Wireless Sensors
Serial MODBUS (RTU/ASCII) Gateway
For Version 3.1
User’s Guide
- 1 -
Contents
1.0 - Serial MODBUS Gateway Overview
Features
Example Network Integration
Serial MODBUS Gateway Specificat io ns
2.0 - Connecting the Serial MODBUS Gateway Hardware
2.1 - Connecting to a USB Programming Dongle
2.2 - Serial MODBUS Gate w a y Indicator Lights
3.0 - MODBUS Protocol Implementation
3.1 - Register Size
3.2 - Multi-byte Formatting
3.3 - Communication Defaults
3.4 - Communications Settings Reset Jumper
3.5 - Factory Reset
4.0 - Using the Gateway
4.0 - Gateway Coils
4.1 - Verifying that the Wireless is Active
4.2 - Resetting the Gateway
4.3 - Resetting the Wireless Network
4.4 - Resetting to Default Communications Settings
4.5 - Resetting the Gateway to Factory Settings
4.6 - Viewing and Modifying MODBUS Communications
4.7 - Setting Gateway Time
4.8 - Viewing Registered Wireless Devices
4.9 - Adding a Wireless Device to the Gateway
4.10 - Verifying Wireless Device Activity
4.11 - Viewing Wireless Device Data (Fast Read Method)
4.12 - Viewing Wireless Device Data (Advanced Method)
4.13 - Configuring Wireless Devices
4.14 - Configuration Rules to Abide By
4.15 – Wireless Device Sync Setting
5.0 - Upgrading Gateway Firmware
Reference Section
Ref.1 - Gateway Coils
Ref.2 - Wireless Device Coils
Ref.3 - Gateway Registers
Ref.4 - Wireless Device List Registers
Ref.5 - Fast Read Registers
Ref.6 - Wireless Device Registers
Error Reporting, Troubleshooting and Support
Warranty Information
Certifications (FCC and IC)
3
5
5
6
7
8
9
10
10
10
11
11
11
12
12
12
13
13
13
13
14
15
15
16
17
17
18
19
19
20
19
21
24
25
28
28
29
34
34
36
- 2 -
1.0 Serial MODBUS Gateway Overview
The BZ-TECH Serial MODBUS Gateway (SMG) acts as a data
concentrator for wireless sensor networks. This device allows
you to connect up to 50 wir ele s s sensing devices, per gateway,
to your existing serial MODBUS RS-232C and RS-485 sensing
and control infrastructures.
BZ-TECH has recognized the importance of using open
standards like MODBUS, allowing wireless sensors to be used in
the majority of industrial applications. MODBUS is often used to
connect a supervisory computer with a remote terminal unit
(RTU) in supervisory control and data acquisition (SCADA)
systems. MODBUS allows for communication between many
devices connected to the same wired network. Therefore, BZTECH SMG’s allow for seemingly unlimited wireless expansion
of a traditional wired network.
A system incorporating BZ-TECH SMG consists of the following:
•
MODBUS Master – PLC, SCADA, etc.
•
Existing RS-232C or RS-485 Infrastructure.
•
Serial MODBUS Gateway (SMG).
•
Wireless Sensors
For information about the MODBUS TCP interface,
please refer to documentation regarding the Ethernet Gateway
v3.0.
- 3 -
This device has been designed to operate with an approved antenna listed on
page 11, and having a maximum gain of 5.1 dBi. Antennas not included in this
list or having a gain greater than 5.1 dBi are strictly prohibited for use with this
device. The required antenna impedance is 50 ohms.
To reduce potential radio interference to other users, the ante nna type and its
gain should be so chosen that the equivalent isotr opi cal ly rad iat ed power (EIR P)
is not more than that required for successful
communication.
FCC Approval (USA)
- Refer To Page 34 for FCC Requirements.
IC Approval (Canada) - Refer To Page 35.
Contains FCC ID: ZTL-RFSC1 & IC: 9794A-RFSC1
This device complies with Part 15 of the FCC Rules. Operation is subject to
the following two conditions: (1) this device may not cause harmful
interference and (2) this device must accept any interference received,
including interference that may cause undesired operation.
- 4 -
Features
•
Works with 900, 868 and 433MHz Sensor Networking
Solutions
•
Communicates with MODBUS RTU / ASCII Protocols
•
Supports RS-232C / RS-485 Interfacing
•
3 LED Indicators (System, Wired and Wireless)
•
NEMA 4X / IP65 Rated Enclosure
•
RP SMA Antenna Connector (Antenna Included)
Example Network Integration
Wireless sensors integrate with existing MODBUS systems
allowing for additional environmental variables to be monitored.
- 5 -
Serial MODBUS Gateway Specifications
General
APN Interface Support
RFSC1 Module by
Frequencies: 433, 868 and 900 MHz
(Future support for WiFi and 500 mW
modules)
Antenna
Connector: RP-SMA
Gain: 3.0 dBi Standard
3 Wire Communication Interface
RS-232C
TXD (OUT), RXD (IN), and Ground /
Common
RS-485
D+, D-, and Ground / Common
Protocol Selector
Jumper for RS-232 and RS485
Power
Input Voltage Range
4.5 - 36.0 VDC
Minimum Current
Required
100mA (500mA Recommended)
Mechanical
Reset Feature
Communication / Factory Settings Reset
Jumper
Indicator Lights
Dual Color LEDs
Enclosure
Durable, Impact-Resistant UV Stabili zed
Polycarbonate (IP65 of IEC 529 and NEMA
1, 2, 4, 4x, 12 and 13 Rated)
Dimensions
179.60 x 90.68 x 41.30 mm
Weight
16 ounces
Environmental
Operating Temperature
-40 to +85 °C (-40 to +185 °F)
Storage Temperature
-40 to +85 °C (-40 to +185 °F)
- 6 -
2.0 Connecting The Serial MODBUS Gateway
Hardware
This section contains details on how to connect the Serial
MODBUS Gateway (SMG) for testing and use.
The SMG has a c ommunication select jumper. No Jumper
is RS-485, jumper on is RS-232C.
The SMG has a 5 wire connector already installed and
ready for connection. The table below shows the wire
mapping.
SMG 5-Wire Connector
Red:
4.5 – 36 VDC
Black:
Power ground
Orange:
RS-232C: TXD gateway’s transmitter data
connection. Connect the MODBUS master’s
receiver.
RS-485: D+ Non-inverting 485 transmitter/receiver.
White:
Signal ground, internally connected to power
ground.
Green:
RS-232C: RXD gateway’s receiver data connection.
Connect the MODBUS master’s transmitter.
RS-485: D- Inverting 485 transmitter/receiver.
- 7 -
2.1 Connecting the Serial MODBUS Gateway to
the USB Programming Dongle:
BZ-TECH provides MODBUS configuratio n softwa re that
presents a GUI to the user and makes interfacing to the
MODBUS gateway easy. BZ-TECH also provides a USB to
RS485 dongle to connect the hardware to a PC. To use
the USB to RS485 dongle, connect the wires from the
MODBUS gateway as shown in the illustration below.
Note:
The white wire is not used with the USB
programming dongle. The white should be left
unconnected but protected to prevent accidental shorting.
* Any COM port in a computer may be used with the
software.
Select the version that is compatible with your PC
operating system.
- 8 -
2.2 Serial MODBUS Gateway Indicator Lights
System - Indicates gateway status. A green light
indicates ready and working, a red light indicates there
is a hardware problem.
Wired - Indicates connect i vit y wit h MODBUS system.
A green light indicates ready and working, a red light
indicates there is a problem. A flashing green light
indicates active communication.
Wireless - Indicates wireless sensor network activity.
A green light indicates ready and working, a red light
indicates that no network has been formed (no sensors
are registered). A flashing green light indicates radio
traffic from the sensors.
Indicator Light Sequences:
Startup - All indicators flash red and green for ~4 seconds.
Internal Memory Failur e - All indicators stay red after startup.
COM Reset - “Wired” indicator will flash red (1x/sec).
Factory Reset - All indicators will flash re d quickly (5x/sec).
- 9 -
3.0 MODBUS Protocol Implementation
The Serial MG supports 2 transmission modes: RTU and
ASCII.
MODBUS Interfaces will support the following commands:
(FC refers to MODBUS Function Codes).
FC = 1: Read Coils
FC = 5: Write Single Coil
FC = 15: Write Multiple Coils
FC = 3: Read Holding Registers
FC = 6: Write Single Regist e r
FC = 16: Write Multiple Registers
All other commands, exceptions, or other interface features
are not supported.
Note:
Raw addressing starts at 0. For FC-specific addressing,
the address starts at 1 for coils and 40001 for holding registers.
Denoted in the literature as 0 / 1 or 1 / 40001.
3.1 Register Size
MODBUS permits the use of a variety of register size
specifications. This device uses the standard 16-bit
unsigned integer for its register size. Additionally, registerdata representation can take the form of multi-register data
types (i.e. 32-bit integer). These will be specified
specifically for all registers that require additional
formatting.
3.2 Multi-byte Formatting
MODBUS has specified the use of ‘Big-Endian’
representation for addresses and data items. This means
that when a numerical quantity larger than a single byte is
transmitted, the most significant byte is sent first.
- 10 -
3.3 Communication Defaults
•
MODBUS slave ID or MODBUS address: 95 or 0x5F
•
MODBUS-RTU, 8 data bits, No Parity, 1 Stop bi t ( 8-N-1),
19200 baud
3.4 Communication Settings Reset Jumper
MUST OPEN ENCLOSURE TO ACCESS
If the device’s communications settings are unknown, it is
possible to reset the communication settings by placing a
jumper on the RESET jumper position when the gateway is
not powered. This jumper is scanned at power up or reset.
•
Open jumper: Normal operation, Wireless and
MODBUS communications allowed to function.
•
Closed jumper: Communications interface reset.
If the jump er is detected closed, the device must be powercycled, with the jumper in the open position, before the
device is allowed to operate normally. During COM reset
the “Wired” indicator light will flash red indicating that the
reset procedure is happening.
3.5 Factory Reset Jumper
MUST OPEN ENCLOSURE TO ACCESS.
While in communication reset state, if the device remains
powered and the reset jumper is deliberately removed and
replaced twice, a factory reset will occur on the device.
All
indicator s will flash red quickly (5x/sec) indicating that the
device has been successfully reset.
Power-cycle the device
with the jumper in the open position to allow normal
operation.
NOTE:
a factory reset will remove all known sensors and
settings from the device.
- 11 -
4.0 Using the Gateway
-
Coil and Register Map
This device has various coils and registers that allow the
user to access gateway and wireless device feature. Here
is a brief listing of the accessible coil and register map.
Resource Name
Acronym
Function
Code
Raw
Address
Gateway Coils
GWC
1-5 0-4
Wireless Device
Coils (50 total sets
of 4 coils)
WDC [0] thru
WDC [49]
2001-2200
2000-2199
Gateway Registers
GWR
40001-40010
0-9
Wireless Device
List (50 total sets
of 2 registers)
WDL [0] thru
WDL [99]
40101-40200
100-199
Fast Read Registers
(50 total sets of
7 registers)
FRR [0] thru
FRR [99]
41001-41350
1000-1349
Wireless Device
Registers (50 total
sets of 50 registers)
WDR [0] thru
WDR [99]
42001-44500
2000-4499
Please see the reference section for more detailed
information.
4.1 Verifying that the Wireless is Active
Read the “WACTIVE” Gateway Coil. (Function Code
address = 1, Raw Address = 0). A true coil denotes that
the system is configured sufficiently to communicate to
wireless device(s). A false coil means the gateway does
not have any registered wireless devices (WDL is empty).
- 12 -
4.2 Resetting the Gateway
Write the “RST_DEVICE” Gateway Coil (Function Code
address = 2, Raw Address = 1) to TRUE. The device will
reset one second after receiving this command. This
resets all wireless device data in the FRR. Additionally,
if any gateway settings (baud rate, MODBUS address,
communication mode) were modified, this causes these
settings to take effect.
4.3 Resetting the Wireless Network
Write the “RST_WNET” Gateway Coil (Function Code
address = 3, Raw Address = 2) to TRUE. The gateway will
take approximately 30 seconds to complete the wireless
network reset after the acknowledging this command. No
serial commands will be acknowledged during this time
(wired LED is red). This operation optimizes the RF
configurations for best performance and clears out all
devices from the WDL. The gateway will not be active
until at least one wireless device is registered.
4.4 Resetting to Default Communications Settings
Write the “RST_COM” Gateway Coil (Function Code
address = 4, Raw Address = 3) to TRUE. After setting this
coil to true, a device reset command must be issued (or
power cycling) before any of the new settings will take
effect.
Resets the baud rate, mode, and device ID back to defaults,
which are respectively: 19200, RTU: 8-N-1, 95.
4.5 Resetting the Gateway to Factory Settings
Write the “RST_FACTORY” Gateway Coil (Function Code
address = 5, Raw Address = 4) to TRUE. After setting this
coil to true, the device will reset automatically one second
after the write coil command is acknowledged. No manual
reset is required.
- 13 -
4.6 Viewing and Modifying MODBUS
Communication Settings
The BAUDRATE Gateway Register (Function Code 40006,
Raw Address 5) contains the baud rate setting. Encoded
options are:
0 : 2400
1 : 4800
2 : 9600
3 : 19200
4 : 38400
5 : 57600
6 : 115200
Example: Writing a value of 2 to this register will effectively
change the baud rate to 9600.
The COMMODE Gateway Register Function Code
address = 40007, Raw Address =6) contains the following
encoded options:
0 : RTU : 8-N-2
1 : RTU : 8-N-1
2 : RTU : 8-E-1
3 : RTU : 8-O-1
4 : ASCII : 7-N-2
5 : ASCII : 7-E-1
6 : ASCII : 7-O-1
Example: Writing a value of 2 to this register will effectively
change the communication mode to RTU: 8-E-1.
The ADDRESS Gateway Register (Function Code
address = 40008, Raw Address =7) contains the address
used by the MODBUS interface. Values of 1-247 are
permitted to be written.
Modifications to these registers are applied after a powercycle or gateway reset sequence.
Please see Ref.4 for more information.
- 14 -
4.7 Setting Gateway Time
GWTIME, consisting of GWTIME_H and GWTIME_L @
40011-40012 or RAW 10-11, is a UInt32 value that by
default represents the time in seconds from the point the
gateway was powered on or reset. A user, that has access
to some form of external time reference, can write to these
registers to set time. It is required that GWTIME_H is
written before GWTIME_L is written. Once GWTIME_L is
written the gateways time is officially updated with the
contents of GWTIME_H/L. Reading these register will
retrieve the gateway’s time in seconds.
The reference time used to set this time only needs to be
meaningful to the application it is used in. Most
applications do not require the Serial Modbus Gateway to
reference any time. If an application uses wireless device
synchronization settings, then the time must be set. As an
example, Current time is September 1
st
, 2016 at
17:05:15. If September 1
st
, 2016, 00:00:00 was referenced
as the beginning time, then the GWTIME can be set to (17
* 3600) + (5 * 60) + 15 = 61515. If January 1
st
, 2016,
00:00:00 was referenced as the beginning time, then
GWTIME can be set to (245 * 24 * 3600) + (17 * 3600) + (5
* 60) + 15 = 21229515. Both time references result in
accurate synchronization of remote wireless devices.
4.8 Viewing Registered Wireless Devices
The WD_CNT Gateway Register (Function Code
address = 40004, Raw Address =3) contains the number
of registered devices in the Wireless Device List (WDL).
A Value of 0 here denotes that no devices are registered
and the wireless is disabled.
The WDL consists of 50 set of 2-paired registers that
represents the Serial Identifier (SID) for the register device.
These registers can be read to discover the location of a
specific device in the list (SLOT).
Note: You need to have registered at least one sensor to
view/edit wireless d evice register data (WDR). Please see
Ref.4 for more information.
- 15 -
4.9 Adding a Wireless Device to the Gateway
Each device has a 32-bit serial identifier (SID). To add a
wireless device, this SID is written to the intended SLOT
(two regis ters at a time ) in WDL r egisters.
Note: The two SLOT ID registers must be written to using
FC = 16 (Write to Multiple Registers) otherwise an error
will be generated. See section 3.0 for more details.
SLOT IDs can only be added one at a time.
For example: If you have sensor 43527 in hand and you
wanted to add this to SLOT 0, you would write the
following.
40101 / 100
0
40102 / 101
43527
To move a wireless device from one slot to another, the
SID of the wireless device only needs to be written to the
new SLOT. The old SLOT will be erased and prepared for
future use.
To delet e a wireless device from the list, write a 0,0 into
the SLOT and the device will be erased and the SLOT is
prepared for future use.
When registering the first wireless device, the second LED
will go red signifying there is no wired communication
available, then the third LED will start flashing while the
wireless network resets. Please wait approximately 30
seconds (until all LEDs turn green, signifying a successful
network reset) after registering the first device, before attempting any other tasks.
If the WDL SLOT is written to incorrectly, a “MODBUS IO
error message” is returned.
Please see Ref.3 for more information.
- 16 -
4.10 Verifying Wireless Device Activity
After a device is registered, the SLOT it was registered at
can be verified by reading the WDL. Once the slot is
known, a user can read the WDC [SLOT], WDR [SLOT],
and FRR [SLOT] associated with the wireless device.
If a wireless device is registered, but is not actively
communicating, the ACTIVE coil @ WDC[SLOT] offset 0
will be false.
When a wireless device is actively communicating, the
ACTIVE coil @ WDC[SLOT] of fset 0 will be true.
4.11 Viewing Wireless Device Data
(Fast Read Method)
All Wireless Devices have two pieces of commonly useful
data:
1) if a threshold is breached or if the device is in an
exception state
2) the acquired data measurement.
Using the FRR, a user can quickly collect new data
generated by multiple devices registered on the gateway.
The purpose of these registers is to allow for efficient
access to the remote wireless device’s most current data.
When new data is available from any Wireless device the
FRR is updated with the newly reported values. The FRR
will zero itself out if no new data is received within a
defined period. The defined period is specified in the
Wireless Device Registers offset 18.
- 17 -
Any write to the first address in the FRR will zero out the
latest measurement and age. These records consist of
seven (7) registers per wireless device. The format of
these records are: AGE, DATA_0, DATA_1, DATA_2,
DATA_3, BATTERY, RSSI.
Fnct. Code ADDRESS = 41001+ (7 * SLOT)
Raw ADDRESS FORMULA = 1000+(7 * SLOT)
Please see Ref.5 for more information on these registers.
4.12 Viewing Wireless Device Data
(Advanced method)
For a user to see more data about a devices exception and
activity status, the ACTIVE coil @ WDC[SLOT] offset
0 and EXCEPTION coil @ WDC[SLOT] offset 1 can be
queried.
WDC F.C. FORMULA=2001+(4*SLOT)+OFFSET
WDC RAW ADDR FORMULA=2000+(4*SLOT)+OFFSET
Please see Ref.2 for more information on these coils.
For a user to see the detailed data from a device, read
regi ster WDR [SLOT] offs et 5 - 15. This will return device
battery voltage, signal strength, and specific status and
data from the device.
WDRF.C.FORMULA=42001+(50* SLOT) + OFFSET
WDR RAW ADDR FORMULA=2000+(50 * SLOT) +
OFFSET
Please see Ref.6 for more details on these registers.
- 18 -
4.13 Configuring Wireless Devices
(Standard Requests)
For a user to view and modify wireless device settings,
read/write to registe r WDR[SL OT] offset 19-23. These
registers contain information and settings relating to
communication intervals, retry, and failure recovery
behaviors.
Please see Ref.6 for more details on these registers.
After changes are made to these regist ers, the user can
use the PENDING_CFG coil @ WDC[SLOT] offset
2 to check the status of these changes. When this coil is
true, the pending changes have not been communicated
with the wireless device. When this coil is reset to false,
the wireless device has been updated with the change. We
recommend one update at a time.
4.14 Configuration Rules to Abide By
There are two important rules to obey when setting
Wireless Devices, to ensure optimum stability.
CFG_INTERVAL_EXCEPTION ≤ CFG_INTERVAL_STANDARD
CFG_INTERVAL_STANDARD÷CFG_INT_TYPE_MEAS_PER_RPT≥ 1
AND
CFG_INTERVAL_EXCEPTION÷CFG_INT_TYPE_MEAS_PER_RPT≥1
- 19 -
4.15 Wireless Device Sync Setting
All “Interval Type” wireless devices contain configuration
CFG_INT_TYPE_SYNC @ offset 45 that enables them to
synchronize data reporting to an external clock. Value can
range from 0 – 5. If the value is 0 [default], the wireless
devices do not synchronize report interval and will report
data in respect to its startup time. If the value is 1 – 5, the
wireless device attempts to track its report time based on
the Serial Modus Gateway’s time. It is important that
GWTIME in the Gateway Registers is set with an
appropriate time reference. For instance, GWTIME could
be set to the number of seconds from January 1st, 2010,
00:00:00. Now when the Sync setting is not set to 0, the
wireless device will constantly adjust its reporting interval
to closely track a modulus of the gateway’s time. As an
example, if a wireless temperature sensor has a report
interval of 30 minutes and this sync setting is enabled, this
sensor will report its data near to 00:00, 00:30, 1:00, 1:30,
…, etc.
The difference in the enabled values of 1 – 5 correlate to
the number of “random seconds” that is included in the
calculation of next report interval. Theses setting are
useful in managing networks of different sizes. If 20
sensors were all configured to synchronize and deliver
data at the exact same time, the RF collisions would
cripple the sensor network. Please see table below for
recommend settings to be used with specific network
sizes.
Sync Setting
# of Devices
Random Time
1
1-2
1 Second
2
3-7
3 Seconds
3
8-15
7 Seconds
4
16-25
15 Seconds
5
26-50
30 Seconds
- 20 -
5.0 Upgrading Gateway Firmware
Gateway Versions 3.0.0.0 and above are remotely
upgradeable. To upgrade the SMG, you will need to
already have or download the MODBUS Sensor Gateway
software executable and possess a Serial MODBUS
Gateway to USB Programming dongle. Once these are in
place, obtain and the latest file upgrade from Support and
save the file locally on your PC.
Put the SMG in bootloader mode by opening the enclosure
and accessing the RESET Jumper. Place the jumper over
the pins and remove and replace at least 5 times.
When the jumper is placed on the RESET terminals for the
first time, the middle light will flash red while the other
lights are off. Removing and replacing the jumper twice will
then cause the all three lights to flash on and off quickly in
red. Removing and replacing the jumper four more times
will cause the top Gateway light to go solid red, while the
other lights are off. Removing the jumper for the final time
will cause all three lights to illuminate solid red. Your SMG
is now in bootloader mode.
Use the MODBUS Sensor Gateway software and find the
menu “Gateway Commands”. At the bottom, select the
option “Upgrade Gateway Firmware”. Select the upgrade
file and click on “Open”.
While the code loads, the status is displayed in the bottom
left of the MODBUS Sensor Gateway Software. The lights
on the SMG will flash red and off during the process. Upon
successful upgrade, the SMG will then reboot. Note that all
registered sensors will be eliminated and the new firmware
will be in a fresh from factory state.
If an error occurs during the process, factory reset the
gateway using the jumper and try again.
- 21 -
Reference Section
Complete Gateway Features and Resource Mapping
Reference
Through the MODBUS interface, the following features are
available for access by a MODBUS master. All coils and registers
are available for read or write access through the MODBUS
address mapping presented here.
Ref.1 - Gateway Coils
The following table represents the supported gateway specific
coils. These are intended to report the status, control the state, or
trigger events on the gateway.
Coil Name
Function
Code
Raw
Address
Description
WACTIVE
1 0 True (1) denotes that the system is
configured sufficiently to
communicate to the sensor.
False (0) denotes that the Wireless
system is not active.
Causes for this include:
- No Registered Sensors.
RST_DEVICE
2 1 Writing True (1) to this coil will force
a device reset and cleans out all
current status. Always read as False
(0).
RST_WNET
3 2 Writing True (1) to this coil will force
a
Wireless Network Reset and reform
the operating network setting base d
on CHANM and NETID (in Gateway
Registers). Always read as False (0).
RST_COM
4 3 Writing True (1) to this coil will force
the ADDRESS, COMMODE, and
BAUDRATE to defaults. Always read
as False (0). After setting this coil to
true, a device reset command must
be issued before any of the new
settings will take effect.
- 22 -
RST_FACTORY
5 4 Writing True (1) to this coil will force
all settings to Factory defaults.
Always read as False (0). After setting
this coil to true, the device will
automatically reset so the new
settings will take effect.
Example MODBUS Request: Read GWC
MODBUS Command: read coils 1-5 (OR RAW 0-4)
DEFAULT MODBUS SETTINGS: Address: 95 (0x5F)
MODBUS ASCII
Poll Gateway Coils: “:63010000000595<CR><LF>“
MODBUS RTU
Poll Gateway Coils: 0x63 01 00 00 00 05 75 8A
• 63 is address
• 01 is function code (read coils)
• 00 is address high
• 00 is address low
• 00 is coil count high
• 05 is coil count low
• 758A is CRC for RTU protocols
95<CR><LF> is the check sum and end-of-line for ASCII protocols
- 23 -
Ref.2 - Wireless Device Coils
This section defines the location and function of all the remotely
located coils available for access through the MODBUS interface.
Every wireless device has been allotted 4 possible coils. The table
below enumerates the address allotment.
FCADDRESSFORMULA=2001+(4*WDL_SLOT)
Raw Address Formula = 2000+(4*WDL_SLOT)
Register Name
Address
Register Name
Address
WDC [0]
FC 2001 / 2000
WDC [49]
FC 2197 / 2196
The following table represents the specific Wireless Device Coils.
These are intended to report the status, control the state, or
trigger events on the remotely connected devices.
Coil Name
Offset
Description
ACTIVE
0 True (1) denotes that the remote wireless
device is actively synchronized with the
gateway.
False (0) denotes that the device is considered
offline by the gateway. No communications
have occurred with the devices for
INACTIVITY_TIMEOUT (in WDR) amount of
time value. This is 0 if no devices are
registered.
(READ ONLY)
EXCEPTION
1 True (1) denotes that device is in an exception
state (data threshold breached or sensor state)
and the device’s wireless report interval is
governed by INTERVAL_EXCEPTION (in
WDR).
False (0) denotes that no exception state is
currently noted on the wireless device.
Therefore the wireless report interval is
governed by INTERVAL_STANDARD (in
WDR). (READ ONLY)
(READ ONLY)
- 24 -
PENDING_CFG
2 True (1) denotes that one or more registers
have been modified from their original values
(located on the remote device).
False (0) denotes that the no local registers
contain configurations that are different from
the remote device.
Writing True (1) to this coil will cause the local
configuration parame ters co nt ained in the gateway to be sent to the remote device. (FORCE
OVERWRITE). Writing False (0) to this coil will
be ignored.
Coil resets automatically when remote
configuration changes have been confirmed.
FORCE_REMOTE_
SYNC
3 Always read as False (0). If set to True (1),
then the wireless device’s local registers will be
cleared and the remote configurations will be
retrieved.
Ref.3 - Gateway Registers
The following table represents the supported gateway settings and
their corresponding properties.
Register Name
Function
Code
Raw
Address
Description
VERSION
40001
0
Designates the FW Version of the
Gateway. (READ-ONLY)
Example Value: 0x3000
(Read 3.0.0.0)
ID_H
40002
1
Gateway’s globally-unique
identifier.
(READ-ONLY)
Combine an ID_H and ID_L to
form UInt32 number.
ID_L
40003
2
WD_CNT
40004
3
Wireless Device Count – Value
that can be read to discover the
number of registered sensors are
configured to operate on the
gateway. A value 0 – 50 is
permitted.
(READ-ONLY)
- 25 -
Example Value: 0 (no sensors
registered, factory reset condition)
Example Value: 10 (10 Registered
device)
OP_CHAN
40005
4
Operating channel designator
reports the wireless channel in
use. Value of 0-25 is permitted
(READ-ONLY)
BAUDRATE
40006
5
Designates the baud rate used by
the MODBUS interface. After
modifying this register, a gateway
reset must be performed before
changes can take effect.
Value Represented Baud
Selected
0 2400
1 4800
2 9600
3 (DEFAULT) 19200
4 38400
5 57600
6 115200
COMMODE
40007
6
Designates the operating mode
used by the MODBUS interface.
After modifying this register, a
gateway reset must be performed
before changes can take effect.
Value Meaning
0 RTU : 8-N-2
1 (DEFAULT) RTU : 8-N-1
2 RTU : 8-E-1
3 RTU : 8-0-1
4 ASCII : 7-N-2
5 ASCII : 7-E-1
6 ASCII : 7-O-1
COMADDR
40008
7
Designates the MODBUS Address
used in the communications
interface. Values range from 1-
247. Default value is 95.
- 26 -
CHANM_H
40009
8
The configurable channel mask is
a UInt32 bit-field that represents
the allowed channels the wireless
is allowed to establish a network.
Default value contains a 1 for
every possible channel (all
channels are allowed). If the value
is 0x00000011, then the network is
only allowed to be established on
channels 0 and 4. After these
registers are modified, the
RST_WNET coil must be set to
true to reform the network and
select new OP_NETID and
OP_CHAN settings.
CHANM_L
40010
9
GWTIME_H
40011
10
By default, this is a UInt32 value
that represents the number of
seconds since the gateway was
last powered or reset. However,
this value can be set to any value
that represents the number of
seconds from any point in time.
GWTIME_L
40012
11
Example MODBUS Request:
MODBUS Command: read registers 40001-40010 (0-9)
DEFAULT MODBUS SETTINGS: Address: 95 (0x5F)
MODBUS ASCII
Poll Gateway Registers: “:63030000000983<CR><LF>”
MODBUS RTU
Poll Gateway Registers: 0x63 03 00 00 00 09 0D 86
• 63 is address
• 03 is function code (read holding registers)
• 00 is address high
• 00 is address low
• 00 is register count high
• 09 is register count low
• 0D86 is CRC for RTU protocols
83<CR><LF> is the check sum and end-of-line for ASCII protocols
- 27 -
Ref.4 - Wireless Device List Registers
The WDL register stores the s erial identifier of the registered wireless devices. The serial identifiers are formatted as a UInt32,
therefore two contiguous registers must be read to extract the full
value.
FCADDRESSFORMULA=40101 + (2 * SLOT)
Raw Address Formula = 100 + (2 * SLOT)
List entries can be as follows:
0xFFFFFFFF: EMPTY
Otherwise, a real device is registered
Example:
Register Name
Address
Register Name
Address
WDL [0]
FC 40101,
Raw 100
WD [49]
FC 40200,
Raw 198
Ref.5 - Fast Read Registers
The purpose of these registers is to allow for efficient access to
the remote wireless device’s most current data. Any write to the
first address in the FRR will zero out the latest measurement and
time.
These records consist of seven (7) registers per wireless device.
FCADDRESSFORMULA=41001+(7*SLOT)
Raw Address Formula=1000+(7*SLOT)
Example:
Record Name
Address
Record Name
Address
FRR [0]
FC 41001,
Raw 1000
FRR [49]
FC 41344,
Raw 1343
- 28 -
The f ormat of thes e recor ds are:
Name
Offset
Description
AGE
0 time in seconds when the wireless devic e
generated this data.
DATA_0,
DATA_1,
DATA_2,
DATA_3
1, 2, 3, 4
Data is generated by wireless device.
The format for this data can be found in the
Serial MODBUS Sensor Application Definition
document
Battery
5 register value / 100 = x.xx Volts
RSSI
6 a negative number from -20 to -110 dBm
The FRR is auto zeroed when no new data comes in.
Ref.6 - Wireless Device Registers
This section defines the location and function of all the remotely
located registers available for access through the MODBUS
interface. Ever y wi r eless device has been allotted 50 possible
registers. The table below enumerates the address allotment.
FCADDRESSFORMULA=42001+(50*SLOT)
Raw Address FORMULA=2000+(50*SLOT)
Example:
Register Name
Address
Register Name
Address
WDR [0]
FC 42001,
Raw 2000
WDR [49]
FC 44451,
Raw 4450
The following table represents the supported Wireless Device
Registers. They contain the pertinent data and configurations
populated from the remote device. Through these registers, a
user is capable of interpreting additional data, setting new
configurations, and sending other control-related messages
(CNTL) to the remote device. Unknown or unused values are
defaulted to 0x0000.
- 29 -
Field Name
Offset
Description
ID_H
0
Wireless device’s globally-unique identifier.
Combine a ID_H and ID_L to form full UInt32
number. (READ-ONLY)
ID_L
1
VER_MAJOR
2
Wireless device’s firmware version number.
Registers VER_MAJOR::VER_MINOR to be
interpreted as ASCII characters with the
following format: “M0”.“M1”.“m0”.“m1”.
Example: VER = 0x3230::0x3136 → “Version:
2.0.1.6”. (READ-ONLY)
VER_MINOR
3
TYPE
4 Device Type value that is used to interpret the
sensor specific portions of this record.
(READ-ONLY)
VOLTAGE
5 Current Voltage reported from the remote
device. Value formatted in millivolts.
(READ-ONLY).
Example: 301 → 3.01 Volts
RSSI
6 Current Received Signal Strength Indicator.
Formatted as Int16. Values of -20 to -106 dBm
typical. The less negative the number, the
more signal there was on the last
communication. (READ-ONLY).
STATUS
7 Current Status reported from the remote
device. (READ-ONLY).
DATA_0
8
The current data reported by the remote
device.
(READ-ONLY).
DATA_1
9 DATA_2
10
DATA_3
11 DATA_4
12 DATA_5
13
DATA_6
14 DATA_7
15
INACTIVITY_
TIMEOUT
16 Timeout in 5 min steps. Values of 1 to 216 (5
min to 18 hrs) permitted. If the device has
communicated within the amount of time
specified here, the ACTIVE coil is set to TRUE.
If No communications have occurred with the
devices for this specified amount of time, the
ACTIVE coil is reset to FALSE.
- 30 -
CFG_ CHANM_H
17
Configurable Channel Mask is a UInt32 bit-field
that represents the allowed channels the
wireless device is permitted to use to search
for gateways. If the value is written to
0x00000011, then the network is only allowed
to be established on channels 1 and 4.
CFG_ CHANM_L
18
CFG_INTERVAL_
LINK
19 Configurable Interval Link represents the
device’s link-state sle ep time . If the device
disconnects from its current network (e.g.
failures, reset), it will scan permitted channels
for a new link. If no gateway is found, then this
specified period of time is waited before
attempting to relink. This value is a UInt16 that
is interpreted as follows:
- CFG_LINKHB <= 18, value is in hours.
(1-18 HRS)
- CFG_LINKHB > 100. value is in minutes.
(105 = 5 MIN)
-
If 0 or Otherwise, 2HR default
CFG_ INTERVAL_
STANDARD
20 Configurable Interval for Standard Reports is
the regular check-in interval for the wireless
device (based on timer, not events).
Format: UInt16 number of seconds to wait
before checking in.
CFG_ INTERVAL_
EXCEPTION
21 Configurable Interval for Exception Reports is
the check-in interval used during exception
cases (based on timer, not events).
Format: UInt16 number of seconds to wait
before checking in.
CFG_ RETRIES
22 Configurable Retry Limit represents the
number of attempts made by the device to
deliver its data when the primary attempt fails.
Value of 0 – 10 inclusive are permitted.
CFG_ FAIL_LIM
23 Configurable Fail Limit represents the number
of report attempts that can fail con sec utiv ely
before the sensor drops current gateway
connection, resets to link mode and re-scans
for a better connection. Value of 1-10 inclusive
are permitted for the relink behavior. If value is
0, then this behavior is disabled and only a
power-cycle can reset the device’s link
settings.
- 31 -
CFG_
PROFILE_TYPE
24 Value that selects what profile specific device
type is recognized by the remote device.
(READ ONLY – Write attempts are ignored)
INTERVAL–TYPE DEVICE = 1
-- Primarily governed by a timer. When it is
time to deliver data, the wireless device
transmits the data to the gateway.
TRIGGER–TYPE DEVICE = 2
-- Primarily governed by the occurrence of an
event. If an event is detect OR the
CFG_INTERVAL_STANDARD is reached, then
the wireless device transmits the data to the
gateway.
CFG_INT_TYPE_
MEAS_PER_RPT
25 Device-Type Specific Parameter:
INTERVAL–TYPE DEVICE
Measurements Per Report represents the
number of measurements that will be taken for
every given wireless report. If an exception is
noted, then the device will immediately report
instead of waiting for the report interval. Value
of 1 – 250 permissible. Minimum granularity of
1 sec maximum sample rate.
CFG_INT_TYPE_
HYSTERESIS_H
26
Device-Type Specific Parameter:
INTERVAL–TYPE DEVICE
Hysteresis represents the amount of observed
variance must occur to permit a device that has
registered an exception to rem ove the
exception notification.
CFG_INT_TYPE_
HYSTERESIS_L
27
CFG_INT_TYPE_
THRESH_MIN_H
28
Device-Type Specific Parameter:
INTERVAL–TYPE DEVICE
Minimum Threshold represents the amount of
device specific observed sign a l can be reduced
before an exception is registered and reported.
CFG_INT_TYPE_
THRESH_MIN_L
29
CFG_INT_TYPE_
THRESH_MAX_H
30
Device-Type Specific Parameter:
INTERVAL–TYPE DEVICE
Maximum Threshold represents the amount of
device specific observed sign a l can be
increased before an exception is registe red
and reported.
CFG_INT_TYPE_
THRESH_MAX_L
31
- 32 -
CFG_INT_TYPE_
CALVAL_1_H
32
Device-Type Specific Parameter:
INTERVAL–TYPE DEVICE
Calibration / Control Values.
CFG_INT_TYPE_CAL
VAL_1_L
33 CFG_INT_TYPE_
CALVAL_2_H
34
CFG_INT_TYPE_
CALVAL_2_L
35 CFG_INT_TYPE_
CALVAL_3_H
36 CFG_INT_TYPE_
CALVAL_3_L
37 CFG_INT_TYPE_
CALVAL_4_H
38
CFG_INT_TYPE_
CALVAL_4_L
39 CFG_TRG_TYPE_
DETECT_TYPE
40
Device-Type Specific Parameter:
TRIGGER–TYPE DEVICE
Mode / Control Values.
CFG_TRG_TYPE_
DETECT_PERIOD
41 CFG_TRG_TYPE_
DETECT_COUNT
42
CFG_TRG_TYPE_
DETECT_REARM
43 CFG_TRG_TYPE_
DETECT_BISTABLE
44
CFG_INT_TYPE_
SYNC
45
UInt16 value used to enable wireless device
time synchronization to ex tern al time inpu t.
Value can range from 0 – 5. If the value is 0
[default], then the wireless devices do not
synchronize and will report its data in respect
to startup time. If the value is 1 – 5, the
wireless device attempts to track its report
time based on the Serial Modus Gateway’s
time (see GWTIME in Gateway registers).
UNUSED
46-49
- 33 -
Notes:
1. See Serial MODBUS Sensor Application Definition document for
more information on field definitions, enumeration, and usage for
these specific registers.
2. An Interval that specifies under 10 minutes must consider the
battery power usage and wireless network load the gateway may
experience if the CFG_INTERVAL parameters a set too low. It is
recommended to keep then network load to at most 10 device
reports per minute. The maximum interval for communications is
18 hrs → 64800 seconds.
Certifications
United States FCC
This equipment has been tested and found to comply with the limits for a Class B digital
device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference i n a residential instal l ation. This
equipment generates, uses, and can radiate radio frequency energy and, if not installed
and used in accordance with the instruction manual, may cause harmful interference to
radio communications. However, there is no guarantee that interference will not occur in
a particular installation. If this equipment does cause harmful interference to radio or
television reception, which can be determined by turning the equipment off and on, the
user is encouraged to try to correct the interference by one of more of the following
measures:
• Reorient or relocate the receiving antenna
• Increase the separation between the equipment and receiver
• Connect the equipment into an outlet on a circuit different from that to which
the receiver is connected.
• Consult the dealer or an experienced radio/TV technician for help.
Warning: Changes or modifications not expressly approved by BZ-TECH could void
the user’s authority to operate the equipment.
RF Exposure
FCC ID: ZTL-RFSC1
This device has been designed to operate with an approved antenna listed below, and
having a maximum gain of 5.1 dBi. Antennas not included in this list or having a gain
greater than 5.1 dBi are strictly prohibited for use with this device. The required antenna
impedance is 50 ohms.
To reduce potential radio interference to other users, the antenna type and its gain should
- 34 -
be so chosen that the equivalent isotropically radiated power (EIRP) is not more than that
required for successful communication.
Approved Antennas
The following antennas are approved for use with FCC ID: ZTL-RFSC1
• Hyperlink HG905RD-RSP (5.1 dBi Rubber Duck)
• Pulse W1063 (3.0 dBi Rubber Duck)
• ChangHong GSM-09 (2.0 dBi Rubber Duck)
• Specialized Manufacturing MC-ANT-20/4.0C (4” whip)
- 35 -
Loading...