Communication Protocol of PV Combiner Box (Modbus)

V1.7.0.3

1. Introduction
This communication protocol, adopting Modbus RTU protocol, applies to the communication between Sungrow PV
combiner box and upper computer (PC) monitoring software. This protocol can read the real-time operating data
and fault states of the combiner box, and change the internal parameter setting.

2. Communication Interface
RS485 (Baud rate: 9600bps; Check bits: Null; Data bits: 8; Stop bits: 1; Fluid control: Null.)

3. Definition of Address
Address of 3x type is read-only register, supporting the cmdcode inquiry of 0x04.
Address of 4x type is holding register, supporting the cmdcode inquiry of 0x03, and cmdcodes write-in of 0x10 and
0x06.
3.1Definition of Running Information Variable Address

Data
Addr.
No. Name Address type (see Data range Unit
type
Note 1)
Running data
1 Device type code 7000 U16 PVS-8M-DB：0X0301 3x
PVS-12M-DB：0X0302
PVS-16M-DB：0X0303
PVS-8M：0X00D4
PVS-12M：0X00D3
PVS-16M：0X00D1
PVS-20M：0X00D5
PVS-24M：0X00D6
2 Max. input numbers 7001 U16 Depends on device 3x
type
3 Protocol ver. 7002 - 7003 U32 e.g. V1.7.0.3 3x
uploaded as 0X00030107
4 Reserved 7004 - 7005 - 3x
5 DC bus voltage 7006 U16 0.1V 3x
6 Internal temperature 7007 S16 0.1℃ 3x
7 Reserved 7008 - 7009 - 3x
8 Digit input 7010 U16 See 4.1 Definition of digit 3x
input
9 Max. current 7011 U16 See 4.3 Glossary 0.01A 3x
10 Average current 7012 U16 See 4.3 Glossary 0.01A 3x
st
11 Current of 1 input 7013 S16 0.01A 3x
nd
12 Current of 2 input 7014 S16 0.01A 3x
1/9
13 Current of 3rd input 7015 S16 0.01A 3x
th
14 Current of 4 input 7016 S16 0.01A 3x
th
15 Current of 5 input 7017 S16 0.01A 3x
th
16 Current of 6 input 7018 S16 0.01A 3x
th
17 Current of 7 input 7019 S16 0.01A 3x
th
18 Current of 8 input 7020 S16 0.01A 3x
th
19 Current of 9 input 7021 S16 0.01A 3x
th
20 Current of 10 input 7022 S16 0.01A 3x
th
21 Current of 11 input 7023 S16 0.01A 3x
th
22 Current of 12 input 7024 S16 0.01A 3x
th
23 Current of 13 input 7025 S16 0.01A 3x
th
24 Current of 14 input 7026 S16 0.01A 3x
th
25 Current of 15 input 7027 S16 0.01A 3x
th
26 Current of 16 input 7028 S16 0.01A 3x
27 Reserved 7029 - 7030 U16 3x
28 Total current 7031 - 7032 U32 See 4.3 Glossary 0.1A 3x
29 Total DC power 7033 - 7034 U32 1W 3x
30 Daily power yields 7035 - 7036 U32 0.1kWh 3x
31 Total power yields 7037 - 7038 U32 0.1kWh 3x
32 Reserved 7039 - 7040 - 3x
Work state U32 See 4.2 Definition of Work 3x
33 7041 - 7042
State
Short circuit data U32 Each bit represents one 3x
channel, starting from the
34 7043 - 7044
lowerbyte. 0: Invalid; 1:
Valid
Reverse current U32 Each bit represents one 3x
channel, starting from the
35 7045 - 7046
lower byte. 0: Invalid; 1:
Valid
High current data U32 Each bit represents one 3x
channel, starting from the
36 7047 - 7048
lower byte. 0: Invalid; 1:
Valid
Fuse blow U32 Each bit represents one 3x
channel, starting from the
37 7049 - 7050
lower byte. 0: Invalid; 1:
Valid
Low current data U32 Each bit represents one 3x
channel, starting from the
38 7051 - 7052
lower byte. 0: Invalid; 1:
Valid
39 Reserved 7053 - 7054 - 3x
40 Open circuit data 7055 - 7056 U32 Each bit represents one 3x

2/9
 channel, starting from the
lower byte. 0: Invalid; 1:
Valid
41 Reserved 7057 - 7058 - 3x
st
42 Power of 1 input 7059 U16 1W 3x
nd
43 Power of 2 input 7060 U16 1W 3x
rd
44 Power of 3 input 7061 U16 1W 3x
th
45 Power of 4 input 7062 U16 1W 3x
th
46 Power of 5 input 7063 U16 1W 3x
th
47 Power of 6 input 7064 U16 1W 3x
th
48 Power of 7 input 7065 U16 1W 3x
th
49 Power of 8 input 7066 U16 1W 3x
th
50 Power of 9 input 7067 U16 1W 3x
th
51 Power of 10 input 7068 U16 1W 3x
th
52 Power of 11 input 7069 U16 1W 3x
th
53 Power of 12 input 7070 U16 1W 3x
th
54 Power of 13 input 7071 U16 1W 3x
th
55 Power of 14 input 7072 U16 1W 3x
th
56 Power of 15 input 7073 U16 1W 3x
th
57 Power of 16 input 7074 U16 1W 3x
Note 1：
① U16: 16-bit unsigned integer
② U32---32-bit unsigned integer; little-endian for double-word data. Big-endian for byte data
③ S16---16-bit signed integer
④ S32---32-bit signed integer; little-endian for double-word data. Big-endian for byte data

Note 2
Read double-word data: little-endian
Example:
transmission order of U16 data 0x0102 is 01, 02
transmission order of U32 data 0x01020304 is 03, 04, 01, 02

Note 3
The hexadecimaladdressstarts from 0000, therefore, read the actual address by subtracting 1. For example, the decimal
address of Device type code is 7000, and the PC read address is 1B 57 rather than1B 58.

Note 4 Check type

CRC16 generates polynomial 0xA001, little-endian.

Note 5
Short circuit data, Reverse current, High current data,Fuse blow, Low current data, and Open circuit data are all U32 data,
corresponding to data of 32-input. However, only 1-16 input are used by now. Sometimes, fault is 1 and normal is 0.
For example, the return of Open circuit data is 0X00080000; according to the following table, it can be determined that
the 4th input is in open-circuit state.
Input 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
3/9
State 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

Input 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17
State 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0

3.2 Parameter setting address definition

Data type
Addr.
No. Name Address (see Note Data range Unit No.
type
1)
Password for 7000～7001 U32 Input the password for 0X55A855 - 4x
1 setting area the setting area (i.e. A9 effective
enter setting)
Password time 7002 U16 For return display only; - 1 4x
2
left no setting respond second
3 Reserved 7003～7004 U32 - - - 4x
4 Reserved 7005～7006 - - - - 4x
Actual input 7007～7008 U32 Each bit represents one Self-adaption - 4x
connected input, starting from the according to
lower byte. 0: Not the types.
5 connect; 1: Connect Default: all
(input numbers cannot connected
bigger than the max.
input numbers)
6 Reserved 7009 - 7012 - - - - 4x
7 Judge current 7013 U16 20 - 2000 200 0.01A 4x
8 Toleranceδ 7014 U16 10-1000 200 0.1% 4x
Count 7015 - 7016 U32 - 21600 - 4x
9
thresholdθ
10 Fuse type 7017 - - - - 4x
Short-circuit U16 50-5000 1400 0.01A 4x
11 7018
current
12 Reserved 7019 - - - - 4x
Note 1:
Any write-in operation to the parameter setting address areas starts with “input setting area password”, i.e. after writing
in 0X55A855A9 to address7000-7001, the parameters in address area of 7007-7047 can be set. If the address return
value for address7000-7001 read by command 03 is 0X58, the password input is correct.
The effective time is 10 minutes. After 10 minutes, the return value for address 7000-7001 is 0X00, i.e. you cannot
perform write-in operation to the parameter setting address. to operate again, you need to “input setting area password”
again.
Note 2
The default fuse specification is 15A. If you use the fuse blow function, please set the fuse class to the actual value.
Mismatched fuse specification may cause non-report or misreport “fuse blow” fault.
4/9
Note 3
There can be no background software “parameter setting” function. Even there has such function, it is not available to
the plant operators unless they has high level managing rights or password.

4. Definition of State and Glossary

4.1 Definition of digit input

Bit State State code

0: Fault
bit 0 SPD state
1: Normal
bit 1 Reserved -
bit 2 Reserved -
Switch trip or off 0: ON
bit 3
(optional, supported by hardware) 1: Trip or OFF
4.2 Definition of work state

Bit State State code State Alarm Fault

bit 0 ---- ---- ---- ---- ----
bit 1 ---- ---- ---- ---- ----
0: Normal
bit 2 SPD fault ---- ---- Fault
1:Fault
0: Normal
bit 3 High internal temp. ---- ---- Fault
1:Fault
0: Normal
bit 4 High DC voltage ---- ---- ----
1:Fault
0: Normal
bit 5 Short-circuit ---- Alarm ----
1:Fault
0: Normal
bit 6 High current ---- Alarm ----
1: Alarm
0: Normal
bit 7 Low current ---- Alarm ----
1: Alarm
0: Normal
bit 8 Open circuit ---- Alarm ----
1: Alarm
0: Normal
bit 9 Reverse current ---- ---- Fault
1:Fault
0: Normal
bit 10 Fuse blow ---- ---- Fault
1:Fault
bit 11 Reserved ---- ---- ---- ----
bit 12 Reserved ---- ---- ---- ----
0: Normal
bit 13 Switch trip State ---- ----
1: Trip
Note 1. The max. alarm internal temperature is 80.0℃.
5/9
4.3 Glossary
Max. current
The max. current among the currents of the n inputs that are actually connected.

Average current
The mean of the sum of the n inputs that are actually connected.
Total current
The sum of the currents of the n inputs that are actually connected.

Actual input connected

4 bytes and each bit represents one input. 0: Not connect; 1: Connect. According to the field cable connection situation,
set the unconnected input number to 0 so that device will not detect the fault state of this input and thus to reduce false
report. Ignore this address if all inputs are connected.

Judge current
Fault detection function is closed automatically when the average current is smaller than the judge current. The default
judge current is 2 A.

Toleranceδ
Toleranceδ is to check the monitoring sensitivity of the string current, i.e. degree that the string current can deviate from
the average. When the string current exceeds the Tolerance limit, overcurrent or undercurrent fault alarm of this input
will be reported. Default value is 20%.
For example: suppose the average current is 5.0A, the defaulttolerance is 5* (1+0.2) =6A; 5* (1-0.2) =4A. The software
of the combiner box will take the current higher than 6A as “Overcurrent” and lower than 4 A as Undercurrent.

Short-circuit current
Short-circuit fault occurs when the string current is higher than the short-circuit current. The default value is 11.00A, or
set according to the short-circuit specification of the string PV panels in series connection

5. Examples
5.1 Read one piece of information (e.g. internal temperature)

Send data: 01 04 1b 5e 00 01 56 fc

Sequence Content Explanation

0 01 Address of the combiner box
1 04 Read command word
2-3 1b 5e Read the address of internal temperature 7007 (actual
send address 1b 5e)
4-5 00 01 Length, read one register
6 56 CRCL
7 1C CRCH

Replayed data by the combiner box: 01 04 02 01 26 39 7A

6/9
 Sequence Content Explanation
0 01 Address of the combiner box
1 04 Read command word
2 02 Return 2 bytes
3-4 01 26 internal temperature: 29.4
5 39 CRCL
6 7A CRCH

5.2 Read all data

Send data: 01 04 1b 57 00 3b 06 ed
Sequence Content Explanation
0 01 Address of the combiner box
1 04 Read command word
2-3 1b 57 Read from the first byte of address 7000
4-5 00 3B Length, read 95 registers
6 06 CRCL
7 ED CRCH

Data replayed by the combiner box: 01 04 76 00 D1 00 10 00 00 01 03 00 00 00 00 16 26 01 27 00 00 00 00 00 08 BA

54 0E 7C 02 DF 02 E4 02 EB 02 F0 02 F6 02 FC 03 02 03 07 03 0E 03 13 03 18 03 1F 03 24 03 29 03 30 BA 54 00 00
00 00 17 2D 00 00 22 42 00 01 00 49 00 00 4C 0E 00 55 00 00 00 00 20 25 00 00 80 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1E 67
Sequence Content Explanation
0 01 Address of the combiner box
1 04 Read command word
2 76 Return 118byte registers
3-4 ….. Analyze according to protocol
….. ….. Analyze according to protocol
119 ….. Analyze according to protocol
120 ….. Analyze according to protocol
121 1E CRCL
122 67 CRCH

5.3Set actual connected input

The parameters can be setonly after entering the correct password.
For combiner box with 16 input, if only connect the 1st -14th input and leave the 15th and 16th not connected, the data
value are 0011 1111 1111 1111.
Send data: 01 10 1b 5e 00 02 04 3f ff 00 00 f5 cb
Sequence Content Explanation
0 01 Address of the combiner box
1 10 Write multi-register command word
2-3 1b 5e Write from address 7007
4-5 00 02 Write 2 registers
6 04 Write 4 bytes

7/9
 7-8 3f ff He 15th and 16th input are not connected among the
1st-16th input
9-10 00 00 17th-32th are not connected
11 F5 CRCL
12 cb CRCH

5.4Change the judge current to above 2.5 A

The parameters can be setonly after entering the correct password.
Send data: 01 06 1b 64 00 FA 00 10
Sequence Content Explanation
0 01 Address of the combiner box
1 06 Write 1 register
2-3 1b 64 Address 7013
4-5 00 FA Content: 250, i.e. 2.50A
6 00 CRCL
7 10 CRCH

5.4Change the Tolerance to 22%

The parameters can be setonly after entering the correct password.
Send data: 01 06 1b 65 00 dc 9e a8
Sequence Content Explanation
0 01 Address of the combiner box
1 06 Write 1 register
2-3 1b 65 Address 7014
4-5 00 dc Content: 220, i.e. 22%
6 9e CRCL
7 A8 CRCH

5.4Change the short-circuit current to 10 A

The parameters can be setonly after entering the correct password.
Send data: 01 06 1b 69 03 E8 5f 8c
Sequence Content Explanation
0 01 Address of the combiner box
1 06 Write 1 register
2-3 1b 69 Address: 7018
4-5 03 E8 Content: 1000, i.e. 10.00A
6 5f CRCL
7 8c CRCH

5.7 Read the parameter setting area

For example:
To read the short circuit current, you need to use the 03 command word.
Send data: 01 03 1b 69 00 01 52 f2
Sequence Content Explanation

8/9
 0 01 Address of the combiner box
1 03 Read command
2-3 1b 69 Address 7018
4-5 00 01 Read 1 register
6 52 CRCL
7 F2 CRCH

Data replayed by the combiner box: 01 03 02 03 E8 B8 FA

Sequence Content Explanation
0 01 Address of the combiner box
1 03 Read command
2 02 Return 2 bytes
3-4 03 08 Content: 1000, i.e. 10.00A
5 B8 CRCL
6 FA CRCH

9/9