Modbus Diagnostic Codes
Original instructions
About us
Introduction
BMENOP0300 IEC 61850 modules in M580 systems support the diagnostic codes in the following tables.
Function Code 3
Some module diagnostics (I/O connection, extended health, redundancy status, FDR server, etc.) are available to Modbus clients that read the local Modbus server area. Use Modbus function code 3 with the unit ID set to 100 for register mapping:
Type
Offset Modbus Address
Size (Words)
Basic Networks Diagnostic Data
0
39
Ethernet Port Diagnostics Data (Internal port)
39
103
Ethernet Port Diagnostics Data (ETH 1)
142
103
Ethernet Port Diagnostics Data (ETH 2)
245
103
Ethernet Port Diagnostics Data (ETH 3)
348
103
Ethernet Port Diagnostics Data (backplane)
451
103
Modbus TCP/Port 502 Diagnostic Data
554
114
Modbus TCP/Port 502 Connection Table Data
668
515
SNTP Diagnostics
1218
57
QoS Diagnostics
1275
11
IEC 61850 Server Diagnostic
2025
20
IEC 61850 Client Diagnostics
2047
20
IEC 61850 Server Diagnostics
Address
MS Byte
LS Byte
Modbus Type
Comments
Offset
Active
Health
WORD
Active: 1 = configured
Health: 1 = Service is operational.
Offset + 1
ProtoEd
ActiveConn
WORD
ProtoEd: IEC 61850 Edition version
ActiveConn: Number of connections established with this server
Offset + 2
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server receives a read variable request
LSW - MSB
LSW - LSB
Offset + 4
MSW - MSB
MSW - LSB
UDINT
the number of rejected MMS read variable requests
LSW - MSB
LSW - LSB
Offset + 6
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server receives a write variable request
LSW - MSB
LSW - LSB
Offset + 8
MSW - MSB
MSW - LSB
UDINT
the number of rejected MMS write variable requests
LSW - MSB
LSW - LSB
Offset + 10
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server sends an information report message
LSW - MSB
LSW - LSB
Offset + 12
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server sends a goose
LSW - MSB
LSW - LSB
Offset + 14
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server receives a goose
LSW - MSB
LSW - LSB
Offset + 16
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the server receives an invalid goose
LSW - MSB
LSW - LSB
Offset + 18
MSW - MSB
MSW - LSB
DWORD
detected error code
LSW - MSB
LSW - LSB
Offset + 20
MSW - MSB
MSW - LSB
DWORD
internalErr
LSW - MSB
LSW - LSB
IEC 61850 Client Diagnostics
Address
MS Byte
LS Byte
Modbus Type
Comments
Offset
Active
Health
WORD
Active: 1 = configured
Health: 1 = Service is operational.
Offset + 1
ProtoEd
ActiveConn
WORD
ProtoEd: IEC 61850 Edition version
ActiveConn: Number of connections established with this server
Offset + 2
MSW - MSB
MSW - LSB
UDINT
IED connection status
LSW - MSB
LSW - LSB
Offset + 4
MSW - MSB
MSW - LSB
UDINT
reserved
LSW - MSB
LSW - LSB
Offset + 6
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the client receives a read variable request
LSW - MSB
LSW - LSB
Offset + 8
MSW - MSB
MSW - LSB
UDINT
the number of rejected MMS read variable requests
LSW - MSB
LSW - LSB
Offset + 10
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the client sends a write variable request
LSW - MSB
LSW - LSB
Offset + 12
MSW - MSB
MSW - LSB
UDINT
the number of rejected MMS write variable requests
LSW - MSB
LSW - LSB
Offset + 14
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the client sends an information report message
LSW - MSB
LSW - LSB
Offset + 16
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the client receives a goose
LSW - MSB
LSW - LSB
Offset + 18
MSW - MSB
MSW - LSB
UDINT
a counter that increments each time the client receives an invalid goose
LSW - MSB
LSW - LSB
Offset + 20
MSW - MSB
MSW - LSB
DWORD
detected error code
LSW - MSB
LSW - LSB
Offset + 22
MSW - MSB
MSW - LSB
DWORD
internalErr
LSW - MSB
LSW - LSB
Modbus Register Mapping of NTP Diagnostics Data
Address
MS Byte
LS Byte
Modbus Type
Comments
Offset + 0
MSW - MSB
MSW - LSB
Uint32
primary NTP server IP address
Offset + 1
LSW - MSB
LSW - LSB
Offset + 2
MSW - MSB
MSW - LSB
Uint32
secondary NTP server IP address
Offset + 3
LSW - MSB
LSW - LSB
Offset + 4
MSW - MSB
BYTE
Uint8
polling period (in seconds)
Offset + 5
MSW - MSB
BYTE
Uint8
update CPU with module time
Offset + 6
MSW - MSB
MSW - LSB
Uint32
time zone
Offset + 7
LSW - MSB
LSW - LSB
Offset + 8
MSB
LSB
Int16
time zone offset (in minutes
Offset + 9
Unused
BYTE
Uint8
daylight saving time bias (in minutes)
Offset + 10
Unused
LSB
Uint8
daylight saving start date - month
Offset + 11
Unused
LSB
Uint8
daylight saving start date - week #, day of week
MS 4-bits: occurrence # (1 = first occurrence, 2 = second occurrence, ..., 5 = fifth or last occurrence)
LS 4-bits: day of the week (0 = Sunday, ..., 6 = Saturday)
Offset + 12
MSW - MSB
MSW - LSB
Uint32
daylight saving start time (seconds elapsed from midnight)
Offset + 13
LSW - MSB
LSW - LSB
Offset + 14
Unused
LSB
Uint8
daylight saving end date - month
Offset + 15
Unused
LSB
Uint8
daylight saving end date - week #, day of week
Offset + 16
MSW - MSB
MSW - LSB
Uint32
daylight saving end time (seconds elapsed from midnight)
Offset + 17
LSW - MSB
LSW - LSB
Offset + 18
Unused
BYTE
Uint8
SNTP mode
Offset + 19
Unused
BYTE
Uint8
reserved
...
–
–
–
–
Offset + 32
Unused
BYTE
Uint8
reserved
Offset + 33
MSW - MSB
MSW - LSB
UDINT
network time service status
Offset + 34
LSW - MSB
LSW - LSB
Offset + 35
MSW - MSB
MSW - LSB
UDINT
link to NTP server status
Offset + 36
LSW - MSB
LSW - LSB
Offset + 37
MSW - MSB
MSW - LSB
UDINT
current NTP server IP address
Offset + 38
LSW - MSB
LSW - LSB
Offset + 39
MSW - MSB
MSW - LSB
UDINT
NTP server type
Offset + 40
LSW - MSB
LSW - LSB
Offset + 41
MSW - MSB
MSW - LSB
UDINT
NTP server time quality
Offset + 42
LSW - MSB
LSW - LSB
Offset + 43
MSW - MSB
MSW - LSB
UDINT
number of NTP requests sent
Offset + 44
LSW - MSB
LSW - LSB
Offset + 45
MSW - MSB
MSW - LSB
UDINT
number of communication errors
Offset + 46
LSW - MSB
LSW - LSB
Offset + 47
MSW - MSB
MSW - LSB
UDINT
number of NTP responses received
Offset + 48
LSW - MSB
LSW - LSB
Offset + 49
MSW - MSB
MSW - LSB
UINT
last error
Offset + 50
MSW - MSB
MSW - LSB
UDINT
current time
Offset + 51
LSW - MSB
LSW - LSB
Offset + 52
MSW - MSB
MSW - LSB
UINT
current date
Offset + 53
MSW - MSB
MSW - LSB
UDINT
daylight saving status
Offset + 54
LSW - MSB
LSW - LSB
Offset + 55
MSW - MSB
MSW - LSB
DINT
time since last update
Offset + 56
LSW - MSB
LSW - LSB
Modbus Register Mapping of QoS Diagnostic Data
Address
MS Byte
LS Byte
Modbus Type
Comments
Offset
MS Byte
LS Byte
UINT
802.1Q tag enable/disable
Offset + 01
MS Byte
LS Byte
UINT
reserved for DSCP PTP event
Offset + 02
MS Byte
LS Byte
UINT
reserved for DSCP PTP general
Offset + 03
MS Byte
LS Byte
UINT
reserved for DSCP EIP urgent
Offset + 04
MS Byte
LS Byte
UINT
reserved for DSCP EIP scheduled
Offset + 05
MS Byte
LS Byte
UINT
reserved for DSCP EIP high
Offset + 06
MS Byte
LS Byte
UINT
reserved for DSCP EIP low
Offset + 07
MS Byte
LS Byte
UINT
reserved for DSCP EIP explicit
Offset + 08
MS Byte
LS Byte
UINT
reserved for DSCP Modbus IO scanner (same as DSCP EIP high)
Offset + 09
MS Byte
LS Byte
UINT
DSCP Modbus client/server (same as EIP explicit)
Offset + 10
MS Byte
LS Byte
UINT
DSCP SNTP
Offset + 11
MS Byte
LS Byte
UINT
DSCP IEC 61850 client
Get Status Summary: Request
Modbus function code 8 / sub-function code 21: request
Field
Length (bytes)
Value (hex)
function code
1
08
sub-function code hi
1
00
sub-function code low
1
15
operation code hi
1
00
operation code low
1
76
Get Status Summary: Response
Modbus function code 8 / sub-function code 21: response
Field
Length (bytes)
Value (hex)
function code
1
08
sub-function code hi
1
00
sub-function code low
1
15
operation code hi
1
00
operation code low
1
76
byte count
1
depends on product
number of LEDs
2
depends on product
each LED color [1]
2
0 = off
1 = on green
2 = on red
each LED status [1]
2
LED status number (see LED Status table)
name string [1]
N
LED name (null terminated)
. . .
–
–
number of services
2
depends on product
each service color [1]
2
0 = off or N/A
1 = green
2 = red
each service status [1]
2
service status number (see Services Status table)
name string [1]
N
service name
. . .
–
–
LED Status
Modbus function code 8 / sub-function code 21: LED status
LED Status Number (hex)
Description
1
ready for operation
2
not ready for operation
3
fault detected
4
no fault detected
5
in operation
6
duplicate IP address
7
waiting for address server response
8
default IP address in use
9
IP address configuration conflict detected
A
not configured
B
recoverable fault detected
C
connections established
D
–
E
connections error detected
F
running
10
detected error present
11
Ethernet link established
12
no Ethernet link established
13
connected to 100 Mbps link
14
not connected to 100 Mbps link
15
connected to full duplex link
16
note connected to full duplex link
17
configuration error detected
Services Status
Modbus function code 8 / sub-function code 21: services status
Service Status Number
Description
1
enabled
2
working properly
3
disabled
4
not configured
5
at least one connection not working
6
enabled on
7
enabled off
BMENOP0300 Module Response
Modbus function code 8 / sub-function code 21: module response
Field
Length (bytes)
Value (hex)
function code
1
08
sub-function code hi
1
00
sub-function code low
1
15
operation code hi
1
00
operation code low
1
76
byte count
1
D6
number of LEDs
2
6
LED 1 color
2
byte 0 = LED color
0 (black) = LED off
1 (green) = green LED on
byte 1 = blinking
0 (not blinking)
1 (blinking) = green LED blinking
LED 1 status
2
0
LED 1 name string
4
RUN
LED 2 color
2
byte 0 = LED color
0 (black) = LED off
2 (red) = red LED on
byte 1 = blinking
0 (not blinking)
1 (blinking) = red LED blinking
LED 2 status
2
0
LED 2 name string
4
ERR
LED 3 color
2
byte 0 = LED color
0 (black) = LED off
2 (red) = red LED on
byte 1 = blinking
0 (not blinking)
1 (blinking) = red LED blinking
LED 3 status
2
0
LED 3 name string
11
mod status
LED 4 color
2
byte 0 = LED color
0 (black) = LED off
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on, red blinking
5 (blink first red, then yellow) = red and green blinking
byte 1 = blinking
0 (not blinking)
1 (blinking) = LED in byte 0 blinking
LED 4 status
2
0
LED 4 name string
15
network status
LED 5 color
2
byte 0 = LED color
0 (black) = LED color
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on, red blinking
5 (blink first red, then yellow) = red and green blinking
byte 1 = blinking
0 (not blinking)
1 (blinking) = LED in byte 0 blinking
LED 5 status
2
0
LED 5 name string
17
network status 1
LED 6 color
2
byte 0 = LED color
0 (black) = LED off
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on, red blinking
5 (blink first red, then yellow) = red and green blinking
byte 1 = blinking
0 (not blinking
1 (blinking) = LED in byte 0 blinking
LED 6 status
2
0
LED 6 name string
17
network status 2
number of services
2
5
service 1 color
2
0 = off <default>
1 = green
service 1 status
2
1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 1 name string
15
access control
service 2 color
2
0 = off <default>
1 = on green
2 = on red
service 2 status
2
4 (corresponds to LED color 0) <default>
2 (corresponds to LED color 1)
5 (corresponds to LED color 2) – link to server down
service 2 name string
21
network time service
service 3 color
2
0 = off <default>
1 = green
service 3 status
2
1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 3 name string
18
IED server service
service 4 color
2
0 = off <default>
1 = green
service 4 status
2
1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 4 name string
18
IED client service
service 5 color
2
0 = off <default>
1 = green
service 5 status
2
1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 5 name string
23
IP forwarding service