Modbus RTU Serial Communication User Manual

Modbus RTU Serial Communication User Manual Version: BA-2017.07.05 ASV Stübbe GmbH & Co.KG Print-No.: 301244 Hollwieser Straße 5 MA EN Rev001 32602 Vlotho Germany Phone: +49 (0) 5733-799-0 Fax: +49 (0) 5733-799-5000 E-Mail: contact@asv-stuebbe.de Internet: www.asv-stuebbe.de We reserve the right to make technical changes. Read carefully before use. Save for future use Modbus is a registered trademark of Schneider Electric, licensed to the Modbus Organization, Inc. Abstract This document provides generic information for ASV-Stuebbe implementing the Modbus RTU Serial Communication protocol. Information relating to specific ASV-Stübbe devices is supplied in separate user manuals. 1 Modbus RTU BA-2017.07.05 301244

Contents 1. Modbus RTU Implementation... 3 2. Modbus RTU Configuration Interface... 4 3. Input and Output Interface... 5 4. Modbus RTU Message Format... 6 5. Modbus RTU Link Layer... 6 6. IEEE 32-bit Floating-Point Register Information... 6 7. Modbus General Menu Settings... 6 8. Modbus RTU Function Codes Address Table... 7 9. Modbus RTU TCP WIFI Gateway... 11 9.1. MD - Gateway Implementation... 11 9.2. Modbus RTU Configuration Interface... 11 9.3. Input and Output Interface... 11 9.4. MD-Gateway Access Mode... 12 9.5. MD-Gateway Station Mode... 12 9.6. WiFi - Board functional description... 13 9.7. Access Mode setup... 13 9.8. Station Mode setup... 14 9.9. How to access a sensor device in Access Mode... 14 9.10. How to access a sensor device in Station Mode... 14 9.11. Limitations... 15 9.12. Webserver sensor-device monitor... 15 9.13. Webserver sensor-device monitor - customer configuration... 16 9.14. Third party software... 16 10. Modbus RTU Profibus Gateways... 17 10.1. Profibus DP Slave / Modbus RTU Master Implementation... 17 Tables Table 1-1 Table 2-1 Table 3-1 Table 4-1 Table 4-2 Table 4-3 Table 4-4 Table 9-3 ASV-Stuebbe Modbus devices Modbus RTU Message Formats ASV-Stuebbe Modbus device defaults PTM Modbus RTU Function Codes HFT / HFB Modbus RTU Function Codes UFM / RFM Modbus RTU Function Codes USF Modbus RTU Function Codes MD-Gateway Connector Pinout 2 Modbus RTU BA-2017.07.05 301244

1. Modbus RTU Implementation This implementation is designed to provide a popular data exchange format connecting these instruments to foreign master devices. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices that subscribe to the Modbus RTU RS-485 specification. Instrument Model Description PTM HFT / HFB UFM FLEX RFM USF Pressure and temperature transmitter Hydrostatic tank level sensor Ultrasonic tank level sensor Radar tank level sensor Ultrasonic flowmeter Table 1-1 ASV-Stuebbe Modbus devices 3 Modbus RTU BA-2017.07.05 301244

2. Modbus RTU Configuration Interface The ASV-Stuebbe Modbus uses the RS-485 (TIA-485-A) as a physical layer. There are two terminals in parallel marked with IN and OUT to connect the Modbus in a line configuration. RS-485 uses a differential balanced line over twisted pair, marked with A and B and GND. To connect the device use a 4 wire cable with a maximum dia. AWG22 and connect A and B with one twisted pair and a second pair with +24V and GND. It is mandatory to terminate the RS-485 bus at the end of the line. Therefore set the jumper Bus Termination to left and middle pin to the position ON. 4 Modbus RTU BA-2017.07.05 301244

3. Input and Output Interface Additional to the Modbus interface, there are two SPDT relays contact and two optoelectronic isolated inputs available. The associated potential of the inputs is on the slot PWR REL & IN. Relay 1 and 2 could be used internally or be controlled Modbus. Example 3 shows a pump control circuit proposed with a PTM: Example 3 Note: It is recommended to ground PWR2 with PE, but it is mandatory to do this for the HFT. Button T1 Start and T2 Stop and RELAY1 is internally used from the PTM pump control menu. RELAY2 could be controlled from the Modbus master, for e.g. H3 and H4 shows a service required. To release the relays function to an external Modbus control. Set: main menu -> output -> switching type -> relay 1,2 -> modbus controlled The relay and input status is shown in the Unidisplay. The relay status is also shown via LEDs on the Modbus PCBA. 5 Modbus RTU BA-2017.07.05 301244

4. Modbus RTU Message Format Coding system Number of data bits per character Table 2-1 Modbus RTU Message Formats 8 bit binary Parity transfer rate Duplex Even or No 2400, 4800, 9600, 19200, 38400 Selectable Half duplex Transceiver with Failsafe Error checking CRC (cyclic redundancy check) Polynomial (CRC-16 10100000000001) transfer order End of message Poll cycle time LSB first Idle line for 3.5 or more characters (>1.75 msec for >19200 Bps). >= 300ms Poll time >= 300ms out Table 2-1 ASV-Stuebbe Modbus Formats 5. Modbus RTU Link Layer The link layer includes the following properties/behaviors: Slave address recognition, Start / End of Frame detection, CRC-16 generation / checking, Transmit / receive message time-out, Buffer overflow detection, Framing error detection, 6. IEEE 32-bit Floating-Point Register Information The Modbus applications support IEEE 32-bit floating-point information for several of the function codes. 7. Modbus General Menu Settings In a Modbus RTU bus every slave uses an own unique address. 6 Modbus RTU BA-2017.07.05 301244

Use the ASV-Stuebbe Unidisplay to set up the specific slave address. In the main menu -> basic settings -> Modbus setting -> address -> select a slave address from 1...247. In the main menu -> basic settings -> Modbus setting -> interface -> select a baud rate from 2400 to 38400. In the second step select even parity with one stop or no parity with two stops. Keep in mind to use the same interface settings for all Modbus member. The default settings are: Instrument Model Address Interface PTM 41 9600,8,E,1 HFT / HFB 40 9600,8,E,1 UFM - FLEX 50 9600,8,E,1 RFM 38 9600,8,E,1 USF 39 9600,8,E,1 Table 3-1 ASV-Stuebbe Modbus device defaults 8. Modbus RTU Function Codes Address Table The ASV-Stuebbe Modbus RTU protocol uses a subset of the standard Modbus RTU function codes to provide access to process-related information. Several standard Modbus RTU function codes are supported. These standard function codes provide basic support for IEEE 32-bit floating point numbers and 16-bit integer register representation of instruments process data. Table 4-1 PTM Modbus RTU Function Codes Function Name Code 01 Read Coil Status Address Note: Coils, Inputs and Register numbers starting from 1 0x00 -> RELAY1 0x01 -> RELAY2 Data type Comment Read relay status 02 Read Input Status 0x00 -> INPUT1 0x01 -> INPUT2 Read input status. A TRUE logic level on the inputs are extended to minimum 5 seconds. 03 Read Holding Registers 04 Read Input Registers 0x00 -> PTM Version Value = 310 -> V3.10 0x01 -> Pressure [mbar] Signed Value = 0..10000 -> 0..10 Bar 0x02 -> Temperature [1/10 C] Signed Value = -350..1250 -> -35,0..125,0 C 0x08 -> Error TRUE -> Sensor error FALSE -> Sensor ok 0x09 -> Device ID [PTM] Value = 41 -> Device ID = 41 0x0A -> Pressure [Bar] Float_ABCD IEEE 32-bit floating-point 0x14 -> Temperature [ C] Float_ABCD IEEE 32-bit floating-point - - - 05 Force Single Coil 0x00 -> RELAY1 0x01 -> RELAY2 Write relay status, if it is released to Modbus control. 7 Modbus RTU BA-2017.07.05 301244

main menu -> output -> switching type -> relay 1,2 -> modbus controlled value = 0x0000 -> Relay off value = 0xFF00 -> Relay on Table 4-2 HFT / HFB Modbus RTU Function Codes Function Name Code 01 Read Coil Status Address Note: Coils, Inputs and Register numbers starting from 1 0x00 -> RELAY1 0x01 -> RELAY2 Data type Comment Read relay status 02 Read Input Status 0x00 -> INPUT1 0x01 -> INPUT2 Read input status. A TRUE logic level on the inputs are extended to minimum 5 seconds. 03 Read Holding Registers 04 Read Input Registers 0x00 -> HFT Version Value = 310 -> V3.10 0x01 -> Pressure [mbar] Signed Value = 0..10000 -> 0..10 Bar 0x02 -> Temperature [1/10 C] Signed Value = -350..1250 -> -35,0..125,0 C 0x08 -> Error TRUE -> Sensor error FALSE -> Sensor ok 0x09 -> Device ID [HFT] Value = 40 -> Device ID = 40 0x0A -> Pressure [mbar] Float_ABCD IEEE 32-bit floating-point 0x0C -> Filling Level [cm] Float_ABCD IEEE 32-bit floating-point 0x0E -> Volume [l] Float_ABCD IEEE 32-bit floating-point 0x14 -> Temperature [ C] Float_ABCD IEEE 32-bit floating-point - - - 05 Force Single Coil 0x00 -> RELAY1 0x01 -> RELAY2 Write relay status, if it is released to Modbus control. main menu -> output -> switching type -> relay 1,2 -> modbus controlled value = 0x0000 -> Relay off value = 0xFF00 -> Relay on 8 Modbus RTU BA-2017.07.05 301244

Table 4-3 RFM / UFM FLEX Modbus RTU Function Codes Function Name Code 01 Read Coil Status Address Note: Coils, Inputs and Register numbers starting from 1 0x00 -> RELAY1 0x01 -> RELAY2 Data type Comment Read relay status 02 Read Input Status 0x00 -> INPUT1 0x01 -> INPUT2 Read input status. A TRUE logic level on the inputs are extended to minimum 5 seconds. 03 Read Holding Registers 04 Read Input Registers 0x00 -> UFM, RFM Version Value = 310 -> V3.10 0x01 -> Distance [mm] Signed Value = 0..6000 -> 0..6000 mm 0x02 -> Signed - 0x08 -> Error TRUE -> Sensor error FALSE -> Sensor ok 0x09 -> Device ID [UFM, RFM] Value = 50 -> Device ID = 50 0x0A -> Distance [cm] Float_ABCD IEEE 32-bit floating-point 0x0C -> Filling Level [cm] Float_ABCD IEEE 32-bit floating-point 0x0E -> Volume [l] Float_ABCD IEEE 32-bit floating-point 0x14 -> Temperature [ C] Float_ABCD - - - - 05 Force Single Coil 0x00 -> RELAY1 0x01 -> RELAY2 Write relay status, if it is released to Modbus control. main menu -> output -> switching type -> relay 1,2 -> modbus controlled value = 0x0000 -> Relay off value = 0xFF00 -> Relay on 9 Modbus RTU BA-2017.07.05 301244

Table 4-4 USF Modbus RTU Function Codes Function Name Code 01 Read Coil Status Address Note: Coils, Inputs and Register numbers starting from 1 0x00 -> RELAY1 0x01 -> RELAY2 Data type Comment Read relay status 02 Read Input Status 0x00 -> INPUT1 0x01 -> INPUT2 Read input status. A TRUE logic level on the inputs are extended to minimum 5 seconds. 03 Read Holding Registers 04 Read Input Registers 0x00 -> USF Version 0x01 -> Flow [l/h] 0x02 -> 0x03 -> Total flow [1/100l] 0x08 -> Error 0x09 -> Device ID [USF] Signed Signed long Value = 301 -> V3.01 Value=-14400..+14400->-14400..+14400 l/h - Value = 1 -> 0.01 liter TRUE -> Sensor error FALSE -> Sensor ok Value = 39 -> Device ID = 39 0x0A -> Flow [l/min] Float_ABCD IEEE 32-bit floating-point 0x0C -> Total flow [l] Float_ABCD IEEE 32-bit floating-point 0x0E -> TOF-DIFF [ns] Float_ABCD IEEE 32-bit floating-point 0x10 -> Sensors distance [mm] Float_ABCD IEEE 32-bit floating-point 0x12 -> Speed of sound [m/s] Float_ABCD IEEE 32-bit floating-point 0x14 -> - Float_ABCD IEEE 32-bit floating-point 0x16 -> Speed of fluid [m/s] Float_ABCD IEEE 32-bit floating-point 0x18 -> Signal strength Float_ABCD IEEE 32-bit floating-point - - - 05 Force Single Coil 0x00 -> RELAY1 0x01 -> RELAY2 Write relay status, if it is released to Modbus control. main menu -> output -> switching type -> relay 1,2 -> modbus controlled value = 0x0000 -> Relay off value = 0xFF00 -> Relay on 10 Modbus RTU BA-2017.07.05 301244

9. Modbus RTU TCP WIFI Gateway 9.1. MD - Gateway Implementation The Wlan MD gateway offers a bridge between the Modbus RTU sensor devices and a TCP network connection. It is integrated in the 235573 PSU + WiFi Device, which support a 24V DC power supply and the RS485 Modbus RTU over one connection. On the other hand, HMI and SCADA application can communicate with the WiFi MD gateway with the Modbus TCP/IP protocol on port 502. 9.2. Modbus RTU Configuration Interface The MD-Gateway have a RS-485 bus termination installed, it is mandatory to use it at the end of the line. The MD-Gateway support the default 9600,8,E,1 Modbus RTU setting. It is necessary to use this for all citizen on the data link. 9.3. Input and Output Interface 1 RS485 A 2 RS485 B 3-4 GND 5 24V DC Table 9-3 MD-Gateway Connector Pinout For further information please refer the PSU datasheet. 11 Modbus RTU BA-2017.07.05 301244

9.4. MD-Gateway Access Mode The Access Mode is useful, to communicate direct with a HMI device with wlan or mobile phone. In this mode it is also possible to setup the network dial up information to use the station mode in a company or home network. 9.5. MD-Gateway Station Mode In Station Mode the MD-Gateway dial up automatically with the given SSID and password into the selected network. Access Point 12 Modbus RTU BA-2017.07.05 301244

9.6. WiFi - Board functional description Picture 9.6.1 Wifi Module 9.7. Access Mode setup 1. Power up the main power. 2. If the orange LED is on. Please set the switch to Access Mode (Picture 9.6.1 Wifi Module). 3. Connect your Wlan device or mobile phone with the MD-Gateway network 4. Because of the WPA2 PSK encryption it is necessary to use the password ASV-Stuebbe for the first connection to this network. 5. Start your HMI / SCADA application or use the built in webserver to show the values. 13 Modbus RTU BA-2017.07.05 301244

9.8. Station Mode setup To connect the gateway for the first time to an existing network, the following steps are necessary: 1. Follow step 9.7. 1..4 to connect the MD-Gateway in Access Mode 2. Open the page gateway.md with an internet browser. 3. The Gateway web server generate this page to setup the company or home network: 4. The access data for the company or home network can be entered under "Wlan network name (ssid)" and "Password". 5. After pressing the "save" button, the access data are stored in the gateway. 6. Please set the switch to Station Mode and push the reset button (Picture 9.6.1 Wifi Module). 7. A successful dial-up into the home or company network shows the orange led after some second. 8. The gateway is now ready to use with a safety WPA2 PSK encryption. 9.9. How to access a sensor device in Access Mode To read values from a sensor device with a HMI/SCADA program, use for a plc the communication protocol Modbus TCP and the default IP address 192.168.4.1 with port 502. To avoid overlaps, it is possible to change the default IP address used in access mode. Please follow step 9.8. 1..3 To create an address tag, it is necessary to provide the station number (7. Modbus General Menu Settings) and the register address (8. Modbus RTU Function Codes Address Table). Please also refer to point 9.2. 9.10. How to access a sensor device in Station Mode To read values from a sensor device with a HMI/SCADA program, use for a plc the communication protocol Modbus TCP and the IP address which is allocated by the router on port 502. To prevent dynamic ip addresses. A fixed allocation should be set according to the MAC address in the router. To identification the gateway, the unique MAC is shown in the table. Please follow step 9.8. 1..3. 14 Modbus RTU BA-2017.07.05 301244

To create an address tag, it is necessary to provide the station number (7. Modbus General Menu Settings) and the register address (8. Modbus RTU Function Codes Address Table). Please also refer to point 9.2. 9.11. Limitations Since the Modbus RTU protocol is not designed for a multimaster system. Only one client (master) can read the data of the sensors. Questions several clients simultaneously the sensors, a correct operation is no longer ensured. 9.12. Webserver sensor-device monitor For an easy start up, to show the value of a sensor on a e.g. mobile phone use an internet browser of your choose. Only three steps are necessary: 1. Connect your MD sensor to the PSU+Wifi power supply. 2. Connect your Wlan device or mobile phone with the MD-Gateway network in Station Mode (Please also refer to point 9.7.) 3. Start an internet browser with address gateway.md and select the sensor you have. 15 Modbus RTU BA-2017.07.05 301244

9.13. Webserver sensor-device monitor - customer configuration It is possible to configure the start page to your demand. Up to 6 sensor you can set up in the Sensor Setup page. The picture shows an example with 4 PTM s and 2 USF s: Do not forget to set the different device address to the same address do you want to read (refer 7.). Take care that no address is double. Please set all device to 9600,8,E,1 (default value after factory setting). The button load default set the web interface back to the sensor factory settings. 9.14. Third party software Various software solutions for various operating systems are available for vialising measurement data. These software packages are also available for mobile use for Android or Apple devices. One example is the software of the company IDEA-Teknik. The special feature is the Window PC program "HMI Droid Studio. With this software the individual composition of the app is created. A file is generated for each sensor, which is then copied to the mobile phone. The app automatically detects these files and performs the sensor queries. Example files for the STUEBBE sensors can be provided on demand. For a correct function, please set the maximum number of Modbus register to 2, to read in one block. 16 Modbus RTU BA-2017.07.05 301244

10. Modbus RTU Profibus Gateways 10.1. Profibus DP Slave / Modbus RTU Master Implementation For an easy implementation for PLC s with a Profibus interface there are Modbus RTU to Profibus converter available e.g. HD67561 ADFweb or AB7000-C Anybus/HMS. The advantage of these gateways is that they independently query the Modbus all participants and provide the data bundled on the Profibus side of the plc. All necessary settings which are necessary to query the Modbus sensors are stored in the gateway. On the other side must be set to the plc side only the Profibus address. The necessary *.gsd file is provided by the gateway manufacturer. Do not hesitate to contact us for your next project. We help with the configuration of the gateway. 17 Modbus RTU BA-2017.07.05 301244