Attachment to operating instruction odourant control OEXD / OKR 7 B7.

571 en

In this attachment the implementation of the MODBUS-communication protocol

into the odourant control OEXD / OKR 7 is described.

Validity range: from version V2.04

Table of contents

1 Introduction

2 Modbus / RTU

2.1 The interface parameters

2.2 General form of the telegrams

2.3 Data types

2.4 Data addressing

2.5 Calculation of the check word (CRC16)

2.6 Error handling

2.7 Telegram examples

2.8 List of parameters

2.9 List of error signals

MODBUS ® - Modbus is a registered trade mark of Schneider Electric.

Detailed communication protocol specifications are available via the website
http://www.modbus.org .
1 Introduction

The Modbus-communication protocol originally was developed by Modicon (now Schneider

Electric) for the data exchange with their controllers. Data was transferred in the form of 16 –
bit registers (Integer-format) or as status information in the form of data bytes. Over time the
communication protocol was extended and also taken over by other manufacturers for their
equipment. New data types were added, especially to achieve a higher resolution of the data
transmitted.

The Modbus-communication protocol is a single-master protocol. This master controls the

complete transfer and monitors the possible appearance of timeouts (no reply from the unit
addressed). The equipment connected must send telegrams after request by the master
only.
The basic information following is limited to the Modbus/RTU communication protocol.
Also only the functions supported by the Modbus equipment of LEWA are described.

2 The MODBUS/RTU-communication protocol

2.1 The interface parameters

Character format: can be partly parameterized

1 Start-, 8 Data-, 1 Stopbit, even parity
1 Start-, 8 Data-, 1 Stopbit, odd parity
1 Start-, 8 Data-, 1 Stopbit, no parity (common, but not according to MODBUS-specification)
Baudrate: parameterizable, common values are
2400, 4800, 9600 und 19200 Baud

2.2 General form of the telegrams

equipment-address Function Data CRC-Check

8 Bits 8 Bits n * 8 Bit 16 Bits

According to MODBUS®-specification an interval of 3.5 characters minimum must be

maintained between two telegrams. Within a telegram the individual characters must not
have a gap of more than 1.5 characters. A typical transmittal e.g. looks as follows:

interv. telegram 1 Æ interv. telegram 2 Æ interv. telegram 3 etc.

.
Comment: The monitoring of the interval times specified by the master is very difficult as
especially windows systems are not designed for such frame conditions. In practical use
therefore much bigger character spacing is tolerated. This however can lead to problems
concerning the equipment addressing as the communication protocol framing can be lost.
The receiver so can interpret data as telegram start by mistake.

Equipment - address
It states which unit should be addressed (Master→Slave) resp. which unit should reply
(Slave→Master). Permissible Modbus addresses are 1..247.

Function
States the reason for the data transfer. Following standard functions are used by LEWA
equipment:
Code MODBUS-Function Register Application examples
01H Read Coil Status 0xxxx Read-out of digital output conditions
02H Read Input Status 1xxxx Read-out of digital input conditions
03H Read Holding Registers 4xxxx Read-out of values measured, counter readings,
average values, desired values and configuration values
05H Write Single Coil 0xxxx Execution of functions, switch-over of configuration
values
10H Write Multiple Registers 4xxxx Writing of pre-codes and configuration values

Data
Contains the information to be transferred. This field is sub-divided into register, number of
registers to be transferred and, if applicable, read-out information or information to be stored.
Data usually is transferred as a multiple of 16-bit registers.

CRC-Check (Check word)

The CRC16-Check total is calculated over all bytes of a telegram. It also is calculated by the
receiver to find out transmission errors.

2.3 Data types

- Standardized data types: Byte (8-Bit) and Register (16-Bit). According to the Modbus-
specification for a register first the High-Byte, followed by the Low-Byte will be transmitted.
- Extented data types: 32-Bit-Integer are transmitted as 2 subsequent 16-Bit-registers. The
transmission sequence of the registers is not determined. In most applications however it is
as follows:

16-Bit numbers
Reg (Bit 15..0)
HByte LByte

32-Bit numbers
Reg_L (Bit 15..0) Reg_H (Bit 31..16)
HByte LByte HByte LByte
Sequence 1. 2. 3. 4.

2.4 Data addressing

Modbus is grouping different data types according to references. The telegram functions 03H
and 10H e.g. are using register-addresses from 40001. The reference 4xxxx in this case is
implicit, this means fixed by the telegram function used. In the telegram therefore the 4 is
deleted and the reference usually is not stated in the Modbus descriptions.
A specialty of the Modbus telegram also is, that the numbering of the registers stars at 1, the
addressing however starts at 0. So, f. i. for reading the register 40001 in the telegram the
address 0 is used. In detail, this also can be taken from the telegram examples.
2.5 Calculation of the check word (CRC16)
The calculation takes place via all characters of the telegram with the exception of the check
word. The lower value byte (Crc_LByte) is set at second last, the higher value byte
(Crc_HByte) at the last position in the telegram.
ATTENTION: this is a reverse sequence when compared to the transmittal of data registers.
The receiver of the telegram calculates the check word again and compares it to the one
received.

2.6 Error handling

In case of a transmission error, when the CRC16 calculated by the receiver does not
match the one received, no acknowledgement is send to the master and a timeout is
provoked. The same happens when a non-existing (or switched off) unit is addressed.
Should the receiver pick-up another error it will send a corresponding error signal back to the
master.

Unit reply:
Address Code Data Check total
LByte HByte
11H Code+80H Error code CRC16

The function code received by the unit is returned as error code. However the highest value
bit (MSB) is set to indicate an error.

Following error codes can appear:

Error code Meaning
01H Use of a non-supported function code
02H Use of a non-permitted memory register: invalid register address was used or
it was tried to write on a protected register address.
03H Use of non-permitted data values e.g. a wrong number of registers.
06H The unit can not process the request at the moment. Repeat request later.

2.7 Telegram examples

Function 01H : READ COIL STATUS

Example: reading the (Digital)-output conditions 30 to 39 of unit 17. These are 10 conditions,
which can be shown with 2 data bytes.

Request Master->Slave
Address Function Data CRC-Check
Start address Number of conditions
addr 01H High-Byte Low-Byte High-Byte Low-Byte crc16

Reply Slave->Master
Address Function Data CRC-Check
No. Data bytes Condition 37..30 Condit. 39..38
addr 01H 8 Bit 8 Bit 8 Bit crc16

Example (Hex): >>>> 11 01 00 01 00 0A crc_l crc_h

<<<< 11 01 02 11 01 crc_l crc_h
11H=00010001B: Relay 5,1 EIN; Relay 8,7,6,4,3,2 OFF
01H=00000001B: Alarm light ON; Metering pump OFF

Comment: Start address 30 is addressed as start address 29 according to the MODBUS-

specification!

Function 02H : READ INPUT STATUS

Example: reading the (Digital) input conditions 1 to 13 of unit 15. These are 13 conditions,
which can be shown with 2 data bytes.

Request Master->Slave
Address Function Data CRC-Check
Start address No. of conditions
addr 02H High-Byte Low-Byte High-Byte Low-Byte crc16

Reply Slave->Master
Address Function Data CRC-Check
No. Data bytes Condition 37..30 Condi. 39..38
addr 02H 8 Bit 8 Bit 8 Bit crc16

Example (Hex): >>>> 0F 02 00 00 00 0D crc_l crc_h

<<<< 0F 02 02 01 0C crc_l crc_h
00H=00000000B: input 1 ON; inputs 8,7,6,5,4,3,2 OFF
0CH=00001100B: input 12, 11 ON; inputs 13,10,9 OFF

Comment: Start address 1 is addressed as start address 0 according to the MODBUS-

specification!

Function 03H : READ HOLDING REGISTERS

Example: reading out of a long-number (32-Bit) onto the register addresses 52 and 53 from
unit 18.

Request Master->Slave
Address Function Data CRC-Check
Start address No. of registers
addr 03H High-Byte Low-Byte High-Byte Low-Byte crc16

Reply Slave->Master
Address Function Data CRC-Check
No. of data bytes Information
addr 03H n (8 Bit) n/2 Register crc16

Example (Hex): >>>> 12 03 00 33 00 02 crc_l crc_h

<<<< 12 03 04 27 10 00 00 crc_l crc_h
00002710H= 10000 Decimal
Comment: Start address 52 is addressed as start address 51 according to the MODBUS-
specification!

Function 05H : WRITE SINGLE COIL

Example: Execution of the function „RESET error“ on address 20 of unit 15.

Request Master->Slave
Address Function Data CRC-Check
Start address Switch condition
addr 05H High-Byte Low-Byte High-Byte Low-Byte crc16

Reply Slave->Master
Address Function Data CRC-Check
Start address Switch condition
addr 05H High-Byte Low-Byte High-Byte Low-Byte crc16

Example (Hex): >>>> 0F 05 00 13 FF 00 crc_l crc_h

<<<< 0F 05 00 13 FF 00 crc_l crc_h
FF00H= activate function resp. switch-on condition (e.g. control to external gas counter)
0000H= switch condition off (e.g. control to internal gas simulation)

Comment: Start address 20 is addressed as start address 19 according to the MODBUS-

specification!

Function 10H : WRITE MULTIPLE REGISTERS

Example: setting the desired value in register 50 of unit 17.

Request Master->Slave
Addres Function Data CRC-Check
s
Start addr. Number of Number of Information
registers bytes
addr 10H High Low High Low n n Bytes crc16

Reply Slave->Master
Address Function Data CRC-Check
Start address No. of registers
addr 10H High-Byte Low-Byte High-Byte Low-Byte crc16

Example (Hex): >>>> 11 10 00 31 00 01 02 00 B4 crc_l crc_h

<<<< 11 10 00 31 00 01 crc_l crc_h
00B4H= set desired value to 180 (this corresponds to 18,0 µl/Nm³)

Comment: Start address 50 is addressed as start address 49 according to the MODBUS-

specification!
2.8 List of parameters

Address Function Parameters and format description

0001 02H Input from gas counter 1
0002 02H Input from gas counter 2
0003 02H Input from gas counter 3
0004 02H Contact from frequency inverter
0005 02H External reset-input
0006 02H Input STOP-odourization resp. slug odourization
0007 02H Contact from PTC-release unit resp. feedback from P1/P2-Relay
0008 02H Initiator from MLM pump 1
0009 02H Contact RI from KMM resp. float switch LSH
0010 02H Contact RII from KMM resp. pulse from FM in the discharge line
0011 02H Float switch LSLL
0012 02H Float switch LSHH
0013 02H Float switch LSH resp. initiator from MLM pump 2
0020 05H Function „acknowledge alarm“
0021 05H Function „delete totalizers“
0022 05H Function „delete average values“
0023 05H Function „ERROR-delete memory“
0024 05H Function „incremented pointers to ERROR-memory“
0028 01H, 05H Switch closed loop control ON/OFF (0000 = switch off, FF00 =
switch on) resp. read condition
0029 01H, 05H Switch operating mode „Internal/External“ (0000 = Internal, FF00
= External) resp. read condition
0030 01H Read relay „common alarm“ (0 = alarm, 1 = no alarm)
0031 01H Read relay „Flow alarm“ (0 = alarm, 1 = no alarm) valid only if the
relay was activated in the menu!
0032 01H Read relay „lack of product” (0 = alarm, 1 = no alarm) valid only if
the relay was activated in the menu!
0033 01H Read relay „pulse per xx ml“
0034 01H Read relay „SV1 from KMM“
0035 01H Read relay „SV2 from KMM“ resp. „SV in venting line“
0036 01H Read relay „SV in discharge line“
0037 01H Read relay „SV in filling line“
0038 01H Read no. of metering pump strokes
0039 01H Read condition of alarm light (0 = no alarm, 1 = alarm)
0050 03H, 10H Read resp. write desired value of concentration. The value is
transferred as full number and interpreted in the format xx.x
ml/Nm³ ! The number 180 means 18,0 µl/Nm³.
Address Function Parameter and format description
0051 03H Read actual value of concentration. The value is transferred as full
number and interpreted in the format xx.x ml/Nm³ ! The number
180 means 18,0 µl/Nm³.
0052 – 03H Read the current gas flow resp. gas simulation. Here it is a 32-Bit
0053 number therefore two registers must be read.
0054 – 03H, 10H Read or write the value of the gas simulation. Here it is a 32-Bit
0055 number therefore two registers must be read.
0056 – 03H Read totalizer of the gas volume. The gas volume is added-up in 3
0058 registers which must be read. Registers 0056 and 0057 contain a
32-Bit number up to 1 billion, the register 0058 contains the carry-
over of the billion value as 16-Bit number. The value is transferred
as full number and interpreted in the format xxxxxxxxxxxx.xx Nm³ !
The number 10000000 means 100000,00 Nm³.
0059 – 03H Read totalizer of the odourant volume. Here it is a 32-Bit number
0060 therefore two registers must be read. The value is transferred as
full number and interpreted in the format xxxxxxxx.xx Nm³ ! The
number 25000 means 250,00 l.
0061 03H Read start date of the totalizers. The date is displayed in the MS-
DOS format which is calculated according to the following
equation: ((Year – 1980) * 512) + (Month * 32) + day. The date
26.02.2008 so would result in the number 14426
0062 03H Read start time of the totalizers. The time is displayed in the MS-
DOS format which is calculated according to the following
equation: ((Hour * 2048) + (Minute * 32). The time 16.02 so would
result in the number 32832..
0063 03H, 10H Read number of reports in ERROR-memory resp. reset pointer to
the reports. The writing process of a deliberate value onto this
register resets the reading pointer to the latest report. If a new
error takes place during the read-out of the ERROR-memory the
pointer is automatically reset to the newest report!
0064 03H Read date of report to which the pointer in the ERROR-memory
points. The date is shown in the MS-DOS format (refer to
description under register 0061).
0065 03H Read time of report to which the pointer in the ERROR-memory
points. The date is shown in the MS-DOS format (refer to
description under register 0062).
0066 03H Read error number of report to which the pointer in the ERROR-
memory points. For list of error numbers refer to chapter 2.9
0067 03H, 10H Read resp. set the active metering pump at an activated pump
switch over P1/P2. As value the current active metering pump 1 or
2 is displayed. If no pump switch over is activated the value 0 is
returned!
0068 03H, 10H Read resp. write permissible tolerance (1 – 99%) which leads to a
metering deviation signal when it is exceeded.
0069 03H, 10H Read resp. write number of measuring cycles (1 – 99) at which an
alarm is generated.
Address Function Parameters and format description
0070 – 03H Read average value of gas counter 1. This value is updated only if
0071 the average value generation in the control is activated! Here it is
a 32-Bit number therefore two registers must be read.
0072 - 03H Read average value of gas counter 2. This value is updated only if
0073 the average value generation in the control is activated! Here it is
a 32-Bit number therefore two registers must be read.
0074 – 03H Read average value of gas counter 3. This value is updated only if
0075 the average value generation in the control is activated! Here it is
a 32-Bit number therefore two registers must be read.
0076 03H Momentary current input at analogue input 1 (0,00 – 20,00 mA).
The value is transmitted as full number and interpreted in the
format xx.xx mA! The number 1000 means 10,00 mA.
0077 03H Momentary current input at analogue input 2 (0,00 – 20,00 mA).
The value is transmitted as full number and interpreted in the
format xx.xx mA! The number 1000 means 10,00 mA.
0078 03H Momentary current input at analogue input 3 (0,00 – 20,00 mA).
The value is transmitted as full number and interpreted in the
format xx.xx mA! The number 1000 means 10,00 mA.
0079 03H Momentary current input at analogue input 4 (0,00 – 20,00 mA).
The value is transmitted as full number and interpreted in the
format xx.xx mA! The number 1000 means 10,00 mA.
0080 03H Momentary voltage input at analogue input 5 (0,00 – 30,00 volts).
The value is transmitted as full number and interpreted in the
format xx.xx volts! The number 2400 means 24,00 volts
0081 03H Monetary adjusting value of the metering pump (0,0 – 100,0%).
The value is transmitted as full number and interpreted in the
format xxx.x %! The number 900 means 90.0 %.
0082 03H Read momentary efficiency of metering pump (0 – xxx%).
0083 03H Read KMM test variable. The number of pump strokes in
reference direction is feed-back.
0084 03H Read KMM test variable. The number of pump strokes against
reference direction is feed-back.

2.9 List of error signals

Error number Signal

1 Over metering
2 Low metering rate
3 HELP, no feedback from flow meter in metering line
4 The gas flow is too high
5 Initiator of metering pump MLM defective
6 Initiator of metering pump MLM not reached
7 Power on
8 Lack of product LSLL
9 Alarm over filling LSHH
10 P1/P2-Relay defective
11 RS XXX error
12 Battery empty
13 RAM defective
14 New initialisation
15 Increasing additional metering
16 Analogue signal from gas counter 1 defective
17 Analogue signal from gas counter 2 defective
18 Analogue signal from gas counter 3 defective
19 Signal gas pressure defective
20 Signal concentration defective
23 Limit value gas counter 1
24 Limit value gas counter 2
25 Limit value gas counter 3
26 Ratio between gas volume and volume metered out of range
27 P1 defective, switch-over
28 P2 defective, switch over
29 EEPROM error
30 Flow rate deviation too high
31 Alarm drive
32 Alarm charge controller
33 PTC alarm
34 Wrong characters from serial interface
37 EEPROM defective
38 Wrong parameters
39 Concentration ratio too high for final concentration control
40 Cyclic switch-over P1/P2

Issue March 2008