ModBus protocol is one of the most robust and widely used industrial communication protocols. Most all industrial computer, PLC, and SCADA systems supports this protocol. These systems are responsible for controlling and making decisions on a factory floor. Using the ncd.io Industrial Wireless RS485 ModBus RTU Modem, the factory floor systems like PLC and SCADA can read sensor data and make quick intelligent decisions.
This Wireless ModBus RTU Modem is an extremely simple device. When a sensor transmits data, this modem captures the data and stores it in register locations. The master device can read the sensor data by querying the register locations just like any other Modbus slave device.
This modem can also be used to configure the wireless sensors as well.
Hardware M12 Connection–
Gray — Power +ve
Black — Gnd (Power -ve)
Brown — A
Blue — B
M12 Connector Connection
1 — A
2 — Power +ve
3 — B
4 — Gnd (Power -ve)
Default Modbus Settings
Baudrate — 9600
Stop Bits — 1
Parity — None
When a sensor sends data its stored in register location 0-100. In order to retrieve sensor data, the master device will need to query these locations. This modem formats the data. What does that mean? Let’s say the sensor data packet was 20 bytes and the ModBus master sends a command to read 30 locations. In that case, the slave device will only return 20 bytes not 30 locations ( 60 bytes) as user requested.
The reason behind that is — This ModBus slave modem will be talking to multiple sensors and these sensor case can same type or different types. The length of the data will depend on sensor type. If you are not sure what kind of sensor you have, what’s the data packet length you can always read 50 register location and the modem will return correct packet.
Function Code — 0x03 ( Read Holding Register)
Register Locations — 0 to 100
In my test setup i have a USB-RS485 connected to the PC. Using this setup i can request data from the ModBus slave device.
In order to read available data from the ModBus slave, send this command:
01 03 00 00 00 32 C4 1F
In the above command
01 — Slave Address
03 — Function Code
00 00 — Data Address of the First Register
00 32 — Total Number of Registers requested
C4 1F — CRC
If there is any data available the slave device will respond with something like this:
01 03 21 7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD F2 F6
01 — Slave Address
03 — Function Code
21 — Number of data bytes to follow
Sensor Data — (7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD)
F2 F6 — CRC
The Sensor data is the data sent by the remote device. It includes the information like Remote Sensor MAC address, Node ID, Battery Level, Sensor Type, Transmission Counter, Sensor Payload. This sensor data message will contain sensor specific data. If you would like to know more about sensor specific data, checkout this sensor’s Product Manual.
Overview Of Sensor Data
In the Sensor Data Packet there are a few things that will maintain the same register location. The only thing that will change is value.
7E 00 1D 90 00 13 A2 00 41 A2 70 EA FF FE C2 7F 00 00 03 FF A6 00 2C 00 00 00 04 DE 1B 81 06 1A CD
7E — Sensor API Header ( Always Same)
00 1D — Length Of the API Packet ( It will depend on sensor actual payload)
90 — Reserved
00 13 A2 00 41 A2 70 EA — Sensor Mac Address ( These registers will always contain the remote sensor MAC address)
FF FE C2 — Reserved
7F — Sensor Payload Header
00 — Sensor Node ID
00 — Sensor Firmware Type
03 FF — Battery Level
A6– Wireless Transmission Counter
00 2C — Sensor Type
00 — Reserved
00 00 04 DE 1B 81 06 1A — Sensor Payload
CD — Sensor API packet Checksum
REG 200 can be used check if the slave Device has a new Packet from any of the wireless devices.
Check if there is new Sensor packet
(MSB : 0 means No new packet, 1 means New packet received)
The Slave Modem has few settings which can be changed by users:
This Modem can be used to talk to end node devices as well to configure remote sensors
When data is written to REG300-REG350 it will be send out to remote devices. In order to make sure it gets to correct remote node, do following things before sending messages
In case of end node ( when this modem is used to communicate with end node devices)
In case of sensor configuring
Note : While writing the data packet, only send the actual payload. The slave device will generate the complete Wireless API packet and send it over wirelessly.