EMCP III Mod Bus
EMCP III Mod Bus
WIRING
SCADA COMMUNICATION wires are brought out of the EMCP 3 GSC as part of the 70-pin AMP
connector. Table 12 shows the pins on the AMP connector.
MODBUS DATA TRANSMISSION over RS-485 is accomplished over a single shielded twisted pair
for differential signaling with transmit and receive alternating over the same wire pair
(MODBUS+ and MODBUS-). The Reference (MODBUS REF) should be connected to the
shield, to prevent ground loop currents.
FIGURE 71 shows a possible wiring configuration to a RS-485 device.
FIGURE 72 shows a possible wiring configuration to a RS-485 to RS-232
converter.
EMCP 3 RS-485
70-pin DB-9
connector connector
MODBUS - 3 5 TxD/RxD-
* *
MODBUS + 5 9 TxD/RxD+
RS-485
to RS-232
EMCP 3 converter
70-pin
connector TD A (-)
MODBUS - 3 RD A (-)
* *
MODBUS + 5 TD B (+)
COMMON
LINE TERMINATION
Both ends of the Modbus lines (or the extreme ends of the trunk, for a multipoint network)
should have termination between MODBUS+ and MODBUS-.
A 0.5W 150 resistor may be adequate.
If line polarization is implemented (see Software Configuration Chapter below), a better choice
is a 10 F capacitor (10V minimum) in series with a 0.25W 120 resistor.
NOTE: For more details on setting up a Modbus network over a serial line, please
refer to RS-485 specifications or Modbus specifications. See the Software
Configuration Chapter below for instructions on enabling line polarization.
SOFTWARE CONFIGURATION
The SCADA DATA LINK may require software configuration. The configuration parameters are
accessible on the EMCP 3 GSC via the following menu options:
MAIN MENU
CONFIGURE
SETPOINTS:
NETWORK
DATA LINK - SCADA
BAUD RATE options are the following: 2400, 4800, 9600, 14400, 19200, 28800, 38400, 57600,
and 115200 baud. (115200 baud is not currently supported).
PARITY can be set to None, Even, or Odd parity.
The SLAVE ADDRESS is a unique address for each slave on the Modbus data link. This address
is referenced in the data messages, described in the Data Link Layer section below. The slave
(EMCP 3 GSC ) will only respond to messages addressed to its particular slave address, or to
global requests. This address can be set to any integer from 1 to 247.
The CONNECT TIMEOUT INTERVAL is the amount of time the EMCP 3 GSC will wait between
message transmissions before it resets the SCADA security level. If a SCADA PASSWORD has
been set, this timeout will disallow any further SCADA reads/writes until the proper password is
written.
The RS-485 BIAS RESISTOR provides line polarization. Line polarization helps prevent noise and
external interference. The data terminals of the EMCP 3 GSC are internally opto-coupled, and
therefore line polarization is not required for the EMCP 3 GSC. However, other devices may
require line polarization. To polarize the line, the EMCP 3 GSC Modbus terminals have
hardware-selectable passive pull-up / pull-down lines. Only a single device on a Modbus
network should have line polarization.
In addition to these setpoints, SCADA access can be restricted by means of assigning a
SCADA PASSWORD (register 724). For more information, see Chapter 21.1 DATA LINK
SECURITY.
NOTE: Modbus register addresses are referenced starting with register 1, whereas
data link requests begin at 0. This results in an offset of 1 in the register
address. For example, to request the parameter Generator Overall Power
Factor, which resides in Modbus register number 103 ($67), a register
address of $66 must be sent.
DATA STRUCTURE
COMMUNICATION
Modbus communication is comprised of data packets. A packet is a set of bytes transmitted
consecutively and interpreted as one message, and can vary in length. A packet is sent with
byte offset 0 first, and the data is sent with the most significant byte first. Every packet shares a
common structure, which is shown in Table 13 Modbus Packet Format. Only the Data field has
a variable length, depending on the function being performed and the amount of data being
transmitted.
ERROR CHECKING
In EMCP 3 GSC SCADA communications, various levels of error-checking are performed.
The Modbus data link protocol allows for BYTE-LEVEL ERROR CHECKING and PACKET-LEVEL
ERROR CHECKING.
FAULT RESPONSE
Once the addresses and function codes are checked, the data is ready to be handled by the
EMCP 3 GSC application software. There is error-checking, at this level, is to determine
whether there are any application-specific errors.
For example: if you are attempting to write 101% into a register that is defined to hold 0-100%,
then, even though the data may fit into the register (and therefore passes the previous error-
checking), the application does not accept an input of 101%, and therefore a FAULT RESPONSE is
sent.
This fault response is called a FAULT IDENTIFIER, or FID.
A fault response is data that is valid over the Modbus data link, but the EMCP 3 GSC and the
Modbus Master device agree to reserve for use as an FID.
PARITY CHECK
Parity checking uses standard even or odd parity. The parity can be set in the EMCP 3 GSC to
even, odd, or none. Parity checking occurs at the byte-level. Upon successful parity check, the
checked byte is accepted as part of the transmitted message. If the parity check fails, the byte
is discarded.
EXCEPTION RESPONSES
Upon a parity or CRC error, the byte or message (respectively) is discarded. If neither of these
errors occurs, the read/write status is checked. An EXCEPTION RESPONSE will be sent if there is
a read/write error.
If the register cannot be read from or written to at a particular time due to some application
software state, it will not generate an Exception Response. Instead, the application layer will
respond with data that is in the Fault Identifiers (FID) range.
An Exception Response contains a function code that is related to the function code the EMCP
3 GSC is responding to; its value is [128 + Function Code for Query]. Any function code 128
($80) or higher is an Exception Response.
128+ ($80 AND ABOVE) – EXCEPTION RESPONSE TO UNSUPPORTED QUERIES
The EMCP 3 GSC does not support any function codes not listed above in the Supported
Function Codes Chapter. Such queries will return an exception response with this exception
code.
EXCEPTION CODE REASON
01 Unsupported function code
Range Boolean
1-Register Data 2-Register Data Notes
Name Data†
Valid Data 0, 1 0 64,255 0 See individual Parameter
4,211,081,215 Descriptions for units, offset,
$0000 or $0000 $FAFF $00000000 and scaling to convert to
$0001 $FAFFFFFF physical units
Not Used 2-65532 65,256 65,023 4,211,081,214 These data ranges are not
$0010 - $FB00 $FDFF $FB000000 used.
$FFFC $FDFFFFFF
Error 65533 65,024 65,279 4,261,412,864h FID: Signal saturated, out of
4,278,190,079h range, or error from source
$FFFD $FE00 $FEFF $FE000000 transmitter
$FEFFFFFF
Not 65535 65280 65535 4,278,190,080 FID: Parameter is not
Available / 4,294,967,294 applicable in the current state,
Not $FFFF $FF00 $FFFF $FF000000 not available from the
Requested $FFFFFFFF controller, or not requested
Note that 2-bit data is not transmitted individually, but rather within a register.
FIGURE 73 shows the default control panel, provided with the EMCP 3 Monitoring Software.
Control Panels can be edited or created, as shown in Chapter 19.3, Creating A Control Panel
View.
For Device Name, enter a name of your choosing for the device and then select the device type
and the node address as shown in FIGURE 75. Make sure that the node address matches the
SCADA Data Link Slave Address setpoint on the EMCP 3 GSC.
The setpoint can be found from the main menu by making the following selections: Configure >
Setpoints > Network > Data Link SCADA.
Check the online configuration settings by selecting Network > Online Configuration or again by
right clicking on the cable symbol and selecting Online Configuration. Verify that the connection
interface is correct and that the baud rate and parity match the settings on the EMCP 3 GSC as
shown in FIGURE 76. On the EMCP 3 GSC, these settings can be found from the main menu
by making the following selections: Configure > Setpoints > Network > Data Link SCADA.
To create a simple test, select Edit > Control Panel Configuration. In this control panel, a digital
display showing battery voltage will be added to verify that a connection between the EMCP 3
GSC and the software has been established. (Simply telling the software to Go Online does not
verify a connection. This is because the software will appear to successfully go online whether
or not a connection is present).
Select Edit > Add Control > Digital Display or click the Digital Display button on the toolbar. To
add the control, double click on the desired location within the control panel. This will add the
digital display as shown in FIGURE 77.
After adding the display, it needs to be set to display battery voltage. Right click on the display
and select Set Parameter Association. This will bring up a Control Configuration window as
shown in FIGURE 78.
Under Device/Group, select the previously named device (ENG in this example) and all of the
possible parameters for the digital display will be shown in the Parameter List.
Double click on Battery Voltage to select it. This can be seen in FIGURE 79.
Make sure to double click the parameter or it will not be selected. Also, it shows up under
Selected Parameter after it has been selected.
Click ok and the parameter will be set.
Now that the parameter is set, save the document by selecting File > Save or click the Save
button on the toolbar.
Select a location and name for the file and click save. The control panel should now look similar
to FIGURE 80.
Close the Control Panel Edit window by selecting the X in the top right corner of the window.
Make sure to close only the control panel window and not the program. Select View > Control
Panel Data to bring up the Control Panel View window. This is shown in FIGURE 81.
To test the connection, select Network > Go Online or right click on the cable symbol in the top
left corner (where it says Offline) and select Go Online. This tells the computer to begin the
connection and within a few seconds the battery voltage should be displayed. It should look
similar to FIGURE 82.
If the battery voltage is reading correctly, then the connection is working properly and it is time
to begin designing the control panel view. If not, first make sure that the window being
displayed is the Control Panel View window and not the Control Panel Edit window.
Also, recheck all settings mentioned at the beginning of this setup chapter. Finally, check the
wiring for any possible problems.
Another simple test is to select the View Current Events button from the toolbar and it should
display all events currently listed on the EMCP 3 GSC.
Using the scroll bar on the right, scroll down until you see EMCP Monitoring Software in the left
column. The next column is title EMCP Monitoring Software.zip and to the far right is the link
Additional Info. Click on it for the Quick Start Guide.
At the bottom of the text, select: ECMP monitoring software QUICKSTART ver1_ 0,doc to
start the download.
Select OPEN to start a document editor and display the Quick Start Guide or SAVE to a folder.
NOTE: The monitoring software allows the use to create new control panel views by
selecting which parameters to display and in what format (circular gauge,
numeric display, etc). then save the configuration to a file. A Default
configuration file is supplied is supplied with the monitoring software and the
file name default.pvc contains basic screens with standard parameters
already built in . The user can modify the file and save as a new file if
desired
To add new controls and displays simply click the proper button on the toolbar and then double
click within the control panel. Controls can also be chosen by selecting Edit > Add Control and
choosing a control from the list.
There are three types of controls available displays, switches and LEDs. The display controls
consist of the circular gauge, digital display, thermometer and linear gauge. These displays can
be used to display information about the generator set. Some examples include engine coolant
temperature, generator total real power, engine RPM and battery voltage. This can be seen in
FIGURE 84.
The switches consist of the sliding switch, panel switch, lever switch, rocker switch, single
button and rotary switch. The rotary knob and the multiple button switch also fall into this
category. These switches can be used to control something that is either off or on. Some
examples include emergency stop, remote initiate command and digital selectors. The multiple
button switch can also control the engine operating mode command as in FIGURE 85.
The LEDs consist of the single LED and the multiple LED control. These LEDs are used to
display outputs from the genset. Some examples include digital input active state and engine
operating mode (see FIGURE 86).
After adding controls to the control panel, they can be moved and resized. To move a control,
simply click and drag it to its desired location. To resize it, select the control by clicking on it
and then move the mouse to the edge of the control until the pointer becomes an arrow. Then,
just simply click and drag it to its desired size as shown in FIGURE 87.
Other display properties can be changed for any of the controls by right clicking on the control
and selecting Set Display Properties. For example, the font size and color for the digital display
can be changed as shown in FIGURE 88.
Each control has different parameters that can be associated with it. To change the parameters
follow the instructions in the setup Chapter. This time, however, select any desired parameter.
The possible parameters can also be viewed under the following categories: block types,
control, engine, generator, I/O and status.
To do this, click the + next to the device name in the Device/Group window and select the
desired category as shown in FIGURE 89.
Remember to double click the desired parameter to select it. Click ok and the parameter will be
set. This can be seen in FIGURE 90.
After selecting a desired parameter, the displayed text can be changed by right clicking on the
text box and selecting Set Text or simply by double clicking on the text. This change can be
seen in FIGURE 91.
The background of the control panel can also be changed. Right click on an empty space in the
control panel and select Set Background Image or select Edit > Set Background Image. To
change the background to a simple color, open Paint and create a screen of the desired color.
Then save it and open it as the background image.
The controls and text can also be set to transparent. This is done by right clicking on the
desired item and selecting Display Transparent. These changes can be seen in FIGURE 92.
Tabs can also be used on the control panel. To rename the current tab select Edit > Rename
Selected Tab. To add another tab select Edit > Add Tab. To edit the new tab, simply click that
tab and the new sheet will open. This can be seen in FIGURE 93.
NOTE: When using multiple tabs, the parameters for each control should be set after
moving and resizing them. If this is not done, the control may go back to its
original position when the parameter was first set and possibly corrupt the
entire tab. This is not necessary for the first tab, only the following ones.
If moving or resizing a control after setting the parameter is necessary, move it to the desired
location and then RESET the parameter again. This will RESET its standard position and prevent
the control from moving. Be sure to RESET the parameter for any control that has been moved.
Again, this is not necessary for the first tab.
To view this data select View > Data Log Data. This will bring up a new screen as shown in
FIGURE 95. If the data value says Offline, be sure to go online as described in the software
setup Chapter. Once online, select Data Configuration > Arm or press the play button on the
toolbar to begin receiving the data.
This data can also be logged to a file. First, go back to the Data Log Configuration window by
selecting Edit > Data Log Configuration. On the right side of the screen where the parameters
are located, select the Data Storage tab. Write the desired name and location of the file into the
box next to Log File or click browse to select the name and location. This can be seen in
FIGURE 96.
Select the Triggering tab to choose the start and stop events. For the start event, select either
On Arm, Manual Trigger, or Absolute Time. On Arm will start the data collection immediately
after selecting Arm or after clicking the play button. Manual Trigger will begin the data collection
once the manual trigger button on the toolbar has been pushed or by selecting Data
Configuration > Start Trigger. Absolute Time will begin the data collection at the specific data
and time specified. The stop event can be configured for Manual Trigger, Duration, or Absolute
Time. Manual Trigger will stop the data collection once the manual trigger button is clicked or by
selecting Data Configuration > Stop Trigger. Duration will stop collecting data as soon as the
specified amount of time has passed.
Absolute Time will stop the data collection once the specified date and time is met.
After the data has been collected, the text file can be opened. Find the saved file and open it in
a text editor such as notepad. The file will contain a timestamp from the start of data logging as
well as data captured according to the Base Scan Rate setting in the Data Log Configuration
window shown in FIGURE 96. The file should look similar to the one shown in FIGURE 97.
The new application software flash file for the target module
The J1939 Primary data link service connector must be used for modules connected to
the J1939 Primary Data Link.
The J1939 Accessory data link service connector must be used for modules connected
to the J1939 Accessory Data Link.
See Chapter 12.1 SAVING EMCP 3 CONFIGURATION DATA for instructions. The
procedure given there is for the EMCP 3 GSC; the process is similar for each of the
EMCP 3 modules.
NOTE: Flashing application software does not affect the setpoints. However,
should a problem occur during flashing, this backup can be used to
quickly configure a replacement module and minimize downtime.
NOTE: This is useful in case the customer wishes to roll back to the previous
version, this information can be used to obtain the correct flash file.
NOTE: Occasionally, WinFlash will not find all of the modules on the J1939 data
link to which it is connected. If you are certain that the target module is
connected to the same J1939 data link, you may attempt to re-scan the
data link by pressing F8 (or selecting File > Update ECM List).
8. Begin flashing
Click on Begin Flash at the bottom of the window.
This process may take up to 10 minutes, depending on the file size and connection
speed. Typically, the EMCP 3 GSC application flash file will take 5-10 minutes, and the
other modules will take less time.
NOTE: The flashing process will abort at this step if the EMCP 3 is not
STOPPED, or if an incorrect version of software was selected.
This includes EMCP 3.1 versus 3.2 versus 3.3 software.
9. Complete
When the flashing process is complete, the ECM that was flashed will reboot. Also,
WinFlash will bring up a window giving options for what to do next (see FIGURE 104
below). This indicates that the software has finished flashing, and is ready to use.
The EMCP 3 GSC will automatically reboot If it was the module that was flashed with
new application software.
On startup, the EMCP 3 shows the software part number.
Verify the software part number matches the new application software that was flashed
(FIGURE 105).
NOTE: The display and SCADA can be at different access levels at the same time.
The EMCP 3 GSC supports five levels of SCADA access, with increasing permissions:
NO ACCESS
This level only allows access to two registers: Current Security Level (732), and Write Access
Password (700). Any other read queries will return unavailable data ($FFs), and write queries
will fail with an exception response.
LEVEL 0 ACCESS
This level allows access to all Modbus registers. However, none of the setpoints can be written
with this access level. See Chapter 7 for information about programming EMCP 3 GSC
setpoints via Modbus.
LEVEL 1 ACCESS
This level allows access to all Modbus registers. It also allows the changing of setpoints that
have a security level of Level 1. See APPENDIX D for information about setpoints and their
associated security levels.
LEVEL 2 ACCESS
This level allows access to all Modbus registers. It also allows the changing of setpoints that
have a security level of Level 1 or 2. See APPENDIX D for information about setpoints and their
associated security levels.
LEVEL 3 ACCESS
This level allows access to all Modbus registers. It also allows the changing of setpoints that
have a security level of Level 1, 2 or 3. See APPENDIX D for information about setpoints and
their associated security levels. The Caterpillar Dealer TC must be contacted to acquire a Level
3 Password.
NOTE: If a password for a certain security level is not configured, or set to a single
zero, that password is disabled. If access to the level below that is acquired,
the EMCP 3 GSC will automatically grant access to the higher (password-
disabled) level. For example, if there is a password configured for Level 1,
but not for Level 2, then the EMCP 3 GSC will initialize to Level 0. Then if
the correct Level 1 password is entered, the EMCP 3 GSC will automatically
grant Level 2 Access.
The SCADA, Level 1, or Level 2 passwords can be changed by writing the new password to the
SCADA Password, Level 1 Password, or Level 2 Password register, as long as the SCADA data
link is at a sufficient access level.
To change the Level 1 password, Level 1 access must be obtained.
To change the SCADA or Level 2 passwords, Level 2 access must be obtained.
A higher level of access can be requested by writing the password of the desired
level to the Write Access Password register.
A lower level of access can be requested simply by entering the desired security
level number into the Write Current Security Level register.
All of the passwords, as well as the phone-in prompt, use the 1-byte ASCII format and character
set. Each string is variable in length, so in order to enter a shorter password, the rest of the field
may be padded with the space character ($20).
All other characters are considered invalid data, and will result in a FID response.
Two of the built in timeout features will reset the security level after a period of inactivity:
The first is the Level 0 Timeout, which resets the SCADA access level to level 0 (or the lowest
unprotected level above level 0) after 10 minutes without any successful write commands over
the SCADA data link. To prevent this fixed timer from expiring without risking affecting functions
of the EMCP 3 GSC, writing to the Key Press register (310) will reset this timer.
The second is the SCADA Timeout, which resets SCADA access completely below the SCADA
security level (or the lowest unprotected level). The timeout for this is configurable from 0.1
seconds to 1 hour it is the SCADA Data Link Connection Timeout Interval setpoint, and will
only expire after a period without ANY activity on the SCADA data link.
LEVEL 1 PASSWORD
$02C4 (708) - 8 REGISTERS (16 BYTES) LONG - WRITE
Modbus register to which a new Level 1 password is written, to change the password.
This is allowed only if current security level is 1 or higher.
ASCII data, numbers (characters $30 through $39) valid. To disable this password, enter a
single zero. If a password is less than 16 characters long, pad the end with space characters
($20). See APPENDIX A for a programming example.
Level 2 Password
$02CC (716) - 8 REGISTERS (16 BYTES) LONG - WRITE
Modbus register to which a new Level 2 password is written, to change the password.
This is allowed only if current security level is 2 or higher.
ASCII data, numbers (characters $30 through $39) valid. To disable this password, enter a
password of a single zero. If a password is less than 16 characters long, pad the end with
space characters ($20).
SCADA PASSWORD
$02D4 (724) - 8 REGISTERS (16 BYTES) LONG - WRITE
Modbus register to which a new SCADA password is written, to change the password.
This is allowed only if the current security level is 2 or higher. The SCADA password allows the
user to obtain Level 0 Access to the EMCP 3 GSC. See APPENDIX A for a programming
example.
ASCII data, numbers (characters $30 through $39) valid. The SCADA password may be a
maximum of 8 characters long. The last 8 characters should be set to NULL ($00) or space
($20). To disable this password, enter a password of a single zero.
KEY PRESS
$0136 (310) - 1 REGISTER (2 BYTES) LONG - WRITE
Triggers a key press event on the control.
The key press event is useful to reset the SCADA security level reset timer, which resets the
SCADA access to level 0 after 10 minutes of inactivity. Reading from Modbus registers will not
reset the above timers, but writing to any Modbus register will do so. This is a safe register to
write, since it does not affect other functions of the EMCP 3.2
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
Temperature
Pressure
Based on the type configuration, it can be assigned to a particular SUSPECT PARAMETER
NUMBER (SPN), and the PERCENTAGE (level), TEMPERATURE, or PRESSURE can be read over
SCADA with the appropriate units.
If the configuration is set to a specific sensor type and SPN but, a request is made over SCADA
for a different type or SPN, then $FFFF will be sent in the response.
For example:
If Type Configuration is set to TEMPERATURE, and SPARE ANALOG INPUT PRESSURE is
queried, the response will be $FFFF
If Suspect Parameter Number is set to OIL FILTER DIFFERENTIAL PRESSURE, and AIR
FILTER 1 DIFFERENTIAL PRESSURE FROM I/O PIN is queried, $FFFF will be returned.
On the EMCP 3 GSC, the Source Configuration for each digital selector can be configured to
input 1 through 10, or Data Link. Each Digital Selector has one Modbus register to read the
Digital Selector #n Commanded Value, and one to write a Digital Selector #n Activate
Command.
These queries will only affect or reflect the outputs if the Digital Selector #n Source
Configuration setpoint is set to Data Link.
Otherwise, these queries will set or read the SCADA command, but the EMCP 3 GSC will not
use that command, and therefore the values will be meaningless.
All of these registers have the same data structure and bit definitions.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
All of these registers have the same data structure and bit definitions.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
00 = FALSE
01 = TRUE
All of these registers have the same data structure and bit definitions.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
All of these registers have the same data structure and bit definitions.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
Indicates whether the engine ECM is in communication with the EMCP 3 GSC via J1939.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
THERMOCOUPLE #1 ONLINE
$044B (1099) - 1 REGISTER (2 BYTES) LONG - READ
Indicates whether the thermocouple module instance #1 is in communication with the EMCP 3
GSC via J1939.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
THERMOCOUPLE #2 ONLINE
$044C (1100) - 1 REGISTER (2 BYTES) LONG - READ
Indicates whether the thermocouple module instance #2 is in communication with the EMCP 3
GSC via J1939.
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
Temperature of combustion byproducts within the left engine exhaust manifold, as received
from another module on the J1939 Data Link.
RESOLUTION OFFSET DATA RANGE
0.03125 C / bit -273 C -273 to 1735 C
LOG ENTRY
$040A (1034) - 14 REGISTERS (28 BYTES) LONG - READ
Reads the entry of the Genset Control Log as specified by the Log Entry Index Modbus register.
For a list of the SPN/FMI combinations supported, please refer to the Systems Operation,
Troubleshooting, Testing and Adjusting manual.
(Register numbers listed below are offsets from the starting register number of this parameter,
given above).
This is a legacy parameter, and has been superseded by the Module Event Log Entry #
parameters.
Register 13 = Log Entry Index (for data format, see Log Entry Index parameter)
Register 12:11 = SPN/FMI
Bits 31:24 = UNUSED
Bits 23:5 = SPN
Bits 4:0 = FMI
Register 10 = Flags / Count
Bits 15:12 UNUSED
Bits 11:8 Event Status:
Bits 0000 = Inactive, 0100 = Active, 0101 = Present, 1111 = Unavailable
Bits 7:0 Occurrence Count
RESET EVENT
$0418 (1048) - 2 REGISTERS (4 BYTES) LONG - WRITE
SCADA command to reset a single EMCP 3 GSC interval event, identified by the SPN and FMI
numbers.
For a list of the SPN/FMI combinations supported, please refer to the Systems Operation,
Troubleshooting, Testing and Adjusting manual.
Bits 31:24 = UNUSED
Bits 23:5 = SPN
Bits 4:0 = FMI
Read this register to determine which module events are currently accessible via the Module
Event Log Entry # parameters (registers 1500 through 1576).
Module definitions are the same as for the Event Log Module Selection Command parameter
(register 1498).
All of these parameters have the same data structure. Register numbers are offsets from the
base register address given above:
Register 13 = Log Entry Index (0 through 19)
Register 12:11 = SPN/FMI
Bits 31:24 = UNUSED
Bits 23:5 = SPN
Bits 4:0 = FMI
Register 10 = Flags / Count
Bits 15:12 UNUSED
Bits 11:8 Event Status: 0000 = Inactive, 0100 = Active, 0101 = Present, 1111 =
Unavailable
All of these parameters have the same data structure. Register numbers are offsets from the
base register address given above:
Register 9:8 = Last Hourmeter
RESOLUTION OFFSET DATA RANGE
0.05 hour / bit 0 hr 0 to 210554060.75 hours
ENGINE RPM
$00CB (203) - 1 REGISTER (2 BYTES) LONG - READ
Actual engine speed, calculated over a minimum crankshaft angle of 720 degrees divided by the
number of cylinders.
To read a setpoint data or related information, first the Setpoint ID for Read parameter must be
set to the appropriate Setpoint ID.
Then, either the Setpoint Information parameter or Setpoint Data Value parameter can be read.
Setpoint Information contains various pieces of information regarding the setpoint, as detailed
below.
To write to a setpoint, the Setpoint Write parameter must be sent, which contains both the
Setpoint ID and the data value.
Immediately prior to reading setpoint information, the Setpoint ID field should be checked to
verify that the correct setpoint is being read.
The Setpoint ID and Setpoint Information parameters contain multiple pieces of information, and
span multiple Modbus registers. The registers may be read separately, but caution should be
taken to maintain integrity of the data being read.
The list of blocks supported on the EMCP 3 GSC are given in APPENDIX C.
The list of setpoints as well as security and data format information are given in APPENDIX D.
For the setpoints which use Setpoint Value Lists, the list of values and their meanings is given in
APPENDIX E.
Setpoints are stored as a 32-bit signed integer value, using 2s complement to represent
negative values. This is a standard data type in computer programming, termed INT32. It can
represent integer values from negative 2,147,483,648 to positive 2,147,483,647; that is,
hexadecimal $ 80 00 00 00 to $ 7F FF FF FF. Other conversion examples:
Decimal -1 = $ FF FF FF FF
Decimal 0 = $ 00 00 00 00
Decimal 1000 = $ 00 00 03 E8
Decimal -1000 = $ FF FF FC 18
SETPOINT INFORMATION
$03ED (1005) - 12 REGISTERS (24 BYTES) LONG - READ
Reads the setpoint information structure associated with the setpoint specified by the Setpoint
ID for Read Modbus register, see APPENDIX A: SCADA Programming Examples.
(Register numbers listed below are offsets from the starting register number of this parameter,
given above).
Register 11:9 = Setpoint ID
Register 8 = Access Level needed to modify
Register 7:6 = Value
Register 5:4 = Minimum
Register 3:2 = Maximum
Register 1:0 = Resolution
SETPOINT WRITE
$03F9 (1017) - 5 REGISTERS (10 BYTES) LONG - WRITE
Writes a specific Setpoint ID and value to change a setpoint.
(Register numbers listed below are offsets from the starting register number of this parameter,
given above).
Register 4:2 = Setpoint ID
Register 1:0 = New Value
21.11 MISCELLANEOUS
BATTERY VOLTAGE
$00CA (202) - 1 REGISTER (2 BYTES) LONG - READ
Measured electrical potential of the battery voltage at the control.
The EMCP 3 GSC can report the voltage of the supply that is powering it over the data link by
means of the Battery Voltage parameter. This is usually the cranking battery or batteries. Note
that the voltage is read at the EMCP, not at the battery terminals. For high power draw cases,
this voltage may be noticeably lower than the voltage at the battery terminals. See APPENDIX A
for a programming example.
RESOLUTION OFFSET DATA RANGE
0.05 V / bit 0V 0 to 3212.75 V
BIT DEFINITIONS:
00 = FALSE
01 = TRUE
BYTES 1-11: ASCII data, characters $30 through $5A valid (numbers and capital letters).
String terminates with a NULL character ($00).
EXAMPLE: Reading the Control Serial Number would return the following:
$0A31 3738 3342 3030 3648 5100
Reply: $ 01 03 02 01 FD xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (Read Registers).
$ 02 = byte count (2 bytes 1 register).
$ 01 FD = 509. 509 * 0.05 V/bit = 25.45V.
ENGINE STATUS
Lets consider the reply under two different conditions to the following request for Engine Status.
Request: $ 01 03 04 1C 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 1C (1 bit offset) $ 04 1D Engine Status
Condition 1
If the engine RPM is set to 15 and the mode is Auto and there is not a remote start signal from
any source, then the EMCP 3 GSC display reads Stopping, and the following is the reply to the
above Modbus request:
Reply (1): $ 01 03 02 00 03 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (Read Register)
$ 02 = byte count (2 bytes = 1 register)
$ 00 03 = 3 = Ready in Auto
The Engine Status is Ready in Auto because the engine RPM is below the Crank Terminate
RPM setpoint. (The minimum value of the Crank Terminate setpoint is 100 rpm).
Condition 2
If the engine RPM is set to zero, the mode to Stop, and the oil pressure below 80kPa, then the
EMCP 3 GSC display reads Stopped, and the following is the reply to the above Modbus
request.
Reply (2): $ 01 03 02 00 00 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (Read Register)
$ 02 = byte count (2 bytes = 1 register)
$ 00 00 = 0 = Not Ready to Go
The Engine Status is Not Ready to Go, which indicates that the control is in Stop mode, and is
not ready to be started via a Remote Initiate command.
Now, wait for the duration of the Level 0 Timeout, which is 10 minutes, without doing any writes
over SCADA. Repeat Step 1 to verify that the current security level is now zero. The reply
should be as follows:
Reply: $ 01 03 02 00 00 xx xx
The level is now zero. Now, disconnect from SCADA completely (i.e. no reads nor writes) for
the duration of the SCADA Timeout, which depends on the SCADA Data Link Connect Timeout
Interval setpoint. If the timeout interval is set to the default of 30 seconds, then wait for 30
seconds, and then reconnect. Repeating Step 1, the reply should be as follows:
Reply: $ 01 03 02 FF FF xx xx
This is the correct response. No read or write can be done to any register since the SCADA
access has timed out, with a couple of exceptions such as the Write Access Password register.
Knowing the password to any level, it can be entered and therefore, be granted access to
SCADA. Now, enter the SCADA password that we set in Step 3:
This verifies that the SCADA password worked, and did indeed give access to level 0 security.
Notice that the level did not increase to 1 or 2 because a level 1 password is set. If the level 1
password is entered, access level 2 would be granted because there is no level 2 password set.
Also, the first space terminates the string, so an entry of 12 3 (space between the 2 and the 3)
will return an exception because only spaces (or nulls, after the first 8 bytes) are accepted after
the first space.
For example: to change the Low Engine Oil Pressure Warning Event Threshold to 327.8 kPa:
1. Check the RESOLUTION. The setpoint will be rounded to the nearest 1 kPa (round
327.8 kPa to 328 kPa).
2. Next, make sure it is within the MIN and MAX range (34 to 690). It is (328 kPa).
3. Look at the SCALING and multiply by 212 to get a decimal value of 1,343,488.
4. Convert it to 32-bit signed integer (see Setpoint Data Type Chapter 0) to get: $ 00 14
80 00
5. Write this value to the New Value registers of the Setpoint Write parameter.
The reply confirms that the write was successful. Read the portion of the Setpoint Information
register span that contains the Value. This is register offsets 7:6 of the Setpoint Information
register, or registers 1011 and 1012.
Request: $ 01 03 03 F2 00 02 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read registers)
$ 03 F2 (1 bit offset) $ 03 F3 Setpoint Information: Value
$ 00 02 = register count (Setpoint Information: Value is 2 registers long)
Reply: $ 01 03 04 00 14 00 00 xx xx
$ 04 = byte count (2 bytes = 1 register)
$ 00 14 00 00 1,310,720 (divide by 2^16) 20% max bias
So the Maximum Generator Voltage Output Bias Percentage is 20%. Read the AVR Bias
Percent and the Desired Genset Output Voltage before any bias is applied.
Request: $ 01 03 04 21 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 21 (1 bit offset) $ 04 22 AVR Bias Percent
$ 00 01 = register count
Reply: $ 01 03 02 7D 80 xx xx
$ 02 = byte count (2 bytes = 1 register)
$ 7D 80 32128 251% (-251% offset) 0.0% bias
Request: $ 01 03 04 20 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 20 (1 bit offset) $ 04 21 Desired Genset Output Voltage
$ 00 01 = register count
Reply: $ 01 03 02 01 E0 xx xx
$ 02 = byte count (2 bytes = 1 register)
$ 01 E0 480V desired
To adjust the voltage, navigate to the Control menu and press the up arrow ten times, re-read
the AVR Bias Percent register.
Request: $ 01 03 04 21 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 21 (1 bit offset) $ 04 22 AVR Bias Percent
$ 00 01 = register count
Reply: $ 01 03 02 80 00 xx xx
$ 02 = byte count (2 bytes = 1 register)
$ 80 00 32768 256% (-251% offset) 5.0% bias
This verifies that each key-press adjusts the percentage by 0.5% (since we did ten key-
presses). Now we can check the actual voltage command that is sent to the AVR by reading
the Desired Genset Output Voltage register.
Request: $ 01 03 04 20 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 20 (1 bit offset) $ 04 21 Desired Genset Output Voltage
$ 00 01 = register count
Reply: $ 01 03 02 01 E5 xx xx
$ 02 = byte count (2 bytes = 1 register)
$ 01 E5 485V desired
This is correct. because the AVR Bias Percent represents a percentage of the Maximum
Generator Voltage Output Bias Percentage, which was 20%, the overall bias percentage is 5%
(AVR Bias Percent) of 20%, which is 1%.
Therefore; 101% of 480V is 484.8V, which rounds up to 485V.
Using the AVR Bias Percent Increment Command Modbus register, re-adjust the desired
voltage to nominal, which is 480V. This time however, we want to increment the bias by -1%
(negative one percent) since the current bias is 1%.
Request: $ 01 06 04 22 7D 00 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 06 = function code (write single register)
$ 04 22 (1 bit offset) $ 04 23 AVR Bias Percent Increment Command
$ 7D 00 = 32000 (divide by 128) = 250 (-251 offset) -1%
Reply: $ 01 06 04 22 7D 00 xx xx
$ 04 22 echo of address
$ 7D 00 echo of data
Finally, re-check the AVR Bias Percent to verify that the bias has returned to zero.
Request: $ 01 03 04 21 00 01 xx xx
$ 01 = slave address of EMCP 3 GSC
$ 03 = function code (read register)
$ 04 21 (1 bit offset) $ 04 22 AVR Bias Percent
$ 00 01 = register count
Reply: $ 01 03 02 7D 80 xx xx
$ 02 = byte count (2 bytes = 1 register)
$ 7D 80 32128 251% (-251% offset) 0.0% bias
This appendix contains information on the various software blocks in the EMCP 3 GSC. Blocks
are functional groups of setpoints. Blocks can occur in multiple instances, and in order to
program a setpoint, the block number as well as the instance number must be referenced.
These numbers reflect the standard production software. For custom designed-to-order (DTO)
software, consult your DTO contact.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
See APPENDIX F Bitmask Value Lists, on how to set the setpoint value.
Some setpoints in APPENDIX C refer to Setpoint Value Lists. Those setpoints are programmed
with integer values with each integer having a specific definition. These integer values and
representations are given here.
Some setpoints in APPENDIX C can take on multiple values simultaneously. This is particularly
true for event response configurations, where an event can trigger multiple responses, such as
a shutdown as well as a breaker tripping. In these cases, the setpoints are assigned bit-mask
values, where different factors of two represent different optional responses. This guarantees
that every combination of possible event responses will have a unique value. These possible
values are given here.
In order to decode a BitMask value, simply mask it with the value in question and compare it to
zero, to determine whether the value is present in the setpoint. For example, in APPENDIX D,
Setpoint Information For Configuration, the setpoint Air Damper Closed Event Response
Configuration setpoint shows units as BitMask. It has a minimum of zero, meaning all of the
responses shown here in Table 28 may be disabled. It has a maximum of 266, which is 256
(Active Only) + 8 (Hard Shutdown) + 2 (Audible Alert). This means that the Air Damper Closed
event can be configured to have these three responses.