Draft SMW Modbus Spec 20151210

WEGDrives&ControlsAutomaoLtda
RelsEletrnicos/SmartGrid
RichardH.Baeumle
PauloC.S.Ficagna
December2015
Draft
SMWSecureMODBUSCommunicationProtocolSpecification
Abstract
ThisdocumentdescribestheMODBUSclient/servercommunicationforWEG
SmartMetersandclientdevices.
Copyrightnotice
Copyright2015WEGAutomacaoLtda.AllRightsReserved.Donotduplicate
ordistributewithoutwrittenpermissionfromWEGDrives&Controls
AutomaoLtda.
Distributionlist
CompanyContactname
WAY2AdrissonC.Floriano<adrisson.floriano@way2.com.br>
Baeumle,Ficagna
Confidential
[Page1]
TableofContents
1.Introduction
..................................................... 4
1.1.Features
..................................................... 4
1.2.Terminology
.................................................. 4
2.SMWSecureModbusProtocol
....................................... 4
2.1.MessagingModel
.............................................. 5
2.2.Query/ReplyModel
............................................ 5
2.3.SecureSession
............................................... 5
3.MessageSemantics
................................................ 6
3.1.Read
......................................................... 6
3.2.Write
........................................................ 6
3.3.Read+Write
................................................... 6
4.MessageTransmission
............................................. 6
4.1.MessageSize
................................................. 7
4.2.Endianess
.................................................... 7
4.3.TransmissionParameters
...................................... 7
5.EstablishingaSecureSession
.................................... 7
5.1.DeviceIdentification
........................................ 8
5.2.ExchangePublicKeys
......................................... 9
5.3.ExchangeSignaturesofPublicKeys
.......................... 10
5.4.ExchangeDiffieHellmanPublicValues
....................... 11
5.5.ExchangeSignaturesofDiffieHellmanPublicValues
......... 14
5.6.SharedSecretGeneration&EncryptedCommunication
.......... 15
5.7.Troubleshooting
............................................. 15
6.Messages&Description
.......................................... 16
6.1.FirmwareIdentification
..................................... 16
6.2.InstantaneousValues
........................................ 17
6.2.1.RMSVoltage
.......................................... 17
6.2.2.RMSCurrent
.......................................... 18
6.2.3.ActivePower
......................................... 18
6.2.4.ReactivePower
....................................... 19
6.2.5.ApparentPower
....................................... 20
6.2.6.PowerFactor
......................................... 20
6.2.7.TotalHarmonicDistortion
............................ 21
6.2.8.InternalTemperature
................................. 22
6.2.9.SupplyFrequency
..................................... 22
6.2.10.AngleofU(Li)
...................................... 23
6.2.11.BatteryCharge
...................................... 23
6.3.Energy
...................................................... 24
6.4.TariffRates
................................................ 25
6.5.Configuration
............................................... 25
6.5.1.General
.............................................. 25
6.5.2.Activation
........................................... 33
6.6.LoadProfile
................................................ 34
6.7.QualityIndexes
............................................. 37
6.8.CommunicationSession
....................................... 37
6.9.DisconnectControl
.......................................... 37
6.9.1.Reconnect
............................................ 37
6.9.2.Disconnect
........................................... 38
6.9.3.OutputState
......................................... 38
Baeumle,Ficagna
Confidential
[Page2]

6.10.FirmwareUpgrade
...........................................
6.11.Logs
.......................................................
6.11.1.Errors&Alarms
.....................................
6.11.2.ParameterChanges
...................................
6.11.3.FirmwareUpgrade
....................................
6.11.4.UserIds
............................................
7.FinalConsiderations
............................................
APPENDIXA:SMWQUICKQUERYGUIDE
...................................
APPENDIXB:OBISANDSDKEQUIVALENTCODES
...........................
Baeumle,Ficagna
Confidential
39
40
40
40
42
44
45
46
50
[Page3]
1.Introduction
WEGSmartMetersallowtheuseofplugandplaycommunicationdevicesfor
remotecommunication.Theinformationexchangebetweencommunication
deviceandmeterreliesonaproprietaryprotocolknownasSMWSecure
Modbus.
Themeterhaveauniqueregisterforeachreadingandconfiguration
parameter.ThecommunicationdeviceactsastheModbusclientandthe
accesstotheregistersisgrantedafterasecurehandshakeandsession
establishmentprocess.
1.1.Features
SMWSecureModbushasthefollowingfeatures:
oMutualauthenticationwithdigitalcertificates
oSynchronousmessageexchanges
oMessageencryption(secrecy)
oLowheaderoverheadandparsingcomplexity
oSupporttoallmeterread/writeconfigurations.
1.2.Terminology
Client
Theoriginatingendpointofaquerythedestinationendpointofa
reply.
Meter
Thedestinationendpointofaquerytheoriginatingendpointof
areply.
SecureSession
Asemipermanentinteractiveinformationinterchangebetweenthe
clientandthemeter.
2.SMWSecureModbusProtocol
ThecommunicationprotocolusedbyWEGSmartMetersusesModbusRTUwith
securitymechanismstoensurethesecrecyandauthenticityofthedata
exchangedwiththemeterandalsotoavoiddatafabrication.Itcanbe
logicallydescribedasamultilayerprotocol(seeFigure1):
++
|Application|
++
++\
|Session||
++|
++|SMWSecure
|Queries/Replies||Modbus
|||
Baeumle,Ficagna
Confidential
[Page4]
|Messages/Encryption||
++/
++
|UART|
++
Figure1:AbstractLayeringof
SMWSecureModbus
2.1.MessagingModel
Theinteractionmodeloftheprotocolisthetraditionalclient/server
modelusedinModbusprotocol.Aclientsendsaquerytothemeteraddress
0x01(thequerymustbeavalidModbusfunction)requestingtoread/write
aregisterinthemeterordobothatthesametime.Themeterthensends
aresponsecontainingitsaddressandthesamefunctioncodeofthe
requestfollowedbythepayload.BothqueryandreplyendswithaCRC16.
ThemessageflowisdepictedinFigure2:
ClientMeter
||
|Query[fun.code]|
+>|
||
|Reply[fun.code]|
|/Errorcode|
|<+
||
Figure2:MessageTransmission
2.2.Query/ReplyModel
Thereare3typesofqueriessupportedbythemeter:read,writeor
read+write.Ifthemeterdoesnotsupportaspecificquery,itwill
respondwithaMODBUSerrorcode.
2.3.SecureSession
Whenaclientdeviceisattachedtothemeteritmustestablishasecure
communicationchannelinordertoreadandwriteregistersinthemeter.
ThesecurechannelrequiresanECCcertificatesignedbyWEGCA.The
securesessionisstartedbytheclientbysendingitscertificatetothe
meterandreceivingthecertificateofthemeter.Ifthecertificatesare
valid,clientandmeterstartaDiffieHellmanhandshaketogeneratea
sharedsecret.ThesharedsecretishashedusingSHA256andthenusedas
AES256CBCkeytoencryptanddecryptallmessagesinthesession.
Thesecuresessiondoesnotimplementatimeout,butitisautomatically
closedwhenthedeviceisphysicallydetachedorwhenthemeter/client
receives3sequentialinvalidmessages.
Thefollowingalgorithmsareusedinthesecuresessionestablishment:
Baeumle,Ficagna
Confidential
[Page5]
ECCKeyPairCurveSECP256R1
Generatedbytheclient,signedbyWEGCA
ECDSARequiredtoverifythesignatures
DHSharedsecretgeneration
Withpublicvaluesignatureverification
SHA256Defaulthashingalgorithm
AESCBC256Messageencryption.
3.MessageSemantics
3.1.Read
ClientMeter
||
|ReadHoldingRegisters[0x03,length]|
+>|
||
|ReadHoldingRegistersResponse[0x03,data]|
|<+
||
Figure3:ReadHoldingRegistersMessageTransmission
3.2.Write
ClientMeter
||
|WriteMultipleRegisters[0x10,data]|
+>|
||
|WriteMultipleRegistersResponse[0x10,writtenLength]|
|<+
||
Figure4:WriteMultipleRegistersMessageTransmission
3.3.Read+Write
ClientMeter
||
|Read+WriteMultipleRegisters[0x17,data,readLength]|
+>|
||
|Read+WriteMultipleRegistersResponse[0x17,data]|
|<+
||
Figure5:Read+WriteMultipleRegistersMessageTransmission
4.MessageTransmission
Thissectiondescribeconstraintsregardingthemessagetransmission.
Baeumle,Ficagna
Confidential
[Page6]
4.1.MessageSize
ThemaximumsizeofaModbusProtocolDataUnit(PDU)shouldnotexceed
253bytes(2562bytesCRC1byteserveraddress).
4.2.Endianess
ValuescarriedinMODBUSApplicationDataUnit(ADU)aretransmittedin
networkbyteorder.Thedefaultendiannessusedinthemeterandclientis
littleendian.Theclientmustswapthevaluesifusingadifferentbyte
order.
4.3.TransmissionParameters
Theclientconfigurationwhenconnecteddirectlytotheserialline(UART)
ofthemetershouldusethefollowingconnectionparameters:
+++
|Parameter|Value|
+++
|Speed|115200bps|
|Stopbits|2|
|Parity|none|
+++
TableX:Serialportparameters.
Theresponsetimeoutistypically300msformostqueries.Specific
queries,suchasDHsignatureexchangemaytakeupto3seconds.
5.EstablishingaSecureSession
Sessionestablishmentcomprehendstheidentificationofthemeterdevice,
mutualauthenticationwithECpublickeyssignedbyWEGCA,and,the
generationofasessionkeyusingamodifiedDiffieHellman(DH)algorithm
thatsignandverifypublicvaluestoavoidManInTheMiddle(MITM)
attacks.TheDHsessionkeyisusedtoencryptalllatermessagesusing
AES256CBC.Acompletesequenceofeventsthatmustoccurduringsession
establishmentisdepictedinFigure6:
ClientMeter
||
|(1)ReadDeviceIdentification|
+>|
|[manufacturer,model,version]|
|<+
||
|(2)ExchangePublicKeys[clientkey]|
+>|
|[meterkey]|
|<+
||
Baeumle,Ficagna
Confidential
[Page7]
|(3)ExchangeSignatureofPublicKeys[clientsignature]|
+>|
|[metersignature]|
|<+
||
+++|
||(4)SignatureVerification||
|<++>|
||
|(5)ExchangeDHPublicValues[clientDHpublicvalue]|
+>|
|[meterDHpublicvalue]|
|<+
||
|(6)ExchangeSignatureDHPublicValues[clientDHsignature]|
+>|
|[meterDHsignature]|
|<+
||
+++|
||(7)DHSignatureVerification||
|<++>|
||
+++|
||(8)GenerateSessionKey||
|<++>|
||
|(9)Securemessaging[encryptedquery]|
+>|
|[encryptedreply]|
|<+
||
Figure6:SequenceofEventsinSessionEstablishment
Ifanyeventfails,forinstance,ifthesignaturecannotbeverified,the
processmustbeabortedandstartedfromthebeginninginthenext
attempt.
Oncethesessionisopen,itdoesnothaveatimeout.However,ifoneend
receivesasequenceof3invalidpackages,thesessionmustbe
automaticallyclosed.
5.1.DeviceIdentification
Thefirststepofthesessionestablishmentshouldbealwaystoreadthe
deviceidentification.Themeterresponseshallcontainthemanufacturer
name,metermodelandfirmwareversion.
MODBUSFunctionCode
ReadDeviceId
Baeumle,Ficagna
Confidential
[Page8]
Request
5
012b0e0100
server,functioncode,MEI,category,object
7
7077
CRC16
Response
5
012b0e0101
server,functioncode,MEI,device,conformity
8
000003
morefollows,nextobjectid,objectcount
9
00
objectid(manufacturer)
10
03
manufacturerobjectlength
13
574547
manufacturerstringWEG
14
01
objectid(model)
15
08
modelobjectlength
20
534d573330
modelstringSMW300>
23
300000
...<
24
02
objectid(version)
25
04
versionobjectlength
30
302e303100
versionstring0.01
32
c434
CRC16
Manufacturer,modelandversionfieldsarerepresentedbyASCII
characters.FormoredetailsonMEI,object,categoryandconformity
fields,pleaserefertoMODBUSoriginalspecificationavailableat
<http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf>.
5.2.ExchangePublicKeys
Thesecondstepofthesessionestablishmentistoobtainthepublickey
ofthemeterandupdateclientskeyinthemeter.Itisaccomplishedin
onemessage.
ThepublickeysaregeneratedusingEllipticCurveCryptography(ECC).The
curveshouldbeSecp256R1.
MODBUSFunctionCode
Read+WriteMultipleRegisters
Request
2
0117
server,functioncode
4
006f
readpublickeyofthemeter
6
0021
readsizeinwords
8
0071
updateclientspublickey
10
0021
clientspublickeysizeinwords
11
42
clientspublickeysizeinbytes66
16
04d94f0c5b
clientspublickey>
21
91aeebf0d1
...
26
22862bf049
...
31
3271e15d1e
...
36
1353f28270
...
41
ccaa7f51e2
...
Baeumle,Ficagna
Confidential
[Page9]
46
39014ac1a3
...
51
f9e05f3b4f
...
56
1c0bd3b809
...
61
6bebd2c4f0
...
66
8757273651
...
71
c201cc209c
...
76
262d445066
...
77
00
...<
79
3db7
CRC16
Response
2
0117
server,functioncode
3
42
meterspublickeysizeinbytes
8
040cb8ae78
meterspublickey>
13
24b5112fe1...
18
9447f04c72...
23
423e7a25ac...
28
272bf71e6c...
33
4925edcbcb...
38
f72a535d25...
43
4e9e9a9d1c...
48
6186888de1...
53
3aafe11bb5...
58
6e2d6edda3...
63
bb4a23fbb1...
68
61bdc3e94c...
69
ff
...<
71
252b
CRC16
5.3.ExchangeSignaturesofPublicKeys
Inthethirdstep,theclientshouldstartthesignatureexchange.Each
sidewillverifythesignatureusingWEGCApublickey.Thepurposeof
thismutualverificationistoalloweachparttoidentifytheotherasan
authorizedequipment.ThesignaturesareASN.1encodedandtheirsizesare
typically72byteslong.
MODBUSFunctionCode
Request
2
0117
server,functioncode
4
0070
readsignatureofthemeter
6
0024
readsizeinwords
8
0072
updateclientssignature
10
0024
clientssignaturesizeinwords
11
48
clientssignaturesizeinbytes72
16
3046022100
clientssignature>
21
16097d0150...
Baeumle,Ficagna
Confidential
[Page10]
26
5368b083aa...
31
47a0ec294c...
36
3268767598...
41
a29643cd1b...
46
887146e255...
51
bd89022100...
56
851422d5c7...
61
1168d03a19...
66
74db02e1ee...
71
3109d3296b...
76
e0d8158f8e...
81
7122a5d787...
83
7b13
...<
85
1f4c
CRC16
Response
2
0117
server,functioncode
3
48
meterssignaturesizeinbytes72
8
3046022100
meterssignature>
13
1e64935978...
18
3d1caa37b3...
23
b6d0d8d9e8...
28
dbba8409ee...
33
789251b67a...
38
528b525ffb...
43
e81e022100...
48
d5ace576b7...
53
cbf3ad8e30...
58
1282bfd9a9...
63
95fb7b5712...
68
fb5b66615a...
73
1c1df04d54...
75
d8f3
...<
77
a14f
CRC16
5.4.ExchangeDiffieHellmanPublicValues
IfthepublickeysareverifiedwithWEGCApublickey,thenextstepis
toexchangeDHpublicvalues.Thepublicvalueistypically220bytes
long.TheclientmustgenerateanewDHpublicvalueeachsession
establishment.Thefollowingpandgparametersshouldbeusedinthe
DHprivate/publicvaluepairgeneration:
p[220]={
0x0F,0x52,0xE5,0x24,0xF5,0xFA,0x9D,0xDC,
0xC6,0xAB,0xE6,0x04,0xD7,0x5E,0x46,0x29,
0xAF,0xB1,0xF4,0x81,0xAF,0xFC,0x9A,0xEF,
0xFA,0x89,0x9E,0x0A,0xFB,0x16,0xE3,0x8F,
0x01,0xA2,0xC8,0xDD,0xB4,0x47,0x12,0xF8,
Baeumle,Ficagna
Confidential
[Page11]
0x29,0x09,0x13,0x6E,0x9D,0xA8,0xF9,0x5D,
0x08,0x00,0x3A,0x8C,0xA7,0xFF,0x6C,0xCF,
0xE3,0x7C,0x3B,0x6B,0xB4,0x26,0xCC,0xDA,
0x89,0x93,0x01,0x73,0xA8,0x55,0x3E,0x5B,
0x77,0x25,0x8F,0x27,0xA3,0xF1,0xBF,0x7A,
0x73,0x1F,0x85,0x96,0x0C,0x45,0x14,0xC1,
0x06,0xB7,0x1C,0x75,0xAA,0x10,0xBC,0x86,
0x98,0x75,0x44,0x70,0xD1,0x0F,0x20,0xF4,
0xAC,0x4C,0xB3,0x88,0x16,0x1C,0x7E,0xA3,
0x27,0xE4,0xAD,0xE1,0xA1,0x85,0x4F,0x1A,
0x22,0x0D,0x05,0x42,0x73,0x69,0x45,0xC9,
0x2F,0xF7,0xC2,0x48,0xE3,0xCE,0x9D,0x74,
0x58,0x53,0xE7,0xA7,0x82,0x18,0xD9,0x3D,
0xAF,0xAB,0x40,0x9F,0xAA,0x4C,0x78,0x0A,
0xC3,0x24,0x2D,0xDB,0x12,0xA9,0x54,0xE5,
0x47,0x87,0xAC,0x52,0xFE,0xE8,0x3D,0x0B,
0x56,0xED,0x9C,0x9F,0xFF,0x39,0xE5,0xE5,
0xBF,0x62,0x32,0x42,0x08,0xAE,0x6A,0xED,
0x88,0x0E,0xB3,0x1A,0x4C,0xD3,0x08,0xE4,
0xC4,0xAA,0x2C,0xCC,0xB1,0x37,0xA5,0xC1,
0xA9,0x64,0x7E,0xEB,0xF9,0xD3,0xF5,0x15,
0x28,0xFE,0x2E,0xE2,0x7F,0xFE,0xD9,0xB9,
0x38,0x42,0x57,0x03}
g[1]={
0x02
}
MODBUSFunctionCode
Request
2
0117
server,functioncode
4
0075
readDHpublicvalueofthemeter
6
006e
readsizeinwords
8
0075
updateclientsDHpublicvalue
10
006e
clientsDHpublicvaluesizewords
11
dc
clientsDHpublicvaluesizeinbytes220
16
06ca6c240e
clientsDHpublicvalue>
21
6125a28adb
...
26
eff4dc7bcc
...
31
94ac9b1929
...
36
0684bd95b4
...
41
b28f7c1fbe
...
46
0d6a635f59
...
51
6d87bb9daa
...
56
79f9c87246
...
61
4622576e20
...
66
aa88d53665
...
71
d2e33cb032
...
76
ec2553f2d3
...
Baeumle,Ficagna
Confidential
[Page12]
81
9f97860e55
...
86
20571e28cf
...
91
d434c17d84
...
96
ce7a945b6b
...
101
2de388de3c
...
106
7dc9d788d1
...
111
1f365333b7
...
116
06acccfb26
...
121
a333cf9087
...
126
0b70fc8df8
...
131
a1e96b5867
...
136
d832524ec6
...
141
a8d67eb6a2
...
146
261767be53
...
151
edac5ae153
...
156
ef80d644a1
...
161
afbc0cb43f
...
166
d462f03830
...
171
d424943e85
...
176
bad3d632de
...
181
28d158df04
...
186
cfdebce56b
...
191
1d898dc99b
...
196
16d1e29328
...
201
06f66c8e1c
...
206
362feabd8d
...
211
d877df45a5
...
216
809d998d18
...
221
b384ebc756
...
226
9556407e9f
...
231
4072720302
...<
233
d07a
CRC16
Response
2
0117
server,functioncode
3
dc
metersDHpublicvaluesizeinbytes220
8
0d469f7cb8
meter'sDHpublicvalue>
13
5f8aed56e2
...
18
8b40914736
...
23
682553401b
...
28
71e6cbaaed
...
33
14dc2ebe3d
...
38
eeec192b63
...
43
2517412780
...
48
524e08771c
...
53
ccf1bb8ec0
...
58
4c1e1c5cf5
...
63
a2fef462ad
...
68
29fc6cbc0b
...
73
f97a7644ee
...
Baeumle,Ficagna
Confidential
[Page13]
78
1a32914660
...
83
f833a1b4f4
...
88
c30ef7d7ec
...
93
4a1f049afa
...
98
4b2d2f0111
...
103
27c0136b7f
...
108
3baf528348
...
113
6bd0628e44
...
118
3bc8567482
...
123
bd1282edfb
...
128
e8dd9e0a21
...
133
c40c6a2aa9
...
138
de8be1dd56
...
143
906fe532e5
...
148
8197aef740
...
153
21a33bc50b
...
158
d84de0ce49
...
163
5bfc8cb53e
...
168
3b280457ce
...
173
77bea492fa
...
178
74842dba38
...
183
132277e32a
...
188
982ff944d0
...
193
4a8ccb2533
...
198
0d599f8cfb
...
203
e241b784e0
...
208
1c70bb2304
...
213
4a4e972eaf
...
218
626046c111
...
223
4c9b7d36a6
...<
225
0a87
CRC16
5.5.ExchangeSignaturesofDiffieHellmanPublicValues
Thepublicvaluesshallbesignedbyeachsideandthenexchangedsoeach
canconfirmthepublicvalueisgeneratedbytheotherandnotbyathird
party.ThisstepisperformedtoavoidMITMattacks.Thesignatureshould
begeneratedusingECDSAalgorithmandtheECCprivatekey.The
verificationusesthereceivedsignatureandtheECCpublickeyofthe
otherpart,receivedinthepublickeyexchangeevent.
MODBUSFunctionCode
Request
2
0117
server,functioncode
4
0074
readDHsignatureofthemeter
6
0024
readsizeinwords
8
0074
updateclientsDHsignature
10
0024
clientsDHsignaturesizewords
Baeumle,Ficagna
Confidential
[Page14]
11
48
clientsDHpublicsignatureinbytes72
16
3046022100
clientsDHsignature>
21
9bfbedd0fd
...
26
1aa8c6c96a
...
31
bea3d49a1d
...
36
5890f148f4
...
41
f5ac68aace
...
46
b17f0552a1
...
51
6413022100
...
56
71e0ffc646
...
61
17cd17337e
...
66
56cbac0fc8
...
71
da9b36d2d9
...
76
3cb66ff87d
...
81
ee9ef45ee0
...
83
4095
...<
85
b92d
CRC16
Response
2
0117
server,functioncode
3
48
metersDHsignaturesizeinbytes72
8
3046022100
...
13
c1d66d7989
...
18
0424792da1
...
23
f39e581804
...
28
94ea8c6e45
...
33
9313371112
...
38
97011531cc
...
43
13d1022100
...
48
7263777655
...
53
05cd653c37
...
58
5dfe8ba9d6
...
63
9f182d8a01
...
68
2587b9fa42
...
73
f215dbe212
...
75
9597
...<
77
fb92
CRC16
5.6.SharedSecretGeneration&EncryptedCommunication
OncethesignatureoftheDHpublicvalueisverifiedbyclientandmeter
individually,eachpartcangeneratethesharedsecretusingDHalgorithm.
ThesessionkeyistheSHA256ofthestandardsharedsecret.
Afterthat,allfurtherMODBUSmessages(thewholedataunit,including
CRC)shouldbeencryptedwithAESCBC256usingthesessionkey.
5.7.Troubleshooting
Themeterdoesnotreplythesignatureexchangewithavalidanswer:
Baeumle,Ficagna
Confidential
[Page15]

Inthiscaseyoushouldcheckthesignaturetransmittedtothemeteris
properlysignedbyWEGCA.Anyothersignaturewillbediscardedbythe
meter.
ThemeterisnotreplyingtotheDHpublicvalueorsignature:
UsuallythisstepstakeslongerbecauseDHcomputationkeypair
computationandsignatureverificationtakesmoreprocessing
capabilities.Therecommendedsolutioninthissituationistoincrease
thetimeoutofthereplies.
6.Messages&Description
Thissectiondescribethemessagesexchangedwiththemeterinthesecure
session.Itisassumedthatthereaderisawarethatallmessagesmustbe
encryptedbeforetransmissionanddecryptedinthereception,exceptwhen
explicitlystatedotherwise.
6.1.FirmwareIdentification
Thisfunctiondoesnotneedanopensecuresession,soitdoesnotneedto
beencrypted.Itusesthestandardreaddeviceidentificationfunction
codeofMODBUSspecification.
MODBUSFunctionCode
ReadDeviceIdentification
MessageFormat
Request
+++++++
|Server|Function|MEI|Catego|Object|CRC16|
|Address|Code|Type|ry|Id|Swapped|
|1byte|1byte|1byte|1byte|1byte|2bytes|
+++++++
|0x01|0x2b|0x0e|0x01|0x00|0x700x77|
+++++++
Response
++++++++
|Server|Function|MEI|Device|Confor|More|Next|
|Address|Code|Type|IdCode|mity|Follows|Obj.Id|
|1byte|1byte|1byte|1byte|1byte|1byte|1byte|
++++++++
|0x01|0x2b|0x0e|0x01|0x01|0x00|...|
++++++++
+++
Obj.|Objects|CRC16|
Count|List|Swapped|
Baeumle,Ficagna
Confidential
[Page16]
1byte|nbytes|2bytes|
+++
...|...|......|
+++
6.2.InstantaneousValues
InstantaneousvaluesarereadonlyandmustbeobtainedusingMODBUSread
holdingregistersfunctioncode.Thesizemayvaryaccordingtothevalue
toberead.FigureXcontainthetypicalpayloadformatsforinstantaneous
values:
(a)Total
++
|Value|
|8bytes|
++
(b)PerPhase
++++
|L1Value|L2Value|L3Value|
|8bytes|8bytes|8bytes|
++++
(c)Total+PerPhase
+++++
|Total|L1Value|L2Value|L3Value|
|8bytes|8bytes|8bytes|8bytes|
+++++
FigureX:TypicalPayloadFormatsforInstantaneousValues
6.2.1.RMSVoltage
RetrievetheinstantaneousRMSvoltageofthe3phases.Nonexisting
phases(i.e.monoorbiphasicmeters)willhavevalue0.Thevalueofeach
phaseisa64bitunsignedvalue.Thevaluesaregiveninmillivolts[mV].
Request
++++++
|Server|Function|Meter|Word|CRC16|
|Address|Code|Register|Length|Swapped|
|1byte|1byte|2bytes|2bytes|2bytes|
++++++
|0x01|0x03|0x000x00|0x000x0c|0x450xcf|
++++++
Response
+++++++
|Server|Function|Byte|L1Value|L2Value|L3Value|
|Address|Code|Length|(uint64_t)|(uint64_t)|(uint64_t)|
|1byte|1byte|1byte|8bytes|8bytes|8bytes|
+++++++
|0x01|0x03|0x18|...|...|...|
Baeumle,Ficagna
Confidential
[Page17]
+++++++
+
CRC16|
Swapped|
2bytes|
+
...|
+
6.2.2.RMSCurrent
RetrievetheinstantaneousRMScurrentofthe3phases.Nonexisting
phases(i.e.monoorbiphasicmeters)willhavevalue0.Thevalueofeach
phaseisa64bitunsignedvalue.Thevaluesaregiveninmilliamperes
[mA].
Request
++++++
++++++
|0x01|0x03|0x000x04|0x000x0c|0x040x0e|
++++++
Response
+++++++
|Server|Function|Byte|L1Value|L2Value|L3Value|
+++++++
|0x01|0x03|0x18|...|...|...|
+++++++
+
CRC16|
Swapped|
2bytes|
+
...|
+
6.2.3.ActivePower
Retrievetheinstantaneousactivepower(totalandperphase).
Nonexistingphases(i.e.monoorbiphasicmeters)willhavevalue0.The
valueofeachphaseandtotalare64bitsignedvalues.Negativevalues
meanstheconsumerisgeneratingtothegrid.Positivevaluesmeansthe
consumerisimportingfromthegrid.Thevaluesaregiveninmilliwatts
[mW].
Baeumle,Ficagna
Confidential
[Page18]

Request
++++++
++++++
|0x01|0x03|0x000x18|0x000x10|0xc40x01|
++++++
Response
+++++++
|Server|Function|Byte|TotalV.|L1Value|L2Value|
|Address|Code|Length|(int64_t)|(int64_t)|(int64_t)|
+++++++
|0x01|0x03|0x20|...|...|...|
+++++++
++
L3Value|CRC16|
(int64_t)|Swapped|
8bytes|2bytes|
++
...|...|
++
6.2.4.ReactivePower
Retrievetheinstantaneousreactivepower(totalandperphase).
consumerisimportingfromthegrid.Thevaluesaregivenin
millivoltamperereactive[mVAR].
Request
++++++
++++++
|0x01|0x03|0x000x19|0x000x10|0x950xc1|
++++++
Response
+++++++
+++++++
Baeumle,Ficagna
Confidential
[Page19]
|0x01|0x03|0x20|...|...|...|
+++++++
++
L3Value|CRC16|
(int64_t)|Swapped|
8bytes|2bytes|
++
...|...|
++
6.2.5.ApparentPower
Retrievetheinstantaneousapparentpower(totalandperphase).
consumerisimportingfromthegrid.Thevaluesaregivenin
millivoltampere[mVA].
Request
++++++
++++++
|0x01|0x03|0x000x1a|0x000x10|0x650xc1|
++++++
Response
+++++++
+++++++
|0x01|0x03|0x20|...|...|...|
+++++++
++
L3Value|CRC16|
(int64_t)|Swapped|
8bytes|2bytes|
++
...|...|
++
6.2.6.PowerFactor
Retrievethepowerfactor(totalandperphase).Nonexistingphases(i.e.
monoorbiphasicmeters)willhavevalue0.Thevalueofeachphaseand
totalare64bitsignedvalues.Negativevaluesmeanstheconsumeris
Baeumle,Ficagna
Confidential
[Page20]
generatingtothegrid.Positivevaluesmeanstheconsumerisimporting
fromthegrid.Thevaluesaregivenin[m%].
Request
++++++
++++++
|0x01|0x03|0x000x22|0x000x10|0xe40x0c|
++++++
Response
+++++++
+++++++
|0x01|0x03|0x20|...|...|...|
+++++++
++
L3Value|CRC16|
(int64_t)|Swapped|
8bytes|2bytes|
++
...|...|
++
6.2.7.TotalHarmonicDistortion
Retrievethevoltagetotalharmonicdistortion(onlycomputedwithpower
notnull)values(totalandperphase).Eachvalueisrepresentedbya
64bitunsignedinteger.
Request
++++++
++++++
|0x01|0x03|0x000x27|0x000x10|0xf40x0d|
++++++
Response
+++++++
+++++++
|0x01|0x03|0x20|...|...|...|
Baeumle,Ficagna
Confidential
[Page21]
+++++++
++
L3Value|CRC16|
(uint64_t)|Swapped|
8bytes|2bytes|
++
...|...|
++
6.2.8.InternalTemperature
Retrievetheinternaltemperatureofthemeter.Theresponsecontainsa
64bitsignedvalue.Validtemperaturevaluesrangebetween10to100C.
Request
++++++
++++++
|0x01|0x03|0x000x6a|0x000x04|0x640x15|
++++++
Response
++++++
|Server|Function|Byte|Temp.Value|CRC16|
|Address|Code|Length|(uint64_t)|Swapped|
|1byte|1byte|1byte|8bytes|2bytes|
++++++
|0x01|0x03|0x08|...|...|
++++++
6.2.9.SupplyFrequency
Retrievethegridsupplyfrequency.Theresponsecontainsa64bit
unsignedinteger.Thevalueisgivenin[E2Hz].
Request
++++++
++++++
|0x01|0x03|0x000x80|0x000x04|0x450xe1|
++++++
Response
++++++
|Server|Function|Byte|FrequencyValue|CRC16|
Baeumle,Ficagna
Confidential
[Page22]
++++++
|0x01|0x03|0x08|...|...|
++++++
Valueconversionexample
Ifthesupplyfrequencyvaluefieldis00000000000017b6bthe
equivalentvalueis5992x10^2Hz.
6.2.10.AngleofU(Li)
Gettheangleofvoltagebetweenthephases(RST).Eachangleis
representedbya64bitunsignedinteger.Thevalueisgivenin[E3].
Request
++++++
++++++
|0x01|0x03|0x000x99|0x000x0c|0x950xe0|
++++++
Response
+++++++
|Server|Function|Byte|TSValue|SRValue|RTValue|
+++++++
|0x01|0x03|0x18|...|...|...|
+++++++
+
CRC16|
Swapped|
2bytes|
+
...|
+
Valueconversionexample
IfTSis000000000001cb06theequivalentvalueis117.510.
6.2.11.BatteryCharge
Retrievethebatterychargestatus.Theresponsecontainsa64bit
unsignedintegerrangingbetween04.Theequivalencybetweenthevalue
andpercentagearegivenintheFigureXbelow:
+++
|Value|Charge|
Baeumle,Ficagna
Confidential
[Page23]
+++
|0|0%|
|1|25%|
|2|50%|
|3|75%|
|4|100%|
+++
FigureX:BatteryCharge
ValuesinPercent
MODBUSFunctionCode
ReadHoldingRegisters
Request
++++++
++++++
|0x01|0x03|0x020xbe|0x000x04|0x250x95|
++++++
Response
++++++
|Server|Function|Byte|BatteryStatus|CRC16|
++++++
|0x01|0x03|0x08|...|...|
++++++
6.3.Energy
EnergyvaluesarereadonlyandmustbeobtainedusingMODBUSreadholding
registersfunctioncode.Thesizemayvaryaccordingtothevaluetobe
read.FigureXcontainthetypicalpayloadformatsusedinenergyreplies:
(a)Total
++
|Value|
|8bytes|
++
(d)Total+PerTariffRate
++++++
|Total|R1Value|R2Value|R3Value|R4Value|
|8bytes|8bytes|8bytes|8bytes|8bytes|
++++++
FigureX:TypicalPayloadFormatsusedinEnergyReplies
6.4.TariffRates
Baeumle,Ficagna
Confidential
[Page24]
Retrievethecurrenttariffzone.Toconfigurethetariffrates,referto
GeneralConfigurationPart2.
a.CurrentTariffZone
Retrievethecurrenttariffzonecode.Thefollowinggroupvaluesare
validaccordingtotheBrazilianelectricityregulation:
(0)Offpeak
(1)Intermediate
(2)Peak
(3)Special
MODBUSFunctionCode
Request
++++++
++++++
|0x01|0x03|0x000x61|0x000x04|0x150xd7|
++++++
Response
++++++
|Server|Function|Byte|TariffZone|CRC16|
++++++
|0x01|0x03|0x08|...|...|
++++++
6.5.Configuration
Meterconfigurationissubdividedintothefollowingcategories:
oGeneralConfiguration
Part1:
Active(running)
Inactive
Part2:
Active(running)
Inactive
6.5.1.General
Retrieveandconfiguremostparameters.Theconfigurationisdividedin
twocommands:
Baeumle,Ficagna
Confidential
[Page25]
Part1
+++
|Field|Description|
+++
|DisplayCycling||
|Rate|Cyclingrateinseconds.|
|Button|Enable/disablecyclingbutton.|
|SavingInterval|LoadProfilesavingintervalinmins[560].|
|DecimalPoint||
|Voltage|Displaydecimalptposition:voltagevalues.|
|Current|Displaydecimalptposition:currentvalues.|
|Energy|Displaydecimalptposition:energyvalues.|
|Power|Displaydecimalptposition:powervalues.|
|GeneralPurpose|Displaydecimalptposition:generalpurpose.|
|Identification||
|ManufacturerId|Readonlymanufacturernumber(32bit).|
|SerialNumber|Readonlyserialnumber(32bit).|
|UtilityNumber|Read+writeutilitynumber(32bit).|
|ConsumerUnit|Read+writeconsumerunit(32bit).|
|Display||
|Default|Maindisplayconfiguration.|
|Alternative|Shownwhencyclingbuttonishold.|
|NominalValues||
|Voltage|Nominalvoltagein[V].|
|Current|Nominalcurrentin[A].|
|PhaseCount|Accordingtothemodel.|
|Reserved||
|LastCalibration||
|Day|8bit.|
|Month|8bit.|
|Year|8bit.|
|LastFirmwareUpgrade||
|Day|8bit.|
|Month|8bit.|
|Year|8bit.|
|DaylightSavings||
|Begin||
|Day|8bit.|
|Month|8bit.|
|Year|8bit.|
|End||
|Day|8bit.|
|Month|8bit.|
|Year|8bit.|
|Holidays||
|Month1|Numberofthemonth112.|
|Holidays|Listof8holidays(255fornonused).|
|...||
|Month12|Numberofthemonth112.|
|Holidays|Listof8holidays(255fornonused).|
|OpticalPortPassword||
Baeumle,Ficagna
Confidential
[Page26]
|Read|Passwordtoreaddataviaopticalport.|
|Write|Passwordtowritedataviaopticalport.|
+++
Part2
+++
|Field|Description|
+++
|LPChannelCount|NumberofchannelsusedbyLoadProfile.|
|LPChannels|ListofchannelsassignedforLoadProfile.|
||Thelistcontain52values.Notassigned|
||channelshavevalue255.|
||Possiblevalues:(0)PhaseRVoltage,|
||(1)PhaseSVoltage,|
||(2)PhaseTVoltage,|
||(3)PhaseRSVoltage,|
||(4)PhaseRTVoltage,|
||(5)PhaseTSVoltage,|
||(6)A.EnergyImportT.,|
||(7)A.EnergyExportT.,|
||(8)R.EnergyImportT.,|
||(9)R.EnergyExportT.,|
||(10)A.EnergyImportOffpeak|
||(11)A.EnergyImportInterm.|
||(12)A.EnergyImportPeak|
||(13)A.EnergyImportSpecial|
||(14)A.EnergyExportOffpeak|
||(15)A.EnergyExportInterm.|
||(16)A.EnergyExportPeak|
||(17)A.EnergyExportSpecial|
||(18)R.EnergyImportOffpeak|
||(19)R.EnergyImportInterm.|
||(20)R.EnergyImportPeak|
||(21)R.EnergyImportSpecial|
||(22)R.EnergyExportOffpeak|
||(23)R.EnergyExportInterm.|
||(24)R.EnergyExportPeak|
||(25)R.EnergyExportSpecial|
||(26)PhaseRCurrent,|
||(27)PhaseSCurrent,|
||(28)PhaseTCurrent,|
||(29)A.PowerImport,|
||(30)A.PowerExport,|
||(31)R.PowerImport,|
||(32)R.PowerExport,|
||(33)ApparentPowerImport,|
||(34)ApparentPowerExport,|
||(35)PolyPhasePowerFactor,|
||(36)PhaseRPowerFactor,|
||(36)PhaseSPowerFactor,|
||(36)PhaseTPowerFactor,|
Baeumle,Ficagna
Confidential
[Page27]
||(37)Temperature,|
||(38)PowerSupplyFrequency,|
||(39)THD|
|TariffRates|Contain12blocksoftariffrates.|
|Tariff#1||
|BeginHour||
|BeginMinute||
|Zone|Possiblevalues:(0)offpeak,|
||(1)intermediate,|
||(2)peak,|
||(3)special,|
|||
|Daytype|Possiblevalues:(0)weekday,|
||(1)weekend,|
||(2)holiday|
|...||
|Tariff#12||
|[sameasabove]||
|Config.FileVersion|Incrementalnumber.|
|LastConfig.Date||
+++
a.Active(running)
Containtheconfigurationthatisrunninginthemeter.Itcannotbeset
directly,butitcanberead.
Request(Part1)
++++++
++++++
|0x01|0x03|0x000xac|0x000x58|0x840x11|
++++++
Response(Part1)
+++++++
|Server|Function|Byte|Display|DisplayCycl.|LPSaving|
|Address|Code|Length|Cycl.Rate|Button|Interval|
|1byte|1byte|1byte|1byte|1byte|1byte|
+++++++
|0x01|0x03|0xb0|...|...|...|
+++++++
\displayparams/
+++++
Voltage|Current|Energy|Power|GPDecimal|
DecimalPt|DecimalPt|DecimalPt|DecimalPt|Point|
1byte|1byte|1byte|1byte|1byte|
+++++
...|...|...|...|...|
Baeumle,Ficagna
Confidential
[Page28]
+++++
\displaydecimalpoint/
++++++
Manufacturer|Serial|Utility|Consumer|Display|Display|
Id|Number|Number|Unit|Default|Altern.|
4bytes|4bytes|4bytes|4bytes|8bytes|8bytes|
++++++
...|...|...|...|...|...|
++++++
\identificationnumbers/\displaycfg/
+++++++
Nominal|Nominal|Phase|Reser|LastCal|LastCal|LastCal|
Voltage|Current|Count|ved|Day|Month|Year|
1byte|1byte|1byte|4bytes|1byte|1byte|1byte|
+++++++
...|...|...|...|...|...|...|
+++++++
\nominalvalues/\lastcalibration/
++++++
LastFU|LastFU|LastFU|Savings|Savings|Savings|
Day|Month|Year|Beg.Day|Beg.Month|Beg.Year|
1byte|1byte|1byte|1byte|1byte|1byte|
++++++
...|...|...|...|...|...|
++++++
\firmwareupgrade/\daylightsavingsbegin/
+++++
Savings|Savings|Savings|Holidays|HolidaysDays|
EndDay|EndMonth|EndYear|Month#i|inMonth#i|
1byte|1byte|1byte|1byte|8bytes|
+++++
...|...|...|...|...|
+++++
\daylightsavingsend/\holidays,x12/
+++
OpticalP.|OpticalP.|CRC16|
ReadPwd|WritePwd|Swapped|
4bytes|4bytes|2bytes|
+++
...|...|...|
+++
\opticalportpwds/
Request(Part2)
++++++
Baeumle,Ficagna
Confidential
[Page29]
++++++
|0x01|0x03|0x000xad|0x000x36|0x540x3d|
++++++
Response(Part2)
+++++++
|Server|Function|Byte|Numberof|Listofchann.|Tariff|
|Address|Code|Length|Channels|Assigned|#1|
|1byte|1byte|1byte|1byte|52bytes|4bytes|
+++++++
|0x01|0x03|0x6c|...|...|...|
+++++++
\LPChannel/\LPChannels/\
count
++++++++
|Tariff|Tariff|Tariff|Tariff|Tariff|Tariff|Tariff|
|#2|#3|#4|#5|#6|#7|#8|
|4bytes|4bytes|4bytes|4bytes|4bytes|4bytes|4bytes|
++++++++
|...|...|...|...|...|...|...|
++++++++
++++++
|Tariff|Tariff|Tariff|Tariff|Tariff|
|#9|#10|#11|#12(beginhour)|#12(beginmin)|
|4bytes|4bytes|4bytes|1byte|1byte|
++++++
|...|...|...|...|...|
++++++
TariffRates
++++++
|Tariff|Tariff|Config.file|Lastconfig.|CRC16|
|Zone|Daytype|Version|Date|Swapped|
++++++
|...|...|...|...|...|
++++++
/
b.Inactive
Theinactiveconfigurationisaconfigurationthatiswaitingtobe
activated.Changesintheconfigurationshouldalwaysbeperformedinthe
inactiveconfigurationandthenactivatedusingtheactivationcommandand
itsdatastructureisexactlythesameofactiveconfigurationdescribed
previously.
Baeumle,Ficagna
Confidential
[Page30]

RequestPart1(Read)
++++++
++++++
|0x01|0x03|0x000xae|0x000x58|0x250xd1|
++++++
ResponsePart1
Theresponseissimilartothepreviouslydescribedatitema.
RequestPart1(Write)
++++++++
|Server|Function|Meter|Word|Byte|Display|Disp.|
|Address|Code|Register|Length|Count|C.Rate|C.B.|
|1byte|1byte|2bytes|2bytes|1byte|1byte|1byte|
++++++++
|0x01|0x10|0x000xae|0x000x58|0xb0|...|...|
++++++++
\displayparams/
+++++++
|LPSaving|Voltage|Current|Energy|Power|GPDecimal|
|Interval|DecimalPt|DecimalPt|DecimalPt|Dec.Pt|Point|
|1byte|1byte|1byte|1byte|1byte|1byte|
+++++++
|...|...|...|...|...|...|
++++++
\displaydecimalpoint/
++++++
Manufacturer|Serial|Utility|Consumer|Display|Display|
Id|Number|Number|Unit|Default|Altern.|
++++++
...|...|...|...|...|...|
++++++
\identificationnumbers/\displaycfg/
+++++++
Nominal|Nominal|Phase|Reser|LastCal|LastCal|LastCal|
Voltage|Current|Count|ved|Day|Month|Year|
1byte|1byte|1byte|4bytes|1byte|1byte|1byte|
+++++++
...|...|...|...|...|...|...|
+++++++
\nominalvalues/\lastcalibration/
++++++
LastFU|LastFU|LastFU|Savings|Savings|Savings|
Baeumle,Ficagna
Confidential
[Page31]
Day|Month|Year|Beg.Day|Beg.Month|Beg.Year|
1byte|1byte|1byte|1byte|1byte|1byte|
++++++
...|...|...|...|...|...|
++++++
\firmwareupgrade/\daylightsavingsbegin/
+++++
Savings|Savings|Savings|Holidays|HolidaysDays|
EndDay|EndMonth|EndYear|Month#i|inMonth#i|
+++++
...|...|...|...|...|
+++++
\daylightsavingsend/\holidays,x12/
+++
OpticalP.|OpticalP.|CRC16|
ReadPwd|WritePwd|Swapped|
+++
...|...|...|
+++
\opticalportpwds/
ResponsePart1
++++++
++++++
|0x01|0x10|0x000xae|0x000x58|0xa00x12|
++++++
RequestPart2(Read)
++++++
++++++
|0x01|0x03|0x000xaf|0x000xcc|0x750xbe|
++++++
ResponsePart2
Theresponseissimilartothepreviouslydescribedatitema.
RequestPart2(Write)
++++++++
|Server|Function|Meter|Word|Num.of|L.of|Tar.|
|Address|Code|Register|Length|Chann.|Ch.a.|#1|
Baeumle,Ficagna
Confidential
[Page32]
|1byte|1byte|2bytes|2bytes|1byte|1byte|1byte|
++++++++
|0x01|0x10|0x000xaf|0x000xcc|...|...|...|
++++++++
++++++++
|Tariff|Tariff|Tariff|Tariff|Tariff|Tariff|Tariff|
|#2|#3|#4|#5|#6|#7|#8|
|4bytes|4bytes|4bytes|4bytes|4bytes|4bytes|4bytes|
++++++++
|...|...|...|...|...|...|...|
++++++++
++++++
|Tariff|Tariff|Tariff|Tariff|Tariff|
|#9|#10|#11|#12(beginhour)|#12(beginmin)|
|4bytes|4bytes|4bytes|1byte|1byte|
++++++
|...|...|...|...|...|
++++++
++++
|Tariff|Tariff|CRC16|
|Zone|Daytype|Swapped|
|1byte|1byte|4bytes|
++++
|...|...|...|
++++
6.5.2.Activation
Inordertoactivateaconfiguration,anactivationrequestmessagemust
besenttothemeteraftertheinactiveconfigurationsareset.
MODBUSFunctionCode
WriteMultipleRegisters
Request
++++++
|Server|Function|Meter|Word|Valuefilled|
|Address|Code|Register|Length|with1s|
++++++
|0x01|0x10|0x000x86|0x000x04|0x01..0x01|
++++++
+
CRC16|
Swapped|
2bytes|
+
0x260x18
|
Baeumle,Ficagna
Confidential
[Page33]
Reponse
++++++
|Address|Code|2bytes|2bytes|2bytes|
++++++
|0x01|0x10|0x000x96|0x000x04|0x210xe6|
++++++
6.6.LoadProfile
Themetercapturesandstoresmeteringdatainconfigurableintervals.The
configurationofthecapturedata(channels)isalsopossible.TheLPhas
thefollowingcharacteristics:
oUpto52configurablechannels
oConfigurablecaptureinterval(560minutes)seeGeneral
Configuration
oStorageproportionaltothenumberofchannels(52channels@15
mins=48daysofstorage).
oCapturabledata:
RMSCurrentandVoltageperLine
Energy(TotalsandperLine)
Power
PowerFactor(TotalandperLine)
Temperature
Frequency
THD.
TheLPisretrievedusingthefollowingqueries:
a.IdofFirst(Oldest)LPRecord
b.IdofLast(Recent)LPRecord
c.LPRecord
d.LPChannels.
a.IdofFirst(Oldest)LPRecord
Gettheindexofthefirst(oldest)LPrecordavailableinthemeter.
MODBUSFunctionCode
Request
++++++
++++++
Baeumle,Ficagna
Confidential
[Page34]
|0x01|0x03|0x020xbc|0x000x04|0x840x55|
++++++
Response
++++++
|Server|Function|Byte|IdofFirst|CRC16|
|Address|Code|Length|LPRecord|Swapped|
++++++
|0x01|0x03|0x08|...|...|
++++++
b.IdofMostRecentLPRecord
GettheindexofthelatestLPrecordavailableinthemeter.
MODBUSFunctionCode
Request
++++++
++++++
|0x01|0x03|0x000xd0|0x000x04|0x450xf0|
++++++
Response
++++++
|Server|Function|Byte|IdofLast|CRC16|
|Address|Code|Length|LPRecord|Swapped|
++++++
|0x01|0x03|0x08|...|...|
++++++
c.LPRecord
RetrievetheLPrecordatspecifiedindex.
MODBUSFunctionCode
Request
+++++++
|Server|Function|MeterR+|ReadWord|MeterW+|WriteWord|
|Address|Code|Register|Length|Register|Length|
|1byte|1byte|2bytes|2bytes|2bytes|2bytes|
+++++++
|0x01|0x17|0x000xce|0x000x0c|0x000xce|0x000x02|
Baeumle,Ficagna
Confidential
[Page35]
+++++++
+++
Byte|Record|CRC16|
Length|Index|Swapped|
1byte|8bytes|2bytes|
+++
0x04|...|...|
+++
Response
++++++++
|Server|Function|Byte|LP|LP|LP|LP|
|Address|Code|Length|Day|Month|Year|Hour|
|1byte|1byte|1byte|1bytes|1byte|2bytes|1byte|
++++++++
|0x01|0x17|0x18|...|...|...|...|
++++++++
+++++
Log|Channel|Data|Data|CRC16|
Minute|Id|Id|Value|Swapped|
1byte|1byte|1byte|4bytes|2bytes|
+++++
...|...|...|...|...|
+++++
d.LPChannels
Retrieveandconfigurethelistofchannelsforloadprofile.
oRead
Request
TBD.
Response
TBD.
oConfigure
Request
TBD.
Response
TBD.
6.7.QualityIndexes
TBD.
Baeumle,Ficagna
Confidential
[Page36]
6.8.CommunicationSession
Thesefunctionsarepriortohavingasecuresessionopen,sotheyare
transmittedwithoutencryption.
Messagesdescribedin
Chapter5
.
6.9.DisconnectControl
Thebreakerisanoptionalaccessoryofthemeter.Itisusedforremote
(re)connection/disconnectionoftheconsumerunit.Theclientcan(1)
open,(2)close,and(3)getthestatusofthebreaker.
[conditions]
o/>00
Disconnected<Connected
FigureX:Remote(re)connection/disconnection.
6.9.1.Reconnect
The(re)connectionoccursonlyifthefollowingconditionsaremet:
a.Networkvoltageisbetween80%and106%ofthenominalvaluein
allphases
b.Thereisnovoltageintheloadside.
MODBUSFunctionCode
Request
+++++++
|Server|Function|Meter|Word|Byte|Registers|
|Address|Code|Register|Length|Count|Values|
|1byte|1byte|2bytes|2bytes|1byte|8bytes|
+++++++
|0x01|0x10|0x000x96|0x000x04|0x08|0x00...0x00|
+++++++
++
|CRC16|
|Swapped|
|2bytes|
++
|0x7d0xf3|
++
Reponse
++++++
|Address|Code|2bytes|2bytes|2bytes|
Baeumle,Ficagna
Confidential
[Page37]
++++++
|0x01|0x10|0x000x96|0x000x04|0x210xe6|
++++++
6.9.2.Disconnect
Remotedisconnectionisalwaysallowed.
MODBUSFunctionCode
Request
+++++++
|Server|Function|Meter|Word|Byte|Registers|
|Address|Code|Register|Length|Count|Values|
|1byte|1byte|2bytes|2bytes|1byte|8bytes|
+++++++
|0x01|0x10|0x000x97|0x000x04|0x08|0x00...0x00|
+++++++
++
|CRC16|
|Swapped|
|2bytes|
++
|0x800x30|
++
Reponse
++++++
++++++
|0x01|0x10|0x000x97|0x000x04|0x700x26|
++++++
6.9.3.OutputState
Retrievetheoutputstateofthedisconnectcontrol.Thefollowingstates
arevalidfortheoutputstatefield:
(0)Disconnected
(1)Connected
MODBUSFunctionCode
Request
++++++
Baeumle,Ficagna
Confidential
[Page38]
++++++
|0x01|0x03|0x020x98|0x000x04|0xc50xe6|
++++++
Reponse
++++++
|Server|Function|Byte|OutputState|CRC16|
++++++
|0x01|0x03|0x08|...|...|
++++++
6.10.FirmwareUpgrade
Firmwareupgradeconsistsof3steps(FigureX):(1)startthetransfer
(informthesizeofthenewfirmware)(2)transfertheblocks(3)
transferthesignatureofthefirmware(finishthetransfer).
ClientMeter
||
|(1)WriteMultipleRegisters[0x10,fwLength]|
+>|
||
|[writeok]|
|<+
||
|while(remainingblocks)|
||
|(2)WriteMultipleRegisters[0x10,block]|
+>|
||
|[writeok]|
|<+
||
|(3)WriteMultipleRegisters[0x10,signature]|
+>|
||
|[writeok]/[noreply(error)]|
|<+
||
FigureX:StepsofFirmwareUpgrade
Afterthesignaturetransfer,themetershallreboot(theclientpowered
bythemetershouldalsoreboot).Theversioncanbeverifiedwiththe
firmwareversionquery.IfMODBUSwriteOKisnotreceivedinanyofthe
steps,itmeansanerroroccurredandtheprocessmustberestarted.
Baeumle,Ficagna
Confidential
[Page39]
6.11.Logs
Retrievemeterlogs.
6.11.1.Errors&Alarms
Retrievealistwiththe10mostrecenterrorsoralarms.
MODBUSFunctionCode
Request
++++++
++++++
|0x01|0x03|0x000x84|0x000x33|0x450xf6|
++++++
Reponse
++++++++
|Server|Function|Byte|Error|Alarm|Day|Month|
|Address|Code|Length|Code|Code|131|112|
|1byte|1byte|1byte|2bytes|2bytes|1byte|1byte|
++++++++
|0x01|0x03|0x66|...|...|...|...|
++++++++
\repeats10times...
+++++
Year|Hour|Minute|Second|CRC16|
0255|0023|0059|0059|Swapped|
+++++
...|...|...|...|...|
+++++
.../
Note
Unfilledeventshavevalue255(0xff).forinstance,ifalarmcodeis
255anderrorcodeisnot,thenthelineisanerrorandviceversa.
6.11.2.ParameterChanges
Retrieveinformationaboutpastparameterchangeevents.Twocommandscan
beusedinconjunction:
oIdofMostRecentParameterChange
oParameterChangeLog(idmustbeprovided).
a.IdofMostRecentFirmwareLog
Baeumle,Ficagna
Confidential
[Page40]

MODBUSFunctionCode
Request
++++++
++++++
|0x01|0x03|0x000x90|0x000x04|0x150xe4|
++++++
Reponse
++++++
|Server|Function|Byte|IdofMostRecent|CRC16|
|Address|Code|Length|Log(uint64_t)|Swapped|
++++++
|0x01|0x03|0x08|...|...|
++++++
b.ParameterChangeLog
MODBUSFunctionCode
Read+WriteHoldingRegisters
Request
+++++++
+++++++
|0x01|0x17|0x000x8f|0x000x2a|0x000x8f|0x000x04|
+++++++
+++
Byte|Idofthe|CRC16|
Length|Log|Swapped|
+++
0x08|...|...|
+++
Response
+++++++
|Server|Function|Byte|Modified|Log|User|
|Address|Code|Length|ParamCode|Index|Id|
+++++++
|0x01|0x17|0x54|...|...|...|
Baeumle,Ficagna
Confidential
[Page41]
+++++++
++++++
Log|Log|Log|Log|Log|Log|
Day|Month|Year|Hour|Minute|Second|
++++++
...|...|...|...|...|...|
++++++
+++
ParamOld|ParamNew|CRC16|
Value|Value|Swapped|
+++
...|...|...|
+++
oModifiedParameterCode([07]|9|65535)
Mayassumeoneofthefollowingvalues:
(0)Date
(1)Time
(3)TariffId
(4)DayType
(5)TariffRate
(6)Holiday
(7)DaylightSavings
(9)Invalidlog.
oLogIndex
Istheidoftherequestedlog.
oUserId
Correspondtooneofthevaluesfromuseridslog.
6.11.3.FirmwareUpgrade
Retrieveinformationaboutpastfirmwareupgradeattempts.Twocommands
canbeusedinconjunction:
oIdofMostRecentFWLog
oFWLog(idmustbeprovided).
a.IdofMostRecentFirmwareLog
MODBUSFunctionCode
Request
++++++
Baeumle,Ficagna
Confidential
[Page42]
++++++
|0x01|0x03|0x000x91|0x000x04|0x150xe4|
++++++
Reponse
++++++
|Server|Function|Byte|IdofMostRecent|CRC16|
|Address|Code|Length|Log(uint64_t)|Swapped|
++++++
|0x01|0x03|0x08|...|...|
++++++
b.FirmwareUpgradeLog
MODBUSFunctionCode
Read+WriteHoldingRegisters
Request
+++++++
+++++++
|0x01|0x17|0x000x8f|0x000x2a|0x000x8f|0x000x04|
+++++++
+++
Byte|Idofthe|CRC16|
Length|Log|Swapped|
+++
0x08|...|...|
+++
Response
+++++++
|Server|Function|Byte|Modified|Log|User|
|Address|Code|Length|ParamCode|Index|Id|
+++++++
|0x01|0x17|0x54|0x08|...|...|
+++++++
++++++
Log|Log|Log|Log|Log|Log|
Day|Month|Year|Hour|Minute|Second|
++++++
...|...|...|...|...|...|
++++++
Baeumle,Ficagna
Confidential
[Page43]

+++
ParamOld|ParamNew|CRC16|
Value|Value|Swapped|
+++
...|...|...|
+++
oModifiedParameterCode
8ifthelogisvalid,9ifnotvalid.
oLogIndex
Istheidoftherequestedlog.
oUserId
Correspondtooneofthevaluesfromuseridslog.
6.11.4.UserIds
Retrievealistofthedevicesthatauthenticatedwiththemeter.The
responsecontainsthesignatureofthepublickeyofeachauthenticated
device.Themeterholdsapointertothelastretrieveduserid,sowhena
newrequestismade,itwillrespondwiththenextidinthelist.When
thepointerreachesthelastid,theresponsewillhaveanidwithmaximum
uin32_tvalue(0xffffffff).
MeterUserIdList
+++
|Id|Signature|
+++
|00000001|0b1b2345fcd...|
|00000002|0dabc333afa...|
|00000003|fc1f2322ad3...|<replypointer
|00000004|db1a2315bc2...|(movesnexteachquery)
|...||
|ffffffff|fffffffffff...|^returnstotop
+++
FigureX:MeterUserId
ListPointer.
oIdisasequentialnumberassociatedtothesignature.
oSignatureisthe32bytesignedhashofthepublicECkeyofthe
client.
MODBUSFunctionCode
Request
++++++
Baeumle,Ficagna
Confidential
[Page44]
++++++
|0x01|0x03|0x000xb1|0x000x12|0x950xe0|
++++++
Note:itispossibletoreadmorewords(multiplesof12).
MaximumModbusPDUsizemustberespected.
Reponse
+++++++
|Server|Function|Byte|User|User|CRC16|
|Address|Code|Length|Signature|Id|Swapped|
+++++++
|0x01|0x03|0x24|...|...|...|
+++++++
7.FinalConsiderations
ClientsprivateECkeymustbestoredinasecurewayandshouldbe
uniqueforeachdevice.
Allcommunicationwiththemeterexceptthesessionestablishmentshould
beencrypted.
TheclientshouldfollowstandardMODBUSRTUrecommendationswithregards
totimeoutsandframeformat.
Baeumle,Ficagna
Confidential
[Page45]
APPENDIXA:SMWQUICKQUERYGUIDE
Instantaneousvalues
++++++
|Query|Unit/|Access|MODBUS|Reg.|R/W
No|Description|Format|Rights|Fun.Code|Addr.|Length
++++++
01|Inst.RMSVoltage|mV|R|0x03|0x00|12
02|Inst.RMSCurrent|mA|R|0x03|0x04|12
03|Inst.ActivePower|mW|R|0x03|0x18|16
04|Inst.ReactivePower|mVAR|R|0x03|0x19|16
05|Inst.ApparentPower|mVA|R|0x03|0x1a|16
06|Inst.PowerFactor|
|R|0x03|0x22|16
07|TotalHarmonicDist.|
|R|0x03|0x27|16
08|InternalTemperature|C|R|0x03|0x6a|4
09|SupplyFrequency|E2Hz|R|0x03|0x80|4
10|AngleofU(Li)|E3|R|0x03|0x99|4
11|BatteryCharge||R|0x03|0x2be|4
++++++
Configuration
++++++
++++++
12|Clock|ddmmyy|R,W|0x03,0x10|0x63|4
||hhMMss||||
13|Re.FlowAlm.Timeout||R,W|0x03,0x10|0x63|4
14|RunningConf.(p.1)||R|0x03|0xac|88
15|RunningConf.(p.2)||R|0x03|0xad|54
16|InactiveConf.(p.1)||R,W|0x03,0x10|0xae|88
17|InactiveConf.(p.2)||R,W|0x03,0x10|0xaf|54
18|RunningDisp.Config.||R|
0x03|0x20d|
|NormalMod|||
||
19|RunningDisp.Config.||R|
0x03|0x20e|
|Altern./AnalysisMode|||
||
20|InactiveDisp.Config.||R,W|0x03,0x10
|0x5f|
|NormalMode|||
||
21|InactiveDisp.Config.||R,W|0x03,0x10
|0x60|
|Altern./AnalysisMode|||
||
++++++
LoadProfile
++++++
++++++
22|LP||R|0x17|0xce|
23|IdofFirst(Oldest)||R|0x03|0x2bc|4
24|IdofLast(Recent)||R|0x03|0xd0|4
++++++
Baeumle,Ficagna
Confidential
[Page46]

TariffRates
++++++
++++++
25|CurrentTariffZone||R|0x03|0x61|4
++++++
QualityIndexes
++++++
++++++
26|DRPRegisters||R|0x03||
27|DRPLast||R|0x03||
28|DRPAverage||R|0x03||
29|DRCRegisters||R|0x03||
30|DRCLast||R|0x03||
31|DRCAverage||R|0x03||
32|DRP/DRCReset||W|0x10||
33|DIC/FICRegisters||R|0x03||
34|DIC/FICReset||W|0x10||
35|SAGCounter||R|0x03||
36|SAGReset||W|0x10||
37|SWELLCounter||R|0x03||
38|SWELLReset||W|0x10||
++++++
Energy
++++++
++++++
39|ActiveEnergy,|mWh|R|0x03|0x08|4
|Total,Import+Export|||||
40|ActiveEnergy,|mWh|R|0x03|0x0a|16
|Import,PerTariffRate|||||
41|ActiveEnergy,|mWh|R|0x03|0x0b|4
|Total,Import|||||
42|ActiveEnergy,|mWh|R|0x03|0x0c|16
|Export,PerTariffRate|||||
43|ActiveEnergy,|mWh|R|0x03|0x0d|4
|Export,Total|||||
44|ReactiveEnergy,|mVARh|R|0x03|0x12|4
|Total,Import+Export|||||
|Import,PerTariffRate|||||
|Import,Total|||||
Baeumle,Ficagna
Confidential
[Page47]
|Export,PerTariffRate|||||
|Export,Total|||||
++++++
MODBUSCommunicationSession
+++++
|Query|Access|MODBUS|Reg.|R/W
No|Description|Rights|Fun.Code|Addr.|Length
+++++
49|MeterPublicKey|R|0x17|0x6f|33
50|SignatureofMeterPublicKey|R|0x17|0x70|36
51|ClientPublicKey|R,W|0x17|0x71|33
52|SignatureofClientPublicKey|R,W|0x17|0x72|36
53|DHPublicValue|R,W|0x17|0x75|110
53|SignatureofDHPublicValue|R,W|0x17|0x74|24
+++++
DisconnectControl
+++++
+++++
55|Reconnect|W|0x10|0x96|4
56|Disconnect|W|0x10|0x97|4
57|OutputState|R|0x03|0x98|4
+++++
FirmwareUpgrade
+++++
+++++
58|NewFirmwareTransfer|W|0x10|0x9a|2
59|TransferBlock|W|0x10|0x9b|
60|TransferSignature|W|0x10|0x9c|
+++++
Logs
+++++
+++++
61|Errors&Alarms|R|0x03|0x84|51
62|ParameterChanges|R|0x17|0x8e|42
63|IdofMostRecentParamChange|R|0x03|0x90|4
64|FirmwareUpgrade|R|0x17|0x8f|42
65|IdofMostRecentFWUpgrade|R|0x03|0x91|4
66|UserIds|R|0x03|0xb1|18
+++++
Baeumle,Ficagna
Confidential
[Page48]
FirmwareIdentification
+++++
+++++
67|FirmwareHash|R|0x03|0x2bd|16
68|FirmwareVersion|R|0x03|0x85|8
+++++
Notes
1"Readlength"istheregisterlengthgivenbythenumberofwords.For
bytelengthmustmultiplybyafactorofx2.
2Instantaneousreadingsreturnthevaluesperphaseinthesamemessage.
Nonexistingphaseshavevalue0.
3Powerreadingsreturnthevaluesperphaseinthesamemessage.
Nonexistingphaseshavevalue0.
4Energyreadingsreturnthetotalandpertariffvalueinthesame
message.
5Clockanddate/timevaluesarerepresentedintheformatddmmyyhhMMss
unlessstatedotherwise.
Baeumle,Ficagna
Confidential
[Page49]
APPENDIXB:SDKANDOBISEQUIVALENTCODES
COSEMClass1DataObjects
++++
|Obis|Description|SDKCommand|
++++
|00:0.2.0.255|ActiveFWidentifier|kFirmwareVersion|
|00:0.2.1.255|ActiveFWversion|kFirmwareVersion|
|00:96.1.0.255|Serialnumber|kRunningConfiguration|
|00:96.1.1.255|Manufacturingnumber|kRunningConfiguration|
|00:96.1.2.255|Utilitynumber|kRunningConfiguration|
|10:96.1.0.255|Consumerunit|kRunningConfiguration|
|00:97.97.0.255|Errors|kEventsLog|
|00:97.98.0.255|Alarms|kEventsLog|
|10:128.128.0.255|Displayconfig|kRunningConfiguration|
|10:128.128.1.255|PhaseCount|kRunningConfiguration|
|10:94.55.1.255|DRP|kDrp|
|10:94.55.2.255|DRC|kDrc|
|00:42.0.0.255|COSEMdevicename||
|00:96.2.0.255|No.ofconfiguration|kRunningConfigurationB|
||programchanges||
|00:96.2.1.255|Dateoflastconfig|kRunningConfigurationB|
||programchange||
|00:96.2.5.255|Dateoflastcalib|kRunningConfiguration|
|00:96.2.13.255|DateoflastFW|kRunningConfiguration|
||activation||
|10:128.128.3.255|RW+opticalport|kRunningConfiguration|
||passwords||
++++
COSEMClass3RegisterObjects
++++
++++
|10:12.32.0.255|SAGcounter|kSagRead,kSagReset|
|10:12.36.0.255|SWELLcounter|kSwellRead,kSwellReset|
|10:0.6.0.255|Nominalvoltage|kRunningConfiguration|
|10:0.6.1.255|Nominalcurrent|kRunningConfiguration|
|10:81.7.2.255|AngleU(L3)U(L1)|kPhaseAngle|
|10:15.7.124.255|THD|kTotalHarmonicDistortion|
|10:35.7.124.255|THD,L1|kTotalHarmonicDistortion|
|10:1.7.0.255|ActivePwrI+Total|kActivePower|
|10:21.7.0.255|ActivePwrI+L1|kActivePower|
|10:2.7.0.255|ActivePwrE+Total|kActivePower|
|10:22.7.0.255|ActivePwrE+L1|kActivePower|
Baeumle,Ficagna
Confidential
[Page50]
|10:3.7.0.255|ReactivePwrI+Total|kReactivePower|
|10:23.7.0.255|ReactivePwrI+L1|kReactivePower|
|10:4.7.0.255|ReactivePwrE+Total|kReactivePower|
|10:24.7.0.255|ReactivePwrE+L1|kReactivePower|
|10:13.7.0.255|PowerFactor,Total|kInstantaneousPowerFactor|
|10:33.7.0.255|PowerFactor,L1|kInstantaneousPowerFactor|
|10:31.7.0.255|InstRMSCurrentL1|kInstantaneousRMSCurrent|
|10:32.7.0.255|InstRMSVoltageL1|kInstantaneousRMSVoltage|
|10:14.7.0.255|SupplyFrequency|kSupplyFrequency|
|00:96.9.0.255|InternalTemperature|kAmbientTemperature|
|00:96.6.1.255|BatteryChargeStatus|kBatteryCharge|
|10:1.8.0.255|ActEnergyI+Total|kActiveEnergyFundamentalIm|
|||portTotal|
|10:1.8.1.255|ActEnergyI+Rate#1|kActiveEnergyFundamentalIm|
|||port|
|||port|
|||port|
|||port|
|10:2.8.0.255|ActEnergyE+Total|kActiveEnergyFundamentalIm|
|||portTotal|
|10:2.8.1.255|ActEnergyE+Rate#1|kActiveEnergyFundamentalEx|
|||port|
|||port|
|||port|
|||port|
|10:15.8.0.255|ActEnergyTotalI/E|kActiveEnergyFundamentalTotal|
|10:3.8.0.255|ReEnergyI+Total|kReactiveEnergyFundamentalIm|
|||portTotal|
|10:3.8.1.255|ReEnergyI+Rate#1|kReactiveEnergyFundamentalIm|
|||port|
|||port|
Baeumle,Ficagna
Confidential
[Page51]
|||port|
|||port|
|10:4.8.0.255|ReEnergyE+Total|kReactiveEnergyFundamentalEx|
|||portTotal|
|10:4.8.1.255|ReEnergyE+Rate#1|kReactiveEnergyFundamentalEx|
|||port|
|||port|
|||port|
|||port|
++++
COSEMClass7ProfileGeneric
++++
++++
|10:99.1.0.255|Loadprofile|kMassMemory,|
|||kMassMemoryFirstIndex,|
|||kMassMemoryLastIndex,|
|||kRunningConfigurationB|
++++
COSEMClass8Clock
++++
++++
|00:1.0.0.255|Clockobject|kDateTime|
++++
COSEMClass11SpecialDaysTable
++++
++++
|00:11.0.0.255|Specialdaystable|
TBD.
|
++++
COSEMClass15AssociationLN
++++
++++
|00:40.0.0.255|Currentassociation||
++++
COSEMClass17SAPAssignment
++++
++++
|00:41.0.0.255|SAPassignment||
Baeumle,Ficagna
Confidential
[Page52]
++++
COSEMClass18ImageTransfer
++++
++++
|00:44.0.0.255|Imagetransfer|kNewTransfer,|
|||kTransferBlock,|
|||kTransferSignature|
++++
COSEMClass20ActivityCalendar
++++
++++
|00:13.0.0.255|Activitycalendar|
TBD.
|
++++
COSEMClass40CosemPushSetup
++++
++++
|00:25.9.0.255|Pushsetup||
++++
COSEMClass64SecuritySetup
++++
++++
|00:43.0.0.255|Securitysetup||
++++
COSEMClass70DisconnectControl
++++
++++
|00:96.3.10.255|Disconnectcontrol|kControlSignalsCloseBreaker,|
|||kControlSignalsOpenBreaker,|
|||kControlSignalsGetBreakerSta|
|||te|
++++
Baeumle,Ficagna
Confidential
[Page53]

Draft SMW Modbus Spec 20151210

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Draft SMW Modbus Spec 20151210

Transféré par

Droits d'auteur :

Formats disponibles

WEGDrives&ControlsAutomaoLtda

Vous aimerez peut-être aussi