EL 2.1 FW 1.4.0 Modbus TCP Communication Interface

• Introduction
• Physical Interface Connection
• TCP/IP Connection Settings
• Modbus Connection Settings
• References
• Data Formats Used
• Data Bits/Registers Dimension
• Data Encoding
• Implemented Modbus Functions
• Modbus Data Model
• Events
• Modbus Table
• Diagrams
• Examples

Introduction

Refer to the Reference section for details of the Modbus protocol.

This document describes public Modbus TCP implementation for Enapter Electrolyser EL 2.1 and assume understanding of TCP/IP and Modbus protocols.

Physical Interface Connection

Connect Ethernet cable to the Ethernet Port of Enapter EL 2.1 electrolyser.

TCP/IP Connection Settings

By default DHCP client is enabled therefore IP address will be assigned automatically by DHCP server available in the connected network.

It is recommended to set DHCP reservation based on MAC address of the electrolyser.

Configuration of the Static IP is possible using Enapter Cloud and Enapter Mobile Application for iOS and Android.

Modbus Connection Settings

Option	Value	Comment
Modbus Port	502
Modbus Slave Address	1	Enapter Electrolyser always addressed as a slave

References

http://www.modbus.org/docs/Modbus_Application_Protocol_V1_1b.pdf (opens new window)

Data Formats Used

Primary tables	Object Type	Permission	Comment
Input Registers	16 bit word	Read Only
Holding Registers	16 bit word	Read / Write

Data Bits/Registers Dimension

Data Type	Size in Bits	Registers Used	Comment
Boolean	16 bits	1 register	0 value means 'false', all other cases - 'true'
Uint16	16 bits	1 register
Uint32	32 bits	2 registers
Uint64	64 bits	4 registers
Float32	32 bits: * bit 31: Sign (1 bit) * bit 30-23: Exponent (8 bits) * bit 22-0: Fraction (23 bits)	2 registers	IEEE 754 Single-precision floating-point

Data Encoding

Big-endian, high word first data encoding used.

This means that when more than single byte (8 bits) is transmitted, network byte order is used - the most significant byte placed at lower address (sent first).

Implemented Modbus Functions

Function	Code	Comment
Read Holding Registers	03
Read Input Registers	04
Write Single Holding Register	06
Write Multiple Holding Registers	16

Modbus Data Model

Input registers and Holding registers are referred to in the range 3XXXX and 4XXXX respectful (also known as PLC Address). For example, Holding register 0 in this document would be referred to as 40001 and would be addressed as register 0000 in the data address field of the Modbus message (also known as Protocol Address).

Events

Severity Levels

Code	Severity Level	LED Indication	Description	Comment
F	Fatal Error	Red and Yellow Blinks	System stopped. Unrecoverable error. Hardware repair required.	e.g. Pressure sensor is not connected or broken.
E	Error	Red Blinks	System Stopped. Recoverable error.	e.g. No input water pressure and internal water tank is empty.
W	Warning	Yellow Blinks	Heads-up event which should be taken into account to avoid Error or Fatal Error.	e.g. No input water pressure and internal water tank is full.

Routines

Code	Routine	Comment
P	Platform
C	Electrolyte Circulation
D	Stack Ramp Down
R	Water Refilling
S	Steady Hydrogen Production
T	Temperature Management
U	Stack Ramp Up
X	Safety Check
F	Anti-freezing
L	Leakage Test
O	Blowdown
H	Heartbeat
Z	Polarization Curve

Warning, Error and Fatal Error Codes

Code	Name	Severity Code	Routine Code	Component	Condition	Description
0x0000	none	--	--	--		No error
0x0FFF	int	--	--	--		Unexpected error, hardware failure, read logs for details
0x1F81	FP_01	F	P	--	Voltage < 2.9V	Brownout detected, restore power and reset system
0x1F82	FP_02	F	P	--	Updated firmware have new mandatory settings	New parameters has been added to configuration, please re-check and write new one, contact enapter support or certified partner
0x3F84	WP_04	W	P	--		Button
0x108A	FC_10	F	C	P107		Pump broken
0x1114	FD_20	F	D	PT101A	Pressure drop > 2%	Hydrogen leaks
0x318A	WR_10	W	R	PT105	Pressure > 5barg	Water inlet pressure too high
0x3194	WR_20	W	R	PT105	Pressure < 0.5barg	Water inlet pressure too low
0x118A	FR_10	F	R	LSHH102A	Water level over level switch	Electrolyte level too much high
0x1194	FR_20	F	R	LSL102D	Water level below level switch	Electrolyte level too much low
0x11B2	FR_50	F	R	LSL102D LSM102C		Conflict between water sensors (low and medium level)
0x11B3	FR_51	F	R	LSM102C LSH102B		Conflict between water sensors (medium and high level)
0x11B4	FR_52	F	R	LSH102B LSHH102A		Conflict between water sensors (high and very high level)
0x11A8	FR_40	F	R	--		Check water leaks
0x3195	WR_21	W	R	--		Refilling timeout (won't be shown if WR_10 or WR_20 is present)
0x31B3	WR_51	W	R	LSL102D		Drain completely (available only in Maintenance Mode)
0x31B4	WR_52	W	R	LSL102D		Refill to high level (available only in Maintenance Mode)
0x3215	WS_21	W	S	PT101A	Pressure spike > 2%	Drifting PT101A
0x3216	WS_22	W	S	LSM102C	System works with electrolyte level less than medium one and can not refill (during pressure limit and etc)	Too low water level
0x128A	FT_10	F	T	TT106	Temperature > 58°C	Electrolyte temperature too high
0x3294	WT_20	W	T	F103A	Rotation < 600rpm	Electrolyte cooling fan broken
0x228A	ET_10	E	T	TT102A	Temperature < 6°C	Electrolyte temperature too low
0x330A	WU_10	W	U	PT101A	Pressure is > atmospheric pressure + 10%	Gas side pressure is not atmospheric. Ramp-Up is not possible (pressure too high for start)
0x230A	EU_10	E	U	LSM102C		Not enough warmup water
0x1401	FX_01	F	X	PT101A	Pressure > 37bar	Hydrogen inner pressure too high
0x1402	FX_02	F	X	WPS104	Water sensor is wet	Water presence
0x1403	FX_03	F	X	PSU 48V	No voltage from PSU	PSU broken
0x1404	FX_04	F	X	HASS	Current > 58A	Stack current too high
0x1405	FX_05	F	X	TSH106		Backflow temperature too high
0x1406	FX_06	F	X	PT101A		Hydrogen leaks
0x1407	FX_07	F	X	TS108	Temperature > 75°C	Electronic board temperature too high
0x1408	FX_08	F	X	PSH102		Electrolyte tank pressure too high
0x1409	FX_09	F	X	TSLL102B		Electrolyte temperature too low
0x140A	FX_10	F	X	PSHH101B		Hydrogen pressure too high
0x141E	FX_30	F	X	PT105		Water inlet pressure transmitter broken
0x141F	FX_31	F	X	TT102A		Electrolyte tank temperature transmitter broken
0x1420	FX_32	F	X	FM106		Electrolyte flow meter broken
0x1421	FX_33	F	X	TT106		Electrolyte backflow temperature transmitter broken
0x1422	FX_34	F	X	PT101A		Hydrogen inner pressure transmitter broken
0x1423	FX_35	F	X	PT101C		Outer hydrogen pressure transmitter broken
0x1424	FX_36	F	X	F1084B	Rotation < 3000rpm	Chassis circulation fan broken
0x1425	FX_37	F	X	F108C	Rotation < 3000rpm	Electronic compartment cooling fan broken
0x1426	FX_38	F	X	TS108		Electronic board temperature transmitter broken
0x1427	FX_39	F	X	HASS		Current sensor broken
0x1428	FX_40	F	X	External switch		Dry contact error
0x148A	FF_10	F	F	--		Frozen pipes
0x1501	FL_01	F	L	--		Huge H2 leak detected
0x358A	WO_10	W	O	PT101C	Pressure > 25 barg	Outer pressure is too high to run blowdown routine
0x3594	WO_20	W	O	--		The Blowdown procedure will be started at H2-production start
0x159E	FO_30	F	O	PT101C		The purge line is obstructed or the adjustable check valve (CV101B) cracking pressure is set incorrectly
0x360A	WH_10	W	H	ModBus	Heartbeat Packet was not received in time	Lost ModBus safety heartbeat communication
0x360B	WH_11	W	H	Gateway	Heartbeat Packet was not received in time	Lost Gateway safety heartbeat communication
0x360C	WH_12	W	H	UCM	Heartbeat Packet was not received in time	Lost UCM safety heartbeat communication
0x368A	WZ_10	W	Z	--		Polarization curve cannot be started

Modbus Table

Holding Registers (Read / Write)

Register	Data Type	Name	Comment
0	Uint64	Unix Time	Seconds from 1 January 1970 UTC. e.g. 02/29/2020 @ 3:15 PM (UTC) represented as 1582989315.
4	Boolean	Reboot	1 = Reboot.
5	Boolean	Locate Electrolyser	1 = Start Blinking All LED; 0 = Stop Blinking All LED.
6	Boolean	Maintenance Mode	1 = Enable Maintenance Mode; 0 = Disable Maintenance Mode.
9	Boolean	Factory Reset	True = enable (possible only in Expert Mode)
1000	Boolean	Start / Stop Electrolyser	1 = Start; 0 = Stop.
1002	Float32	Production Rate [%]	Current production rate in percent (system reset set this value to 'Default Production Rate'), can be changed 'on-fly' even when electrolyser produce H2
1010	Boolean	Request Blowdown routine	1 = Request blowdown or read 'is blowdown requested'
4000	Boolean	Configuration Begin	1 = Start configuration
4001	Boolean	Configuration Commit	1 = Commit current changes; 0 = Rollback changes
4020	Uint32	Ethernet IP Address	e.g. 0xC0A80201 (192.168.2.1); 0 = DHCP enabled
4022	Uint32	Ethernet IP Netmask
4024	Uint32	Ethernet Gateway IP Address
4074	Uint32	PSU Type	0 = internal; 1 = Zekalabs
4308	Float32	Max Tank Pressure (Outlet)	bar
4310	Float32	Restart Pressure (Outlet)	bar
4336	Float32	Conversion curve parameter
4338	Float32	Conversion curve parameter
4396	Float32	Default Production Rate [%]	This register can be modified only when stack is inactive (Idle or Maintenance mode)
4474	Float32	Electronic fan maximal rotation speed	in percent, default = 100
4494	Uint32	Electrolyte Cooling Type	0 = Disabled; 1 = Air Cooled; 2 = Liquid Cooled
4476	Float32	Electronic fan minimal rotation speed	in percent, default = 10
4520	Float32	Temperature to open solenoid valve V106	Celsius
4522	Float32	Temperature to close solenoid valve V106	Celsius
4530	Uint32	Cooling Type	1 = Air Cooling; 2 = Water Cooling
4600	Uint32	Heartbeat ModBus Timeout	Seconds; 0 = disable
4602	Uint32	Heartbeat Gateway Timeout	Seconds; 0 = disable
4604	Uint32	Heartbeat UCM Timeout	Seconds; 0 = disable

Input Registers (Read Only)

Register	Data Type	Name	Comment
0	Uint32	Device Model	0x454C3231 for EL 2.1
2	Uint16	Firmware MAJOR and MINOR Version	Ex: 267 => 267 // 256 = 1, 267 % 256 => 11 (1.11)
3	Uint16	Firmware PATCH Version	Ex: 3 => 3 (3)
4	Uint32	Firmware Build Number	e.g. 0x4E343471
6	Uint128	Device Control Board Serial Number	9E25E695-A66A-61DD-6570-50DB4E73652D
14	Uint64	Cabinet (Chassis) Serial Number	19030125124810
18	Uint16	System State	0 = Internal Error, System not Initialized yet; 1 = System in Operation; 2 = System Halted (e.g. during error); 3 = System in Maintenance Mode; 4 = Fatal Error; 5 = System in Expert Mode.
20	Uint32	Live time [seconds]	Total time during which a system is power up (not only time when stack is working).
22	Uint32	Uptime [seconds]	How long the system has been running
768	Array of 32 Warning Events	Warning Events Array	Warning Events Array represented by Error Codes. First Uint16 contains total quantity of Warning Events.
832	Array of 32 Error Events	Error Events Array	Error Events Array represented by Error Codes. First Uint16 contains total quantity of Error Events.
1000	Uint32	Product Code	0x00 = ELE210535A2AXV01_03 0x01 = ELE210508A2AXV01_03 0x02 = ELE210535A2AXV04 0x03 = ELE210508A2AXV04 0x04 = ELE210535A2LSV01 0x05 = ELE210508A2LXV01
1002	Uint32	Stack Start/Stop Cycles Quantity
1004	Uint32	Stack Total Runtime	seconds
1006	Float32	Stack Total H2 Production	NL
1008	Float32	H2 Flow Rate	NL/hour, NAN when not producing H2;
1200	Uint16	Electrolyser State	0 = Halted; 1= Maintenance mode; 2 = Idle; 3 = Steady; 4 = Stand-By (Max Pressure); 5 = Curve; 6 = Blowdown.
4000	Boolean	Configuration Progress	1 = Configuration is in progress.
4001	Boolean	Configuration Source	1 = Configuration over Modbus.
4002	Int32	Last Configuration Result	0 = OK, Configuration was completed successfully; 1 = Permanent, The operation has failed (internal or general error); 2 = No Entry, Configuration was not started or interrupted; 5 = I/O, Data save error; 11 - Try again, Configuration needs to be tried again; 13 = Access Denied, Some changed registers are read-only; 16 = Busy, Another configuration was in progress; 22 = Invalid, The data has invalid or wrong type.
4004	Uint16	Last Configuration Wrong Holding	Keeps first invalid Holding register number which doesn't allow successful configuration commit.
4600	Uint16	Heartbeat
6000	Uint16	Dryer Error	Dryer error code (bitmask). Reserved, not implemented yet.
6001	Uint16	Dryer Warning	Dryer warning code (bitmask). Reserved, not implemented yet.
6002	Float32	Dryer TT00	Temperature of heater element for cartridge 0 (first line). Reserved, not implemented yet.
6004	Float32	Dryer TT01	Temperature of heater element for cartridge 1 (first line). Reserved, not implemented yet.
6006	Float32	Dryer TT02	Temperature of heater element for cartridge 2 (first line). Reserved, not implemented yet.
6008	Float32	Dryer TT03	Temperature of heater element for cartridge 3 (first line). Reserved, not implemented yet.
6010	Float32	Dryer PT00	Input pressure of the dryer. Reserved, not implemented yet.
6012	Float32	Dryer PT01	Output pressure of the dryer. Reserved, not implemented yet.
7000	Boolean	High Electrolyte Level Switch (LSH102B_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7001	Boolean	Very High Electrolyte Level Switch (LSHH102A_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7002	Boolean	Low Electrolyte Level Switch (LSL102D_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7003	Boolean	Medium Electrolyte Level Switch (LSM102C_in)	1 = Electrolyte level over sensor; 0 = Electrolyte level below sensor.
7004	Boolean	Electrolyte Tank High Pressure Switch (PSH102_in)	1 = Pressure is too high; 0 = Pressure is normal.
7005	Boolean	Very High Hydrogen Pressure Switch (PSHH101B_in)	1 = Pressure is too high; 0 = Pressure is normal.
7006	Boolean	Downstream High Temperature Switch (TSH106_in)	1 = Temperature is too high. 0 = Temperature is normal.
7007	Boolean	Electronic Compartment High Temperature Switch (TSH108_in)	1 = Temperature is too high. 0 = Temperature is normal.
7008	Boolean	Very Low Electrolyte Temperature Switch (TSLL102B_in)	1 = Temperature is too low. 0 = Temperature is normal.
7009	Boolean	Chassis Water Presence Switch (WPS104_in)	1 = Water is present on input; 0 = No water input.
7500	Float32	Electrolyte Cooler Fan Speed (F103A_in_rpm)	[rpm]
7502	Float32	Air Circulation Fan Speed (F104B_in_rpm)	[rpm]
7504	Float32	Electronic Compartment Cooling Fan Speed (F108C_in_rpm)	[rpm]
7506	Float32	Electrolyte Flow Meter (FM106_in_lmin)	[Liters per minute]
7508	Float32	Stack Current (HASS_in_a)	[Ampere]
7510	Float32	PSU Voltage (Stack Voltage) (PSU_in_v)	[Volt]
7512	Float32	Inner Hydrogen Pressure (PT101A_in_bar)	[bar]
7514	Float32	Outer Hydrogen Pressure (PT101C_in_bar)	[bar]
7516	Float32	Water Inlet Pressure (PT105_in_bar)	[bar]
7518	Float32	Electrolyte Temperature (TT102A_in_c)	[°C]
7520	Float32	Downstream Temperature (TT106_in_c)	[°C]
8000	Float32	Inner Hydrogen Pressure Raw Sensor Value (PT101A_in_v)	Raw value, [Volt]
8002	Float32	Outer Hydrogen Pressure Raw Sensor Value (PT101C_in_v)	Raw value, [Volt]
8004	Float32	Stack Current Raw Sensor Value (HASS_in_v)	Raw value, [Volt]

Diagrams

System State Diagram

This diagram describes possible transition between different electrolyser states. The state can be read in the Input Register #18.

Examples

Example: Change Electrolyser Restart Pressure Flow

Here is an example to change Electrolyser Restart Pressure to 25 bar. This will enable Electrolyser to restart when pressure drop to 25 bar on outlet.

Example: Reading Modbus Input Registers

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Word Count
  00 01	00 00	00 06	01	04	03 EE	00 02

• Request Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Reference Number: Starting register – decimal: 1006
  • Word Count: Number of registers to read – decimal: 2

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Byte Count	Register[0]	Register[1]
  00 01	00 00	00 07	01	04	04	48 00	10 7A

• Response Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – decimal: 7
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Byte Count: Registers values size – decimal: 4
  • Register[0] value – decimal: 18432
  • Register[1] value – decimal: 4218
  • Register[…] value – 2 bytes

• Wireshark Example

Example: Writing to Modbus Holding Registers

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 01	00 00	00 06	01	06	00 04	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 01	00 00	00 06	01	06	00 04	01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4
  • Data: Value to write – decimal: 1

• Wireshark Example

Example: Reading Errors Sequence

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Word Count
  00 01	00 00	00 06	01	04	03 40	00 20

• Request packet description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol Identifier – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Reference Number: Starting register – default: 03 40
  • Word Count: Number of registers to read – default: 00 20

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Byte Count	Register[0]	Register[1]
  00 01	00 00	00 43	01	04	40	00 01	11 B3

• Response packet description

  Modbus/TCP

  • Transaction ID – default: 00 01
  • Protocol ID – default: 00 00
  • Query Length – default: 00 43
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Read Input Registers – default: 04
  • Byte count: Registers values size – default: 40
  • Register[0] value – total number of errors, decimal: 1
  • Register[1] value – error code 1: 11 B3
  • Register[…] value – error code N

• Wireshark Example

Example: Writing Heartbeat Modbus Timeout

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 02	00 00	00 06	01	06	0F A0	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 2
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4000
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 02	00 00	00 06	01	06	0F A0	00 01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 2
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4000
  • Data: Value to write – decimal: 1

• Wireshark Example

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 03	00 00	00 06	01	06	11 F8	00 00

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 3
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4600
  • Data: Value to write – decimal: 0

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 03	00 00	00 06	01	06	11 F8	00 00

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 3
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4600
  • Data: Value to write – decimal: 0

• Wireshark Example

• Request Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 04	00 00	00 06	01	06	0F A1	00 01

• Request Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 4
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Starting register – decimal: 4001
  • Data: Value to write – decimal: 1

• Wireshark Example

• Response Packet

  Transaction ID	Protocol ID	Query Length	Unit ID	Function Code	Reference Number	Data
  00 04	00 00	00 06	01	06	0F A1	00 01

• Response Packet Description

  Modbus/TCP

  • Transaction ID – decimal: 4
  • Protocol ID – default: 00 00
  • Query Length – default: 00 06
  • Unit ID: Slave Address – default: 01

  Modbus

  • Function Code: Write Single Register – default: 06
  • Reference Number: Register to write – decimal: 4001
  • Data: Value to write – decimal: 1