background image

30

12. Modbus telegram examples

12.1 Diagnostics: return query data

This function is useful to ensure that the communication path and 
slave configuration are correct. It will echo the request in the 
response.
In the example, slave address 0x01 is used.

Request from master to slave

Example of response from slave to master

If there is no response from the slave, see section 

9. Data item 

overview

.

12.2 Reading the CIM configuration register block

This section shows how to read the first four registers of the 
CIM configuration register block.
In the example, slave address 0x01 is used.

Request from master to slave

Example of response from slave to master

If there is no response from the slave, see section 

9. Data item 

overview

.

12.3 Tripping the MP 204 

This section shows how to set the control bit that trips the 
MP 204.
In the example, slave address 0x01 is used.
To trip the MP 204, the ControlRegister (register address 00101, 
bit 1) must be raised.
Hence the value to set is 0b0000000000000010 = 0x0002.

Request from master to slave

Example of response from slave to master

If there is no response from the slave, see section 

9. Data item 

overview

.

12.4 Resetting an alarm

This section shows how to set the control bit that resets MP 204 
alarms.
In the example, slave address 0x01 is used.
To reset an alarm, the ControlRegister (register address 00101, 
bit 0) must be raised.
Hence the value to set is 0b0000000000000001 = 0x0001.

Request from master to slave

Example of response from slave to master

If there is no response from the slave, see section 

9. Data item 

overview

.

Note

CRC fields are not shown in the following 
examples.

Note

The Modbus data model states that registers 
numbered X are addressed in telegrams as X - 1, 
e.g. register 00104 (setpoint) is addressed as 
00103 in a Modbus telegram.

Field

Value

Description

Slave address

0x01

-

Function code

0x08

Diagnostics

Subcode

0x00

Echo request

Data

0xAB

Test data

Data

0xCD

Test data

Field

Value

Description

Slave address

0x01

-

Function code

0x08

Diagnostics

Subcode

0x00

Echo request

Data

0xAB

Test data

Data

0xCD

Test data

Field

Value

Description

Slave address

0x01

-

Function code

0x04

Read input registers

Start address HI

0x00

Start address
= 0x0001

Start address LO

0x00

Quantity HI

0x00

Number of registers
= 0x0004

Quantity LO

0x04

Field

Value

Description

Slave address

0x01

-

Function code

0x04

Read input registers

Byte count

0x08

8 bytes follow

00001 HI

0x00

SlaveMinimumReplyDelay
= 0x000A

00001 LO

0x0A

00002 HI

0x00

RegisterOffset
= 0x0000

00002 LO

0x00

00003 HI

0x00

Reserved value
= 0x0000

00003 LO

0x00

00004 HI

0x00

ModbusBitRate
= 0x0004

00004 LO

0x04

Field

Value

Description

Slave address

0x01

-

Function code

0x06

Write single register

Start address HI

0x00

ControlRegister address
= 00101 (0x0065)

Start address LO

0x64

Value HI

0x00

ControlRegister value
= 2 (0x0002)

Value LO

0x02

Field

Value

Description

Slave address

0x01

-

Function code

0x06

Write single register

Start address HI

0x00

ControlRegister address
= 00101 (0x0065)

Start address LO

0x64

Value HI

0x00

ControlRegister value
= 2 (0x0002)

Value LO

0x02

Field

Value

Description

Slave address

0x01

-

Function code

0x06

Write single register

Start address HI

0x00

ControlRegister address
= 00101 (0x0065)

Start address LO

0x64

Value HI

0x00

ControlRegister value
= 1 (0x0001)

Value LO

0x01

Field

Value

Description

Slave address

0x01

-

Function code

0x06

Write single register

Start address HI

0x00

ControlRegister address
= 00101 (0x0065)

Start address LO

0x64

Value HI

0x00

ControlRegister value
= 1 (0x0001)

Value LO

0x01

Subject to alterations.

Summary of Contents for CIU 250

Page 1: ...GRUNDFOS INSTRUCTIONS Grundfos CIU 250 GSM for Grundfos MP 204 Functional profile and user manual ...

Page 2: ...ults 20 9 Data item overview 21 10 Grundfos alarm and warning codes 24 11 Modbus telegrams and function codes 26 11 1 Modbus telegram overview 26 11 2 Read holding registers 0x03 27 11 3 Read input registers 0x04 27 11 4 Write single register 0x06 27 11 5 Write multiple registers 0x10 28 11 6 Diagnostics 0x08 28 11 7 Diagnostics register interpretation 29 12 Modbus telegram examples 30 12 1 Diagno...

Page 3: ...remote control This is out of the scope of this manual Fig 1 CIU 250 solution for the MP 204 connected to a pump SELV Separated or Safety Extra Low Voltage SELV E Separated or Safety Extra Low Voltage with Earth connection SIM SIM card Subscriber Identity Module SMA SubMiniature version A Coaxial radio signal connection standard TCP IP Transmission Control Protocol Internet Protocol Protocol suita...

Page 4: ...ture is within 0 C to 45 C GENIbus visual diagnostics LED2 Will be in one of these states Off constantly green flashing red constantly red See section 3 2 LEDs Modbus GSM GPRS specifications Data protocol Modbus RTU Modbus TCP Modbus connection type GSM GPRS Slave address Factory 231 0xE7 Can be changed via Modbus register 00003 SetModbusAddress GSM GPRS visual diagnostics LED1 Will be in one of t...

Page 5: ...esignation Description 1 Battery socket 2 SIM card holder 3 SMA connection for GSM antenna 4 LED1 Yellow green status LED for GSM GPRS communication 5 LED2 Red green status LED for internal communication between the CIU 250 and MP 204 6 SW1 Reset button Keep the button pressed for 5 seconds to return to default settings Note Before installation make sure that the power supply has been switched off...

Page 6: ...or by the battery The LED1 is flashing yellow searching for GSM network When the connection to the GSM network has been established the LED1 will pulsate yellow GSM network active See fig 6 The LED2 must be constantly green indicating that the CIM 250 has been fitted correctly in the CIU 250 3 1 4 Configuration For software configuration of the CIU 250 which includes setting of SMS functions and S...

Page 7: ...n 1 Flashing yellow Searching for GSM network 2 Pulsating yellow single pulse Connection to the GSM network has been established 3 Constantly yellow Call up connection has been established 4 Pulsating green single pulse Data are exchanged via GPRS 5 Pulsating green double pulse Data are exchanged via the call up connection 6 Green 3 sec Sending or receiving an SMS message Status Description Off Th...

Page 8: ...ions this offset should not be changed 00003 SetModbusAddress The value is stored in the device and will remain after a power off Legal values are 1 247 Default value of this register is 0xE7 231 which should normally not be changed 00004 SoftwareDefinedBitRate Not used 00005 AutoAckControlBits Used to select the behaviour of control bit acknowledgements from the CIU 250 0 Disabled Control bits ar...

Page 9: ... Holds a transmit counter for total number of telegrams sent from the CIU 250 to the MP 204 00027 00028 GENIbusRXcountHI GENIbusRXcountLO Holds a receive counter for total number of telegrams received by the CIU 250 from the MP 204 00029 GeneralStatus Bit 0 ScadaPinCodeEnabled PIN code functionality 0 No PIN code required 1 PIN code required to perform remote control and configuration Activation o...

Page 10: ...at resets the NumberOfStartsTripCounterHI LO registers 00342 and 00343 0 No resetting 1 Resetting This control bit is triggered on rising edge only i e setting logical 0 to 1 See section 5 2 CIM configuration register block address 00005 for acknowledgement behaviour ControlRegister Bit 6 ResetRestartCounter Control bit that resets the AutoRestartsTripCounterHI LO registers 00344 and 00345 0 No re...

Page 11: ...r 00101 bit 2 3 Protection stop 00203 SystemMode Indicates the actual system mode 0 Power up 1 Operating normal condition 2 MP 204 fault 00204 AlarmCode The Grundfos specific alarm code See section 10 Grundfos alarm and warning codes 00205 WarningBits1 Bit interpreted warnings Bit 0 Maximum voltage Bit 1 Minimum voltage Bit 2 Maximum line current Bit 3 Minimum line current Bit 4 Line current asymm...

Page 12: ...ement 1 Control bit acknowledged This functionality is only used when AutoAckControlBits is disabled See section 5 2 CIM configuration register block address 00005 AcknowledgeRegister Bit 7 ResetLogsAck Indicates if a ResetLogs control bit was acknowledged by the device 0 No acknowledgement 1 Control bit acknowledged This functionality is only used when AutoAckControlBits is disabled See section 5...

Page 13: ...3 VoltageAngleL1L3 1 degree 00324 CosPhiL1 0 01 00325 CosPhiL2 0 01 00326 CosPhiL3 0 01 00327 CosPhi 0 01 00328 00329 PowerHI PowerLO 1 W 00330 00331 EnergyHI EnergyLO 1 kWh 00332 00333 EnergyTripCounterHI EnergyTripCounterLO 1 kWh Reset with ControlRegister register 00101 bit 9 00334 00335 OperationTimeHI OperationTimeLO 1 hour 00336 00337 TotalPoweredTimeHI TotalPoweredTimeLO 1 hour 00338 00339 ...

Page 14: ...setAlarm control bit register 00101 bit 0 or by pressing the R button on the MP 204 Bit interpretation like WarningBits1 register 00205 and WarningBits2 register 00206 00702 SimulationWarningBits2 00703 SimulationAlarmBits1 00704 SimulationAlarmBits2 Address Register name Scale Description 00751 00800 UserRegisters unscaled This area is for device labelling by the user SCADA system The CIU 250 wil...

Page 15: ...ster 00011 has been written Writing the correct PIN code value will trigger the write access control and write access will be open which can be verified with GeneralStatus register 00029 bit 1 1 For call up connections with PIN code protection the ScadaPinCode register has to be written each time a new call up is made 6 3 GSM call up options setup To prepare the CIU 250 for Modbus communication wi...

Page 16: ...s Solutions based on a VPN Virtual Private Network involve the use of special routers e g GRE routers Generic Routing Encapsulation which you will also get from the service provider 7 3 Installation To prepare the CIU 250 for GPRS communication some settings have to be made via SMS commands Select Access Point Name APN ascii string This is always mandatory Select Username USERNAME ascii string The...

Page 17: ... from the client in the form of a Modbus TCP telegram embedded in a TCP IP frame and directed to TCP port 502 To the client software the connection to the CIU 250 is completely transparent The protection against unauthorised data access is high The access to the GPRS network from the internet can only take place via the VPN tunnel See fig 10 Moreover data transfer requires a Modbus master client k...

Page 18: ...129 1510 PC Tool etc SCADA system Clients LAN GRE router GRE router VPN tunnel Internet GSM operator GSM GPRS network Base station APN CIU 250 with CIM 250 module and SIM card Mobile phone Static IP address Setup status and control commands via SMS ...

Page 19: ...204 Contact the nearest Grundfos company 4 The LED for GSM GPRS communication LED1 is flashing yellow See signal 1 in fig 6 on page 7 a The SIM card has not been inserted Insert the SIM card See section 3 1 2 Inserting the SIM card b The SIM card has not been inserted correctly Insert the SIM card See section 3 1 2 Inserting the SIM card c The SIM card PIN code is not correct Enter the correct PIN...

Page 20: ...2 Invalid data address a The master is trying to read or write an invalid data address If a master tries to read register addresses that are not listed in the tables the slave will respond with this exception response Some masters may automatically try to read large blocks in one telegram which will cause problems if some of the registers in the block are not supported An example would be reading ...

Page 21: ...version MP 204 control register block 00101 ControlRegister bits W Register for control bits See section 5 4 MP 204 control register block MP 204 status register block 00201 StatusRegister bits R Actual modes See section 5 5 MP 204 status register block 00202 OperationMode enum R Actual MP 204 operating mode See section 5 5 MP 204 status register block 00203 SystemMode enum R Actual MP 204 system ...

Page 22: ...e R Voltage angle between L1 L2 00323 VoltageAngleL1L3 1 degree R Voltage angle between L1 L3 00324 CosPhiL1 0 01 R Current phase angle cosine for L1 00325 CosPhiL2 0 01 R Current phase angle cosine for L2 00326 CosPhiL3 0 01 R Current phase angle cosine for L3 00327 CosPhi 0 01 R Power factor 00328 00329 PowerHI PowerLO 1 W R Power consumption 00330 00331 EnergyHI EnergyLO 1 W R Energy consumptio...

Page 23: ...e R button on the MP 204 Bit interpretation like WarningBits1 register 00205 and WarningBits2 register 00206 00702 SimulationWarningBits2 bits R W 00703 SimulationAlarmBits1 bits R W 00704 SimulationAlarmBits2 bits R W User register block 00751 00800 UserRegisters unscaled R W This area is for device labelling by the user SCADA system The CIU 250 will not modify this area by itself The user regist...

Page 24: ...nsor 16 Other 55 Motor current protection activated MCP 93 Signal fault sensor 2 17 Performance requirement cannot be met 56 Underload 94 Limit exceeded sensor 1 18 Commanded alarm standby trip 57 Dry running 95 Limit exceeded sensor 2 19 Diaphragm break dosing pump 58 Low flow 96 Setpoint signal outside range 20 Insulation resistance low 59 No flow 97 Signal fault setpoint input 21 Too many start...

Page 25: ...ault 197 Operation with reduced pressure 229 Not used 159 CIM fault Communication Interface Module 198 Operation with increased power consumption 230 Network alarm 160 GSM modem SIM card fault 199 Process out of range monitoring estimation calculation control 231 Ethernet No IP address from DHCP server 168 Signal fault pressure sensor 200 Application alarm 232 Ethernet Auto disabled due to misuse ...

Page 26: ...s with the slave address occupying one byte The function code comes next See section 4 Modbus function code overview for supported function codes Then comes a variable size data field For each telegram a CRC is calculated and appended to the telegram two bytes total All bytes in the telegram except for the CRC itself are included in the check Slave address Function code Data CRC 1 byte 1 byte 0 to...

Page 27: ...f request from master to slave In the request the slave with address 1 is asked to deliver three contiguous registers starting from address 0x1010 4112 meaning register 4113 Example of response from slave to master In the response the byte count is six since there are three registers of two bytes All three registers hold the value of 0x2222 11 4 Write single register 0x06 This function is used for...

Page 28: ...hoed in the response The response must be identical to the request so this function is often used to verify Modbus communication 0x01 Restart communications All communication counters are cleared and the device is restarted 0x02 Return diagnostics register Returns the 16 bit diagnostics register See section 11 7 Diagnostics register interpretation 0x04 Force Listen Only Forces the device into list...

Page 29: ...scription 0 Internal communication failure with the Grundfos CIU 250 1 EEPROM self test failed the test is carried out when the system is booted 2 Grundfos CIU 250 not supported 3 Modbus address offset is different from default value i e it differs from 0 4 Using software defined Modbus transmission speed 5 RESERVED 6 RESERVED 7 RESERVED 8 RESERVED 9 RESERVED 10 RESERVED 11 RESERVED 12 RESERVED 13...

Page 30: ...ers numbered X are addressed in telegrams as X 1 e g register 00104 setpoint is addressed as 00103 in a Modbus telegram Field Value Description Slave address 0x01 Function code 0x08 Diagnostics Subcode 0x00 Echo request Data 0xAB Test data Data 0xCD Test data Field Value Description Slave address 0x01 Function code 0x08 Diagnostics Subcode 0x00 Echo request Data 0xAB Test data Data 0xCD Test data ...

Page 31: ...rea Ltd 6th Floor Aju Building 679 5 Yeoksam dong Kangnam ku 135 916 Seoul Korea Phone 82 2 5317 600 Telefax 82 2 5633 725 Latvia SIA GRUNDFOS Pumps Latvia Deglava biznesa centrs Augusta Deglava ielā 60 LV 1035 Rīga Tālr 371 714 9640 7 149 641 Fakss 371 914 9646 Lithuania GRUNDFOS Pumps UAB Smolensko g 6 LT 03201 Vilnius Tel 370 52 395 430 Fax 370 52 395 431 Malaysia GRUNDFOS Pumps Sdn Bhd 7 Jalan...

Page 32: ...inking ahead makes it possible Innovation is the essence The name Grundfos the Grundfos logo and the payoff Be Think Innovate are registrated trademarks owned by Grundfos Management A S or Grundfos A S Denmark All rights reserved worldwide 97693501 0710 GB ...

Reviews: