Security Classification: Public

Logger Communication Protocol

AW0 1.0.2.7
Applicable models:
Logger1000
Logger3000
Logger4000

I. General Description
This protocol applies to the communication between
Logger4000/Logger3000/Logger1000 and the host computer monitoring software. It
adopts MODBUS RTU/TCP communication protocol. This protocol can read the
real-time overall machine running information of Logger4000/Logger3000/
Logger1000, and the information of sensors configured for
Logger4000/Logger3000/Logger1000. Communication address of
Logger4000/Logger3000/Logger1000 is 247.
When the logger forwards data from a device (e.g., inverter), the device (inverter)
address is its forwarding address. For information on how to get the address and access
data, please refer to Logger Modbus Protocol Data Forwarding Guide.

II. Physical Interface

1. RS485
Default setting
Addressing 247
Broadcast Yes
Baud rate 9600 bit/s
Check None
Data bit 8
Stop bit 1
Mode RTU
Electrical
RS485-2W cable connection
interface

2. Ethernet (Logger1000 default IP: 12.12.12.12, default open port: 502;

Logger3000 ETH1 default IP: 12.12.12.12, ETH2 default IP: 13.13.13.13, default open
port: 502; Logger4000 default IP: 12.12.12.12, default open port: 502)

1
 Security Classification: Public

III. Communication Description

1. Data type
U16 - Unsigned 16-bit integer, big-endian
S16 - Signed 16-bit integer, big-endian
U32 - Unsigned 32-bit integer, little-endian for double-word data; big-endian for
byte data
S32 - Signed 32-bit integer, little-endian for double-word data; big-endian for byte
data
U64---unsigned 64-bit integer data, big-endian format;
S64---signed 64-bit integer data, big-endian format;
E.g., U16 data 0x0102 is transmitted in the order 01, 02.
E.g., U32 data 0x01020304 is transmitted in the order 03, 04, 01, 02.
E.g., U64 data 0x0102030405060708 is transmitted in the order 01, 02, 03, 04, 05,
06, 07, 08.
The address register starts counting at 1, so the communication address = protocol
address - 1.
2. Numerical description
Decimal numbers are transmitted as integers after expansion. E.g., 10.333KW is
transmitted as 10333; 800.5V is transmitted as 8005. Negative numbers are transmitted
as complements. E.g., 0xFFFF denotes -1.
For registers that are "reserved" or not supported by the local PC, when query
unsigned numbers, it is replied with all "F". For example, "0xFFFF" for U16,
"0xFFFFFFFF" for U32, and "0xFFFFFFFFFFFFFFFF" for U64. Signed numbers are
replied with the maximum positive number. For example, "0x7FFF" for S16,
"0x7FFFFFFF" for S32, "0x7FFFFFFFFFFFFFFF" for S64, and "0x00" for UTF-8.
UTF-8 occupies 1 byte. An odd length is padded with 0x00.
3. Address type
The input register is a read-only register and supports 0x04 function code read.
The holding register is a read/write register and supports 0x03 function code query
2
 Security Classification: Public

and 0x06/0x10 function code write.

4. Check type
CRC16, polynomial 0xA001, little-endian.

IV. Address Definition Table

4.1 Input register (address type: 3X)
Note: A remark of "Logger1000" indicates that only Logger1000 supports it.
"Logger3000" indicates only Logger3000 supported it. "Logger4000" indicates only
Logger4000 supports it. If there are no remarks, Logger1000, Logger3000, and
Logger4000 all supported it.
Name Address Data type Factor Unit Remarks
0x0705 Logger3000
Device type code 8000 U16 1 0x0710 Logger1000
0x0718 Logger4000
Protocol number 8001 U32 1
Communication
8003 U32 1
protocol version
Total devices
8005 U16 1 Set
connected
Total faulty devices 8006 U16 1 Set
Reserved 8015 U32 1
Reserved 8017 U16 1
Currently only the low 16 bits are used.
Logger1000 only uses 8 bits,
Digital input state 8021 U32 1
Logger3000 uses 16 bits, and
Logger4000 uses 16 bits
Reserved 8023 U32 1
Reserved 8025 U32 1
PT100-1 8027 S16 0.1 °C Logger3000/Logger4000
PT100-2 8028 S16 0.1 °C Logger3000/Logger4000
ADC1 voltage 8029 S16 0.01 V
ADC1 current 8030 S16 0.01 mA Logger1000/Logger3000
ADC2 voltage 8031 S16 0.01 V Logger1000/Logger3000
ADC2 current 8032 S16 0.01 mA
Logger3000 and Logger1000 share the
ADC3 voltage 8033 S16 voltage. Logger3000 consumes 0.01mV,
and Logger1000 consumes 0.01V
Logger3000 and Logger1000 share the
ADC4 voltage 8034 S16 voltage. Logger3000 consumes 0.01mV,
and Logger1000 consumes 0.01V
ADC3 current 8035 S16 0.01 mA Logger1000/Logger4000
ADC4 current 8036 S16 0.01 mA Logger1000/Logger4000
Reserved 8037 S16 1
Longitude 8054 S32 0.0001 º Logger3000
Latitude 8056 S32 0.0001 º Logger3000
Max. total nominal 8058 U16 1 kW

3
 Security Classification: Public

active power
Min. total nominal
8059 U16 1 kW
active power
Max. total nominal
8060 U16 1 kVar
reactive power
Min. total nominal
8061 S16 1 kVar
reactive power
Inverter preset total
8066 U16 1 kW
active power
Inverter preset total
8067 S16 1 kVar
reactive power
0: Off
Logger On/Off state 8068 U16 1
1: On
0: latched
Logger unlatch state 8069 U16 1
1: unlatched
Total active power 8070 U64 1 W
Daily yield 8074 U32 0.1 kWh
Total reactive power 8076 S64 1 var
Total yield 8080 U64 0.1 kWh
Min. adjustable
8084 U32 0.1 kW
active power
Max. adjustable
8086 U32 0.1 kW
active power
Min. adjustable
8088 S32 0.1 kVar
reactive power
Max. adjustable
8090 S32 0.1 kVar
reactive power
Nominal active
8092 U32 0.1 kVar
power
Nominal reactive
8094 U32 0.1 kVar
power
Grid-connected
8096 U16 1 Set
devices
Off-grid devices 8097 U16 1 Set
Monthly yield of
8098 U64 0.1 kWh
array
Annual yield of array 8102 U64 0.1 kWh
Apparent power of
8106 U64 1 VA
array

4.2 Holding register (address type: 4X)

The holding register is set to support single function only. All commands from the
broadcast address 0 are directly transparently transmitted to the inverter.
Upper Lower
Name Address Data type Factor Unit Remarks
limit limit
Set the sub-array 0: Off
8002 U16
inverter on and off 1: On
Set active power
of subarray 8003 U32 0.1 kW
inverter
Set active power
ratio of subarray 8005 U32 0.1 %
inverter

4
 Security Classification: Public

Set reactive
power of subarray 8007 S32 0.1 kVar
inverter
Setting reactive
power ratio of 8009 S32 0.1 %
subarray inverter
Set the power
factor of subarray 8011 S32 0.001
inverter
D01 8013 U16 1 Logger3000/Logger4000
D02 8014 U16 1 0: The common end and the NC
D03 8015 U16 1 end are closed
1: The common end and the NO
D04 8016 U16 1 end are closed

V. Examples
6.1. The background communicates with the logger over the network. The address of
the logger is 247. When the background is bound to the port 502 of the logger, it needs
to query the DI state of the logger.
Background sends: 09 79 00 00 00 06 F7 04 1F 54 00 02
Logger replies: 09 79 00 00 00 07 F7 04 04 00 01 00 00
In the data replied, "09 79 00 00 00 06" and "09 79 00 00 00 07" are headers of the
Modbus TCP message; F7 is the address of the logger; 04 is the function code; 0x1F54
= 8020 is to query the data of Register 8021. According to this protocol, Register 8021
indicates the "digital input state (DIN)", and the data of Register 8021 in the logger
reply message is 0x0000.

6.2. Set boot

Send command: 0A B3 00 00 00 06 F7 06 1F 41 00 01
Reply date: 0A B3 00 00 00 06 F7 06 1F 41 00 01
In the command sent, "0A B3 00 00 00 06" is the Modbus TCP message header, F7 is
the logger address, 06 is the function code, 0x1F41 = 8001 is to write data to Register
8002; the value to write is 0x0001, indicates booting.

6.3. Set the active power value of subarray inverter

Send command: 00 00 00 00 00 0b F7 10 1F 42 00 02 04 00 00 00 00
Reply data: 00 00 00 00 00 06 F7 10 1F 42 00 02
In the command sent, "00 00 00 00 00 0b" is the Modbus TCP message header, F7 is the
logger address, 10 is the function code, 0x1F42 = 8002 is to write two consecutive
register data to the starting address of Register 8003, and the value to write is
0x00000000.

6.4. Set the active ratio of subarray inverter

5
 Security Classification: Public

Send command: 00 00 00 00 00 0b F7 10 1F 44 00 02 04 01 5E 00 00
Reply data: 00 00 00 00 00 06 F7 10 1F 44 00 02
In the command sent, "00 00 00 00 00 0b" is the Modbus TCP message header, F7 is the
logger address, 10 is the function code, 0x1F44 = 8004 is to write two consecutive
register data to the starting address of Register 8005, and the value to write is
0x0000015E.