MB Ecp 202 Expert en
MB Ecp 202 Expert en
INDEX
GENERAL DESCRIPTION
Pag. 3 1.1 Modbus protocol
1
Pag. 3 1.2 Serial configuration
Pag. 4 1.3 Message format (Frame)
Pag. 5 1.4 Messagges synchronization
Pag. 5 1.5 Error messagges (exceptions)
COMMANDS DESCRIPTION
Pag. 6 2.1 Register reading (0x03)
2
Pag. 7 2.2 Single register writing (0x06)
Pag. 8 2.3 Data reading of device identification (0x2B / 0x0E)
GLOSSARY
Pag. 17 4 Glossary
4
MODBUS-RTU
1: GENERAL DESCRIPTION
The data communication system based on Modbus protocol allows to connect up to 247 devices in a
common RS485 line with standard format and communication mode.
Communication takes place in half duplex by frame (transmitted continuously); only master (PC , PLC ...)
can start polling with slaves as question/answer (only one slave addressed) and the polled slave answers.
The slave answers after a minimum pause of 3,5 characters between received frame and the one to be
transmitted.
Also broadcast communication mode exists where the master send a request to all the slaves
simultaneously, and they give no answer back; this mode it's not available with this controller.
The data serial transmission mode implemented on the controller is RTU type (Remote Terminal Unit),
where data are exchanged in binary format (8 bit characters).
Start bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0 Parità Stop
(optional)
Each message (Frame) is made, based on MODBUS-RTU standard, by the following parts:
Device Function
Start Data CRC16 Stop
address code
pause (3.5 times pause (3.5 times
the character the character
Byte Byte n x Byte LSByte MSByte
transmission transmission
period) period)
- Start / Stop :
Message starts with pause higher than 3.5 times the character transmission period.
See chap. 4.1 for further clarifications.
- Device address:
Device address with whom the master established the polling; it's a value between 1 and 247. Address
0 is reserved to the broadcast, message sent to all slave devices (not active on this controller). RS485
line allows to connect together up to 32 devices (1 Master + 31 slaves), but with appropriate "bridges"
or relay devices it is possible to use the whole logical addressing field.
- Function Code:
Code of the function to be execute or already executed; On device are acteve codes 0x03 (register
reading), 0x06 (single register writing) and 0x2B/0x0E (identification data reading).
- Data:
Data that must be exchanged.
- CRC16:
Error checking field based on CRC16 algorithm. CRC16 is calculated on the whole message by the
master device which is trasmitting and attached to the message itself. The slave, at the end of
reception, calculates CRC16 on the message and compares it with the value learnt by the master; if the
values do not match, the message will be considered not valid and will be discarded without sending
any answer to the master.
The following fragment of C code shows the CRC16 calculation mode:
unsigned int CRC16
void Modbus_CRC(unsigned char *Frame, unsigned char FrameLength)
{
unsigned char ByteCount;
unsigned char i;
unsigned char bit_lsb;
CRC16 = 0xFFFF;
for (ByteCount=0;ByteCount<FrameLength;ByteCount++)
{
CRC16^=Frame[ByteCount];
for (i=0;i<8,i++)
{
bit_lsb = CRC16 & 0x0001;
CRC16 = CRC16>>1;
if (bit_lsb == 1)
CRC16 ^= 0xA001;
}
}
}
MODBUS-RTU SPECIFIC FOR
Pag. 4 ECP 202 EXPERT SERIES Rev. 01-17
MODBUS-RTU
Message synchronization between transmitter and receiver is made placing a pause on the messages at
least 3.5 times the character transmission period. If the receiver does not receive any Byte for 3.5 times the
character transmission period, consider the last message completed and set the next Byte received ad the
first one of a new message.
The slave, once received the complete message, decodes it and, if there are no errors, sends the answer
message to the master. To send the answer, slave keeps RS485 line busy, wait a pause of 3.5 times the
character transmission period, send the complete message, wait 3.5 times the character transmission
period and then release the RS485 line.
The master unit will have to consider these periods to avoid risks of transmission overlap; in particular must
be set a proper answer reception time-out before starting a new transmission (typical time-out value:
500msec or higher, for a baud rate = 9600).
The device, if not possible to complete the required operation, answers with an error message, in the
following format:
- Device address:
Address of slave device answering
- Function Code:
Function code MSb =1 (to show exception); i.e. 0x83 (for 0x03 reading ) or 0x86 (for 0x06 writing)
- Exception Code:
Exception codes handled by the device are the following:
Exception
Description Exception cause
code
Function not A function code not available was requested, different from 0x03, 0x06
0x01
implemented and 0x2B/0x0E.
It's generated in several situations:
- a not implemented register has been requested (or a not-existing
area)
Address not
0x02 - a reading of a number of registers that goes further on the
valid
implemented area has been requested (starting from requested
address)
- tried to write on a read-only area
It's generated in several situations:
Value not valid
0x03 - message 0x2B/0x0E DeviceIdCode is not correct
for datum
- has been tried to write a parameter with an out of range value
Error control field based on the CRC16 algorithm.
Note:
In case the device identifies in the received message an error on format or in CRC16, the message is
discarded (considered not valid) and no answer is sent.
2: COMMANDS DESCRIPTION
All the registers, to equalize the interpretation, are handled in a Word format (16 bit), even if an 8-bit
parameter is contained.
- Device address:
Address of slave device to be polled
- Function Code:
Function code to be executed, in this case register reading (0x03)
- Register address:
Starting register address for reading expressed with two Bytes; (MSByte) and (LSByte).
- Number of registers:
indicates the number of Word required from the starting address. If a number of registers more than 1
is requested, the answer message will provide all the registers required with consecutive addresses
starting from the address shown on the "register address" field.
The number of registers to read is expressed on two Bytes, particularly for this controller (MSByte)
must always be 0x00 and (LSByte) with range 1-10.
- CRC16:
Error control field based on the CRC16 algorithm.
- Device address:
Address of slave device answering
- Function Code:
Function code to be answered to, in this case register reading (0x03)
- Bytes’ number of datum:
Contains the total Bytes number of data.
Consider that the Bytes’ number of datum is the double of the number of registers (because we talk
about word). I.e. if in the polling message 2 registers are requested, in the answer message Bytes’
number of datum must be set as 4.
- Datum n :
Contains data sequences each expressed on two Bytes; (MSByte) and (LSByte).
- CRC16:
Error control field based on the CRC16 algorithm.
Register
Device address Function Code address Datum CRC16
Byte Byte MSByte LSByte MSByte LSByte LSByte MSByte
- Device address:
Address of slave device to be polled
- Function Code:
Function code to be executed, in this case single register writing (0x06)
- Register address:
address of register to write expressed with two Bytes; (MSByte) and (LSByte).
- Data:
Value to be assigned to the register expressed with two Bytes; (MSByte) and (LSByte).
- CRC16:
Error control field based on the CRC16 algorithm.
The answer message is a simple echo of the polling message to confirm that the variable has been
modified.
- Device address:
Address of slave device to be polled
- Function Code:
Function code to be executed, in this case identification data reading (0x2B)
- MEI type:
Modbus Encapsulated Interface type: it must be 0x0E.
- Read Device Id Code:
Indicates the access type to data: it must be 0x01.
- Object Id:
Indicates the starting object for data reading (range: 0x00 – 0x02).
- CRC16:
Error control field based on the CRC16 algorithm.
- Device address:
Address of slave device answering
- Function Code:
Function code to be executed, in this case identification data reading (0x2B)
- MEI type:
Modbus Encapsulated Interface type: it must be 0x0E.
- Read Device Id Code:
Indicates the access type to data: it must be 0x01.
- Conformity level:
indicates the slave conformity level: it is always 0x01.
- More Follows:
indicates the number of additional transactions requested: it is always 0x00.
- Next Object Id:
indicates the object that has to be requested in the eventual following transaction: it is always 0x00
- Number Of Object:
number of objects that follow (1, 2 o 3).
MODBUS-RTU SPECIFIC FOR
Pag. 8 ECP 202 EXPERT SERIES Rev. 01-17
MODBUS-RTU
- List of:
- Object Id:
current object number .
- Object Length:
length of following string.
- Object Value:
ASCII string that contains the identification information.
- CRC16:
Error control field based on the CRC16 algorithm.
Reading example of all controllers identification information with software ECP202 rel. 26 (address 1)
Demand message: ( 01 2B 0E 01 00 70 77 )
- Device address: 0x01
- Function code: 0x2B
- MEI type: 0x0E
- Read DeviceIdCode: 0x01
- ObjectId: 0x00
- CRC16: to be calculated on previous values
Each register has a 16 bit dimension. It has been formed some blocks of variables (each with a different
MSByte address) basing on the the type of these variables. In the followings paragraphs are described in
the detail all the available blocks and, for each block, the implemented variables.
At the beginning of each table it has been indicated in the first row if its data could be only read (READ-
ONLY) or written and read (READ/WRITE).
READ-ONLY
Register Description Bytes meaning and range U.M. Conv Molt
MSByte Resolution 0,1°C
Ambient
256 range: -45°C .. +99°C °C X 0,1
temperature LSByte Values > +99°C indicate broken probe
MSByte Resolution 0,1°C
Evaporator
257 range: -45°C .. +99°C °C X 0,1
temperature LSByte Values > +99°C indicate broken probe
3.2 PARAMETERS
READ / WRITE
Register Description Bytes meaning and range U.M. Conv Molt
MSByte
778 F4 range: 0..1, (1 = stopped fans) num 1
fans stop in defrosting LSByte
dE MSByte
779 evaporator probe range: 0..1, (1 = probe excluded) num 1
exclusion LSByte
dSt MSByte
1 °C steps
792 Smart defrost Setpoint °C X 1
LSByte range: -30..30 °C
(if dSE=1)
CE1 MSByte 1 minute steps
793 Duration of compressor range: 0..240 minutes min 1
ON time in the case of
LSByte (0 = disabled)
faulty ambient probe
CE2 MSByte
Duration of compressor 1 minute steps
794 min 1
OFF time in the case of range: 5..240 minutes
LSByte
faulty ambient probe
3.2a PARAMETERS
READ-ONLY
Registro Descrizione Significato e range Bytes U.M. Conv Molt
MSByte
mOd 0 = Cold function
512 Thermostat functioning num 1
1 = Hot function
mode LSByte
d1 MSByte 0 = heaters
513 1 = hot gas num 1
Defrost type LSByte 2 = heater with temperature control
0 = current temperature
dFd MSByte
1 = temperature at the beginning of
514 Display viewing during num 1
the defrost
defrost LSByte 2 = “DEF”
In1 MSByte
515 range: -8 .. +8 (0=disabled) num 1
Input 1 setting LSByte
In2 MSByte
516 Like In1. num 1
Input 2 setting LSByte
AU1 MSByte
517 range: -6 .. +6 (0=disabled) num 1
Auxiliary relay 1 control LSByte
AU2 MSByte
518 Like AU1. num 1
Auxiliary relay 2 control LSByte
READ-ONLY
Register Description Bytes meaning U.M. Conv Molt
bit 7 (MSb)
bit 6
bit 5
bit 4
MSByte Not used
bit 3
bit 2
bit 1
bit 0 (LSb)
1280 output status bit 7 (MSb) Not used
num 1
bit 6 Hot resistance status
bit 5 Stand-by status
bit 4 Dripping status
LSByte
bit 3 Cold room light relay
bit 2 Fans relay
bit 1 Defrost relay
bit 0 (LSb) Compressor relay
READ-ONLY
Register Description Bytes meaning U.M. Conv Molt
bit 7 (MSb)
bit 6
bit 5
bit 4
MSByte Not used
bit 3
bit 2
bit 1
bit 0 (LSb)
1281 input status bit 7 (MSb) Night digital input (energy saving)
num 1
bit 6 Remote Stop defrost
bit 5 Remote Start defrost
bit 4 Remote Stand-by
LSByte
bit 3 Pump-down input
bit 2 Man in cold room alarm (E8)
bit 1 Compressor protection (EC)
bit 0 (LSb) Door-switch
READ-ONLY
Register Description Bytes meaning U.M. Conv Molt
bit 7 (MSb) Not used
bit 6 Not used
bit 5 Not used
bit 4 Not used
MSByte
bit 3 Not used
bit 2 Not used
bit 1 Light alarm (E9)
bit 0 (LSb) Compressor protection alarm (Ec)
1282 alarms status bit 7 (MSb) Man in room alarm (E8)
num 1
bit 6 Open door alarm (Ed)
bit 5 Low temperature alarm (EL)
bit 4 High temperature alarm (EH)
LSByte
bit 3 Not used
bit 2 EEPROM error(E2)
bit 1 Evaporator probe fault (E1)
bit 0 (LSb) Ambient probe fault (E0)
READ / WRITE
Register Description Bytes meaning U.M. Conv Molt
bit 7 (MSb) Not used
bit 6 Not used
bit 5 Not used
bit 4 Not used
MSByte bit 3 Not used
bit 2 Defrost forcing enabling
Modific. enabling of cold room light
bit 1
status
bit 0 (LSb) Modific. enabling of stand-by status
bit 7 (MSb) Not used
bit 6 Not used
1536 device status bit 5 Not used num 1
bit 4 Not used
bit 3 Not used
Defrost forcing
LSByte bit 2 1 = defrost
0 = non-defrost
Cold room light key status
bit 1 1 = active cold room light
0 = non-active cold room light
Stand-by status
bit 0 (LSb) 1 = stand-by
0 = ON
For asking the modification of one of device status bits, the master has to send into LSByte the requested
value for the bit and into MSByte the corresponding bit set to 1. i.e.: for stand-by staus forcing, the master
has to send MSByte = 00000001 and LSByte = 00000001. For disabling the cold room light, the master has
to send MSByte = 00000010 and LSByte = 00000000.
4: GLOSSARY
- Binary Number:
It is used in computer science for the internal representation of numbers, thanks to the simplicity to
physically realize an element with two state (0,1) instead an higher number, but also with the matching
with the logic values TRUE and FALSE.
- Decimal Numer:
On decimal system all whole numbers can be represented using the ten digits that indicates the first
ten natural numbers, included zero. The value of each of these digits depends on the position occupied
inside the number, and it increases in powers of 10, from right to left.
- Hexadecimal Number:
It is part of a positional numeric system with base 16, that means it uses 16 symbols instead usual 10 of
the traditional numerical deciaml system. Hexadecimal generally uses symbols from 0 to 9 and then
letters from A to F, for a total 16 symbols. Conventionally an hexadecimal number is preceded by 0x
(i.e. 0x03) or by H (i.e. H03).
- bit:
A bit is a binary digit that is one of the two symbols of numerical binary system, usually called zero (0)
and one (1). It represents the definition unit of a logic state.
It's defined also as elementary unit of the information used by a computer.
- Byte:
It's the quantity of bit needed to define an alphanumeric character; particularly a Byte is made by a
sequence of 8 bit (i.e. 10010110).
- Word:
Unit of measure that fixes information lenght at 16 bits that is equivalent to 2 Bytes
(i.e. 10010110 01101011).
- LSb:
Less significant bit of a binary digit (first bit on the right of the indicated number)
- MSb:
Most significant bit of a binary digit (first bit on the left of the indicated number)
- LSByte:
Less significant Byte of a Word (Byte on the right of the indicated Word)
- MSByte:
Most significant Byte of a Word (Byte on the left of the indicated Word)
NOTE
NOTE
PEGO s.r.l.
Via Piacentina, 6/b 45030 Occhiobello ROVIGO - ITALY
Tel. +39 0425 762906 Fax +39 0425 762905
e.mail: info@pego.it – www.pego.it
Distributor: