Industrial Modbus RTU Modem

Industrial Wireless RS485 ModBus RTU Modem User Guide

ModBus protocol is one of the most robust and widely used industrial communication protocols. Most all industrial computer, PLC, and SCADA systems supports this protocol. These systems are responsible for controlling and making decisions on a factory floor. Using the ncd.io Industrial Wireless RS485 ModBus RTU Modem, the factory floor systems like PLC and SCADA can read sensor data and make quick intelligent decisions. 

 

How It Works

This Wireless ModBus RTU Modem is an extremely simple device. When a sensor transmits data, this modem captures the data and stores it in register locations. The master device can read the sensor data by querying the register locations just like any other Modbus slave device. 

This modem can also be used to configure the wireless sensors as well. 

Hardware M12 Connection–

Cable Connection

Gray — Power +ve

Black — Gnd (Power -ve)

Brown — A

Blue — B

M12 Connector Connection 

1 — A

2 — Power +ve

3 — B

4 — Gnd (Power -ve)

Default Modbus Settings 

Baudrate — 9600

Stop Bits — 1

Parity — None

How To Read Wireless Sensor Data

When a sensor sends data its stored in register location 0-100. In order to retrieve sensor data, the master device will need to query these locations. This modem formats the data. What does that mean? Let’s say the sensor data packet was 20 bytes and the ModBus master sends a command to read 30 locations. In that case, the slave device will only return 20 bytes not 30 locations ( 60 bytes) as user requested.

The reason behind that is — This ModBus slave modem will be talking to multiple sensors and these sensor case can same type or different types. The length of the data will depend on sensor type.  If you are not sure what kind of sensor you have, what’s the data packet length you can always read 50 register location and the modem will return correct packet.

 

Function Code — 0x03 ( Read Holding Register)

Register Locations — 0 to 100

In my test setup i have a USB-RS485 connected to the PC. Using this setup i can request data from the ModBus slave device. 

 

In order to read available data from the ModBus slave, send this command:

01 03 00 00 00 32 C4 1F

In the above command

01 — Slave Address

03 — Function Code

00 00 — Data Address of the First Register 

00 32 — Total Number of Registers requested

C4 1F — CRC

If there is any data available the slave device will respond with something like this:

01 03 21 7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD F2 F6

01 — Slave Address

03 — Function Code

21 — Number of data bytes to follow

Sensor Data — (7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD)

F2 F6 — CRC

The Sensor data is the data sent by the remote device. It includes the information like Remote Sensor MAC address, Node ID, Battery Level, Sensor Type, Transmission Counter, Sensor Payload. This sensor data message will contain sensor specific data. If you would like to know more about sensor specific data, checkout this sensor’s Product Manual.

Overview Of Sensor Data

In the Sensor Data Packet there are a few things that will maintain the same register location. The only thing that will change is value.

7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD

7E — Sensor API Header ( Always Same)

00 1D — Length Of the API Packet ( It will depend on sensor actual payload)

90 — Reserved 

00 13 A2 00 41 A2 70 EA  — Sensor Mac Address ( These registers will always contain the remote sensor MAC address)

FF FE C2 — Reserved 

7F — Sensor Payload Header

00 — Sensor Node ID

00 — Sensor Firmware Type

03 FF — Battery Level

A6– Wireless Transmission Counter

00 2C — Sensor Type

00 — Reserved 

00 00 04 DE 1B 81 06 1A —  Sensor Payload 

CD — Sensor API packet Checksum

Using PC  

REG 200 can be used check if the slave Device has a new Packet from any of the wireless devices. 

REG 200

R-Only

Check if there is new Sensor packet

(MSB : 0 means No new packet, 1 means New packet received)
(LSB : Reserved)

 

How To Configure RS485 Modem Slave Settings

The Slave Modem has few settings which can be changed by users:

  1. Encryption Key — REG 101 to REG 108 Function Code 10
  2. Enable/Disable Encryption — REG 109 Function Code 06 (MSB : 0 means Disable, 1 means Enable) (LSB : Reserved)
  3. Baud rate — REG 110 (MSB : 0 means 9600 , 1 means 19200)(LSB : Reserved)
  4. PAN ID — REG 111 PAN ID (16-bit) Big-endian
  5. Factory Reset — REG 112
  6. Slave Address — REG 130 
  7. Destination Address — REG350-REG357 — If master sends a packet which need to go to remote node. in that this address needs to be set as the remote node address and once Slave gets a packet from master it will send to this address. The default value is 00000000 0000FFFF ( Broadcast address) it means it will send to all nodes

How To Send Message To Remote Nodes

This Modem can be used to talk to end node devices as well to configure remote sensors

When data is written to REG300-REG350 it will be send out to remote devices. In order to make sure it gets to correct remote node, do following things before sending messages

In case of end node ( when this modem is used to communicate with end node devices)

  1. Set the slave destination address (REG 350-REG357) to end node mac address
  2. Write data to REG300-REG350 which you would like to send to remote device
  3. Once the end node gets the command, it will check if its a valid command if it is it will respond accordingly and this response can be read from REG0 – REG100

In case of sensor configuring

  1. Set the Slave PAN ID to 0x7BCD ( REG 111)
  2. Set the slave destination address( REG 350-REG357) to sensor mac address
  3. Write data to REG300-REG350 which you would like to send to remote device
  4. Once the Sensor gets the command, it will check if its a valid command if it is it will respond accordingly and this response can be read from REG0 – REG100

Note : While writing the data packet, only send the actual payload. The slave device will generate the complete Wireless API packet and send it over wirelessly.