File Number File version V1.

0
KAISE UPS File Secret Level Non-secret Effective date 2020.09
Formulating Software Department
department

TCP/IP MODBUS/SNMP
PROTOCOL OF KAISE
1-3KVA

2021.03
 File Number File version V1.0
East Group Co., Ltd. File Secret Level Non-secret Effective date 2020.09
Formulating Software Department
department

ID Version Content Modifier Time Remarks

Determine the basic electrical quantity,

1 Ver 1.0 supplementary application range and Yjp 2020-09-22

interface definition

2021.03
 Table of Contents
Chapter 1: TCP/IP Modbus protocol ............................................................................. 1

1、Description of the protocol .................................................................................... 1

1、The scope of application of the protocol .....................................................................................................1

2、Normative references ..................................................................................................................................1

3、Introduction to modbus protocol.................................................................................................................1

4、Modbus TCP .................................................................................................................................................1

5、Response information classification ............................................................................................................2

6、Function code ...............................................................................................................................................4

2、 Modbus address mapping .................................................................................... 5

1、Read Input Registers(0x04) ..........................................................................................................................5

2、Read Discrete Inputs(0x02) ..........................................................................................................................7

3、Write Register（0x06/0x10） .....................................................................................................................8

3、Communication content....................................................................................... 10

1、MODBUS/TCP Data Format ........................................................................................................................10

2、Example of reading input register (0x04) ...................................................................................................11

3、Example of reading discrete quantities (0x02)...........................................................................................12

4、Example of read device register (0x03) ......................................................................................................13

5、Set device register (0x06/0x10)..................................................................................................................14

Appendix A CRC Check ...........................................................................................................................15

Appendix B Table of High and Low Bytes ..............................................................................................18

Chapter 2: SNMP protocol (Simple Network Management Protocol) ......................... 21

1、Description of the protocol .................................................................................. 21

1、Scope of protocol .......................................................................................................................................21

2、Introduction to SNMP protocol ..................................................................................................................21

2、Communication content and OID ......................................................................... 23

2021.03
Chapter 1: TCP/IP Modbus protocol
1、Description of the protocol

1、The scope of application of the protocol

The first chapter of this protocol document specifies the equipment EA900 G3 1-3K UPS, and the
SNMP card provides Modbus interface requirements through TCP/IP connection.

2、Normative references

1. RFC791, Internet Protocol, Sep81 DARPA

2. MODBUS Protocol Reference Guide Rev J, MODICON, June 1996, doc#PI_MBUS_300
MODBUS is an application layer message transmission protocol used for client/server communication
between devices connected through different types of buses or networks. Currently, MODBUS is
implemented in the following situations:
1) TCP/IP on Ethernet.
2) Asynchronous serial transmission on various media (wired: EIA/TIA-232-E, EIA/TIA-485-A; optical
fiber, wireless, etc.).

3、Introduction to modbus protocol

The Modbus protocol is a universal language applied to the controller. Through this protocol, the
controller can communicate with other UPS devices via the network. This communication adopts the
response mode, the host initiates a request (send telemetry, remote signaling information), and the slave
executes the request and responds. The slaves need to be distinguished by address setting. The address
range that can be set for the slaves is 1~247.

4、Modbus TCP

Modbus rtu and Modbus tcp are both MODBUS protocols in essence. Both rely on MODBUS register
addresses to exchange data, but the hardware interfaces used are different. Modbus RTU generally uses
serial port RS232C or RS485/422, while Modbus TCP generally uses Ethernet. Network port.
ModbusTCP mode does not require additional verification, because the TCP protocol is a

1
2021.03
connection-oriented reliable protocol. TCP and RTU protocols are very similar, just remove the
two-byte check code of the RTU protocol, and then add a six-byte prefix before the RTU data frame and
send it out through the TCP/IP network protocol. All requests are sent from register port 502 via TCP.
The request and response are prefixed with six bytes, as follows:
Modbus TCP data frame can be divided into two parts: MBAP + PDU
MBAP message header (7byte):
byte 0: transaction identifier
byte 1: transaction identifier
byte 2: protocol identifier
byte 3: protocol identifier
byte 4: length field
byte 5: length field
byte 6: Unit identifier (formerly "Slave address")
PDU data:
byte 7: MODBUS function code
byte 8: transfer data

5、Response information classification

When an error occurs, a series of defined exception codes are sent back from the station. Note that the
master station will "speculatively" send instructions, and use the received success or exception code to
determine which MODBUS of the dominating equipment is willing to respond and the size of the
different available data areas of the slave station.
All exceptions are marked by adding 0x80 to the requested function code. Following this byte is a single
cause byte
As shown in the following example:
03 12 34 00 01 => 83 02
When the index is 0x1234, respond with exception type 02 "Illegal data address"
The exceptions are listed as follows:
01 Illegal function
For the slave, the function code received during the inquiry is not allowed. This may be because the
2
2021.03
function code only applies
It is used in the latest controller and cannot be used in the selected unit. It can also be inferred that the
slave station is in the wrong state and issued such a
A request, such as being asked to return a register value without being configured.
02 Illegal data address
For the slave, the data address received during the inquiry is not an allowable address. To be more clear,
refer to the value and transmission
The combination of length is invalid. For a controller with 100 registers, the one with offset 96 and
length 4
The request will succeed, and a request with offset 96 and length 5 will generate exception 02.

3
2021.03
6、Function code

Function
Name Effect
Code
Read the binary data in the discrete input register of the
0x02 Read discrete input
slave
0x03 Read holding register Get the current binary value in one or more holding registers
0x04 Read input register Get the current binary value in one or more input registers
Write a single holding Write a single register on the slave (can be used as a
0x06
register function code for setting a single parameter)
Write multiple holding Write multiple registers on the slave (can be used as a
0x10
registers function code for setting multiple parameters)

4
2021.03
2、 Modbus address mapping

1、Read Input Registers(0x04)

Address Data
Content type unit ratio remark
HEX DEC length
0x0002:Battery normal
0x0003:Battery low voltage
0x0101 257 Battery status 2bytes USHORT / 1 0x0005:Battery self-check
0x0008:Battery disCharge
Other invalid
Battery residual
0x0104 260 2bytes USHORT % 1
capacity
0x0105 261 Battery voltage 2bytes SHORT V 0.1
0x010A 266 Input voltage 2bytes SHORT V 1
0x0110 272 Input frequency 2bytes USHORT Hz 0.1
0x0002:Standby
0x0003:Normal
Output Power
0x0119 281 2bytes USHORT / 1 0x0004:Bypass
Supply Mode
0x0005:Battery
Other invalid
0x011A 282 Output frequency 2bytes USHORT Hz 0.1
0x011C 284 Output voltage 2bytes SHORT V 1
0x0128 296 Load percentage 2bytes USHORT % 1
0x012B 299 Bypass frequency 2bytes USHORT Hz 0.1
0x012D 301 Bypass voltage 2bytes SHORT V 1
Rated input
0x0139 313 2bytes USHORT V 1
voltage
Rated input
0x013A 314 2bytes USHORT Hz 0.1
frequency
Rated output
0x013B 315 2bytes USHORT V 1
voltage
Rated output
0x013C 316 2bytes USHORT Hz 0.1
frequency
0x0142 322 Buzzer status 2bytes USHORT / 1
0x0001:Standby mode
0x0002:Bypass mode
0x0003:Online mode
UPS operating
0x0161 353 2bytes USHORT / 1 0x0004:Battery mode
mode
0x0005:Battery self-check
mode
0x0006:Fault mode
5
2021.03
 0x0007:Frequency
conversion mode
0x0008:Economic mode
0x0009:Shutdown mode
Other invalid
0x0201 513- The manufacturer 2bytes
SHORT / 1
~0x0210 528 name *16
0x0211 529- 2bytes
UPS models SHORT / 1
~0x0230 560 *32
0x0231 561- UPS Software 2bytes
SHORT / 1
~0x0250 592 Version *32

6
2021.03
2、Read Discrete Inputs(0x02)

Address
Alarm/Fault Length Note
HEX DEC
0x0103 259 Battery powered 1 bit 1:Happen
0x0104 260 Battery low voltage 1 bit 1:Happen
0x0107 263 Input Fault 1 bit 1:Happen
0x010A 266 Bypass powered 1 bit 1:Happen
0x0113 275 UPS Fault 1 bit 1:Happen
0x0118 280 Testing 1 bit 1:Happen
0x011B 283 Battery Discharge 1 bit 1:Happen
0x0121 289 The types of UPS 1 bit 1:Off-line 0:On-line

7
2021.03
3、Write Register（0x06/0x10）
Address
Content Length note
HEX DEC
Writing 0xFFFF is valid, and the test will
return after 10s. If the battery voltage is low
0x0001 1 Battery test 10s 2 bytes
during the test, the system immediately
returns to the initial state.
Writing 0xFFFF is valid, and the system is
Battery low
0x0002 2 2 bytes tested until the battery voltage is low and the
voltage test
inverter is powered.
Writing 0xFFFF is valid. When the UPS
0x0003 3 Buzzer switch 2 bytes system alarms, the alarm tone can be turned
on or canceled.
Writing 0xFFFF is valid and cancels all the
Cancel test
0x0004 4 2 bytes states being tested, and the system
command
immediately restores to the output state.
Writing 0xFFFF is valid,
a. If the system is in shutdown waiting state,
you can cancel the shutdown command;
Cancel shutdown
0x0005 5 2 bytes b. If the system is in the recovery state after
command
shutdown, this command will immediately
restore the system output, but the UPS must
maintain the disabled state for at least 10s.
Writing time 0~99 is valid; continuous testing
Battery test N for n minutes. If the battery voltage is low
0x0006 6 2 bytes
minutes during the test, the system will return
immediately;
Turn off after N The writing time is 12~600 valid; the UPS
0x0007 7 2 bytes
seconds system will be shut down after N seconds.
Restart the UPS The writing time 1~9999 is valid; after the
0x0008 8 N minutes after 2 bytes UPS system is shut down, the system restarts
the scheduled in N minutes.

8
2021.03
 shutdown Note that the operation to this register address
alone is invalid. It must be operated
continuously from 0x0007 to 0x0008 for this
function to take effect.

9
2021.03
3、Communication content
1、MODBUS/TCP Data Format
This section describes the general format of MODBUS request and/or response encapsulation carried
over the MODBUS/TCP network.(Note: In the request and response data frame, the structure from the
function code to the end corresponds to the MODBUS RTU format)
Modbus TCP data frame can be divided into two parts: MBAP + PDU (take 03 function code as an example)
Request：00 00 00 00 00 06 09 03 00 04 00 01
Example length/byte Note Remarks
Transaction identifier (high eight
0x00 1 Client initiated, server
digits)
replication, used for
Transaction identifier (lower eight
0x00 1 transaction processing pairing
bits)
MBAP header Client initiates, server
0x0000 2 Protocol identification symbol
replicates, Modbus protocol=0
From the next to the end of
0x0006 2 Length
this byte
0x09 1 Unit identifier Slave address
Function code 0x03 1 Modbus function code
0x0004 2 starting address
Data
0x0001 2 Number of registers

Response：00 00 00 00 00 05 09 03 02 00 05
Example length/byte Note Remarks
Transaction identifier (high eight
0x00 1 Client initiated, server
digits)
replication, used for
Transaction identifier (lower eight
0x00 1 transaction processing pairing
bits)
MBAP header Client initiates, server
0x0000 2 Protocol identification symbol
replicates, Modbus protocol=0
From the next to the end of
0x0005 2 length
this byte
0x09 1 Unit identifier Slave address
Function code 0x03 1 Modbus function code
0x02 1 Number of bytes The specific number is subject
Data
0x0005 2 data to the actual reading (refer to

10
2021.03
 Modbus)
The "CRC-16" or "LRC" check field is not required in MODBUS/TCP. Instead, TCP/IP and link layer
(Ethernet) checksum mechanisms are used to verify the accuracy of packet switching.

2、Example of reading input register (0x04)

Assuming that the UPS device address is set to 0x18, the starting address of the query register is
0x0043, and the number of registers is 2, assuming that the value of "Battery Voltage" and "Battery
Current" is queried, the value of "Battery Voltage" is 54.1V. The value of "battery current" is 30.9A, and
the coefficient according to this value is 0.1, then:
The value of register 0x0043 is: (541)D = (021D)H
The value of register 0x0044 is: (309)D = (0135)H
Then the number of bytes of returned data is 4. In RTU mode, the request frame information and
response frame information for data query are:
The request frame information is:

Address Function Code Register start address Number of registers CRC check
Data 0x18 0x04 0x00 0x43 0x00 0x02 0x82 0x16
Number of
1 1 2 2 2
bytes

The response frame information is：

Function Return the number of

Address Data content CRC check
Code data bytes

Data 0x18 0x04 0x04 0x021D 0x0135 0x23 0x7C

Number of
1 1 1 4 2
bytes

11
2021.03
3、Example of reading discrete quantities (0x02)

Assuming that the UPS device address is set to 0x18, the starting address of the query register is 51,
that is, 0x0033, and the number of discrete quantities is 1.Suppose that the discrete quantity of the query
point is “bypass MCB closing”, at this time “bypass MCB closing occurs”, that is, the value is 1.
When returning data, the byte is arranged from low to high, up to 8 bits. 8 input bits in the next byte
It is also arranged from low to high. If the returned input digits are not a multiple of 8, the remaining
digits in the last data byte up to the highest bit of the byte are all filled with zeros.
In RTU mode, the request frame information and response frame information for status query are:
The request frame information is：

Function
Address Starting address Discrete number CRC check
Code

Data 0x18 0x02 0x00 0x33 0x00 0x01 0x4B 0xCC

Number of
1 1 2 2 2
bytes

The response frame information is：

Function Return the number of

Address Data content CRC check
Code data bytes

Data 0x18 0x02 0x01 0x01 0x67 0x14

Number of
1 1 1 1 2
bytes

12
2021.03
4、Example of read device register (0x03)

Assuming that the UPS device address is set to 0x18, request to read the contents of registers
43-44:
The value of register 0x0043 is: (541)D = (021D)H
The value of register 0x0044 is: (309)D = (0135)H
Then the number of bytes of returned data is 4. In RTU mode, the request frame information and
response frame information for data query are:
The request frame information is:

Function Register start

Address Number of registers CRC check
code address
Data 0x18 0x03 0x00 0x43 0x00 0x02 0x37 0xD6

Number
1 1 2 2 2
of bytes

The response frame information is：

Return the
Function
Address number of data Data content CRC check
code
bytes
Data 0x18 0x03 0x04 0x021D 0x0135 0x22 0xCB

Number
1 1 1 4 2
of bytes

13
2021.03
5、Set device register (0x06/0x10)

Assuming that the UPS device address is set to 0x18, the value of the register address 0x0001 needs
to be set to 0x00FF. After the register content is preset, the normal response is returned; the request
frame information and response frame information of the preset single register are:
The request frame information is:
Function Register start
Address Preset data CRC check
code address
Data 0x18 0x06 0x00 0x01 0x00 0xFF 0x9A 0x43

Number of
1 1 2 2 2
bytes

The response frame information is：

Function Successfully preset

Address Register address CRC check
code data

Data 0x18 0x06 0x00 0x01 0x00 0xFF 0x9A 0x43

Number of
1 1 2 2 2
bytes

14
2021.03
Appendix A CRC Check

CRC Cyclic Redundancy Check

The cyclic redundancy check (CRC) field is two bytes and contains a binary 16-bit value. The CRC
value appended to the message is calculated by the sending device. The receiving device recalculates the
CRC value when receiving the message, and compares the calculation result with the actually received
CRC value. If the two values are not equal, it is an error.
CRC calculation, start to pre-load a 16-bit register 1. Then perform subsequent calculations on
consecutive 8-bit subsections in the message. Only the 8 data bits in the character participate in the
calculation of CRC generation, and the start bit, stop bit and check bit do not participate in the CRC
calculation. In the process of CRC generation, each 8-bit character is XORed with the value in the
register. Then the result is shifted (Shift) 1 bit to the least significant bit (LSB) direction, and the most
significant bit (MSB) position is filled with zero. Then extract and check the LSB: if the LSB is 1, the
value in the register is XORed with a fixed preset value; if the LSB is 0, the XOR operation is not
performed. This process will repeat until 8 shifts have been performed. After finishing the last (eighth)
shift and related operations, the next 8-bit byte is XORed with the current value of the register, and then
the same as described above is repeated 8 times. The final value in the register obtained after all
subsections in the message are calculated is the CRC.
The process of generating CRC is:
1. Load a 16-bit register into hexadecimal FFFF (all 1s). Call it the CRC register.
2. XOR the first 8-bit byte of the message with the low byte of the 16-bit CRC register, and place the
result in the CRC register.
3. Move the CRC register 1 bit to the right (towards the LSB direction), and charge the MSB to zero.
Extract and check the LSB.
4. (If LSB is 0): Repeat step 3 (another shift).
(If LSB is 1): XOR polynomial value of CRC register 0xA001 (1010 0000 0000 0001).
5. Repeat steps 3 and 4 until 8 shifts are completed. When this operation is completed, the complete
operation on the 8-bit byte will be completed.
6. Repeat steps 2 to 5 for the next byte in the message, and continue this operation until all messages

15
2021.03
have been processed.
7.The final content in the CRC register is the CRC value.
8. When placing the CRC value in the message, as described below, the high and low bytes must be
exchanged.
Place the CRC in the message. When the 16-bit CRC (2 8-bit bytes) is transmitted in the message, the
low-order byte is sent first, followed by the high-order byte.
Example: The C language functions that perform CRC generation are shown below. All possible CRC
values are pre-installed in two arrays, which can be simply indexed when calculating the message
content. One array contains all 256 possible high-order bytes of the 16-bit CRC field, and the other array
contains the low-order byte values. This index access CRC method provides a faster method than
calculating a new CRC for each new character in the message buffer.
Note: This function internally performs high/low CRC byte exchange. This function returns the CRC
value that has been exchanged.
In other words, the CRC value returned from this function can be directly placed in the message for
sending.
The function uses two parameters:
unsigned char *puchMsg; Pointer to the buffer containing the binary data message used to generate the
CRC
unsigned short usDataLen; The number of bytes in the message buffer.
CRC generation function
unsigned short CRC16 ( puchMsg， usDataLen ) /* The function returns CRC in unsigned short type */
unsigned char *puchMsg ; /* Message used to calculate CRC */
unsigned short usDataLen ; /* Number of bytes in the message */
{
unsigned char uchCRCHi = 0xFF ; /* CRC high byte initialization */
unsigned char uchCRCLo = 0xFF ; /* CRC low byte initialization */
unsigned uIndex ; /* CRC lookup table index */
while (usDataLen--) /* Complete the entire message buffer */
{
uIndex = uchCRCLo ^ *puchMsgg++ ; /* Calculate CRC */
16
2021.03
 uchCRCLo = uchCRCHi ^ auchCRCHi[uIndex] ;
uchCRCHi = auchCRCLo[uIndex] ;
}
return (uchCRCHi << 8 | uchCRCLo) ;

17
2021.03
Appendix B Table of High and Low Bytes

High byte table

/* CRC value of high byte */
static unsigned char auchCRCHi[] = {
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1,
0x81, 0x40, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,
0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80,
0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00,
0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81,
0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1,
0x81, 0x40, 0x01,
0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01,
0xC0, 0x80, 0x41,

18
2021.03
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01,
0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81,
0x40
};

Low byte table

/* CRC value of low byte */
static char auchCRCLo[] = {
0x00, 0xC0, 0xC1, 0x01, 0xC3, 0x03, 0x02, 0xC2, 0xC6, 0x06, 0x07, 0xC7,
0x05, 0xC5, 0xC4,
0x04, 0xCC, 0x0C, 0x0D, 0xCD, 0x0F, 0xCF, 0xCE, 0x0E, 0x0A, 0xCA, 0xCB,
0x0B, 0xC9, 0x09,
0x08, 0xC8, 0xD8, 0x18, 0x19, 0xD9, 0x1B, 0xDB, 0xDA, 0x1A, 0x1E, 0xDE,
0xDF, 0x1F, 0xDD,
0x1D, 0x1C, 0xDC, 0x14, 0xD4, 0xD5, 0x15, 0xD7, 0x17, 0x16, 0xD6, 0xD2,
0x12, 0x13, 0xD3,
0x11, 0xD1, 0xD0, 0x10, 0xF0, 0x30, 0x31, 0xF1, 0x33, 0xF3, 0xF2, 0x32,
0x36, 0xF6, 0xF7,
0x37, 0xF5, 0x35, 0x34, 0xF4, 0x3C, 0xFC, 0xFD, 0x3D, 0xFF, 0x3F, 0x3E,
0xFE, 0xFA, 0x3A,
0x3B, 0xFB, 0x39, 0xF9, 0xF8, 0x38, 0x28, 0xE8, 0xE9, 0x29, 0xEB, 0x2B,
0x2A, 0xEA, 0xEE,
19
2021.03
0x2E, 0x2F, 0xEF, 0x2D, 0xED, 0xEC, 0x2C, 0xE4, 0x24, 0x25, 0xE5, 0x27,
0xE7, 0xE6, 0x26,
0x22, 0xE2, 0xE3, 0x23, 0xE1, 0x21, 0x20, 0xE0, 0xA0, 0x60, 0x61, 0xA1,
0x63, 0xA3, 0xA2,
0x62, 0x66, 0xA6, 0xA7, 0x67, 0xA5, 0x65, 0x64, 0xA4, 0x6C, 0xAC, 0xAD,
0x6D, 0xAF, 0x6F,
0x6E, 0xAE, 0xAA, 0x6A, 0x6B, 0xAB, 0x69, 0xA9, 0xA8, 0x68, 0x78, 0xB8,
0xB9, 0x79, 0xBB,
0x7B, 0x7A, 0xBA, 0xBE, 0x7E, 0x7F, 0xBF, 0x7D, 0xBD, 0xBC, 0x7C, 0xB4,
0x74, 0x75, 0xB5,
0x77, 0xB7, 0xB6, 0x76, 0x72, 0xB2, 0xB3, 0x73, 0xB1, 0x71, 0x70, 0xB0,
0x50, 0x90, 0x91,
0x51, 0x93, 0x53, 0x52, 0x92, 0x96, 0x56, 0x57, 0x97, 0x55, 0x95, 0x94,
0x54, 0x9C, 0x5C,
0x5D, 0x9D, 0x5F, 0x9F, 0x9E, 0x5E, 0x5A, 0x9A, 0x9B, 0x5B, 0x99, 0x59,
0x58, 0x98, 0x88,
0x48, 0x49, 0x89, 0x4B, 0x8B, 0x8A, 0x4A, 0x4E, 0x8E, 0x8F, 0x4F, 0x8D,
0x4D, 0x4C, 0x8C,
0x44, 0x84, 0x85, 0x45, 0x87, 0x47, 0x46, 0x86, 0x82, 0x42, 0x43, 0x83,
0x41, 0x81, 0x80,
0x40
};

20
2021.03
Chapter 2: SNMP protocol (Simple Network Management
Protocol)
1、Description of the protocol

1、Scope of protocol

The second chapter of this protocol document specifies the equipment EA990 G4 40-120K UPS. The
SNMP card provides the SNMP protocol through the TCP/IP connection for the interface requirements
of the network management node information.

2、Introduction to SNMP protocol

Simple Network Management Protocol (SNMP: Simple Network Management Protocol) is a

standard protocol specifically designed to manage network nodes (servers, workstations, routers,
switches, and HUBS, etc.) in an IP network, and is an application layer protocol. SNMP enables
network administrators to manage network performance, discover and solve network problems, and plan
network growth. Receive random messages (and event reports) through SNMP. The network
management system learns that there is a problem with the network.
The predecessor of SNMP was Simple Gateway Monitoring Protocol (SGMP), which was used to
manage communication lines. Subsequently, people made great changes to SGMP, especially the
addition of SMI and MIB that conform to the definition of the Internet. The improved protocol is the
famous SNMP. The SNMP network management framework based on TCP/IP is the current industry
standard and consists of three main parts, namely the management information structure SMI, the
management information base MIB and the management protocol SNMP, which are defined as follows:
1) SMI defines the organization and identification of information used in the SNMP framework, and
provides a template for MIB to define management objects and use management objects.
2) MIB defines a collection of management objects that can be accessed through SNMP.
3) The SNMP protocol is an application layer protocol, which defines how the network manager
reads and writes the MIB objects of the agent process.
The MIB in SNMP is a tree-like database. The object managed by MIB is the end node of the tree.
Each node has a unique location and unique name. IETF stipulates that the management information
21
2021.03
base object identifier (OID, Object Identifier) is uniquely specified. The naming rule is that the name of
the parent node is used as the prefix of the child node name.

22
2021.03
2、Communication content and OID
The OID and related communication information supported by this protocol can be found in the
MIB library (RFC1628_UPS_MIB.mib), as shown in the following table
Rati
Content Node(oid) Node name unit Remarks
o
2: Battery normal

3: Battery low voltage

Battery status 1.3.6.1.2.1.33.1.2.1 upsBatteryStatus / 1 5: Battery self-check

8: Battery discharge

Other invalid
upsEstimatedCharge
Battery remaining capacity 1.3.6.1.2.1.33.1.2.4 % 1
Remaining
Battery voltage 1.3.6.1.2.1.33.1.2.5 upsBatteryVoltage V 0.1

Input voltage 1.3.6.1.2.1.33.1.3.3.1.3 upsInputVoltage V 1

Input frequency 1.3.6.1.2.1.33.1.3.3.1.2 upsInputFrequency Hz 0.1

3: Normal

4: Bypass
Output power supply mode 1.3.6.1.2.1.33.1.4.1 upsOutputSource / 1
5: Battery

Other invalid
upsOutput
Load percentage 1.3.6.1.2.1.33.1.4.4.1.5 % 1
PercentLoad
upsBypass
Bypass frequency 1.3.6.1.2.1.33.1.5.1 Hz 0.1
Frequency
Bypass voltage 1.3.6.1.2.1.33.1.5.3.1.2 upsBypassVoltage V 1
upsConfig
Rated input voltage 1.3.6.1.2.1.33.1.9.1 V 1
InputVoltage
upsConfig
Rated input frequency 1.3.6.1.2.1.33.1.9.2 Hz 0.1
InputFreq
upsConfig
Rated output voltage 1.3.6.1.2.1.33.1.9.3 V 1
OutputVoltage
upsConfig
Rated output frequency 1.3.6.1.2.1.33.1.9.4 Hz 0.1
OutputFreq
upsConfig
Buzzer status 1.3.6.1.2.1.33.1.9.8 / 1
AudibleStatus
upsIdent
Manufacturer's name 1.3.6.1.2.1.33.1.1.1 / /
Manufacturer
23
2021.03
UPS model 1.3.6.1.2.1.33.1.1.2 upsIdentModel / /
upsIdentUPS
UPS software version 1.3.6.1.2.1.33.1.1.3 / /
SoftwareVersion
Battery powered 1.3.6.1.2.1.33.1.6.3.2 upsAlarmOnBattery 1: happen
upsAlarmLowBatter
Battery voltage is low 1.3.6.1.2.1.33.1.6.3.3 1: happen
y
Input (mains) failure 1.3.6.1.2.1.33.1.6.3.6 upsAlarmInputBad 1: happen

Bypass power supply 1.3.6.1.2.1.33.1.6.3.9 upsAlarmOnBypass 1: happen

upsAlarm
UPS failure 1.3.6.1.2.1.33.1.6.3.18 1: happen
GeneralFault
upsAlarm
Testing 1.3.6.1.2.1.33.1.6.3.24 1: happen
TestInProgress
Writing 0xFFFF is

valid. When the UPS

upsConfig
Buzzer switch 1.3.6.1.2.1.33.1.9.8 system alarms, the
AudibleStatus
alarm tone can be

turned on or canceled.

The writing time is

upsShutdown 12~600 valid; the UPS

Turn off after N seconds 1.3.6.1.2.1.33.1.8.2
AfterDelay system will be shut

down after N seconds.

The writing time

1~9999 is valid; after

the UPS system is shut

down, the system

restarts in N minutes.
Restart the UPS N minutes
after the scheduled 1.3.6.1.2.1.33.1.8.3 StartupAfterDelay Note that the operation
shutdown
to this register address

alone is invalid. It must

be operated

continuously from

0x0007 to 0x0008 for

24
2021.03
 this function to take

effect.

25
2021.03