www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
3
1 GENERAL INFORMATION
1.1 Scope of the document
These instructions are supplementary to the signal converter handbook. For all other data, use
the relevant chapters of the handbook. If you do not have this document, please contact the
nearest office or download them from the manufacturer's internet site.
1.2 Scope of delivery
The information in this supplementary manual only contains the data applicable to MODBUS
communication.
The technical data in the handbook shall be valid in its current version, provided that it is not
rendered invalid or replaced by this supplement.
1.3 Modbus protocol interface
The Modbus interface to the signal converter is implemented in the Modbus RTU
communications protocol and is done in accordance with the specification and requirements of
the "Modbus Protocol Specification V1.1b".
MFC 400
The physical electrical parameters of the Modbus specification are defined by the EIA/TIA-485
(RS485) standard and the "Modbus over Serial Line - Specification and Implementation Guide
V1.02".
Both specifications can be obtained on the official website of the Modbus organisation:
http://www.modbus.org
4
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
MFC 400
TECHNICAL DATA 2
2.1 General technical data
InterfaceRS485, galvanically isolated
Baud rate1200, 2400, 3600, 4800, 9600, 19200, 38400, 57600 or
ProtocolModbus RTU (available as a separate document on request)
Maximum participants on bus32 per line, master included (may be extended by repeaters)
CodingNRZ bit coding
Address range1...247
Transmission procedureHalf duplex, asynchronous
Bus accessMaster / slave
CableScreened twisted pair
DistancesMaximum 1.2 km / 3937 ft without repeater (dependant on
115200 bps
baud rate and cable specifications)
2.2 Technical data of the Modbus interface (acc. to EIA/TIA standards)
Kind of signal transmissionDifferential, 2-wire topology
Maximum number of
transmitter/receivers
Voltage range on converter input-7...+12 V
Maximum voltage on converter output5V
Minimum voltage on driver output, max.
load
Maximum input current (off state)-20...+20 μA
Receiver input voltage-7...+12 V
Sensitivity of the receiver-200...+200 mV
Receiver input resistance>12kΩ
Short circuit current< 250 mA
Termination / polarization resistors
(if activated by factory)
32
U
>1.5V
diff
120 Ω / 560 Ω
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
5
3 ELECTRICAL CONNECTIONS
3.1 Modbus connection
The signal converter is hooked up onto the bus using terminals C and D:
TerminalsDescription
D-Signal A (D 0)
DSignal B (D 1)
C-Common 0 V
CNot connected
Terminals A and B of the signal converter are dependant on the options selected at order. Refer
to the standard handbook of the signal converter for connection details.
3.2 Connection to Modbus bus
The signal converter is designed to be connected as a slave device onto the 2-wire bus
implementation of the Modbus serial physical layer definition.
MFC 400
In addition to the D0 and D1 signal lines the bus MUST
ground reference point for the data signals.
For proper operation of Modbus in half duplex mode in single or multi-drop communication, it is
recommended that a termination resistor is applied to both ends of the data line. The simplest
form of termination is line-to-line resistor across the differential input.
In RTU mode the Modus protocol requires quiet periods on the communications bus for
synchronisation. It is therefore important that the Modbus is not allowed to "float", i.e.
unreferenced to 0 V, as this could lead to spurious signals due to noise pick-up. It is therefore
necessary to employ biasing resistors at one point on the bus network.
MUST include a "Common" signal line to act as a
MUSTMUST
6
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
MFC 400
ESTABLISH RS485 CONNECTION 4
To establish a RS485 connection with the signal converter, prepare the master device with the
appropriate default settings or use custom parameters specified via display of the signal
converter.
The Modbus RS485 settings can be found in the menu C6.8 of the display. The following
parameters can be configured:
Data formatBig Endian, Little EndianBig EndianC6.8.4
Transmission
delay
Stop Bits1 Stop Bit, 2 Stop Bits1 Stop BitC6.8.6
19200, 38400, 57600, 115200
bps
0...0.04 [s]0sC6.8.5
19200 bpsC6.8.2
These settings can be changed via Modbus too. For further information refer to
Communication Settings
on page 24.
Modbus RS485
All devices connected to the bus, must have the same baud rate.
INFORMATION!
It is of great importance to ensure at the time of the procedure of devices addressing, that there
are not two devices with the same address. In such a case, an abnormal behaviour of the whole
serial bus can occur. It is then impossible for the master to communicate with all present slaves
on the bus.
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
7
5 MODBUS PROTOCOL
5.1 RTU frame format
Using RTU (Remote Terminal Unit) format, data is transmitted as 8 bit binary characters. There
are no special characters to determine the start and end of a message frame. Synchronization is
achieved by a minimum silent period of at least 3.5 character times before the start of each
frame transmission and a maximum silent period of 1.5 character times between characters in
the same frame.
The format of the query and response frames vary slightly depending upon the function code.
The basic form is outlined below.
Command functionFrame formatDescription
MFC 400
Silent period3.5 x TAll transmissions must be preceded by a minimum silent
Slave address8bitsThis is a single byte slave address which is transmitted
Function code8bitsThis is an eight bit code in the range of 1...255 although
Register start address or
byte count when required
Number of points or data
bytes when required
8 bit byte count
16 bit address
n×8bitsNumber of points:
period of 3.5 x T, where T is the transmission time of a
single character. This can be calculated from the baud
rate, e.g. T = 572 µs at 19.2 kbps.
first and must be in the range of 1...247. Address 0 is
reserved for a broadcast address which all slaves should
recognise, and therefore requires no response.
only 126 functions exist as the codes 129...255 represent
an error condition. An error condition occurs when the
addressed slave does not accept the command, in which
case it responds with the function code + 128, i.e. with its
msb set to 1.
Register start address:
Register start address: for a query command that requires
Register start address:Register start address:
data to be returned, this field will contain the 16 bit start
address of the register (or data) to be returned.
Note that the signal converter uses protocol addresses.
Therefore the register address listed is the actual number
required in the Modbus command.
E.g:
E.g: to access input register 30006, the register start
E.g:E.g:
address is 30006 = 0x7536.
Byte count:
Byte count: In general this is only present in frames that
Byte count:Byte count:
are transferring data, and has a value equal to the number
of bytes contained in the data field. The data field is limited
to a maximum of 250 bytes.
Number of points: for a query command that requires data
Number of points:Number of points:
to be returned, this field will contain the number of
registers to be returned regardless of their bit size.
Data bytes:
Data bytes: contains the data requested. The signal
Data bytes:Data bytes:
converter can use Big Endian format (MSB first) or Little
Endian format (LSB first).
CRC16 bitsThis field contains a 16 bit CRC which is calculated on all
8
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
the data bits of the message bytes.
MFC 400
5.2 Data representation
There are two data types used to transmit information on a Modbus data bus, the "Bit" and the
"Register". The "Bit" represents a single binary state, whether as an output or an input condition.
The "Register" is a 16-bit integer transmitted as two 8-bit characters. Using multiple "Registers"
the Modbus interface can transmit higher accuracy values such as "Floating Point" and "Double
Precision Floating Point" numbers.
"Bit" variables are packed into a byte containing 8 bit, so each character, sent or received, can
contain up to 8 "Bit" variables. The master and slave devices use only as many 8 bit data
characters as are required to transmit the information. Any unused bits in the data characters
are ignored. The bit that is requested by the start address is transmitted in the LSB at bit 0. The
next "Bit" value is transmitted in the next bit (bit 1). This continues until the last bit location (bit 7)
of the LSB is reached. The next "Bit" value is then transmitted in the next data byte (LSB+1/MSB)
at bit 0. This continues until all of the requested values have been transmitted. Any unused bits in
the MSB are filled out with "0"s.
For simple single register variables the MSB of the register is transmitted first, with the LSB
following immediately after. However, for variables that require multiple registers, i.e. the
"Floating Point" and "Double Precision Floating Point" variables, the transmission order can be
selected in the RS485 settings. By default, those values will be transmitted in Big Endian.
MODBUS PROTOCOL 5
5.2.1 8-bit values
Register HiLo
N0x00Byte
5.2.2 16-bit values
Register HiLo
NMSBLSB
5.2.3 32-bit values
Little Endian
Register HiLo
NLSB + 1LSB
N + 1MSBLSB + 2
Big Endian
Register HiLo
NMSBLSB + 2
N + 1LSB + 1LSB
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
9
5 MODBUS PROTOCOL
Float (single precision, IEEE 754)
MSBLSB + 1LSB + 1LSB
SEEEEEEEEMMMMMMMMMMMMMMMMMMMMMMM
With S = sign, E = exponent, M = mantissa/fraction
5.2.4 64-bit values
Little Endian
Register HiLo
NLSB + 1LSB
N + 1LSB + 3LSB + 2
N + 2LSB + 5LSB + 4
N + 3MSBLSB + 6
MFC 400
Big Endian
Register HiLo
NMSBLSB + 6
N + 1LSB + 5LSB + 4
N + 2LSB + 3LSB + 2
N + 3LSB + 1LSB
Double (double precision, IEEE 754)
MSB
MSBLSB + 6
MSBMSB
SEEEEEEEEEEEMMMMMMMMMMMMMMMMMMMM
LSB + 3
LSB + 3LSB + 2
LSB + 3LSB + 3
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
LSB + 6LSB + 5
LSB + 6LSB + 6
LSB + 2LSB + 1
LSB + 2LSB + 2
LSB + 5LSB + 4
LSB + 5LSB + 5
LSB + 1LSB
LSB + 1LSB + 1
LSB + 4
LSB + 4LSB + 4
LSB
LSBLSB
With S = sign, E = exponent, M = mantissa/fraction
10
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
MFC 400
5.3 Modbus Register Addresses
The signal converter supports four types of data references, which are associated to a range of
Modbus registers.
Address rangePrimary tablesAccess rights
0...9999Coilsread + write
10000...19999Discrete Inputsread
20000...39999Input Registersread
40000...65535Holding Registersread + write
INFORMATION!
•
Sometimes register numbers are asked for. The register numbers can be calculated by
adding a 1 to the register address.
•
Some systems cannot use addresses above 9999. For these systems there is the possibility to
use the listed addresses but
- for Input Registers omit the leading 3 of 3xxxx;
- for Holding Registers omit the leading 4 of 4xxxx.
MODBUS PROTOCOL 5
5.4 Supported Function Codes
Function codeName
dechex
0101Read Single Coil
0202Read Descrete Inputs
0303Read Holding Register
0404Read Input Register
0505Write Single Coil
0808Diagnostics
1610Write Multiple Register
432BEncapsulated Interface Transport
For detailed information about the telegrams structure of all function codes refer to
Modbus function codes
on page 33.
5.5 Error messages
When the signal converter detects an error in the requests, received in a properly formatted
telegram, it will respond with an error message. The error message response telegram is
formatted as follows:
Supported
AddressFunction CodeError CodeCRC LoCRC Hi
The msb (most significant bit) of the requested function code is set (add 0d128 / 0x80) in the
reponse telegram to indicate an error has been detected. For example, if an error were detected
in a function 1 request, then the returned function code would be 0x81 (0d129).
www.krohne.com05/2013 - 4002525102 - AD Modbus MFC 400 R02 en
11
5 MODBUS PROTOCOL
The single data character in the response telegram will indicate the type of error detected.
These are as follows:
MFC 400
Error
NameMeaning
Code
01ILLEGAL FUNCTIONThe requested function code is not supported or not valid due to the
02ILLEGAL DATA
03ILLEGAL DATA VALUEThe requested data is invalid for the register being written.
04SLAVE DEVICE
06SLAVE DEVICE BUSYThe slave is unable to process the requested command because a
ADDRESS
FAILURE
Errors due to communications faults (CRC errors, Parity errors etc.) are logged but no response
is returned because the data in the received telegram is deemed unreliable. The master system
can read the error logs by using the diagnostics command (for details on Function Code 0x08
refer to
Diagnostics
on page 13).
5.6 Device identification
Retrieve all of the identification information from the signal converter.
Modbus Function Code "Encapsulated Interface Transport" (0x2B).
current settings of the device.
The register requested is not valid or the quantity of requested
registers hits invalid registers.
An unrecoverable error occurred while the slave was attempting to
perform the requested action.
long-duration command is in progress. The master should
retransmit the message later.
Modbus Encapsulated Interface (MEI) type (0x0E).
Category Object IdObject nameTypeContent
Basic0x00VendorName16 byte ASCII StringKROHNE
0x01ProductCode10 byte ASCII StringCG number; order code for the
0x02MajorMinorRevision7 byte ASCII StringElectronic Revision number