Electrical network management

MV substation control unit

Merlin Gerin Easergy Range

G200

Modbus Communication
User's manual
Contents

GENERAL 3 
Functionality 3 
Characteristics 3 
Specific Modbus TCP features for GPRS solar version 3 
COMMUNICATION MODULE 4 
Communication module configuration 4 
Flite communication parameters 5 
Parameters Flite x to y 6 
Alarm and storage parameters 6 
Alarm parameters: Overall 7 
Alarm Parameters: Flite information 7 
Alarm Parameters: G200 information 8 
Relay parameters 9 
Communication parameters 10 
Modbus TCP/IP parameters 13 
Display events 14 
Display analog 14 
Flite counters 15 
Equipment state 16 
MODBUS analyser 17 
Time setup 18 
Radio analyser 18 
MODBUS DATA ADDRESSES AND ENCODING 19 
General 19 
Identification / configuration zone 21 
Time synchronisation zone 21 
Test zone 22 
Event zone 22 
TCD / TSS zone 24 
Parameters zone 27 
Diagnostic counter reading 34 
Report by exception without any modem 35 
Report by exception with GSM 35 
Report by exception with GPRS 36 
APPENDIX 37 
MODBUS protocol (non GPRS version) 37 
MODBUS TCP protocol (GPRS version only) 39 
Read N bits: functions n°1 and 2 40 
Read N words: functions n°3 and 4 40 
Write a bit: function n°5 41 
Write a word: function n°6 41 
Read diagnostic counters: function n°8 42 
Write N consecutive words: function n°16 43 
Report Slave ID: function n°17 43 
CRC 16 calculation algorithm 44 
Write CRC 16 calculation in C language 44 

2 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

General

Functionality

Monitoring
Network faults (di/dt or IMAX)
Voltage losses/ returns
Flite Low battery and communication failures

Measurements
Phase currents(I_min, I_max, I_mean and I_inst)
MV presence statistics

Remote control
Flite parameters
G200 parameters
Long range communication
Storage and alarm information

Characteristics
type of transmission asynchronous serial
protocol Standard Modbus slave or Modbus TCP
speed 300, 600, 1200, 2400, 4800,
9600, 19200 baud
data format 1 start bit, 8 data bits with no parity, 1
stop bit
electrical interface RS232, GSM or GPRS

Specific Modbus TCP features for GPRS solar version

G200 GPRS can be used as any MODBUS TCP slave but an enhanced specification has been added to solve two major
issues:
- Modbus TCP is not compliant with a solar power supply due to the fact that the connection is permanent.
- In many cases, GPRS access does not provide a static IP to the RTU. So the SCADA can not establish the connection.

Consequently, a non-permanent mode has been developed. In this mode, Scada system and G200 can be both TCP client
and server. It means that the G200 is establishing a connection on alarm. The SCADA system can also establish a
connection on demand but in both case TCP link is never maintained.

For dynamic IP, each time the G200 is changing its IP address, an alarm can be activated and the G200 is establishing a
connection to provide its new IP address to the SCADA..

This mode has been implemented in the L500 system.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 3

Communication module

Communication module
configuration
Equipment Name:
 Local name only used to access a hidden GSM version
menu (reserved to the manufacturer). ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ══════════╗
║ Easergy G200 Modbus ║
Flite Identification: ║ PROM v2.00 ║
║ ║
 When selected, G200 searches for all ║ ║
nearby FLITE units and records their ║ EQUIPMENT NAME: G200Modb ║
║ ║
unique physical address. ║ FLITE SETUP : ║
 The process takes 2 minutes approx. ║
║
Flite Identification
Parameters Flite 1 to 6
Flite Communication Parameters
Parameters Flite 7 to 9
║
║
║ ║
Flite Communication parameters: ║ MODBUS Address: 1 ║
║ Alarm and Storage Parameters Relay Parameters ║
 Gives access to the short range radio ║ ║
G200-FLITE communication parameters ║ COMMUNICATION SETUP : ║
║ Modem Slot 1 : GSM Modem Slot 2 : Short Range Radio ║
║ Communication Parameters ║
Parameters Flite x to y: ║ ║
║ SAVE CONFIGURATION : OK Export ║
 Gives access to fault parameters of each ║ Cancel Import ║
FLITE unit (referred to with a logical ║ DIAGNOSIS ║
║ Display events Erase events Setup Time ║
address 1 to 9) ║ Display analog Equipment states ║
║ Flite counters Modbus analyser RADIO analyser ║
╚══════════════════════════════════════════════════════════════════════════════╝
Modbus Address:
 Source address used by the remote
GPRS version
SCADA to identify this G200 through the
protocol. ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ══════════╗
║ Easergy G200 Modbus GPRS ║
 Adjustable from 1 to 255 in GSM and ║ PROM v1.00 ║
RS232 version. ║ ║
║ EQUIPMENT NAME: G2MGPRS ║
 1 is the default modbus address value in ║ ║
GSM and RS232 version. In GPRS ║ FLITE SETUP : ║
║ Flite Identification Flite Communication Parameters ║
version, the value is fixed to 255 ║ Parameters Flite 1 to 6 Parameters Flite 7 to 9 ║
║ ║
║ MODBUS Address: 255 ║
Alarm and storage parameters: ║ Alarm and Storage Parameters Relay Parameters ║
 Gives access to alarm & storage menu ║ ║
║ COMMUNICATION SETUP : ║
║ Modem Slot 1 : GPRS Modem Slot 2 : Short Range Radio ║
Note: for RS232, the link is permanent so ║ GPRS parameters ║
║ Modbus TCP/IP parameters ║
alarms have no use. ║ ║
║ SAVE CONFIGURATION : OK Export ║
║ Cancel Import ║
Relay parameters: ║ DIAGNOSIS ║
 menu used to configure Relay parameters. ║ Display events Erase events Setup Time ║
║ Display analog Equipment states ║
║ Flite counters Modbus analyser RADIO analyser ║
Modem Slot 1: ╚══════════════════════════════════════════════════════════════════════════════╝

 Direct RS232:
Direct RS232 : permanent link. Communications Parameters
 Modem Hayes (dial-up): (Direct RS232 and Data Modem only):
Hayes : for Hayes compatible modems.  Gives access to long range communication parameter settings
GSM: for AT commands compatible GSM
modems. GPRS Parameters (GPRS Modem only):
 Gives access to GPRS menu
 Modem GPRS:
GPRS: for WAVECOM GPRS/ GSM Modbus TCP/IP Parameters (GPRS Modem only):
modems with embedded IP stack  Gives access to Modbus TCP/ IP menu

4 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

Save Configuration: Display events:

 Displays the log of the last 100 time-stamped records
 OK: requested to confirm modifications of
any data, both in the main menu and in the Display analog:
sub-menus.  Displays the current measurement value lookup box
 Cancel: all the modifications that have Flite counters:
been done but not yet confirmed are  Displays the statistics counters from the flites
cancelled. The equipment keeps the
previous data, which is displayed back on Erase events:
the screen.  Erases the records log after confirmation

 Export: the settings are copied in a file Equipment states:

with a “.cfg” extension:  The equipment states menu is used to display information linked to G200
and Flites state.
All versions
flite.cfg: FLITE parameters Modbus analyser:
 Displays the trace of exchanges with the remote control station
Direct RS232 and GSM:
g200m.cfg: G200 parameters Setup time:
com.cfg: long range communication  Displays the dialogue box for time setup on G200
parameters
Radio analyser:
GPRS:  This menu is used to analyse data exchanges on the short range radio link
g2mgprs.cfg: G200 parameters with each FLITE unit
gprs.cfg: GPRS parameters
ip.cfg: TCP/IP parameters
 Import: the settings are imported from
“.cfg file”. If no “.cfg” file is present, the
default configuration is loaded.

Flite communication
parameters
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
This menu is used to set the short range ║ Flite Communication Parameters ║
communication parameters between G200 and ║ ║
║ Serial Number Wink RSSI Level logical Address ║
FLITE units. ║ ║
║ 012B043002C0 WINK RSSI 1 ║
║ 012B043002D5 WINK RSSI 2 ║
IMPORTANT : during the first installation, it ║ 012B04300315 WINK RSSI 3 ║
is vital to activate a FLITE identification ║ 012B0430000B WINK RSSI 4 ║
║ 012B04300317 WINK RSSI 5 ║
command (main menu) to update this menu. ║ 012B043002C3 WINK RSSI 6 ║
║ 012B043002CA WINK RSSI 7 ║
║ 012B043002CB WINK RSSI 8 ║
Serial Number: this is the physical address (in ║ 012B0430031C WINK RSSI 9 ║
║ ║
hexadecimals, on 6 bytes) of the FLITE units ║ ║
identified by the G200. This list is updated by ║ ║
║ Get Flite Current ║
the "FLITE identification" command in the main ║ Get Flite Info ║
menu. This field cannot be modified by the ║ Nota : an indicator is considered as missing if its logical address is 0 ║
║ ║
operator. ║ Measuring period : 1 h ║
N.B.: The value FFFFFFFFFFFF means that ║ ║
║ Escape=Exit ║
there is no corresponding FLITE unit. ╚═════════════════════════════════════════════════════════════════════════════╝

Wink: the WINK command (signal) is used to For example, say that 3 FLITEs have been detected
flash a FLITE unit.  FLITE on phase A => select 1 as its logical address
 FLITE on phase B => select 2 as its logical address
RSSI Level: the RSSI command (Received  FLITE on phase C => select 3 as its logical address
Signal Strength Indication) is used to get
information on the signal level received by  Measuring period: this is the period used by FLITE for current
FLITE. In good conditions, the indication measurement . It is either set to 2 mn (for test purpose only) or to 1 hour
should be greater than 30 %. (standard operation).
Logical Address: Configurable from 0 to 9,  Get Flite Current: when selected, this command retrieves the latest current
this is the logical address that is used by the value measured from all FLITE units (data available in “display analog”
G200 to address FLITE. An indicator is menu).
considered as not present if its logical address
is 0.  Get Flite Info: when selected, this command retrieves the latest value of
communication counters from all FLITE units (data available in “Flite counters”
IMPORTANT : All FLITE units must have a menu).
different logical address from 1 to 9

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 5

 ” menu).

Communication module

Parameters Flite x to y
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
These two menus are used to configure FLITE ║ Parameters Flite 1 to 6 ║
fault detection parameters. ║ ║
║ ║
║ ║
For each FLITE unit, following parameters are ║ Flite Flite Flite Flite Flite Flite ║
adjustable: ║ n°1 n°2 n°3 n°4 n°5 n°6 ║
║ ║
║ FAULT DETECTION ║
DI/DT level: ║ DI/DT level : 60 A 60 A 60 A 60 A 60 A 60 A ║
║ I max level : 250 A 500 A 500 A 500 A 500 A 500 A ║
 Minimum phase current variation threshold ║ auto. Reset : 3 s 3 s 3 s 3 s 3 s 3 s ║
above which a fault is detected. ║ Flash time : 2 h 2 h 2 h 2 h 2 h 2h ║
║ Inrush : 3 s 3 s 3 s 3s 3 s 3 s ║
 Adjustable from 6 to 80A, or disabled. ║ Validation : On On On On On On ║
 DT is automatically set to 30ms (50Hz) or ║ MV level(1) : A A A A A A ║
║ ║
25ms (60HZ) for FLITE116-SA ║ ║
║ (1): A = single circuit , B = multi-circuit ║
Note: the selected threshold may be set at any ║ ║
║ ║
value, whatever the load current is. This is why ║ ║
using a DI/DT algorithm is preferred to a IMAX ║ ║
║ Escape=Exit ║
algorithm, for one may apply the same value for ╚══════════════════════════════════════════════════════════════════════════════
the whole feeder since the feeding substation. ╝
Flash time:
Imax level:  time-out after which flash is reset.
 Minimum absolute phase current threshold  Adjustable from 2 to 16 hours.
above which a fault is detected.
 Adjustable from 100 to 800A Inrush:
 Used to filter inrush currents due to MV/LV transformers magnetising
Note: the selected threshold must be greater currents upon line energising.
than the maximum load current in use on the  Adjustable to 3/ 30/ 60s or to OFF (“without”).
conductor at the location where it is installed.  Setting it to OFF means to de-activate the inrush filter (not recommended)

Auto. Reset: Validation:

 Time-out for which FLITE waits after MV  when set to ON (“70 s” for FLITE116-SA or “5 s” for FLITE116), FLITE
has return before resetting the flash. must see a voltage dip within 70 s (5 s for FLITE116) after the fault
 Adjustable to 3/ 30/ 70s for automatic occurrence to confirm it.
voltage reset, or to OFF (“no”) for transient  Setting it to OFF may be useful for some specific applications.
fault detection.
Note: FLITE may be set to find all types of faults MV level:
(permanent, transient and “self-extinguishable”)  this is the electrical field that FLITE must sense for all voltage operations
depending on its parameter settings. (fault confirmation and automatic voltage reset).
 Adjustable to A or B:
 A: for single line pole
 B: for multi-lines poles
 Default value : A

Alarm and storage

parameters
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Alarm and Storage Parameters ║
This menu is used to configure the alarm ║ ║
parameters for the long range communication ║ ║
and storage parameters. ║ ║
║ ║
║ ║
║ ║
║ ║
Alarm Parameters: Overall ║ Alarms Parameters: Overall ║
 Gives access to general G200 alarm menu ║ ║
║ Alarm Parameters : Flite information ║
║ ║
║ Alarm Parameters : G200 information ║
Alarm Parameters: Flite information ║ ║
 Gives access to FLITE alarms and events ║ ║
storage menu ║ ║
║ ║
║ ║
║ ║
Alarm Parameters: G200 information ║ ║
Gives access to G200 alarms and events ║ ║
║ ║
storage menu ║ Escape=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝


6 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

Alarm parameters:
Overall

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗

This menu is used to set automatic calls to the ║ Alarms Parameters: Overall ║
supervisor ║ ║
║ ║
║ Alarm message enabled : yes ║
Alarm message enabled: ║ ║
║ Call Test (write 1 only): no ║
 Yes: If an alarmed change of state occurs ║ ║
a call is made to the SCADA ║ ║
║ ║
 No: G200 does not send any alarm ║ Automatic call : no ║
message to the SCADA ║ Start time (h) : 0 ║
║ (min) : 15 ║
║ Period (hours) : 24 ║
║ ║
Call Test: ║ ║
 to test long range communication, ║ ║
║ ║
select yes ║ ║
 At the next configuration save, G200 shall ║ ║
║ ║
issue a call to the SCADA. ║ ║
║ ║
║ Escape=Exit ║
Automatic call: ╚═════════════════════════════════════════════════════════════════════════════╝
 To issue a cyclic call to the SCADA,
select yes
 Type in the start time (next time after back-
up), and the period (in hours).
 This option can be used to test
communication with equipment once a day.
 It is not mandatory to activate it if a daily
call is already done by the SCADA.

Alarm Parameters:
Flite information

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗

This menu is used to set the alarm parameters ║ Alarm Parameters : Flite information ║
and storage information for FLITE events. ║ ║
║ ║
║ Alarm ║
For TSS item, you can choose whether the ║ dI/dt : Alarmed ║
║ Imax : Alarmed ║
corresponding event is alarmed, alarmed on bit ║ Flite Batt. check : Not alarmed ║
set only, alarmed on bit clear only, or not ║ Volt.Presence : Not alarmed ║
alarmed. ║ ║
║ ║
║ Flite Comm Fault : Not alarmed ║
║ Successive comm fault : 1 (before alarm) ║
For current and voltage measurement, you can ║ Config in progress : Not alarmed ║
choose whether the corresponding event is ║ Config fault : Not alarmed ║
stored in the modbus event stack, or not stored ║ ║
║ ║
(see deadband value). ║ Info in stack DeadBand value ║
║ Imean(A) : Stored 20 Current(%) ║
║ Imin(A) : Not stored 2 Min variation(A) ║
Di/dt: ║ Imax(A) : Stored ║
║ Volt.(kV/m) : Not stored 2 Voltage(kV/m) ║
 Alarm of all di/dt faults detected by any ║ ║
FLITE unit. ║ Escape=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝

Imax Fault:
 Alarm of all IMAX faults detected by any
FLITE unit.

Flite batt. check:

 Alarm of low battery alarm from any FLITE
unit.

Voltage presence :
 Alarm of voltage presence/absence

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 7

Communication module

Flite comm fault: DeadBand value for current measurement:

 Alarm on FLITE-G200 short range  Current(%): relative current variation required for storage.
communication faults.  Min variation (A): minimum absolute variation that is required for storage.
 An alarm is set when the number of
successive FLITE communication faults is Caution: to be stored, a current must increase or decrease in percentage
greater than the preset threshold above what is set in <Current (%)> AND increase in absolute value above
what is set in <Min variation (A)>
Successive comm fault before alarm:
 Number of successive faults before the Measured value deadband Voltage:
alarm (above) is set. The voltage value is the measurement of the FLITE 116 SA voltage field
sensor. This is not a voltage measurement.
 Adjustable from 1 to 4.
This value is only necessary for maintenance purpose. The useful information
Config in progress: is the voltage presence.
Alarm activation when a FLITE configuration is
in progress.

Config fault:
Alarm activation when a FLITE configuration
fails.

Alarm Parameters:
G200 information

Equipment Start:
 Alarm of all G200 starts/ restarts GSM version
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Alarm Parameters : G200 information ║
Conf: ║ ║
 Alarm on local/ remote configuration ║ ║
║ Alarm ║
 It is set to “0” for a local configuration ║ ║
and to “1” for a remote one ║ Equipment Start : Not alarmed ║
║ Conf (local or remote) : Not alarmed ║
║ ║
Modbus event stack 80%: ║ Modbus event stack 80% : Alarmed on bit set ║
║ ║
 Alarm on modbus event stack 80% ║ ║
overflow occurrences ║ Digital Input 1 : Not alarmed ║
║ Digital Input 2 : Not alarmed ║
 When the modbus event stack has ║ Digital Input 3 : Not alarmed ║
reached 80% of its capacity, it may send ║ Digital Input 4 : Not alarmed ║
║ Digital Input 5 : Not alarmed ║
an alarm to the SCADA so that it ║ Digital Input 6 : Not alarmed ║
downloads the stack before event loss ║ ║
║ ║
occurs ║ ║
║ ║
║ ║
Digital Input x: ║ Escape=Exit ║
 Alarm on digital input status change ╚═════════════════════════════════════════════════════════════════════════════╝

8 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

G200 IP address change GPRS version

(GPRS version only): ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Alarm Parameters : G200 information ║
 Alarm on G200 IP address change ║ ║
║ ║
 Only alarm on bit set and not alarmed ║ Alarm ║
║ ║
can be selected. ║ Equipment Start : Not alarmed ║
║ Conf (local or remote) : Not alarmed ║
 If alarm on bit set is selected, when G200 ║ ║
IP address changes, G200 calls the ║ ║
║ G200 IP address change : Not alarmed ║
SCADA. ║ Modbus event stack 80% : Alarmed on bit set ║
║ ║
 This feature must be activated when: ║ ║
║ Digital Input 1 : Not alarmed ║
 G200 IP address is dynamic ║ Digital Input 2 : Not alarmed ║
║ Digital Input 3 : Not alarmed ║
 And when G200 is connected to a ║ Digital Input 4 : Not alarmed ║
L500 SCADA ║ Digital Input 5 : Not alarmed ║
║ Digital Input 6 : Not alarmed ║
 With this feature, L500 is able to ║ ║
║ ║
refresh G200 IP address ║ ║
║ Escape=Exit ║
If this option is activated, it is not necessary ╚═════════════════════════════════════════════════════════════════════════════╝
to configure a call once a day. It will be done
at modem reset.

Relay parameters
Each digital output relay may be assigned to ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Relay Parameters ║
one of the following actions: ║ ║
║ ║
 Fault: ║ Relay activation : no (Not recommended with solar panel power supply) ║
when a line fault occurs on any FLITE, the ║ Relay 1 : Fault ║
║ Relay 2 : Com.Fault ║
digital output (DO) closes. When all line ║ Relay 3 : Bat.Fault ║
faults are cleared, the DO opens. ║ ║
║ ║
 Com fault: ║ ║
when a short range communication failure ║ ║
║ ║
occurs on any FLITE, the DO closes. When ║ ║
all communication failures are cleared, the ║ ║
║ ║
DO opens. ║ ║
 Bat Fault: ║
║
║
║
when a battery failure occurs on any FLITE, ║ ║
the DO closes. When all battery failures are ║ ║
║ ║
cleared, the DO opens. ║ ║
║ Escape=Exit ║
 Fault x: ╚═════════════════════════════════════════════════════════════════════════════╝
if a line fault occurred on FLITE number x
(x=1,2 or 3), the DO closes . When the fault
is cleared, the DO opens.

Warning: with solar G200 version,

relay activation is FORBIDDEN

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 9

Communication module

Communication parameters

RS232 version

The following menu are used to set the long ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Communication Parameters ║
range communication parameters (between ║ ║
the G200 and the remote control system) ║ ║
║ ║
║ Modem : Direct RS 232 ║
Host baud rate: ║ ║
 Data communication speed between ║
║
Host baud rate : 9600 bauds ║
║
SCADA and G200. ║ Handle DSR : no ║
 Adjustable from 200 to 9,600 bps. ║
║
Handle CTS : no ║
║
 Default value: 9,600 bps. ║ RTS delay (Only if Handle CTS = no): 10ms ║
║ ║
Note : for test purpose, it is better to select a ║ ║
║ ║
low speed so that it is easier to see exchanged ║ ║
messages between SCADA and G200 (see ║ ║
║ ║
Modbus analyser below) ║ ║
║ ║
Handle DSR: ║ ║
║ ║
 Select yes if you want G200 to detect ║ Escape=Exit ║
connection using DSR signal. ╚═════════════════════════════════════════════════════════════════════════════╝

 Default value: no

Handle CTS: RTS delay:

 To make G200 wait for CTS signal (after  Waiting time between RTS activation and frame emission.
asserting RTS signal) before sending  Default value: 10 ms
message, select yes This parameter is to be used only if Handle CTS = 0.
 Default value: no

10 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗

GSM version ║ Communication Parameters ║
║ ║
║ Modem : GSM ║
Host baud rate: ║ Host baud rate : 9600 bauds ║
║ PIN code : 0000 ║
 Data communication speed between ║ ║
SCADA and G200. ║ Modem parameters ║
║ ║
 Must be set to 9,600 bps with GSM ║ Host tel number (main) : ║
modem (mandatory data speed). ║ Host tel number (standby) : ║
║ ║
║ Dial up delay time - first attempt : 1s ║
PIN code: ║ (0s = random value) - second attempt : 1mn ║
║ - third attempt : 2mn ║
 Setting of the PIN into the SIM card (default ║ Max transmission time - Answer Mode : 10mn ║
value is 000). ║ - Calling Mode : 4mn ║
║ ║
 In case a wrong PIN is entered, "SIM card ║ Short message system : SMS ║
failure" appears in the screen "Equipment ║ Short message system enable : no ║
║ SMS service center phone number : ║
states". ║ SMS user phone number : ║
║ ║
║ Escape=Exit ║
Beware: after 3 unsuccessful PIN operations, ╚═════════════════════════════════════════════════════════════════════════════╝
the SIM card is locked. To unlock it , a mobile
phone set is needed (G200 cannot do it). Short message system enabled :
Please also refer to the SIM card user’s guide  To get a SMS (short message) sent to a specific GSM cell phone (the
to unlock it. lineman’s one, for instance) upon alarm detection, select yes

Host tel number (main): Note: it is possible to have both an alarm sent to the SCADA and a SMS to a
 SCADA main phone number, used to send cell phone. The short message is sent first.
the alarms to SCADA.
 15 digits maximum. SMS service center phone number:
 Phone number of the SMS server
Host tel number (standby): Please refer to the SIM card user’s guide in which this phone number is
 SCADA backup phone number, in case of given.
no access using the main phone number. Note: you may set the phone number in international format (for example
 15 digits maximum. “+336….” for a French cell phone number.

Dial up delay time: SMS user phone number:

 time-out delay for alarms  GSM cell phone number of the person (lineman) to whom the SMS shall
 first attempt: adjustable from 0 to 1min. be sent
per steps of 1 s. Setting it to ‘’0’’ selects a
random value between 0 and 1 min (this is Note: you may set the phone number in international format (for example
mandatory to prevent all equipment calling “+336….” for a French cell phone number.
the SCADA at the same time).
 second attempt: configurable from 0 to
5min. per steps of 1 min. Setting it to ‘’0’’ Important: SMS feature is available only with a GSM modem.
selects a random value between 0 and 5 The events that can be transmitted by SMS are limited to Flites digital
min. events: Di Fault, Imax Fault, Low Battery,Volt Pres, Comm Fault,
 third attempt: configurable from 0 to 10 Presence, Conf in prog, Conf Fault
min, in steps of 1 min. Setting it to ‘’0’’
selects a random time between 0 and 10 Please refer to chapter “Alarm Parameters:Flite information”.
min.
Note: 2nd and 3rd attempts are only used if the
preceding one (1st or 2nd one) did not manage
to send the frame.

Max transmission time:

 Maximum duration of a call in answer mode
or calling mode (alarm). On respective
time-out expiry, the modem hangs up.
 This feature permits to secure the
maximum call duration to avoid:
 high communication charges if a hang
up is not done
 Solar version: discharge of battery

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 11

Communication module

GPRS version
PIN code:
GPRS version only
 Setting of the PIN into the SIM card (default
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
value is 0000). ║ GPRS parameters ║
 In case a wrong PIN is entered, "SIM card ║ ║
║ SIM CARD PARAMETERS ║
failure" appears in the screen "Equipment ║ PIN code : 0000 ║
states". ║ ║
║ GPRS COMMUNICATION PARAMETERS ║
║ APN Server (Max 30 Digits) : ║
Beware: after 3 unsuccessful PIN operations, ║ APN Login (Max 30 Digits) : ║
the SIM card is locked. To unlock it, a mobile ║ APN Password (Max 30 Digits) : ║
║ ║
phone set is needed (G200 cannot do it). ║ Time between connection attempts : 30mn ║
Please also refer to the SIM card user’s guide ║ ║
║ Time of daily modem reset : 0 h 0 mn ║
to unlock it. ║ ║
║ ║
APN Server: ║ ║
║ ║
 Enter the APN (Access Point Name) given ║ ║
║ ║
by your GPRS network provider ║ ║
║ ║
APN Login and Password: ║ ║
║ Escape=Exit ║
 Enter the login and the password provided ╚═════════════════════════════════════════════════════════════════════════════╝
with your GPRS account.
G200 performs a daily modem reset.
Note: in most cases, login and password are If the IP address is dynamic, at the new network connection, the IP
not required for GPRS access. address will be changed. To avoid having too many connection attempts to
Time between connection attempts: the SCADA at the same time due to alarm on IP address change, daily
modem reset time is configurable
 If a GPRS connection loss occurs, G200
will wait before establishing a new GPRS Time of daily modem reset:
connection.  Set hour and minutes of the daily modem reset time

 This feature is necessary for solar version

in case of unavailability of IP network
during GPRS network maintenance:
 To avoid many unsuccessful attempts
and energy wasting.
 The default value is 30 mn (adapted to
solar version). For AC version, the time can
be reduced to 1 mn.

Beware: If connection fails the G200 will not

be reachable during this time but all events
will be stored in modbus events stack

12 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

Modbus TCP/IP parameters

G200 parameters

Slave ID: GPRS version only

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
The slave Id is used when the G200 is working ║ Modbus TCP/IP parameters ║
in non-permanent mode with dynamic IP. ║ ║
║ ║
This mode is implemented in the L500 SCADA ║ G200 PARAMETERS ║
to identify the G200 on incoming TCP ║ ║
║ Slave ID (if dynamic IP) : 0 ║
connection. ║ Local port(1-65535) : 502 ║
║ Timeout : 1mn ║
║ ║
The Slave Id is read by the SCADA using the ║ TCP connect. delay - 1st try : 1s ║
Identification frame (see below). ║ (0s = random value) - 2nd try : 1mn ║
║ - 3rd try : 2mn ║
║ ║
 The slave Id must be different for every ║
║
SCADA PARAMETERS
IP address : 0.0.0.0
║
║
G200 equipment and must be set in the ║ Remote port(1-65535) : 502 ║
L500 system as well ║ ║
║ ║
 Value is from 0 to 65534 ║ ║
║ ║
║ ║
Local Port: ║ ║
║ Escape=Exit ║
 Enter the port number you want the G200 ╚═════════════════════════════════════════════════════════════════════════════╝
to be listening to incoming connection.
 Value is from 1 to 65535.  third attempt: configurable from 0 to 10 min, by steps of 1 min. Setting
it to ‘’0’’ selects a random time between 0 and 10 min
Check with GPRS provider for open port
Note: The 2nd and 3rd send are only done if the preceding ones did not
availability.
succeed.
Timeout:
 During a GPRS connection, if no Scada parameters
communication occurs before the timeout
 expiry (silence), the TCP/IP connection IP address :
is closed
 Enter the destination IP address of the SCADA
 Each time the G200 receives a request, the
timer is re-armed.
Remote port:
 Enter the port number on which the SCADA is listening to incoming
TCP/IP connect. delay:
connection from G200 units.
Time before alarm send:

 first attempt: adjustable from 0 to 1min.

by steps of 1s. Setting it to ‘’0’’ selects a
random time between 0 and 1 min (this is
mandatory to prevent all equipment calling
the SCADA at the same time).

 second attempt: configurable from 0 to

5min. by steps of 1min. Setting it to ‘’0’’
selects a random time between 0 and 5
min.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 13

Communication module

Display events
The "Display events" menu is used to review ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
stored time-stamped events locally. ║ Display events ║
║ ║
 When all events have been displayed, their ║ 82 - 11/04/07 10:22:37.19 - Local configuration ║
║ 83 - 11/04/07 10:22:37.23 - Flite config start Fl1 ║
total number is indicated on the same line as ║ 84 - 11/04/07 10:22:41.30 - Flite config stop Fl1 ║
the message 'End of xx events'. ║ 85 - 11/04/07 10:22:41.87 - Flite presence Fl1 ║
║ 86 - 11/04/07 14:35:00.02 – Remote configuration ║
It is then possible to move around the list ║ 87 - 11/04/07 14:35:01.25 - Digital Input 1 on ║
using the arrow keys. ║ 88 - 11/04/07 14:35:01.25 - Digital Input 2 on ║
║ 89 - 11/04/07 14:35:01.26 - Digital Input 6 on ║
║ 90 - 11/04/07 14:40:28.28 - Digital Input 1 off ║
 100 time-stamped events may be recorded. ║ 91 - 11/04/07 14:40:28.29 - Digital Input 2 off ║
When this number is exceeded, the first event ║ 92 - 11/04/07 14:40:37.68 – Digital Input 6 off ║
║ 93 - 11/04/07 14:40:52.27 - Local configuration ║
in the list is "Events loss". ║ 94 - 11/04/07 14:40:52.43 - Equipment start ║
║ 95 - 11/04/07 14:40:52.98 - End of Flite presence Fl1 ║
 Events may be erased by selecting "Erase ║ 96 - 11/04/07 14:40:53.49 - Digital Input 1 on ║
║ 97 - 11/04/07 14:40:53.49 - Digital Input 2 on ║
events" in main menu. ║ 98 - 11/04/07 14:40:53.50 - Digital Input 6 on ║
Confirmation is requested by "Confirm (Y/N)". ║ 99 - 11/04/07 14:41:43.11 - Digital Input 6 off ║
║ 100 - 11/04/07 14:41:43.81 - Digital Input 1 off ║
Pressing the "Y" key permanently erases the ║ End of the 100 events ║
time-stamped events. ║ ESCAPE=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝

Display analog
The "Display analog" menu is used to display ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
the instant measurements from the FLITES. ║ Display analog ║
║ Instant Value ║
To refresh these values, press “Get pic data” ║ ║
║ ║
command in the “Flite communication ║ Adr date I ║
parameters” menu. ║ ║
║ 1 00/00 00:00:00 0 A ║
║ 2 00/00 00:00:00 0 A ║
║ 3 00/00 00:00:00 0 A ║
║ 4 00/00 00:00:00 0 A ║
║ 5 00/00 00:00:00 0 A ║
║ 6 00/00 00:00:00 0 A ║
║ 7 00/00 00:00:00 0 A ║
║ 8 00/00 00:00:00 0 A ║
║ 9 00/00 00:00:00 0 A ║
║ ║
║ ║
║ ║
║ ║
║ ║
║ ║
║ ║
║ ESCAPE=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝

14 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

Flite counters
The "Flite counters" menu is used to display the ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
statistics counters from the FLITES. Refresh ║ Flite counters ║
║ ║
these values with “Get Flite info” command in ║Communication Diagnose: ║
“Flite communication parameters” menu. ║ ║
║ FLITE 1 2 3 4 5 6 7 8 9 ║
║ ║
Counters are listed here below : ║ Trs232 0% 0% 0% 0% 0% 0% 0% 0% 0% ║
║ Tradio 0% 0% 0% 0% 0% 0% 0% 0% 0% ║
Trs232: ║ Tapp 0% 0% 0% 0% 0% 0% 0% 0% 0% ║
 Acknowledge rate of message sending on ║ ║
║ ║
the serial port between the radio ║ ║
component and the PIC. ║ ║
║ ║
 It should be more than 80%. ║ ║
Tradio: ║ ║
║ ║
 Sending rate of message previously ║ ║
acknowledged. ║ ║
║ ║
 It should be 100% ║ ║
Tapp: ║ ║
║ ESCAPE=Exit ║
 Application acknowledge rate. ╚═════════════════════════════════════════════════════════════════════════════╝
 It should be more than 80 %.
Note : if the resulting rate is lower than the one
expected, It could be due to a hardware
problem on the FLITE unit. Replace the FLITE
with another one and do the test again.
If the problem is still there, it could be due to a
disturbed radio environment or a wrong
installation.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 15

Communication module

Equipment state The equipment states menu is used to display the information linked to the
state of the G200 and the FLITES.
Equipment fault: The equipment encounters a
configuration fault. Hayes and RS232 Version
╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
Modem not identified: G200 was unable to ║ Equipment states ║
║ Equipment Fault : no Modem not identified no ║
communicate with the modem used. ║ Alarm processing : no SIM card failure no ║
║ ║
║ Modem state : ║
Alarm processing: an alarm is under process. ║ GSM signal quality:(must be > 16) ║
║ received signal: 0 ░░░░░░░░░░░░░░░░ Max(31) - Not detectable(99) ║
║ ║
SIM card failure: G200 has detected the ║ Fault Pres Bat.Fault I ave I min I max MV Comm.Qual Conf.Fault║
embedded GSM modem card, but cannot read ║ 1 no no 0 A 0 A 0 A 0% 0% no ║
║ 2 no no 0 A 0 A 0 A 0% 0% no ║
the SIM card. ║ 3 no no 0 A 0 A 0 A 0% 0% no ║
║ 4 no no 0 A 0 A 0 A 0% 0% no ║
║ 5 no no 0 A 0 A 0 A 0% 0% no ║
Received signal: indicates the Received Signal ║ 6 no no 0 A 0 A 0 A 0% 0% no ║
Strength Indication of the modem. Should be ║ 7 no no 0 A 0 A 0 A 0% 0% no ║
║ 8 no no 0 A 0 A 0 A 0% 0% no ║
above 16. ║ 9 no no 0 A 0 A 0 A 0% 0% no ║
║ ║
║ ║
IP address (only GPRS): Indicates the current ║ ║
║ ║
IP address of the G200. ║ ESCAPE=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝
The FLITE states are as follows:
Fault Pres.: GPRS version
fault detected on FLITE no. x ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
Battery fault: ║ Equipment states ║
║ Equipment Fault : no Modem not identified no ║
battery fault of FLITE no. x ║ Alarm processing : no SIM card failure no ║
Iav: ║ ║
║ Modem state : TCP Listened ! IP address : 80.10.21.121 ║
last received average load ║ GSM signal quality:(must be > 16) ║
Imin: ║ received signal: 22 ░░░░░░░░░░░░░░░░ Max(31) - Not detectable(99) ║
║ ║
last received minimum current ║ Fault MV Com. Batt. Conf. I ave I min I max MV Comm. ║
Imax: ║ Pres. Pres. Fault Fault Fault (A) (A) (A) (kV/m) Qual(%) ║
║ 1 no no 0 A 0 A 0 A 0% 0% no ║
last received average load ║ 2 no no 0 A 0 A 0 A 0% 0% no ║
MV: ║ 3 no no 0 A 0 A 0 A 0% 0% no ║
║ 4 no no 0 A 0 A 0 A 0% 0% no ║
last received MV availability ║ 5 no no 0 A 0 A 0 A 0% 0% no ║
║ 6 no no 0 A 0 A 0 A 0% 0% no ║
║ 7 no no 0 A 0 A 0 A 0% 0% no ║
Comm Qual.: indicates (in %) the quality of the ║ 8 no no 0 A 0 A 0 A 0% 0% no ║
║ 9 no no 0 A 0 A 0 A 0% 0% no ║
radio communication between the G200 and the ║ ║
FLITE no. x. This indicator must be 100 %. (The ║ ║
indicator is regularly refreshed according to the ║ ║
║ ESCAPE=Exit ║
period of measurement of the FLITE). ╚═════════════════════════════════════════════════════════════════════════════╝
GPRS version:
Note: the counter is initially set to 100% at each
configuration loading, then it is reduced Modem state comments
gradually when measurements are not updated
within the time given (with an additional delay of Modem Init... G200 is configuring the modem
2 minutes to take repeats into account ). Entering code pin... -
Code pin error ! Wrong PIN code
Conf fault: configuration of the FLITE no. x is Network registration... IMSI registration
not complete. GPRS registration...
PDP Init... Open a PDP session
Modem state: PDP Closing... Close the PDP session
indicates the current state of the modem PDP Status... Check the PDP status

Hayes version: PDP Connected ! Standby state before listen mode is activated.

Closing TCP listened Close the listen port

Modem state comments
TCP Closing... Disconnection from the SCADA
Modem hang up Standby state TCP Listening... Opening the listen port
Modem calling... - TCP Listened ! Standby state when listen mode is activated.
Modem answering... - TCP Connecting... Try to connect to the SCADA
Modem connected - TCP Connected ! Connected to the SCADA
Modem breaking The modem is hanging up Modem failure !
G200 is configuring the GSM registration IMSI registration is refused by the operator (check
Modem Init...
modem denied ! your SIM card right with your provider)
Modem sending GPRS registration or PDP activation is refused by
GPRS registration
sms... the operator (check your SIM card right with your
denied !
Code pin error ! Wrong PIN code provider)

16 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Communication module

MODBUS analyser G200 provides a protocol analyser (with a Modbus frame specific decoder).
This feature is accessible from the MODBUS analyser menu on the PC
connected to the configuration plug.

RS232 and GSM version

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Modbus analyser ║
║ ║
║ ║
║ESCAPE=Exit, SPACE=Pause, C=Clear, S=Save, F=Toggle filtering ║
║12:16.78 Answer in progress... "RING" ║
║13:32.72 Connected, answer mode "CONNECT 9600" ║
║13:33.96 address < 00 00 01 B0 ║
║13:33.96 ADDRESS >> 01 80 00 41 C0 ║
║13:34.85 read cr < 01 01 03 10 00 06 BD 89 ║
║13:34.85 READ CR >> 01 01 01 00 51 88 ║
║13:35.63 read ts < 01 01 03 20 00 60 3D AC ║
║13:35.64 READ TS >> 01 01 0C 80 01 28 28 28 28 28 28 28 28 28 00 B2 8B ║
║13:36.44 read tm < 01 03 00 40 00 36 C4 08 ║
║13:36.47 READ TM >> 01 03 6C 00 57 00 00 00 70 00 96 00 64 00 38 00 58 00║
║ 00 00 73 00 0E 00 64 00 70 00 5A 00 00 00 78 00 0E 00║
║ 64 00 73 00 58 00 00 00 73 00 0E 00 64 00 70 00 53 00║
║ 00 00 64 00 0C 00 64 00 61 00 4C 00 4C 00 4D 00 0A 00║
║ 64 00 4D 00 3D 00 00 00 ║
║13:37.40 read state < 01 01 00 10 00 10 3C 03 ║
║13:37.40 READ STATE >> 01 01 02 41 00 89 AC ║
║Pause... ║
║ ║
╚═════════════════════════════════════════════════════════════════════════════╝

GPRS version only

╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
║ Modbus analyser ║
║ ║
The frames are decoded as Modbus TCP ║ ║
║ESCAPE=Exit, SPACE=Pause, C=Clear, S=Save trace, F=Toggle filtering ║
frames ║54:24.69 read tc < 00 0E 00 00 00 06 0A 04 00 30 00 01 ║
║54:24.69 READ TC >> 00 0E 00 00 00 05 0A 04 02 00 00 ║
║54:27.18 read cr < 00 0F 00 00 00 06 0A 04 00 31 00 01 ║
║54:27.18 READ CR >> 00 0F 00 00 00 05 0A 04 02 00 00 ║
║54:41.17 read ts < 00 10 00 00 00 06 0A 04 00 32 00 06 ║
║54:41.17 READ TS >> 00 10 00 00 00 0F 0A 04 0C 3F 00 00 28 00 00 00 00 00║
║ 00 00 00 ║
║55:00.53 read tm < 00 11 00 00 00 06 0A 04 00 40 00 12 ║
║55:00.55 READ TM >> 00 11 00 00 00 27 0A 04 24 00 38 00 38 00 39 00 08 00║
║ 64 80 00 80 00 80 00 80 00 80 00 00 00 80 00 80 00 80║
║ 00 80 00 80 00 00 00 80 00 ║
║55:46.45 read param < 00 12 00 00 00 06 0A 04 00 90 00 1D ║
║55:46.45 READ PARAM >> 00 12 00 00 00 3D 0A 04 3A DF 0F 00 05 00 00 10 03 00║
║ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00║
║ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00║
║ 18 50 0A 35 06 53 CE 6A AD 09 64 09 64 ║
║55:54.57 read state < 00 13 00 00 00 06 0A 04 00 01 00 01 ║
║55:54.57 READ STATE >> 00 13 00 00 00 05 0A 04 02 00 69 ║
║ ║
╚═════════════════════════════════════════════════════════════════════════════╝

Use: Display:
 The "SPACE" key is used to stop scrolling,  The first column gives the time of the message in minutes, seconds and
thereby facilitating analysis of the frames 100ths of seconds.
received.
 The second column indicates the type of frame. Upper case characters are
 The "C" key clears the screen. used for frames transmitted by the G200. This is confirmed by the double
chevron '>>' in column 3. On the other hand, all the lower case characters
The "S" key activates the storage of the pertain to frames received by the remote control station (confirmed by a single
exchanges (only when the modbus analyser is chevron '<' in column 3).
opened).
 The last column displays the frame in hexadecimal form. The "+" and ' * '
 The ‘’F’’ key changes the filtering method. signs may precede the display of the frame:

 Display all received frames  The '+' sign indicates frames not intended for the equipment,
 Display only frames addressed to this  The ' * ' sign indicates an erroneous frame (incomplete frame, faulty
G200. construction,...).

The "ESCAPE" key is used to exit the

analyser function.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 17

Communication module

Time setup
The equipment clock may be set by the ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
configuration computer: ║ Setup Time ║
║ ║
║ ║
Automatic setup time: ║ ║
║ automatic Time setup (from laptop) ║
 G200 automatically adjusts its date & time ║ ║
to the PC date & time ║ Date : 10/04/07 ║
║ Time : 08:54:53 ║
║ ║
Manual setup time: ║ Clock stop (for an extended storage) ║
║ ║
 G200 clock is manually set by the user ║ ║
║ ║
Stop clock: ║ ║
║ ║
 When the equipment is stored for a long ║ ║
period of time, it is recommended to stop ║ ║
║ ║
the clock to increase the service lifetime of ║ ║
the lithium battery associated with the ║ ║
║ ║
component that manages the clock. ║ ║
║ Escape=Exit ║
╚═════════════════════════════════════════════════════════════════════════════╝
Notes:
(1) the G200 is delivered with the clock
stopped.
(2) Date and time are only used for dating
time-stamped events and by the protocol
analyser

Radio analyser
This menu is used to analyse the data ╔═════════ MERLIN GERIN - Configuration and Diagnostic - ALT+F4=Exit ═════════╗
exchange on the short range radio link to each ║ RADIO analyser ║
║ ║
FLITE unit. ║ ║
║ESCAPE=Exit, SPACE=Pause, C=Clear, S=Save Trace ║
Main causes of use are: ║ ║
║00:00.17 REQ_SEND_MESSAGE >> FF 02 0B 22 01 2A 04 30 02 A4 06 1A 5E 03║
 Absence of FLITE - G 200 dialogue ║00:00.27 ACK
║00:00.35 RES_SEND_FRAME
< FF 02 04 06 56 02
< FF 02 05 21 00 56 03
║
║
Check: ║00:00.42 ACK >> FF 02 04 06 56 02 03 ║
║00:03.64 RECEIVED_FRAME < FF 02 0D 30 01 2A 04 30 02 A4 14 06 00 8C║
equipment power supply ║C8 ║
state of transmission interface (aerial, ║00:03.71 ACK >> FF 02 04 06 56 02 03 ║
║ ║
FLITE position, etc.) ║ ║
FLITE power supply (FLITE battery, …), ║ ║
║ ║
start-up procedure, ║ ║
 Functional faults report (Remote controls ║
║
║
║
not executed, remote indications not ║ ║
║ ║
received) ║ ║
Check: ║ ║
╚═════════════════════════════════════════════════════════════════════════════╝
FLITE power supply,
Communication with the FLITE (possible
short range radio disturbances)

18 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding

General
Addressing with RS232 and GSM version
A MODBUS master can access 255 storage spaces of 64K words (255 MODBUS
addresses).

 Addressing of G200 range is limited to 255 equipments

 To increase the addressing capability, the MODBUS master may use the test
zone to identify more accurately the equipment.

 Mechanism of the data encoding: data are split to a non-permanent

communication. But a permanent communication (direct connection) with a
continuous scrolling of the slave is more simple, so a lot of things aren't useful :

- report by exception

- events

- alarms

- parameters

- test zone

Addressing with GPRS version

Scada and RTU can be both TCP client and server.

To identify a RTU, a scada may use its IP address (if the network provided fix IP
address for the G200) or its Slave ID if the IP address is dynamic..

In the case there is no fix IP address for the equipment on the network, the scada
must be listening on an opened port on which the RTU can open a TCP connection.
To identify the RTU, the scada automatically sends an identification frame on
connection. In case of IP address change, the equipment can be set to call the Scada
so that it can call back afterwards.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 19

MODBUS data addresses and encoding

Reply messages
 Upon receipt of a request recognised by the equipment (read or write),
transmission of the data corresponding to the MODBUS specifications.

 Upon receipt of a request not recognised by the equipment, transmission of

an exception message (type 1, 2 or 3 only).

Read zone
 The number of words read may not exceed the size of the checked zone.

 Some zones may only be accessed as a whole.

Notes
 The bit by bit write and read functions are not used in the G200 application.

 Values followed by the letter "h" are in hexadecimal form (e.g. 0003h).

 In the charts describing the data exchanged between the master and the
G200, the hatched strips in the "authorised function" columns indicate the zones
that are accessible as a whole.

Terminology
 TCD: remote control (digital output encoded in 2 bits)

 TSS: single-state remote indication (digital input encoded in 1 bit)

 TM: remote metering (analog input encoded in 16 bits)

20 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding

Identification /
configuration zone
word address access mode authorised
0000h to 0001h function
Software version 0000h read 3,4
Status 0001h read 3,4

 Bit 0 to 7 of status indicates the type of the equipment. (read only)

= 104 decimal (68h) for G200 Modbus GSM v2.00

= 105 decimal (69h) for G200 Modbus GPRS v1.00

 Bit 15 of status indicates:

 0 = No events loss

 1 = Loss of events

This bit is set when the modbus event file is full. The event ‘’event loss’’ is then
placed in the file. As long as this event is in the file, no other event can be
memorised. This bit is reset when the file is half empty. This change of state
doesn’t generate an event.

This zone contains the internal date The zone may only be read or written
Time synchronisation and time of the equipment for time as a whole.
zone stamping of events.

binary date word address access mode authorised

0002h to 0005h function
year 0002h read/write 3,4,16
month+day 0003h read/write 3,4
hours+minutes 0004h read/write 3,4
milliseconds 0005h read/write 3,4

0 Year (0 to 99)
b15 b8 b7 b0

0 month (1 to 12) 0 day (1 to 31)

b15 b8 b7 b0

0 hour 0 minute (0 to 59)

b15 b8 b7 b0

millisecond (0 to 59999)
b15 b8 b7 b0

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 21

MODBUS data addresses and encoding
The test zone contains 9 words that The contents of the zone does not
Test zone can be read or written. It is recorded in have any effect on the G200 functions.
saved RAM and is available to users
to facilitate final adjustment tests or to
record an identification of the
equipment.

Test zone word address access mode authorised

function
9 words 0006h to 000Eh read/write 1,2,3,4,5,6,16

This zone contains the time stamp events.

Event zone

Event zone word address access mode authorised

function
exchange word 000Fh read/write 3,4,6,16
event 1 0010h to read 3,4
0017h
event 2 0018h to read 3,4
001Fh
event 3 0020h to read 3,4
0027h
event 4 0028h to read 3,4
002Fh

Exchange word format :

Exchange number Event number

b15 b8 b7 b0

Only the exchange word may be The exchange word consists of 2

written. bytes:
It is possible to read the exchange
zone as a whole or the exchange word  Most significant byte = exchange
only. number which identifies each event
frame. It is preset to zero when the
The exchange word is used to manage G200 is switched on. when it reaches
a specific protocol to be sure not to its maximum value (FFh), it
lose events as a result of a MODBUS automatically goes back to 0. The
communication problem. The event G200 numbers the exchanges and the
table is numbered for that purpose. master acknowledges the numbering.

 Least significant byte = number of

valid events in the event zone
(maximum 4).

22 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding
Encoding of events

Each event is encoded with 4 words related to the event, followed by 4 words
containing the event time-stamping data:

 word 1: identification word

0800h /2048 0400h/1024
binary event 16 bits analogical event
 word 2: event address
 001Fh /31:
Event loss bit ( set only on
appearance) Analogical event word address
Digital event bit address  40h to 75h:
TM 1 to 54
 0320h to 037Fh:
TSS 1 to 96
 word 3: event value MSW
0 0
 word 4: event value LSW
0 = 1 to 0
change of state
16 bits analogical event value
1 = 0 to 1
change of state
 words 5 to 8:
time-stamping with same format as date zone.

Acknowledgement of events

To inform the G200 that it has correctly received the frame it has read, the
master must :

 write the number of the last exchange it has received in the "exchange
number" byte

 reset the "number of events" byte of the exchange word to zero.

After acknowledgement, the G200 erases the events that have already been
transmitted and replaces them by new ones when applicable.

Note: until the exchange word written by the master becomes "X,0" (with X =
number of the previous exchange that the master wishes to acknowledge), the
exchange word in the table remains at "X, number of previous events".

If the number is equal to zero, the master is not required to acknowledge a

message with no event.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 23

MODBUS data addresses and encoding

TCD / TSS zone

TCD / TSS word address access mode function
authorised
TCD 1-8 0030h write 5,6
CR 0031h read 1,2,3,4,5,6
TSS 1-16 0032h read 1,2,3,4
TSS 17-32 0033h read 1,2,3,4
TSS 33-48 0034h read 1,2,3,4
TSS 49-64 0035h read 1,2,3,4
TSS 65-80 0036h read 1,2,3,4
TSS 81-96 0037h read 1,2,3,4

Each TCD (Double Digital Output) word is encoded as follows:

TCD8 TCD7 TCD6 TCD5 TCD4 TCD3 TCD2 TCD1

C O C O C O C O C O C O C O C O
b15 b8 b7 b0

TCD Single remote indications Word bit

1 Get DATA (wake-up FLITEs to have fresh data) 30h 0-1

A remote control TCD is encoded in The CR code (result code) gives

2 bits: information on the processing of the
remote control order carried out by the
01 = open order G 200:
10 = closing order
The TCDs are assigned as follows:
 bit 0: Remote control in progress.
 TCD1..8 : control 1..8.
 bit 1: Fault concerning the initial
 Here, only 1 TCD is used remote control order

Writing a TCD word performs remote  bit 2: Serious fault detected during
control orders. Only one remote internal check.
control order at a time may be
requested.
 bit 3: not used.
The control order zone (TCD) may be
 bit 4: not used.
read with bit and word read function
code. As it contains no information the
 bit 5: Failure to execute for an
data is 0.
unknown reason.

The control center system may reset

this code by writing a 0 to the relevant
address.

24 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding
Each TSS (Simple Digital Input) word is encoded as follows:

TSS16 TSS15 TSS14 TSS13 TSS12 TSS11 TSS10 TSS9 TSS8 TSS7 TSS6 TSS5 TSS4 TSS3 TSS2 TSS1

b15 b8 b7 b0

TSS Single remote indications Word bit TSS Single remote indications Word bit TSS Single remote indications Word bit
1 Equipment start 32h 0 49 Fault dI/dt - ind. 5 35h 0 97 Reserved 38h 0
2 Configuration 32h 1 50 Fault Imax - ind. 5 35h 1 98 Reserved 38h 1
3 Modbus event stack 80% 32h 2 51 Battery fault - ind. 5 35h 2 99 Reserved 38h 2
4 Reserved 32h 3 52 Volt. Presence - ind. 5 35h 3 100 Reserved 38h 3
5 Reserved 32h 4 53 Comm. Fault - ind. 5 35h 4 101 Reserved 38h 4
6 Reserved 32h 5 54 Flite presence - ind. 5 35h 5 102 Reserved 38h 5
7 Reserved 32h 6 55 Config in progress - ind. 5 35h 6 103 Reserved 38h 6
8 Reserved 32h 7 56 Config fault - ind. 5 35h 7 104 Reserved 38h 7
9 DI 1 Digital input 1 32h 8 57 Fault dI/dt - ind. 6 35h 8 105 Reserved 38h 8
10 DI 2 Digital input 2 32h 9 58 Fault Imax - ind. 6 35h 9 106 Reserved 38h 9
11 DI 3 Digital input 3 32h 10 59 Battery fault - ind. 6 35h 10 107 Reserved 38h 10
12 DI 4 Digital input 4 32h 11 60 Volt. Presence - ind. 6 35h 11 108 Reserved 38h 11
13 DI 5 Digital input 5 32h 12 61 Comm. Fault - ind. 6 35h 12 109 Reserved 38h 12
14 DI 6 Digital input 6 32h 13 62 Flite presence - ind. 6 35h 13 110 Reserved 38h 13
15 Reserved 32h 14 63 Config in progress - ind. 6 35h 14 111 Reserved 38h 14
16 Reserved 32h 15 64 Config fault - ind. 6 35h 15 112 Reserved 38h 15
17 Fault dI/dt - ind. 1 33h 0 65 Fault dI/dt - ind. 7 36h 0
18 Fault Imax - ind. 1 33h 1 66 Fault Imax - ind. 7 36h 1
19 Battery fault - ind. 1 33h 2 67 Battery fault - ind. 7 36h 2
20 Volt. Presence - ind. 1 33h 3 68 Volt. Presence - ind. 7 36h 3
21 Comm. Fault - ind. 1 33h 4 69 Comm. Fault - ind. 7 36h 4
22 Flite presence - ind. 1 33h 5 70 Flite presence - ind. 7 36h 5
23 Config in progress - ind. 1 33h 6 71 Config in progress - ind. 7 36h 6
24 Config fault - ind. 1 33h 7 72 Config fault - ind. 7 36h 7
25 Fault dI/dt - ind. 2 33h 8 73 Fault dI/dt - ind. 8 36h 8 Status Flite n°7
26 Fault Imax - ind. 2 33h 9 74 Fault Imax - ind. 8 36h 9
27 Battery fault - ind. 2 33h 10 75 Battery fault - ind. 8 36h 10
28 Volt. Presence - ind. 2 33h 11 76 Volt. Presence - ind. 8 36h 11
29 Comm. Fault - ind. 2 33h 12 77 Comm. Fault - ind. 8 36h 12
30 Flite presence - ind. 2 33h 13 78 Flite presence - ind. 8 36h 13
31 Config in progress - ind. 2 33h 14 79 Config in progress - ind. 8 36h 14
32 Config fault - ind. 2 33h 15 80 Config fault - ind. 8 36h 15
33 Fault dI/dt - ind. 3 34h 0 81 Fault dI/dt - ind. 9 37h 0 Status Flite n°8
34 Fault Imax - ind. 3 34h 1 82 Fault Imax - ind. 9 37h 1
35 Battery fault - ind. 3 34h 2 83 Battery fault - ind. 9 37h 2
36 Volt. Presence - ind. 3 34h 3 84 Volt. Presence - ind. 9 37h 3
37 Comm. Fault - ind. 3 34h 4 85 Comm. Fault - ind. 9 37h 4
38 Flite presence - ind. 3 34h 5 86 Flite presence - ind. 9 37h 5
39 Config in progress - ind. 3 34h 6 87 Config in progress - ind. 9 37h 6
40 Config fault - ind. 3 34h 7 88 Config fault - ind. 9 37h 7
41 Fault dI/dt - ind. 4 34h 8 89 Reserved 37h 8 Status Flite n°9
42 Fault Imax - ind. 4 34h 9 90 Reserved 37h 9
43 Battery fault - ind. 4 34h 10 91 Reserved 37h 10
44 Volt. Presence - ind. 4 34h 11 92 Reserved 37h 11
45 Comm. Fault - ind. 4 34h 12 93 Reserved 37h 12
46 Flite presence - ind. 4 34h 13 94 Reserved 37h 13
47 Config in progress - ind. 4 34h 14 95 Reserved 37h 14
48 Config fault - ind. 4 34h 15 96 Reserved 37h 15

Remote metering zone

Word address access function

Hex. decimal mode authorised
I_mean - F1 0040h 64 read 3,4
I_min – F1 0041h 65 read 3,4
I_max – F1 0042h 66 read 3,4
Voltage pres. – F1 0043h 67 read 3,4
Comms count. - F1 0044h 68 read 3,4
I_inst – F1 0045h 69 read 3,4
I_mean – F2 0046h 70 read 3,4
I_min – F2 0047h 71 read 3,4
I_max – F2 0048h 72 read 3,4
Voltage pres. – F2 0049h 73 read 3,4
Comms count. – F2 004Ah 74 read 3,4
I_inst – F2 004Bh 75 read 3,4

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 25

MODBUS data addresses and encoding

I_mean – F3 004Ch 76 read 3,4

I_min – F3 004Dh 77 read 3,4
I_max – F3 004Eh 78 read 3,4
Voltage pres. – F3 004Fh 79 read 3,4
Comms count. – F3 0050h 80 read 3,4
I_inst – F3 0051h 81 read 3,4
I_mean – F4 0052h 82 read 3,4
I_min – F4 0053h 83 read 3,4
I_max – F4 0054h 84 read 3,4
Voltage pres. – F4 0055h 85 read 3,4
Comms count. – F4 0056h 86 read 3,4
I_inst – F4 0057h 87 read 3,4
I_mean – F5 0058h 88 read 3,4
I_min – F5 0059h 89 read 3,4
I_max – F5 005Ah 90 read 3,4
Voltage pres. – F5 005Bh 91 read 3,4
Comms count. – F5 005Ch 92 read 3,4
I_inst – F5 005Dh 93 read 3,4
I_mean – F6 005Eh 94 read 3,4
I_min – F6 005Fh 95 read 3,4
I_max – F6 0060h 96 read 3,4
Voltage pres. – F6 0061h 97 read 3,4
Comms count. – F6 0062h 98 read 3,4
I_inst – F6 0063h 99 read 3,4
I_mean – F7 0064h 100 read 3,4
I_min – F7 0065h 101 read 3,4
I_max – F7 0066h 102 read 3,4
Voltage pres. – F7 0067h 103 read 3,4
Comms count. – F7 0068h 104 read 3,4
I_inst – F7 0069h 105 read 3,4
I_mean – F8 006Ah 106 read 3,4
I_min – F8 006Bh 107 read 3,4
I_max – F8 006Ch 108 read 3,4
Voltage pres. – F8 006Dh 109 read 3,4
Comms count. – F8 006Eh 110 read 3,4
I_inst – F8 006Fh 111 read 3,4
I_mean – F9 0070h 112 read 3,4
I_min – F9 0071h 113 read 3,4
I_max – F9 0072h 114 read 3,4
Voltage pres. – F9 0073h 115 read 3,4
Comms count. – F9 0074h 116 read 3,4
I_inst – F9 0075h 117 read 3,4
Reserved 0078h to 118 to 143 read 3,4
008Fh

 Each TM (or Analog Input) value is a signed value encoded in 2's complement
16-bit word.
 0x8000 stands for non valid value.

26 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding

Parameters zone
Word address access function
Parameters Hex. Decimal mode authorised
Storage information 0090h to 144 to 145 Read/write 1,2,3,4,5,6
0091h
Alarm information 0092h to 146 to 148 Read/write 1,2,3,4,5,6
0094h
Primary Host phone number 0095h to 149 to 152 Read/write 1,2,3,4,5,6
0098h
Standby host phone number 0099h to 153 to 156 Read/write 1,2,3,4,5,6
(standby) 009Ch
SMS service center phone 009Dh to 157 to 160 Read/write 1,2,3,4,5,6
number 00A0h
SMS user phone number 00A1h to 161 to 164 Read/write 1,2,3,4,5,6
00A4h
Cyclic dial up period 00A5h to 165 to 166 Read/write 1,2,3,4,5,6
00A6h
G200 IP address 00A7h to 167 to 168 Read 1,2,3,4,5,6
00A8h
SCADA IP address 00A9h to 169 to 170 Read/write 1,2,3,4,5,6
00AA.h
G200 local port 00ABh 171 Read/write 1,2,3,4,5,6
SCADA remote port 00ACh 172 Read/write 1,2,3,4,5,6
Reserved 00ACh to 173 to 175
00AFh
Measurement period 00B0h 176 Read/write 1,2,3,4,5,6
Current deadband (%) 00B1h 177 Read/write 1,2,3,4,5,6
Minimum current variation 00B2h 178 Read/write 1,2,3,4,5,6
Voltage deadband 00B3h 179 Read/write 1,2,3,4,5,6
Communication fault 00B4h 180 Read/write 1,2,3,4,5,6
counter threshold
Config. Indicator F1 00B5h to 181 to 182 Read/write 1,2,3,4,5,6
00B6h
Config. Indicator F2 00B7h to 183 to 184 Read/write 1,2,3,4,5,6
00B8h
Config. Indicator F3 00B9h to 185 to 186 Read/write 1,2,3,4,5,6
00BAh
Config. Indicator F4 00BBh to 187 to 188 Read/write 1,2,3,4,5,6
00BCh
Config. Indicator F5 00BDh to 189 to 190 Read/write 1,2,3,4,5,6
00BEh
Config. Indicator F6 00BFh to 191 to 192 Read/write 1,2,3,4,5,6
00C0h
Config. Indicator F7 00C1h to 193 to 194 Read/write 1,2,3,4,5,6
00C2h
Config. Indicator F8 00C3h to 195 to 196 Read/write 1,2,3,4,5,6
00C4h
Config. Indicator F9 00C5h to 197 to 198 Read/write 1,2,3,4,5,6
00C6h
Reserved 00C7h to 199 to 207 Read/write 1,2,3,4,5,6
CFh

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 27

MODBUS data addresses and encoding
Indicator parameters
WARNING.
di_threshold IMAX_threshold
These two words must 1 0 0 0 0 di_threshold 0 0 0 0 IMAX_threshold
be written at the same b15 b8 b7 b0
time to avoid
unnecessary
communications with Ctl HT
flites Inrush Valid Reset Flash 0 0 0 0 HT 0 0 0

b15 b8 b7 b0

di_threshold User-selected di/dt threshold value

IMAX_threshold User-selected IMAX threshold value

This control Word is used to configure following parameters : inrush time-out, fault
Ctl
confirmation per voltage absence, automatic voltage reset and flash time-out

HT Electrical field threshold above which the MV voltage is detected.

Recommended values are in bold:

di_threshold di/dt value (for IMAX_Threshold IMAX value Ctl Description HT voltage
50Hz networks) presence
1xxx0000 6 A / 30 ms XXXX0000 800 A 00XXXXXX No Inrush XXXX0XXX A
1xxx0001 12 A / 30 ms XXXX0001 100 A 01XXXXXX Inrush : 3s XXXX1XXX B
1xxx0010 24 A / 30 ms XXXX0010 150 A 10XXXXXX Inrush : 30 s
1xxx0011 30 A / 30 ms XXXX0011 200 A 11XXXXXX Inrush : 60 s
1xxx0100 40 A / 30 ms XXXX0100 250 A XX00XXXX No validation
1xxx0101 60 A / 30 ms XXXX0101 300 A XX01XXXX Validation
1xxx0110 80 A / 30 ms XXXX0110 400 A XX10XXXX Not used
1xxx0111 OFF XXXX0111 500 A XX11XXXX Not used
XXXX1000 600 A XXXX00XX No auto. Reset
XXXX01XX auto. reset 3s
XXXX10XX auto. reset 30s
XXXX11XX auto. reset 60s
XXXXXX00 2 h flash time
XXXXXX01 4 h flash time
XXXXXX10 8 h flash time
XXXXXX11 16 h flash time

Note: for 60 Hz networks, dt becomes 25ms

28 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding
An TM event is stored in modbus stack upon 1 bit:
When the bit is set to <0>, a change is not added in the event stack. When set to
<1>, it is added.

When modbus event stack overflows, no more event is stored in the stack until it
reaches half emptiness.

Storage Single remote indications Word bit

1 I_average 90h 0
2 I_min 90h 1
3 I_max 90h 2
4 Voltage Presence(kV/m) 90h 3
5 Reserved 90h 4
6 Reserved 90h 5
7 Reserved 90h 6
8 Reserved 90h 7
9 Reserved 90h 8
10 Reserved 90h 9
11 Reserved 90h 10
12 Reserved 90h 11
13 Reserved 90h 12
14 Reserved 90h 13
15 Reserved 90h 14
16 Reserved 90h 15
1 Reserved 91h 0
2 Reserved 91h 1
3 Reserved 91h 2
4 Reserved 91h 3
5 Reserved 91h 4
6 Reserved 91h 5
7 Reserved 91h 6
8 Reserved 91h 7
9 Reserved 91h 8
10 Reserved 91h 9
11 Reserved 91h 10
12 Reserved 91h 11
13 Reserved 91h 12
14 Reserved 91h 13
15 Reserved 91h 14
16 Reserved 91h 15

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 29

MODBUS data addresses and encoding
Alarm information:
This enables the user to choose whether a change of state creates an alarm or
not, for each type of information:
 00 = Alarm is not used
 01 = Alarmed on bit set
 10 = Alarmed on bit clear
 11 = Alarmed on bit set and clear

Alarm Single remote indications Word bit

1 di/dt Fault 92h 0-1
2 IMAX Fault 92h 2-3
3 Battery check 92h 4-5
4 Voltage Presence 92h 6-7
5 Comm. Fault 92h 8-9
6 Reserved 92h 10-11
7 Configuration in progress 92h 12-13
8 Configuration fault 92h 14-15
9 Equipment Start 93h 0-1
10 Configuration 93h 2-3
11 Modbus event stack 80% 93h 4-5
12 Reserved 93h 6-7
13 Alarm message set up 93h 8-9
14 SMS message system enabled 93h 10-11
15 Test alarm 93h 12-13
16 Reserved 93h 14-15
1 Digital Input 1 94h 0-1
2 Digital Input 2 94h 2-3
3 Digital Input 3 94h 4-5
4 Digital Input 4 94h 6-7
5 Digital Input 5 94h 8-9
6 Digital Input 6 94h 10-11
7 Reserved 94h 12-13
8 Reserved 94h 14-15

Except for Alarm 13, 14,15,16 , when bits are set to 00, the information is not
alarmed. When set to 01, it is alarmed on bit set. When set to 10, it is alarmed on
bit reset. When set to 11, it is alarmed on both bit set and bit reset.

For 13, 14 and 15 and 16, values are restricted to 00(not alarmed) and
11(alarmed) values.

 Test alarm : A bit is used to test the alarm mechanism : if bits is written with "11"
by the master MODBUS, an alarm signal will set off one minute later. The bit will
then be set to "00" by the G200 if the alarm is acquitted.

 Alarm message set up : bits are used to set up the alarm mechanism: if bits are
written with "11" by the master MODBUS, The alarm mechanism is set up. If bits
are written with "00" by the master MODBUS, no alarm neither cyclic dialup will be
do by the equipment

 Short message system enabled : bits are used to set up the SMS mechanism :
if bits are written with "11" by the master MODBUS, an alarm will send a SMS.

30 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding

Cyclic dial up period.

The equipment may periodically dial up. This function can be used to check that
G200 is alive and to download measurements.

 Hour of the first dialup during the day (00A5h)

Set 0 Hour (0 to 24) 0 minute (0 to 59)
b15 b8 b7 b0
Set = 1 : Cyclic dial up mechanism is ON (only if "Alarm message set up"=1)
= 0 : Cyclic dial up mechanism is OFF

 Period of the dialup (00A6h)

0 Period (Hour 0 to 255)
b15 b8 b7 b0

Period (number of hours) between to dial up

Each time when data is written in this zone(A5-A6h) automatic call is Re-initialise.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 31

MODBUS data addresses and encoding
Phone number (for GSM only)

Phone number of the host computer system or SMS, used to send the alarms.
15 figures maximum encoded.
Only this figures are accepted : <0 to 9>, '+'=<A>
Zone initialised with <F..F> : Flair 200C doesn't send alarms.
i.e. :+330476606599 encoded value :

Phone number Word

FFFA 95h
3304 96h
7660 97h
6599 98h
IP address (for GPRS only)
For instance, 193.251.9.68 is converted as follows :

IP address Word
C1FB A7h
0944 A8h
IP port (for GPRS only)

Possible values: 1 to 65535

For instance, 502 converted as follows :

IP port Word
0x01F6 ABh

Load current deadband (I_mean, I_min, I_max)

Load current variation (expressed in %) above which the measured current value
is stored in the event stack.

Possible values: 0 to 100

Minimum current variation for deadband (I_mean, I_min, I_max)

Minimum load current variation (expressed in A) above which the measured
current value is stored in the event stack.

Possible values: 0 to 250

Caution: to be stored, a current measurement must overtake both the load

current variation and the minimum current variation.

DeadBand voltage availability

Minimum voltage presence percentage variation above which the voltage
availability is stored in the event stack.

Possible values: 0 to 20

32 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding
Communication fault counter threshold
Successive number of missing hourly measurements above which an alarm is
sent.

Possible values: 1 to 4

Measurement period
Period of time for current measurement recording

Possible values: 0002h= test (every 2 minutes)

003Ch= standard( every 1 hour)

Caution: it is mandatory to use 1 hour measurement period for normal operation

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 33

MODBUS data addresses and encoding

The sub-function codes recognised by  000Ch: reading of the number

Diagnostic counter the G200 are: frames received with CRC errors
reading (CPT2).
 0000h: return query data.
 000Dh: reading of the number of
 000Ah: clear counters and exception replies (CPT3).
diagnostic register.
 000Eh: reading of the number of
 000Bh: reading of the number of frames addressed to the station
frames exchanged. (CPT4).

 000Fh: reading of broadcast

requests received (CPT5).

The most significant bit of the sub-function code should be assigned with the
sub-address of the G200 to be accessed.

sub-function code = 0B
CRC16

Reading: 01 08 00 0B 00 00 91 8D

Reply: 01 08 00 0B 00 04 90 4E

G200 address = 1

Function code = 8

34 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

MODBUS data addresses and encoding

Report by exception without any modem

This function allows G200 to report an alarm to the master when :
 The link between G200 / Master is multipoint (permanent link, radio, optical
fiber ...).
 The Master doesn’t poll G200 all the time.

In this case configuration of G200 in the communication parameter menu is :

Modem : Direct
Alarm message enabled : yes
Then G200 can report an alarm by exception (modification of status, fault
detection …)
 G200 transmits spontaneously an exception.

Slave 00h 00h CRC16

number
1 byte 1 byte 1 byte 2 byte

 The master then must read tables and events from the G200 which
transmits spontaneously an exception.

 If the master doesn’t reply by a reading of table, G200 has no transmits

again the exception message after 1, 2, 5, 10, 10, ... minutes.

 G200 transmits this exception with a collision avoidance mechanism.

Report by exception with GSM

When an indication configured as an alarm changes of state, G200 initiates an
alarm cycle by dialling-up the main phone number after the ‘’dial-up delay time / first
attempt’’.

Two cases can occur:

1 - The control center system doesn’t answer:

G200 dial-up again the ‘’main’’ phone number after the ‘’dial-up delay time / second
attempt’’ and eventually try again after the ‘’dial-up delay time / third attempt’’.

2 - The control center system answer :

The control center system send a broadcast message (Slave address = 0) and the
function code = 0.

G200 sends back an exception message with its address, function code 0 with most
significant bit set to 1 and the exception code = 0.

The control center system can then initiate a standard MODBUS Master/Slave
communication.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 35

MODBUS data addresses and encoding

Report by exception with GPRS

When working in non permanent mode (G200 with solar panel power supply) and
in case of alarm, the scada may be called by the G200.

The G200 initiates a TCP connection.

Two cases can occur:

1 - The control center system isn’t reachable:

G200 again tries to make connection with the scada after the ‘TCP/IP connect.
delay / second attempt’’ and eventually tries again after the ‘TCP/IP connect. delay/
third attempt’’.

2 – Connection is successful:
The control center system sends a broadcast message (Slave address = 0) with the
function code = 17 (identification frame)

G200 answers this frame providing the control center with its own modbus address
and its slave ID.

The control center system can then initiate a standard Modbus Master/Slave TCP
communication.

41:12.42 identf < 00 00 00 00 00 02 00 11

41:12.42 IDENTF >> 00 00 00 00 00 06 FF 11 03 00 01 FF
41:13.81 write date < 00 01 00 00 00 0F FF 10 00 02 00 04 08
00 07 04 0B 08 29 38 44
41:14.00 WRITE DATE >> 00 01 00 00 00 06 FF 10 00 02 00 04
41:15.35 read event < 00 02 00 00 00 06 FF 03 00 0F 00 21
41:15.35 READ EVENT >> 00 02 00 00 00 45 FF 03 42 …

To avoid having the G200 not reachable, it can be configured to call at each change
of IP address.

36 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Appendix

MODBUS protocol
(non GPRS version)
MODBUS is a master - slave protocol.
It is used to read or write one or more words (16 bits), as well as diagnostic
counters.

Functions available:

 1: read n output bits.

 2: read n input bits.

 3: read n output words.

 4: read n input words.

 5: write a bit.

 6: write a word.

 8: read diagnostic counters.

 16: write several words.

Exchanges are carried out at the master's initiative and comprise a request from
the master followed by the reply from the slave. The master's requests are
addressed to a slave identified by its number in the first byte of the frame or else
addressed to all the slaves (broadcast).

Broadcast commands are necessarily write commands. No reply is transmitted

by the slaves.

Structure of frames exchanged

All the frames exchanged (request and reply) have the same structure:

Slave function data zone check zone

number code CRC16

Each message or frame contains 4 types of information:

 slave number (1 byte): it specifies the receiving equipment
(0 to FFh). If it is equal to zero, the request concerns all the slaves (broadcast)
and there is no reply message.
 function code (1 byte): it is used to select a command (read, write...) and
check that the reply is correct.
 data zone (n bytes): it contains the parameters linked to the function.
 check zone (2 bytes): it is used to detect transmission errors.
Please note that words (2 bytes = 16 bits) are always written as high-order bits
to low-order bits, with the exception of the CRC16 which is written as least
significant bit, most significant bit.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 37

Appendix

Synchronisation of exchanges
Any character that is received after a silence of more than 3 characters is
considered as the beginning of a frame. A silence in the line equal to at least 3
characters should be respected between two frames.

Example: at 9600 baud, the time is equal to approximately

3 milliseconds.

Checking of messages received by the slave

When the slave receives a frame, it checks the following, in order:
CRC16, slave number, function code and function parameters.

 If the CRC16 or the slave number are incorrect, the slave does not reply.

 If the CRC16 and the slave number are correct, but the function code or
parameters are not valid, the slave transmits an exception reply.

 If the CRC16, slave number, function code and parameters are correct, the
slave replies to the master's request.

Exception reply transmitted by the slave

Slave function Exception code CRC16

number code 01 unknown function code
received 02 incorrect address
with MSB 03 incorrect data
set to 1
1 byte 1 byte 1 byte 2 bytes

38 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Appendix

MODBUS TCP protocol

(GPRS version only)
Modbus TCP protocol is based on the standard modbus protocol.

Same functions as standard modbus are available:

 1: read n output bits.

 2: read n input bits.

 3: read n output words.

 4: read n input words.

 5: write a bit.

 6: write a word.

 8: read diagnostic counters.

 16: write several words.

Plus:

 17: report slave ID. (only used with GPRS)

Structure of frames exchanged

Modbus TCP and its corresponding standard Modbus frame:

Transaction Protocol Unit function
Length data zone
identifier identifier identifier code
2 bytes 2 bytes 2 bytes 1 byte 1 byte

Slave function data zone check zone

Corresponding standard Modbus frame :
number code CRC16

 Transaction identifier: in the reply frame, the RTU sets the transaction
identifier to the same value as the one in the request frame.
 Protocol identifier value is 0x0000.
 Length: it is the length of all the following data of the frame (including unit
identifier and the function code)
 Unit identifier is the modbus address field of main menu of the communication
module. Should be let to default value.
Except from the check zone that is suppressed in modbus TCP, the following of
the field Length is treated the same way as in standard modbus.
In the following, the function codes will be described as used in standard
modbus. To use them in modbus TCP, one only need to add transaction
identifier, protocol identifier and length at the beginning of the frame and to cut
the CRC at the end of it.

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 39

Appendix

Read N bits:
functions n°1 and 2
Function 1: read output bits.
Function 2: read input bits.

Request
Slave 1 or 2 address of 1st bit number of bits CRC16
number (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

Reply
Slave 1 or 2 number of 1st byte read last byte CRC16
number bytes read read
1 byte 1 byte 1 byte 1 byte N bytes 1 byte 2 bytes

Example
Reading of 16 bits, bit address 300h of slave n°1
Request:01 01 03 00 00 10 36 42
Reply:01 01 02 00 00 B9 FC

Read N words:
functions n°3 and 4
The number of words to be read should be less than or equal to 125.

Function 3: read output words.

Function 4: read input words.

Request
Slave 3 or 4 address of 1st word number of words CRC16
number (MSB+LSB) (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

Reply
Slave 3 or 4 number of 1st word read last word CRC16
number bytes read (MSB+LSB) read
(MSB+LSB)
1 byte 1 byte 2 bytes 1 byte 1 byte 2 bytes

Example
Reading of words 40h to 43h of slave n°1,
Request:01 03 00 40 00 04 45 DD
Reply:01 03 08 00 00 80 00 80 00 80 00 C2 17

40 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Appendix

Write a bit:
function n°5
Request
Slave 5 address of bit bit value 0 CRC16
number (MSB+LSB)
1 byte 1 byte 2 bytes 1 byte 1 byte 2 bytes

Reply
The reply is an echo of the request indicating that the slave has acknowledged the
value contained in the request.

Slave 5 address of bit bit value 0 CRC16

number (MSB+LSB)
1 byte 1 byte 2 bytes 1 byte 1 byte 2 bytes

Example
Writing of bit to 1, bit address 301h of slave n°1,
Request:01 05 03 01 FF 00 D6 7E
Reply:01 05 03 01 FF 00 D6 7E

Write a word:
function n°6
Request
Slave 6 address of word value of word CRC16
number (MSB+LSB) (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

Reply
The reply is an echo of the request indicating that the slave has acknowledged the
value contained in the request.

Slave 6 address of word value of word CRC16

number (MSB+LSB) (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

Example
Writing of word 30h of slave n°1, at the value 0001h
Request:01 06 00 30 00 01 48 05
Reply:01 06 00 30 00 01 48 05

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 41

Appendix

Read diagnostic
counters:
function n°8
Each slave is assigned diagnostic counters. There are 5 counters in all per slave. The
counters are 16-bit words. When they reach FFFFh, they go back to 0000h.
When a request is sent by the master, the most significant byte in the sub-function
code is assigned by the G200 equipment offset to access and the data are at 0000h.
When the slave sends a reply, the data contain the value of the counter concerned.

Request / reply
Slave 8 sub-function code data (MSB+LSB) CRC16
number (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

sub-function data
code
the slave should send the echo of the request xx00 XXXX
resetting of diagnostic counters xx0A 0000
reading of total number:
of frames received with no CRC errors (CPT1) xx0B XXXX
of frames received with CRC errors (CPT2) xx0C XXXX
of the number of exception replies (CPT3) xx0D XXXX
of frames addressed to the station (CPT4) xx0E XXXX
(excluding broadcast)
of broadcast requests received and correctly executed xx0F XXXX
(CPT5)

Sub-function n°0 is used to test transmission. The slave sends back the echo of the
data received.

Examples
Resetting of counters for slave n°1,
Request:01 08 00 0A 00 00 C0 09
Reply:01 08 00 0A 00 00 C0 09

Reading of broadcast requests received (CPT5) for slave n°1, offset 3

(300h in storage space)
Request:01 08 03 0F 00 00 D0 4C
Reply:01 08 03 0F 00 05 10 4F

42 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Appendix

Write N consecutive
words:
function n°16
The number of words to be written is between 1 and 123 and the number of bytes is
between 2 and 246.
Words are written in increasing order of addresses.

Request

Slave 10h address of number of number of values of CRC16

number 1st word to words to bytes to write words to
write write write
1 byte 1 byte 2 bytes 2 bytes 1 byte N bytes 2 bytes

Reply
Slave 10h address of 1st word number of words written CRC16
number written (MSB+LSB) (MSB+LSB)
1 byte 1 byte 2 bytes 2 bytes 2 bytes

Example
Writing of words 0302h to 0305h of slave n°1, (addresses 02h to 05h) with the values
0060h, 0A10h, 0B33h, 1662h
Request: 01 10 03 02 00 04 08 00 60 0A 10 0B 33 16 62 96 B3
Reply: 01 10 03 02 00 04 60 4E

51:26.43 read state < 00 16 00 00 00 06 FF 04 00 01 00 01

51:26.43 READ STATE >> 00 16 00 00 00 05 FF 04 02 00 69

Report Slave ID:

function n°17
Only used with G200 GPRS
and modbus TCP
This function code is used in the case G200 doesn’t have a fix IP address on the
network. It makes it possible to identify the equipment calling.
G200 will always answer with Status to On (0xFF in last byte of frame)

Request

Transaction Protocol Length Unit 11h

identifier identifier identifier
2 bytes 2 bytes 2 bytes 1 byte 1 byte

Reply
Transaction Protocol Length Unit 11h 0x02 Slave Id OxFF
identifier identifier identifier (Byte (MSB+LSB) (Status à
count) ON)
2 bytes 2 bytes 2 bytes 1 byte 1 byte 1 byte 2 bytes 1 byte

Example
The request is addressed to all equipment connected (Unit identifier = 0x00) which
corresponds to the only G200 that has created TCP connection. The G200 answers
with modbus address to 255 and slave ID to 1.

41:12.42 identf < 00 00 00 00 00 02 00 11

41:12.42 IDENTF >> 00 00 00 00 00 06 FF 11 03 00 01 FF

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 43

Appendix

CRC 16 calculation
algorithm
Hex FFFF CRC 16

CRC 16 byte CRC 16

n=0

Shift to right CRC 16

no carry yes

CRC 16 poly CRC 16

n=n+1

no n>7 yes

Next byte

no Messsage completed yes

End

n = number of bits of data

poly= CRC16=1010 0000 0000 0001 calculation polynomial

Write CRC 16
calculation in C
language
Calculates and gives the CRC16 in the "buf" zone with length "len" *buf:
pointer of buffer on which the calculations are performed.
 len: length of buffer.
unsigned crc16(char *buf, int len)
{
#define POLY 0xA001
char i;
unsigned crc;

for (crc = 0xFFFF; len != 0; len --)

{
crc ^= *buf ++;
for (i = 0; i < 8; i ++)
{
if (crc & 0x0001)
crc = (crc >> 1) ^ POLY;
else
crc >>= 1;
}
}
return (crc);
}

44 G200 – Modbus Communication – NT00142EN-02.doc Schneider Electric

Schneider Electric SA Postal address As standards, specifications and designs change from time to time, please ask for
F-38050 Grenoble Cedex 9 confirmation of the information given in this publication.
Tel.: +33 (0)4 76 57 60 60
Telex: merge 320842 F Published by: Schneider Electric SA
http:\\www.schneider- Printed by: Hewlett Packard
electric.com

Rcs nanterre B 954 503 439

Schneider Electric G200 – Modbus Communication – NT00142EN-02.doc 45