Communication Modules MAG 8000 Modbus RTU System integration Function codes Operating Instructions Technical data Sensor dimension dependent default settings Modbus coil registers Modbus holding registers Appendix Add-on module for use with flowmeter types SITRANS F M MAG 8000 04/2016 A5E03409989-AB...
Page 4
Note the following: WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems.
Table of contents Introduction ............................. 5 Revision history ......................... 5 Modbus RTU technology ......................6 Further Information ........................8 Safety notes ............................9 Installation in hazardous area ....................9 Hardware Installation ..........................11 Connecting ............................13 Wiring ............................13 Closing the device ........................15 System integration ..........................
Page 6
Table of contents Modbus holding registers ........................43 Introduction to holding registers ..................... 43 MODBUS application settings ....................44 MODBUS driver settings ......................45 Menu control .......................... 46 Sensor characteristics ......................47 Totalization ..........................49 Pulse output ........................... 50 Service control ........................51 Error messages ........................
See also For more information about SITRANS F M transmitters and sensors, please refer to the appropriate Operating Instructions available on the flowdocumentation homepage (http://www.siemens.com/flowdocumentation) or on the SITRANS F literature CD-ROM.
Features The SITRANS F Modbus RTU Communication modules comply with the Modbus Serial Line Protocol. Among other things this implies a Master-Slave protocol at level 2 of the OSI model. A node (the master) issues explicit commands to one of the slave nodes and processes responses.
Page 9
Introduction 1.2 Modbus RTU technology Communication modes Two modes of communication are possible, Unicast and Broadcast. ● In unicast mode the Master sends a request to a specific Slave device, and waits a specified time for a response. Image 1-1 Unicast Mode ●...
Product information on the Internet The Operating Instructions are available on the CD-ROM shipped with the device, and on the Internet on the Siemens homepage, where further information on the range of SITRANS F flowmeters may also be found: Product information on the internet (http://www.siemens.com/flow)
Safety notes CAUTION Correct, reliable operation of the product requires proper transport, storage, positioning and assembly as well as careful operation and maintenance. Only qualified personnel should install or operate this instrument. Note Alterations to the product, including opening or improper repairs of the product, are not permitted.
Page 12
Safety notes 2.1 Installation in hazardous area MAG 8000 Modbus RTU Operating Instructions, 04/2016, A5E03409989-AB...
Hardware Installation The installation procedure for an add-on module to a MAG 8000 transmitter is as follows: 1. Loosen screws on transmitter top. 2. Remove transmitter top using a screwdriver. 3. Dispose of silica gel bag. 4. Mount the modules on the backside of the MAG 8000 electronics. Image 3-1 Hardware installation 5.
Connecting Note Shielding Always shield a Modbus over Serial Line Cable. At one end of each cable its shield must be connected to protective ground. If a connector is used at this end, the shell of the connector is connected to the shield of the cable. Note Cable specifications A RS 485-Modbus must use a balanced pair (for D0-D1) and a third wire (for the Common).
Page 16
Connecting 4.1 Wiring RS 232 connection diagram ① Common ② Connect shield to enclosure ③ Shield connected to protective ground ① Common RS 485 connection diagram ① Common ② Connect shield to enclosure ③ Shield connected to protective ground MAG 8000 Modbus RTU Operating Instructions, 04/2016, A5E03409989-AB...
Connecting 4.2 Closing the device ① Common ② Termination Bus termination All RS 485-based networks must be terminated correctly to function properly. A termination must be placed at each end of segment. The Modbus RTU module can add a 120 ohm termination if a jumper is placed beside terminals in position "ON".
System integration System integration instructions This chapter provides information on how to integrate the flowmeter in a Modbus RTU automation and control system. The chapter shows the necessary steps in order to put the system into operation. After finishing the steps, the system is ready to go into normal operation in the Modbus RTU automation control system.
System integration 5.3 Communication parameter settings Communication parameter settings Effect of changing baudrate or framing Changing baudrate or framing has effect on the communication as follows: When changed from the Modbus master, the new settings only have effect after a reset (PowerUp) of the device–...
System integration 5.5 Commissioning with PDM To successfully change a parameter, use the following routine: 1. Write the password to parameter "Meter Access Code" at address 2007. Default password is "1000" 2. Change the parameter. When the correct password has been entered, the flowmeter remains "unlocked" for 10 minutes after last communication.
Install EDD files Install the PDM device driver as follows: 1. Close SIMATIC PDM (if already open). 2. Open Device Integration Manager from [Start → All Programs → Siemens Automation → SIMATIC → SIMATIC PDM]. MAG 8000 Modbus RTU Operating Instructions, 04/2016, A5E03409989-AB...
Page 23
5. Browse to the folder where the source files are located and click on the folder. 6. The device will show up in a tree view. Mark the device to be installed and click on install the driver on the PC. See also MAG 8000 Downloads (http://support.automation.siemens.com/WW/view/en/19701862/133100) MAG 8000 Modbus RTU Operating Instructions, 04/2016, A5E03409989-AB...
Your PC is now added to the Modbus Net, e.g. NOG0482D – Right click on "Modbus Net" and select "Insert New Object"->"Modbus Device". – Click on "Assign" and assign the Modbus device to MAG8000 Advanced or Basic (Sensors->Flow->Electromagnetic->SIEMENS AG->MAG8000) and click "ok". Image 5-1 Assigning Modbus device to network –...
System integration 5.5 Commissioning with PDM 5.5.5 Configuring the device Read all parameters Before any parameterization is done it is necessary to read all parameters from the device into the offline table of SIMATIC PDM. The offline table merely contains default data. 1.
System integration 5.5 Commissioning with PDM 5.5.6 Operation The system is now ready for normal operation. 1. Select "View->Display" to see all process values. 2. Verify that the process values show the expected values. Image 5-3 View all process values MAG 8000 Modbus RTU Operating Instructions, 04/2016, A5E03409989-AB...
Broadcast communication is not secured by the normal check mechanisms and shall be limited to very few uses. A SITRANS F Modbus slave only recognizes (and accepts) few Modbus RTU commands/function codes.
Function codes 6.2 Read coils Read coils Command messages The read coils functions (01 hex) allow the master to request information from the slave. The command message of a coil read is structured as shown below. Each row in the table compares to a byte in the message –...
Page 29
Function codes 6.2 Read coils The Bit count is the number of status bits returned in the response message. The number equals the quantity in the command message. The data section of the response message contains a number of bits representing the status of the coils(s) that has been read from the device.
Function codes 6.3 Read multiple registers Read multiple registers Command messages The multiple register read functions (03 hex) allows the master to request information from the slave. The command message of a multiple register read is structured as shown below. Each row in the table compares to byte in the message –...
Page 31
Function codes 6.3 Read multiple registers Normal response The normal response message contains the same slave address and function code as the command message. The Byte count is the number of data bytes returned in the response message. The number is actually the quantity (in the command message) times 2, since there are two bytes of data in each register.
Function codes 6.4 Write single coil Example Read actual velocity (4:03001) ● Query: 1,3,11,184,0,2,70,10 (Hex 01,03,0B,B8,00,02,46,0A) ● Normal response: 1,3,4,64,195,82,139,98,200 (Hex 01,03,04,40,C3,52,8B,62,C8) ● Actual velocity = 6.10383 mm/s. Write single coil Command messages The write coil functions (05 hex) allow the master to control single bits in the slave. The command message of a coil write is structured as shown below.
Page 33
Function codes 6.4 Write single coil The new coil value is the value written to the coil. Table 6- 9 Write coil normal response messages Message byte Example Slave address xx hex Function code 05 hex Coil address Upper xx hex Lower xx hex New coil value...
Function codes 6.5 Write multiple registers Write multiple registers Command messages The multiple register write functions (10 hex) allow the master to write data to the slaves registers. The command message of a multiple register write is structured as shown below. The initial slave address is 1.
Page 35
Function codes 6.5 Write multiple registers The starting register is the first register that was written to. The quantity value indicates how many consecutive registers were written to. Table 6- 12 Write multiple coil normal response messages Message byte Example Slave address xx hex Function code...
Null terminator included Capability bits Bits describing the capabilities of this module. 3 bytes 1.2, 2.4, 4.8, 9.6, 19.2, 38.4 kB/s Manufacturer name "Siemens" (Read from EEPROM) Null termina- 12 bytes tor included Product name "MAG 8000" 12 bytes Null terminator included...
Function codes 6.7 Exception handling Exception handling There is a defined set of exception codes to be returned by slaves in the event of problems. All exceptions are signalled in the response from the slave by adding 80 hex to the function code of the request and following this byte by an exception code.
Technical data Table 7- 1 Technical data Device type Slave Baud rates 1200, 2400, 4800, 9600, 19200, 38400 bits/sec Number of stations Recommended: max. 31 per segment without repeaters Device address range 1-247 Protocol RTU (Other Modbus protocols like ASCII, Plus or TCP/IP are not supported.) Electrical interface RS 485, 3-wire...
Modbus coil registers Modbus register Parameter Description Access level MODBUS driver settings Reset communication driver Warning! Check settings before reset and Read Only accept new communications settings - other- wise communication will be interrupted! 0 = No • 1 = Yes •...
Page 44
Modbus coil registers Modbus register Parameter Description Access level Reset statistic information Access code 0 = No • 1 = Yes • Consumption profile Reset consumption profile Reset the consumption profile information Access code 0 = No • 1 = Yes •...
Modbus holding registers Introduction to holding registers In the following the holding registers for the MAG 8000 Modbus RTU module are described. Image A-1 Modbus Holding Registers Memory Map ● The minimum value of a writable "holding register" value can be read by adding 10000 to the address of the value.
Modbus holding registers A.2 MODBUS application settings MODBUS application settings Table A- 1 Customer profile Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:2009 string / 6 Meter access code Password to change parameters 1000 [-] Write in the water meter...
Modbus holding registers A.4 Menu control Menu control Table A- 5 Menu control Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0235 uint8 / 1 Menu active 1 byte describing which menus Basic version: Read Only are enabled...
Modbus holding registers A.5 Sensor characteristics Sensor characteristics Table A- 6 Sensor characteristics Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0207 float32 / 4 Flow unit factor Flow unit correction factor from Sensor specific Read / Write /s to other flow unit...
Page 50
Modbus holding registers A.5 Sensor characteristics Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0248 uint8 / 1 Excitation frequency Maximum possible sensor exci- Sensor size Read Only sensor limit tation frequency. specific [-] 0 = 1/15 Hz •...
Modbus holding registers A.7 Pulse output Modbus Data type / Parameter Description Default value Access level register [unit] / Value Size [bytes] range 4:0402 uint8 / 1 Flow direction totalizer Calculation principle on flow Reverse [-] Read / Write direction for forward - reverse or net flow 0 = Forward •...
Modbus holding registers A.8 Service control Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0380 uint8 / 1 Pulse B function Configuration of output B as Alarm [-] Read / Write pulse - alarm or call up function 0 = Pulse •...
Modbus holding registers A.9 Error messages Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0367 uint16 / 2 Numbers of power up Total number of power up since 0 [-] Read Only first time power up.
Page 55
Modbus holding registers A.9 Error messages Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0306 uint8 / 1 Low power fault Total number of faults - [-] Read Only counter 4:0307 date / 6 Low power fault ap- First time the fault appeared...
Page 56
Modbus holding registers A.9 Error messages Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0355 date / 6 Empty pipe fault ap- First time the fault appeared - [-] Read Only pears 4:0358 date / 6...
Page 57
Modbus holding registers A.9 Error messages Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0361 uint16 / 2 Alarm configuration 2 bytes describing which er- - [-] Read Only list rors/warning should generate an alarm or call up on output B Bit 1: Insulation error •...
Modbus holding registers A.10 Power control Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:3017 uint16 / 2 Fault status 2 bytes describing which er- - [-] Read Only rors/warnings are active Bit 1: Insulation error •...
Page 59
Modbus holding registers A.10 Power control Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0369 uint8 / 1 Battery power Number of installed batteries Read Only (Internal battery pack has 2 batteries and external battery pack has 4 batteries) 4:3015...
Modbus holding registers A.12 Consumption profile Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0167 float32 / 4 Latest month con- Latest month consumption 0 [-] Read Only sumption (based on totalizer 1 from the first in the month) 4:0428 date / 6...
Modbus holding registers A.13 Leakage statistic Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0446 float32 / 4 Total time in CP Total hours of flow rate in the - [h] Read Only range 6 last flow range 6 (from previous...
Page 63
Modbus holding registers A.13 Leakage statistic Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0457 uint8 / 1 Duration leakage Leakage detection duration in 10 - [min*10] Read / Write detection minutes resolution 4:0458 uint8 / 1...
Modbus holding registers A.14 Datalog A.14 Datalog Table A- 15 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0472 uint8 / 1 Log interval Log interval Monthly [-] Read / Write 0 = Daily •...
Page 65
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0484 uint16 / 2 Latest Log period Two bytes describing fault status - [-] Read Only fault status in log period Bit 1: Insulation error •...
Page 66
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0491 float32 / 4 Log period 2 totalized Previous logged value of con- - [-] Read Only sumption based on totalizer 2 4:0493 uint16 / 2 Log period 2 fault...
Page 67
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0498 float32 / 4 Log period 3 totalized Log period 3 logged value of - [-] Read Only consumption based on totalizer 1 4:0500 float32 / 4...
Page 68
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0559 uint8 / 1 Log period 7 status See log period 2 - [-] Read Only information 4:0560 date / 6 Date of log period 8 Date where value for log 8 is...
Page 69
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0601 float32 / 4 Log period 12 totalized Log period 12 logged value of - [-] Read Only consumption based on totalizer 2 4:0603 uint16 / 2...
Page 70
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0679 date / 6 Date of log period 17 Date where value for log 17 is - [-] Read Only stored 4:0682...
Page 71
Modbus holding registers A.14 Datalog Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0722 uint16 / 2 Log period 21 fault See log period 2 - [-] Read Only status 4:0723 uint8 / 1 Log period 21 status See log period 2...
Modbus holding registers A.15 Consumption readings Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0763 float32 / 4 Log period 26 totalized Log period 26 logged value of - [-] Read Only consumption based on totalizer 1 4:0765 float32/ 4...
Page 73
Modbus holding registers A.15 Consumption readings Modbus Data type / Parameter Description Default value Access level register [unit] / Size [bytes] Value range 4:0156 date / 6 Previous settling date Previous settling date where Production date Read Only value of totalizer 1 was stored (YYMMDDHHM MSS) [-] 4:0159...
Appendix Data type mapping Some standard data types are defined in the MAG 8000 protocol. Most of these data types are not present in the Modbus RTU protocol as it defines ‘Registers’ and ‘Coils’ for all variables. A register in this context is always 16 bit long. Table B- 1 Data type mapping Datatype...
Modbus RTU implementation TotalType Data type defined by Siemens mainly used for Totalizer values. TotalType consist of two parts: 1. signed long Number - contains the integer part of Value 2. signed long Decimal – contains the fractional part of the Value multiplied with 1.0E9 The parameters are read using function code 03 hex ‘Read multiple registers’.
Page 77
Appendix B.2 CRC calculation Placing the CRC into the Message When the 16–bit CRC (two 8–bit bytes) is transmitted in the message, the low-order byte will be transmitted first, followed by the high-order byte. For example, if the CRC value is 1241 hex (0001 0010 0100 0001): Addr Func Data count...