HONGFA GROUP

Z3GW The Smart Gateway

Software Manual

Xiamen Hongfa Switchgear Co., LTD

 catalogue
1. INTRODUCTION ..............................................................................................................................................................1
2. FUNCTION INTRODUCTION ............................................................................................................................................ 1
2.1 COMMUNICATION FUNCTION ............................................................................................................................................... 2
2.2 INDICATOR LIGHT FUNCTION ................................................................................................................................................ 2
2.3 KEY FUNCTIONS .................................................................................................................................................................2
2.4 GATEWAY ADD CIRCUIT BREAKER ADDRESS CONFIGURATION ....................................................................................................3
2. 5MQTT CLOUD DATA TRANSMISSION ..................................................................................................................................3
2.5.1 MQTT Server Connection ......................................................................................................................................... 3
2.5.2 Actively reporting device information ..................................................................................................................... 6
2.5.3 Report Message Format ...........................................................................................................................................6
2.5.4 Release Request ....................................................................................................................................................... 9
2.5.5 MQTT Message Data Analysis ................................................................................................................................ 10
2.6 MODBUS TCP DATA TRANSMISSION ...................................................................................................................................15
2.6.1 Modbus TCP instruction message (standard format) ............................................................................................ 15
2.6.2 Gateway AP hotspot modification configuration (only supported with W gateway) ........................................... 15
2.6.3 WIFI/Ethernet transparent communication .......................................................................................................... 16
2.7 MODBUS RTU DATA TRANSMISSION (ONLY SUPPORTED WITH R/U GATEWAY) .......................................................................... 16
2.8 TIMING CONTROL ............................................................................................................................................................ 16
2.9 ONE CLICK CONTROL ........................................................................................................................................................ 16
3. INSTRUCTIONS FOR USE ...............................................................................................................................................17
3.1 COMMUNICATION DEBUGGING TOOLS ................................................................................................................................ 17
3.2 INSTRUCTIONS FOR USING CONFIGURATION TOOLS ................................................................................................................ 17
3.2.1 TCP mode (used in gateway AP hotspot mode) .....................................................................................................17
3.2.2 RTU mode (only supported with R/U gateway) ..................................................................................................... 19
3.3 COMMUNICATION DEBUGGING STEPS ..................................................................................................................................20
3.3.1 WIFI communication .............................................................................................................................................. 20
3.3.2 Ethernet communication connection .................................................................................................................... 21
3.3. 34G Communication ...............................................................................................................................................21
3.3.4 Upstream RS485/232 communication ................................................................................................................... 21
4. COMMON FAULTS AND HANDLING ............................................................................................................................. 21
5. APPENDIX .....................................................................................................................................................................23
5.1 INTELLIGENT GATEWAY COMMUNICATION PROTOCOL ............................................................................................................23
 Z3GW 智能网关软件手册 V1.0

1. introduction

Before software debugging, please confirm that the installation and wiring of the gateway circuit breaker are correct.
The wiring diagram is as follows:

Wiring diagram of gateway, power supply, and circuit breaker

2. Function Introduction

Gateway Interface Diagram

—1—
 Z3GW 智能网关软件手册 V1.0

2.1 Communication function

Note: Abbreviations represent W (WIFI), E (wired Ethernet), G (4G), R (RS485), U (RS232). Only
one method can be selected for WEG gateway communication, and gateway settings must be done before
use. Please use our company's configuration tool software for gateway configuration, and refer to the
3.2 Configuration Tool Instructions for operation.

Downlink
Gateway Communication Uplink transmission
transmission Remarks
Type method protocol
protocol
Does not support 5G network
connection, default baud rate for
W WIFI MQTT (default)/Modbus TCP Modbus RTU
downlink is 9600, no verification,
stop bit 1, data bit 8
The default baud rate for the
Wired
E MQTT (default)/Modbus TCP Modbus RTU downlink is 9600, with no checksum,
Ethernet
stop bit 1, and data bit 8
There are no restrictions on
operators, including the Internet
of Things, phone cards, traffic
G 4G MQTT Modbus RTU cards, etc; The default baud rate
for the downlink is 9600, with no
checksum, stop bit 1, and data bit
8
The default baud rate for uplink and
downlink is 9600, without
R RS485 Modbus RTU Modbus RTU
verification, with stop bit 1 and
data bit 8
The default baud rate for uplink and
The data format is Modbus downlink is 9600, without
U RS232 Modbus RTU
RTU verification, with stop bit 1 and
data bit 8

2.2 Indicator light function

Indicator light state explain
AP hotspot mode, can be configured for WIFI distribution
1s slow flashing
network or gateway
100ms flash Not connected to the network, currently connected
NET (green light)
Chang Liang Connected to the network
2 seconds slow flash and 4G card not recognized, please check if the card is inserted
then fast flash correctly!
Circuit breaker communication abnormal or gateway not
1s slow flashing
connected (added) circuit breaker
RS485 (red light)
Chang Liang Circuit breaker communication is normal
100ms flash Circuit breaker address configuration mode
Slow flashing of traffic lights simultaneously Entering UDP distribution network state

2.3 Key functions

explain operation

—2—
 Z3GW 智能网关软件手册 V1.0

Press and hold for 3 seconds, the green light will slowly
Activate AP hotspot mode
flash
Turn off AP hotspot mode Long press for 3 seconds, green light flashes quickly
Enter the circuit breaker address configuration Press three times within 6 seconds and the red light will
state flash quickly
Exit the circuit breaker address configuration Press three times within 6 seconds (the gateway automatically
state refreshes the online device after each exit)
Enter the state of clearing the configured Long press for 8 seconds, the red light flashes quickly;
circuit breaker address and reconfiguring the Assign circuit breaker addresses starting from address 1;
address Press three times to exit the state within 6 seconds
Press and hold for 3 seconds before releasing, and the green
Entering UDP distribution network state light will slowly flash; Press again three times and the red
light will flash slowly

2.4 Add circuit breaker address configuration to the gateway

The intelligent gateway can automatically configure the communication address of the connected
circuit breaker locally, and the gateway must also configure the circuit breaker information before
reporting it to MQTT. The specific operation steps are as follows:

1) The gateway is connected to a circuit breaker, and the power supply is 12Vd. c, which is normal;
2) Press the gateway button 3 times within 6 seconds for a new gateway (without configuring a circuit breaker
address), and the gateway red light will flash quickly to enter the address configuration state;
3) Set the blue dial code on the front of the first circuit breaker from automatic to manual position. The circuit
breaker's green light flashes, and the gateway's red light remains on for about 2 seconds. Continue flashing
quickly and successfully configure the address of this circuit breaker to 1;
4) Set the blue dial code on the front of the second circuit breaker from automatic to manual position. The circuit
breaker's green light flashes, and the gateway's red light remains on for about 2 seconds. Continue flashing
quickly and successfully configure the address of this circuit breaker to 2;
5) Repeat the above operation and configure the address of the newly added circuit breaker in sequence, with a
maximum configuration of 16 units;
6) After the configuration is completed, press the gateway button 3 times within 6 seconds, and the gateway red
light will turn on, indicating that the communication with the added circuit breaker is normal, and the circuit
breaker dial will be set back to the automatic position;
7) If you need to add another circuit breaker, you can press the button 3 times again to enter the configuration
status dial, and assign the address from the last ending address to continue. If you have already configured
address 1-5 circuit breakers for the first time, and configure them again for the second time, start from address
6;
8) To clear the configured address and reconfigure it, press and hold the button for 8 seconds. After the red light
changes to a fast flashing light, repeat steps 3-6 above and start configuring from address 1;
9) If the gateway red light does not stay on for 2 seconds during dialing configuration, and it keeps flashing fast, it
indicates that the address configuration has failed and the circuit breaker is abnormal. Please replace this
circuit breaker!

2.5 MQTT Cloud Data Transmission

2.5.1 MQTT server connection

—3—
 Z3GW 智能网关软件手册 V1.0

You can use our company's configuration tool to set the MQTT server domain name, username, password,
and port that you need to connect to. For detailed operations, please refer to 【 3.2 Configuration
Tool Instructions 】.

The deployment diagram of cloud and gateway is as follows:

Deployment diagram for cloud and gateway

Define two themes, one for reporting online device information, published by the lower computer
(gateway) and subscribed by the upper computer (cloud); A theme for writing devices, published by the
upper computer (cloud) and subscribed by the lower computer (gateway).

—4—
 Z3GW 智能网关软件手册 V1.0

The interaction diagram between the cloud and gateway for the content in each topic is shown below:

Interaction diagram between cloud and gateway

—5—
 Z3GW 智能网关软件手册 V1.0

It is recommended that the upper computer (cloud) parse the data of the gateway and slave devices as follows:

1) Obtain device information, wait for reporting or actively obtaining, obtain and store the number of gateway
slave devices, the number of gateway online slave devices, the ID numbers and device types of each device.
2) Analyze the actively reported data or issue relevant requests based on the ID number and device type.
3) The real-time performance of data transmission is not very strong, and in practical applications, the real-time
requirements for electrical parameter updates are also not high. The regular reporting period is 15 minutes. If
you expect faster or slower reporting, you can set the reporting period for the gateway. If you need to actively
obtain all electrical parameters, you can use the publication topic {"ReportAll": "*"}. For the opening and
closing functions of multiple circuit breakers with high real-time performance, the 0x015D-0x0160 register of
the gateway point table can be directly written and operated to achieve fast control. Please refer to the
intelligent gateway communication protocol in the appendix. If necessary, "GW_Request" and
"MRaw_Request" can be used to read and write all relevant parameters of the gateway and circuit breaker.

2.5.2 Actively reporting device information

Note: According to the 15min cycle, each circuit breaker uses a 4G flow rate of about 2M/month,
and connecting 10 circuit breakers uses about 20M/month.

Report type Reporting time Reporting Information Remarks

Periodic Gateway and all online circuit
0.1-2000min (default 15min)
reporting breaker information
Voltage and
1-1000% (default 30%) Circuit breaker information
current changes
Electricity
0.001-60kWh (default 20kWh) Circuit breaker information
change
Reporting of changes in
opening and closing
State change real time Circuit breaker information
status, manual and
automatic status
Alarm real time Alarm record information
fault real time Fault record information

2.5.3 Report Message Format

Submit subscription topic: hongfa/gateway ID number/upload/
Example: hongfa/FFFE200810095012/upload/(Please scan the front QR code for gateway ID)
Report type message format Remarks

—6—
 Z3GW 智能网关软件手册 V1.0

{"GWD_RAW_04": "* * *", "SD_RAW_04": "* * *"}

type Reporting scope Number of

reported
frames Report the ID number and
device type of the gateway
and circuit breaker, with a
GWD_RAW_04 Appendix [Intelligent Report one maximum of 16 slaves.
Report one slave device
Gateway Gateway Communication frame per information per frame, and
Information report one frame every 1
Protocol] Registers slave
second.
0x0000-0x0002 device For specific data
analysis, please refer to
[2.5.5 MQTT Message Data
SD_RAW_04 Appendix [Intelligent Analysis]
Gateway Communication
Protocol] Slave Device
Information in
Registers 0x0003-0x00C6

{"SSN": "*", "DataUp04": "* *", "TM": "* * *"}

'SSN' is the circuit breaker ID number;

TM "is the gateway time: year, year, day, hour, minute, second;

'DataUp04' refers to the reported content:

Actively report the
current and voltage status
Equipment type Reporting scope Number of
of the intelligent circuit
reported
breaker based on the device
frames
ID number, and upload 22
registers (44 bytes) at a
M-series 1P 【 M-series three
time. Due to the large
Circuit breaker series 1P/1PN/1PNL/2P
information amount of data, it needs to
communication
be uploaded in frames with
protocol 】 Registers
an interval of 1 second.
0x0000-0x003F
Refer to different data
point tables for device
M-series 3P Registers 0x0000-0x0091 five
type analysis.
series [M-series
3P/3PN/3PNL/4P
communication protocol]

C/CP series [C/CP Communication three

Protocol] Registers
0x0000-0x003F

—7—
 Z3GW 智能网关软件手册 V1.0

Note: Please refer to the official website of Hongfa Group for

the communication protocol of the above intelligent circuit
breaker https://www.hongfa.cn/Product/Item/UEZ3-63 Download
the document "UEZ3 Series Intelligent Small Circuit Breaker
Software Manual", and the protocol can be found in the appendix
of the document.

{"SSN": "*", "DataUp04": "* *", "TM": "* * *", "Type": "alarm"}

'SSN' is the circuit breaker ID number;

TM "is the gateway time: year, year, day, hour, minute, second;

'DataUp04' refers to the reported content:

type Reporting scope Number of

reported
frames Actively report the alarm
frame when an alarm occurs,
M-series 1P Registers 0x00F0-0x00F8 one including information such as
series [M-series voltage, current, temperature,

Alarm 1P/1PN/1PNL/2P and time during the alarm; For

communication protocol] specific data analysis,
please refer to [2.5.5 MQTT
M-series 3P Register 0x0150-0x015F one Message Data Analysis]
series [M-series
3P/3PN/3PNL/4P
communication protocol]

Note: Please refer to the official website of Hongfa Group for

the communication protocol of the above intelligent circuit
breaker https://www.hongfa.cn/Product/Item/UEZ3-63 Download
the document "UEZ3 Series Intelligent Small Circuit Breaker
Software Manual", and the protocol can be found in the appendix
of the document.

{"SSN": "*", "DataUp04": "* *", "TM": "* * *", "Type": "trip"}
Actively report the fault
frame when a fault occurs,
'SSN' is the circuit breaker ID number;
including information such
as voltage, current,
TM "is the gateway time: year, year, day, hour, minute, second; temperature, and time
fault during the fault; For
'DataUp04' refers to the reported content: specific data analysis,
please refer to [2.5.5 MQTT
Message Data Analysis]
type Reporting scope Number of
reported

—8—
 Z3GW 智能网关软件手册 V1.0

frames

M-series 1P 【 M-series one

series 1P/1PN/1PNL/2P
communication
protocol 】 Registers
0x0040-0x0048

M-series 3P 【 M-series one

series 3P/3PN/3PNL/4P
communication
protocol 】 Register
0x00A0-0x00AF

Note: Please refer to the official website of Hongfa Group for

the communication protocol of the above intelligent circuit
breaker https://www.hongfa.cn/Product/Item/UEZ3-63 Download
the document "UEZ3 Series Intelligent Small Circuit Breaker
Software Manual", and the protocol can be found in the appendix
of the document.

'GSN' is the gateway ID

number, and 'GW_Respond'
Gateway Request is the reply data. For
{"GSN": "*", "GW_Respond": "* * *"}
Reply specific data analysis,
please refer to [2.5.5 MQTT
Message Data Analysis]
'SSN' is the circuit
breaker ID number,
Circuit breaker MRaw Respond "is the reply
{"SSN": "*", "MRaw Response": "* * *"} data. For specific data
request reply
analysis, please refer to
[2.5.5 MQTT Message Data
Analysis]

2.5.4 Publish Request

Publish request subject: hongfa/gateway ID number/download/
Example: hongfa/FFFE200810095012/download/(Please scan the front QR code for gateway ID)
Request Type message format Remarks
According to the corresponding circuit
breaker ID number, read and write the
values of the relevant registers of the
intelligent circuit breaker. After
reading and writing, there is a response,
and a maximum of 22 registers (44 bytes)
Circuit breaker request {"SSN": "*", "MRaw Request": "* * *"} can be read and written at a time; Please
refer to [2.5.5 MQTT Message Data
Analysis] for the data frame format, and
refer to the corresponding protocol for
the data point table based on the device
type. Please go to the official website
of Hongfa Group for the communication

—9—
 Z3GW 智能网关软件手册 V1.0

protocol of intelligent circuit breakers

https://www.hongfa.cn/Product/Item/UEZ
3-63 The protocol for downloading the
document "UEZ3 Series Intelligent Small
Circuit Breaker Software Manual" can be
found in the appendix of this document.
Read or write gateway related registers,
such as reporting cycle, timing control,
and one key control, with a maximum of 22
registers (44 bytes) read and written at
Gateway Request {"GSN": "*", "GW_Request": "* * *"} a time; Please refer to [2.5.5 MQTT
Message Data Analysis] for data frame
format, and refer to Appendix
[Intelligent Gateway Communication
Protocol] for data point table
Online device information Actively obtain gateway and online device
{"GWD_SLAVE_ALL": "*"}
reporting request information, with any "*" content
The gateway immediately reports
All requests for reporting
{"ReportAll": "*"} information on all currently configured
device information
circuit breakers; Any content of '*'
The gateway will search for all
configured circuit breaker devices
Redirect device reporting again, report device information again
{"FindAllSales": "*"}
request after searching, and use it after
replacing the circuit breaker; Any
content of '*'
After replacing the gateway, search for
Replace gateway device
all circuit breaker devices and search
information reporting {"NEW_GATEWAY-FindAllSales": "*"}
for all devices from addresses 1-32; Any
request
content of '*'
Time calibration, sending this command
can simultaneously calibrate the time of
the gateway and circuit breaker; The
Time calibration {"SyncTime": "* * *"} content of '* * *' is' year, month, day,
hour, minute, and second '. For example,
if it is written as' 221214153005' at
15:30:05 on December 14, 2022

2.5.5 MQTT message data parsing

Note: All message data formats are in JSON format, hexadecimal. Please go to the official website
of Hongfa Group for the communication protocol of intelligent circuit breakers
https://www.hongfa.cn/Product/Item/UEZ3-63 Download the document "UEZ3 Series Intelligent Small
Circuit Breaker Software Manual". The intelligent gateway communication protocol can be found in the
appendix of this document [5.1 Intelligent Gateway Communication Protocol]

The data content of MQTT is a character based hexadecimal number, which is similar to the data
format of ModbusTCP and includes three parts: MBAP message header, function code, and data:

MBAP message
Function code data
header

The MBAP message header includes the following fields:

field length describe Client server

—10—
 Z3GW 智能网关软件手册 V1.0

CRC
2 Calculate from the third byte to
inspection hold hold
bytes the last byte
code

Start The starting register address of

2
register the data, prepared for active data hold hold
bytes
address upload

Initiated by
2 Initialized by server
length The number of bytes client
bytes (response)
(request)

The identification code of a remote The server replicates from

Unit Initialized by
1 byte slave station connected on a serial the received request (i.e.
identifier client
link or other bus the address of the slave)

The function code supports the function of 0x03/0x04/0x06/0x10, and the data format is consistent
with modbusTCP, as shown in the example below.

1) Actively reporting device data

Example message format: {"SSN": "1A2B22129200008", "DataUp04":

"F45B000002F03042C000000... 0021", "TM": "221229174230"};

SSN "represents the ID number of the circuit breaker 1A2B221229200008," TM "represents

17:42:30 on December 29, 2022

The data parsing for 'DataUp04' is as follows (the parsing methods for 'GWD_RAW_04'
and 'SD_RAW_04' are similar, first converting character hexadecimal to hexadecimal):

field byte example describe

CRC verification code 2 bytes F4 5B Calculate from the third byte to the last byte
Register Start Address 2 bytes 00 00 Report data starting from register 0x0000
Byte A (all subsequent
2 bytes 00 2F 47 bytes of subsequent data
bytes)
Gateway address is 255, circuit breaker address
Mailing Address 1 byte 03
1-247
Function code 1 byte 04 04 Read Function Code
Bytes B (all subsequent
1 byte 2C 44 bytes of data
bytes)
The starting register 0x0000 data is 0000
(according to the M-series 1PN device protocol,
Data 1 2 bytes 00 00 this register is in a protected state, so the
current state of the device is normal and there
is no fault alarm)
The data of register 0x0001 is 0000 (according to
the M-series 1PN device protocol, this register
Data 2 2 bytes 00 00
is in an alarm state, so the current state of the
device is normal and there are no alarms)
Registers 0x0002~0x0014 Register data
The data of register 0x0015 is 00 21 (in decimal
format, it is 33. According to the M-series 1PN
Data (Bytes B/2) 2 bytes 00 21
device protocol, this register is resolved as
temperature, so the device temperature is 33 ℃)

—11—
 Z3GW 智能网关软件手册 V1.0

2) Post Request Reply

Example of request message format:

{"SSN": "1A2B2212229200008", "MRaw-Request": "AA270010000602040010000A"}; 'SSN' is
the ID number of the circuit breaker that needs to be requested;
Example of reply message format: {"SSN": "1A2B2212229200008", "MRaw Response":
"7F76001000170204143FC000000 25843660000002143AC800041F4CCCD"};

A1. Use the 03/04 function code to read gateway or circuit breaker information (request:
"MRaw_Request" or "GW_Request" content)

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes AA 27
byte
Register Start Address 2 bytes 00 10
Bytes 2 bytes 00 06
Gateway address is 255, circuit breaker
Mailing Address 1 byte 02
address 1-247
Function code 1 byte 04 04 Read Function Code
Register Start Address 2 bytes 00 10 Reading starts from register 0x0010
Number of Registers 2 bytes 00 0A 10 registers

A2. Normal response reply (reply with the content of "MRaw_Respond" or "GW_Respond")

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes 7F 76
byte
Register Start Address 2 bytes 00 10
Byte A (all subsequent bytes) 2 bytes 00 17
Mailing Address 1 byte 02
Function code 1 byte 04
Bytes B (all subsequent
1 byte fourteen
bytes)
Registers 0x0010~0x0011 data, analyzed
according to the M-series 1PN protocol, the
Data 1~Data 2 2*2 bytes 3F C0 00 00 00
current value is a hexadecimal to floating
point number of 1.5A
0x0012 data, analyzed according to the
Data 3 2 bytes 02 58 M-series 1PN protocol, the leakage value is
600/100=6mA
0x0013~0x0014 data, analyzed according to
Data 4~Data 5 2 * 2 bytes 43 66 00 00 the M-series 1PN protocol, with a voltage of
230.0V as a floating point number
0x0015 data, analyzed according to the
Data 6 2 bytes 00 21 M-series 1PN protocol, with a temperature of
33 ℃
0x0016~0x0017 data, analyzed according to
Data 7~Data 8 2 * 2 bytes 43 AC 80 00 the M-series 1PN protocol, with a power of
345.0W as a floating point number
Data 9~Data 10 2 * 2 bytes 41 F4 CC CD 0x0018~0x0019 data, analyzed according to

—12—
 Z3GW 智能网关软件手册 V1.0

the M-series 1PN protocol, with a floating

point capacity of 30.6kWh

A3. Abnormal response response response (reply with the content of "MRaw_Respond" or "GW_Respond")

field byte example describe

CRC verification code 2 bytes 1A D4 Calculate from the third byte to the last byte
Register Start
2 bytes 00 10
Address
Bytes 2 bytes 00 03
Mailing Address 1 byte 02
Abnormal function 04 function code exception code, 03 function exception code
1 byte eighty-four
code is 83
01: Illegal function
Exception code 1 byte 01 02: Illegal data address
03: Illegal data value

B1. Use the 06 function code to modify the individual settings of the gateway or circuit breaker
(request: "MRaw_Request" or "GW_Request" content)

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes 92 13
byte
Register Address 2 bytes 01 D0
Bytes 2 bytes 00 06
Gateway address is 255, circuit breaker
Mailing Address 1 byte 01
address 1-247
Function code 1 byte 06
Register Address 2 bytes 01 D0 M-series 1PN device control register
Write data 00 01 and control the closing
Write data 2 bytes 00 01 according to the M-series 1PN protocol;
Write 00 04 control opening

B2. Normal response response (reply with the content of "MRaw_Respond" or "GW_Respond")

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes 92 13
byte
Register Start Address 2 bytes 01 D0
Bytes 2 bytes 00 06
Mailing Address 1 byte 01
Function code 1 byte 06
Register Address 2 bytes 01 D0
Write data 2 bytes 00 01

B3. Abnormal response reply (reply with the content of "MRaw_Respond" or "GW_Respond")

field byte example example

CRC verification code 2 bytes EA 74 Calculate from the third byte to the last

—13—
 Z3GW 智能网关软件手册 V1.0

byte
Register Address 2 bytes 01 D0
Bytes 2 bytes 00 03
Mailing Address 1 byte 01
Abnormal function code 1 byte eighty-six 06 Function Exception Code
01: Illegal function
Exception code 1 byte 01 02: Illegal data address
03: Illegal data value

C1. Use the 10 function code to modify the settings of multiple consecutive parameters for the
gateway or circuit breaker (request: "MRaw_Request" or "GW_Request" content)

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes BE DF
byte
Register Start Address 2 bytes 02 46
Byte A (all subsequent
2 bytes 00 0B
bytes)
Gateway address is 255, circuit breaker
Mailing Address 1 byte FF
address 1-247
Function code 1 byte ten
Register Start Address 2 bytes 02 46
Number of Registers 2 bytes 00 02 Continuously writing 2 registers
Bytes B (all subsequent
1 byte 04
bytes)
The data written in the starting register
0x0246, according to the gateway protocol,
Data 1 2 bytes 03 E8
is reported as electric energy change 1000
* 0.001=1 kWh
The data written in register 0x0247,
according to the gateway protocol, has a
Data 2 2 bytes 00 C8
write cycle reporting time of 200 *
0.1=20min

C2. Normal reply (reply to the content of "MRaw_Respond" or "GW_Respond")

field byte example describe

Calculate from the third byte to the last
CRC verification code 2 bytes 19 CE
byte
Register Start Address 2 bytes 02 46
Bytes 2 bytes 00 06
Mailing Address 1 byte FF
Function code 1 byte ten
Register Start Address 2 bytes 02 46
Number of Registers 2 bytes 00 02

C3. Exception response (reply with the content of "MRaw_Respond" or "GW_Respond")

field byte example describe

—14—
 Z3GW 智能网关软件手册 V1.0

Calculate from the third byte to the last

CRC verification code 2 bytes AB D2
byte
Register Start Address 2 bytes 02 46
Bytes 2 bytes 00 03
Mailing Address 1 byte FF
Abnormal function code 1 byte ninety
01: Illegal function
Exception code 1 byte 01 02: Illegal data address
03: Illegal data value

Note: Our company provides parsing APIs for the Java language. If necessary, please consult
technical personnel.

2.6 Modbus TCP data transmission

The gateway of wired Ethernet and WiFi supports standard ModbusTCP data transmission, and it needs
to be configured to ModbusTCP mode through the configuration tool. For specific usage, please refer
to 【 3.2 Configuration Tool Instructions 】.

2.6.1 Modbus TCP instruction message (standard format)

Format Content byte example describe
serial number 2 bytes 00 01
Protocol identification 2 bytes 00 00 TCP protocol identifier is 00 00
Bytes 2 bytes 00 06
Communication address, gateway address
Unit identifier 1 byte 01
255, device address 1-247
Function code 1 byte 03/04/06/10
Different function codes result in
PDU data ---- ----
different data frame structures

Example:

M-series 1PN control closing command: 00 00 00 00 00 06 01 06 01 D0 00 01

M-series 1PN control opening command: 00 01 00 00 00 06 01 06 01 D0 00 04

M series 3PN control closing command: 00 02 00 00 00 06 01 06 02 50 00 01

M-series 3PN control opening command: 00 03 00 00 00 06 01 06 02 50 00 04

2.6.2 Gateway AP hotspot modification configuration (only supported with W gateway)

Press and hold the gateway button for 3 seconds, the green light will change to a slow flashing
start AP hotspot, and the laptop will be connected to the name HongFa_ Xxxx's WIFI network, password:
56781234. After the connection is successful, open our company's configuration tool, select TCP mode,
IP: 192.168.4.1, port number: 8080, check the gateway version, and click "Connect successfully" to
read and modify the gateway related parameters as needed (gateway communication address 255). Please
refer to 【 3.2 Configuration Tool Instructions 】 for specific operations and configuration content.

—15—
 Z3GW 智能网关软件手册 V1.0

2.6.3 WIFI/Ethernet transparent communication

After the gateway successfully connects to the network, TCP communication can be connected based
on the gateway's IP address and port number, and circuit breaker information can be read. Please refer
to 2.6.1 for the TCP instruction format, and refer to the corresponding communication protocol for
the data point table based on the device type. You can also use our company's configuration tool to
select the corresponding device type and address after TCP connection, which can read the electrical
parameter information of the circuit breaker, control opening and closing, etc.

2.7 Modbus RTU data transmission (only supported with R/U gateway)
The gateway with uplink RS485/232 interface supports Modbus RTU serial port data type communication,
and can communicate with the gateway and connected circuit breakers through the serial port. And it
is compatible with WIFI/wired Ethernet/4G communication and can be used together (regardless of whether
it is connected to the network or not, serial communication can be normal). Please refer to the
communication protocol in the appendix for the data point table, and refer to the RTU mode in [3.2
Configuration Tool Instructions] for communication using our company's configuration tool software.

2.8 Timing control

The gateway contains 8 scheduled tasks, each of which can set time, cycle, control enable, and
control status. Settings can be modified by issuing instructions through gateway Modbus TCP or
connecting to MQTT. Please refer to Appendix [Intelligent Gateway Communication Protocol].

Example: Set Timer 1 (register address 0x0176-0x017B) every Monday to Friday at 16:30. The switches
with addresses 1, 3, 5, and 7 will automatically open, and the switches with addresses 2, 4, 6,
and 8 will automatically close.

Register Address Register Meaning Register Value analysis

three thousand and
0x0176 Minute hour 16:30
sixteen
Convert to binary (0000 0000 0001 1111)
0x0177 Cyclic cycle 001F
indicates a cycle from Monday to Friday
Convert to binary (0000 0000 000000 0000
Control switch
0x0178-0x0179 0000 00FF 1111 1111) to indicate address 1-8 circuit
enable
breaker opening control function
Convert to binary (0000 0000 000000 0000
1010 1010) to indicate that devices at
Control switch
0x017A-0x017B 0000 00AA addresses 1, 3, 5, and 7 are opened, and
status
devices at addresses 2, 4, 6, and 8 are
closed

2.9 One click control

By simultaneously writing control enable and control commands to the gateway register 0x015D-0x0160,
multiple devices can be controlled to open and close with one click. Settings can be modified by issuing
instructions through gateway Modbus TCP or connecting to MQTT. Please refer to Appendix [Intelligent
Gateway Communication Protocol].

—16—
 Z3GW 智能网关软件手册 V1.0

Example: One click control circuit breaker addresses 1, 2, 3, and 4 for device opening, and addresses
5, 6, 7, and 8 for device closing. Use the 10 function code to simultaneously write data to the
four registers of 0x015D-0x0160.

Register Address Register Meaning Register Value analysis

Convert to binary (0000 0000 000000 0000
0x015D-0x015E Control switch enable 0000 00FF 1111 1111) to indicate address 1-8 circuit
breaker opening control function
Convert to binary (0000 0000 0000 0000 0000
0000 1111 0000) to indicate that address 1,
0x015F-0x0160 Control switch status 0000 00F0
2, 3, and 4 devices are opened, and address
5, 6, 7, and 8 devices are closed

3. Instructions for use

3.1 Communication debugging tools

1) Laptops
2) MQTT computer software
3) Hongfa Configuration Tool Software

3.2 Instructions for using configuration tools

3.2.1 TCP mode (used in gateway AP hotspot mode)
1) Press and hold the button for 3 seconds at the gateway, and the green light will slowly flash;
2) Laptop connected to WIFI account: HongFa_ XXXX, password: 56781234;
3) Open the configuration tool, select TCP in Modbus mode, IP: 192.168.4.1, port number: 8080, check the
gateway version, click Connect, and once the connection is successful, proceed with the configuration
operation.
4) After the configuration is completed, click to disconnect, and then press and hold the gateway button for 3
seconds. The green light will change to a fast flash to exit the hotspot mode, and wait for the green light to
remain on to automatically connect to the network.

—17—
 Z3GW 智能网关软件手册 V1.0

functional
Include features Remarks
module
Display the number of circuit
[Slave Device Information]: Number of Slave Devices, breakers configured and connected to
Monitoring Number of Slave Devices Online, Number of the current gateway, and the online
Successfully Configured Devices number refers to the number of circuit
breakers reported by MQTT normally
[Factory Parameters]: Gateway Type, Gateway ID,
Monitoring
Gateway Time, Gateway Version, Factory Time
[4G parameters]: 4G module self check, 4G signal The relevant parameters can only be
Monitoring strength, operator, 4G network type, SIM card status, read after the 4G gateway card is
IM card ICCID number, IMEI number, 4G network status inserted and connected to the network
The WIFI username and password only
need to be configured for the WIFI
gateway type; MQTT related settings
Cloud mode parameter settings: WIFI username, WIFI only need to be set in cloud mode;
Setting password, MQTT domain name, username, password, MQTT Enter data in the input box, click
port number, data format, login method [Write], wait for the prompt to
succeed, and then write the next
parameter. Only one parameter can be
modified at a time.
Set the gateway reporting conditions.
If the current reporting switch is
turned on, messages will be reported
based on the set rate of change. If it
【 Reporting parameters 】: Voltage and current
is turned off, changes in current and
Setting change rate, current reporting switch, electrical
voltage data will not be reported;
energy reporting change, data cycle reporting
Position the mouse in the display box
that needs to be modified, click
[Single item write], and wait for the
prompt to be successful.
Enter the 2-digit year, month, day,
hour, minute, and second in the input
box, click on [Set Device Time] to
【 Time Setting 】: Set device time and
Setting modify the gateway system time, or
synchronization device time
directly click on [Synchronize Device
Time] to write the computer system
time into the gateway
[485 communication mode] must be
[Communication parameters]: communication address, selected as normal, [TCP
baud rate, stop bit, verification, IP allocation communication mode] cloud mode is
method (manual/automatic), 485 communication mode MQTT, and ordinary Ethernet mode is
(normal/configured), MAC address, IP address, subnet MODBUS TCP mode; The gray box can only
Setting
mask, gateway address, DNS address, gateway type, be read and cannot be modified;
communication port, TCP communication mode (cloud Position the mouse in the display box
mode/regular Ethernet), uplink (baud rate, stop bit, that needs to be modified, click
verification), software version [Single item write], and wait for the
prompt to be successful.
Check the address of the device that
needs to be controlled in the box,
click the corresponding button to
select the opening and closing action
(on represents closing, OFF
represents opening), and after
【 Group control function 】: Group control settings,
Setting setting it, click 【 One click
group control intervals
control 】 to corresponding control
the device action; The group control
interval is the action interval of
each device, which is 500ms by
default. It is recommended to set it
no less than 300ms.

—18—
 Z3GW 智能网关软件手册 V1.0

Pull down and select the timer 1-8

that needs to be set. After setting
【 Timing function 】: 8 timing controllers,
the time, checking the cycle, and
Setting including time setting, cycle setting, and group
setting the group control, click [One
control setting
click to write parameters] to save the
current timer settings

5) If you need to control the circuit breaker through hotspot mode, uncheck the gateway version and click
Connect; After successful connection, select the corresponding device from the dropdown device type, enter
the device address, and the interface will automatically switch to the circuit breaker function for operation

3.2.2 RTU mode (only supported with R/U gateway)

Use the USB to RS485/232 serial port tool to connect the gateway to the communication interface,
open the configuration tool, select the RTU mode in Modbus mode, serial port number (click the [Refresh]
button to update the current serial port connected to the computer, drop-down selection), baud rate
(default 9600, drop-down selection), and click to connect; After successful connection, select Gateway
from the 'Device Type' dropdown, enter the address 255, and select 'No Verification' by default for
the 'Verification Method' to operate on the gateway related configuration (the function is completely
the same as the TCP mode, see 3.2.1 for details). You can also operate the devices connected under
the gateway through this method. Select the corresponding device type and enter the corresponding
communication address for the address.

—19—
 Z3GW 智能网关软件手册 V1.0

3.3 Communication debugging steps

3.3.1 WIFI communication
1) Configure device address: Connect the gateway to the circuit breaker 12Vd. c and power it on. Within 6
seconds, press the gateway button three times continuously. After the red light flashes quickly to enter the
address configuration state, dial the circuit breaker in sequence. After the address configuration is completed,
press the button three times continuously. A constant red light indicates successful configuration. For specific
operations, please refer to 【 2.4 Gateway Add Circuit Breaker Address Configuration 】
2) Distribution network and parameter configuration: Press and hold the gateway button for 3 seconds, the green
light will slowly flash, and enter hotspot mode. The laptop will be connected to WIFI with the name: HongFa_
Xxxx, password: 56781234, open our company's configuration tool software, select TCP mode, IP: 192.168.4.1,
port number: 8080, check the gateway version, and after successful connection, you can read, confirm, and
configure the gateway parameters as needed. For specific operations, please refer to 【 3.2 Configuration
Tool Instructions 】

function Parameters need to be configured Remarks

Distribution [Cloud Mode Parameter Settings]: Enter the WIFI Does not support connecting to 5G
network username and password to connect to networks
Cloud mode parameter settings: MQTT domain name,
username, password, MQTT port number; Cloud mode (MQTT) and regular
Ethernet mode (Modbus TCP) can only
MQTT 【 Communication parameters 】: 485 communication be used in either mode and cannot be
mode (normal), gateway type (WIFI), TCP used simultaneously
communication mode (cloud mode)
Using the automatic address
[Communication parameters]: IP allocation method allocation method, the gateway
(manual/automatic), 485 communication mode needs to successfully connect to
(normal), MAC address, IP address, subnet mask, the network first, and then enter
Modbus TCP
gateway address, DNS address, gateway type (WIFI), the AP hotspot to read the correct
communication port, TCP communication mode (normal IP address; If manual (static)
Ethernet) address allocation is used, the set
gateway IP address is used.

3) After configuring all parameters, press and hold the button for 3 seconds, and the green light will flash quickly.
Waiting for the green light to remain on indicates successful network connection.

—20—
 Z3GW 智能网关软件手册 V1.0

4) MQTT cloud operation:

A． Open the MQTT tool on the computer;

B． Log in to the server with the same address, port number, username, and password as the server
set by the gateway;
C． After successful connection, the subscription gateway reports a message with the subscription
topic: hongfa/gateway ID number/upload/;
D． Post message topic: hongfa/gateway ID number/download/;
E． Please refer to 【 2.5MQTT Cloud Data Transmission 】 for the specific format and resolution
of message reporting and distribution.

5) Modbus TCP operation:

A． Follow steps 1-3 above to configure the gateway parameters and connect to the network normally;
B． Use the IP address, port number, and other information obtained from the gateway to connect
to the upper TCP debugging tool for communication (or use our company's configuration tool).
C． The TCP instruction is in the standard Modbus TCP format, which can be referred to in [2.6.1
Modbus TCP Instruction Message (Standard Format)]. Please refer to the communication protocol
for the data point table according to the device type.

3.3.2 Ethernet communication connection

Insert the RJ45 network port of the gateway into the network cable and connect it to the router.
Follow steps 1-5 of [3.3.1] above (no network configuration is required in step 2, select RJ45 Ethernet
for [gateway type], and other operations are the same).

3.3.3 4G communication
Insert a valid 4G card correctly according to the printing direction on the side of the gateway,
and follow steps 1-4 of [3.3.1] above. (In step 2, there is no need for network distribution, select
4G for [Gateway Type], other operations are the same).

3.3.4 Uplink RS485/232 communication

When the gateway 【 485 mode 】 is set to normal mode, local communication with the gateway and
the connected circuit breaker can be achieved through the uplink serial port (regardless of whether
the gateway is connected to the network or not). You can use any serial communication tool software,
with a default baud rate of 9600, no verification, data bit 8, and stop bit 1. You can also use our
company's configuration tool software [Modbus Mode] to select the RTU mode. For specific operations,
please refer to [3.2 Configuration Tool Instructions].

4. Common faults and handling

1) WIFI cannot connect to the network and keeps flashing green: confirm that the written WIFI username and
password are correct. If it is in MQTT mode, it is also necessary to confirm whether the relevant settings of the
MQTT server are correct; And does not support 5G network connection.
2) The gateway is connected to the network. How to obtain the gateway IP address: After connecting to the
network, long press the button for 3 seconds and the green light slowly flashes to enter the AP hotspot mode.

—21—
 Z3GW 智能网关软件手册 V1.0

Use our company's configuration tool to read the gateway IP information, confirm, and then long press the
button to exit the hotspot mode and automatically connect to the network.
3) The 4G card has been inserted but the green light is not always on: if the gateway green light is always on for 2
seconds and then flashes quickly, it indicates that the card is not recognized. Confirm whether the direction of
the 4G card insertion is consistent with the side label; If the green light keeps flashing rapidly, confirm whether
the MQTT server that needs to be connected is running normally and whether the 4G card is down and in
arrears.
4) The green light of the gateway is always on, but there is no reporting information on MQTT: confirm whether
the gateway has configured a circuit breaker address, and there is no reporting if the address has not been
configured;
5) Gateway red light flashing slowly: The gateway has not been configured with a circuit breaker address, or the
configured circuit breaker is disconnected and has abnormal communication. Please check the wiring.
6) How to obtain the ID number of the circuit breaker connected under the gateway through MQTT: MQTT cloud
mode, based on the reported information, the content of the "SSN" can be obtained as the ID number.
7) MQTT sends control messages without reply: confirm whether the SN number and communication address in
the instruction correspond correctly; If there is no response, confirm whether the circuit breaker dial switch is
in the "automatic" position. The instruction format is standard JSON format, and the symbols must be in
English!
8) MQTT continuous message loss: Each message should be distributed at least 1 second apart, and multiple
messages cannot be distributed at the same time.

—22—
 Z3GW 智能网关软件手册 V1.0

5. appendix

5.1 Intelligent Gateway Communication Protocol

Communication Variable Point Table
Function
address Meaning of variables data type Convert Format unit
code

Equipment type

21: WiFi version gateway

0x0000 Gateway device type unsigned int 0x04 22: Ethernet RJ45 gateway /
23: 4G gateway
Number of gateway slave
0x0001 devices (total number of unsigned int 0x04 Range 0-16 /
configured devices)
The number of online slave
devices in the gateway (the
total number of online
devices polled for the first
power on, and the subsequent
offline slave devices are
0x0002 indicated by communication unsigned int 0x04 Range 0-16 /
fault bits to re poll the
number of online slave
devices: 1. Power off, 2.
Press the gateway button 6
times, 3. The upper computer
sends instructions)
The highest byte is FF, the
0x0003-0x00 Device ID number of the second byte is a random
unsigned int 0x04 /
06 gateway (8 bytes) number, and the others are the
factory time
Circuit breaker equipment
type:
1: 1P-M series
2: 1PN M Series
3: 1PNL - M series
4: 3P-M series
5: 3PN M Series
6: 3PNL - M series
First slave circuit breaker 8: CP C series
0x0007 unsigned int 0x04 /
type
10: C-C series
12: 2P-M series
16: 4P - M series
13: UEM5Z1-3PN (Electronic
Plastic Shell)
14: UEM5Z1-4P (Electronic
Plastic Shell)
15: UEM5Z1-3P (Electronic
Plastic Shell)
Address of the first slave
0x0008 unsigned int 0x04 1-247 /
circuit breaker
0x0009-0x00 The ID number of the first
unsigned int 0x04 /
0C slave circuit breaker

—23—
 Z3GW 智能网关软件手册 V1.0

The second slave circuit

0x000D-0x00 breaker information, in the Second slave device
unsigned int 0x04 /
12 same format as information
(0x0007-0x000C)
(0x0007+(i- The i-th slave circuit
1) * 6) - breaker information (i The i-th slave device
unsigned int 0x04 /
(0x000C+(i- range 3-31), in the same information
1) * 6) format as (0x0007-0x000C)
The 16th slave circuit
0x0061-0x00 breaker information, in the
unsigned int 0x04 16th slave device information /
66 same format as
(0x0007-0x000C)
0: disconnected, 1:
connected, 2: connected
0x00C7 Current network status unsigned int 0x04 /
successfully, 3: hotspot
mode, 4: 4G card not inserted
4G module self test results
(4G card must be inserted,
and self test must be 0: Self test failed, 1: Self
0x00C8 unsigned int 0x04 /
performed every time the test successful
power is turned off and
powered on)
4G signal strength
(obtained during operation,
others obtained during
0x00C9 registration, maximum value unsigned int 0x04 0-100% /
obtained during
registration, and later
obtained periodically)
0x00CA-0x00 Operator (supported only Character
0x04 Character length 20 /
D3 for 4G gateways) type

0 GSM
2 UTRAN
3 GSM W/EGPRS
Network type (supported Character
0x00D4 0x04 4 UTRAN W/HSDPA /
only for 4G gateways) type
5 UTRAN W/HSUPA
6 UTRAN W/HSDPA
and HSUPA
7 E-UTRAN

0 Not
registered ME
is not
currently
searching a
new operator
to register to
Network status (supported Character 1 Registered,
0x00D5 0x04 /
only for 4G gateways) type home network
2 Not
registered,
but MT is
currently
trying to
attach or
search an

—24—
 Z3GW 智能网关软件手册 V1.0

operator to
register to
3 Registration
denied
4 Unknown
5 Registered,
Roaming
Maximum character length 20
0x00D6-0x00 SIM card status (supported Character
0x04 The meaning can be found in /
DF only for 4G gateways) type
Note 1
SIM card ICCID number
0x00E0-0x00 Character
(supported only for 4G 0x04 Maximum character length 50 /
F8 type
gateways)
IMEI number (mobile device
0x00F9-0x01 number) Character
0x04 Maximum character length 30 /
07 (Supported only for 4G type
gateways)

System parameter area

Gateway time (minutes (low

0x03/0x06/0
0x0150 bytes), seconds (high unsigned int BCD code format /
x10
bytes))
Gateway time (day (low 0x03/0x06/0
0x0151 unsigned int BCD code format /
byte), hour (high byte)) x10
Gateway time (year (low 0x03/0x06/0
0x0152 unsigned int BCD code format /
byte), month (high byte)) x10
1: 9600 (default to 1)
Downlink Baud Rate (default 0x03/0x06/0
0x0158 unsigned int 2 /
9600) x10
:14400 3:19200
0x03/0x06/0 0:1 bit stop bit 1:2 bit stop
Bit0 Stop bit /
x10 bit
0x0159 unsigned int
Reserved / / / /

21: WiFi version gateway

0x03/0x06/0
0x015B Gateway Type unsigned int 22: Ethernet RJ45 gateway /
x10
23: 4G gateway
The total number of sub
devices successfully
configured (written to the
0x03/0x06/0
0x015C new gateway after replacing unsigned int Range 0-16 /
x10
the gateway, and the device
needs to be searched again
after writing)
Bit0: Address 1
Bit1: Address 2
Control command inhibit and
enable (group control Bit2: Address 3
online device command, does Unsigned
0x015D-0x01
not support 06 function 32-bit 0x03/0x10 Bit31: Address 32 /
5E
code, must simultaneously integer
control variables of 0: Prohibit control, do not
0x015D-0x0160) participate in group control
1: Enable control and
participate in group control

0x015F-0x01 control command Unsigned 0x03/0x10 Bit0: Control address 1 /

—25—
 Z3GW 智能网关软件手册 V1.0

60 32-bit Bit1: Control address 2

integer
Bit31: Control address 32
0: Opening, 1: Closing
Range 100-10000ms (default
500ms)
It is recommended to connect 8
30W power supplies with an
0x03/0x06/0 interval of 500ms. If the
0x0161 Group control time interval unsigned int /
x10 interval becomes smaller, it
is necessary to increase the
power supply. Group control
only supports small circuit
breakers
1: 9600 (default to 1)
2
0x03/0x06/0
0x0162 Up RS485 baud rate unsigned int :14400 3:19200 /
x10
4: 38400 5:57600
6: 115200
Bit0 Reserved Reserved
0x03/0x06/0
0x0163 unsigned int 0: No parity 1: Odd parity 2: /
Bit1-2 Parity bit x10
Even parity, default 0
Timing control
Minute hour
selection
BCD code format (timing only
(high byte Unsigned 16 0x03/0x06/0
0x0176 supports small circuit /
for minutes, bit integer x10
breakers)
low byte for
hours)
Y (0-0x7F, default 0),
Bit0: Every Monday
Bit1: Every Tuesday
Bit2: Every Wednesday
Bit3: Every Thursday
Bit4: Every Friday
Single cycle Unsigned 16 0x03/0x06/0 Bit5: Every Saturday
0x0177 /
selection bit integer x10 Bit6: Every Sunday
0 indicates a single
Timing occurrence, Bit0-6 non 0
control 1 indicates a weekly cycle, and
a single occurrence indicates
that the control is no longer
repeated after controlling
once
Bit0: Address 1
Bit1: Address 2
Enable Bit2: Address 3
Unsigned
0x0178-0x01 switch 0x03/0x06/0
32-bit /
79 address for x10
integer
control Bit31: Address 32
0: Prohibit control 1: Enable
control

Unsigned Bit0: Control address 1

0x017A-0x01 State of 0x03/0x06/0
32-bit Bit1: Control address 2 /
7B control x10
integer

—26—
 Z3GW 智能网关软件手册 V1.0

Bit31: Control address 32

0: Opening, 1: Closing
Unsigned 16 0x03/0x06/0
0x017C Reserved /
bit integer x10
Timing control 2
0x017D-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
83 bit integer x10
timer 1)
Timing control 3
0x0184-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
8A bit integer x10
timer 1)
Timing control 4
0x018B-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
91 bit integer x10
timer 1)
Timing control 5
0x0192-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
98 bit integer x10
timer 1)
Timing control 6
0x0199-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
9F bit integer x10
timer 1)
Timing control 7
0x01A0-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
A6 bit integer x10
timer 1)
Timing control 8
0x01A7-0x01 Unsigned 16 0x03/0x06/0
(parameters are the same as /
AD bit integer x10
timer 1)
Factory parameter area
Y/10 (e.g. 235 represents
0x01D1 Software version number unsigned int 0x03 /
2.3.5)
Ethernet parameter area
IP allocation method Unsigned 0x03/0x06/0
0x0230 0: Manual, 1: Automatic (DHCP) /
(default 1) shaping x10
MAC address byte 1 (high
Unsigned Byte 1 (high byte), Byte 2 (low
0x0231 byte), MAC address byte 2 0x03 /
shaping byte)
(low byte)

MAC address byte 3 (high

Unsigned Byte 3 (high byte), Byte 4 (low
0x0232 byte), MAC address byte 4 0x03 /
shaping byte)
(low byte)

Byte 5 (high byte), Byte 6 (low

MAC address byte 5 (high byte)
Unsigned
0x0233 byte), MAC address byte 6 0x03 /
shaping The MAC address is bytes
(low byte)
1,2,3,4,5,6 from left to right
Ethernet IP address setting
Unsigned 0x03/0x06/0 Byte 1 (high byte), Byte 2 (low
0x0234 byte 1 (high byte), byte 2 /
shaping x10 byte)
(low byte)
Byte 3 (high byte), Byte 4 (low
Ethernet IP address setting byte)
Unsigned 0x03/0x06/0
0x0235 byte 3 (high byte), byte 4 /
shaping x10 IP addresses from left to
(low byte)
right are bytes 1,2,3,4
Unsigned 0x03/0x06/0
0x0236 Communication port number Default 502 (Modbus TCP) /
shaping x10

Ethernet subnet mask Unsigned 0x03/0x06/0 Byte 1 (high byte), Byte 2 (low
0x0237 /
address setting byte 1 (high shaping x10 byte)

—27—
 Z3GW 智能网关软件手册 V1.0

byte), byte 2 (low byte)

Byte 3 (high byte), Byte 4 (low
Ethernet subnet mask byte)
Unsigned 0x03/0x06/0
0x0238 address setting byte 3 (high /
shaping x10 The address is bytes 1,2,3,4
byte), byte 4 (low byte)
from left to right
Ethernet gateway address
Unsigned 0x03/0x06/0 Byte 1 (high byte), Byte 2 (low
0x0239 setting byte 1 (high byte), /
shaping x10 byte)
byte 2 (low byte)
Byte 3 (high byte), Byte 4 (low
Ethernet gateway address byte)
Unsigned 0x03/0x06/0
0x023A setting byte 3 (high byte), /
shaping x10 The address is bytes 1,2,3,4
byte 4 (low byte)
from left to right
Ethernet Modbus host
settings byte 1 (high byte), Unsigned 0x03/0x06/0 Byte 1 (high byte), Byte 2 (low
0x023B /
byte 2 (low byte) (DNS shaping x10 byte)
address, for MQTT protocol)

Ethernet Modbus host Byte 3 (high byte), Byte 4 (low

settings byte 3 (high byte), Unsigned 0x03/0x06/0 byte)
0x023C /
byte 4 (low byte) (DNS shaping x10 The address is bytes 1,2,3,4
address, for MQTT protocol) from left to right
0: Cloud mode (MQTT), 1:
TCP communication mode Unsigned 0x03/0x06/0 Normal Ethernet mode (Modbus
0x023D /
(default 1) shaping x10 TCP, 4G does not support this
mode)
Rate of change on and off 0: Turn off rate of change
Unsigned 0x03/0x06/0
0x023E (changes in registers judgment 1: Turn on rate of /
shaping x10
0x241-0x246) change judgment
Y (0: Normal mode, 1:
Configuration mode) - For the
485 communication mode Unsigned 0x03/0x06/0 host, the configuration mode
0x023F /
(default 0) shaping x10 is similar to the slave mode
and allows for free
configuration of information.
Y (0: indicates shutdown,
1-65535s)
Unsigned 0x03/0x06/0 The default is 180s. If no data
0x0240 Failed reconnect timeout is received within 180s, the /
shaping x10
communication will be
reinitialized, which is valid
for Modbus TCP
Voltage and current
reporting rate of change Unsigned 0x03/0x06/0
0x0241 (1-1000)% Default 30% /
(only supported for shaping x10
M-series circuit breakers)
Electric energy reporting (1-60000) * 0.001kWh
Unsigned 0x03/0x06/0
0x0246 changes (only supported for /
shaping x10 Default 20000 (i.e. 20kWh)
M-series circuit breakers)

Data cycle reporting Unsigned 0x03/0x06/0 (1-20000) * 0.1min

0x0247 /
(supported by all devices) shaping x10 Default 150 (i.e. 15 minutes)
0x0248-0x02 Character
WIFI username 0x03/0x10 Maximum character length 30 /
56 type
0x0257-0x02 Character
WIFI password 0x03/0x10 Maximum character length 30 /
65 type
0x0266-0x02 MQTT domain name (or IP Character
0x03/0x10 Maximum character length 80 /
8D address) type

—28—
 Z3GW 智能网关软件手册 V1.0

0x028E-0x2A Character
user name 0x03/0x10 Maximum character length 60 /
B type
0x02AC-0x02 Character
password 0x03/0x10 Maximum character length 60 /
C9 type
Unsigned
0x02CA MQTT port number 0x03/0x10 /
shaping
Version 3 (for 3.1.0)
Or 4 (default to 4 for 3.1.0),
Unsigned Gateway settings for 4G mode
0x02D1 MQTT protocol version 0x03/0x10 /
shaping and wired Ethernet
If the MQTT server version is
5, it must be 4 here

—29—