Fronius GEN24 - Modbus TCP and RTU

The description of the protocol is largely taken from the Modbus specifications, which are publicly available at www.modbus.org/specs.php.

Modbus is a simple, open communication protocol, with which master-slave or client-server communication can be carried out between the devices connected to the network. The basic principle of Modbus is: a master sends a request and a slave responds to this. In Modbus TCP, the master is referred to as the client and a slave as a server. The function is the same. The descriptions of the protocol functions provided below will use the more common names master and slave, irrespective of the RTU and TCP variants. In cases where there are differences between RTU and TCP, this will be specifically indicated.

In the case of Modbus RTU, there can only ever be one master in the system. In principle, only one master may initiate requests. A slave may only give a response if it has been addressed by the master; the slaves cannot communicate with each other. If a broadcast request (request to all available slaves via slave ID or unit ID 0) is sent, none of the slaves can respond. Broadcasts can therefore only be used for write commands.

Modbus devices provide data in 16 bit large data blocks (registers).
In certain cases, individual data points may also cover several data blocks (e.g., 2 registers = 32 bit value).

The description of the protocol is largely taken from the Modbus specifications, which are publicly available at www.modbus.org/specs.php.

Modbus is a simple, open communication protocol, with which master-slave or client-server communication can be carried out between the devices connected to the network. The basic principle of Modbus is: a master sends a request and a slave responds to this. In Modbus TCP, the master is referred to as the client and a slave as a server. The function is the same. The descriptions of the protocol functions provided below will use the more common names master and slave, irrespective of the RTU and TCP variants. In cases where there are differences between RTU and TCP, this will be specifically indicated.

In the case of Modbus RTU, there can only ever be one master in the system. In principle, only one master may initiate requests. A slave may only give a response if it has been addressed by the master; the slaves cannot communicate with each other. If a broadcast request (request to all available slaves via slave ID or unit ID 0) is sent, none of the slaves can respond. Broadcasts can therefore only be used for write commands.

Modbus devices provide data in 16 bit large data blocks (registers).
In certain cases, individual data points may also cover several data blocks (e.g., 2 registers = 32 bit value).

In principle, a Modbus message is made up of the protocol data unit (PDU). This is independent of the underlying communication layers.
Depending on the bus or network that is used, additional fields can also be added. This structure is then referred to as the application data unit (ADU).

Modbus TCP uses its own header to identify the application data unit. This header is called MBAP header (MODBUS application protocol header).

If an error occurs on the slave during the processing of a request, an error message is sent as the response (exception response). In the event of this kind of response, the most significant bit of the function code is set to 1 (corresponds to adding 0x80 to the function code) ¹⁾ and an exception code is added, which indicates the reason for the error.

¹⁾ The prefix "0x" stands for hexadecimal numbers.

This function code is used to read the content of one or more successive registers of a device. The request contains the address of the first register to be read and the number of registers to be read. Registers are addressed in the request starting at 0. This means that registers 1 to 16 will be addressed via addresses 0 to 15.

This function code is used in order to write a single register. The request only contains the address of the register to be written. Registers are addressed starting at 0. This means that register 1 is addressed via address 0. The normal response is a copy of the request, which is sent after successfully writing the register.

This function code is used in order to write a block of successive registers. The request contains the address of the first register to be written, the number of registers to be written, the number of bytes to be written, and the values to be written (2 bytes per register). The normal response contains the function code, the start address, and the number of registers written.

Each Modbus RTU message is equipped with a checksum (CRC, Cyclic Redundancy Check) in order to be able to identify transmission errors. The size of the checksum is 2 bytes. It is calculated by the sending device and attached to the message to be sent. For its part, the receiver calculates the checksum from all bytes of the received message (without CRC) and compares this with the received checksum. If these two checksums are different, then an error has occurred.

The calculation of the checksum starts with setting all bits of a 16 bit register (CRC register) to 1 (0xFFFF). All bytes of the message are then individually processed with the CRC register. Only the data bytes of one message are used for the calculation. Start, stop, and parity bits are not considered.

During the calculation of the CRC, each byte is XOR-linked with the CRC register. The result is then moved in the direction of the least significant bit (LSB) and the most significant bit (MSB) is set to 0. The LSB is considered. If the LSB was previously 1, then the CRC register is XOR-linked with a fixed assigned value. If the LSB was 0, then nothing needs to be done.

This process is repeated until the CRC register has been moved eight times. After the last (eighth) movement, the next byte is taken and XOR-linked to the current CRC register. The write process then starts from the beginning; it is again moved eight times. After dealing with all bytes of the message, the value of the CRC register is the checksum.

Calculation algorithm of the CRC16

If the 16 bit (2 bytes) CRC checksum is sent with a message, then the less significant byte is transferred before the more significant one.

The register lists can be downloaded from the Fronius website:

https://www.fronius.com/de/downloads / Solar Energy / Modbus Sunspec Maps, State Codes and Events

Recommendation for timeout values
Modbus requests should only be executed sequentially and not in parallel (maximum 2 queries in parallel). Perform the requests with a timeout of at least 1 second. Requests in millisecond intervals can lead to long response times.
Multiple register requests in one message are faster than multiple requests of individual registers.

TCP: The unit-id of the inverter is always 0x01. Identification is possible by the IP address.

RTU: The slave-id must be configured on the web interface of the GEN24. Several GEN24 devices can be connected together. Each device must have a unique number.

If an energy meter (e.g., Fronius Smart Meter 63A) is connected via Modbus RTU, it can be read out via the settable Modbus device ID using Modbus TCP.

IMPORTANT!

Correct procedure:

To read a register, the register's start address must be specified in the Modbus request.

SunSpec Basic Register: 40001

Registers begin at 1 and do not represent a function code.

Do not confuse the registers with the Modicon address scheme:
in the Modicon address scheme, 40001 is displayed as 4x40001.
To read register 40001, use address 40000 (0x9C40).

The register address that is output therefore always has 1 number less than the actual register number.

Examples for Modbus RTU:

Examples for Modbus TCP:

¹⁾ The prefix "0x" stands for hexadecimal numbers.

The EEI sign convention¹⁾ for the power factor is in line with the SunSpec specification and is based on the information contained in the "Handbook for Electricity Metering" and IEC 61557-12 (2007).

¹⁾ EEI = Edison Electrical Institute

IMPORTANT! Scale factors (also possible when selecting "Float"!) are not static, even if they are entered as a fixed value in these Operating Instructions.
Scale factors can change every time the firmware is changed and also change with the runtime (auto-scale) (e.g., scale factor for power specification).

Scale factors with constant values are listed in the tables in the column "Range of values".
Current data (data of inverters and energy meters) may have variable scale factors. These must be read from the corresponding registers.

The data type "sunssf" is a signed integer with 16 bits.
Example calculation:
(Model 160): 1_DCW = 10000, DCW_SF = -1 -> Power = 10000 x 10^(-1) = 1000 W

Some registers only permit certain values. The valid values can be found in the relevant register table.
If an invalid value is entered into a register, the inverter control will return exception code 3 (illegal data value). The invalid value is ignored.

From your web browser, you can use the inverter web interface to apply the Modbus connection settings which cannot be accessed via the Modbus protocol.

From your web browser, you can use the inverter web interface to apply the Modbus connection settings which cannot be accessed via the Modbus protocol.

The inverter communicates with system components (e.g., Fronius Smart Meter) and other inverters via Modbus. The primary device (Modbus Client) sends control commands to the secondary device (Modbus Server). The control commands are executed by the secondary device.

RTU Server
The following input fields and functions are available for communication via Modbus RTU:

TCP Server
The following input fields and functions are available for communication via Modbus TCP:

The "Limit Control" option is only available for the TCP transmission protocols.
It is used to block inverter control commands from unauthorized users by only permitting control for specific devices.

Limit Control
If this option is activated, only certain devices will be able to send control commands.

IP address
To limit inverter control to one or more devices, enter the IP addresses of the devices which are permitted to send commands to the inverter in this field. Multiple entries are separated by commas.

The description of the Common Block including the SID register (register 40001–40002) for identification as a SunSpec device applies for each device type (inverter, energy meter). Each device has its own Common Block, which lists information about the device (model, serial number, SW version, etc.).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

The description of the Common Block including the SID register (register 40001–40002) for identification as a SunSpec device applies for each device type (inverter, energy meter). Each device has its own Common Block, which lists information about the device (model, serial number, SW version, etc.).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

The register number of the two model types is different!

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

VRef (4)
The reference voltage is the voltage at the joint connection point where the local grid is connected to the public grid. The reference voltage is the same as the inverter's nominal voltage.
=> See figure "Joint Connection Point."

The value is given in volts in the range of 0 (0x0000) to 400 (0x0190).

Joint Connection Point

VRefOfs (5)
Depending on the wiring of the local grid, there may be a deviation from the reference voltage at the point where each individual inverter is connected to the local grid (see "Joint connection point" diagram).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

In the settings on the inverter's web interface, the setting "Inverter control via Modbus" must be enabled under Modbus for write functions to be possible. Depending on the control priority that has been set (IO control, dynamic power reduction, or control via Modbus), Modbus commands may not be accepted.

In the settings on the inverter's web interface, the setting "Inverter control via Modbus" must be enabled under Modbus for write functions to be possible. Depending on the control priority that has been set (IO control, dynamic power reduction, or control via Modbus), Modbus commands may not be accepted.

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

Conn_WinTms (3) to Conn (5)
These registers are used to control the standby mode (no grid power feed operation) of the inverter.

Conn_WinTms (3) and Conn_RvrtTms (4)
These registers can be used to control the inverter's time response. => See section "Time Response of the Supported Operating Modes".
0 is set as the default for all registers.

WMaxLimPct (6) to WMaxLim_Ena (10)
These registers can be used to set an output power reduction in the inverter.

WMaxLimPct (6)
Values between 0% and 100% can be entered in register WMaxLimPct.
The values limit the maximum possible output power of the device, and therefore do not necessarily have an effect on the current power.

IMPORTANT! Observe the scale factor for this register.
Further information can be found at:
http://sunspec.org/wp-content/uploads/2015/06/SunSpec-Information-Models-12041.pdf

WMaxLimPct_WinTms (7), WMaxLimPct_RvrtTms (8)
These registers can be used to control the inverter's time response for this operating mode. => See section "Time response of the supported operating modes".
0 is set as the default for all registers.

If you are working with function code 0x10 (write multiple registers), performance specifications can be used to achieve a higher level of performance. Instead of using two Modbus commands, it is now possible to preset both the power and enable at the same time with just one command. All 5 registers (WMaxLimPct, WMaxLimPct_WinTms, WMaxLimPct_RvrtTms, WMaxLimPct_RmpTms, WMaxLim_Ena) can be written with one command. Writing to the "Read Only" register WMaxLimPct_RmpTms takes place without returning an otherwise usual exception (error) code.
For example, register values for 80% specification without timing specification: 8000, 0, 0, 0, 1

IMPORTANT! Observe the scale factor for this register.
Further information can be found at:
http://sunspec.org/wp-content/uploads/2015/06/SunSpec-Information-Models-12041.pdf

If the power reduction was originally started using WMaxLimPct_RvrtTms = 0, the operating mode must be manually deactivated.

In principle, reactive power operation is limited by the maximum output current (the maximum apparent power) and by the operative reactive power limit of the inverter:

the following diagram shows the possible working range of the inverter. All valid operating points defined by effective power P and reactive power Q are within the gray area.

The maximum values must be read out from the Nameplate Model via registers VArRtgQ1 to VArRtgQ4 and VArRtg_SF.

Under-excited (inductive)		Over-excited (capacitive)

Reactive power and power factor

OutPFSet (11) to OutPFSet_Ena (15)
These registers can be used to set a constant power factor in the inverter.

OutPFSet_WinTms (12), OutPFSet_RvrtTms (13)
These registers can be used to control the inverter's time response for this operating mode. => See section "Time response of the supported operating modes".
0 is set as the default for all registers.

VArMaxPct (17) to VArPct_Ena (23)
These registers can be used to set on the inverter a constant value for the reactive power to be produced by the inverter.

VArPct_WinTms (19), VArPct_RvrtTms (20)
These registers can be used to control the inverter's time response for this operating mode. => See section "Time response of the supported operating modes".
0 is set as the default for all registers.

The Multiple MPPT Inverter Extension Model contains the values of the DC inverter inputs.

If the inverter has several DC inputs, then this is where the current, voltage, power, energy, and status codes for the individual inputs are listed. In the inverter model (101–103 or 111–113), only the full DC power of both inputs is output in this case. DC current and DC voltage are displayed as "not implemented".

The number of blocks is automatically adjusted based on the DC inputs. For devices with a storage solution, there are two additional blocks (charging (MPP3) and discharging (MPP4)). The register addresses are shifted in the following models (absolutely related to the register addresses).

The Multiple MPPT Inverter Extension Model contains the values of the DC inverter inputs.

If the inverter has several DC inputs, then this is where the current, voltage, power, energy, and status codes for the individual inputs are listed. In the inverter model (101–103 or 111–113), only the full DC power of both inputs is output in this case. DC current and DC voltage are displayed as "not implemented".

The number of blocks is automatically adjusted based on the DC inputs. For devices with a storage solution, there are two additional blocks (charging (MPP3) and discharging (MPP4)). The register addresses are shifted in the following models (absolutely related to the register addresses).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

This model is only available for inverters with a storage solution.

The Basic Storage Control Model can be used to make the following settings on the inverter:

This model is only available for inverters with a storage solution.

The Basic Storage Control Model can be used to make the following settings on the inverter:

The Basic Storage Control Model provides the following read-only information:

WChaMax

ChaState

ChaSt
Energy storage operating status

In the settings on the inverter's web interface, the setting "Inverter control via Modbus" must be enabled under Modbus for write functions to be possible. Depending on the control priority that has been set (IO control, dynamic power reduction, or control via Modbus), Modbus commands may not be accepted.

The following examples assume that WchaMax = 3300 W.

The following applies for the resulting power windows:

Example 1: Only permit energy storage charging

This behavior can be achieved by limiting the maximum discharge capacity to 0% => results in window [-3300 W, 0 W]

Example 2: Only permit energy storage discharging

This behavior can be achieved by limiting the maximum charge capacity to 0% => results in window [0 W, 3300 W]

Example 3: Do not permit charging or discharging

This behavior can be achieved by limiting the maximum charge capacity to 0% and the maximum discharge capacity to 0%
=> results in window [0 W, 0 W]

Example 4: Charging and discharging with maximum 50% of the nominal power

This behavior can be achieved by limiting the maximum charge capacity to 50% and the maximum discharge capacity to 50%
=> results in window [-1650 W, 1650 W]

Example 5: Charging in the range of 50% to 75% of the nominal power

This behavior can be achieved by limiting the maximum charge capacity to 75% and the maximum discharge capacity to -50%
=> results in window [1650 W, 2475 W]

Example 6: Discharging with 50% of the nominal power

This behavior can be achieved by limiting the maximum charge capacity to -50% and the maximum discharge capacity to 50%
=> results in window [-1650 W, -1650 W]

Example 7: Charging with 50% to 100% of the nominal power

This behavior can be achieved by limiting the maximum discharge capacity to -50% => results in window [1650 W, 3300 W]

By setting register MinRsvPct, a minimum state of charge of the energy storage can be set.
For example, by setting MinRsvPct to 20%, a reserve of 20% of the state of charge can be reserved that the state of charge should not fall below.

The ChaGriSet register can be used to allow or prevent inverter storage charging via the grid. The register ChaGriSet and the field "battery charging from DNO grid" in the Fronius system monitoring settings are AND-linked (Device configuration - Components - Battery). If the behavior is to be controlled by the ChaGriSet flag, "battery charging from DNO grid" must be checked.

The battery can be woken from standby mode via the IC124 model. If the SocMin under the last known SoC is set while the battery is in standby mode, this will be enabled.

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

Fronius Solar.web allow users to visualize status changes from the battery. These changes can be seen in Fronius Solar.web under the option Energy balance then Production or Consumption. The changes are marked with a bubble status, clicking on a state change will show the previous state followed by an arrow and the new state.

Battery state change from Start-up to Normal Operation.

IMPORTANT
The SunSpec 700 models are only available with inverters in the Primo GEN24 208-240 3.8-10.0 kW device class.

On the user interface of the inverter, set the Modbus RTU interface 0/1 to Slave in the Communication → Modbus menu. Inverter control via the supported SunSpec 700 models is activated.

IMPORTANT
The SunSpec 700 models are only available with inverters in the Primo GEN24 208-240 3.8-10.0 kW device class.

On the user interface of the inverter, set the Modbus RTU interface 0/1 to Slave in the Communication → Modbus menu. Inverter control via the supported SunSpec 700 models is activated.

Global priority
The inverter has several interfaces for control. The Modbus 700 commands are prioritized in the event of a conflict between the commands via the Modbus 700 models and other control options (Modbus 100 models, digital I/Os, feed-in limits via the user interface of the inverter).

Priority within the SunSpec 700 models
Prioritization is necessary within the SunSpec 700 models to set the defined control behavior.

* One of the following reactive power functions can be activated. The activated function is deactivated when another is selected:

The following registers can be defined for a set period of time in the Reversion Timers Register:

The values to be applied after the time has elapsed are also written via Modbus registers. This Reversion Timer function is available for the following Modbus models:

SunSpec supports the option of storing several parameter sets (or curves) for the respective functions. A total of 4 curves are supported. The curve with the index 1 corresponds to the current active parameter set of the inverter. The curves with index 2 to 4 can be described and activated. The following registers are displayed:

This functionality is supported for the following models:

This model outputs the following measured and status values:

This model outputs the following measured and status values:

This model corresponds to a digital rating plate. The following values can be read:

This model corresponds to a digital rating plate. The following values can be read:

This model controls the conditions for connection and feed-in of the inverter with the following parameters:

This model controls the conditions for connection and feed-in of the inverter with the following parameters:

This model contains the control of the inverter. The following parameters can be used to set the effective power, a constant power factor, or a constant reactive power:

Power factor

Effective power limit
These registers limit the effective power of the inverter:

Reactive power

This model contains the control of the inverter. The following parameters can be used to set the effective power, a constant power factor, or a constant reactive power:

Power factor

Effective power limit
These registers limit the effective power of the inverter:

Reactive power

The behavior of the function Q(U) (reactive power over voltage) can be controlled with this model. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

The behavior of the function Q(U) (reactive power over voltage) can be controlled with this model. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

This model can be used to control the behavior of the function P(U) (effective power over voltage). A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

This model can be used to control the behavior of the function P(U) (effective power over voltage). A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

Models 707 and 708 are used to set the mains voltage limits. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

Models 707 and 708 are used to set the mains voltage limits. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

Models 709 and 710 are used to set the mains frequency limits. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

Models 709 and 710 are used to set the mains frequency limits. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

This model is used to control the function P(f) (effective power over mains frequency). A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

This model is used to control the function P(f) (effective power over mains frequency). A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

The function Q(U) (reactive power over mains voltage) is controlled with this model. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

The function Q(U) (reactive power over mains voltage) is controlled with this model. A graphical overview of the function is shown in the document "SunSpec Modbus IEEE 1547-2018 Profile Specification and Implementation Guide".

This model provides information on a connected battery storage system.

This model provides information on a connected battery storage system.

The register number of the two model types is different!

The Modbus device ID of the energy meter is configurable (default = 200).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

There are 4 different meter locations, which are described by the location number (see table). Depending on where the Smart Meter is located and whether the inverter is producing or consuming, the signs of the PowerReal values and the Energy values change. These are shown in the following table:

The register number of the two model types is different!

The Modbus device ID of the energy meter is configurable (default = 200).

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .

There are 4 different meter locations, which are described by the location number (see table). Depending on where the Smart Meter is located and whether the inverter is producing or consuming, the signs of the PowerReal values and the Energy values change. These are shown in the following table:

The register tables can be found on the Fronius website or opened using the link:
http://www.fronius.com/QR-link/0024 .