Walchem W600 Operating Manual
W600/
W
900 Modbus
Instruction Manual
WAL C HE M, Iwaki America Inc.
Five Boynton Road Hopping Brook Park Holliston, MA 01746 USA :
TEL: 508-429-1110 WEB: www.walchem.com
Notice
© 2018 WALCHEM, Iwaki America Inc. (hereinafter “Walchem”)
5 Boynton Road, Holliston, MA 01746 USA
(508) 429-1110
All Rights Reserved
Printed in USA
Proprietary Material
The information and descriptions contained herein are the property of WALCHEM. Such information and
descriptions may not be copied or reproduced by any means, or disseminated or distributed without the
express prior written permission of WALCHEM, 5 Boynton Road, Holliston, MA 01746.
This document is for information purposes only and is subject to change without notice.
Statement of Limited Warranty
WALCHEM warrants equipment of its manufacture, and bearing its identification to be free from defects in
workmanship and material for a period of 24 months for electronics and 12 months for mechanical parts and
electrodes from date of delivery from the factory or authorized distributor under normal use and service and
otherwise when such equipment is used in accordance with instructions furnished by WALCHEM and for the
purposes disclosed in writing at the time of purchase, if any. WALCHEM’s liability under this warranty shall
be limited to replacement or repair, F.O.B. Holliston, MA U.S.A. of any defective equipment or part which,
having been returned to WALCHEM, transportation charges prepaid, has been inspected and determined by
WALCHEM to be defective. Replaceable elastomeric parts and glass components are expendable and are not
covered by any warranty.
THIS WARRANTY IS IN LIEU OF ANY OTHER WARRANTY, EITHER EXPRESS OR IMPLIED, AS TO
DESCRIPTION, QUALITY, MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE OR USE,
OR ANY OTHER MATTER.
180676 Rev F
October 2018
Table of Contents
1.0 SCOPE ............................................................................................................................................................... 1
2.0 INTRODUCTION ................................................................................................................................................ 1
3.0 OVERVIEW ........................................................................................................................................................ 1
3.1 Modbus Settings ..................................................................................................................................................................... 2
4.0 MODBUS/TCP DRIVER ...................................................................................................................................... 2
4.1 Modbus/TCP Protocol ............................................................................................................................................................ 2
4.1.1 MBAP Header .................................................................................................................................................................... 2
4.1.2 Protocol Data Unit ............................................................................................................................................................. 3
4.1.3 Modbus/TCP Function Codes ............................................................................................................................................ 3
4.1.3.1 Function Code 1, Read Coils ..................................................................................................................................... 4
4.1.3.2 Function Code 2, Read Discrete Inputs .................................................................................................................... 4
4.1.3.3 Function Code 3, Read Holding Registers ................................................................................................................ 5
4.1.3.4 Function Code 4, Read Input Registers .................................................................................................................... 5
4.1.3.5 Function Code 5, Write Single Coil ........................................................................................................................... 6
4.1.3.6 Function Code 6, Write Single Holding Register ...................................................................................................... 6
4.1.3.7 Function Code 16, Write Multiple Holding Registers ............................................................................................... 7
4.1.4 Modbus/TCP Exception Error Codes .................................................................................................................................. 7
4.2 TCP/IP Interface ...................................................................................................................................................................... 8
4.3 Data Refresh ........................................................................................................................................................................... 8
4.4 Data Encoding ........................................................................................................................................................................ 8
4.4.1 Coils and Discrete Inputs ................................................................................................................................................... 8
4.4.1.1 Boolean .................................................................................................................................................................... 8
4.4.2 Holding Register and Input Registers ................................................................................................................................. 8
4.4.2.1 16-Bit Word (Boolean) ............................................................................................................................................. 8
4.4.2.2 16-Bit Word (Bitfield) ............................................................................................................................................... 9
4.4.2.3 16-Bit Word (Status) ................................................................................................................................................ 9
4.4.2.4 16-Bit Word (Integer) ............................................................................................................................................... 9
4.4.2.5 32-Bit Value (Integer) ............................................................................................................................................... 9
4.4.2.6 32-Bit Value (Float) .................................................................................................................................................. 9
4.4.2.7 32-Bit Inverse Data Format (Integer or Float) ........................................................................................................ 10
5.0 DATA DICTIONARY .......................................................................................................................................... 10
5.1 Addressing (0- or 1-Based) ................................................................................................................................................... 10
5.2 Address Maps ....................................................................................................................................................................... 10
5.2.1 W600 Controller – I/O Channel Address Maps ................................................................................................................ 11
5.2.2 W900 Controller – I/O Channel Address Maps ................................................................................................................ 12
5.2.3 Alternate Address Maps .................................................................................................................................................. 14
5.3 Type-Specific Address Map .................................................................................................................................................. 15
5.3.1 System Address Map ....................................................................................................................................................... 15
5.3.2 Network Address Map ..................................................................................................................................................... 16
5.3.3 Sensor Input Address Maps ............................................................................................................................................. 17
5.3.3.1 Sensor Input (all types except Analog Input Flowmeter) Address Map ................................................................. 17
5.3.3.2 Analog Input Flowmeter Address Map .................................................................................................................. 18
5.3.4 Digital Input Address Maps .............................................................................................................................................. 19
5.3.4.1 Digital Input / DI State Type Address Map ............................................................................................................. 19
5.3.4.2 Digital Input / Contacting Flow Meter Type Address Map ..................................................................................... 20
5.3.4.3 Digital Input / Paddlewheel Flow Meter Type Address Map ................................................................................. 21
5.3.4.4 Digital Input / DI Counter Type Address Map ........................................................................................................ 22
5.3.4.5 Digital Input / Flow Monitor Type Address Map .................................................................................................... 23
5.3.5 Virtual Input Address Maps ............................................................................................................................................. 24
5.3.5.1 Virtual Input / Calculation & Raw Value Type Address Map .................................................................................. 24
5.3.5.2 Virtual Input / Redundant Sensor Type Address Map ........................................................................................... 25
5.3.5.3 Virtual Input / Disturbance Type Address Map ..................................................................................................... 26
5.3.6 Relay Output Address Maps ............................................................................................................................................ 27
5.3.6.1 Relay Output / Manual Control Mode Address Map ............................................................................................. 27
5.3.6.2 Relay Output / On/Off & On/Off Disturbance Control Mode Address Map .......................................................... 28
5.3.6.3 Relay Output / Dual Setpoint Control Mode Address Map .................................................................................... 29
5.3.6.4 Relay Output / Time Proportional Control Mode Address Map ............................................................................ 30
5.3.6.5 Relay Output / Intermittent Sampling Control Mode Address Map ...................................................................... 31
5.3.6.6 Relay Output / Bleed And Feed Control Mode Address Map ................................................................................ 32
5.3.6.7 Relay Output / Bleed Then Feed Control Mode Address Map ............................................................................... 33
5.3.6.8 Relay Output / Flow Timer Control Mode Address Map ....................................................................................... 34
5.3.6.9 Relay Output / Counter Timer Control Mode Address Map .................................................................................. 35
5.3.6.10 Relay Output / Target PPM Control Mode Address Map ....................................................................................... 36
5.3.6.11 Relay Output / PPM By Volume Control Mode Address Map ................................................................................ 37
5.3.6.12 Relay Output / Flow Meter Ratio Control Mode Address Map .............................................................................. 38
5.3.6.13 Relay Output / Volumetric Blend Control Mode Address Map .............................................................................. 39
5.3.6.14 Relay Output / Percent Timer Control Mode Address Map ................................................................................... 40
5.3.6.15 Relay Output / Event Timer Control Mode Address Map ...................................................................................... 41
5.3.6.16 Relay Output / Biocide Timer Control Mode Address Map ................................................................................... 42
5.3.6.17 Relay Output / Spike Control Mode Address Map ................................................................................................. 43
5.3.6.18 Relay Output / Probe Wash Control Mode Address Map ...................................................................................... 44
5.3.6.19 Relay Output / Plating Control Mode Address Map .............................................................................................. 45
5.3.6.20 Relay Output / Plating Follow Control Mode Address Map ................................................................................... 46
5.3.6.21 Relay Output / Lag Output Control Mode Address Map........................................................................................ 47
5.3.6.22 Relay Output / Alarm Control Mode Address Map ................................................................................................ 48
5.3.7 Pulse Relay Output Address Maps ................................................................................................................................... 49
5.3.7.1 Pulse Relay Output / Manual Control Mode Address Map .................................................................................... 49
5.3.7.2 Pulse Relay Output / Pulse Proportional Control Mode Address Map .................................................................. 50
5.3.7.3 Pulse Relay Output / Flow Proportional Control Mode Address Map ................................................................... 51
5.3.7.4 Pulse Relay Output / Pulse PID Control Mode Address Map ................................................................................. 52
5.3.7.5 Pulse Relay Output / Pulse Disturbance Control Mode Address Map ................................................................... 53
5.3.7.6 Pulse Relay Output / Lag Output Control Mode Address Map .............................................................................. 54
5.3.8 Analog Output Address Maps .......................................................................................................................................... 55
5.3.8.1 Analog Output / Manual Control Mode Address Map ........................................................................................... 55
5.3.8.2 Analog Output / Retransmit Mode Address Map .................................................................................................. 56
5.3.8.3 Analog Output / Proportional Control Mode Address Map ................................................................................... 57
5.3.8.4 Analog Output / Flow Proportional Control Mode Address Map .......................................................................... 58
5.3.8.5 Analog Output / PID Control Mode Address Map ................................................................................................. 59
5.3.8.6 Analog Output / Disturbance Control Mode Address Map .................................................................................... 60
5.3.8.7 Analog Output / Lag Output Control Mode Address Map ..................................................................................... 61
5.3.9 Alternate Address Maps .................................................................................................................................................. 62
5.3.9.1 Alternate Sensor Input Address Map ..................................................................................................................... 62
5.3.9.2 Alternate Digital Input Address Map ..................................................................................................................... 63
5.3.9.3 Alternate Virtual Input Address Map ..................................................................................................................... 64
5.3.9.4 Alternate Relay Output Address Map .................................................................................................................... 65
5.3.9.5 Alternate Analog Output Address Map ................................................................................................................. 66
5.3.9.6 Alternate Control Output Address Map ................................................................................................................. 67
5.4 Status Register Codes ........................................................................................................................................................... 68
5.5 Alarm Bitfields ...................................................................................................................................................................... 70
5.5.1 System Alarm Bitfield ...................................................................................................................................................... 70
5.5.2 Network Alarm Bitfield .................................................................................................................................................... 70
5.5.3 Sensor Input Alarm Bitfield ............................................................................................................................................. 71
5.5.4 Digital Input Alarm Bitfield .............................................................................................................................................. 71
5.5.5 Virtual Input Alarm Bitfield .............................................................................................................................................. 72
5.5.6 Relay & Control Output Alarm Bitfield ............................................................................................................................ 72
5.5.7 Analog Output Alarm Bitfield .......................................................................................................................................... 73
1.0 SCOPE
This document is a User Interface Specification for the Walchem Modbus/TCP product feature for W600
and W900 Controllers. It contains mapping of the various dynamic variables to their Modbus/TCP
address locations.
This document supports the Modbus/TCP feature on controller software versions 3.01 and higher.
2.0 INTRODUCTION
The Modbus/TCP feature allows the Walchem controller to communicate with PC-based applications
such as WonderWare and Intellution HMI/SCADA programs, Building Energy Management systems,
Distributed Control Systems (DCS), as well as stand-alone HMI devices.
The controller is a Modbus Server, meaning that it can respond to requests from the HMI device. The
controller cannot initiate the flow of information. For example, it will not immediately send a new alarm
message. It will wait until the HMI device requests the current data contained in specific address
locations.
If the HMI device does not directly support the Modbus/TCP protocol, then a protocol translation
gateway may be required to convert from Modbus/TCP to a protocol that the device supports. Please
note that Modbus/RTU requires a serial interface, not Ethernet, and therefore is not directly compatible
with the Walchem controller.
3.0 OVERVIEW
Modbus/TCP, also known as Modbus TCP/IP, is a form of Modbus that uses the TCP/IP layers as a base
for controlling the communications between different devices. This is not to be confused with Modbus
over TCP/IP, which Walchem controllers do not support.
The Modbus/TCP protocol supports multiple types of data transactions, from reading single bits per
transaction, to advanced object-oriented operations. However, to ensure the most compatible system
available, only a basic subset of these functions is supported in the controller.
The official Modbus/TCP protocol supports data addresses 5 digits in length. A de facto extended
standard exists which supports data addresses 6 digits in length. However, to ensure compatibility, the
Modbus/TCP feature supports only 5-digit data address system.
The Modbus/TCP feature supports reading and writing of single-bit Coils and 16-bit Holding Registers, as
well as read-only single-bit Discrete Inputs and 16-bit Input Registers. These data formats allow the
controller to establish blocks that contain all the process variables, set points, alarms, and input/output
status values that are made public to a Modbus/TCP client. These blocks of data are packaged so that it
can be read in 8-bit chunks (for a group of up to 8 Coils or Discrete Inputs) or 16-bit chunks (for a single
Holding Register or Input Register), regardless of the type of data within it. In the following sections, the
formatting, storing, and reading of this data are described.
1
3.1 Modbus Settings
Modbus Application Protocol (MBAP)
Header
Modbus Application Protocol (MBAP) Header
Name
Size
Description
Identification of Request/Response transaction.
Copied from request to response
Protocol Identifier
2 bytes
0 = Modbus protocol.
Length
2 bytes
Number of following bytes (includes the Unit Identifier and PDU)
Identification of Remote Device.
Can be used for broadcasting (unsupported).
Settings relating to the Modbus/TCP feature can be configured in the Remote Communication
Configuration Menu.
The ‘Verbose Logging’ setting is used to generate an Event log entry for every Modbus message into and
out of the controller. The information may be used in conjunction with an HMI log when
troubleshooting communications during commissioning. However, the additional logging adds a
significant load on the controller’s systems. Therefore, this feature should only be enabled temporarily
while actively troubleshooting communications. The setting automatically reverts to Disabled when the
controller is restarted.
Detailed information on the Remote Communication Configuration Menu can be found in the controller
Instruction Manual.
4.0 MODBUS/TCP DRIVER
4.1 Modbus/TCP Protocol
The Modbus protocol, as well as the Modbus/TCP variant, is well documented in the specifications
which are available at http://www.modbus.org
supporting and organizing the Modbus protocol.
The Modbus/TCP Application Data Unit (ADU) consists of 2 distinct sections:
, a website established by the Modbus Organization for
Protocol Data Unit (PDU)
The total size of the ADU is between 9 and 263 bytes, depending on the function code and number of
data addresses requested.
4.1.1 MBAP Header
The Modbus/TCP extension adds 7 additional bytes to the original Modbus protocol, which allows for
the transport over the TCP/IP layers. These 7 bytes make up the MBAP Header:
Transaction Identifier 2 bytes
Unit Identifier 1 byte
The Unit Identifier has a special consideration in the Modbus/TCP implementation. If the value is 0, then
the request is a broadcast message and the packet will be processed, but no response will be generated.
If the value is non-zero, the packet will be processed and a response will be returned.
Normally the Slave ID, which is not present in the Modbus/TCP protocol, will be set in the HMI client
software to 1. The broadcast Unit Identifier address is not supported by the controller; all supported
function codes require a response message at all times.
2
4.1.2 Protocol Data Unit
Protocol Data Unit (PDU)
Name
Size
Description
Function Code identifier.
Can be any of the hexadecimal codes listed in the Function Code table.
1 – 255
byte(s)
Payload for request/response transactions.
Varies depending on function code and number of addresses requested.
Supported Function Codes
Function
Code
Data Address
Range
FC1
(0x01)
Read up to 2000 consecutive 1-bit Coils within a single
request/response cycle.
FC2
(0x02)
Read Discrete
Inputs
Read up to 2000 consecutive 1-bit Discrete Inputs
within a single request/response cycle.
FC3
(0x03)
Read Holding
Registers
Read up to 125 consecutive 16-bit Holding Registers
within a single request/response cycle.
FC4
(0x04)
Read Input
Registers
Read up to 125 consecutive 16-bit Input Registers
within a single request/response cycle.
FC5
(0x05)
Write a single 1-bit Coil within a single
request/response cycle.
FC6
(0x06)
Write Single
Holding Register
Write a single 16-bit Holding Register within a single
request/response cycle.
FC16
(0x10)
Write Multiple
Holding Registers
Write up to 125 consecutive 16-bit Holding Registers
within a single request/response cycle.
The Protocol Data Unit (PDU) is made up of between 2 and 256 bytes, depending on the function and
number of data addresses requested:
Function Code 1 byte
Data Payload
4.1.3 Modbus/TCP Function Codes
The Modbus/TCP Server feature supports the following function codes:
Name Description
Read Coils
0xxxx
1xxxx
4xxxx
3xxxx
Write Single Coil
0xxxx
4xxxx
4xxxx
The consecutive address limitations of the Coils, Discrete Inputs, Holding Registers, and Input Registers
were established for the Modbus/TCP standard to maintain consistency with the original Modbus
protocol standard, even though a TCP/IP packet can contain a larger payload.
The Modbus/TCP feature allows for Function Codes 1 and 2 to be used interchangeably for read
requests. For example, a read coils (FC1) request for data addresses 00605 through 00610 will always
return the same result as a read discrete inputs (FC2) request for data addresses 10605 through 10610.
Likewise, the Modbus/TCP feature allows for Function Codes 3 and 4 to also be used interchangeably for
read requests. For example, a read holding registers (FC3) request for data addresses 40587 through
40590 will always return the same result as a read input registers (FC4) request for data addresses
30587 through 30590. All addresses accessible as a Coil or Discrete Input may also be accessed as a
Holding Register or Input Register.
Only the 4 least significant digits of the data address are explicitly stated in the Modbus message, with
the most significant (5
th
) digit being derived from the function code. However, generally the entire
5-digit data address must be specified in the Tag Database of an HMI.
3
4.1.3.1 Function Code 1, Read Coils
Read Coils Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x01).
Starting Address
2 Bytes
The data address of the first Coil to read.
Quantity of Coils
2 Bytes
The number of Coils requested, maximum of 2000 per message.
Read Coils Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x01).
Byte Count
1 Byte
The number of data bytes to follow.
Coil Status
1-125 Bytes
8 Coils per byte, up to 2000 Coils per message.
Read Coils Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x81).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
Read Discrete Inputs Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x02).
Starting Address
2 Bytes
The data address of the first Discrete Input to read.
Quantity of
Discrete Inputs
The number of Discrete Inputs requested, maximum of 2000 per
message.
Read Discrete Inputs Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x02).
Byte Count
1 Byte
The number of data bytes to follow.
Discrete Input
Status
8 Discrete Inputs per byte, up to 2000 Discrete Inputs per
message.
Read Discrete Inputs Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x82).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.3.2 Function Code 2, Read Discrete Inputs
2 Bytes
1-125 Bytes
4
4.1.3.3 Function Code 3, Read Holding Registers
Read Holding Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x03).
Starting Address
2 Bytes
The data address of the first Holding Register to read.
Quantity of
Holding Registers
The total number of Holding Registers requested, maximum of
125 per message.
Read Holding Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x03).
Byte Count
1 Byte
The number of data bytes to follow.
Holding Register
Values
1 Holding Register for every 2 bytes, maximum of 125 Holding
Registers per message.
Read Holding Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x83).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
Read Input Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x04).
Starting Address
2 Bytes
The data address of the first Input Register to read.
Quantity of Input
Registers
The total number of Input Registers requested, maximum of 125
per message.
Read Input Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x04).
Byte Count
1 Byte
The number of data bytes to follow.
Input Register
Values
1 Input Register for every 2 bytes, maximum of 125 Input
Registers per message.
Read Input Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x84).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
2 Bytes
2-250 Bytes
4.1.3.4 Function Code 4, Read Input Registers
2 Bytes
2-250 Bytes
5
4.1.3.5 Function Code 5, Write Single Coil
Write Single Coil Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x05).
Coil Address
2 Bytes
The data address of the Coil to which to write.
Coil Value
2 Bytes
The value to write to the Coil (0xFF00 = On, 0x0000 = Off).
Write Single Coil Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x05).
Coil Address
2 Bytes
The data address of the Coil written.
Coil Value
2 Bytes
The value written to the Coil (0xFF00 = On, 0x0000 = Off).
Write Single Coil Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x85).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
Write Single Holding Register Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x06).
Holding Register
Address
Holding Register
Value
Write Single Holding Register Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x06).
Holding Register
Address
Holding Register
Value
Write Single Holding Register Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x86).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.3.6 Function Code 6, Write Single Holding Register
2 Bytes The data address of the Holding Register to which to write.
2 Bytes The value to write to the Holding Register.
2 Bytes The data address of the Holding Register written.
2 Bytes The value written to the Holding Register.
6
4.1.3.7 Function Code 16, Write Multiple Holding Registers
Write Multiple Holding Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x10).
Starting Address
2 Bytes
The data address of the first Holding Register to which to write.
Quantity of
Holding Registers
Byte Count
1 Byte
The number of data bytes to follow.
Holding Register
Values
2 bytes for every Holding Register, maximum of 125 Holding
Registers per message. Write Multiple Holding Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x10).
Starting Address
2 Bytes
The data address of the Holding Register written.
Quantity of
Holding Registers
Write Multiple Holding Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x90).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
Supported Exception Codes
Exception Code
Name
Description
The function code received is not supported in the
controller.
The data address received is not an allowable address within
register requested is not valid for the function.
A value contained in the query data field for a Write
for the function.
An unrecoverable error occurred while the controller was
but the controller could provide a response.
2 Bytes Number of Holding Registers to write.
1-250 Bytes
2 Bytes Number of Holding Registers written.
4.1.4 Modbus/TCP Exception Error Codes
The Modbus/TCP feature supports the following Exception (Error) Codes:
0x01 Illegal Function
0x02 Illegal Data Address
0x03 Illegal Data Value
0x04 Slave Device Failure
When an exception occurs, the Response PDU contains a Function Code of 0x80 plus the original
hexadecimal Function Code.
the controller. This error will only be generated if the first
command is not an allowable value for field. This error will
only be generated if the first register requested is not valid
attempting to perform the requested action. This is a
general exception code indicating that the request was valid,
7
4.2 TCP/IP Interface
Byte Value
Coil 1
Coil 2
6 unused bits
0x02
(00000010)
Word Value
Coil Value
Most Significant Byte
Least Significant Byte
0xFF00
(1111111100000000)
0xFF
(11111111)
0x00
(00000000)
Word Value
Bit Value
Most Significant Byte
Least Significant Byte
0x0001
(0000000000000001)
0x00
(00000000)
0x01
(00000001)
The Modbus/TCP interface is attached to the TCP/IP stack that is implemented within the Walchem
controller. When the Modbus feature is Enabled, the controller will listen to all communications that
come in on the Modbus/TCP registered port 502. This port can be changed in the Remote
Communications Menu.
4.3 Data Refresh
To ensure continued connectivity, the Modbus/TCP client should not request data more frequently than
once every 5000 msec. Faster refresh rates are unsupported and may result in unexpected behavior.
4.4 Data Encoding
Modbus uses a ‘big-endian’ representation for addresses and data items. This means that within each
register, when a numerical quantity larger than a single byte is transmitted, the MOST significant byte is
sent first. The following topics describe the different types of encoding and show how the data is
encoded within the Modbus/TCP packet. Most client drivers will extract the data from the packet in the
correct format for use/display within the client environment.
4.4.1 Coils and Discrete Inputs
4.4.1.1 Boolean
Coils and Discrete Inputs can be used for digital input states, relay states, alarm states, and reset buttons
that are representable as a 1 or a 0. All binary data is packed from least significant bit to most significant
bit into a byte containing up to 8 Coils or Discrete Inputs. Bits not containing the value of a Coil or
Discrete Input are space holders and have a value of 0.
0 1 000000
Reset buttons may also be packed as a 16-bit word when using the Write Single Coil function code.
(0xFF00 = On, 0x0000 = Off)
1
4.4.2 Holding Register and Input Registers
4.4.2.1 16-Bit Word (Boolean)
Holding Registers and Input Registers can be used for digital input states, relay states, alarm states, and
reset buttons that are representable as a 1 or a 0. All binary data can be packed into a 16-Bit register,
with the least significant bit of the least significant byte being occupied by the 1-bit value. This is
functionally identical to a 16-bit integer.
1
8
4.4.2.2 16-Bit Word (Bitfield)
Word Value
Alarm Bitfield Value
Most Significant Byte
Least Significant Byte
0x00AA
(0000000010101010)
0x00
(00000000)
0xAA
(10101010)
Word Value
Alarm Bitfield Value
Most Significant Byte
Least Significant Byte
0x00AA
(0000000010101010)
0x00
(00000000)
0xAA
(10101010)
Word Value
Most Significant Byte
Least Significant Byte
0x1234
0x12
0x34
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Least Significant Word
Most Significant Word
0x12345678
0x56
0x78
0x12
0x34
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Least Significant Word
Most Significant Word
0x12345678
0x56
0x78
0x12
0x34
Holding Registers and Input Registers can be used for Alarm Bitfields. An 8-Bit Alarm bitfield is packed
into the least significant byte of a 16-bit register. This is offered as a single-register alternative to
accessing alarm states individually. Bitfields can be decoded in section 5.5 Alarm Bitfields
0xAA
.
4.4.2.3 16-Bit Word (Status)
Holding Registers and Input Registers can be used for enumerated values such as status codes. An 8-Bit
status code is packed into the least significant byte of a 16-bit register. This is functionally identical to
the 16-bit integer. Status codes are defined in section 5.4 Status Register Codes
0xAA
.
4.4.2.4 16-Bit Word (Integer)
Holding Registers and Input Registers can be used for 16-bit integers containing HOA settings, and time
data that don’t require 32-bit integers. All 16-bit integers are unsigned.
4.4.2.5 32-Bit Value (Integer)
Holding Registers and Input Registers can be used for 32-bit integer data containing elapsed time values
and timestamps. The system clock register and all registers containing timestamps use the Unix Time
format, that counts the seconds passed since 12:00:00 am, January 1
wide; therefore, a request message must include 2 consecutive registers to read or write a 32-bit
integer. The 32-bit value is transmitted with the least significant word first, then the most significant
word. All 32-bit integers are unsigned.
Word Value
st
, 1970. Registers are only 16 bits
4.4.2.6 32-Bit Value (Float)
Holding Registers and Input Registers can be used for 32-bit floating point data containing set points,
sensor readings, percentages, deadbands, etc. Registers are only 16 bits wide; therefore, a request
message must include 2 consecutive registers to read or write a 32-bit float. The 32-bit value is
transmitted with the least significant word first, then the most significant word.
Word Value
9
4.4.2.7 32-Bit Inverse Data Format (Integer or Float)
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Most Significant Word
Least Significant Word
0x12345678
0x12
0x34
0x56
0x78
32-bit integers and floats can use an inverse data format, where the contents of registers 1 and 2 are
switched. When inverse data format is selected, the 32-bit value is transmitted with the most significant
word first, then the least significant word. The data format setting can be modified in the Remote
Communications Settings Menu.
Word Value
5.0 DATA DICTIONARY
5.1 Addressing (0- or 1-Based)
The addressing within the Modbus/TCP protocol (that is, the data within the physical packet) is 0-based,
meaning the first element/item to be accessed is referenced by address 0. The Modbus standard for
handling and displaying data is 1-based, meaning the first element/data item to be accessed is
referenced by address 1.
For most client applications, users enter the 1-based number which is converted to 0-based addressing
at the protocol level. The addresses defined in the following address maps below are 1-based, as most
of the client applications work with this method. Register addresses for individual elements are derived
by adding the address offset in the appropriate Type-Specific Address Map
I/O Channel Address Map below.
to the starting address in the
5.2 Address Maps
The address map is a function code-agnostic map that contains all data values that can be accessed as
Coils (0xxxx), Discrete Inputs (1xxxx), Holding Registers (4xxxx), and Input Registers (3xxxx).
The Address Map of the Modbus/TCP feature is modular; valid addresses are determined by the add-on
card configuration of the controller and the task being performed by each Input or Output. Each object
has a block of 36 addresses.
The Modbus/TCP feature allows all addresses to be accessed as registers. On the following address map
tables, values in BOLD can also be accessed as a Coil or Discrete Input.
As examples, to read the ‘Controller Firmware Version’ from the System Address Map
x0037) as an Input Register (FC4), the address indices 2 and 3 must be requested together: Addresses
30039 and 30040.
To read the ‘Low Alarm’ status for Sensor 2-1 in a W600 Controller as a Coil (FC1), the
Address Map indicates the starting address is x0865. Address index 28 must be requested: Address
00893. For the W900 Controller, the ‘Low Alarm’ status for Sensor 2-1 is x1729 + 28 = Address 01757.
To write the ‘Setpoint’ for Relay 3 (set to On/Off control mode) in the
Address Map (staring address x9001) as a Holding Register (FC6), the address indices 6 and 7 must be
used together: Addresses 49007 and 49008.
Relay On/Off Control Mode
(starting address
Sensor Input
10
5.2.1 W600 Controller – I/O Channel Address Maps
W600 Controller – I/O Channel Address Map
Starting
Address
Ending
Address
Type-Specific Address Maps
System
Network
Sensor Input 1-1
Sensor Input 1-2
Sensor Input 1-3
Sensor Input 2-1
x0865
x0900
Sensor Input 2-2
x0901
x0936
Sensor Input 2-3
x0937
x0972
Digital Input 1
x0289
x0324
Digital Input 2
Digital Input 3
Digital Input 4
Digital Input 5
Digital Input 6
Virtual Input 1
Virtual Input 2
x5797
x5832
Relay Output 1
x8929
x8964
Relay Output 2
x8965
x9000
Relay Output 3
Relay Output 4
Relay Output 5
Relay Output 6
Analog Output 1
Analog Output 2
The address ranges for each input/output channel in the W600 controller are as follows:
Object
x0037 x0072 See 5.3.1 System Address Map
x0145 x0180 See 5.3.2 Network Address Map
x0577 x0612
x0613 x0648
x0649 x0684
x0325 x0360
x0361 x0396
x0397 x0432
x0433 x0468
x0469 x0504
x5761 x5796
See 5.3.3 Sensor Input Address Maps
See 5.3.4 Digital Input Address Maps
See 5.3.5 Virtual Input Address Maps
See 5.3.6 Relay Output Address Maps
x9001 x9036
x9037 x9072
x9073 x9108
x9109 x9144
x1153 x1188
x1189 x1224
5.3.7 Pulse Relay Output Address Maps
See 5.3.8 Analog Output Address Maps
Or
11
5.2.2 W900 Controller – I/O Channel Address Maps
W900 Controller – I/O Channel Address Map
Type-Specific Address Maps
System
Network
Sensor Input 1-1
Sensor Input 1-2
Sensor Input 1-3
Sensor Input 1-4
x1261
x1296
Sensor Input 1-5
x1297
x1332
Sensor Input 1-6
x1333
x1368
Sensor Input 2-1
Sensor Input 2-2
Sensor Input 2-3
Sensor Input 2-4
Sensor Input 2-5
Sensor Input 2-6
Sensor Input 3-1
Sensor Input 3-2
Sensor Input 3-3
x2377
x2412
Sensor Input 3-4
x2413
x2448
Sensor Input 3-5
x2449
x2484
Sensor Input 3-6
Sensor Input 4-1
Sensor Input 4-2
Sensor Input 4-3
Sensor Input 4-4
Sensor Input 4-5
Sensor Input 4-6
x3061
x3096
Digital Input 1
x0577
x0612
Digital Input 2
x0613
x0648
Digital Input 3
x0649
x0684
Digital Input 4
Digital Input 5
Digital Input 6
Digital Input 7
Digital Input 8
Digital Input 9
Digital Input 10
x0901
x0936
Digital Input 11
x0937
x0972
Digital Input 12
x0973
x1008
The address ranges for each input/output channel in the W900 controller are as follows:
Object Starting Address Ending Address
x0037 x0072 See 5.3.1 System Address Map
x0145 x0180 See 5.3.2 Network Address Map
x1153 x1188
x1189 x1224
x1225 x1260
x1729 x1764
x1765 x1800
x1801 x1836
x1837 x1872
x1873 x1908
x1909 x1944
x2305 x2340
x2341 x2376
x2485 x2520
x2881 x2916
x2917 x2952
x2953 x2988
x2989 x3024
x3025 x3060
See 5.3.3 Sensor Input Address Maps
Note: When using P/N 191918 I/O card with
2 Analog Input + 4 Analog Output channels,
the two (4-20 mA) Sensor Inputs are mapped
from channels 1 and 2 into channels 5 and 6.
For example, if the card is installed in the third
I/O slot, the register address mapping is:
Analog Output 3-1: x2305 to x2340
Analog Output 3-2: x2341 to x2376
Analog Output 3-3: x2377 to x2412
Analog Output 3-4: x2413 to x2448
Sensor Input 3-1: x2449 to x2484
Sensor Input 3-2: x2485 to x2520
x0685 x0720
x0721 x0756
x0757 x0792
x0793 x0828
x0829 x0864
x0865 x0900
12
See 5.3.4 Digital Input Address Maps
W900 Controller – I/O Channel Address Map
Object
Starting Address
Ending Address
Type-Specific Address Maps
Virtual Input 1
x5761
x5796
Virtual Input 2
x5797
x5832
Virtual Input 3
Virtual Input 4
Virtual Input 5
Virtual Input 6
Virtual Input 7
Virtual Input 8
Relay Output 1
Relay Output 2
x8965
x9000
Relay Output 3
x9001
x9036
Relay Output 4
x9037
x9072
Relay Output 5
Relay Output 6
Relay Output 7
Relay Output 8
x9181
x9144
Analog Output 1-1
Analog Output 1-2
Analog Output 1-3
Analog Output 1-4
x1261
x1296
Analog Output 2-1
x1729
x1764
Analog Output 2-2
x1765
x1800
Analog Output 2-3
x1801
x1836
Analog Output 2-4
Analog Output 3-1
Analog Output 3-2
Analog Output 3-3
Analog Output 3-4
Analog Output 4-1
Analog Output 4-2
x2917
x2952
Analog Output 4-3
x2953
x2988
Analog Output 4-4
x2989
x3024
Control Output 1
Control Output 2
Control Output 3
Control Output 4
Control Output 5
Control Output 6
Control Output 7
x7129
x7164
Control Output 8
x7165
x7200
x5833 x5868
x5869 x5904
x5905 x5940
x5941 x5976
x5977 x6012
x6013 x6048
x8929 x8964
See 5.3.5 Virtual Input Address Maps
x9073 x9108
x9109 x9144
x9145 x9180
x1153 x1188
x1189 x1224
x1225 x1260
x1837 x1872
x2305 x2340
x2341 x2376
x2377 x2412
x2413 x2448
x2881 x2916
See 5.3.6 Relay Output Address Maps
Or
5.3.7 Pulse Relay Output Address Maps
See 5.3.8 Analog Output Address Maps
x6913 x6948
x6949 x6984
x6985 x7020
x7021 x7056
x7057 x7092
x7093 x7128
See 5.3.6 Relay Output Address Maps
Or
5.3.7 Pulse Relay Output Address Maps
Note: Control Outputs share address maps
and alarm bitfields with Relay control modes
13
5.2.3 Alternate Address Maps
Primary Value; Status
Calibration Required
DI State; Interlock State
Low, High Alarms
Primary Value; Status
Alarm Bitfield
Relay State
Alarm Bitfield
Output Percent
Alarm Bitfield
Output State
Alarm Bitfield
Scenario #1: I/O Slot 2 Not Populated
Scenario #2: I/O Slot 2 Populated
Channel
Address
Alternate
Address
Channel
Address
Alternate
Address
I/O Slot 1: Dual Sensor Input Card
I/O Slot 1: Dual Sensor Input Card
Sensor Input 1-1
x1153
Sensor 1
x9217
Sensor Input 1-1
x1153
Sensor 1
x9217
Sensor Input 1-2
x1189
Sensor 2
x9219
Sensor Input 1-2
x1189
Sensor 2
x9219
Sensor Input 1-3
x1225
Sensor 3
x9221
Sensor Input 1-3
x1225
Sensor 3
x9221
Sensor Input 1-4
x1261
Sensor 4
x9223
Sensor Input 1-4
x1261
Sensor 4
x9223
I/O Slot 2: Not Populated
I/O Slot 2: Single Sensor Input Card
Sensor Input 2-1
x1729
Sensor 5
x9225
Sensor Input 2-2
x1765
Sensor 6
x9227
I/O Slot 3: Dual Analog Input Card
I/O Slot 3: Dual Analog Input Card
Sensor Input 3-1
x2305
Sensor 5
x9225
Sensor Input 3-1
x2305
Sensor 7
x9229
Sensor Input 3-2
x2341
Sensor 6
x9227
Sensor Input 3-2
x2341
Sensor 8
x9231
The I/O Address Maps in the previous sections are based on the hardware position/slot within the
controller. Alternate Address Maps use software-based, dynamic addressing to provide a more efficient
way to access similar data from different objects. Using these address tables, the same field type is
accessible using consecutive addresses. For example, the primary values for all sensors installed in the
controller can be accessed in a single Modbus FC4 request/response cycle starting at address 39217.
I/O Type Available Objects Type-Specific Alternate Address Map
Sensor Inputs
Digital Inputs
Virtual Inputs
Relay Outputs
Analog Outputs
Control Outputs
Alarm Bitfield
Low, High Alarms
LoLo, HiHi Alarms
Total Time
Flowrate;
Pulse Output Percent
Flow Total
Alarm Bitfield
Time On;
Time On; Status
Output Percent
Time On;
Status
Status
See 5.3.9.1 Alternate Sensor Input / Temperature Input /
Analog Input Address Map
See 5.3.9.2 Alternate Digital Input Address Map
See 5.3.9.3 Alternate Virtual Input Address Map
See 5.3.9.4 Alternate Relay Output Address Map
See 5.3.9.5 Alternate Analog Output Address Map
See 5.3.9.6 Alternate Control Output Address Map
Note that changing I/O card locations can affect the address used to access individual objects. For
example, if a W900 is configured with a Dual SI card in slot 1 and a Dual AI card in slot 3, the alternate
address mappings for the primary values are different if a Single SI card is inserted into slot 2:
14
5.3 Type-Specific Address Maps
System Address Map
Address
Name
Data Encoding
Permissions
Value
0
1
2
Controller Firmware
Version
3
4
5
6
Controller Processor
Temperature
7
8
Network Card
Temperature
9
10
Digital Input Card
Temperature (W900 Only)
11
12
13
14
15
16
I/O Card 3 Temperature
(W900 Only)
17
18
I/O Card 4 Temperature
(W900 Only)
19
20
21
22
23
24
25
26
27
28
29
30
31
32
+12 V Supply
(W900 Only)
33
34
35
Alarm Bitfield
16-Bit Bitfield
Read
See 5.5.1 System Alarm Bitfield
5.3.1 System Address Map
Controller Time 32-Bit Integer Read Unix Time
32-Bit Float Read
Date of Last Data Log 32-Bit Integer Read Unix Time
32-Bit Float Read °C
32-Bit Float Read °C
32-Bit Float Read °C
I/O Card 1 Temperature 32-Bit Float Read °C
I/O Card 2 Temperature 32-Bit Float Read °C
32-Bit Float Read °C
32-Bit Float Read °C
Battery Power 32-Bit Float Read Volt
+3.3 V Supply 32-Bit Float Read Volt
+5 V Supply 32-Bit Float Read Volt
32-Bit Float Read Volt
15
5.3.2 Network Address Map
Network Address Map
Address
Name
Data Encoding
Permissions
Value
0
1
2
VTouch Last
Configuration Time
3
4
5
VTouch LiveConnect
Status
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
WiFi Channel
(W900 Only)
23
WiFi Security
(W900 Only)
25
WiFi Status (W900 Only)
16-Bit Status
Read
See 5.4 Status Register Codes
Begin Temporary
(W900 Only)
27
28
29
30
31
32
33
34
See 5.5.2 Network Alarm
Bitfield
VTouch Last Data Time 32-Bit Integer Read Unix Time
VTouch Refresh Rate 32-Bit Float Read/Write 1 – 1440 Minutes
32-Bit Integer Read Unix Time
24
6
WiFi Signal Strength
(W900 Only)
WiFi RSSI
(W900 Only)
16-Bit Status Read See 5.4 Status Register Codes
32-Bit Float Read -30 – -100 dBm
32-Bit Float Read 0 – 100%
32-Bit Float Read 1 – 14
16-Bit Status Read See 5.4 Status Register Codes
26
Ad-Hoc Mode Session
Ad-Hoc Mode Time Limit
35 Alarm Bitfield 16-Bit Bitfield Read
(W900 Only)
Boolean Read/Write
32-Bit Float Read/Write
16
Write 1 to Begin Temporary
Ad-Hoc Mode Session
1 – 1440 minutes
5.3.3 Sensor Input Address Maps
Sensor Input (all types except Analog Input Flowmeter) Address Map
Address
Name
Data Encoding
Permissions
Value
0
1
Cond: µS/cm before ATC
Temperature: Ω
Corrosion Rate: mpy (Mild Steel)
Imbalance
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Low Alarm
Boolean
Read
1 = Alarm Active
29
High Alarm
Boolean
Read
1 = Alarm Active
30
LoLo Alarm
Boolean
Read
1 = Alarm Active
31
HiHi Alarm
Boolean
Read
1 = Alarm Active
32
Cal Required
Boolean
Read
1 = Alarm Active
33
Input Failure
Boolean
Read
1 = Alarm Active
34
Status
16-Bit Status
Read
See 5.4 Status Register Codes
35
Alarm Bitfield
16-Bit Bitfield
Read
See 5.5.3 Sensor Input Alarm Bitfield
5.3.3.1 Sensor Input (all types except Analog Input Flowmeter) Address Map
Primary Value 32-Bit Float Read Sensor Units
2
Active, Cu/Ni: mV
4-20 mA Input: mA
Primary Raw Value 32-Bit Float Read
3
Imbalance: Corrosion Rate
Last Calibration Date 32-Bit Integer Read Unix Time
Deadband 32-Bit Float Read/Write Sensor Units
Smoothing Factor 32-Bit Float Read/Write 0 – 90%
LoLo Alarm Setpoint 32-Bit Float Read/Write Sensor Units
Low Alarm Setpoint 32-Bit Float Read/Write Sensor Units
High Alarm Setpoint 32-Bit Float Read/Write Sensor Units
HiHi Alarm Setpoint 32-Bit Float Read/Write Sensor Units
17
5.3.3.2 Analog Input Flowmeter Address Map
Analog Input Flowmeter Address Map (W900 Controller Only)
Address
Name
Data Encoding
Permissions
Value
0
Flow Units
Rate Units
1
2
3
4
5
6
7
8
9
10
Flow Units
Rate Units
11
12
13
14
15
16
17
18
Rate Units
19
20
Flow Units
Rate Units
21
22
23
24
25
Reset Total Flow
Boolean
Read/Write
Write 1 to Reset Flow Total
26
27
28
Low Alarm
Boolean
Read
1 = Alarm Active
29
High Alarm
Boolean
Read
1 = Alarm Active
30
LoLo Alarm
Boolean
Read
1 = Alarm Active
31
HiHi Alarm
Boolean
Read
1 = Alarm Active
32
Cal Required
Boolean
Read
1 = Alarm Active
33
Input Failure
Boolean
Read
1 = Alarm Active
34
Status
16-Bit Status
Read
See 5.4 Status Register Codes
35
Alarm Bitfield
16-Bit Bitfield
Read
See 5.5.3 Sensor Input Alarm Bitfield
Primary Value 32-Bit Float Read
Primary Raw Value 32-Bit Float Read mA
Last Calibration Date 32-Bit Integer Read Unix Time
Flow Total 32-Bit Float Read Flow Units
Input Filter 32-Bit Float Read/Write mA
Deadband 32-Bit Float Read/Write
Smoothing Factor 32-Bit Float Read/Write 0 – 90%
LoLo Alarm Setpoint 32-Bit Float Read/Write
Low Alarm Setpoint 32-Bit Float Read/Write
High Alarm Setpoint 32-Bit Float Read/Write
HiHi Alarm Setpoint 32-Bit Float Read/Write
Flow Units
Rate Units
Flow Units
Rate Units
Flow Units
18
5.3.4 Digital Input Address Maps
Digital Input / DI State Type Address Map
Address
Name
Data Encoding
Permissions
Value
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
Reset Total Time
Boolean
Read/Write
Write 1 to Reset Time
33
DI State
Boolean
Read
0 = Open, 1 = Closed
0 = Inactive
1 = Active Interlock
See 5.5.4 Digital Input Alarm Bitfield
Returns 1 if any alarm is active
5.3.4.1 Digital Input / DI State Type Address Map
Last Reset Date 32-Bit Integer Read Unix Time
Total Time 32-Bit Integer Read Seconds
Cycle Time 32-Bit Integer Read Seconds
34 Interlock State Boolean Read
35 Alarm Bitfield 16-Bit Bitfield Read
When accessed as a Coil,
19
5.3.4.2 Digital Input / Contacting Flow Meter Type Address Map
Digital Input / Contacting Flow Meter Address Map
Data
Encoding
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
Reset Total Flow
Boolean
Read/Write
Write 1 to Reset Flow Total
33
34
See 5.5.4 Digital Input Alarm Bitfield
Returns 1 if any alarm is active
Address Name
Last Reset Date 32-Bit Integer Read Unix Time
Total Flow 32-Bit Float Read Flow Units
Total Flow Alarm
Setpoint
Permissions Value
32-Bit Float Read/Write
0 – 1,000,000,000
Flow Units
35 Alarm Bitfield 16-Bit Bitfield Read
When accessed as a Coil,
20
Loading...