Hiking DDS238-2 ZN/S energy meter

DDS238-2 ZN-S Modbus.md

Hiking DDS238-2 ZN/S energy meter

Document included in the project https://github.com/fawno/Modbus

https://github.com/fawno/Modbus/blob/master/DDS238-2%20ZN-S%20Modbus.md

Modbus holding registers:

Register(s)	Meaning	Scale Unit	Data format	R/W
0000h-0001h	total energy	1/100 kWh	unsigned dword	R¹
0002h-0003h	reserved		unsigned dword
0004h-0005h	reserved		unsigned dword
0006h-0007h	reserved		unsigned dword
0008h-0009h	export energy	1/100 kWh	unsigned dword	R¹
000Ah-000Bh	import energy	1/100 kWh	unsigned dword	R¹
000Ch	voltage	1/10 V	unsigned word	R
000Dh	current	1/100 A	unsigned word	R
000Eh	active power	1 W	signed word	R
000Fh	reactive power	1 VAr	unsigned word	R
0010h	power factor	1/1000	unsigned word	R
0011h	frequency	1/100 Hz	unsigned word	R
0012h	reserved		unsigned word
0013h	reserved		unsigned word
0014h	reserved		unsigned word
0015h:high	station address	1-247	unsigned char	R/W
0015h:low	baud rate	1-4²	unsigned char	R/W
001Ah	relay³		unsigned word	R/W

Notes:

Note 1:

Total, export and import energy counters can erased writing 0 in total energy registers.

Note 2:

Value mapping, default 1.

Value	Baud rate
1	9600 Bd
2	4800 Bd
3	2400 Bd
4	1200 Bd

Note 3:

In DDS238-2 ZN/SR model the relay can be switched by 0x001A register.

Value	Relay
0	Off
1	On

Data formats

Data format	Lenght	Byte order
char	8 bits
word	16 bits	Big endian
dword	32 bits	Big endian

Writing registers

The meter does not understand the 'write sigle register' function code (06h), only the 'write multiple registers' function code (10h).

dds238-read.php

<?php
  function set_win_port_attr ($port_name = 'com1:', $port_attr = ['baud' => 9600, 'data' => 8, 'stop' => 1, 'parity' => 'n']) {
    $mode = 'mode ' . $port_name;
    foreach ($port_attr as $attr => $value) {
      $mode .= ' ' . $attr . '=' . $value;
    }

    exec($mode, $output, $return);

    return $return;
  }

  function crc16 ($data) {
    $crc = 0xFFFF;
    foreach (unpack('C*', $data) as $byte) {
      $crc ^= $byte;
      for ($j = 8; $j; $j--) {
        $crc = ($crc >> 1) ^ (($crc & 0x0001) * 0xA001);
      }
    }

    return pack('v1', $crc);
  }

  $modbus_message_format = [
    'address' => 'C1',
    'function' => 'C1',
    'start' => 'n1',
    'quantity' => 'n1',
    //'crc' => 'n1',
  ];

  $modbus_message_pack = implode($modbus_message_format);
  $modbus_message_unpack = null;
  foreach ($modbus_message_format as $name => $format) {
    $modbus_message_unpack .= $format . $name . '/';
  }

  $modbus_response_format = [
    'address' => 'C1',
    'function' => 'C1',
    'count' => 'C1',
    'total_energy' => 'N1',
    'reserved' => 'N3',
    'export_energy' => 'N1',
    'import_energy' => 'N1',
    'voltage' => 'n1',
    'current' => 'n1',
    'active_power' => 'n1',
    'reactive_power' => 'n1',
    'power_factor' => 'n1',
    'frecuency' => 'n1',
    //'year' => 'C1',
    //'month' => 'C1',
    //'day' => 'C1',
    //'hour' => 'C1',
    //'minute' => 'C1',
    //'second' => 'C1',
    //'comm_addr' => 'C1',
    //'comm_baud' => 'C1',
    //'trip_energy' => 'N1',
    //'trip_time' => 'N1',
    //'unknow' => 'n5',
    //'month2' => 'C1',
    //'day2' => 'C1',
    'crc' => 'n1',
  ];

  $modbus_response_pack = implode($modbus_response_format);
  $modbus_response_unpack = null;
  foreach ($modbus_response_format as $name => $format) {
    $modbus_response_unpack .= $format . $name . '/';
  }

  $port_name = 'COM3:';
  $port_attr = ['baud' => 9600, 'data' => 8, 'stop' => 1, 'parity' => 'n', 'xon' => 'off'];
  set_win_port_attr($port_name, $port_attr);

  $modbus = fopen($port_name, 'rb+');

  $message = [0x01, 0x03, 0, 18];
  $message = pack($modbus_message_pack, ...$message);
  $message .= crc16($message);

  fwrite($modbus, $message);

  $buffer = null;
  do {
    usleep($buffer ? 5000 : 100000);
    $buffer .= fread($modbus, 1);
  } while (!feof($modbus));

  if (crc16(substr($buffer, 0, -2)) != substr($buffer, -2)) {
    echo __LINE__, PHP_EOL;
    echo bin2hex($buffer), PHP_EOL;
    echo bin2hex(substr($buffer, 0, -2)), PHP_EOL;
    echo bin2hex(substr($buffer, -2)), PHP_EOL;
    die();
  }

  $response = unpack($modbus_response_unpack, $buffer);

  //print_r($response);

  $data_scale = [
    'total_energy' => 1/100,  // daWh / 100 => kWh
    'export_energy' => 1/100, // daWh / 100 => kWh
    'import_energy' => 1/100, // daWh / 100 => kWh
    'voltage' => 1/10,        // dV / 10 => V
    'current' => 1/100,       // cA / 100 => A
    'active_power' => 1,      // W
    'reactive_power' => 1,    // VA
    'power_factor' => 1/1000,
    'frecuency' => 1/100,     // cHz / 100 => Hz
    //'comm_addr' => 1,
    //'comm_baud' => 1,         // [1 => 9600, 2 => 4800, 3 => 2400, 4 => 1200]
    //'trip_energy' => 1/100,   // daWh / 100 => kWh
  ];

  $data = [];
  foreach ($data_scale as $key => $scale) {
    $data[$key] = isset($response[$key]) ? $response[$key] * $scale : null;
  }

  print_r($data);

  echo "\nok";
  fclose($modbus);

dds238-reset-energy-counters.php

<?php
  function set_win_port_attr ($port_name = 'com1:', $port_attr = ['baud' => 9600, 'data' => 8, 'stop' => 1, 'parity' => 'n']) {
    $mode = 'mode ' . $port_name;
    foreach ($port_attr as $attr => $value) {
      $mode .= ' ' . $attr . '=' . $value;
    }

    exec($mode, $output, $return);

    return $return;
  }

  function crc16 ($data) {
    $crc = 0xFFFF;
    foreach (unpack('C*', $data) as $byte) {
      $crc ^= $byte;
      for ($j = 8; $j; $j--) {
        $crc = ($crc >> 1) ^ (($crc & 0x0001) * 0xA001);
      }
    }

    return pack('v1', $crc);
  }

  $port_name = 'COM3:';
  $port_attr = ['baud' => 9600, 'data' => 8, 'stop' => 1, 'parity' => 'n', 'xon' => 'off'];
  set_win_port_attr($port_name, $port_attr);

  $modbus = fopen($port_name, 'rb+');

  //| 0000h-0001h | total energy    | 1/100 kWh  | unsigned dword | R/W |
  $message = [0x01, 0x10, 0x0000, 2, 4, 0];
  $message = pack('C1C1n1n1C1N1', ...$message);
  $message .= crc16($message);

  fwrite($modbus, $message);

  fclose($modbus);

Hello, I am also using the DDS238 ZN/SR. I am using QModMaster to communicate with the meter and a ethernet/modbus convertor DR302.

When I got the meter, ID=1. By using the read holding registers 0x03, I could read all the registers. And writing 0 or 1 to register 0x001A, I could switch the relay.

Then I wrote 0x2001 to register 0x0015, I lost all of the modbus communication. On the display is ID=000. The meter still works, it measures how it should do, but no communication. I have ofcourse also used the ID=0, the broadcast, but still no reply of the meter.

In QModMaster I have to increase the address with 1, so If I want to write to register 0x0015 I have to enter 0x0016. I check in the program the output and then it is correct.

Does anyone has seen this before? Can it be a problem with the QModMaster or does anyone how to set the address back to 1?

At the moment I don't have a RS232/RS485 convertor, it is ordered. Then I can use an Arduino to sent the strings and have every bit under control.

Greetings, Frans

Hello -
by accident, I also wrote 0 out in register 0x0015.
Now the gauge ID =0 and I can't fix it to anything else.
Is the recycle bin the only solution?

Hello, There is no limitation on what you write into the register, also not for the baud rate.  I did not find a way to reset the registers to the original value, also not by the supplier. Does your meter answer when you call it with ID=0, if not the recycle bin is the solution. ⁣Met vriendelijke groet, Frans Landsbergen​ Op 1 nov. 2023 16:05, om 16:05, MadsHHLund ***@***.***> schreef:

…

@MadsHHLund commented on this gist: Hello - by accident, I also wrote 0 out in register 0x0015. Now the gauge ID =0 and I can't fix it to anything else. Is the recycle bin the only solution? -- Reply to this email directly or view it on GitHub: https://gist.github.com/alphp/95e1efe916c0dd6df7156f43dd521d53#gistcomment-4746059 Unsubscribe from this thread: https://github.com/notifications/unsubscribe-auth/ADYO4DOAYPVQN7OWQZTXZV3YCJQK5BFKMF2HI4TJMJ2XIZLTSKBKK5TBNR2WLJDHNFZXJJDOMFWWLK3UNBZGKYLEL52HS4DFQKSXMYLMOVS2I5DSOVS2I3TBNVS3W5DIOJSWCZC7OBQXE5DJMNUXAYLOORPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLK2HNFZXIQ3PNVWWK3TUUZ2G64DJMNZZDAVEOR4XAZNEM5UXG5FFOZQWY5LFVA4TINZSGQYDEM5HORZGSZ3HMVZKMY3SMVQXIZI You are receiving this because you commented on the thread Message ID: <alphp/DDS238-2 ZN-S ***@***.***>

Okay recycle Bin.

Que tal Fernando, espero que te encuentres muy bien.
Tu post me ha ayudado mucho a identificar los datos en los registros del dispositivo.
Ahora mismo te escribo para probar suerte y preguntar si hay forma de obtener el DL/T645 ID usando MODBUS.
Veo que en el dispositivo este ID se encuentra impreso sobre el medidor y me sería muy útil poder obtenerlo para identificar distintos medidores.
Espero puedas ayudarme :) De antemano gracias

Tengo bastante aparcado el tema.
Pero si se tiene un volcado en binario de todos los registros y se sabe la información que se espera encontrar es posible identificar el registro si esa información está almacenada en algún registro. Obviamente debería ser un registro o bien marcado como reservado (básicamente es un registro cuya información no he podido identificar) o un registro nuevo (no explorado).
Un saludo