# Property of PMA Electrical Solutions, LLC. # # EATON S611 SOFT STARTER — not a VFD. No speed reference, no reverse. # # SOURCE — Eaton primary only, one document: # MN03902011E "S611 Soft Starter User Manual", May 2012 (supersedes Aug 2011), # 96 pp. Printed page numbers below; the PDF page index runs +12. # p.1 two comms ports, which one carries native Modbus # p.11 terminal table: TB4 D0/D1/Common, and the TB3 Permissive and # Network control inputs # p.20 Network Control, Local Control, the Permissive/Network inputs # p.21 Level vs Edge sensing (restart behaviour after a trip) # p.27-28 fault code (FC) table, F.03-F.35 # p.38 communication adapter catalogue numbers # p.41 Advanced Operation Mode P.00-P.08 (panel-side comm settings) # p.46-47 fault display and the 10-deep fault queue # p.65 Appendix F Modbus general specifications, function codes # p.66 circuit descriptions, RS-485 wiring, THE ADDRESSING NOTE # p.66-67 communication-module registers (adapter only — see below) # p.68-72 the Modbus Map: registers 300-338 and 400-445 # # This profile claims the S611 ONLY. MN03902011E covers no sibling model, so # none is named here. The S811+/S801+ are a different family with their own # document and are not covered by this file. # # COMMUNICATION PATH THIS PROFILE ASSUMES: the S611's NATIVE Modbus RTU on # comms port A, the TB4 screw terminal block (p.1: "Comms port A is a screw # terminal block that is used for Modbus RS-485 communications"). No option # card is needed for this path. Comms port B (TB5) is the PCB connector that # takes the C441M / C441N / C441P Modbus adapters, or PROFIBUS / DeviceNet # (p.38); Eaton states both ports may run simultaneously and are configured # independently (p.20), and each has its own address/baud/parity pair on the # panel (P.00-P.02 for port A, P.03-P.05 for port B, p.41). # # ADDRESSING. Eaton's tables print a "Modbus Register Number", which is # 1-based, NOT a protocol address. p.66 states it outright: # "The Modbus register address is -1 of the Modbus register number." # 0-based protocol address = Eaton register number - 1 # e.g. status reg 300 -> 299, control reg 400 -> 399, FLA reg 404 -> 403. # Every address in this file is already converted. There is no 4xxxx notation # anywhere in MN03902011E, so there is no 4xxxx offset to undo — the trap here # is the 1-based *register number*, not PLC notation. # # The same tables print a "Modbus Coil Number" beside each bit, and those # corroborate the conversion independently: # coil number = 16 x (0-based register address) + bit + 1 # Check: status reg 300 -> addr 299; 299*16+0+1 = 4785, which Eaton labels # "Run - bit 0". Its "In Bypass - bit 2" is coil 4787 (+2), "Fault - bit 5" is # 4790 (+5), "Permissive - bit 14" is 4799 (+14). Control reg 400 -> addr 399; # 399*16+0+1 = 6385 = "Run". Both the -1 and the bit ORDER below are pinned by # that arithmetic rather than by reading a column heading. # # FUNCTION CODES: Eaton supports 0x03 read holding, 0x04 read input, 0x06 and # 0x10 write (p.65) against this map, so this app's FC03-only reads reach # everything below. Nothing in this profile is FC04-only. The coil space # (FC01/FC02/FC05/FC0F) is a bit-addressed MIRROR of these same registers, not # a separate map, and is deliberately unused here. # # DRIVE-SIDE SETUP — and on the S611 the important part is NOT a parameter. # Two HARDWIRED 120 Vac inputs on TB3 gate network control (p.11, p.20): # - Permissive (run enable) "must be energized (120 Vac) to enable operation # of all S611 soft starters by BOTH local and network control". Losing it # at any time initiates a coast, soft or pump stop per the setup # parameters — including while the motor is under Modbus control. # - Network "when energized (maintained), selects the network communications # port A (TB4) and/or port B (TB5) as the source of motor control", and # while it is energized the hardwired Start input is ignored. # With those two de-energized the starter still answers reads and still ACKs # writes to register 400 — it simply will not start. Check the terminals, not # the register, when a run is accepted and nothing turns. # Panel-side: P.00 address, P.01 baud, P.02 parity for port A (p.41), mirrored # on the wire at addresses 439/440/441 below. # # LEVEL vs EDGE SENSING (p.21, register address 400) decides what happens # after a trip clears, and the DEFAULT IS LEVEL. With Level sensing and the Run # bit still set, clearing the fault restarts the motor with no further command. # Edge sensing requires the Run bit to go 0 -> 1 again. The run sequence below # writes the 0 -> 1 edge either way, and the reset sequence never carries the # Run bit, so a reset issued from this app cannot itself be a start. # # SCALING is fixed integer engineering units on this map — currents amps x10, # frequency Hz x100, power factor x100, temperatures degC x10 — not panel # decimals and not configuration-dependent. Register 300 # (DCI_ORION_CURRENT_SCALE_FACTOR) reads back the current scale factor, which # Eaton documents as 10; it is exposed below so a unit that disagrees is # visible rather than silently mis-scaled. name = "Eaton S611 (soft starter)" vendor = "Eaton" device_type = "soft_starter" verified = false probe_register = 299 # status word, readable whenever comms port A is alive [connection] summary = "Use native Comms Port A on TB4; D1 is RS485+ and D0 is RS485-. No C441 adapter is required." warnings = ["Isolate line and 120 Vac control power before wiring the starter.", "Network control also requires live 120 Vac Permissive and Network inputs on TB3; these are hazardous control voltages, not low-voltage data terminals."] [[connection.methods]] id = "native_tb4_rs485" title = "Native TB4 Modbus RTU" transport = "serial" hardware = "built_in" port = "Comms Port A TB4: D1 RS485+, D0 RS485-, Common" connector = "TB4 screw terminal block" adapter = "Isolated USB-to-RS-485 adapter" cable = "Shielded two-wire RS-485 cable with reference conductor" parts = ["Small insulated screwdriver", "Qualified 120 Vac control wiring for TB3 enables"] wiring = [{ adapter = "D+ / B+", device = "TB4 D1", signal = "RS-485 positive" }, { adapter = "D- / A-", device = "TB4 D0", signal = "RS-485 negative" }, { adapter = "COM/GND", device = "TB4 Common", signal = "RS-485 common" }] steps = ["Lock out line and 120 Vac control power and locate TB4 Comms Port A.", "Land adapter positive on D1, negative on D0, and reference on Common.", "Have a qualified electrician provide the documented TB3 Permissive and Network-control 120 Vac enables.", "Restore covers and power, then select the serial adapter."] setup = ["Set P.00 address, P.01 baud, and P.02 parity for Port A.", "Select Port A as the network control source and verify Level/Edge sensing for the intended restart behavior."] warnings = ["Removing Permissive must remain the independent stop path.", "Do not connect the adapter to TB4 +24 V."] source = "Eaton MN03902011E, printed pp. 1, 11, 20-21, 41, and 65-66" # Port A factory defaults: P.01 baud = 4 = 19200, P.02 parity = 0 = "Even # (1 stop bit)" (p.41), matching Appendix F's byte characteristics "RTU: 8 bit, # even parity, 1 stop bit" (p.65) and register 441's default. NOT 9600 8N1. [serial] baudrate = 19200 parity = "E" stopbits = 1 [monitor] # Reg 300 -> 299. Bits 1, 3, 4, 6-10 and 15 are printed with no name in # Eaton's table and are left unnamed here rather than guessed. # Bit 0 Run and bit 2 In Bypass are NOT the same thing: Run is set for the # whole time the starter is energizing the motor, including the voltage ramp # and a soft stop's ramp down; In Bypass is set only after the bypass contacts # close at the end of a successful start. Bit 14 Permissive and bit 13 Control # From Net report the two hardwired TB3 inputs described in the header — read # them first when a start is accepted and nothing happens. status_word = { address = 299, bits = { 0 = "Run", 2 = "InBypass", 5 = "Fault", 11 = "Relay1", 12 = "Relay2", 13 = "ControlFromNet", 14 = "Permissive" } } control_word = { address = 399, bits = { 0 = "Run", 2 = "Permissive", 3 = "Reset" } } current_scale_factor = { address = 300 } # Eaton documents this as 10 phase_current_l1 = { address = 301, scale = 0.1, unit = "A" } phase_current_l2 = { address = 302, scale = 0.1, unit = "A" } phase_current_l3 = { address = 303, scale = 0.1, unit = "A" } motor_current = { address = 304, scale = 0.1, unit = "A" } # RMS average voltage_ab = { address = 305, unit = "V" } voltage_bc = { address = 306, unit = "V" } voltage_ca = { address = 307, unit = "V" } line_voltage = { address = 308, unit = "V" } # RMS average # Total kW is a MAGNITUDE; its sign lives in its own register (DCI_POWER_SIGN, # address 311), so this point is deliberately unsigned. output_power = { address = 309, scale = 0.1, unit = "kW" } power_factor = { address = 310, scale = 0.01 } power_sign = { address = 311 } line_frequency = { address = 312, scale = 0.01, unit = "Hz" } motor_thermal = { address = 313, unit = "%" } # overload thermal pile current_unbalance = { address = 314, unit = "%" } voltage_unbalance = { address = 315, unit = "%" } # Address 316 is Reserved in Eaton's table and is not read. # Pole temperatures are documented as "Deg C * 10" with no signedness stated. # They are decoded signed here: a heatsink cannot approach the +3276.7 degC # where the two decodings diverge, so signed is correct across the entire # physical range and additionally right if a cold panel reads below zero. pole_temp_1 = { address = 317, scale = 0.1, signed = true, unit = "degC" } pole_temp_2 = { address = 318, scale = 0.1, signed = true, unit = "degC" } pole_temp_3 = { address = 319, scale = 0.1, signed = true, unit = "degC" } pole_temp_avg = { address = 320, scale = 0.1, signed = true, unit = "degC" } start_count = { address = 321 } run_hours = { address = 322, unit = "h" } unit_id = { address = 337 } # DCI_UNIT_ID — present, meaning undocumented # DCI_MOTOR_CONTROL, reg 400 -> 399. Bit 0 Run, bit 2 Permissive, bit 3 Reset; # bits 1 and 4 are printed unnamed. There is no separate stop bit — a stop is # the Run bit cleared, which is why the stop word is 0x0000. # # 0x0000 is chosen as the resting word rather than "permissive held, run # clear". Eaton's table names bit 2 Permissive but never says what writing it # does, and the hardwired TB3 Permissive terminal is the enable the manual # actually documents. Under EITHER reading of bit 2, 0x0000 means stopped: # Run cleared stops it, and a network permissive dropped also stops it. The # keepalive re-sends the last word written, so the resting word is the one that # must be safe to repeat forever. # # A soft starter has no speed reference and no reverse: speed_register, # speed_scale, max_ref and run_rev are all absent, so `control speed` and # `control run_rev` refuse rather than misbehave. Ramp shape is configuration, # not a live command — start method, start time, initial torque, kick start and # current limit are parameters 405-411 in the restore range below. [control] command_register = 399 step_delay = 0.05 stop = [0x0000] run_fwd = [0x0004, 0x0005] # permissive bit, then permissive + run # Reset is a rising edge on bit 3 taken from a stopped word and returned to # one. It never carries bit 0, so this reset cannot be a run command even # under the default Level sensing described in the header. reset = [0x0000, 0x0008, 0x0000] # WHICH DIRECTION SILENCE FAILS — read this before arming an S611. # Three registers decide, and their DEFAULTS DISAGREE with each other: # 444 DCI_NETWORK_WATCHDOG_ENABLE 0 = Disable (DEFAULT), 1 = Enable # 442 DCI_COMM_LOSS_TIMEOUT_MILLISECS 1-65000 ms, default 2000 # 443 DCI_COMM_LOSS_BEHAVIOR 1 = Fault (default), 2 = Hold last # state, 3 = Stop # AS SHIPPED THE WATCHDOG IS DISABLED. On a factory-default S611 a master that # goes quiet does NOT stop the motor and does NOT trip the starter — the motor # keeps running on the last command. The fault-on-timeout behaviour only exists # once register 444 is set to 1, and even then register 443 can be set to # "Hold last state", which is the same silent-runaway outcome. Enable 444 and # confirm 443 = 1 before trusting the bus as a stop path; until then the # hardwired TB3 Permissive terminal is the only stop that survives a dead link. # The named fault is F.09 "Comm lost port A" (F.10 for port B), p.27 and p.47. # The keepalive interval is set well inside the 2000 ms default timeout; if the # unit has a shorter timeout programmed, shorten this to match. # A C441 adapter on port B carries its OWN timeout at address 109, separate # from 442 — setting one does not set the other. [control.watchdog] interval_ms = 500 fault = "F.09 comm lost port A" # Bit 0 = Run: the starter is energizing the motor. It is set during the # voltage ramp and during a soft stop's ramp down, not only at full voltage. # For "at speed / bypass closed" read status bit 2 instead. [running_check] register = 299 bit = 0 # DCI_TRIP_REASON, reg 324 -> 323. A BITMAP of the active trip reasons, not a # numeric code, so several can be set at once. Bit positions are taken from # Eaton's coil numbers 5169-5184 against the coil formula in the header # (5169 - 16*323 = 1, so coil 5169 is bit 0). # # NO history registers are wired up. The 10-deep fault queue does exist at # addresses 324-333 (Eaton regs 325-334), but it stores the panel FC CODES — # F.03, F.20, F.30 and so on, p.46-47 — which is a DIFFERENT encoding from # this bitmap. This app decodes history with the same scheme as the active # register, so listing the queue here would print FC 20 (motor overload) as # "Jam, Load Disconnect" (bits 2 and 4 of 20). Read the queue by hand if you # need it, and cross-reference the FC table below. # # FC codes for the queue and the display (p.27-28, p.46), NOT usable as codes # for the bitmap above: # 3 watchdog firmware 5 FRam 6 UI comm failure # 7 flash CRC 8 zero volt cross lost # 9 comm lost port A 10 comm lost port B 15 pole over temp # 16 bypass dropout 17 SCR not firing 18 shorted SCR # 19 instantaneous SCR overcurrent 20 motor overload # 21 mains loss 22 under voltage 23 over voltage # 24 phase reversal 25 stall 27 SCR overcurrent # 28 under load 29 current imbalance 30 phase loss # 31 voltage imbalance 33 jam 34 contactor overcurrent # 35 missing temp sensor # The FC list and the bitmap are not one-for-one: the bitmap has no under # voltage / over voltage / voltage imbalance bit and no bypass-related FC # beyond bit 11, so a trip can show on the display with no bit set here. [faults] register = 323 bitfield = true [faults.bits] 0 = "Overload" 1 = "Jam" 2 = "Stall" 3 = "Imbalance" 4 = "Load Disconnect" 5 = "Phase Loss" 6 = "Mains Fault" 7 = "Phase Reversal" 8 = "Shorted SCR" 9 = "SCR Not Firing" 10 = "Pole Overtemp" 11 = "Bypass Dropout" 12 = "SCR Overcurrent" 13 = "Contactor Overcurrent" 14 = "Communication Fault" 15 = "Device Fault" # Read/write configuration block only: addresses 403-438, i.e. Eaton registers # 404 DCI_OVERLOAD_FLA through 439 DCI_USER_DISPLAY_CONFIG. The range is cut # short at BOTH ends on purpose, and each exclusion is a register that a naive # "clone every R/W register" would walk straight into: # 399 DCI_MOTOR_CONTROL — the run command # 400 DCI_START_CONTROL_EDGE_LEVEL — changes restart-after-trip behaviour # 401 DCI_COMMAND_REGISTER — 1/2/3 clear run hours, start count, # fault queue; destroys the unit's history # 402 DCI_CONFIGURATION_RESET — 1 = soft reset, 2 = FACTORY DEFAULTS. # Writing 2 here wipes the configuration # the restore is trying to install. # 439-441 Modbus address, baud, parity — cuts the link mid-restore # 442-444 comm-loss timeout, behaviour, watchdog enable — the safety # settings, which must be a decision on # this bus, not an inheritance from # whatever unit was cloned # Addresses 409 and 418-420 inside the range are marked Reserved by Eaton; a # clone reads and writes them back unchanged, which is harmless. # # WARNING for clone/restore: this map exposes NO frame-size or unit-rating # register. Address 403 is the MOTOR's FLA, not the starter's rating, and # DCI_UNIT_ID at 337 has no documented meaning, so nothing here can catch a # 414 A S611's configuration being pushed onto a 52 A unit. There is no # [rating] section for that reason. Read the type label by eye before # restoring — Eaton sells eleven control-board current ratings from 52 A to # 414 A in this family (p.38). [parameters] ranges = [[403, 438]]