LUNA2000B

ESS Modbus Port Definitions

Issue 01
Date 2023-06-13

HUAWEI TECHNOLOGIES CO., LTD.

Copyright © Huawei Technologies Co., Ltd. 2023. All rights reserved.
No part of this document may be reproduced or transmitted in any form or by any means without prior
written consent of Huawei Technologies Co., Ltd.

Trademarks and Permissions

and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd.
All other trademarks and trade names mentioned in this document are the property of their respective
holders.

Notice
The purchased products, services and features are stipulated by the contract made between Huawei and
the customer. All or part of the products, services and features described in this document may not be
within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements,
information, and recommendations in this document are provided "AS IS" without warranties, guarantees
or representations of any kind, either express or implied.

The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute a warranty of any kind, express or implied.

Huawei Technologies Co., Ltd.

Address: Huawei Industrial Base
Bantian, Longgang
Shenzhen 518129
People's Republic of China

Website: https://e.huawei.com

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. i

LUNA2000B
ESS Modbus Port Definitions 1 ESS Models

1 ESS Models

This chapter describes the energy storage system (ESS) models that use Modbus
protocol and the minimum software versions required.

1.1 ESS Model Description

Table 1-1 ESS models and software versions
Model Model Name Model ID Minimum Firmware Version
Series

LUNA2 LUNA2000-200KW 512 FusionSolar V800R021C10

000-20 H-2H0
0KWH
series

LUNA2 LUNA2000-200KW 513 LUNA2000B V300R023C00

000-20 H-2H1
0KWH
series

NOTE

Different ESS models vary in the number of ESS subsystems and configuration of
commercial & industrial (C&I) cabinet subsystems. Check the information in the point table
before use.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 1

LUNA2000B
ESS Modbus Port Definitions 2 Introduction

2 Introduction

Modbus is a widely used protocol for device communications. This document

describes the Modbus protocol used by Huawei ESSs and can be used to regulate
subsequent development for third-party integration. Huawei ESSs comply with the
standard Modbus protocol, and this document focuses on the information specific
to Huawei ESSs. For other information about Modbus, see the standard
documents about the Modbus protocol. For details about the interaction modes
and examples of the standard protocol and custom part used in Huawei ESSs, see
5 Overview of the Communications Protocol.

2.1 Terms and Abbreviations

Table 2-1 Terms and abbreviations
Term Description

Master node In the master-slave communication, the party that

initiates the communication is called the master
node.

Slave node During master-slave communication, the party that

responds to a communication request is referred to
as the slave node.

Broadcast address Fixed to 0.

Register address Recorded in two bytes.

U16 16-bit unsigned integer

U32 32-bit unsigned integer

U64 64-bit unsigned integer

I16 16-bit signed integer

I32 32-bit signed integer

I64 64-bit signed integer

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 2

LUNA2000B
ESS Modbus Port Definitions 2 Introduction

Term Description

STR Character string

MLD Multiple bytes

Bitfield16 16-bit data

Bitfield32 32-bit data

- N/A

s Second

EPOCHTIME Number of seconds since 1970-01-01 00:00:00

RO Read-only data

RW Data that is readable and writable

WO Write-only data

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 3

LUNA2000B
ESS Modbus Port Definitions 3 C&I Cabinet Subsystem

3 C&I Cabinet Subsystem

3.1 Register Definitions

Table 3-1 C&I cabinet subsystem
No. Signal Re Ty Un Gai Addr Qua Scope
ad/ pe it n ess ntit
Wr y
ite

1 Container RO Bitf N/ N/ 3000 1 For details about

status 1 ield A A 0 the bit definition,
16 see alarm
definitions.

2 Container RO Bitf N/ N/ 3000 1 For details about

status 2 ield A A 1 the bit definition,
16 see alarm
definitions.

3 Container RO Bitf N/ N/ 3000 1 For details about

status 3 ield A A 2 the bit definition,
16 see alarm
definitions.

4 Battery cabin RO I16 ℃ 10 3001 1

temperature 1 4

5 Battery cabin RO I16 % 10 3001 1

humidity 1 5

6 Battery cabin RO I16 ℃ 10 3003 1

dew point 4
temperature

7 SOC RO U1 % 1 3003 1 [0, 100]

6 5

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 4

LUNA2000B
ESS Modbus Port Definitions 3 C&I Cabinet Subsystem

No. Signal Re Ty Un Gai Addr Qua Scope

ad/ pe it n ess ntit
Wr y
ite

8 Energy charged RO U3 kW 10 3003 2

today 2 h 0 8

9 Energy RO U3 kW 10 3004 2
discharged 2 h 0 0
today

10 Energy charged RO U3 kW 10 3004 2

this month 2 h 0 2

11 Energy RO U3 kW 10 3004 2
discharged this 2 h 0 4
month

14 Energy charged RO I64 kW 10 3004 4

this year h 0 6

15 Energy RO I64 kW 10 3005 4

discharged this h 0 0
year

16 Total auxiliary RO U3 kW 10 3006 2

power 2 h 0 0
consumption

17 Charge/ RO I32 kW 10 3006 2

Discharge 00 2
power

18 Rated capacity RO U3 kW 10 3006 2

2 h 00 4

19 Rated power RO U3 kW 10 3006 2

2 00 6

20 Chargeable RO U3 kW 10 3006 2
capacity 2 h 00 8

21 Dischargeable RO U3 kW 10 3007 2
capacity 2 h 00 0

22 Total energy RO I64 kW 10 3007 4

charged h 0 6

23 Total energy RO I64 kW 10 3008 4

discharged h 0 0

24 CO RO U1 pp 1 3009 1
concentration 1 6 m 1

25 CO RO U1 pp 1 3009 1
concentration 2 6 m 2

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 5

LUNA2000B
ESS Modbus Port Definitions 3 C&I Cabinet Subsystem

No. Signal Re Ty Un Gai Addr Qua Scope

ad/ pe it n ess ntit
Wr y
ite

26 H2 RO U1 pp 1 3010 1
concentration 1 6 m 4

27 Alarm 1 RO U1 N/ 1 3011 1 For details about

6 A 8 the bit definition,
see alarm
definitions.

29 Alarm 2 RO U1 N/ 1 3011 1 For details about

6 A 9 the bit definition,
see alarm
definitions.

30 Fan speed 1 RO U1 RP 1 3019 1

6 M 0

31 Fan speed 2 RO U1 RP 1 3019 1

6 M 1

32 DC bus voltage RO U1 V 10 3020 1 [0, 6553]

6 2

33 DC bus current RO U1 A 10 3020 1 [0, 6553]

6 3

34 Phase A voltage RO U3 V 10 3030 2

2 0 0

35 Phase B voltage RO U3 V 10 3030 2

2 0 2

36 Phase C voltage RO U3 V 10 3030 2

2 0 4

37 Phase A active RO I32 kW 10 3030 2

power 00 6

38 Phase B active RO I32 kW 10 3030 2

power 00 8

39 Phase C active RO I32 kW 10 3031 2

power 00 0

40 Active power RO I32 kW 10 3031 2

00 2

41 Reactive power RO I32 kV 10 3031 2

ar 00 4

42 Power factor RO I16 N/ 10 3031 1

A 00 6

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 6

LUNA2000B
ESS Modbus Port Definitions 3 C&I Cabinet Subsystem

No. Signal Re Ty Un Gai Addr Qua Scope

ad/ pe it n ess ntit
Wr y
ite

43 Rectifier fault RO U1 N/ N/ 3049 1 0: no

6 A A 9 1: yes

44 Total output RO U1 V 10 3050 1

voltage of 6 0
rectifiers

45 Total output RO U1 A 10 3050 1

current of 6 1
rectifiers

46 Quantity of RO U1 N/ 1 3050 1
rectifiers 6 A 2

47 Total output RO U3 kW 10 3050 2

power of 2 00 3
rectifiers

3.2 Alarm Definitions

Table 3-2 Alarm definition table
ID Alarm Name Alarm Cause Severit Register Bit
y Address

3804 AC SPD Fault AC SPD fault Major 30000 0

3825 UPS Alarm A UPS alarm has been generated. Major 30000 3

3832 Fire Alarm A fire has been detected in the Major 30000 7
battery cabin.

3826 Combustible Gas 1. The safety valve of the lithium Major 30000 11
Alarm battery is open, and combustible
gas is leaked.
2. Lithium battery thermal
runaway has occurred.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 7

LUNA2000B
ESS Modbus Port Definitions 3 C&I Cabinet Subsystem

ID Alarm Name Alarm Cause Severit Register Bit

y Address

3831 Built-in Fire 1. Check whether the pressure Major 30000 12

Suppression gauge pointer is in the green area.
Module Pressure If yes, check whether the network
Low cable from the fire suppression
module is securely connected to
the DI port on the CMU.
2. If not, replace the fire
suppression module as soon as
possible by referring to the
maintenance manual. Otherwise,
the system will automatically shut
down three days later.

3800 Battery Cabin Water is detected in the battery Major 30001 0

Water Alarm cabin.

3801 Battery Cabin Battery cabin door 1 is open. Major 30002 1

Door 1 Status
Alarm

3827 Battery Cabin The ambient temperature in the Major 30118 0

Temperature battery cabin is too high, which
High triggers system shutdown.

3828 Battery Cabin Condensation risk exists in the Minor 30118 2

Condensation battery cabin.
Risk

3829 Battery Cabin There are too many faulty Minor 30118 4
T/H Sensor temperature and humidity sensors
Malfunction in the battery cabin.

3830 Battery Cabin Too many air conditioners in the Major 30118 6
T/H Control battery cabin are faulty. As a
Malfunction result, the temperature and
humidity in the battery cabin
cannot be controlled properly.

3833 Rectifier Fault The rectifier is faulty. Major 30119 0

3833 Rectifier Fault The rectifier is faulty. Major 30119 1

3833 Rectifier Fault The rectifier is faulty. Major 30119 2

3833 Rectifier Fault The rectifier is faulty. Major 30119 3

3833 Rectifier Fault The rectifier is faulty. Major 30119 4

3833 Rectifier Fault The rectifier is faulty. Major 30119 5

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 8

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

4 ESS Subsystem

4.1 Register Definitions

Table 4-1 ESS subsystem
No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

1 Quantity of RO U16 N/A 1 3010 1 N/A

working packs 1

2 Device status RO U16 N/A 1 3010 1 [0,9]

2

3 Rack voltage RO I16 V 10 3010 1 N/A

3

4 Rack current RO I16 A 10 3010 1 N/A

4

5 SOC RO U16 % 1 3010 1 [0,10

5 0]

6 SOH RO U16 % 1 3010 1 [0,10

6 0]

7 Charge/ RO I32 kW 1000 3010 2 N/A

Discharge power 7

8 SOE RO U16 % 1 3016 1 [0,10

4 0]

9 DOD RO U16 % 1 3016 1 [0,10

7 0]

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 9

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

10 Chargeable RO U32 kWh 1000 3016 2 N/A

capacity 8

11 Dischargeable RO U32 kWh 1000 3017 2 N/A

capacity 0

14 Highest pack RO I16 ℃ 100 3017 1 N/A

temperature 6

15 Pack with RO U16 N/A 1 3017 1 N/A

highest 7
temperature

16 Lowest pack RO I16 ℃ 100 3017 1 N/A

temperature 8

17 Pack with lowest RO U16 N/A 1 3017 1 N/A

temperature 9

18 Lowest pack RO U16 V 10 3018 1 N/A

voltage 0

19 Pack with lowest RO U16 N/A 1 3018 1 N/A

voltage 1

20 Highest pack RO U16 V 10 3018 1 N/A

voltage 2

21 Pack with RO U16 N/A 1 3018 1 N/A

highest voltage 3

22 Energy charged RO U32 kWh 100 3019 2 N/A

today 2

23 Energy charged RO U32 kWh 100 3019 2 N/A

this month 4

24 Energy charged RO U32 kWh 100 3019 2 N/A

this year 6

25 Energy RO U32 kWh 100 3020 2 N/A

discharged today 2

26 Energy RO U32 kWh 100 3020 2 N/A

discharged this 4
month

27 Energy RO U32 kWh 100 3020 2 N/A

discharged this 6
year

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 10

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

29 DCDC - Battery- RO I16 V 10 3156 1 N/A

side voltage 1

30 DCDC - Bus-side RO I16 V 10 3156 1 N/A

voltage 2

31 DCDC - Battery- RO I16 A 10 3156 1 N/A

side current 3

32 DCDC - Bus-side RO I16 A 10 3156 1 N/A

current 4

33 DCDC - Cabinet RO I16 ℃ 10 3156 1 N/A

temperature 5

34 DCDC - ISO RO U16 MΩ 1000 3157 1 N/A

insulation 1
resistance

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 11

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

35 DCDC - Running RO U16 N/A 1 3161 1 0x00

status 4 00:
Stan
dby;
0x00
01:
Stan
dby:
safe
mode
;
0x00
02:
Stan
dby:
cable
conn
ectio
n
detec
tion;
0x01
00:
Soft
start;
0x02
00:
Runn
ing;
0x02
01:
Oper
ating:
limite
d
powe
r;
0x02
02:
Oper
ating:
self-
derat
ing;

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 12

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

0x02
03:
runni
ng
(curr
ent
limiti
ng);
0x03
00:
Unex
pecte
d
shutd
own;
0x03
01:
Com
man
ded
shutd
own;
0x03
02:
Emer
genc
y
powe
r off;
0x03
03:
Char
ge/
Disch
arge
disab
led;
0x03
04:
Batte
ry
pack
rapid
shutd
own;

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 13

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

0xB0
00:
off-
line;
0xC0
00:
Loadi
ng

36 Teleindication RO U16 N/A 1 3901 1 For

alarm 1 4 detail
s
abou
t the
bit
defini
tion,
see
alar
m
defini
tions.

37 Teleindication RO U16 N/A 1 3901 1 For

alarm 2 5 detail
s
abou
t the
bit
defini
tion,
see
alar
m
defini
tions.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 14

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

No. Signal Name Read Data Unit Gain Regis Num Scop
/ Type ter ber e
Writ Addr of
e ess Regis
ters

38 Teleindication RO U16 N/A 1 3901 1 For

alarm 3 6 detail
s
abou
t the
bit
defini
tion,
see
alar
m
defini
tions.

39 Teleindication RO U16 N/A 1 3901 1 For

alarm 4 7 detail
s
abou
t the
bit
defini
tion,
see
alar
m
defini
tions.

4.2 Alarm Definitions

Table 4-2 Alarm definition table
ID Alarm Name Alarm Cause Severit Register Bit
y Address

3013 Controller-Pack The rack controller fails to Major 39014 13

Communication communicate with the battery
Error pack.

3014 Rack Controller A major fault has occurred on the Major 39014 14
Abnormal internal circuit of the rack
controller.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 15

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

ID Alarm Name Alarm Cause Severit Register Bit

y Address

3015 Controller The battery side voltage exceeds Major 39014 15

Battery Side the maximum operating voltage
Overvoltage of the power module.

3016 Controller The battery is not securely Major 39015 0

Battery Side connected or is abnormal.
Undervoltage

3017 Controller The battery cable is incorrectly Major 39015 1

Battery Side connected.
Short-Circuit

3018 Controller The battery cable is reversely Major 39015 2

Battery Side connected.
Reverse Polarity

3019 Controller Bus The bus cable is not correctly Major 39015 3
Side Overvoltage connected, or the bus voltage
exceeds the maximum operating
voltage of the power module.

3020 Controller Bus The bus is connected in reverse Major 39015 4

Side Reverse polarity.
Polarity

3021 Controller 1. The battery is short-circuited to Major 39015 5

Insulation the ground.
Resistance 2. The battery is in a humid
Abnormal environment and the insulation
between the circuit and ground is
poor.

3022 Controller 1. The installation position of the Minor 39015 6

Temperature battery power control module is
High not well ventilated.
2. The ambient temperature is too
high.
3. The battery power control
module is abnormal.
4. The fan in the battery power
control module is abnormal.

3023 Controller The battery terminal is not Major 39015 7

Battery Terminal securely connected.
Temperature
High

3024 Controller Bus The bus terminal is not securely Major 39015 8
Terminal connected.
Temperature
High

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 16

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

ID Alarm Name Alarm Cause Severit Register Bit

y Address

3025 Controller The upgrade fails. Minor 39015 9

Version
Mismatch

3026 Controller The internal fan is short-circuited, Warnin 39015 10

Internal Fan the power supply is insufficient, or g
Faulty the fan is damaged.

3027 Pack Monitoring A major fault has occurred on the Major 39015 11
Board Error internal circuit of the battery pack
monitoring device.

3028 Pack Internal A major fault occurred on the Major 39015 12

Error battery pack.

3029 Pack Lockout A failure recurs many times in the Major 39015 13
battery pack.

3030 Pack Fan Fault 1. The fan is short-circuited. Major 39015 14

2. The power supply is insufficient.
3. The fan is damaged.
4. The fan is blocked.

3031 Pack The temperatures of cells in a Minor 39015 15

Temperature battery pack are unbalanced.
Imbalance

3032 Pack Overvoltage The voltage of the battery pack or Major 39016 0
its cell is too high.

3033 Controller Power The internal communication of the Major 39016 1

Control Unit rack controller has failed.
Communication
Error

3034 Controller The battery rack and its power Major 39016 2
Connection module are connected incorrectly.
Detection Error

3035 Battery Pack 1. The actual quantity of the Major 39016 3

Positions of Rack battery packs is inconsistent with
Controller the setting value.
Abnormal 2. The system has not identified
the address of the battery pack.
3. The address of the battery pack
is not identified after changing.
4. The connection of the battery
pack is incorrect.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 17

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

ID Alarm Name Alarm Cause Severit Register Bit

y Address

3036 Optimizer Error A major fault has occurred in the Major 39016 4
circuit inside the optimization unit
of the battery pack.

3037 Optimizer 1. The installation position of the Minor 39016 5

Temperature battery pack is not well ventilated.
High 2. The ambient temperature is too
high.
3. The battery power control
module is abnormal.
4. The optimization unit is
abnormal.

3038 Optimizer The terminal is not securely Major 39016 6

Terminal connected.
Temperature
High

3039 Optimizer The upgrade fails. Minor 39016 7

Version
Mismatch

3040 Incorrect The output buses are not Major 39016 8

Controller Bus connected in parallel in the 1C
Connection scenario.

3041 Loose The copper bar of the battery pack Major 39016 9
Connection on is loosely connected.
Copper Bar

3042 Controller Rapid The rapid shutdown cabling Major 39016 10

Shutdown between battery racks is incorrect.
Connection
Detection Error

3043 Pack SOH Low The SOH of the battery pack is Warnin 39016 11
low. g

3044 Pack Overcurrent The battery pack current exceeds Major 39016 12
the maximum operating current
for long.

3045 Pack 1. The installation position of the Major 39016 13

Temperature battery pack is not well ventilated.
High 2. The air conditioner/fan is not
running properly.

3046 Pack The ambient temperature is too Major 39016 14

Temperature Low low that it activates the charge/
discharge protection.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 18

LUNA2000B
ESS Modbus Port Definitions 4 ESS Subsystem

ID Alarm Name Alarm Cause Severit Register Bit

y Address

3047 Pack 1. The voltage of the battery pack Major 39016 15

Undervoltage or its cell is too low.
2. Battery pack stores the energy
for long when off-grid.
3. Battery pack does not work for
long after getting on-grid.

3048 Pack Aux. Power The relay control of the black start Warnin 39017 0
Supply Faulty auxiliary power supply is faulty. g

3052 DC Aux. Power 1. The DC circuit breaker is OFF. Major 39017 4

Supply of 2. The PSU is faulty.
Controller Faulty

3053 External Fan of The external fan is short-circuited Warnin 39017 5

Rack Controller or damaged, the power supply is g
Faulty insufficient, or the air channel is
blocked.

3054 Rack Controller The NTC is short-circuited or Warnin 39017 6

Temperature open-circuited. g
Abnormal

3055 Optimizer The ambient temperature is too Major 39017 7

Temperature Low low.

3056 Emergency The EPO button is pressed down. Major 39017 8

Power-Off

3057 Controller-Pack 1. The versions of the rack Warnin 39017 9

Version controller and battery packs are g
Inconsistency inconsistent.
2. The upgrade fails.
3. The battery packs have been
replaced.

3058 Controller-Pack 1. The versions of the rack Major 39017 10

Version controller and battery packs are
Mismatch inconsistent.
2. The upgrade fails.
3. The battery packs have been
replaced.

3059 Communication 1. The communications cable Major 39017 11

Error Between between the CMU and
Controller and SmartLogger is abnormal.
PCS 2. The communications cable
between the PCS and
SmartLogger is abnormal.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 19

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5 Overview of the Communications

Protocol

The Modbus communications protocol consists of the following layers.

Figure 5-1 Modbus protocol layers

5.1 Physical Layer

Huawei ESS containers provide Modbus communication based on FE physical
media. The communication is based on the TCP link and complies with the
Modbus-TCP format.

5.2 Data Link Layer

The following figure shows the generic frame structure of the Modbus protocol.

Figure 5-2 Modbus generic frame format

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 20

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.2.1 Modbus-TCP
Figure 5-3 Modbus-TCP frame format

5.2.1.1 ADU Length

The recommended frame length is 260 bytes based on the standard. When some
extended functions are applied, the data service provider may extend the ADU to
a proper length based on available resources to improve network transmission
efficiency. The ADU length is indicated by the length field in the MBAP header.

5.2.1.2 MBAP Header

When Modbus runs on top of TCP/IP, a dedicated MBAP header (Modbus
application protocol header) is used to identify the Modbus ADU. The Modbus
header consists of four fields and seven bytes, which are defined as follows.

Table 5-1 MBAP definition

Data Field Length Description Client Server

(Byte)

Transmissio 2 Matching identifier Assigned by the The identifier

n identifier between a request client. It is of the
frame and a recommended response
response frame that each frame from
frame be the server
assigned a must be the
unique same as that
identifier. of the
corresponding
request
frame.

Protocol 2 0 = Modbus Assigned by the The identifier

protocol client; 0 by of the
default response
frame from
the server
must be the
same as that
of the
corresponding
request
frame.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 21

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Data Field Length Description Client Server

(Byte)

Data 2 Follow-up data Assigned by the Assigned by

length length client based on the server
the actual data based on the
frame actual frame
length

Logical 1 0 Assigned by the The identifier

device ID client based on of the
the actual data response
frame request frame from
the server
must be the
same as that
of the
corresponding
request
frame.

5.2.1.3 Communications Address

Based on the TCP communications host, unit 0 is used by default to access the
directly connected slave node, and other addresses are used to access the
downstream devices of the slave node. The default address of the slave node is 0.
The address is configurable.

Figure 5-4 Three-layer communications addresses

5.2.1.4 TCP Port

In a local area network or VPN environment, the master node may initiate a TCP
socket connection to the slave node. The master node can use port 502 to request
data services from the slave node.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 22

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

In a non-VPN environment across the public network, the device deployed on the
internal network needs to initiate TCP socket link establishment to the master
node exposed on the public network. In this case, you need to specify the port
number of the master node on the slave node. To ensure security and minimize
traffic, the master node must provide at least one encrypted port and one non-
encrypted port.

5.2.1.5 TCP Link Establishment Process

This section focuses on the cross-public network application.
The following figure shows the process of connecting a slave node.

Figure 5-5 Process of establishing a secure TCP connection

5.3 Application Layer

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 23

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.1 Function Code

Table 5-2 Function code
Function Code Description Remarks

0x03 Reads registers. Supports continuous

reading of a single
register or multiple
registers.

0x06 Writes a single register. Supports writing into a

single register.

0x10 Writes multiple registers. Supports continuous

writing into multiple
registers.

5.3.2 Exception Code

Exception codes must be unique for each network element (NE) type. The names
and descriptions should be provided in the NE interface document. Different
versions of the same NE type must be backward compatible. Exception codes in
use cannot be assigned to other exceptions.

Table 5-3 Exception codes returned by an NE (0x00–0x8F used for common

exception codes)
Code Term Description

0x01 Invalid function The function code received in the query is not an
allowable action for the server (or slave node).
This may be because the function code is only
applicable to newer devices, and cannot be
implemented in the unit selected. It also
indicates that the server (or slave node) is in the
wrong state to process a request of this type, for
example because it is not configured and is being
asked to return register values.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 24

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Code Term Description

0x02 Invalid data The data address received in the query is not an
address allowable address for the server. More
specifically, the combination of the starting
register address and register quantity is invalid.
For a controller with 100 registers, the PDU
addresses the first register as 0 and the last one
as 99. If the starting register address in a request
is 96 and the register quantity is 4, the request
can obtain the return values of registers 96, 97,
98, and 99. If the starting register address of a
request is 96 and the register quantity is 5, the
request fails and the exception code 0x02
"Invalid data address" is returned because the
request attempts to read registers 96, 97, 98, 99,
and 100, among which 100 is not a defined
address.

0x03 Invalid data The value contained in the query data field is not
value an allowable value for the server (or slave node).
The value indicates a fault in the structure of the
remainder of a complex request, such as an
incorrectly implied length. It does not mean that
a data item submitted for storage in a register
has a value outside the expectation of the
application program since the Modbus protocol is
unaware of the significance of any particular
value of any particular register.

0x04 Slave node An error occurs while the server attempts to

failure perform the requested action.

0x06 Slave node busy The server cannot accept a Modbus request PDU.
The client application determines whether and
when to retransmit the request.

0x80 No permission An operation is not allowed because of a

permission authentication failure or permission
expiration.

0x90 Southbound The response from the southbound device times

access device out or the communication is disconnected.
response
timeout

0x91 Internal unit The response from the internal unit times out or
response the communication is disconnected.
timeout

5.3.3 Read Registers (0x03)

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 25

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.3.1 Frame Format of a Master Node Request

Data Field Length Description

Function Code 1 byte 0x03

Starting Register Address 2 bytes 0x0000–0xFFFF

Number of Registers 2 bytes 1–125

5.3.3.2 Frame Format of a Normal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x03

Byte Count 1 byte 2xN

Register Value 2 x N bytes N/A

NOTE
N refers to the number of registers.

5.3.3.3 Frame Format of an Abnormal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x83

Exception Code 1 byte See 5.3.2 Exception

Code.

5.3.3.4 Examples
This section takes the Modbus-TCP communications frames as an example. The
differences between Modbus-RTU and Modbus-TCP lie in the additional address
field and the CRC. Pay attention to the differences when using the Modbus-RTU
frames. This also works for the follow-up examples.

The master node sends a query request (register address: 32306/0X7E32) to the
slave node (logical device ID: 00).

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 26

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Description Frame Data

00

Data length 00

06

Logical device ID 00

Function Code 03

Data Register address 7E

32

Number of registers 00

02

Normal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

07

Logical device ID 00

Function Code 03

Data Byte count 04

Register data 00

00

00

01

Abnormal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 27

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Description Frame Data

01

Protocol 00

00

Data length 00

03

Logical device ID 00

Function Code 83

Data Error code 03

5.3.4 Writing a Single Register (0x06)

5.3.4.1 Frame Format of a Master Node Request

Data Field Length Description

Function Code 1 byte 0x06

Register Address 2 bytes 0x0000–0xFFFF

Register Value 2 bytes 0x0000–0xFFFF

5.3.4.2 Frame Format of a Normal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x06

Register Address 2 bytes 0x0000–0xFFFF

Register Value 2 bytes 0x0000–0xFFFF

5.3.4.3 Frame Format of an Abnormal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x86

Exception Code 1 byte See 5.3.2 Exception

Code.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 28

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.4.4 Examples
A master node sends a command (register address: 40200/0X9D08) to a slave
node (address: 00).

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

06

Logical device ID 00

Function Code 06

Data Register address 9D

08

Register data 00

00

Normal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

06

Logical device ID 00

Function Code 06

Data Register address 9D

08

Register data 00

00

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 29

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Abnormal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

03

Logical device ID 00

Function Code 86

Data Error code 04

5.3.5 Writing Multiple Registers (0x10)

5.3.5.1 Frame Format of a Master Node Request

Data Field Length Description

Function Code 1 byte 0x10

Starting Register Address 2 bytes 0x0000–0xFFFF

Number of Registers 2 bytes 0x0000–0x007b

Byte Count 1 byte 2xN

Register Value 2 x N bytes Value

NOTE
N refers to the number of registers.

5.3.5.2 Frame Format of a Normal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x10

Register Address 2 bytes 0x0000–0xFFFF

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 30

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Data Field Length Description

Number of Registers 2 bytes 0x0000–0x007b

5.3.5.3 Frame Format of an Abnormal Response from a Slave Node

Data Field Length Description

Function Code 1 byte 0x90

Exception Code 1 byte See 5.3.2 Exception

Code.

5.3.5.4 Examples
The master node sets the register address 40118/0X9CB6 to 2 and the register
address 40119/0X9CB7 to 50 for the slave node (address: 00). The request frame
format is as follows.

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

0B

Logical device ID 00

Function Code 10

Data Register address 9C

B6

Number of registers 00

02

Byte count 04

Register data 00

02

00

32

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 31

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Normal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

06

Logical device ID 00

Function Code 10

Data Register address 9C

B6

Number of registers 00

02

Abnormal response from a slave node

Description Frame Data

MBAP Header Protocol identifier 00

01

Protocol 00

00

Data length 00

03

Logical device ID 00

Function Code 90

Data Error code 04

5.3.6 Reading Device Identifiers (0x2B)

This command code allows reading identifiers and added packets that are relevant
to the physical and function description of the remote devices.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 32

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Simulate the interface of the read device identifier as an address space. This
address space consists of a set of addressable data elements. Data elements are
objects to be read, and the object IDs determine these data elements.
A data element consists of three objects:
1. Basic device identifier: All objects of this type are mandatory, such as the
vendor name, product code, and revision version.
2. Regular device identifier: In addition to the basic data objects, the device
provides additional and optional identifiers and data object description.
Define all types of objects according to definitions in the standard, but the
execution of this type of objects is optional.
3. Extended device identifier: In addition to regular data objects, the device
provides additional and optional identifiers and private data object
description. All the data is related to the device.

Table 5-4 Read device identifiers

Object ID Object Type Mandatory/ Type
Name/ Optional
Description

0x00 Vendor ASCII string Mandatory Basic

0x01 Product code ASCII string Mandatory

0x02 Main revision ASCII string Mandatory

version

0x03–0x7F -- -- -- Regular

0x80–0xFF -- -- -- Extended

5.3.6.1 Command for Querying Device Identifiers

Table 5-5 Request frame format

Data Field Length Description

Function Code 1 byte 0x2B

MEI Type 1 byte 0x0E

ReadDevId Code 1 byte 01

Object ID 1 byte 0x00

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 33

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Table 5-6 Frame format for a normal response

Data Field Length Description

Function Code 1 byte 0x2B

MEI Type 1 byte 0x0E

ReadDevId Code 1 byte 01

Conformity Level 1 byte 01

More 1 byte --

Next Object ID 1 byte --

Object Quantity 1 byte --

Object List First Object 1 byte 0x00

object ID

Object 1 byte N
length

Object N bytes --
value

... ... ... ...

Table 5-7 Object list

Object ID Object Name/ Description Type
Description

0x00 Vendor "HUAWEI" Basic

0x01 Product code "SUN2000" or

"LUNA2000-P"

0x02 Main revision ASCII string,

version software version

Table 5-8 Frame format for an abnormal response

Data Field Length Description

Function Code 1 byte 0xAB

Exception Code 1 byte See 5.3.2 Exception

Code.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 34

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.6.2 Command for Querying a Device List

Table 5-9 Request frame format

Data Field Length Description

Function Code 1 byte 0x2B

MEI Type 1 byte 0x0E

ReadDevId Code 1 byte 03

Object ID 1 byte 0x87

Table 5-10 Frame format for a normal response

Data Field Length Description

Function Code 1 byte 0x2B

MEI Type 1 byte 0x0E

ReadDevId Code 1 byte 03

Conformity Level 1 byte 03

More 1 byte --

Next Object ID 1 byte --

Object Quantity 1 byte --

Object List First object Object 1 byte 0x87

ID

Object 1 byte N
length

Object N bytes --
value

... ... ... ...

Table 5-11 Object list

Object ID Object Name Type Description

0x80–0x86 Retained -- Returns a null

object with a
length of 0.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 35

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Object ID Object Name Type Description

0x87 Number of int Returns the

devices number of devices
connected to this
address.

0x88 Description about ASCII string Returns only

the first device See the device description about
description the first device if
definitions. an NE allows only
one device to be
connected to each
address.

0x8A Description about -- --

the second device

-- -- -- --

0xFF Description about -- --

the 120th device

5.3.6.3 Device Description Definition

Each device description consists of all "attribute=value" character strings.

"Attribute ID=%s;attribute ID=%s;... attribute ID=%s"

Example: "1= LUNA2000-200KTL-H0; 2=V800R021C10; 3=P1.0-D5.0;

4=123456789ABC; 5=1; 6=1.0; 8=LUNA2000-P"

Table 5-12 Definition of attributes

Attribut Attribute Type Description

e ID

1 Device model ASCII string --

2 Device software ASCII string --

version

3 Interface ASCII string See the interface protocol version

protocol version definitions.

4 ESN ASCII string --

5 Device ID int 0, 1, 2, 3,... (assigned by NEs; 0

indicates the master device into
which the Modbus card is
inserted)

6 Feature version ASCII string --

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 36

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Attribut Attribute Type Description

e ID

8 Device type ASCII string LUNA2000-P or SUN2000

Table 5-13 Frame format for an abnormal response

Data Field Length Description

Function Code 1 byte 0xAB

Exception Code 1 byte See 5.3.2 Exception

Code.

5.3.7 Huawei-defined Functions (0x41)

5.3.7.1 Uploading Files

Uploading files means uploading from a slave node to a master node through
stream access. The following figure shows the file uploading process.

Figure 5-6 File uploading process

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 37

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.7.1.1 Starting the Upload

Frame format of a request from a master node

Table 5-14 PDU data field of the request frame for starting upload (0x05)
PDU Length Description
Data (Byte)
Field

Function 1 0x41
Code

Sub- 1 0x05
function
Code

Data 1 1+N
Length

File Type 1 Unique ID of a file

Customiz N -
ed Data

Table 5-15 PDU data field of the response frame for starting the upload (0x05)
Data Length Description
Field (Byte)

Function 1 0x41
Code

Sub- 1 0x05
function
Code

Data 1 6+N
Length

File Type 1 Unique ID of a file

File 4 -
Length

Data 1 -
Frame
Length

Customiz N -
ed Data

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 38

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Table 5-16 PDU data field in the abnormal response frame of the slave node
PDU Data Field Length Description

Error Code 1 0xC1

Exception Code 1 See 5.3.2 Exception Code.

NOTE
If the exception code is 0x06, the request will be retransmitted in 10 seconds. A maximum
of six attempts are supported.

5.3.7.1.2 Uploading Data

Table 5-17 Request frame for uploading data (0x06)

PDU Data Field Length Description
(Byte)

Function Code 1 0x41

Sub-function Code 1 0x06

Data Length 1 3

File Type 1 Unique ID of a file

Frame No. 2 0x0000–0xFFFF

Table 5-18 Response frame for uploading data (0x06)

PDU Data Field Length Description
(Byte)

Function Code 1 0x41

Sub-function Code 1 0x06

Data Length 1 3+N

File Type 1 -

Frame No. 2 0x0000–0xFFFF

Frame Data N -

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 39

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

Table 5-19 Abnormal response frame for uploading data

PDU Data Field Length Description
(Byte)

Error Code 1 0xC1

Exception Code 1 See 5.3.2 Exception Code.

5.3.7.1.3 Completing the Data Upload

Table 5-20 Request frame for completing the data upload

PDU Data Field Length Description
(Byte)

Function Code 1 0x41

Sub-function Code 1 0x0c

Data Length 1 1

File Type 1 -

Table 5-21 Response frame for completing the data upload

PDU Data Field Length Description
(Byte)

Function Code 1 0x41

Sub-function Code 1 0x0c

Data Length 1 3

File Type 1 -

File CRC 2 -

Table 5-22 Abnormal response frame for completing the data upload
Data Field Length Description

Error Code 1 0xC1

Exception Code 1 See 5.3.2 Exception Code.

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 40

LUNA2000B
ESS Modbus Port Definitions 5 Overview of the Communications Protocol

5.3.7.1.4 Timeout Processing

Table 5-23 Processing specifications for sub-process timeout

Item Constraint

Response timeout period for starting an 10s

upload

Response timeout period for uploading data 10s

Maximum retransmission attempts for data 6

upload command

Response timeout period for completing a 10s

data upload

Issue 01 (2023-06-13) Copyright © Huawei Technologies Co., Ltd. 41