TSPC Serial Communications Formats Chuck Elliot 18 Nov 2008

Transcription

1 DRAFT TSPC Serial Communications Formats Chuck Elliot 8 Nov 008 /8

2 Introduction... Modbus RTU... Senix Supported Modbus Functions... 4 Packet Structure... Packet Framing... Modbus Error Codes... 7 Modbus CRC Calculation... 8 Function Read Holding Resisters... 9 Function Write Multiple Registers... Senix Data Map... OCX Interface... 7 Continuous ASCII Interface... 8 /8

3 Introduction The scope of this document is to provide the end user with sufficient information to facilitate communications with a TSPC sensor. Information is exchanged with a TSPC sensor over either a RS- or RS-48 interface. Using these interfaces, Senix allows three different methods to facilitate communications. These include: Modbus RTU OCX Interface Continuous ASCII Each of these methods is detailed in the following pages. Modbus RTU Modbus RTU is the standard interface that Senix uses to communicate with TSPC sensors. It is used by the SenixVIEW program to configure a sensor under Microsoft Windows. Modbus RTU is a binary Master/Slave protocol that may be used with RS- or RS-48. The TSPC sensor is the slave device and the master device is a PC or other controlling device. It is outside the scope of this document to fully define the Modbus protocol. A full specification may be found at: Another useful link for PC development tools and additional information may be found at: /8

4 Senix Supported Modbus Functions TSPC sensors may be set to slave address -47. TSPC sensors are shipped with this address set to and may be changed using SenixVIEW. All data exchange is performed with Modbus functions: Input - Function (0x0) - Read Holding Resisters Output - Function (0x0) - Write Multiple Registers It is suggested that only read functions be performed by the end user and all sensor configuration be performed with SenixVIEW. Senix will direct end users on a case by case basis, if the need arises, on the methods required to dynamically alter configuration parameters via Modbus. 4/8

5 Packet Structure The Modbus master device initiates communications with a slave device by issuing a request and then waits for a response from the slave. The master must handle of possibilities: A response is received An error response is received No response is received The general form of a request is: Function Request Data - Function Dependant CRC s (See: Modbus CRC Calculation) The general form of a response is: Same as request Function Same as request Response Data - Function Dependant CRC s The general form of an error response is: Same as request FUNCTION Same as request with the high bit of the byte set to Error Code s (See: Modbus Error Codes) CRC s CRC Calculation is performed on the bytes from the to the last byte before the CRC itself. Integer values that are contained in the Request or Response are stored in big Endian format. In other words, the MSB of the integer is placed before the LSB when viewing the data as a byte stream. The exception to this is the CRC which is stored LSB and then MSB. /8

6 Packet Framing In RTU mode, messages start with a silent interval of at least. character times. This is most easily implemented as a multiple of character times at the baud rate that is being used on the network. The first field then transmitted is the device address. When the first field (the address field) is received, each slave device decodes it to find out if it is the addressed device. Following the last transmitted character, a similar interval of at least. character times marks the end of the message. A new message can begin after this interval. The entire message frame must be transmitted as a continuous stream. If a silent interval of more than. character times occurs before completion of the frame, the receiving device flushes the incomplete message and assumes that the next byte will be the address field of a new message. Similarly, if a new message begins earlier than. character times following a previous message, the receiving device will consider it a continuation of the previous message. This will set an error, as the value in the final CRC field will not be valid for the combined messages. A typical message frame is shown below: /8

7 Modbus Error Codes The most common Modbus error codes are as follows. Other codes exist. Refer to the full Modbus specification. 0 ILLEGAL FUNCTION The function code received in the query is not an allowable action for the server (or slave). 0 ILLEGAL DATA ADDRESS The data address received in the query is not an allowable address for the server (or slave). 0 ILLEGAL DATA VALUE A value contained in the query data field is not an allowable value for server (or slave). 7/8

8 Modbus CRC Calculation The following C code example illustrates the algorithm used to calculate the CRC word: // WORD = bits unsigned // BYTE = 8 bits unsigned WORD CRC(BYTE *ndata, WORD wlength) { static const WORD wcrctable[] = { 0x0000, 0xC0C, 0xC8, 40, 0xC0, 0x0C0, 0x080, 0xC4, 0xC0, 0x0C0, 0x0780, 0xC74, 0x000, 0xCC, 0xC48, 0x0440, 0xCC0, 0x0CC0, 0x0D80, 0xCD4, 0x0F00, 0xCFC, 0xCE8, 0x0E40, 0x0A00, 0xCAC, 0xCB8, 0x0B40, 0xC90, 0x09C0, 0x0880, 0xC84, 0xD80, 0x8C0, 0x980, 0xD94, 0xB00, 0xDBC, 0xDA8, 0xA40, 0xE00, 0xDEC, 0xDF8, 0xF40, 0xDD0, 0xDC0, 0xC80, 0xDC4, 0x400, 0xD4C, 0xD8, 0x40, 0xD70, 0x7C0, 0x80, 0xD4, 0xD0, 0xC0, 0x80, 0xD4, 0x00, 0xDC, 0xD08, 0x040, 0xF00, 0x0C0, 0x80, 0xF4, 0x00, 0xFC, 0xF8, 0x40, 0x00, 0xFC, 0xF78, 0x740, 0xF0, 0xC0, 0x480, 0xF44, 0xC00, 0xFCC, 0xFD8, 0xD40, 0xFF0, 0xFC0, 0xE80, 0xFE4, 0xFA0, 0xAC0, 0xB80, 0xFB4, 0x900, 0xF9C, 0xF88, 0x840, 0x800, 0xE8C, 0xE98, 0x940, 0xEB0, 0xBC0, 0xA80, 0xEA4, 0xEE0, 0xEC0, 0xF80, 0xEF4, 0xD00, 0xEDC, 0xEC8, 0xC40, 0xE40, 0x4C0, 0x80, 0xE4, 0x700, 0xE7C, 0xE8, 0x40, 0x00, 0xEC, 0xE8, 0x40, 0xE0, 0xC0, 0x080, 0xE04, 0xA00, 0x0C0, 0x80, 0xA4, 0x00, 0xAC, 0xA8, 0x40, 0x00, 0xAC, 0xA78, 0x740, 0xA0, 0xC0, 0x480, 0xA44, 0xC00, 0xACC, 0xAD8, 0xD40, 0xAF0, 0xFC0, 0xE80, 0xAE4, 0xAA0, 0xAC0, 0xB80, 0xAB4, 0x900, 0xA9C, 0xA88, 0x840, 0x7800, 0xB8C, 0xB98, 0x7940, 0xBB0, 0x7BC0, 0x7A80, 0xBA4, 0xBE0, 0x7EC0, 0x7F80, 0xBF4, 0x7D00, 0xBDC, 0xBC8, 0x7C40, 0xB40, 0x74C0, 0x780, 0xB4, 0x7700, 0xB7C, 0xB8, 0x740, 0x700, 0xBC, 0xB8, 0x740, 0xB0, 0x7C0, 0x7080, 0xB04, 0x000, 0x90C, 0x98, 0x40, 0x90, 0xC0, 0x80, 0x94, 0x90, 0xC0, 0x780, 0x974, 0x00, 0x9C, 0x948, 0x440, 0x9C0, 0xCC0, 0xD80, 0x9D4, 0xF00, 0x9FC, 0x9E8, 0xE40, 0xA00, 0x9AC, 0x9B8, 0xB40, 0x990, 0x9C0, 0x880, 0x984, 0x880, 0x48C0, 0x4980, 0x894, 0x4B00, 0x8BC, 0x8A8, 0x4A40, 0x4E00, 0x8EC, 0x8F8, 0x4F40, 0x8D0, 0x4DC0, 0x4C80, 0x8C4, 0x4400, 0x84C, 0x88, 0x440, 0x870, 0x47C0, 0x480, 0x84, 0x80, 0x4C0, 0x480, 0x84, 0x400, 0x8C, 0x808, 0x4040 }; BYTE ntemp; WORD wcrcword = 0xFFFF; } while (wlength--) { ntemp = *ndata++ ^ wcrcword; wcrcword >>= 8; wcrcword ^= wcrctable[ntemp]; } return wcrcword; 8/8

9 Function Read Holding Resisters Read the binary contents of holding registers in the slave. The request message specifies the starting register and quantity of registers to be read Function Starting MSB Starting LSB Register Count MSB Register Count LSB The reply message format is: N = Register Count from Request 9/8

10 As an example, if we wished to read register at address 0 (0x08 Hex) the request packet would be: Assuming register 0x08 in the slave contains the value 0x4 the reply would be: 4 Function Reg Value 0x08 MSB Reg Value 0x08 LSB Hex 0x0 0x 0x4 0xFC 0xAF 0/8

11 As a second example, if we wish to read registers at the same address the request packet would be: If resister 0x08 has the same value as before 0x4 and 0x09 in the slave contains 0x78 then the reply would be: Function Reg Value 0x08 MSB Reg Value 0x08 LSB Reg Value 0x09 MSB Reg Value 0x09 LSB Hex 0x0 0x 0x4 0x 0x78 0xE 0xFE A possible error reply, error, might be: Function with Hi bit set Error Code Hex 0x8 0x80 0xF0 /8

12 Function Write Multiple Registers Write the binary registers in the slave. The request message specifies the starting register, quantity of registers, total data byte count and register values to be written: *N 7 + *N *N + Function Starting MSB Starting LSB Register Count MSB Register Count LSB Total Count * N bytes of data N = Register Count The reply message format is: Function Starting MSB Starting LSB Register Count MSB Register Count LSB /8

13 As an example, if we wished to write register at address 4 (0x0004 Hex) with the value 0x4 the request packet would be: Function Starting MSB Starting LSB Register Count MSB Register Count LSB Total Count Data MSB Data LSB Hex 0x0 0x00 0x04 0x00 0x0 0x 0x4 0xA9 0xB7 The reply would be: Function Starting MSB Starting LSB Register Count MSB Register Count LSB Hex 0x0 0x00 0x04 0x00 0x00 0x0C /8

14 Expanding the first example, to write registers at address 4 (0x0004 Hex) with the values 0x4 and 0x78 the request packet would be: Function Starting MSB Starting LSB Register Count MSB Register Count LSB Total Count Data MSB Data LSB Hex 0x0 0x00 0x04 0x00 0x0 0x04 8 Data MSB 0x 9 Data LSB 0x4 0x 0x78 0x89 0x97 The reply would be: Function Starting MSB Starting LSB Register Count MSB Register Count LSB Hex 0x0 0x00 0x04 0x00 0x0 0x40 0x0D 4/8

15 Senix Data Map As stated previously, Senix recommends that only read functions be performed on the sensor. Senix will direct end users on a case by case basis, if the need arises, on the methods required to dynamically alter configuration parameters via Modbus. The following registers may be read either as single registers or as a group: Hex 0x008 0x009 0x00A 0x00B 0x00C 0x00D 0x00E Distance Cycle Count Voltage Current Switch States Reserved Unfiltered Distance Distance The Distance register returns a raw integer count from the sensor. This value must be converted to create a true distance measurement. The conversion factor is dependent on the senor model. To convert the raw register value to inches use the following: TSPC0S Inches = Raw * TSPC0S Inches = Raw * TSPCS Inches = Raw * *.0 TSPCS Inches = Raw * * 4.0 Cycle Count The Cycle Count is used as a method of determining if a returned distance measurement is from a new sonic measurement by the sensor. Each time the sensor makes a new measurement the Cycle Count is incremented. Values are from 0 to with a wrap-around back to 0 from. Important note: The register returned from Modbus is a bit register and must be masked to the LSB to be valid. Voltage The Voltage register returns a raw integer value of the DAC that controls the voltage output of the sensor. It make be converted to a numeric value as follows: /8

16 Numeric Voltage = (Raw Value / 400) * 0.0 = 0-0 VDC Current The Current register returns a raw integer value of the DAC that controls the current output of the sensor. It make be converted to a numeric value as follows: Numeric Current = (Raw Value / 400) * 0.0 = 0-0 ma Switch States The Switch States register returns the values of the output switches in the sensor. These are bit values that are defined as follows: Where: A B C D Switch Source On Switch Sink On Switch Source On Switch Sink On Unfiltered Distance The Unfiltered Distance Register returns the value of the measurement made by the sensor prior to any filtering that was selected in the sensor. /8

17 OCX Interface Senix has created and can provide an OCX control that facilitates the creation of PC applications that wish to communicate with TSPC sensors. The development environment must support OCX controls. Most Microsoft programming languages support this method of interfacing. Contact Senix for further information. 7/8

18 Continuous ASCII Interface Senix can also provide an alternate serial interface where a TSPC sensor streams a continuous ASCII block of information that contains the distance measurement to a host system. A utility program to allow access to this feature and a description of the returned data may be obtained fro Senix. 8/8