SHENZHEN ENCOM ELECTRIC TECHNOLOGIES CO. EN500 Series Service Manual page 242

Inquiry frame:
: 0 1 0 3 0 0 0 1 0 0 0 1 F A \n\r
(The detail introduction of every byte)
":": beginning symbol
0 1: Slave address
0 3:read the command
0 0 0 1:storage address of reading parameter
0 0 0 1:the number of reading the parameter
F A:{ 0 1 0 3 0 0 0 1 0 0 0 1} for LRC checksum.
0xFA = 0x100 - (0x01 + 0x03 + 0x00 + 0x01 + 0x00 + 0x01)
Response frame:
: 0 1 0 3 0 2 0 0 3 3 C 7 \n\r
(The detail introduction of every byte)
":": beginning symbol
0 1: Slave address
0 3:read the command
0 2:The byte length of return parameter Data.
0 0 3 3:return parameter，current storage value
C 7:{ 0 1 0 3 0 2 0 0 3 3} for LRC checksum.
0xC7 = 0x100 – (0x01 + 0x03 + 0x02 + 0x00 + 0x33)
The main frame writes slave address single register, command code: 06
Send
1 2
byte
Remark:
Slave address:
Single inverter ID code，range:0～247.
Thereinto, address 00 is broadcast address.
Command code:
Read parameter from inverter or command of Data, the value is:06
Register address:
The storage address of inverter function parameter, is double byte.
The host frame
The host frame format
2 4
Appendix A Modbus communication protocol
4 2 2
235