of Averaged Measurements 552 1

Voltage Status 553 1

Voltage High Limit 554 1 cV

Voltage Low Limit 555 1 cV

Voltage Hysteresis 556 1 cV

Voltage Thermal Limit 557 1 cV

Voltage Limit Low Discharge 558 1 cV

Ohmic Value (calculated) 559 1 10 μΩ

Average Ohmic Value (calculated) 560 1 10 μΩ

Number of Averaged Measurements 561 1

Ohmic Value Status 562 1

Ohmic Value High Limit 563 1 10 μΩ

Ohmic Value Low Limit 564 1 10 μΩ

Ohmic Value Hysteresis 565 1 10 μΩ

String Status (LSW) 566 1

Ripple Voltage 567 1 mV

3.6.0-01 8

Ripple Average 568 1 mV

Ripple Average Count 569 1

Ripple Status 570 1

Ripple Limit 571 1 mV

Ripple Hysteresis 572 1 mV

Thermal Runaway Status 573 1

Thermal Runaway Year 574 1

Thermal Runaway Month 575 1

Thermal Runaway Day 576 1

Thermal Runaway Hour 577 1

Thermal Runaway Minute 578 1

Thermal Runaway Second 579 1

Thermal Runaway Duration 580 1 mins

Thermal Runaway Time-To-Cutoff (LSW) 581 1 secs

Thermal Runaway Time-To-Cutoff (MSW) 582 1

Thermal Runaway Hold Delay (LSW) 583 1 secs

Thermal Runaway Hold Delay (MSW) 584 1

String Status (MSW) 585 1

…

Logi

cal C

urr

ent

Label 641 32 Yes

… … … …

Current Value (LSW) 673 2 mA

Current Value (MSW) 674

Average (non-Discharge, LSW) 675 2 mA

Average (non-Discharge, MSW) 676

Average Count 677 1

Current Status 678 1

Discharge Peak (LSW) 679 2 mA

Discharge Peak (MSW) 680

Charge Peak (LSW) 681 2 mA

Charge Peak (MSW) 682

Discharge Start Year 683 1

Discharge Start Month 684 1

Discharge Start Day 685 1

Discharge Start Hour 686 1

Discharge Start Minute 687 1

Discharge Start Second 688 1

Discharge Duration (LSW) 689 2 secs

Discharge Duration (MSW) 690

Bulk Charge Start Year 691 1

Bulk Charge Start Month 692 1

Bulk Charge Start Day 693 1

Bulk Charge Start Hour 694 1

Bulk Charge Start Minute 695 1

Bulk Charge Start Second 696 1

Bulk Charge Duration (LSW) 697 2 secs

3.6.0-01 9

Bulk Charge Duration (MSW) 698

Discharge Limit (LSW) 699 2 mA

Discharge Limit (MSW) 700

Charge Limit (LSW) 701 2 mA

Charge Limit (MSW) 702

Hysteresis 703 1 mA

…

Inp

ut

Bit

InputBit1 Label 737 32 Yes

… … … …

InputBit1 State 769 1

InputBit1 Alarm 770 1

InputBit1 Limit (On/Off) 771 1

Inp

ut

Bit


… … … …




Inp

ut

Bit


… … … …




Inp

ut

Bit


… … … …




…

Tem

per

atu

re P

rob

e

Temperature Probe1 Name 929 32 Yes

… … … …

Temperature Probe1 Value 961 1 c°C

Temperature Probe1 Average 962 1 c°C

Temperature Probe1 Average Count 963 1

Temperature Probe1 Status 964 1

TP1 High Limit 965 1 c°C

TP1 Low Limit 966 1 c°C

TP1 Hysteresis 967 1 c°C

TP1 Thermal Runaway Limit 968 1 c°C

…


… … … …



3.6.0-01 10







…

Tem

per

atu

re P

rob

e


… … … …









…

Tem

per

atu

re P

rob

e


… … … …









…

DC

M T

emp

erat

ure

Pro

be

Temperature (DCM) Value 1265 256 c°C

… … …

Temperature (DCM) Average 1521 256 c°C

… … …

Temperature (DCM) Average Count 1777 256

… … …

Temperature (DCM) Status 2033 256

… … …

Temperature (DCM) High Limit 2289 256 c°C

… … …

Temperature (DCM) Low Limit 2545 256 c°C

… … …

Temperature (DCM) Hysteresis 2801 256 c°C

… … …

Temperature (DCM) Thermal Runaway Limit 3057 256 c°C

… … …

3.6.0-01 11

Vo

ltag

e Voltage Value 3313 256 mV

… … …

Voltage Average 3569 256 mV

… … …

Voltage Average Count 3825 256

… … …

Voltage Status 4081 256

… … …

Voltage High Limit 4337 256 mV

… … …

Voltage Low Limit 4593 256 mV

… … …

Voltage Hysteresis 4849 256 mV

… … …

Voltage Thermal Runaway Limit 5105 256 mV

… … …

Voltage Low Discharge Limit 5361 256 mV

… … …

Oh

mic

Val

ue

Ohmic Value 5617 256 μΩ

… … …

Ohmic Value Average 5873 256 μΩ

… … …

Ohmic Value Average Counts 6129 256

… … …

Ohmic Value Status 6385 256

… … …

Ohmic Value High Limit 6641 256 μΩ

… … …

Ohmic Value Low Limit 6897 256 μΩ

… … …

Ohmic Value Hysteresis 7153 256 μΩ

… … …

Ohmic Value Last Measurement Year 7409 256

Ohmic Value Last Measurement Month s+1

Ohmic Value Last Measurement Day s+2

Ohmic Value Last Measurement Hour s+3

Ohmic Value Last Measurement Minute s+4

Ohmic Value Last Measurement Second s+5

… … …

Ther

mal

Ru

naw

ay Thermal Runaway Channel Status 8945 256

… … …

Thermal Runaway Channel Duration (LSW)

9201 256

Thermal Runaway Channel Duration (MSW) …

Thermal Runaway Channel Timestamp, Year 9713 256

Thermal Runaway Channel Timestamp, Month s+1

3.6.0-01 12

Thermal Runaway Channel Timestamp, Day s+2

Thermal Runaway Channel Timestamp, Hour s+3

Thermal Runaway Channel Timestamp, Minute s+4

Thermal Runaway Channel Timestamp, Second s+5

… … …

FED

FED Electrolyte Level Status 13297 256

FED Electrolyte Alarm Enabled 13553 256

… … …

end 13809

*Note that any otherwise defined Modbus Register that points to an entity that is not configured (Ex. Battery # String # does

not exist in the configuration) will always display "-1". Empty slots (otherwise unassigned Holding Registers) display "0".

Translating Modbus Registers

This section will explain how to interpret the Modbus registers for integration into a SCADA system.

Note that all HR references are interpreted as Holding Register.

Decoding 32-bit (2-Register) Values In Modbus, Holding Registers contain 16-bit values. In the Frontier Modbus specification, many data

points are 32-bit values, meaning that they are spread across two registers. In the register map defined

above, 32-bit values are split between the Least Significant Word (LSW) and Most Significant Word

(MSW).

To interpret 32-bit values correctly, the LSW must be read first. The MSW will then be read, shifted left

16 bits (multiply by 216), and combined by adding (or bitwise OR) with the LSW. The result is the 32-bit

value for that particular data point.

Decoding Example

Using the Alarm Status LSW and MSW registers (HR43 and HR61, respectively): Integer 16-bit Binary Polling HR43 results in: 22 0000000000010110 Polling HR61 results in: 1 0000000000000001 Now, take the value in HR61 and multiply it by 216, then add it to the value in HR43:

1 ∗ 216 = 65536 65536 + 22 = 65558

The resulting 32-bit integer value is 65558. This can be converted to 32-bit binary in order to determine which bits are set. Integer 32-bit Binary HR61 + HR43 results in: 65558 0000000000000001 0000000000010110

3.6.0-01 13

By decoding the 32-bit value, we determine that the following alarms have occurred:

Low Voltage Alarm

High Ohmic Alarm

High Temperature Alarm

FED Failure

Decoding Flag Registers The next few sections will define the bit flag registers that Frontier uses to indicate the status of the

system and its various hardware components. Most flag registers are 16 or 32 bits wide (one or two

registers wide) where each individual bit represents a status.

Alarm Status, Battery Status, String Status

The status registers are 32-bit values that are made up of a Least Significant Word (LSW) and Most

Significant Word (MSW). These two registers are bit flag registers where each individual bit represents a

status. Each bit, when set to 1, indicates that the associated alarm is present somewhere in the Frontier

system. The presence of any of these alarms causes the Battery Alarm LED to turn on if the associated

Enable bit (HR49) is set to 1.

Note: Bit 14 is not an alarm and does not appear in the Alarm Status; it is only an indicator within

Battery Status or String Status.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Low

Electrolyte

Alarm

Pro

be Failu

re

DC

M Failu

re Alarm

DIB

s Alarm

Cu

toff2 A

larm

Cu

toff1 A

larm

Therm

al Ru

naw

ay Alarm

Rip

ple V

oltage A

larm

Ch

arging A

larm

Disch

arging A

larm

Low

Temp

erature A

larm

High

Temp

erature A

larm

Low

Oh

mic A

larm

High

Oh

mic A

larm

Low

Vo

ltage Alarm

High

Vo

ltage Alarm

The bit flags for the Status LSW.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

Alw

ays 0

Alw

ays 0

Alw

ays 0

Alw

ays 0

--

--

--

--

--

--

--

--

--

--

--

FED Failu

re

The bit flags for the Status MSW.

3.6.0-01 14

The definition for each flag can be found in the table below:

Flag Description

High Voltage Alarm High-Limit(s) exceeding either at the cell, or at the String level in a Battery. Low Voltage Alarm Low-Limit(s) exceeding either at the cell, or at the String level in a Battery. High Ohmic Alarm High-Limit(s) exceeding either at the cell, or at the String level in a Battery. Low Ohmic Alarm Low-Limit(s) exceeding either at the cell, or at the String level in a Battery. High Temperature Alarm

High-Limit(s) exceeding either at the cell, or at the String level in a Battery.

Low Temperature Alarm

Low-Limit(s) exceeding either at the cell, or at the String level in a Battery.

Discharging Alarm One or more of the four Current measurements is exceeding its set Discharge limit.

Charging Alarm One or more of the four Current measurements is exceeding its set Bulk Charging limit.

Ripple Voltage Alarm String(s) exceeding its AC Ripple limit. Thermal Runaway Alarm

String(s) exceeding the combination of Voltage and Temperature Thermal Runaway Limits. This alarm will be removed if either of the two conditions returns to normal.

Cutoff1 Alarm A String assigned to Cutoff1 has been in Thermal Runaway state for more than the time limit (up to 24hrs). This condition must be manually cleared.

Cutoff2 Alarm A String assigned to Cutoff2 has been in Thermal Runaway state for more than the time limit (up to 24hrs). This condition must be manually cleared.

DIBs Alarm Digital Input(s) entered a binary state assigned as an Alarm. DCM Failure Alarm DCMs are not communicating. Probe Failure Current or Temperature Probes are not connected or are not providing

signal. Low Electrolyte Alarm One or more FEDs has indicated Low Electrolyte Level. FED Failure One or more FEDs have failed to report or cannot be accessed.

String Status (Thermal Runaway)

The Thermal Runaway Status is a bit flag register where each individual bit represents a status. Each bit,

when set to 1, indicates that the associated alarm is present somewhere in the Frontier system. Below

are the bit flag definitions for Thermal Runaway Status on a String level.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

--

--

--

--

--

--

--

--

--

Ru

naw

ay Mem

ory

--

--

--

--

Therm

al Cu

toff

Therm

al Ru

naw

ay

3.6.0-01 15


Flag Description

Thermal Runaway Thermal Runaway has been detected on this String. Thermal Cutoff The String has been disconnected from the Battery due to Thermal

Runaway. Runaway Memory Set if the String has entered Thermal Runaway at any time since the

Frontier system has been running, even if it is no longer in Thermal Runaway. This will not persist through a reboot of the Frontier device.

Channel Status (Thermal Runaway)

This status register is similar to the String Status for Thermal Runaway, except that it only contains the

Thermal Runaway flag, or bit 0. The Thermal Cutoff (bit 1) and Runaway Memory (bit 6) flags are not

applicable to Channel Status.

Channel Status (voltage, temperature, Ohmic value)

Channel status registers are bit flag registers where each individual bit represents a status. Each bit,


are the bit flag definitions for voltage, temperature, and Ohmic value status.

Note: Thermal runaway does not take Ohmic value into account, so the Thermal Watch Alert flag (bit 6)

is not defined for Ohmic value status registers.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

--

--

--

--

--

--

--

--

--

Therm

al Watch

Alert

--

--

--

--

Low

Alarm

High

Alarm

The bit flags for Channel Status. Thermal Watch Alert is defined for voltage and temperature only.


Flag Description

High Alarm Measurement has risen above the preset high alarm limit. Low Alarm Measurement has fallen below the preset low alarm limit. Thermal Watch Alert Voltage/Temperature has risen above the preset limit at which it is

considered a Thermal Runaway condition.

3.6.0-01 16

Channel Status (logical current)



are the bit flag definitions for logical current probe status.

Note: A logical current probe is made up of one or more physical current transducers assigned to a

string.

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0

--

--

--

--

--

--

--

--

--

--

--

--

--

--

Ch

arge Alert

Disch

arge Alarm


Flag Description

Discharge Alarm Current value has exceeded the preset discharge limit. Charge Alert Current value has exceeded the preset charge limit.

Channel Status (FED)



are the bit flag definitions for the status of each Frontier Electrolyte Level Detector (FED).

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 --

--

--

--

--

--

--

--

--

--

--

--

--

--

Read

Failure

Low

Level Alarm


3.6.0-01 17

Flag Description

Low Level Alarm The FED unit has indicated low electrolyte level in the monitored container. Read Failure The FED unit could not be accessed during a read attempt. It may be

disconnected or damaged.

Interpreting Current Readings Current (H/R 641-701) is always presented in Modbus as a 32-bit Logical Current, which is made up of

either a single Charge/Discharge CT, or a combination of two CTs arranged and configured as Discharge

CT and Charge CT.

The range of Currents within Frontier is +/-1000.000 Amps, which is represented as an integer number.

Thus, the integer representation is -1000000 to +1000000 (mA), and so a 32-bit presentation is needed.

In Frontier’s Modbus, all Currents and related Limits are presented as 2-register accesses, LSW first

(Little Endian). That means that to read a Current, the first register must be read. The next higher-

addressed register, MSW, is read, shifted left 16 bits (multiply by 2^16), and combined (add, or OR) with

the LSW. The resulting number is the Current reading.

Direct (Physical) CT readings are displayed at H/R 81-88 as sets of 32-bit values, in mA units.

Decoding Label Registers All text is handled entirely as UTF-8 characters, which may have a variable byte length depending on the

character set. US/ASCII characters all map into a single-byte-per-character space, so may be easily

accounted. Non-English languages may be accommodated, as well as international symbols, but may

require two or more bytes per character.

64 bytes of space are reserved for each label. Thus up to 64 English characters are available or less than

64 characters for certain non-English character sets where more than two bytes are used per character.

Modbus mapping reserves 32 Holding Registers per Label for each entity. The mapping is from low

register, MSB to high Register LSB, such that the first character byte is placed in the MSB of the first

register. The second byte is placed in the second register, and so on, until all available bytes are

mapped. The remaining register space, if any, is filled with 0x00s. A US ASCII string of "Frontier1" would

be represented as:

ASCII F r o n t i e r 1 …

hex 0x45 0x72 0x6F 0x6E 0x74 0x69 0x65 0x72 0x31 0

Which translates to a Modbus mapping:

3.6.0-01 18

Holding Register Offset Contents

0 0x4572

1 0x6F6E

2 0x7469

3 0x6572

4 0x3100

5 0x0000

6 0x0000

… 0x0000

31 0x0000

Now try Greek letters, the first six Alphabet characters:

Character α β γ δ ε ζ

hex 0xCEB1 0xCEB2 0xCEB3 0xCEB4 0xCEB5 0xCEB6

In Modbus, these become a series of Holding Registers that maps well because they all happen to

occupy two bytes:


0 0xCEB1

1 0xCEB2

2 0xCEB3

3 0xCEB4

4 0xCEB5

5 0xCEB6

6 0x0000

… 0x0000

31 0x0000

However, some common symbols, €®¢£ would require varying numbers of bytes, up to 4 bytes per character:

Symbol € ® ¢ £ Ω

hex 0xE282AC 0xC2AE 0xC2A2 0xC2A3 0xE284A6

Would be represented in Modbus Holding Registers as:

3.6.0-01 19


0 0xE282

1 0xACC2

2 0xAEC2

3 0xA2C2

4 0xA3E2

5 0x84A6

6 0x0000

… 0x0000

31 0x0000

Determination of whether characters will occupy two bytes or four bytes will be dependent on the

battery name and characters entered. This will largely be dependent on the localized settings for the

Frontier system.

frontier modbus protocol user guide · 2018. 1. 23. · 3.6.0-01 4 introduction this document...

Documents