FLOWSIC 600. Secification MODBUS

Transcription

1 FLOWSIC 600 Secification MODBUS Specification MODBUS Revision number: V2.1 Produced by: SICK ENGINEERING GMBH Bergener Ring 27 D_01458 Ottendorf-Okrilla :42 1. History Version Changes Date 1.6 Initial (hardware V1.x) Dietz 2.0 Turbulence registers added, description Master burst mode communication (hardware V2.x) Dietz 2.1 Description RTU protocol Hoffmann E_33118 A Seite 1 von 17

2 1. History 1 2. MODBUS Reference Specification Data Protocol Device Address Communication Protocol MODBUS MODBUS ASCII MODBUS RTU Implemented Data Types Implemented MODBUS-Commands Code 0x03 Read Multiple Registers Code 0x06 Write Single Register Transmission Status Error Code Error Sources Register reference Short word registers Long word registers Floating point registers Examples Read one 30nn register (unsigned integer) Read one 50nn register (unsigned long) Write one 50nn register (unsigned long) Read / Write one 70nn register (floating point) Exception responses Supported Exception Responses Communication Master Mode: Implementation: Timing: Register reference Control Register Structure Type 1 (total size: 26 bytes) Structure Type 2 (total size: 68 bytes) Structure Type 3 (total size: 114 bytes) 17 E_33118 A Seite 2 von 17

3 2. MODBUS Reference Specification 2.1. Data Protocol - Serial, asynchronous, half duplex - Baudrate: 9600bps (Standard), 19200bps, 38400bps, 57600bps - Start bits: 1Bit - Data bits: 8Bit - Stop bits: 1Bit - Parity: none 2.2. Device Address The FLOWSIC 600 can use the communication slave addresses in the range of 1 through 127 (Register 5020). A parameter reset sets the device address always back to 1 (factory setting). A query on the broadcastaddress 0 is answered by the system, giving the device address in the answer Communication Protocol MODBUS The communication protocol is implemented based on Modicon MODBUS III reference J. ( (part: PI-MBUS-300)). Only the ASCII mode is supported. The FLOWSIC 600 is always the communication slave. The external host has to work as a communication master MODBUS ASCII a) ASCII Protocol Frame In the ASCII protocol mode two ASCII characters (0-9, A-F) are used to transfer one byte of data. The frame starts with a : as the preamble. The frame is closed with the character group Carriage Return (CR) Line Feed (LF) as the postamble. Modbus ASCII telegram: Start Address Function Data LRC Check End 1 Char 2 Chars 2 Chars n Chars 2 Chars 2 Chars 0x3A x0D 0x0A b) Timeout The maximum allowed response timeout is 2 seconds. The maximum timeout between two received characters is 1 second. In general a request will be answered immediately, at the latest in the next measuring cycle (response time typically less than 100msec). If necessary, the response time can be delayed by setting a delay time in the register MODBUSDelay (register 5022, value100, msec). c) Error Detection The data packet is combined with a checksum (LRC) to increase the reliability of the transmitted data. LRC longitudinal redundancy check. Algorithm: All hexadecimally coded characters will be converted into 8-bit binary characters. All these characters are added. The overflow flag will be ignored. Finally the two-complement of the sum is formed. Pre- and postamble will not be used during the checksum calculation. E_33118 A Seite 3 von 17

4 MODBUS RTU a) RTU Protocol Frame In RTU mode all data are transferred as binary values. Possible characters are 0 9 and A F hexadecimal. Modbus RTU telegram: Start Address Function Data CRC Check End 8 Bit 8 Bit n x 8 Bit 16 Bit 3,5 t Byte CRC low, CRC High 3,5 t Byte T Byte = lenght of one character Example for 1T Byte : Baud rate: Baud t Bit = 1/57600 = 17,36 µs t Byte = 8 Bit * 17,36 µs = 138,88 µs + (2*17,36 µs) = 173,6 µs b) Timeout Before start of any transmission a break of 3,5 t Byte is required. After this break the data telegram must be transmitted in a continuos stream of characters. The telegram will be ignored in case of more than 1,5 t Byte interrupt. c) Error detection Similar as for the ASCII protocol check sums are calculated using cyclic redundancy check (CRC) method. The CRC is calculated for the complete data of each telegram and is represented by 16 bit integer. The CRC is transferred by 2 bytes starting with the last significant bit (LSB) followed by the most significant bit (MSB). Algorithm to claculate CRC: 1. init of CRC-register with 0xFFFF 2. XOR concuntion of the first data byte with the LSB of the CRC-register 3. write result into CRC-register 4. shift CRC-register by 1 bit right 5. fill MSB of CRC-register with 0 6. If LSB was 0: proceed with step 4 If LSB was 1: XOR conjuction of CRC-register with fixed value (polynomial) 7. repeat step 3 and 4 for 8 shifts Implemented Data Types All implemented data types are grouped. This allows sorting and distinguishes the data type by the register number. Note that the 32bit registers are counted as one register number opposite to some MODBUS implementations which use two registernumbers to represent one 32bit number! Integer 16bit Register Group 3xxx 16-bit unsigned integer MSB LSB Bits NNNN NNNN NNNN NNNN Order B0 B1 B2 B3 Integer 32bit Register Group 5xxx 32-bit unsigned integer MSB LSB Bytes NNNN NNNN NNNN NNNN NNNN NNNN NNNN NNNN Order B0 B1 B2 B3 B4 B5 B6 B7 Float 32bit (IEEE-754) Register Group 7xxx IEEE float Sign (1bit), Exponent (8bits), Mantissa (23bits) Bytes SEEEEEEE EMMMMMMM MMMMMMMM MMMMMMMM Order B0 B1 B2 B3 B4 B5 B6 B7 E_33118 A Seite 4 von 17

5 2.4. Implemented MODBUS-Commands Code 0x03 Read Multiple Registers Used to read out the value of one ore more (interrelated) registers. The command must declare - the register number of the first register to read (START_REG) - and the number of registers to read (REG_CNT). - The maximum number of registers wich can be read by a request is 50. Command: :, ADDR, 0x03, START_REG MSB, START_REG LSB, REG_CNT MSB, REG_CNT LSB, LRC, CR, LF Answer: :, ADDR, 0x03, BYTE_CNT,... DATA..., LRC, CR, LF Note that the read request of a block with a gap between defined registernumbers results in an error message (Code 0x02, unsupported register number) Code 0x06 Write Single Register Sets a new value into the defined register. The command must declare the number of the register to be modified (START_REG) and the new value (VALUE). Command: :, ADDR, 0x06, START_REG MSB, START_REG LSB, VALUE, LRC, CR, LF Answer: :, ADDR, 0x06, REG MSB, REG LSB,... VALUE..., LRC, CR, LF E_33118 A Seite 5 von 17

6 2.5. Transmission Status Error Code A corrupted request will be answered by an error status code. The function code of the answer is formed by adding 0x80hex. Status Code Name Description Code 0x01 Unknown Function Code The received function code is not supported by the device. Code 0x02 Unsupported Register Number. The requested register number is not used by the device. Code 0x03 Invalid Data Value The received data value exceeds the defined valid range. Example: Unknown register number Request: ASCII Bytes Answer: B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 Hex 0x3A 0x31 0x31 0x30 0x33 0x39 0x39 0x39 0x39 0x30 0x31 0xB9 0x0D 0x0A ASCII : ASCII Bytes Start Address Function code Register Number LRC CRLF B0 B1 B2 B3 B4 B5 B6 B11 B12 B13 Hex 0x3A 0x31 0x31 0x38 0x33 0x30 0x32 0x6A 0x0D 0x0A ASCII : Start Address Function code Error Status Code LRC CRLF Error Sources CODE 0x01 Unknown Function Code a.) Command code is not supported (only command code 0x03 or 0x06 is supported) b.) Write access to a parameter without previously activated configuration mode c.) Write access is avoided by active parameter protection switch. d.) Write access to a read only defined register. CODE 0x02 Unsupported Register Number a.) The declared register number is not used and supported by the device. b.) Read command: The register number is valid, but the number of registers to read exceeds the register group border or the number of registers to read is more than 50. CODE 0x03 Invalid Data Value a.) Write command: The declared data value exceeds the defined value range of the register. E_33118 A Seite 6 von 17

7 2.6. Register reference Short word registers Register Access Unit Description 3001 R/W Device identification (flow meter type) 3002 R/W System control register 3003 R System status R Status register path R Number of valid samples of path 1..4 (related to data block size and measure rate) R Digit AGC level of receiver 1A, 1B,..., 4A, 4B 3020 R mv VBatt Level 3024 R/W Password Register 3025 R/W AO Source Register 3026 R/W Frequenz Source Register 3027 R/W Hz Test Frequenz Forward 3028 R/W Hz Test Frequenz Reverse 3029 R Freq Current R Undefined registers returns (0x02 see ERROR CODES) Register Name and Description Unit Default Type Access 3002 SystemControl n.n. 0 INT R/W Register zur Auswahl von Gerätefunktionalitäten Bit Erklärung 0 Normal Operation Mode 0 / Configuration Mode 1 1 Path 1 deactivated 0 / Path 1 activated 1 2 Path 2 deactivated 0 / Path 1 activated 1 3 Path 3 deactivated 0 / Path 1 activated 1 4 Path 4 deactivated 0 / Path 1 activated 1 5 Path 1 Checkcycle deactivated 0 / Checkcycle activated 1 6 Path 2 Checkcycle deactivated 0 / Checkcycle activated 1 7 Path 3 Checkcycle deactivated 0 / Checkcycle activated 1 8 Path 4 Checkcycle deactivated 0 / Checkcycle activated 1 9 Reset Error Volume Counter 10 Engineering Units, definiert Einheitensystem für Lesen und Schreiben von MODBUS Registern welche physikalische Werte repräsentieren, 0 metric unit system SI [m, m³/h, m/s] 1 english unit system US [ft, ft³/h, ft/s] 11 Reserved 12 Test Watchdog Looks the watchdog trigger. System restarts after 1,5sec 13 Reset the Learnt Path Conditions gelernte Pfadverhältnisse werden zurückgesetzt 14 Continuous Mode used during signal diagnosis; the system transmits always an upand downstream signal; during normal operation the measure cycle will be canceled after receiving the upstream signal, if this signal could not be used to detect a transit time 15 Reserved E_33118 A Seite 7 von 17

8 Register Name and Description Unit Default Type Access 3003 SystemStatus n.v. 0 INT R Bit Description 0 Measure Mode 1 Measure valid 2 Reduced Accuracy 3 Warning Self Diagnostic 4 Hardware Lock 5 Paht 1 Error if LimitErrCount exceeded 6 Path 2 Error if LimitErrCount exceeded 7 Path 3 Error if LimitErrCount exceeded 8 Path 4 Error if LimitErrCount exceeded 9 EEPROM Error 10 IO Parameter Error 11 reserved 12 Warning IO Range 13 DSP-fault 14 Compensation valid 15 DSP Parameter Error Path x Status Bit Description 0 WarnSNR 1 WarnAGCDeviation 2 WarnAGCLimit 3 WarnSOSDeviation 4 Announced Burst 5 Matrix Singular (No Fit) 6 Max too big (Bad Signal) 7 Max too small (Bad Signal) 8 MaxPos too early (Bad Signal) 9 MaxPos too late (Bad Signal) 10 PathError 11 Limit SNR (Bad Signal) 12 Too much Iteration (No Fit) 13 Delta Fit (No Fit) 14 Check 15 Limit MSE (No Fit) n.v. 0 INT R E_33118 A Seite 8 von 17

9 Long word registers Register Access Unit Description 5001 R SN Device 5002 R Software version 5003 R SN Analog 5004 R ConstantsCRC 5005 R ProgramCRC 5006 R ParameterCRC 5007 R/W ddmmyyyy Date 5008 R/W hhmmss Time 5010 R * Forward volume 5011 R * Forward volume Error 5012 R * Reverse volume 5013 R * Reverse volume Error 5014 R/W ConterResolution; Volume in CounterRes m = olution 3 VolumeCount 1000 VolumeCount: content of the registers 5010, 5011, 5012, R/W Modbus ID 5021 R/W BaudRate 5022 R/W msec ResponceDelay R Undefined registers returns (0x02 see ERROR CODES) E_33118 A Seite 9 von 17

10 Floating point registers Register Access Unit Description 7001 R m³/h Volume flow rate at line conditions (=actual volume flow) 7002 R m³/h Volume flow rate at base conditions 7003 R m/s Velocity of sound (N-path average value) 7004 R m/s Gas Velocity (N-path average value) R m/s Velocity of sound per path 1..4 (averaged values) R m/s Velocity of gas per paths 1..4 (averaged values) R db SNR receiver 1A, 1B,..., 4A, 4B (averaged values) 7021 R/W Gas temperature 7022 R/W bar Pressure(abs) 7023 R/W RealgasFactor 7024 R/W TemperatureBase 7025 R/W PressureBase 7026 R/W RealFactorBase 7027 R/W Meter Factor (Number of impulses per m³) 7028 R/W m³/h AO low 7029 R/W m³/h AO high 7030 R/W s AO TimeConstant 7031 R/W ma AO Test 7032 R/W ma AO Error 7033 R/W AO Gain 7034 R/W ma AO Offset 7035 R/W ma AO Current 7036 R/W m³/h LowFlowCutoff 7037 R/W Adjust FactorForward 7038 R/W Adjust FactorReverse 7039 R/W m³/h ZeroFlowOffset 7040 R/W Temperature Fix 7041 R/W bar Pressure(abs) Fix 7042 R/W Compressebility Fix R % rel. Turbulance of the path (Sx / average path velocity) Undefined registers returns (0x02 see ERROR CODES) E_33118 A Seite 10 von 17

11 2.7. Examples Read one 30nn register (unsigned integer) assumed register value: Register: 3001 (0x0BB9h) value: 0x1234h Slave Address = 0x11h LRC = 0xFF - (0x11+ 0x03 + 0x0B + 0xB9 + 0x01) + 0x01 Query: transmitted ASCII String: ASCII Bytes B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 B14 B15 16 Hex 0x3A 0x31 0x31 0x30 0x33 0x30 0x42 0x42 0x39 0x30 0x30 0x30 0x31 0x32 0x37 0x0D 0x0A ASCII : B B Start Response: received ASCII String: Slave- Address Function Code Register Number of Points LRC CRLF ASCII Bytes B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 B14 Hex 0x3A 0x31 0x31 0x30 0x33 0x30 0x32 0x31 0x32 0x33 0x34 0x41 0x34 0x0D 0x0A ASCII : A Start Slave-Address Function Code Byte Count Register value LRC CRLF LRC = 0xFF - (0x11+ 0x03 + 0x02 + 0x12 + 0x34) + 0x Read one 50nn register (unsigned long) assumed registers values: Register: 5006(0x138Eh) Slave Address = 0x11h Query: transmitted ASCII String: value: 0x h 0x3A 0x31 0x31 0x30 0x33 0x31 0x33 0x38 0x45 0x30 0x30 0x30 0x31 0x34 0x41 0x0D 0x0A : E A - - Start Slave-Address Function Code Register Number of Points LRC CRLF Response: received ASCII String: 3A D 0A : D Start Slave- Address Function Code Byte Count Register value LRC CRLF E_33118 A Seite 11 von 17

12 Write one 50nn register (unsigned long) assumed register value: Register 5002 (0x138Ah) Slave Address = 0x11h value: 0x h Query: transmitted ASCII String: 3A D 0A : A A Start Slave- Address Function Code Response: received ASCII String (echo!): Register Register value LRC CRLF 3A D 0A : A A Start Slave- Address Function Code Register Register value LRC CRLF Read / Write one 70nn register (floating point) equal to Read / Write one 50nn register E_33118 A Seite 12 von 17

13 2.8. Exception responses If an error occurred the function code respond with <function code> + 0x Supported Exception Responses Code Name Description Code 0x01 Illegal Function Code. The received message function is not an allowable action for the device. Code 0x02 Illegal Data address. The address referenced is not an allowable address for this device. Code 0x03 Illegal Data values. The value written to the data field is not in a valid range Example: Illegal Data Address Query: transmitted ASCII String: ASCII B0 B1 B2 B3 B4 B5 B6 B7 B8 B9 B10 B11 B12 B13 Bytes Hex 0x3A 0x31 0x31 0x30 0x33 0x39 0x39 0x39 0x39 0x30 0x31 0xB9 0x0D 0x0A ASCII : Start Address Function code Register Number LRC CRLF Response: received ASCII String: ASCII B0 B1 B2 B3 B4 B5 B6 B11 B12 B13 Bytes Hex 0x3A 0x31 0x31 0x38 0x33 0x30 0x32 0x6A 0x0D 0x0A ASCII : Start Address Function code Error Code LRC CRLF CODE 0x01 Illegal Function Reasons: a.) b.) c.) d.) Command is not supported (command<>0x03/0x06) A parameter set command is given, but the device is in RUN mode. A parameter write command is given, but the device is locked with hardware (bridge/jumper). A parameter write command is given, but the address is refereed to read only register. CODE 0x02 Illegal Data address Reasons: a.) b.) c.) The refereed register doesn t exist. Read command: The refereed register is correct, but the number of reading registers leaded to overlapping. Read command: The refereed register is correct, but the number of reading registers is too much. CODE 0x03 Illegal Data value Reasons: a.) Write command: The refereed Data value is out of input limits. E_33118 A Seite 13 von 17

14 3. Communication Master Mode: The FLOWSIC 600 has the ability to communicate to more than two devices (usually a flowcomputer and a supervisory system). This would give the possibility for customer specific diagnostic data visualisation and data storage in a, mostly PC based, supervisory system for the metering station. To avoid bus conflicts it becomes necessary to let the FLOWSIC act as a master of the communication. Data base Supervisory System Flow Computer RS Implementation: If the FLOWSIC is the communication master, a data block is periodically transmitted on the serial bus. This data block implementation is conform to the ASCII MODBUS specification. This gives also the ability to read the same data structure by a request, if the periodically transmission is not activated. All values in this data block are simple value copies of the existing value registers like flowrate or velocity of gas at this moment Timing: The longest data structure represents 33 numbers (32-bit). Using the ASCII protocol 8 characters per number are necessary. This is a total amount of 264 characters. The data structure is packed in a standard MODBUS protocol frame, which requires additional 11 characters (preamble, address, function code, byte count, LRC, postamble). At the lowest baudrate (9600baud) the total transmission time will be 131char x 11bit/char x 1/9600 bit/sec = 0,15sec With a minimum period of 1 second, the FLOWSIC 600 will be ready to communicate as slave in 85% of the time. This gives the possibility to take over the control by an other master (e.g. a PC running MEPAFLOW). E_33118 A Seite 14 von 17

15 INT LINT FLOAT 3.3. Register reference 2 byte unsigned integer 4 byte long unsigned integer 4 byte float Control Register Register Range Unit Type Description msec LINT Period time of the cyclic data transmission hardware V2.x, UART 1: 5051 UART 2: UART 3: LINT source (block type) of the structure which has to be transmitted. 0: master burst mode disabled 1: only flowrate, velocity of sound and the four volume counters, system status 2: additionally the status, velocity of sound and velocity of gas per path 3: additionally the signal-noise-ratio and the AGC level per path hardware V2.x, UART 1: 5050 UART 2: 5052 UART 3: 5054 E_33118 A Seite 15 von 17

16 Structure Type 1 (total size: 26 bytes) Register Size Unit Type Description (7001) 4 byte m³/h float Actual Flowrate (7003) 4 byte m/s float Velocity of Sound (5010) 4 byte LINT Volume counter forward (5012) 4 byte LINT Volume counter reverse (5011) 4 byte LINT Volume counter error volume forward (5013) 4 byte LINT Volume counter error volume reverse (3003) 2 byte UINT System status Structure Type 2 (total size: 68 bytes) Register Size Unit Type Description (7001) 4 byte m³/h FLOAT Actual Flowrate (7003) 4 byte m/s FLOAT Velocity of Sound (5010) 4 byte LINT Volume counter forward (5012) 4 byte LINT Volume counter reverse (5011) 4 byte LINT Volume counter error volume forward (5013) 4 byte LINT Volume counter error volume reverse (3003) 2 byte UINT System status (3004) 2 byte UINT Path status 1 (3005) 2 byte UINT Path status 2 (3006) 2 byte UINT Path status 3 (3007) 2 byte UINT Path status 4 (7009) 4 byte FLOAT Velocity of gas path 1 (7010) 4 byte FLOAT Velocity of gas path 2 (7011) 4 byte FLOAT Velocity of gas path 3 (7012) 4 byte FLOAT Velocity of gas path 4 (7005) 4 byte FLOAT Velocity of sound path 1 (7006) 4 byte FLOAT Velocity of sound path 2 (7007) 4 byte FLOAT Velocity of sound path 3 (7008) 4 byte FLOAT Velocity of sound path 4 E_33118 A Seite 16 von 17

17 Structure Type 3 (total size: 114 bytes) Register Size Unit Type Description (7001) 4 byte m³/h FLOAT Actual Flowrate (7003) 4 byte m/s FLOAT Velocity of Sound (5010) 4 byte LINT Volume counter forward (5012) 4 byte LINT Volume counter reverse (5011) 4 byte LINT Volume counter error volume forward (5013) 4 byte LINT Volume counter error volume reverse (3003) 2 byte UINT System status (3004) 2 byte UINT Path status 1 (3005) 2 byte UINT Path status 2 (3006) 2 byte UINT Path status 3 (3007) 2 byte UINT Path status 4 (7009) 4 byte m/s FLOAT Velocity of gas path 1 (7010) 4 byte m/s FLOAT Velocity of gas path 2 (7011) 4 byte m/s FLOAT Velocity of gas path 3 (7012) 4 byte m/s FLOAT Velocity of gas path 4 (7005) 4 byte m/s FLOAT Velocity of sound path 1 (7006) 4 byte m/s FLOAT Velocity of sound path 2 (7007) 4 byte m/s FLOAT Velocity of sound path 3 (7008) 4 byte m/s FLOAT Velocity of sound path 4 (7013) 4 byte db FLOAT SNR path 1 AB (7014) 4 byte db FLOAT SNR path 1 BA (7015) 4 byte db FLOAT SNR path 2 AB (7016) 4 byte db FLOAT SNR path 2 BA (7017) 4 byte db FLOAT SNR path 3 AB (7018) 4 byte db FLOAT SNR path 3 BA (7019) 4 byte db FLOAT SNR path 4 AB (7020) 4 byte db FLOAT SNR path 4 BA (3012) 2 byte db UINT AGC path 1 AB (3013) 2 byte db UINT AGC path 1 BA (3014) 2 byte db UINT AGC path 2 AB (3015) 2 byte db UINT AGC path 2 BA (3016) 2 byte db UINT AGC path 3 AB (3017) 2 byte db UINT AGC path 3 BA (3018) 2 byte db UINT AGC path 4 AB (3019) 2 byte db UINT AGC path 4 BA E_33118 A Seite 17 von 17