Professional Documents
Culture Documents
No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Kehua Data Co.,Ltd.
and other Kehua trademarks are trademarks of Kehua Data Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective holders.
Notice
The purchased products,services and features are stipulated by the contract made between Kehua and the
customer. All or part of the products, services and features described in this document may not be within the
purchase scope or the usage scope. Unless otherwise specification in the contract, all statements, information,
and recommendations in this document are provided “AS IS” without warranties, guarantees or
representations of any kind, either express or implied.
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.
E-mail: service@kehua.com
Tel: 0592-5160516
Fax: 0592-5162166
Change History
Changes between document issues are cumulative. The latest document issue contains all the changes
made in earlier issues.
Contents
1 Overview......................................................................................................................................... 5
1.1 Product Intro..................................................................................................................................................... 5
1 Overview
⚫ SPI250K-B-H
⚫ SPI200K-B-H
⚫ SPI225K-B-H
⚫ SPI175K-B-H
⚫ SPI136K-BHV
⚫ SPI125K-B
⚫ SPI100K-B
UINT16 Unsigned 16-bit integer. High byte front, low byte behind.
UINT32 Unsigned 32-bit integer. High byte front, low byte behind.
Name Description
INT16 Signed 16-bit integer. High byte front, low byte behind.
INT32 Signed 32-bit integer. High byte front, low byte behind.
MLB Multibyte
Name Description
Frame interval Not less than the transmission time of 3.5 bytes
Intra-frame bytes interval Not larger than the transmission time of 1.5 bytes
Max. response time of the slave The transmission time of 150 bytes
Min. polling interval of the host The transmission time of 200 bytes
Name Description
Port ID 502
Max. response time of the slave 100ms
Min. polling interval of the host 100ms
Default: 192.168.1.10
IP
It can be configured according to Chapter 10
Default: 255.255.255.0
Subnet mask
It can be configured according to Chapter 10
Default: 192.168.1.1
Gateway
It can be configured according to Chapter 10
2 Register Definition
Size Read/
Register Signal name Type Remark/unit
(Byte) write
1- PV inverter
4850 Device type 2 UINT16 RO
2- PCS
1- three-phase
protocol
3-PID protocol
Size Read/
Register Signal name Type Remark/unit
(Byte) write
Size Read/
Register Signal name Type Remark
(Byte) write
0-standby;1-grid-tied;
2- fault;3-off;4-off-line;
Size Read/
Register Signal name Type Remark/unit
(Byte) write
Version of control
10040-10044 10 String RO
software 1
Version of control
10045-10049 10 String RO
software 2
Version of control
10050-10054 10 String RO
software 3
Version of control
10055-10059 10 String RO
software 4
Version of control
10060-10064 10 String RO
software 5
Version of control
10065-10069 10 String RO
software 6
1- Three-phase PV
inverter
10070 Device type 2 UINT16 RO
2- Three-phase PV
energy-storage inverter
1- Three-phase protocol
10071 Protocol type 2 UINT16 RO
2- Single-phase
Size Read/
Register Signal name Type Remark/unit
(Byte) write
protocol
3- PID protocol
Size Read/
Register Signal name Type Remark/unit
(Byte) write
Size Read/
Register Signal name Type Remark/unit
(Byte) write
0x0000-standby (no
DC input)
0x0002-standby
(self-check)
0x0100-grid-tied
0x0103- Ration
derating
0x0200-fault
0x0201-fault (waiting
Size Read/
Register Signal name Type Remark/unit
(Byte) write
0x0300-off
0x0400-off-line
Size Read/
Register Signal name Type Remark/unit
(Byte) write
module (inverter)
Voltage of
11064-11079 16*2 UINT16 RO 0.1V
MPPT1-MPPT16
Current of
11080-11095 16*2 INT16 RO 0.1A
MPPT1-MPPT16
Size Read/
Register Signal name Type Remark/unit
(Byte) write
Size Read/
Register Signal name Type Remark/unit
(Byte) write
0-not recovery;
1-recovery, it only
valid after disable the
12002 Recover grid-tied 2 UINT16 RW "self-start after
abnormal recovers"
and grid abnormal
recovers.
Insulation resistance
12006 2 UINT16 RW 0-disable; 1-enable
detection
0: no response for
12016 Active power mode 2 UINT16 RW
scheduling.
Size Read/
Register Signal name Type Remark/unit
(Byte) write
1: response for SI
value scheduling;
0: no response for
scheduling;
1: response for SI
value scheduling;
12019 Reactive power mode 2 UINT16 RW 2: response for p.u.
value scheduling;
Size Read/
Register Signal name Type Remark/unit
(Byte) write
1-UL1741;
2-UL1741(SA );
3-Germany;
4-Australia;
5-new Zealand;
6-UK;
7-Thailand PEA;
8-Thailand MEA;
9-Italy0-16;
10- Italy0-21;
11-user-defined ;
16-Netherlands;
17-Spain;
18-EN50438;
20-city grid;
21-India;
22-Korea;
23-Canada;
24-Mexico;
25-Japan;
26-Morocco;
27-Poland;
28-Ukraine;
Size Read/
Register Signal name Type Remark/unit
(Byte) write
29-Brazil
Anti-countercurrent RW
12029 2 UINT16 0-disable; 1-enable
function
Size Read/
Register Signal name Type Remark/unit
(Byte) write
Read/
Register Signal name Byte Type Remark/unit
write
1-locked
0- OFF;
1- on
10591 Probation status 2 UINT16 RO probation;
2- Probation
expires
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
4 UINT32 Logout
12100-12101 Permission password RW automatically
after 20min
Read/
Register Signal name Byte Type Remark/unit
write
1-clear
2 0-invalid;
12109 Clear energy UINT16 RW
1-clear
2 0-invalid;
12110 Clear history log UINT16 RW
1-clear
2 0-all ON;
1- 30mA gear
is not
Residual current protection
12111 UINT16 RW protected;
prohibition
2: 60mA gear
is not
protected
2 0-independent
;
2- automatic
identification
2 0-CVT ;
12114 Control mode UINT16 RW
1-MPPT
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
time
Read/
Register Signal name Byte Type Remark/unit
write
[0,2] : 0-off;
12189 P-V mode 2 UINT16 RW 1-linear; 2-
hysteresis
Read/
Register Signal name Byte Type Remark/unit
write
[0,2]: 0-off;
12196 P-F mode 2 UINT16 RW 1-linear; 2-
hysteresis
[0,1]:0-off;
12210 Q-V mode 2 UINT16 RW
1-on
Read/
Register Signal name Byte Type Remark/unit
write
[0,1]:0-off;
12220 SPF mode 2 UINT16 RW
1-on
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
2 0-Kehua;
12503 Manufacturer setting UINT16 RW
1-neutral
2 0~15
Corresponding
12504 Reference model UINT16 RW model of code
are defined by
manufacturer
2 0-OFF ,
12554 Off-grid debug mode UINT16 RW
1-GRID
2 0-disable;
12555 Disperse control UINT16 RW
1-enable
2 0-disable;
12560 Slow start detection UINT16 RW
1-enable
Read/
Register Signal name Byte Type Remark/unit
write
Measured voltage of 32
12600-12615 UINT16 RW 0.1V
MPPT1-MPPT16
Measured current of 32
12616-12631 INT16 RW 0.01A
MPPT1-MPPT16
Measured current of 64
12632-12663 INT16 RW 0.01A
PV1-PV32
Measured current of 32
12680-12695 INT16 RW 0.01A
Boost1-Boost16
Measured temperature of 2
12699 INT16 RW
power module 2 (boost 1) 0.1℃
Measured temperature of 2
12704 INT16 RW
power module 2 (boost 2) 0.1℃
12705 Reserved 2 RW
Read/
Register Signal name Byte Type Remark/unit
write
Read/
Register Signal name Byte Type Remark/unit
write
Current DC component
bit6 Reserved bit6
abnormal
bit7 Reserved bit7 Residual current abnormal
Alarm 1
Alarm 2
Anti-countercurrent
bit11 Reserved bit11
communication abnormal
bit12 Reserved bit12 External CT abnormal
bit13 Reserved bit13 Smart meter abnormal
Alarm 4
Alarm 6
Alarm 12
Alarm 14
Alarm 16
Before using the function, it is necessary to set the " active power scheduling options" (register 12016)
and "reactive power scheduling options" (register 12019) to "response for absolute value scheduling"
(1)
Remark
Register Signal name type
/unit
…… ……
…… …… 0.1kW
Remark
Register Signal name type
/unit
…… ……
…… …… 0.1kVar
The active power and reactive power needs to be set respectively. If there are n sets of inverter, it
needs to write 2*n+1 register.
Send active power scheduling value 10kW, 50kW, 73.2kW to the inverter of Slave Addres 1, 32, 63.
The sending command as follows:
Register quantity: 0x00 0x07 (2*n+1, e.g., if there are 3 inverters, the quantity is 7)
Inverter Quantity: 0x00 0x03 (The quantity of written power of this broadcast is 3)
Inverter 1 Address: 0x00 0x01 (The slave address of Inverter 1 is 1. The device Slave
Addres of broadcast can be user-defined.)
Operation way: (read: 0x03; write single register: 0x06; write multi registers: 0x10)
Read
Register Signal name Byte type /wri Unit Remark
te
Read
Register Signal name Byte type /wri Unit Remark
te
Read
Register Signal name Byte type /wri Unit Remark
te
Operation way: (read: 0x03; write single register: 0x06; write multi registers: 0x10)
1. Bit0 ~ Bit15:
MPPT1~MPPT16
I&V curve configuration -
13200 2 UINT16 RW 0- not sampled; 1- sampling
sampling setting word 1
2. The number of MPPT
refer to register 10078.
13204 I&V curve query -MPPT no. 2 UINT16 RW 1. The register of this
section must be totally
written at one time, or the
I&V curve query - channel setting will be invalid.
13205 2 UINT16 RW
code
2. The number of MPPT
refer to register 10078.
Read/
Register Signal name Byte Type Remark
write
Channel 1 is PV;
13210 I&V curve - channel no. 2 UINT16 RO Channel 2 and above are
array current.
When the read status of sampling is 0 or 1, it will query the read status of waveform. (there need have
a timeout exit mechanism)
When the read status is 2, the sampling failed, host will end the reading.
Query the above two info to confirm the data quantity in Step 4, Step 5.
Step 4 Read the channel data: send MPPT number, channel number.
Query if the MPPT number, channel number and subpackage number matches the data sent in Step 4,
if matches, it will export the channel data 1~50 (reserved 50 points, details decided by sampling
point quantity.
Repeat Step 4, Step 5 till queried all channel data of all MPPT that sent in Step 1.
----End
7 User-defined Function
2. Register 13800-13809 is
used to judge if it matches
Station no.
that of the device, it is not
13810 configuration-station 2 UINT16 RW
stored.
no.
3. Range of register 13810:
1~247.
Step 1 Using the inner function code, broadcast to send the S/N,Slave Addres of configured device.
E0 stored.)
Station no.
13810 configuration-Slave 2 UINT16
Addres
After ARM received the broadcast frame, it compares the received S/N with the S/N of itself, if
matches, it will set the S/N as itsSlave Addres
Step 2 After all configurations are send, the upper-computer needs to confirm whether the configuration is
successful. The configuration method is the same as that using the uniqueness of S/N to query the
S/N according to slave no.
Function code Register Signal name Byte Data type Remark/ unit
----End
Example
Procedure:
2. QuerySlave Addres 2, register 10025-10034 according to function code 03, and judge whether
the S/N matches that sent in step 1. If matches, it means the configuration is successful.
4. Query slave addres 4, register 10025-10034 according to function code 03, and judge whether the
S/N matches that sent in step 3. If matches, it means the configuration is successful.
Uint16crc16(Uint16*buf,Uint16n)
Uint16uCRCHi=0xff;
Uint16uCRCLow=0xff;
Uint16CRC=0xffff;
Uint16CRCFlag=0;
Uint16i=0,j=0;
for(j=0;j<n;j++)
CRC=CRC^buf[j];
for(i=0;i<8;i++)
CRCFlag=CRC&0x0001;
CRC=CRC>>1;
if(CRCFlag==1)
CRC=CRC^0xa001;
uCRCHi=CRC&0x00ff;
uCRCLow=(CRC>>8)&0x00ff;
return(uCRCHi<<8|uCRCLow);
Set the address of slave to 0x01, and needs to query running information (address is 4501-4510).
01 04 14 00 01 00 02 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A B9 F0
xx 0x01 xx xx xx xx xx xx
xx 0x01 xx xx … xx xx xx
The bit 0 of register 1 of response information is corresponding to the starting address in the request, If
the returned register quantity is less than 8 or not a multiple of eight, the remaining bits in the final
register will be padded with zeros.
xx 0x02 xx xx xx xx xx xx
xx 0x02 xx xx … xx xx xx
The bit 0 of register 1 of response information is corresponding to the starting address in the request, If
the returned register quantity is less than 8 or not a multiple of eight, the remaining bits in the final
register will be padded with zeros.
xx 0x03 xx xx xx xx xx xx
Slave response(Hexadecimal):
xx 0x03 xx xx xx … … xx xx xx xx
Reading one or more registers is distinguished by the quantity of register. If the quantity of register is 1,
it means that there is one register. If the quantity of register is more than 1, it means that there are
several registers. Register 1 is corresponding to the starting address.
xx 0x04 xx xx xx xx xx xx
Slave response(Hexadecimal):
xx 0x04 xx xx xx … … xx xx xx xx
Reading one or more registers is distinguished by the quantity of register. If the quantity of register is 1,
it means that there is one register. If the quantity of register is more than 1, it means that there are
several registers. Register 1 is corresponding to the starting address.
xx 0x05 xx xx xx xx xx xx
For the write input status can be ON/OFF only, 0xFF00 request input status is ON, 0x0000 request
input status is OFF.
Slave response(Hexadecimal):
xx 0x05 xx xx xx xx xx xx
xx 0x06 xx xx xx xx xx xx
Slave response(Hexadecimal):
xx 0x06 xx xx xx xx xx xx
xx 0x10 xx xx xx xx xx xx xx … xx xx
Slave response(Hexadecimal):
xx 0x10 xx xx xx xx xx xx
xx 0xE0 xx xx xx xx xx xx xx … xx xx
Slave response(Hexadecimal):
xx 0xE0 xx xx xx xx xx xx
Slave response(Hexadecimal):
CRC check
Address Function code Error code
Low byte High byte
xx xx|0x80 xx xx xx
When the communication module of the inverter detects error except CRC error, it must send the
information to the host. The highest bit of function codes is 1, that is, add 128 at the sent function
code of host. The responded and sent error codes of inverter's communication module are as follows:
0x01 Invalid function code The server does not understand the function code
0x11 No authority
A special header used on the TCP/IP is to indentify MODBUS application data unit, called MBAP
heade(MODBUS protocol header).
The difference between Modbus TCP data frame and serial link data frame:
MODBUS request
Server recopys from the
Transaction ID 2 byte response transaction Client start
received request
processing ID
Client
Length 2 byte Number of bytes Client(response) start
start(request)
⚫ Transaction processing ID: Used for transaction matching. In response, the Modbus server copies
the transaction processing ID of the request.
⚫ Protocol ID: Used for multiplexing within system. The Modbus protocol is indentified by a value
of 0.
⚫ Length: The length filed is the number of bytes in the next field, including unit ID and data field.
⚫ Unit ID: This field is used for intra-system routing. Dedicated to communication between
MODBUS or MODBUS+ serial link slaves by a gateway between an Ethernet TCP-IP network
and a MODBUS serial link. The MODBUS client sets this field in the request, and the server
must return this field with the same value in the response.
⚫ All MODBUS/TCP ADUs are sent through TCP on the registered port 502.
Request PDU
0x 01 xx xx xx xx
Response PDU
0x 01 xx xx … xx
The bit 0 of register 1 of response information is corresponding to the starting address in the request, If
the returned register quantity is less than 8 or not a multiple of eight, the remaining bits in the final
register will be padded with zeros.
Request PDU
0x 02 xx xx xx xx
Response PDU
0x 02 xx xx … xx
The bit 0 of register 1 of response information is corresponding to the starting address in the request, If
the returned register quantity is less than 8 or not a multiple of eight, the remaining bits in the final
register will be padded with zeros.
Request PDU
0x 03 xx xx xx xx
Response PDU
code quantity High byte Low byte … … High byte Low byte
0x 03 xx xx xx … … xx xx
Reading one or more registers is distinguished by the quantity of register. If the quantity of register is 1,
it means that there is one register. If the quantity of register is more than 1, it means that there are
several registers. Register 1 is corresponding to the starting address.
Request PDU
0x 04 xx xx xx xx
Response PDU
0x 04 xx xx xx … … xx xx
Reading one or more registers is distinguished by the quantity of register. If the quantity of register is 1,
it means that there is one register. If the quantity of register is more than 1, it means that there are
several registers. Register 1 is corresponding to the starting address.
Request PDU
0x 05 xx xx xx xx
For the write input status can be ON/OFF only, 0xFF00 request input status is ON, 0x0000 request input status is
OFF.
Request PDU
0x 06 xx xx xx xx
Response PDU
0x 06 xx xx xx xx
Request PDU
0x 10 xx xx xx xx xx xx xx …
Response PDU
0x 10 xx xx xx xx
Response PDU
xx|0x80 xx
When the communication module of slave detects error except CRC error, it must send the
information to the host. The highest bit of function code is 1, that is, add 128 at the sent function code
of host. The responded and sent error codes of slave's communication module are as follows:
0x01 Invalid function code The server does not understand the function code