Classification: Public

Logger Communication Protocol

AW0 1.0.2.5
For models:
Logger1000
Logger3000

I. General Description
This protocol applies to the communication between the
Logger3000/Logger1000 and the host computer monitoring software. It adopts
MODBUS RTU/TCP communication protocol. This protocol can read the run
information of the Logger3000/Logger1000 and the sensor information configured for
the Logger3000/Logger1000 in real time. The Logger3000/Logger1000
communication address is 247.
When the logger forwards data from a device (e.g. inverter), the device (inverter)
address is its forwarding address. For information on how to get the address and
access data, please refer to "Logger Modbus Protocol Data Forwarding Guide".

II. Physical Interface

1. RS485
Default setting
Addressing 247
Broadcast Yes
Baud rate 9600 bit/s
Check N/A
Data bit 8
Stop bit 1
Mode RTU
Electrical interface RS485-2W cable connection

2. Ethernet (for the Logger1000, default IP: 12.12.12.12, default open port: 502;
for the Logger3000, default ETH1 IP: 12.12.12.12, default ETH2 IP: 13.13.13.13,
default open port: 502)

III. Communication Description

1
 Classification: Public

1. Data type
U16 - 16-bit unsigned integer, big-endian.
S16 - 6-bit signed integer, big-endian.
U32 - 32-bit unsigned integer; little-endian for double-word data; big-endian for byte
data.
S32 - 32-bit signed integer; little-endian for double-word data; big-endian for byte
data.
U64 - unsigned 64-bit integer data, big-endian format.
S64 - signed 64-bit integer data, big-endian format.
For example,
U16 data 0x0102 is transmitted in the order 01, 02.
U32 data 0x01020304 is transmitted in the order 03, 04, 01, 02.
U64 data 0x0102030405060708 is transmitted in the order 01, 02, 03, 04, 05, 06, 07,
08.
The address register starts counting at 1, so the communication address = protocol
address - 1.
2. Numerical description
Decimal numbers are transmitted as integers after expansion. For example,
10.333KW is transmitted as 10 333 in expanded form; 800.5V is transmitted as 8005.
Negative numbers are transmitted as complements. For example, 0xFFFF denotes -1.
"Reserved" or unsupported registers cannot be queried or set. "F"s are returned when
unsigned numbers are queried. For example, "0xFFFF" is returned for U16,
"0xFFFFFFFF" for U32, and "0xFFFFFFFFFFFFFFFF" for U64. The largest positive
numbers are returned for signed numbers, for example, “0x7FFF” is returned for S16,
"0x7FFFFFFF" for S32, "0x7FFFFFFFFFFFFFFF" for S64, and 0x00 for UTF-8.
UTF-8 occupies 1 byte. An odd length is padded with 0x00.
3. Address type
The input register is a read-only register and supports 0x04 function code read.
The holding register is a read/write register and supports 0x03 function code query

2
 Classification: Public

and 0x06/0x10 function code write.

4. Check type
CRC16, polynomial 0xA001, little-endian.

IV. Address Definition Table

4.1 Input register (address type: 3X)
Note: In the Remarks column, "Logger1000" indicates that it is supported by the
Logger1000 only; "Logger3000" indicates that it is supported by the Logger3000
only; blank indicates that it is supported by both Logger1000 and Logger3000.
Name Address Data type Factor Unit Remarks
0x0705 Logger3000
Device type code 8000 U16 1
0x0710 Logger1000
Protocol number 8001 U32 1
Communication protocol version 8003 U32 1
Total devices connected 8005 U16 1 Set
Total faulty devices 8006 U16 1 Set
Reserved 8015 U32 1
Reserved 8017 U16 1
Currently only the low
16 bits are used.
Digital input state 8021 U32 1 Logger1000 only uses 8
bits, while Logger3000
uses 16 bits
Reserved 8023 U32 1
Reserved 8025 U32 1
PT100-1 8027 S16 0.1 ℃ Logger3000
PT100-2 8028 S16 0.1 ℃ Logger3000
ADC1 voltage 8029 S16 0.01 V
ADC1 current 8030 S16 0.01 mA
ADC2 voltage 8031 S16 0.01 V
ADC2 current 8032 S16 0.01 mA
Shared by Logger3000
and Logger1000, where
Logger3000 consumes
ADC3 voltage 8033 S16
0.01mV, while
Logger1000 consumes
0.01V
Shared by Logger3000
and Logger1000, where
ADC4 voltage 8034 S16 Logger 3000 consumes
0.01mV while Logger
1000 consumes 0.01V
ADC3 current 8035 S16 0.01 mA Logger1000
ADC4 current 8036 S16 0.01 mA Logger1000
Reserved 8037 S16 1
Longitude 8054 S32 0.0001 º Logger3000
Latitude 8056 S32 0.0001 º Logger3000
Max. total nominal active power 8058 U16 1 kW

3
 Classification: Public

Min. total nominal active power 8059 U16 1 kW

Max. total nominal reactive
8060 U16 1 kvar
power
Min. total nominal reactive
8061 S16 1 kvar
power
Inverter preset total active power 8066 U16 1 kW
Inverter preset total reactive
8067 S16 1 kvar
power
0: Off
Logger On/Off state 8068 U16 1
1: On
0: latched
Logger unlatch state 8069 U16 1
1: unlatched
Total active power 8070 U64 1 W
Daily power yield 8074 U32 0.1 kWh
Total reactive power 8076 S64 1 var
Total power yield 8080 U64 0.1 kWh
Min. adjustable active power 8084 U32 0.1 kW
Max. adjustable active power 8086 U32 0.1 kW
Min. adjustable reactive power 8088 S32 0.1 kvar
Max. adjustable reactive power 8090 S32 0.1 kvar
Nominal active power 8092 U32 0.1 kvar
Nominal reactive power 8094 U32 0.1 kvar
Grid-connected devices 8096 U16 1 Set
Off-grid devices 8097 U16 1 Set
Monthly yield of array 8098 U64 0.1 kWh
Annual yield of array 8102 U64 0.1 kWh
Apparent power of array 8106 U64 1 VA

4.2 Holding register (address type: 4X)

Note: The holding register is set to support single function only. All commands from
the broadcast address 0 are directly transparently transmitted to the inverter.
Data Upper Lower
Name Address Factor Unit Remarks
type limit limit
Set On/Off for 0: Off
8002 U16
subarray inverter 1: On
Set the active
power value
8003 U32 0.1 kW
for subarray
inverter
Set the active
power ratio
8005 U32 0.1 %
for subarray
inverter
Set the reactive
power value
8007 S32 0.1 kvar
for subarray
inverter
Set the reactive
power ratio
8009 S32 0.1 %
for subarray
inverter
Set the power
8011 S32 0.001
factor

4
 Classification: Public

for subarray
inverter
D01 8013 U16 1 Logger3000
D02 8014 U16 1 0: Common port and
D03 8015 U16 1 NC port are closed
1: Common port and
D04 8016 U16 1
NO port are closed

V. Examples
6.1. The background communicates with the logger over the network. The address of
the logger is 247. When the background is bound to the port 502 of the logger, it
needs to query the DI state of the logger.
Background sends: 09 79 00 00 00 06 F7 04 1F 54 00 02
Logger replies: 09 79 00 00 00 07 F7 04 04 00 01 00 00
In the data replied, "09 79 00 00 00 00 06" and "09 79 00 00 00 07" are headers of the
Modbus TCP message; F7 is the address of the logger; 04 is the function code;
0x1F54 = 8020 is to query the data of Register 8021. According to this protocol,
Register 8021 indicates the "digital input state (DIN)", and the data of Register 8021
in the logger reply message is 0x0000.

6.2. Set boot

Send command: 0A B3 00 00 00 06 F7 06 1F 41 00 01
Reply data: 0A B3 00 00 00 06 F7 06 1F 41 00 01
In the command sent, "0ab30000006" is the Modbus TCP message header, F7 is the
logger address, 06 is the function code, 0x1F41 = 8001 is to write data to Register 8002;
the value to write is 0x0001 indicates booting.

6.3 Set the active power ratio for subarray inverter

Send command: 00 00 00 00 00 0b F7 10 1F 42 00 02 04 00 00 00 00
Reply data: 00 00 00 00 00 06 F7 10 1F 42 00 02
In the command sent, "00 00 00 00 00 0b" is the Modbus TCP message header, F7 is
the Logger address, 10 is the function code, 0x1F42 = 8002 is to write two consecutive
register data to the starting address of Register 8003, and the value to write is
0x00000000.

6.4. Set the active power ratio for subarray inverter

Send command: 00 00 00 00 00 0b F7 10 1F 44 00 02 04 01 5E 00 00
Reply data: 00 00 00 00 00 06 F7 10 1F 44 00 02
In the command sent, "00 00 00 00 00 0b" is the Modbus TCP message header, F7 is
the Logger address, 10 is the function code, 0x1F44 = 8004 is to write two consecutive
register data to the starting address of Register 8005, and the value to write is

5
 Classification: Public

0x0000015E.