1 / 24

OffGrid SPF5000 Modbus RS485&RS232 RTU Protocol

V0.14
2020-10-16

No. Version Date Notice Signature

1 V0.01 2016-12-27 The first version Zhenyuan.li
2 V0.02 2017-1-12 1 、 modify input reg 0, system Zhenyuan.li
status;
2、add input reg 44 for send DTC to
server to identify machine type;
3 V0.03 2017-2-6 1、modify Holding reg 29, Model Zhenyuan.li
Low;
4 V0.04 2017-2-16 1、add Holding reg 39, battery type; Zhenyuan.li
2、modify Holding reg 0, On/Off;
3、modify Input reg 46, Production
Line Mode;
5 V0.05 2017-3-10 1、modify Input reg 17、28、29, Zhenyuan.li
Battery Voltage;
6 V0.06 2017-3-15 1、modify Holding reg 29, Model L; Zhenyuan.li
7 V0.07 2017-5-25 1、modify Hold reg 29; Zhenyuan.li
2、modify Input reg 36~39;
3、add Input reg 68~82;
8 V0.08 2017-5-26 1、add Input reg 90~131 for BMS Zhenyuan.li
infomation;
9 V0.09 2017-7-4 1 、 add Input reg 135~179 for Zhenyuan.li
SolarCharger infomation;
10 V0.10 2017-7-12 1、add Input reg 83~86 for Machine Zhenyuan.li
Rate Power ;
11 V0.11 2017-8-09 1、Change Machine Rate Power Zhenyuan.li
from Input Reg 83~86 to Holding
Reg 76~79;
2、Adjust BMS info, and add BMS2
info;
3、Add Solar Charger Info at Input
Reg 180~224;
12 V0.13 2020-06-16 Jianjian.Yu
13 V0.14 2020-10-16 Modify 37,82,95 holding register’s Jianjian.Yu
description
14 V0.15 2020-04-20 Add 41 and 42 new function of Xiao.jin
holding register;
Modify 43 of input register;
 2 / 24

V0.01 2016-12-27:
1, Update the register map tables from sp3000 RTU protocol for spf3-5K;
V0.02 2017-1-12:
1, modify input reg 0, system status;
2, add input reg 44 for send DTC to server to identify machine type;
V0.03 2017-2-6:
1, modify Holding reg 29, model Low;
V0.04 2017-2-16:
1, add Holding reg 39, battery type; it can be set by server;
2, modify Holding reg 0, On/Off; add remote control ac output and set standby state function;
3, modify Input reg 46, Production Line Mode; add production line mode set 2 to clear fault, decrease test
time;
V0.05 2017-3-10:
1, modify Input reg 17、28、29, Battery Voltage; change uint 0.1V to uint 0.01V;
V0.06 2017-3-15:
1, modify Holding reg 29, Model L; Add S bit for Aging Mode;
V0.07 2017-5-25:
1, modify Holding reg 29, Model L; U bit add two user:CPS and cODM_Haiti;
2, modify Input reg 36~39 for AC input Power;
3, add Input reg 68 for AC charge current; add Input reg 69~72 for AC discharge power; add Input reg 73~76
for battery discharge power; add Input reg 77~78 for battery power; add Input reg 80 for battery over
charge flag; add Input reg 81~82 for fan speed;
V0.08 2017-5-26:
1, add Input reg 90~131 for BMS 2nformation;
V0.09 2017-7-4:
1, add Input reg 135~179 for SolarCharger 2nformation;
V0.10 2017-7-12:
1, add Input reg 83~86 for Machine Rate Power;
V0.11 2017-8-09:
1, Change Machine Rate Power from Input Reg 83~86 to Holding Reg 76~79;
2, Adjust BMS info, and add BMS2 info;
3, Add Solar Charger Info at Input Reg 180~224;
V0.12 2020-6-16:
 3 / 24

1 Data format ............................................................................................................................ 4

2 Command Format ................................................................................................................... 4

3 Device Message Transmission Mode / Framing ..................................................................... 7

4 Register map ........................................................................................................................... 8

5 Set address ........................................................................................................................... 23

6 Notice ................................................................................................................................... 24
 4 / 24

1 Data format

Valid slave device addresses are in the range of 0 – 247 decimal.

The individual slave devices are assigned addresses in the range of 1 – 247.
0 is the broadcast address

It is 16bits (two bytes) unsigned integer for each holding and input register;

2 Command Format

Function 3 Read holding register

Response Error:
11 0x80|0x03 Errornum CRC (Errornum as a byte)
 5 / 24

Function 4 Read input register

Response Error:
11 0x80|0x04 Errornum CRC (Errornum as a byte)

Function 6 Preset single register

 6 / 24

Response Error:
11 0x80|0x06 Errornum CRC (Errornum as a byte)

Function 16 Preset multiple register

Response Error:
11 0x80|0x10 Errornum CRC (Errornum as a byte)
 7 / 24

3 Device Message Transmission Mode / Framing

RTU Mode
When controllers are setup to communicate on a Modbus network using RTU (Remote
Terminal Unit) mode, each 8–bit byte in a message contains two 4–bit hexadecimal
characters. Each message must be transmitted in a continuous stream.

The format for each byte in RTU mode is:

Coding System: 8–bit binary, hexadecimal 0–9, A–F
Two hexadecimal characters contained in each
8–bit field of the message

Bits per Byte:

1 start bit
8 data bits, least significant bit sent first
None parity
1 stop bit
Error Check Field: Cyclical Redundancy Check (CRC)

The baud rate of the transmission is:

Baud Rate: 9600 bps

Minimum CMD period (RS485 Time out): 850ms.

Wait for minimum 850ms to send a new CMD after last CMD. Suggestion is 1s;

Maximum Data Length Define:

Maximum read data length is 45 words in read command;
Maximum update data length is 45 words in preset command;
Read or update registers NO. should in the range of times of 45,
eg: 1~45 or 96~123 are OK, but 40~60 is not OK;

Note:
Except the CEI0-21 and VDE-AR-N 4105 power management registers, you should refer the
manufactory’s suggestion when writing other registers;
 8 / 24

4 Register map

It is 16bits (two bytes) unsigned integer for each holding and input register;

4.1 Holding Reg

Reg Variable Name Description Cust Value Unit Initial Note
NO. ome value
r
Writ
e
00 On/Off The Standby On/Off 0x0000: Output enable; 0
state and the AC 0x0100: Output disable;
output DisEN/EN
state; The low byte is
the Standby
on/off(1/0), the high
byte is the AC output
disable/enable (1/0).
01 OutputConfig AC output set W 0: BAT First; 0
1: PV First;
2: UTI First;
3: PV&UTI First
02 ChargeConfig Charge source set W 0: PV first; 0
1: PV&UTI;
2: PV Only;
03 UtiOutStart Uti Output Start Time W 0-23 H(hour) 0
04 UtiOutEnd Uti Output End Time W 0-23 H(hour) 0
05 UtiChargeStart Uti Charge Start Time W 0-23 H(hour) 0
06 UtiChargeEnd Uti Charge End Time W 0-23 H(hour) 0
07 PVModel PV Input Mode W 0:Independent; 0
1: Parallel;
08 ACInModel AC Input Mode W 0: APL,90-280VAC; 0
1: UPS,170-280VAC;
2: GEN
09 Fw version H Firmware version ASCII
(high)
10 Fw version M Firmware version
(middle)
11 Fw version L Firmware version
(low)
12 Fw version2 H Control Firmware ASCII
version (high)
 9 / 24

13 Fw version2 M Control Firmware

version (middle)
14 Fw version2 L Control Firmware
version (low)
15 LCD language LCD language W 0-1 1 English
16 GridV_Adj
17 InvV_Adj
18 OutputVoltType Output Volt Type W 0: 208VAC; 1
1: 230VAC
2: 240VAC
3:220VAC
4:100VAC
5:110VAC
6:120VAC
19 OutputFreqType Output Freq Type W 0: 50Hz; 0
1: 60Hz
20 OverLoadRestart Over Load Restart W 0:Yes; 0 Yes(over Load
1:No; 1mins to
2: Swith to UTI; restart, after
over Load three
times to stop
output)
21 OverTempRestart Over Temperature W 0:Yes; 0 Yes(over
Restart 1:No; Temperature
to restart ，
after over
Temperature
three times to
stop output)
22 BuzzerEN Buzzer on/off enable W 1:Enable; 1
0:Disable;
23 Serial NO. 5 Serial number 5 W ASCII
24 Serial No. 4 Serial number 4 W
25 Serial No. 3 Serial number 3 W
26 Serial No. 2 Serial number 2 W
27 Serial No. 1 Serial number 1 W
28 Moudle H Inverter Moudle W Can be set at
(high) standy state
Only
29 Moudle L Inverter Moudle W P-battery type: Can be set at
(low) 0: Lead_Acid; standy state
1: Lithium; Only
2: CustomLead_Acid;
U-user type:
 10 / 24

0: No verndor;
1: Growatt;
2: CPS;
3: Haiti;

M-power rate:
3: 3KW;
5:5KW;
S-Aging;
0: Normal Mode;
1: Aging Mode;
30 Com Address Communicate addre W 1~254 1
ss
31 FlashStart Update firmware W 0x0001: own
0X0100: control broad
32 Reset User Info Reset User W 0x0001
Information
33 Reset to factory Reset to factory W 0x0001
34 MaxChargeCurr Max Charge Current W 0~180 1A 70
35 BulkChargeVolt Bulk Charge Volt W 500~640 0.1V 564
36 FloatChargeVolt Float Charge Volt W 500~560 0.1V 540
37 BatLowToUtiVolt Bat Low Volt Switch W 200~640 (non Lithium) 0.1V 460
To Uti or Or Or
5~100 (Lithium) 1% 50%
38 ACChargeCurr AC Charge Current W 0~100 1A 30
39 Battery Type Battery Type W 0: AGM 1 Can be set at
1: FLD standy state
2: USE Only
3: Lithium;
4: USE2

40 Aging Mode Aging Mode W 0: Normal Mode; 0 Can be set at

1: Aging Mode; standy state
Only
41 Function Mask W bit0=Etl check enable 0:Disable;
1:Enable;
bit1=Pv ISO Check 0:Disable;
enable 1:Enable;
bit2~bit15: reserved
42 Safety Type W 1: standard
2. ETL
3. AS4777
4. CQC
5. VDE4105
 11 / 24

43 DTC Device Type Code &*6

44
45 Sys Year System time-year W Year offset is 2000
46 Sys Month System time- Month W
47 Sys Day System time- Day W
48 Sys Hour System time- Hour W
49 Sys Min System time- Min W
50 Sys Sec System time- Second W
51
52 uwAcVoltHighL
53 uwAcVoltLowL
54 uwAcFreqHighL
55 uwAcFreqLowL
56
57
58
59 Manufacturer Manufacturer ASCII
Info 8 information (high)

60 Manufacturer Manufacturer
Info 7 information (middle)

61 Manufacturer Manufacturer
Info 6 information (low)

62 Manufacturer Manufacturer
Info 5 information (high)

63 Manufacturer Manufacturer
Info 4 information (middle)
64 Manufacturer Manufacturer
Info3 information (low)
65 Manufacturer Manufacturer
Info 2 information (low)
66 Manufacturer Manufacturer ASCII
Info 1 information (high)
67 FW Build No. 4 Control FW Build No.
2
68 FW Build No. 3 Control FW Build No.
1
69 FW Build No. 2 COM FW Build No. 2
70 FW Build No. 1 COM FW Build No. 1
 12 / 24

71
72 Sys Weekly Sys Weekly W 0-6
73 ModbusVersion Modbus Version Eg：207 is V2.07 Int(16bit
s)
74 For par avg
power
75 SCC_ComMode SCC Communication For BMS
Mode board, SCC
cntrl
76 Rate Watt H Rate active 0.1W
power(high)
77 Rate Watt L Rate active 0.1W
power(low)
78 Rate VA H Rata apparent power 0.1VA
(high)
79 Rate VA L Rate apparent power 0.1VA
(low)
80 ComboardVer Communicaiton For bms
board Version boad
81 uwBatPieceNum
82 wBatLowCutOff Bat voltage low cutoff 200~640 (non Lithium) 0.1V 460
or Or Or
5~100 (Lithium) 1% 50%
83
84 NomGridVolt
85 NomGridFreq
86 NomBatVolt
87 NomPvCurr
88 NomAcChgCurr
89 NomOpVolt
90 NomOpFreq
91 NomOpPow
92
93
94
95 uwAC2BatVolt AC switch to Battery 200~640 (non Lithium) 0.1V 460
or Or Or
5~100 (Lithium) 1% 50%
96 BypEnable
97 PowSavingEn
98 SpowBalEn
99 ClrEnergyToday
100 clrEnergyAll
 13 / 24

101 BurnInTestEn
102 ManualStartEn
103 SciLossChkEn
104 BlightEn
105 ParaMaxChgCurr Parallel System
Maximum charge
current
106 LiProtocolType Protocol type for 1~99 1
battery
107 AudioAlarmEn
108 uwEqEn
109 uwEqChgVolt
110 uwEqTime
111 uwEqTimeOut
112 uwEqInterval
113 uwMaxDisChgCu
rr

162 BLVersion2 Boot loader version2 R M3

bootloader
version

4.2 Input Reg

(Some of input Registers can be wrote by Manufacturer, write address offset is 0x1000, start at
0x1000. Can not be wrote by customer.)
Reg Variable Name Description Value U Note
NO. n
i
t
00 System Status System run state 0: Standby;
1; PV an Grid
Combine Discharge
2: Discharge;
3: Fault;
4: Flash;
5: PV charge;
6: AC charge;
7: Combine charge;
8: Combine charge
and Bypass;
9: PV charge and
Bypass;
10: AC charge and
 14 / 24

Bypass;
11: Bypass;
12: PV charge and
Discharge;
01 Vpv1 PV1 voltage 0
.
1
V
02 Vpv2 PV2 voltage 0
.
1
V
03 Ppv1 H PV1 charge power (high) 0
.
1
W
04 Ppv1 L PV1 charge power (low) 0
.
1
W
05 Ppv2 H PV2 charge power (high) 0
.
1
W
06 Ppv2 L PV2 charge power (low) 0
.
1
W
07 Buck1Curr Buck1 current 0
.
1
A
08 Buck2Curr Buck2 current 0
.
1
A
09 OP_Watt H Output active power (high) 0
.
1
W
10 OP_Watt L Output active power (low) 0
.
1
W
 15 / 24

11 OP_VA H Output apparent power (high) 0

.
1
V
A
12 OP_VA L Output apparent power (low) 0
.
1
V
A
13 ACChr_Watt H AC charge watt (high) 0
.
1
W
14 ACChr_Watt L AC charge watt (low) 0
.
1
W
15 ACChr_VA H AC charge apparent power 0
(high) .
1
V
A
16 ACChr_VA L AC charge apparent power 0
(low) .
1
V
A
17 Bat Volt Battery volt (M3) 0
.
0
1
V
18 BatterySOC Battery SOC 0~100 1
%
19 Bus Volt Bus Voltage 0
.
1
V
20 Grid Volt AC input Volt 0
.
1
V
21 Line Freq AC input frequency 0
 16 / 24

.
0
1
H
z
22 OutputVolt AC output Volt 0
.
1
V
23 OutputFreq AC output frequency 0
.
0
1
H
z
24 Ouput DCV Ouput DC Volt 0
.
1
V
25 InvTemp Inv Temperature 0
.
1
C
26 DcDc Temp DC-DC Temperature 0
.
1
C
27 LoadPercent Load Percent 0~1000 0
.
1
%
28 Bat_s_Volt Battery-port volt (DSP) 0
.
0
1
V
29 Bat_Volt_DSP Battery-bus volt (DSP) 0
.
0
1
V
30 Time total H Work time total (high) 0
.
5
 17 / 24

S
31 Time total L Work time total (low) 0
.
5
S
32 Buck1_NTC Buck1 Temperature 0
.
1
C
33 Buck2_NTC Buck2 Temperature 0
.
1
C
34 OP_Curr Output Current 0
.
1
A
35 Inv_Curr Inv Current 0
.
1
A
36 AC_InWatt H AC input watt (high) 0
.
1
W
37 AC_InWatt L AC input watt (low) 0
.
1
W
38 AC_InVA H AC input apparent power 0
(high) .
1
V
A
39 AC_InVA L AC input apparent power 0
(low) .
1
V
A
40 Fault bit fault bit &*1
41 Warning bit Warning bit &*1
42 Warning bit high
43 warning value warning value
44 DTC Device Type Code &*6
 18 / 24

45 Check Step Product check step 1:PV1 charge power

check;
2:PV2 charge power
check;
3:AC charge Power
check
46 Production Line Mode Production Line Mode 0: Not at Production
Line Mode;
1: Production Line
Mode;
2: Production Line
Clear Fault Mode;
47 ConstantPowerOKFlag Constant Power OK Flag 0: Not OK;
1: OK;
48 Epv1_today H PV Energy today

49 Epv1_today L PV Energy today 0

.
1
k
W
h
50 Epv1_total H PV Energy total
51 Epv1_total L PV Energy total 0
.
1
k
W
h
52 Epv2_today H PV Energy today
53 Epv2_today L PV Energy today 0
.
1
k
W
h
54 Epv2_total H PV Energy total
55 Epv2_total L PV Energy total 0
.
1
k
W
h
56 Eac_chrToday H AC charge Energy today
 19 / 24

57 Eac_chrToday L AC charge Energy today 0

.
1
k
W
h
58 Eac_chrTotal H AC charge Energy total
59 Eac_chrTotal L AC charge Energy total 0
.
1
k
W
h
60 Ebat_dischrToday H Bat discharge Energy today
61 Ebat_dischrToday L Bat discharge Energy today 0
.
1
k
W
h
62 Ebat_dischrTotal H Bat discharge Energy total
63 Ebat_dischrTotal L Bat discharge Energy total 0
.
1
k
W
h
64 Eac_dischrToday H AC discharge Energy today
65 Eac_dischrToday L AC discharge Energy today 0
.
1
k
W
h
66 Eac_dischrTotal H AC discharge Energy total
67 Eac_dischrTotal L AC discharge Energy total 0
.
1
k
W
h
68 ACChrCurr AC Charge Battery Current 0
.
1
 20 / 24

A
69 AC_DisChrWatt H AC discharge watt (high) 0
.
1
W
70 AC_DisChrWatt L AC discharge watt (low) 0
.
1
W
71 AC_DisChrVA H AC discharge apparent power 0
(high) .
1
V
A
72 AC_DisChrVA L AC discharge apparent power 0
(low) .
1
V
A
73 Bat_DisChrWatt H Bat discharge watt (high) 0
.
1
W
74 Bat_DisChrWatt L Bat discharge watt (low) 0
.
1
W
75 Bat_DisChrVA H Bat discharge apparent power 0
(high) .
1
V
A
76 Bat_DisChrVA L Bat discharge apparent power 0
(low) .
1
V
A
77 Bat_Watt H Bat watt (high) (signed int 32) 0
Positive:Battery .
Discharge Power; 1
Negative: Battery W
78 Bat_Watt L Bat watt (low) Charge Power; 0
.
1
 21 / 24

W
79 uwSlaveExistCnt uwSlaveExistCnt
80 BatOverCharge Battery Over Charge Flag 0:Battery not over
charge;
1:Battery over charge;
81 MpptFanSpeed Fan speed of MPPT Charger 0~100 1
%
82 InvFanSpeed Fan speed of Inverter 0~100 1
%
83 TotalChgCur Total Charge current 0
.
1
A
85 Eop_dischrToday_H Op discharge Enerday today
86 Eop_dischrToday_L
87 Eop_dischrTotal_H Op discharge Enerday total
88 Eop_dischrTotal_L

90 ParaChgCurr Para system charge current 0

.
1
A

&*1: Off Grid Inverter fault code Bit(See &*8):

Fault type value Means(The message showed on the inverter when the inverter
has fault)
2 Over Temperature 过温
3 Bat Voltage High 电池电压过高
5 Output short 输出短路
6 Output voltage high 输出电压过高
7 Over Load 过载
8 Bus voltage high 直流母线电压过高
9 Bus start fail 直流母线软起失败
51 over current 过流
52 Bus voltage low 直流母线电压过低
53 inverter softstart fail 逆变软起失败
56 battery open 电池未接
58 output voltage low 输出电压过低
60 negtive power 负功过大
61 PV voltage high PV 电压过高
62 SCI com error 内部通讯故障
80 can fault Can 通讯失败
81 host loss 主机丢失
 22 / 24

&*5: Inverter Model: A , could be show: “T0 Q0 PF U1 M5 S1” or “00F151”

Tx=(A&0XF00000)>>20
Qx=(A&0X0F0000)>>16
Px=(A&0x00F000)>>12
Ux=(A&0x000F00)>>8
Mx=(A&0x0000F0)>>4
Sx=(A&0x00000F)
&*6: DTC(Device type code)

Code Device type Note

No.
001xx Inverter 1 tracker and 1phase Grid connect PV inverter TL
002xx Inverter 2 tracker and 1phase Grid connect PV inverter TL
003xx Inverter 1 tracker and 1phase Grid connect PV inverter HF
004xx Inverter 2 tracker and 1phase Grid connect PV inverter HF
005xx Inverter 1 tracker and 1phase Grid connect PV inverter LF
006xx Inverter 2 tracker and 1phase Grid connect PV inverter LF
007xx Inverter 1 tracker and 3phase Grid connect PV inverter TL
008xx Inverter 2 tracker and 3phase Grid connect PV inverter TL
009xx Inverter 1 tracker and 3phase Grid connect PV inverter LF
010xx Inverter 2 tracker and 3phase Grid connect PV inverter LF
……
10001 Data logger RF-ShineVersion
10002 Data logger Web-ShinePano
10003 Data logger Web-ShineWebBox
10004 Data logger WL-WIFI Module
……
11001 Confluence box Confluence box 1
……
031xx PV Storage Front 1 tracker PV Storage
034xx OffGrid OffGrid SPF 3-5K

&*7: Grid network power control command password:

Inverter is in lock state after power on; change the power control by network command should unlock
inverter first; default pw is XXXXXX;
Unlock: send 0 to 3-135, then send password to 3-136~138; inverter will auto lock in 5min after
unlocked;
Change PW: unlock first, then send 1 to 3-135, then send new password to 3-136~138;
Lock: send 0 or 2 to 3-135;
 23 / 24

&*8: Off Grid Inverter warning code

Warning code
Warning bit(41)
0x0001 Fan lock warning 风扇被锁
0x0002 Over charge 电池过充
0x0004 Battery voltage low 电池电压过低
0x0008 Over load 过载
0x0010 Op power derating 输出功率降额
0x0020 Solar stop due to bat low 电池过低太阳能停止充电
0x0040 Solar stop due to Pv high 太阳能电压过高太阳能停止充电
0x0080 solar stop due to over load 过载太阳能停止充电
0x0100 Grid different 并机市电输入不一致
0x0200 Grid phase error 并机输入相序错误
0x0400 Op phase loss 并机输出缺相
0x0800 Over temprature 过温
0x1000 Buck current over Buck 电流过大
0x2000 Battery disconnected 电池未接
0x4000 BMS com error BMS 通讯失败
0x8000 Pv power insufficient Pv 功率不足

Warning bit high(42)

0x0001 No bat parallel disable 无电池不并机
0x0002 Parallel version different 并机版本不兼容
0x0004
0x0008 Capacity different 并机机器容量不一致
0x0010 Host Loss 主机丢失
0x0020 BmsCellOverVolt BMS 单体过压
0x0040 BmsTotalOverVolt BMS 整体过压
0x0080 BmsDischgOverCurr BMS 放电过流
0x0100 BmsChgOverCurr BMS 充电过流
0x0200 BmsOverTemp BMS 过温
0x0400 Battery voltage consistent

5 Set address

Refer to the Inverter user manual. Always is :

Knock the pv inverter to let the lcd display to the “COM Addr: xxx”, then double knock, if
displays “Move”, you should another double knock, until it displays a address number, then you
can give a single knock to change the address, this address will be remembered when the lcd
backlight off.
 24 / 24

6 Notice
1) It can drive mostly 32 pv inverters for one rs485 comport.
2) There are only read input and hold registers commands even the newest version.
3) App user could only care the input register.
4) App user could not care the holding registers.
5) Except the CEI0-21 and VDE-AR-N 4105 power management registers, you should refer the
manufactory’s suggestion when writing the other registers;