3.Modbus RTU Protocol
geokon’s Model 8960-01C uses the industry standard Modbus Remote Terminal Unit (RTU) protocol to communicate with dataloggers. As the name suggests, Modbus was designed to work on what is known as a bus network, meaning that every device receives every message which passes across the network. Model 8960-01C strings use the RS-485 electrical interface because of its prevalence, simplicity, and success as a robust industrial physical layer.
More information about Modbus can be found at the following website:
http://www.modbus.org/specs.php
The Modbus RTU protocol uses packets (messages made up of multiple sections) to communicate and transfer data between devices on the network. The general format of these packets is as follows:
1.Modbus Address (1 byte) – The address of the specific device on the bus.
2.Function Code (1 byte) – The action to be carried out by the server device.
3.Data (multi-byte) – The payload of the function code being sent.
4.Cyclic Redundancy Check or CRC (2 bytes) – A 16-bit data integrity check calculated over the other byes in the packet.
Modbus tables (maps) define the memory locations within each 8960-01C interface and what information they contain. For example, the most recent sensor reading is stored in a table. This reading is presented in different formats in different sections of the table. The register location and size of these variables is detailed in the table below.
|
Variable |
Type |
Modbus Register |
Decimal |
Description |
|
Frequency |
float32 |
0x0100 |
256 |
Measured frequency in Hz |
|
Resistance |
float32 |
0x0102 |
258 |
Measured thermistor-resistance |
|
Trigger |
uint16 |
0x0118 |
280 |
Writing to this register initiates a sample |
table 2: RAM Storage
3.4Reading Sensors with the 8960-01C Interfaces
While Modbus RTU supports roughly 20 different function codes, the simple functionality of a bused VW sensor eliminates the need for all but two of them. Specifically, the Preset Single Register (0x06) and the Read Holding Registers (0x03). The Preset Single Register function code is used to issue a 'trigger' command to the interface. This initiates a pluck and read sequence. The Read Holding Registers function code is used to read the values stored in 16-bit registers in the 8960-01C. In this case, the measurement result occupies two 16-bit registers. The readings can be retrieved as frequency (Hz). An example of this trigger and subsequent query is shown in Tables 3 and 4 below.
|
TX-> 01 06 0118 00 01 C9 F1 |
Trigger address #1 |
|
RX<- 01 06 0118 00 01 C9 F1 |
Sensor acknowledges the single write |
|
...wait 370 ms... |
|
|
TX-> 01 03 0100 00 02 C5 F7 |
Get contents of 2 registers @ 0x0100 (gauge frequency) |
|
RX<- 01 03 71 58 45 4B 12 7B |
Registers = 0x454B7158, 3255.08 Hz |
|
TX-> 01 03 01 02 00 02 64 37 |
Get contents of 2 registers @ 0x0102 (thermistor resistance) |
|
RX<- 01 03 5D 3A 45 51 3A FE |
Registers = 0x45515D3A, 3349.83 Ω |
|
|
Device Address |
Function Code |
Data Address |
Data to Write |
*CRC |
|
HEX16 |
01 |
06 |
0118 |
0001 |
C9F1 |
|
DEC10 |
1 |
6 |
280 |
1 |
51697 |
table 3: Example Trigger Command - Sensor #1
The following table shows the IEEE-754 floating point response as two parts, each one composed of two bytes. Because of how this information is stored in the memory, the two parts are received in reverse order. The complete floating point number in HEX is 0x454B7158 (3255.08).
|
|
Device Address |
Function Code |
Byte Count |
Lower 16 bits |
Upper 16 bits |
*CRC |
|
HEX16 |
01 |
03 |
04 |
7158 |
454B |
127B |
|
DEC10 |
1 |
3 |
4 |
3255.08 |
4731 |
|
table 4: Example Response - Sensor #1, Floating Point Frequency Reading
Figure 10: PC terminal program screen capture
Note: The Modbus CRC is sent the least-significant byte (LSB) first. When calculating the CRC for the write of address 0118 in Table 5, the Modbus CRC algorithm will return 0xF1C9 (61897D). Our examples show the decimal value after the LSB and most-significant byte (MSB) are swapped.
The Model 8960-01C interface is designed to excite and measure all geokon VW transducers. It will automatically detect any resonant frequency between 400 and 5,000 Hz. There are no settings for sensor type.
The time between sending a trigger and data availability is 370 milliseconds.