Modbus RTU between PCS and EMS: frames, function codes and register partitions

The VGRID POWER event-record and shutdown-waveform protocol governs PCS-to-EMS communication over Modbus RTU or Modbus TCP/IP, covering SP100HC, SP100HC-1, SP110HS and SP110HS-1. The most common integration error is not wiring but reading across register partitions in a single request: the protocol explicitly states that cross-partition reads are not supported.

Link and frame structure

Serial device addresses span 1 to 16, with the physical interface determined by the PCS ports. A standard RTU message has start marker, RTU frame and end marker; the RTU frame contains the address, a PDU (function code plus data) and a CRC. Supported functions are 0x03 for reading multiple registers or status words and 0x06 for writing a single register or command. An exception code equals the request function code plus 0x80, so 0x83 and 0x86. A 0x03 request reads at most 125 registers, with two bytes per register, high byte first.

Parameter partitions

ARM basic information starts at 0 with 16 registers; DSP basic information at 16 with 8; status and fault information at 25 with 75; common user variables at 100 with 199; ARM user configuration at 300 with 31, DSP user configuration at 331 with 24 and further ARM configuration at 360 with 100; control commands at 650 with 20; module configuration at 700 with 199; CAN information at 5000 with 485; battery basic information at 6000 with 50; upgrade status at 50000 with 20; and the fault waveform partition starts at 51001 with 22015 registers. Split EMS requests by partition rather than crossing a boundary.

Point-table checks on site

The status and fault partition exposes bitfield fault words: register 50 covers inverter fault, neutral anomaly, paralleling fault, cycle-by-cycle current limiting, AC short circuit and overload; register 52 covers islanding, LVRT/HVRT faults and leakage-current alarm; register 53 covers EMS communication-loss shutdown, fan alarm, insulation fault and BMS fault. Bind bit definitions, scaling factors, read/write attributes and polling intervals to the firmware version, and record that version in the AEMS100 commissioning report so a remote upgrade cannot silently shift the point mapping.

Frequently asked questions

0x03 returns no data - what to check first?

Verify the device address (1-16), that the function code is supported, and that start address plus quantity stay within one partition. Then use exception code 0x83 to distinguish an illegal address from illegal data.

Is CRC still needed over Modbus TCP/IP?

CRC belongs to the RTU frame. TCP/IP uses an MBAP header instead. The protocol supports both links, so confirm the actual PCS port before integration.

Related equipment and guides

SP125HCPS · SP1350H54SW · STS200 · SP200/150HAPV · All technical guides · Product catalogue。