PROTOCOL Translator MODBus User Manual

Transcription

1 PROTOCOL Translator MODBus User Manual

2 Protocol Translator MODBus User Manual Page 2 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

3 Protocol Translator MODBus User Manual Revision Table Rev Detail of Change 01 Initial issue 02 Format and style update. This document is in support of the Multitrode Translator. Version Revision 02 This document is valid for MultiTrode Translator firmware version 1.09 or newer. Multitrode reserves the right to update this document without notification. MULTITRODE and MULTISMART are registered trademarks of MultiTrode Pty Ltd in Australia, USA and many countries worldwide. PUMPVIEW is a registered trademark of MultiTrode Pty Ltd in Australia. Design registration is pending for the MultiSmart Pump Controller Remote and Base Modules in Australia, USA and many countries worldwide. Patents pending in Australia, USA and many countries worldwide MultiTrode Pty Ltd. This publication is protected by copyright. No part of this publication may be reproduced by any process, electronic or otherwise, without the express written permission of MultiTrode Pty Ltd. Although every attempt has been made to ensure the correctness of the information contained herein, no liability is accepted by Multitrode or its staff for any errata contained. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 3 of 28

4 Protocol Translator MODBus User Manual Page 4 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

5 Protocol Translator MODBus User Manual Contents 1 Introduction The MultiTrode Translator Quick Installation Guide MODBus Guide Introducing MODBus Protocol The Query-Response Cycle The Query The Response RTU Mode RTU Framing How the Address Field is Handled How the Function Field is Handled Contents of the Data Field Cyclic Redundancy Check [CRC] MultiTrode Translator Interfaces MultiTrode MonitorPro MODBus Interface Locally Generated Points MODBus Commands Read Coil Status Read Input Status Read Holding Registers Read Input Registers Force Single Coil Preset Single Register Diagnostics Function (0F Hex) Force Multiple Coils (10 Hex) Preset Multiple Registers Mirror Input Status Mode Configuring the MultiTrode Translator for Mirror Mode Specifications Full List of MODBUS Points...27 Figures Figure 1 Overview Connection Diagram...8 Figure 2 MODBus query cycle...10 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 5 of 28

6 Protocol Translator MODBus User Manual Page 6 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

7 Protocol Translator MODBus User Manual 1 Introduction Congratulations on the purchase of the advanced MultiTrode Translator. In order to gain maximum benefit from the use of the MultiTrode Translator it is recommended that a good understanding is developed of MODBus protocol. It is not the intention of this manual to cover this protocol in detail but only to explain its basic operation to assist with the functional installation of the unit. 1.1 The MultiTrode Translator The MultiTrode Translator gathers information from a MultiTrode MonitorPRO or Remote Reservoir Monitor by issuing continuous assembled status requests. This information is mapped to and stored in a pair of native databases (one for MODBus, one for DNP3) which can then be accessed by a Master using the appropriate protocol. Local inputs on the MultiTrode Translator are also placed into these databases. The Master may request control operations and/or point writes to control the MultiTrode device via the MultiTrode Translator. Control operations that relate to MultiTrode devices will be acknowledged immediately by the MultiTrode Translator and the appropriate MultiTrode command issued at the earliest possible time. The success or failure of a control operation is determined by subsequently reading status information for the relevant point. The MonitorPRO is a state-of-the-art pump station supervisor, which has been specifically designed to provide a high level of motor protection, capable of monitoring and protecting pumps by measuring pump currents and voltages. The MonitorPRO, in conjunction with the MT2/3PC Pump Controllers have many desirable features. Together they provide a complete pump station management system, which is not only more efficient than conventional systems, but also provides a smaller, more-cost-effective and more reliable solution. The MultiTrode Pump Controller (MTxPC) is an advanced microprocessor-based pump controller designed to control two or three pumps, depending on the model chosen. It is specifically designed for use in water and sewage pumping stations and provides automatic level control, pump alternation, pump protection logic and level alarms. These two products form the Remote Terminal Unit MultiTrode Translator, which is connected to a Master SCADA system via land line or radio. The existing SCADA system works by using MultiTrode s proprietary protocol working into special SCADA software. However, via the MultiTrode Translator all these MultiTrode points can be accessed via the MODBus protocol. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 7 of 28

8 Protocol Translator MODBus User Manual 2 Quick Installation Guide As the default setting of the MultiTrode Translator will meet most applications needs, the only necessity is to set the site address and desired protocol option of the unit to allow polling of the remote site by the SCADA or PLC controlling system. Connect the MultiTrode Translator as per diagram below VDC Power Supply MonitorPro Protocol Translator Radio PC Figure 1 Overview Connection Diagram Using HyperTerminal or some similar terminal emulation program, send the word login to the MultiTrode Translator using [MB]Com. 2. The word login should be preceded with a 1 second silent period. The login command is lower case and strictly login without an enter. Default communication settings should be 9600bps, 1 Start bit, no Parity and 2 Stop bits. The MultiTrode Translator will display the Main Menu to HyperTerminal. From the Main Menu select option 1. MultiTrode Translator (MultiTrode - DNP / MODBus converter) v1.00. Main Menu. 1) MultiTrode Translator Address [1] Change the MultiTrode Translator s address to the address used by the Master to communicate with it. Page 8 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

9 Protocol Translator MODBus User Manual Again from the Main Menu select option 2 MultiTrode Translator (MultiTrode - DNP / MODBus converter) v1.00. Main Menu. 1) MultiTrode Translator Address [1] 2) Configure COM ports. By selecting option 1) Next port, the com. Port desired for DNP3 operation can be configured. COM2 (RS-232) Port Configuration. 1) Next port 2) Protocol [MODBus Slave] 3) Baud rate [9600] Select option 2) Protocol to set desired protocol. Press Esc twice and close down HyperTerminal. Notice that the MT RX, MT TX, LEDs are polling. The MultiTrode units should now be available via the MultiTrode Translator by the Central Monitoring Facility [CMF]. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 9 of 28

10 Protocol Translator MODBus User Manual 3 MODBus Guide 3.1 Introducing MODBus Protocol The common language used by most controllers is the MODBus protocol. This protocol defines a message structure that controllers will recognize and use, regardless of the type of networks over which they communicate. It describes the process a controller uses to request access to another device, how it will respond to requests from the other devices, and how errors will be detected and reported. It establishes a common format for the layout and contents of message fields. The MODBus protocol provides an international standard that all controllers can use for passing messages. During communications on a MODBus network, the protocol determines how each controller will know its device address, recognize a message addressed to it, determine the kind of action to be taken, and extract any data or other information contained in the message. If a reply is required, the controller will construct the reply message and send it using MODBus protocol. The following sections describe the MODBus commands as used in the MultiTrode Translator. Commands not listed are not supported by the MultiTrode Translator and if requested, an error message will be returned to the Master. 3.2 The Query-Response Cycle RTU Device Address Function Code QUERY Eight Bit Data Bytes MASTER RTU CRC Error Check RTU Device Address Function Code SLAVE RTU Eight Bit Data Bytes RESPONSE CRC Error Check Figure 2 MODBus query cycle 3.3 The Query The function code in the query tells the addressed Slave device what kind of action to perform. The data bytes contain any additional information that the Slave will need to perform the function. For example, function code 03 will query the Slave to read holding registers and respond with their contents. The data field must contain the information which tells the Slave at what register to start, and how many registers to read. The error check field provides a method for the Slave to validate the integrity of the message contents. Page 10 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

11 Protocol Translator MODBus User Manual 3.4 The Response If the Slave makes a normal response, the function code in that response is an echo of the function code in the query the data bytes contain the data collected by the Slave, such as register values or status. If an error occurs, the function code is modified to indicate that the response is an error response, and the data bytes contain a code that describes the error. The error check field allows the Master to validate the integrity of the message RTU Mode When controllers are set up to communicate on a MODBus network using RTU (Remote Terminal Unit) mode, each eight-bit byte in a message contains two four-bit hexadecimal characters. The main advantage of this mode is that its greater character density allows better data throughput than ASCII for the same baud rate. Each message must be transmitted in a continuous stream Coding System Eight-bit binary, hexadecimal 0--9, A--F Two hexadecimal characters contained in each eight-bit field of the message Bits per Byte 1 start bit 8 data bits, least significant bit sent first 1 bit for even/odd parity no bit for no parity 1 stop bit if parity is used 2 bits if no parity Error Check Field Cyclical Redundancy Check (CRC) RTU Framing In RTU mode, messages start with a silent interval period of at least 3.5 characters. This is most easily implemented as a multiple of character times at the baud rate that is being used on the network (shown as T1-T2-T3-T4 in the figure below). The first field then transmitted is the device address. The allowable characters transmitted for all fields are hexadecimal 0--9, A--F Networked devices monitor the network bus continuously, including during the silent intervals. When the first field (the address field) is received, each device decodes it to find out if it is the addressed device. Following the last transmitted character, a similar interval of at least a period of 3.5 characters marks the end of the message. A new message can begin after this interval. The entire message frame must be transmitted as a continuous stream. If a silent interval period of more than 1.6 characters occurs before completion of the frame, the receiving device flushes the incomplete message and assumes that the next byte will be the address field of a new message. Similarly, if a new message begins earlier than a period of 8.6 characters following a previous message, the receiving device will consider it a continuation of the previous message. This will set an error, as the value in the final CRC field will not be valid for the combined messages. A typical message frame is shown below. START Address Function Data CRC Check END T1-T2-T3-T4 8-bits 8-bits n x 8-bits 16-bits T1-T2-T3-T4 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 11 of 28

12 Protocol Translator MODBus User Manual How the Address Field is Handled The address field of a message frame contains 1 byte or 8-bits for MODBus RTU protocol. Valid Slave device addresses are in the range of decimal. The individual Slave devices are assigned addresses in the range of A Master addresses a Slave by placing the Slave address in the address field of the message. When the Slave sends it s response, it places it s own address in this address field of the response to let the Master know which Slave is responding. Address 0 is used for the broadcast address, which all Slave devices recognize. When MODBus protocol is used on higher level networks, broadcasts may not be allowed or may be replaced by other methods How the Function Field is Handled The function code field of a message frame contains 1 byte or eight bits for MODBus RTU protocol. Valid codes are in the range of decimal. Of these 255 possible function codes only 9 codes are used by the MultiTrode Translator. When a message is sent from a Master to a Slave device the function code field tells the Slave what kind of action to perform. Examples are: read the ON/OFF states of a group of discrete coils or inputs, read the data contents of a group of registers or write to designated coils or registers. When the Slave responds to the Master, it uses the function code field to indicate either a normal (errorfree) response or that some kind of error occurred (called an exception response). For a normal response, the Slave simply echoes the original function code. For an exception response, the Slave returns a code that is equivalent to the original function code with it s most significant bit set to a logic 1. For example, a message from Master to Slave to read a group of holding registers would have the following function code: (Hexadecimal 03) If the Slave device takes the requested action without error, it returns the same code in it s response. If an exception occurs, it returns: (Hexadecimal 83) In addition to it s modification of the function code for an exception response, the Slave places a unique code into the data field of the response message. This tells the Master what kind of error occurred, or the reason for the exception. There are several error codes defined in MODBus but the MultiTrode Translator only returns two. These are: Illegal function (function code not recognised or supported) Illegal data address (referencing a point number that does not exist) The Master device s application program has the responsibility of handling exception responses. Typical processes are to post subsequent retries of the message, to try diagnostic messages to the Slave, and to notify operators. Page 12 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

13 Protocol Translator MODBus User Manual Contents of the Data Field The data field is constructed using sets of two hexadecimal digits, in the range of 00 to FF hexadecimal. These can be made from a pair of ASCII characters, or from one RTU character, according to the network s serial transmission mode. The data field of messages sent from a Master to Slave devices contains additional information, which the Slave must use to take the action defined by the function code. This can include items like discrete and register addresses, the quantity of items to be handled, and the count of actual data bytes in the field. For example, if the Master requests a Slave to read a group of holding registers (function code 03), the data field specifies the starting register and how many registers are to be read. If the Master writes to a group of registers in the Slave (function code 11 hexadecimal), the data field specifies the starting register, how many registers to write, the count of data bytes to follow in the data field, and the data to be written into the registers. If no error occurs, the data field of a response from a Slave to a Master contains the data requested. If an error occurs, the field contains an exception code that the Master application can use to determine the next action to be taken. The data field can be non-existent (of zero length) in certain kinds of messages Cyclic Redundancy Check [CRC] In RTU mode, messages include an error-checking field that is based on a CRC method. The CRC field checks the contents of the entire message. It is applied regardless of any parity check method used for the individual characters of the message. The CRC field is two bytes, containing a 16-bit binary value. The CRC value is calculated by the transmitting device, which appends the CRC to the message. The receiving device recalculates a CRC during receipt of the message, and compares the calculated value to the actual value it received in the CRC field. If the two values are not equal, an error result is assumed and corrective action may be taken. When the CRC is appended to the message, the low-order byte is appended first, followed by the highorder byte. The CRC generation algorithm is given in the table below. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Load a 16-bit register with FFFF hex (all l s). Call this the CRC register. Exclusive OR the first eight-bit byte of the message with the low order byte of the 16-bit CRC register, putting the result in the CRC register. Shift the CRC register one bit to the right (toward the LSB), zero-filling the MSB. Extract and examine the LSB. If the LSB is 0, repeat Step 3 (another shift). If the LSB is 1, Exclusive OR the CRC register with the polynomial value A001 hex ( ). Repeat Steps 3 and 4 until eight shifts have been performed. When this is done, a complete eight-bit byte will have been processed. Repeat Steps for the next eight-bit byte of the message. Continue doing this until all bytes have been processed. The final content of the CRC register is the CRC value. When the CRC is placed into the message, it s upper and lower bytes must be swapped. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 13 of 28

14 Protocol Translator MODBus User Manual 3.5 MultiTrode Translator Interfaces This section outlines the design of the MultiTrode Translator firmware. The MultiTrode Translator acts as a protocol converter for MultiTrode MonitorPro devices to MODBus by maintaining a database image in MODBus format. This database is accessible to the MODBus Masters through RS232 and/or FSK ports, using MODBus RTU function set MultiTrode MonitorPro Connection to the MultiTrode MonitorPRO is via a dedicated RS-232 port. All information is retrieved using the Assembled Status Request Command. Once collected, this information is separated into four data types commonly used by MODBus for storage: Coils: Input Status: Holding Registers: Read/write single bit values (digital outputs) (0xxxx references) Read only single bit values (digital inputs) (1xxxx references) Read/write 16-bit values (analog outputs, configuration, modifiable registers) (4xxxx references) Input Registers: Read only 16-bit values (analog inputs, non-modifiable registers) (3xxxx references) When a MODBus coil or holding register is modified, the associated MultiTrode command is sent to the MonitorPRO using MultiTrode protocol. The status of some of these coils and holding registers is available in an Assembled Status Response. For MODBus points where status is not available, the last written value is returned instead MODBus Interface MODBus access is available via the second RS-232 port or the FSK port. The device will behave as a Slave and service the following Master function requests using the MODBus RTU protocol: Function Description 01 Read Coil Status 02 Read Input Status 03 Read Holding Registers 04 Read Input Registers 05 Force Single Coil 06 Preset Single Register 15 Force Multiple Coils 16 Force Multiple Registers 08 Diagnostic Loop Back Any other function codes in a request will result in a code 01 (Illegal Function) response. There is a separate MODBus driver installed on each com port (except the one assigned to the Monitor PRO) functioning independently allowing simultaneous access via multiple ports. Page 14 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

15 Protocol Translator MODBus User Manual Locally Generated Points The MultiTrode Translator generates some of its own data via its analogue and digital inputs. These points are depicted in the MODBus Point Map: Digital Inputs Six digital inputs are available and appear as Input Status points (948 to 953). These inputs are individually configurable as normal or latched Normal Mode: In normal mode the Input Status Point reflects the instantaneous value of the digital input Latched Mode: In latched mode, a transition from 0 to 1 sets the Input Status Point to 1. A transition from 1 to 0 has no effect and the Input Status Point remains in the 1 state. As this Input Status Point is latched it needs to be reset before it can resume it function. Each input has an associated clear latch Output Coil. Writing a 1 to this coil sets the Input Status Point to the instantaneous value of the digital input. Additionally, each digital input has an associated 32-bit accumulator that occupies a pair of holding registers (16 to 27). Writing zero to both of the holding registers of the pair will reset the accumulator Analogue Inputs Two analogue inputs appear as input registers. Each analogue input has an associated 16-bit byte that occupies an input registers (302 & 303). The values returned are pre-scaled. The pre-scaling of the analog inputs is done in the MultiTrode Translator Configuration Menu. See the MultiTrode Translator Installation Manual for further details on how to set up the pre-scaling MultiTrode Translator status Loss of communication between the MultiTrode Translator and MultiTrode MonitorPRO is reflected as a 1 in an Input Status Point 956. A stale data indicator is available as an Input Status Point 957. This is cleared whenever new information arrives from the MonitorPRO. A timer is also started at this point and runs for a configurable period. When it expires, the stale data indicator is set. See the MultiTrode Translator Installation Manual for further details on setting the stale data timer period. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 15 of 28

16 Protocol Translator MODBus User Manual 3.6 MODBus Commands Read Coil Status Reads the ON/OFF status of discrete outputs coils (0xxxx references) in the Slave. Broadcast is not supported. When a read request is received the data is retrieved immediately from the MultiTrode Translator s database and returned to the Master Query The query message specifies the starting coil and quantity of coils to be read. Coils are addressed starting at zero, i.e. coils are addressed as Following is an example of a query to read coils from Slave device 17: Field Name Example (Hex) Slave Address 11 Function 01 Starting Address Hi 00 Starting Address Lo 13 Number of Points Hi 00 Number of Points Lo 25 Error Check (LRC or CRC) Response The coil status in the response message is packed as one coil per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the first coil addressed in the query. The other coils follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned coil quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The Byte Count field specifies the quantity of complete bytes of data. Following is an example of a response to the above query: Field Name Example (Hex) Slave Address 11 Function 01 Byte Count 05 Data (Coils ) Data (Coils ) Data (Coils ) Data (Coils ) Data (Coils ) Error Check (LRC or CRC) -- CD 6B B2 0E 1B The status of coils is shown as the byte value CD hex, or binary Coil 27 is the MSB of this byte, and coil 20 is the LSB. Left to right, the status of coils is ON-ON-OFF-OFF-ON-ON- OFF-ON. By convention, bits within a byte are shown with the MSB to the left, and the LSB to the right. Thus the coils in the first byte are , from left to right. The next byte has coils , left to right. As the bits are transmitted serially, they flow from LSB to MSB: , , and so on. In the last data byte, the status of coils is shown as the byte value lb hex, or binary Coil 56 is in the fourth bit position from the left, and coil 52 is the LSB of this byte. The status of coils is: ON-ON-OFF-ON-ON. Note: The three remaining bits (toward the high-order end) are zero-filled. Page 16 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

17 Protocol Translator MODBus User Manual Read Input Status Reads the ON/OFF status of discrete inputs (1xxxx references) in the Slave. Broadcast is not supported. When a read request is received the data is retrieved immediately from the MultiTrode Translator s database and returned to the Master Query The query message specifies the starting input and quantity of inputs to be read. Inputs are addressed starting at zero, i.e. inputs are addressed as Following is an example of a request to read inputs from Slave device 17: Field Name Example (Hex) Slave Address 11 Function 02 Starting Address Hi 00 Starting Address Lo Number of Points Hi 00 Number of Points Lo 16 Error Check (LRC or CRC) -- C Response The input status in the response message is packed as one input per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the first input addressed in the query. The other inputs follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned input quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high-order end of the byte). The Byte Count field specifies the quantity of complete bytes of data. Following is an example of a response to the query: Field Name Example (Hex) Slave Address 11 Function 02 Byte Count 03 Data (Inputs ) Data (Inputs ) Data (Inputs ) 35 Error Check (LRC or CRC) -- AC DB The status of inputs is shown as the byte value AC hex, or binary Input is the MSB of this byte, and input is the LSB. Left to right, the status of inputs is ON-OFF-ON-OFF-ON-ON-OFF-OFF The status of inputs is shown as the byte value 35 hex, or binary Input is in the third bit position from the left, and input is the LSB. The status of inputs is: ON-ON-OFF-ON-OFF-ON. Note: The two remaining bits (toward the high order end) are zero-filled. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 17 of 28

18 Protocol Translator MODBus User Manual Read Holding Registers Read the binary contents of holding registers (4xxxx references) in the Slave. Broadcast is not supported. When a read request is received the data is retrieved immediately from the MultiTrode Translator s database and returned to the Master Query The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero, i.e. registers are addressed as Following is an example of a request to read registers from Slave device 17: Field Name Example (Hex) Slave Address 11 Function 03 Starting Address Hi 00 Starting Address Lo Number of Points Hi 00 Number of Points Lo 03 Error Check (LRC or CRC) -- 6B Response The register data in the response message are packed as two bytes per register; with the binary contents right justified within each byte. For each register, the first byte contains the high order bits and the second contains the low order bits. Following is an example of a response to the query: Field Name Example (Hex) Slave Address 11 Function 03 Byte Count 06 Data Hi (Register 40108) 02 Data Lo (Register 40108) Data Hi (Register 40109) 00 Data Lo (Register 40109) 00 Data Hi (Register 40110) 00 Data Lo (Register 40110) 64 Error Check (LRC or CRC) -- 2B The contents of register are shown as the two byte values of 02 2B hex, or 555 decimal. The contents of registers are and hex, or 0 and 100 decimal respectively. Page 18 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

19 Protocol Translator MODBus User Manual Read Input Registers Reads the binary content of input registers (3xxxx references) in the Slave. Broadcast is not supported. When a read request is received the data is retrieved immediately from the MultiTrode Translator s database and returned to the Master Query The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero, i.e. registers are addressed as Following is an example of a request to read register from Slave device 17: Field Name Example (Hex) Slave Address 11 Function 04 Starting Address Hi 00 Starting Address Lo 08 Number of Points Hi 00 Number of Points Lo 01 Error Check (LRC or CRC) Response The register data in the response message are packed as two bytes per register, with the binary contents right-justified within each byte. For each register, the first byte contains the high-order bits and the second contains the low-order bits. Following is an example of a response to the query: Field Name Example (Hex) Slave Address 11 Function 04 Byte Count 02 Data Hi (Register 30009) 00 Data Lo (Register 30009) Error Check (LRC or CRC) -- 0A The contents of register are shown as the two byte values of 00 OA hex, or 10 decimal Force Single Coil Forces a single coil in the Slave unit (0xxxx reference) to either ON or OFF. When broadcast, the function forces the same coil reference in all attached Slaves. When a force command is received, the MultiTrode Translator will update its database and pass a command through to the MonitorPRO via the command queue. The command queue is a MultiTrode Translator buffer area to queue commands to the MonitorPRO. The MultiTrode Translator then issues this command to the MonitorPRO at the next opportunity. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 19 of 28

20 Protocol Translator MODBus User Manual Query The query message specifies the coil reference to be forced. Coils are addressed starting at zero, i.e. coil 1 is addressed as 0. The requested ON/OFF state is specified by a constant in the query data field. A value of FF 00 hex requests the coil to be ON. A value of requests it to be OFF. All other values are illegal and will not affect the coil. Following is an example of a request to force coil 173 ON in Slave device 17: Field Name Example (Hex) Slave Address 11 Function 05 Coil Address Hi 00 Coil Address Lo Force Data Hi Force Data Lo 00 Error Check (LRC or CRC) -- AC FF Response The normal response is an echo of the query, returned after the coil state has been forced. Following is an example of a response to the query: Field Name Example (Hex) Slave Address 11 Function 05 Coil Address Hi 00 Coil Address Lo Force Data Hi Force Data Lo 00 Error Check (LRC or CRC) -- AC FF Preset Single Register Presets a value into a single holding register (4xxxx reference) in the addressed Slave unit. When broadcast, the function presets have the same register reference in all attached Slaves. When a Preset command is received, the MultiTrode Translator will update its database and passes a command through to the MonitorPRO via the command queue. The command queue is a MultiTrode Translator buffer area to queue commands to the MonitorPRO. The MultiTrode Translator then issues this command to the MonitorPRO at the next opportunity. Page 20 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

21 Protocol Translator MODBus User Manual Query The query message specifies the register reference to be preset. Registers are addressed starting at zero, i.e. register 1 is addressed as 0. Following is an example of a request to preset register to hex in Slave device 17: Field Name Example (Hex) Slave Address 11 Function 06 Register Address Hi 00 Register Address Lo 01 Preset Data Hi 00 Preset Data Lo 03 Error Check (LRC or CRC) Response The normal response is an echo of the query, returned after the register contents have been preset. Following is an example of a response to the query: Field Name Example (Hex) Slave Address 11 Function 06 Register Address Hi 00 Register Address Lo 01 Preset Data Hi 00 Preset Data Lo 03 Error Check (LRC or CRC) Diagnostics Function MODBus function 08 provides a test for checking the communication system between the Master and Slave. Only the Return Query Data diagnostic function is supported. This means that any data sent to the Slave will be echoed to the Master without any actions Query Here is an example of a request to Slave device 17 to Return Query Data. This uses a sub-function code of zero (00 00 hex in the two-byte field). The data to be returned is sent in the two-byte data field (A5 37 hex). Field Name Example (Hex) Slave Address 11 Function 08 Sub-function Hi 00 Sub-function Lo 00 Data Hi Data Lo 37 Error Check (LRC or CRC) -- A5 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 21 of 28

22 Protocol Translator MODBus User Manual Response The normal response to the Return Query Data request is to loop-back the same data. The function code and sub-function code are also echoed. Field Name Example (Hex) Slave Address 11 Function 08 Sub-function Hi 00 Sub-function Lo 00 Data Hi Data Lo 37 Error Check (LRC or CRC) -- A5 The data fields in responses to other kinds of queries could contain error counts or other information requested by the sub-function code (0F Hex) Force Multiple Coils This command forces each coil (0xxxx reference) in a sequence of coils to either ON or OFF When broadcast, the function forces the same coil references in all attached Slaves. When a force command is received, the MultiTrode Translator will update its database and sends a command through to the MonitorPRO via the command queue. The command queue is a MultiTrode Translator buffer area to queue a command to the MonitorPRO. The MultiTrode Translator then issues this command to the MonitorPRO at the next opportunity Query The query message specifies the coil references to be forced. Coils are addressed starting at zero, i.e. coil 1 is addressed as 0. The requested ON/OFF states are specified by contents of the query data field. A logical 1 in a bit position of the field requests the corresponding coil to be ON. A logical 0 requests it to be OFF. The following shows an example of a request to force a series of ten coils starting at coil 20 in Slave device 17. The query data contents are two bytes: CD 01 hex ( binary). The binary bits correspond to the coils in the following way: Query data: Coil: The first byte transmitted (CD hex) addresses coils , with the least significant bit addressing the lowest coil (20) in this set. Page 22 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

23 Protocol Translator MODBus User Manual The next byte transmitted (01 hex) addresses coils 29 and 28, with the least significant bit addressing the lowest coil (28) in this set. Unused bits in the last data byte should be zero-filled. Field Name Example (Hex) Slave Address 11 Function Coil Address Hi 00 Coil Address Lo 13 Quantity of Coils Hi 00 Quantity of Coils Lo Byte Count 02 Force Data Hi (Coils 27 20) Force Data Hi (Coils 29 28) 01 Error Check (LRC or CRC) -- 0F 0A CD Response The normal response returns the Slave address, function code, starting address, and quantity of coils forced. Here is an example of a response to the query shown above: Field Name Example (Hex) Slave Address 11 Function Coil Address Hi 00 Coil Address Lo 13 Quantity of Coils Hi 00 Quantity of Coils Lo Error Check (LRC or CRC) -- 0F 0A (10 Hex) Preset Multiple Registers Presets are a sequence of values into holding registers (4xxxx references) in a Slave unit. When broadcast, the function presets are the same register references in all attached Slaves. When a Preset command is received, the MultiTrode Translator will update its database and pushes a command through to the MonitorPRO via the command queue. The command queue is a MultiTrode Translator buffer area to queue a command to the MonitorPRO. The MultiTrode Translator then issues this command to the MonitorPRO at the next opportunity Query The query message specifies the register references to be preset. Registers are addressed starting at zero-register, i.e. register 1 is addressed as 0. The requested preset values are specified in the query data field. Data is packed as two bytes per register. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 23 of 28

24 Protocol Translator MODBus User Manual Here is an example of a request to preset two registers starting at to 00 OA and hex, in Slave device 17: Field Name Example (Hex) Slave Address 11 Function 10 Starting Address Hi 00 Starting Address Lo 01 Number of Registers Hi 00 Number of Registers Lo 02 Byte Count 04 Data Hi 00 Data Lo Data Hi 01 Data Lo 02 Error Check (LRC or CRC) -- 0A Response The normal response returns the Slave address, function code, starting address, and quantity of registers preset. Here is an example of a response to the query shown above. Field Name Example (Hex) Slave Address 11 Function 10 Starting Address Hi 00 Starting Address Lo 01 Number of Registers Hi 00 Number of Registers Lo 02 Error Check (LRC or CRC) -- Page 24 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

25 Protocol Translator MODBus User Manual 3.7 Mirror Input Status Mode An option exists to allow all of the Input Status points to be mirrored to a block of Input Registers (16 status points to each register). Normally, digital inputs will appear as MODBus Input Status Points and 16-bit values as MODBus Input Registers. However, when using a SCADA or PLC Master Control system, it is sometimes desirable to minimise the tag count so as to lower licence costs. To this end the MultiTrode Translator has the ability to mirror Input Status Points into the Input Registers. By default this feature is off, but if enabled, the Input Status Points will also appear in a configurable block of Input Registers. For example if the feature is enabled and the base register set to 1000, then a single byte read of Input Register 1000 will return Digital Status Points 1 to 16. This allows 957 Digital Input Points to be read using only 59 registers. Some extra effort is needed within the Master control system to split each register into its component digital points once they have been retrieved, but this involves the use of internal tags Configuring the MultiTrode Translator for Mirror Mode For more details on configuring the MultiTrode Translator, see the MultiTrode Translator Installation Manual. The following steps give a quick configuration guide when using a terminal emulation program such as HyperTerminal. Login to the MultiTrode Translator by entering login. In the Main Menu select option 5) MODBus Parameters. In the Database Menu select option 1 MODBus Database Configuration. 1) Mirror 'Input Status' into 'Input Registers' [Yes]. 2) Base Register For Mirrored Block [312]. ESC) Back. In the Database Menu select option 2 and set the base address to a number higher than the existing number of Input Registers (311), remembering that this register number is zero based. MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 25 of 28

26 Protocol Translator MODBus User Manual 4 Specifications Dimensions: 118H x 45W x 135D - DIN Rail mounted Supply: Inputs: Communications Ports: Modem: Typically: 100mA at 12VDC. Minimum supply voltage 8V DC. Maximum supply voltage 38V DC. Supply is fused at 250mA (self-resetting fuse). 6 x digital: Voltage free input contacts. Cable length should not exceed 50m. ESD and EMC protected. -ve line is common ground. Maximum input frequency of 100Hz (10 milliseconds) 2 x analog: 0 to 22mA input. Input resistance 220 Ohms. 10bit ADC accuracy, linearity ±1lsb (0.025%). ADC value scaleable via configuration menu. External supply range 12 to 48VDC. ESD and EMC protected. -ve line is common ground. 2 x RS232 Asynchronous:- 9 pin male D type connector with TD, RD, RTS, CTS, DTR and DSR. 1 x Radio port to Bell 202, FSK baud(fixed) Audio output: adjustable via trimpot to 400mVp-p Audio input sensitivity: mVp-p Squelch input: 5-30VDC common ground Press To Talk (PTT): Open drain 200mA at 40VDC Indicators: 9 status LEDS EMC: C-Tick and CE compliant AS/NZS3548 (C-Tick) CISPR 24:1997; EN55024:1998 EN :1995, Including Amendment A1 EN :1995, Including Amendment 1:1998 EN :1995. IEC :1995. IEC :1995, Including Amendment A1 IEC :1993 IEC :1994. Environmental: Temperature Humidity -10 C to 60 C 0 to 95% non- condensing Page 26 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

27 Protocol Translator MODBus User Manual 5 Full List of MODBUS Points Following is the full list of MODBus points that can be retrieved from a station, using the MultiTrode Translator. Note: A number of points are reserved for future MultiTrode use. MultiTrode Pty Ltd Head Office Ph: Fx: sales@multitrode.com.au Visit for the latest information MultiTrode Inc USA Ph: Fx: sales@multitrode.net MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc Page 27 of 28

28 Protocol Translator MODBus User Manual Page 28 of 28 MultiTrode_MTT_MODBus_Manual_v1-0-9_R02.doc

29 Input Status: Single bit digital (read only) * The mirrored input register offest needs to be added to the configured "Mirror Base" of the Procon V to get actual register number. Index Mirrored Input Register Description Multitrode Cross-Reference Offset * Bit Variable Bit This bit will be high if there is any fault on pump 1 and low otherwise Status_quick[2] This bit will be high if there is any fault on pump 1 that is unacknowledged (i.e. fault not present AND Status_quick[2] 6 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 2 and low otherwise Status_quick[2] This bit will be high if there is any fault on pump 2 that is unacknowledged (i.e. fault not present AND Status_quick[2] 4 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 3 and low otherwise Status_quick[2] This bit will be high if there is any fault on pump 3 that is unacknowledged (i.e. fault not present AND Status_quick[2] 2 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 4 and low otherwise Status_quick[2] This bit will be high if there is any fault on pump 4 that is unacknowledged (i.e. fault not present AND Status_quick[2] 0 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 5 and low otherwise Status_quick[3] This bit will be high if there is any fault on pump 5 that is unacknowledged (i.e. fault not present AND Status_quick[3] 6 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 6 and low otherwise Status_quick[3] This bit will be high if there is any fault on pump 6 that is unacknowledged (i.e. fault not present AND Status_quick[3] 4 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 7 and low otherwise Status_quick[3] This bit will be high if there is any fault on pump 7 that is unacknowledged (i.e. fault not present AND Status_quick[3] 2 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 8 and low otherwise Status_quick[3] This bit will be high if there is any fault on pump 8 that is unacknowledged (i.e. fault not present AND Status_quick[3] 0 unacknowledged) and low otherwise This bit will be high if there is any fault on pump 9 and low otherwise Status_quick[4] This bit will be high if there is any fault on pump 9 that is unacknowledged (i.e. fault not present AND Status_quick[4] 6 unacknowledged) and low otherwise This bit will be high if pump 1 is available and low otherwise Status_quick[4] This bit will be high if pump 2 is available and low otherwise Status_quick[4] This bit will be high if pump 3 is available and low otherwise Status_quick[4] This bit will be high if pump 4 is available and low otherwise Status_quick[4] This bit will be high if pump 5 is available and low otherwise Status_quick[4] This bit will be high if pump 6 is available and low otherwise Status_quick[4] This bit will be high if pump 7 is available and low otherwise Status_quick[5] This bit will be high if pump 8 is available and low otherwise Status_quick[5] This bit will be high if pump 9 is available and low otherwise Status_quick[5] This bit will be high if there is any fault on the Master MonitorPRO and low otherwise Status_quick[5] This bit will be high if there is any fault on Slave 1 MonitorPRO and low otherwise Status_quick[5] This bit will be high if there is any fault on Slave 2 MonitorPRO and low otherwise Status_quick[5] This bit will be high if there is any change to the fault status and low otherwise Status_quick[5] This bit will be high if there is any change to any of the digital inputs or outputs or analogue inputs and low otherwise Status_quick[5] This bit is high if pump 1 is running and low otherwise Status_quick[6] This bit is high if pump 1 is available and low otherwise Status_quick[6] 6 Page 1 Input Status

30 Input Status: Single bit digital (read only) * The mirrored input register offest needs to be added to the configured "Mirror Base" of the Procon V to get actual register number. Index Mirrored Input Register Description Multitrode Cross-Reference Offset * Bit Variable Bit If index 34=0 and index 35=0 then pump 1 is in auto mode. If index 34=0 and index 35=1 then pump 1 is off. If index 34=1 and index 35=0 then pump 1 is off. If index 34=1 and index 35=1 then pump 1 is in manual mode Status_quick[6] See above. Status_quick[6] This bit is high if pump 2 is running and low otherwise Status_quick[6] This bit is high if pump 2 is available and low otherwise Status_quick[6] If index 38=0 and index 39=0 then pump 2 is in auto mode. Status_quick[6] 1 If index 38=0 and index 39=1 then pump 2 is off. If index 38=1 and index 39=0 then pump 2 is off. If index 38=1 and index 39=1 then pump 2 is in manual mode See above. Status_quick[6] This bit is high if pump 3 is running and low otherwise Status_quick[7] This bit is high if pump 3 is available and low otherwise Status_quick[7] If index 42=0 and index 43=0 then pump 3 is in auto mode. Status_quick[7] 5 If index 42=0 and index 43=1 then pump 3 is off. If index 42=1 and index 43=0 then pump 3 is off. If index 42=1 and index 43=1 then pump 3 is in manual mode See above. Status_quick[7] This bit is high if pump 4 is running and low otherwise Status_quick[7] This bit is high if pump 4 is available and low otherwise Status_quick[7] If index 46=0 and index 47=0 then pump 4 is in auto mode. Status_quick[7] 1 If index 46=0 and index 47=1 then pump 4 is off. If index 46=1 and index 47=0 then pump 4 is off. If index 46=1 and index 47=1 then pump 4 is in manual mode See above. Status_quick[7] This bit is high if pump 5 is running and low otherwise Status_quick[8] This bit is high if pump 5 is available and low otherwise Status_quick[8] If index 50=0 and index 51=0 then pump 5 is in auto mode. Status_quick[8] 5 If index 50=0 and index 51=1 then pump 5 is off. If index 50=1 and index 51=0 then pump 5 is off. If index 50=1 and index 51=1 then pump 5 is in manual mode See above. Status_quick[8] This bit is high if pump 6 is running and low otherwise Status_quick[8] This bit is high if pump 6 is available and low otherwise Status_quick[8] If index 54=0 and index 55=0 then pump 6 is in auto mode. Status_quick[8] 1 If index 54=0 and index 55=1 then pump 6 is off. If index 54=1 and index 55=0 then pump 6 is off. If index 54=1 and index 55=1 then pump 6 is in manual mode See above. Status_quick[8] This bit is high if pump 7 is running and low otherwise Status_quick[9] This bit is high if pump 7 is available and low otherwise Status_quick[9] 6 Page 2 Input Status

31 Input Status: Single bit digital (read only) * The mirrored input register offest needs to be added to the configured "Mirror Base" of the Procon V to get actual register number. Index Mirrored Input Register Description Multitrode Cross-Reference Offset * Bit Variable Bit If index 58=0 and index 59=0 then pump 7 is in auto mode. If index 58=0 and index 59=1 then pump 7 is off. If index 58=1 and index 59=0 then pump 7 is off. If index 58=1 and index 59=1 then pump 7 is in manual mode Status_quick[9] See above. Status_quick[9] This bit is high if pump 8 is running and low otherwise Status_quick[9] This bit is high if pump 8 is available and low otherwise Status_quick[9] If index 62=0 and index 63=0 then pump 8 is in auto mode. Status_quick[9] 1 If index 62=0 and index 63=1 then pump 8 is off. If index 62=1 and index 63=0 then pump 8 is off. If index 62=1 and index 63=1 then pump 8 is in manual mode See above. Status_quick[9] This bit is high if pump 9 is running and low otherwise Status_quick[10] This bit is high if pump 9 is available and low otherwise Status_quick[10] If index 66=0 and index 67=0 then pump 9 is in auto mode. Status_quick[10] 5 If index 66=0 and index 67=1 then pump 9 is off. If index 66=1 and index 67=0 then pump 9 is off. If index 66=1 and index 67=1 then pump 9 is in manual mode See above. Status_quick[10] Reserved Status_quick[10] Reserved Status_quick[10] Reserved Status_quick[10] Reserved Status_quick[10] Alarm 1 status_dig Alarm 2 status_dig Common Alarm status_dig Datalog Full Flag status_dig Spare status_dig Spare status_dig Spare status_dig Spare status_dig This bit will be high if a critical fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a non-critical fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a delay fail fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a seal fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a flygt seal fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a flygt thermistor fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] If the maximum starts per hour on pump 1 has been exceeded then this bit is high and low otherw status_xpc_pump_present[0] This bit will be high if a thermistor fault is PRESENT on pump 1 and low otherwise status_xpc_pump_present[0] This bit will be high if a critical fault is PRESENT on pump 2 and low otherwise status_xpc_pump_present[1] This bit will be high if a non-critical fault is PRESENT on pump 2 and low otherwise status_xpc_pump_present[1] This bit will be high if a delay fail fault is PRESENT on pump 2 and low otherwise status_xpc_pump_present[1] This bit will be high if a seal fault is PRESENT on pump 2 and low otherwise status_xpc_pump_present[1] This bit will be high if a flygt seal fault is PRESENT on pump 2 and low otherwise status_xpc_pump_present[1] 3 Page 3 Input Status