MODBUS

The probe can be addressed directly using the MODBUS protocol, to request the measured humidity and temperature values. The parameters highlighted in yellow should be selected according to the table below.

Important: In order to communicate directly with the digital probe via MODBUS, please use the E2-05XX-MOD cable. The digital MODBUS protocol is delivered over RS485.

Command: (MSB first)

Probe address	Command ID		Start address		Number of records	MODBUS CRC
0x00	0x04	0x00	0x00	0x00	0x00	0x0000

Probe address

0…255, if '0' then all probes respond regardless of the address.The default probe address is 247.

Device specific input registers: MODBUS address = register -1.

Device data

30'001	Serial number	Serial number of the device (part 1)	Int. 32-bit
30'002	Serial number of the device (part 2)
30'003	Vendor Name	Rotronic (ASCI)	Char
30'004
30'005
30'006
30'007	Product Type	TCD-S	Char
30'008
30'009
30'010

Current Values

Current values in 32-bit IEEE754 float format.

**Note! ** These values are changing every measurement cycle, so always read the two corresponding registers in one Modbus command.

31'001	Temperature	Current temperature values (part 1) (attention to register byte order)	Float 32-bit
31'002	Current temperature values (part 2) (attention to register byte order)
31'003	Measurement Flags Temperature	Current measurement flags temperature	Integer 16-bit

Read Current Float Value (Registers 31'001 to 31'008)

Example:

Transmit	01 04 79 18 00 02 e8 90
Receive	01 04 04 0B F8 9B 41 D3 51

Field	Bytes	Value	Description
Transmit
RTU number	1	0x01	Modbus RTU Address
Function code	1	0x04	Read Discret Inputs
Starting address	2	0x7918	= 31'000 ( Attention! register number – 1 )
Quantity of input registers	2	0x0002	= 2, means read 2 registers
Checksum	2	0x90E8	CRC Checksum
Receive
RTU number	1	0x01	Modbus RTU Address
Function code	1	0x04	Read Discret Inputs
Byte count	1	0x04	= 16 x 2 * N, means numbers of returned bytes
Input registers	2 * N	0x419BF80	= 19.50 °C Temperature
Checksum	2	0x51D3	CRC Checksum

Device Specific holding Registers

Via the Modbus Holding Registers you can read and write device specific data of the TCD probe.

Assisted Modbus commands are Read Holding Registers (0x03), Write Single Register (0x06)

Function 03/06 – Read/Write Single register

40'001	Device Address	Device address (default 0x00F7)	Integer 16-bit
40'002	Byte Order	Defines byte order for floating point number output	Integer 16-bit

Read Modbus Address (Registers 40'001)

Example:

Note: the device answers to address 0. This can be used to get the current device address

Transmit	00 03 9c 40 00 01 aa 5f
Receive	01 03 02 00 01 79 84

Field	Bytes	Value	Description
Transmit
RTU number	1	0x00	Modbus RTU Address
Function code	1	0x03	Read Holding Register
Starting address	2	0x9c40	= 40001 ( Attention! register number – 1 )
Quantity of Holding registers	2	0x0001	= 1, means read 1 register
Checksum	2	0x5FAA	CRC Checksum
Receive
Byte count	1	0x02	= 2 x 2 * N, means numbers of returned bytes
Holding register	N	0x0001	= 1, current address
Checksum	2	0X8479	CRC Checksum

Write Modbus Adress (Registers 40'0001)

Example:

Note: The device answers with the current Modbus RTU Address, afterwards the address is changed.

Receive	F7 06 9C 40 00 01 73 18

Field	Bytes	Value	Description
Transmit/Receive
RTU number	1	0xF7	Modbus RTU Address
Function code	1	0x06	Read Holding Register
Starting address	2	0x9C40	= 40001 ( Attention! register number – 1 )
Value	2	0x0001	= 1, new Modbus address
Checksum	2	0x1873	CRC Checksum

Byte Order / Swap modes

Selectable Swap Modes for Rotronic Devices

Selectable swap modes only for 32-bit Float and 32-bit Integer values based on Little Endian memory organisation.

Value	Swap Mode	Source Bytes	Target Bytes
0x0000	Little endian - No Swap	[ a b ] [ c d ]	[ a b c d ]
0x0001	Big endian - byte and word swap	[ a b ] [ c d ]	[ d c b a ]
0x0002	Mid-little endian - byte swap	[ a b ] [ c d ]	[ b a d c ]
0x0003	Mid-big endian - word swap	[ a b ] [ c d ]	[ c d a b ]

Read Swap mode (Registers 40'001)

Example:

Transmit	01 03 9c 41 00 01 fa 4e
Receive	01 03 02 00 02 39 85

Field	Bytes	Value	Description
Transmit
RTU number	1	0x01	Modbus RTU Address
Function code	1	0x03	Read Holding Register
Starting address	2	0x9c41	= 40002 ( Attention! register number – 1 )
Quantity of Holding registers	2	0x0001	= 1, means read 1 register
Checksum	2	0x4EFA	CRC Checksum
Receive
Byte count	1	0x02	= 2 x 2 * N, means numbers of returned bytes
Holding register	N	0x0002	= 2, Mid-little endian - byte swap
Checksum	2	0x8539	CRC Checksum

Example:

Set Swap Mode “Mid-big endian - byte swap”

Transmit	01 06 9c 41 00 02 76 4f
Receive	01 06 9c 41 00 02 76 4f

Field	Bytes	Value	Description
Transmit / Receive
RTU number	1	0x01	Modbus RTU Address
Function code	1	0x06	Write Holding Register
Starting address	2	0x9c41	= 40002 ( Attention! register number – 1 )
Value	2	0x0002	= 2, Mid-little endian - byte swap
Checksum	2	0x4F76	CRC Checksum

Response in the event of an error

0x..	0x84	0x00	0x....

0x02	Start address and number of records invalid
0x03	Number of records invalid

Sensor faults

In case of a short circuit or open circuit at the probe, a value of NAN (0x7fffffff) is output for the measured value concerned.

Additional MODBUS details can be found here: MODBUS in RMS.

For detailed information about Modbus protocol Read Discrete Inputs see: (http://modbus.org/docs/Modbus_Application_Protocol_V1_1b3.pdf).