Modbus Protocol: 1. Realisation

Modbus protocol
1. Realisation
The realisation of a Modbus RTU slave – protocol part is made with the elements
• MIB (Multi-Interface-Board)
• C7000AT
These elements act in Modbus-BMS connections as gateway for Stulz controllers downstream. The gateway
currently gathers the necessary data point information of the controllers to be visualized. For the realised
Modbus read commands
• 1, Read Coil Status
• 2, Read Input Status
• 3, Read Holding Register
• 4, Read Input Register
the gateway sends the requested data point information, resp. with the write commands
• 5, Force Single Coil
• 16, Write Multiple Register
data point modifications are possible, where a write access is permitted. The function
• 8, Loopback Test
allows a simple connection and configuration test.
1.1 Restrictions
C7000AT:
Caused by the cache memory size, 50 data points per C7000IOC can maximally be provided.
2. Function description
Here follows a description of the realisation of selected Modbus functions. Only the Modbus variant RTU, as
Modbus slave is put into practice.
The data point information of the addressed Stulz controllers is provided in the MIB/C7000AT which act as
a gateway. Whereas the MIB provides constantly all data point values of the available Modbus data point
lists, the C7000AT takes into account which data points are requested in order to not currently update un-
necessarily many data points.
For this the C7000AT must pass a learning cycle, when Modbus-BMS requests occur for the first time and im-
mediate responses will not yet be sent. Repeated Modbus-BMS requests may then be answered at once.
2.1 Realised functions

The Modbus RTU realisation is presented here by the gateway MIB or C7000AT, the basic difference of which
consists of the rigid assignment of certain Modbus functions to digital and analogous in- and outputs on the
MIB (for historical reasons) whereas the realisation with the C7000AT is more flexible. Here a difference is
made only between registers and bits so that the functions 1 and 2 as 3 and 4 may cover the same data
point range.
This difference is only determined in the data point list of a Stulz controller and may be disregarded in the
following function description.
The commands for request and response consist of hexadecimal characters.
By the global unit address of the Stulz controllers, the global address of C7000IOCs resp. the CPU address
of former generations of Stulz controllers is meant.
EN/03.2010/Modbus/1
2.1.1 Read Coil Status (0x01) / Read Input Status (0x02)
Function 1 is historically determined to binary outputs, whereas function 2 is used for binary inputs. Block
requests are possible.
The character strings for these commands only differ by the transmitted function code and therefore they
are explained together.
Master Slave
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd 11.stDP-
dp addr.
Adr. count crc
unit adr.: global address of the addressed stulz controller, 1 Byte

cmd: read function (0x01/0x02) for binary data points, 1 Byte
1st dp addr.: 1st Bit data point address of a block request with the length count, 2 Bytes
count: 1 – 256 Bit data points in a block request, 2 Bytes
crc: checksum serves for the data safety, 2 Bytes
The number count of Bit data points will be read blockwise from the 1st dp addr. .
Slave Master
Byte Nr. 0 1 2 3 ..bytes+2 bytes+3 bytes+4

unit adr. cmd bytes data crc

cmd: read function (0x01/0x02) for binary data points, 1 Byte
bytes: bytes = (count + 7) / 8 data bytes will follow, 1 Byte
data: 8 Bits are transmitted encoded in a Byte (see below), bytes
The number count of the read data points is transmitted in bytes = (count + 7) / 8 Bytes. The order of the
Bit data points to be transmitted within the 1st data Byte is as follows:
MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 LSB

8th bit 7th bit 6th bit 5th bit 4th bit 3rd bit 2nd bit 1st bit
for ex.: 0x0B = 0000.1011

MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 LSB
8th bit 7th bit 6th bit 5th bit 4th bit 3rd bit 2nd bit 1st bit
0 0 0 0 1 0 1 1
This Bit order repeats itself in every further necessary Byte in the same way. For this, the Bit counting order
begins by 9 at the LSB in the 2nd data Byte.
EN/03.2010/Modbus/2
Example 1:
Reception: -> 01r 01r 00r 02r 00r 02r 1Cr 0Br r = receive
0x01: Global address of the controller
0x01: Function „Read Coil Status“
0x0002: 1st data point address (block beginning)
0x0002: 2 consecutive Bit data points requested blockwise
0x1C0B: Checksum
Response: <- 01t 01t 01t 02t D0t 49t t = transmit

0x01: Function „Read Coil Status“
0x01: 1 data Byte follows
0x02 = 0000 0010 1st requested Bit data point = „0, False“
2nd requested Bit data point = „1, True“
0xD049: Checksum
Example 2:
Reception: -> 01r 02r 00r 00r 00r 03r 38r 0Br r = receive
0x02: Function „Read Input Status“
0x0003: 3 consecutive Bit data points requested blockwise
0x380B: Checksum
Response: <- 01t 02t 01t 00t A1t 88t t = transmit

0x02: Function „Read Input Status“
0x01: 1 data Byte follows
0x00 = 0000 0000 1st requested Bit data point = „0, False“
2nd requested Bit data point = „0, False“
3rd requested Bit data point = „0, False“
0xA188: Checksum
EN/03.2010/Modbus/3
2.1.2 Read Holding Register (0x03) / Read input Register (0x04)
Function 3 is used for analogous outputs and internal variables, whereas function 4 is historically determined
to analogous inputs. Block requests are possible.
The character strings for these commands only differ by the transmitted function code and therefore they
are explained together.
These functions have in common that the read data points are exclusively of the type Real/Float, encoded as
IEEE754 (32Bit , 4Byte, 2 words). The order of the two Words of each data point can be generally adjusted
(chapter 3).
A conversion of IEEE754 encoded values can be found with the following link:
http://babbage.cs.qc.edu/IEEE-754/32bit.html
Master Slave
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd 1st1.dp addr.
DP- Adr. count crc

cmd: read function (0x03/0x04) for analogous data points, 1 Byte
1. dp addr.: 1st data point address of a block request with the length count, 2 Bytes
count: 2 – 128 Words: 1 – 64 analogous data points in a block request, 2 Bytes
The number n = (count / 2) of analogous real data points out of 2 Words each (4 Bytes) are read as data
point block beginning from 1st dp addr. .
Slave Master
Byte Nr. 0 1 2 3 ..bytes+2 bytes+3 bytes+4

unit adr. cmd bytes data crc

cmd: read function (0x03/0x04) for analogous data points, 1 Byte
bytes: bytes = 2 * count data Bytes will follow, 1 Byte
data: n = (count / 2) IEEE754 data (standard setting: MSB first), bytes
The number n = (count / 2) of the read real data points in the format IEEE754 are transmitted by bytes =
2 * count Bytes.
EN/03.2010/Modbus/4
Example 1:
Reception: -> 01r 03r 00r 00r 00r 02r C4r 0Br r = receive
0x03: Function „Read Input Register“
0x0000: 1st data point address
0x0002: 1 data point (2 Words) requested
0xC40B: Checksum
Response: <- 01t 03t 04t 41t B4t 00t 00t AEt 29t t = transmit
0x04: 4 data Bytes follow
0x41B4 0000 1st requested data point = 22,5 (conversion)
0xAE29: Checksum
Example 2:
Reception: -> 01r 04r 00r 00r 00r 04r F1r C9r r = receive
0x0004: 2 consecutive data points (4 Words) requested blockwise
0xF1C9: Checksum
Response: <- 01t 04t 08t 41t D0t 00t 00t 42t 45t 99t 9At DFt AAt t = transmit
0x41D0 0000 1st requested data point = 26 (conversion)
0x4245 999A 2nd requested data point = 49,4 (conversion)
0xDFAA: Checksum
EN/03.2010/Modbus/5
2.1.3 Force Single Coil (0x05)
By function 5 single binary data points can be modified.

Master Slave
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd dp addr.
DP- Adr. value crc
unit addr.: global address of the addressed stulz controller, 1 Byte
cmd: write function (0x05) for binary data points, 1 Byte
dp addr.: the Bit data point address to be described, 2 Bytes
value: the binary date 0 / 1 is transmitted as 0x0000 / 0xFF00 value, 2 Bytes
The data value is written to data point address dp addr..
Slave Master
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd dpDP-
addr.
Adr. value crc
The acknowledgement resonse of the Stulz unit is identical with the write command.
Example 1:
Reception: -> 01r 05r 00r 00r FFr 00r 8Cr 3Ar r = receive
0x05: Function “Force Single Coil“
0x0000: Data point address
⌆≘≙
0xFF00: Write value; 0xFF00 ≙ 1
0x8C3A: Checksum
Response: <- 01t 05t 00t 00t FFt 00t 8Ct 3At t = transmit
0xFF00: Write value; 0xFF00 ≙ 1
0x8C3A: Checksum
Example 2:
Reception: -> 01r 05r 00r 00r 00r 00r CDr CAr r = receive
0x0000: Write value; 0x0000 ≙ 0
0xCDCA: Checksum
Response: <- 01t 05t 00t 00t 00t 00t CDt CAt t = transmit
0x0000: Write value; 0x0000 ≙ 0
0xCDCA: Checksum
EN/03.2010/Modbus/6
2.1.4 Write Multiple Register (0x10)
Function 16 (hexadecimal 0x10) is used to write analogous Stulz data points, which are encoded as IEEE754
values (32Bit , 4Byte, 2 Words) .
As a Modbus Register consists generally of a Word, a Stulz – data point access is already a multiple access
(2 Words) at an even Modbus address (0, 2, 4, …). The order of the two Words of each data point can be
generally adjusted (chapter 3).
The realisation with the Stulz gateway only allows the writing of exactly 2 Words, i.e. 1 Stulz data point.
Master Slave
Byte Nr. 0 1 2 3 4 5 6 7..11 12 13
DP- Adr. words bytes data crc

cmd: write function (0x10) for exactly one analogous data point, 1 Byte
dp addr.: data point address for the write access, 2 Bytes
words: number of Words to be written is always 2, 2 Bytes
bytes: number of consecutive data Bytes is always 4, 1 Byte
data: IEEE754 date (standard setting: MSB first), 4 Bytes
The analogous date data (2 Words) is written to the even address dp addr..
Slave Master
Byte Nr. 0 1 2 3 4 5 6 7..11 12 13
DP- Adr. words bytes data crc

cmd: write function (0x10) for exactly one analogous data point, 1 Byte
dp addr.: data point address for the write access, 2 Bytes
words: number of Words to be written is always 2, 2 Bytes
The first part of the write command is returned with a new checksum as acknowledgement of the writing
process.
Example 1:
Reception: -> 01r 10r 00r 00r 00r 02r 04r 41r B0r 00r 00r E6r 74r r = receive
0x0002: 1 data point (2 Words) will be written
0x41B0 0000 datapoint to be written = 22,0 (conversion)
0xE674: Checksum
Response: <- 01t 10t 00t 00t 00t 02t 41t C8t t = transmit
0x0002: 1 data point (2 Words) is written
0x41C8: Checksum
EN/03.2010/Modbus/7
2.1.5 Loopback Test (0x08)
By function 8 a connection and configuration test can be made.
Master Slave
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd diag code value crc
cmd: test function (0x08), 1 Byte
diag code: any, 2 Bytes
value: any, 2 Bytes
Slave Master
Byte Nr. 0 1 2 3 4 5 6 7
unit adr. cmd diag code value crc
With this connection test the test command is returned unmodified as an echo.
Example:
Reception: -> 01r 08r 00r 00r 00r 02r A1r A6r r = receive
0x08: Function “Loopback Test“
0x0000: Diag code
0x0203: Diag value
0xA16A: Checksum
Response: <--> 01r 08r 00r 00r 00r 02r A1r A6r t = transmit
0x08: Function “Loopback Test“
0x0000: Diag code
0x0203: Diag value
0xA16A: Checksum
EN/03.2010/Modbus/8
2.1.6 Modbus error messages
If an error occurs at a data point access, the error telegram consists for all Modbus functions of the following
elements:
Slave Master
Byte Nr. 0 1 2 3 4 5
unit adr. err id err code crc
unit adr.: global address of the Stulz controller, which indicates the error, 1 Byte
err id: the cmd from the Master->Slave command + 0x80, 1 Byte
err code: indicates the cause of malfunction, 1 Byte
An exception is formed by the "Loopback Test". In case of error no response will be returned for this function.
The error recognition err id in the 2nd Byte of an error telegram can look like this:
err id cmd Modbus function

Funktion
0x81 0x01 Read Coil Status
0x82 0x02 Read input Status
0x83 0x03 Read Holding Register
0x84 0x04 Read Input Register
0x85 0x05 Write Single Coil
--- 0x08 Loopback Test
0x90 0x10 Write Multiple Register
The following error codes are supported:
err code Modbus Error Code Explanation

1 MODBUS_ILL_FUNCTION The requested Modbus function is not supported.
2 MODBUS_ILL_ADDRESS Address and data type do not match in the data point list.
3 MODBUS_ILL_VALUE The write value is out of the valid range.
The unit can not be reached, an error has occurred. The cache
4 MODBUS_DEVICE_FAIL
memory may be exceeded.
The unit can not provide an acknowledgement or the data at
6 MODBUS_DEVICE_BUSY
once. A new request is necessary.
10 MODBUS_ILL_ACCESS The data point access is not allowed.
EN/03.2010/Modbus/9
3. Settings for activation
To enable the Modbus protocol the following command is available at the service interface.
• protocol modbus
C7000AT-Menu: AT-Icon -> BMS -> Protocol -> MODBUS
Concerning the protocol modbus selected above, you can choose among three data point lists in the
C7000AT:
• dplist classic
• dplist full
• dplist custom
C7000AT-Menu: AT-Icon -> BMS-> DP-List -> CLASSIC

FULLSIZE
CUSTOM
The connection to a BMS can be carried out via RS232 or RS485.
• port rs232
• port rs485
C7000AT-Menu: AT-Icon -> BMS -> Port -> RS232

RS485
Under certain circumstances the setting of the data word order for ieee754 encoded analogous data points
may be important (see chap. 2.1.2, chap. 2.1.4). The data word order can begin either with the MSB or the
LSB. The standard setting is MSB.
• ieee msb
• ieee lsb
The following baudrates are available:
57600, 38400, 19200, 14400, 9600, 7200, 4800, 3600, 2400, 1200, 600, 300
We disadvise to modify further settings of the serial interface. The standard settings are:
• baudrate 9600
• flowcontrol off
• databits 8
• stopbits 1
• parity none
EN/03.2010/Modbus/10
4. Data point lists
The construction of the Modbus data point lists is explaned here in extracts.
For the data point access a combination of Modbus address and Modbus function is decisive.
Modbus data point addresses begin at 0.
The addresses for analogous data points are exclusively even addresses, as they always consists of 2 Words
and are of the type Real/Floating Point, IEEE754 encoded (32Bit, 4Byte).
The access possibilities on data points are indicated as follows:
• r = Read only
• w = Write only
• rw = Read and Write
Besides the data point description you find important information to the indicated valid range.
Whereas the C7000AT can only be used as gateway for the BMS connection of C7000IO controllers, with
the MIB board Stulz controllers of former generations can be used.
The following data point lists can actually be selected:
4.1 Modbus Classic

MIB:
For historical reason the rigid assignment of certain Modbus functions to digital and analogous in- and outputs
for the gateway function of the MIB is still valid. That's why the data point list consists of four single lists.
• Digital outputs, Modbus functions 1, 5

• Digital inputs, Modbus function 2
• Analogous outputs, Modbus functionen 3, 16
• Analogous inputs, Modbus function 4
C7000AT:
On the basis of the concise number of datapoints of former controllers, this data point list has been created
with quite a similar scope. The rigid assignment of in- and outputs and functions has been omitted.
The data point list is arranged according to Modbus functions and data point addresses.
4.2 Modbus Fullsize (C7000AT) / Modbus (MIB)

MIB:
For Stulz controllers of previous generations the "Modbus" -data point list corresponds to the "Modbus
Classic“ data point list.
For C7000IOCs this list can be freely configured in each C7000IO controller. This possiblity should only be
taken into consideration in agreement with the technical support in Hamburg.
C7000AT:
This data point list allows the BMS access to many unit parameters of the C7000IOC.
4.3 Modbus Custom (only C7000AT)

The customized data point list assumes a special place in the C7000AT. It is not determined, but is configured
according to the customer's need as a selection out of the complete data point list "Modbus Fullsize“, which
has the advantage of updating the complete controller image of a C7000IOC in the BMS by few data point
block accesses (ideally 2).
4.3.1 Function description
The customized data point list Modbus Custom obtains shorter update times in customer installations for
C7000 sytems consisting of C7000AT and C7000IOC. Only the data points which are important for the cus-
tomer are configured into a customized data point list and can be read out all in one block.
The data point list configured this way is safe in the C7000AT even at power failures.
Only in case of a software update resp. exchange of hardware of the corresponding C7000AT, the configu-
ration must be carried out again.
4.3.2 Configuration and start-up

Following the steps to configure and start up the C7000AT with the example of the BMS protocol Modbus
RTU are listed.
You can also save the complete configuration as a text file and have it automatically send by the C7000
service program, button „Configuration“ (, resp. the program C7000-Config.exe) to the C7000AT.
4.3.2.1 Preparing the computer

1. Establish terminal connection between computer and C7000AT (Service port X4). An appropriate
serial interface must be present at the computer (RS232), or must be realized by an USB adap-
tor.
A terminal connection ("C7000-Service.exe“) must be established via this serial interface. The
selection "Interface Port“ in the C7000 service program must correspond to the assigned port
number in the computer (see system control of the PC).
4.3.2.2 Protocol settings at the C7000AT

2. Settings in menu item C7000AT->BMS
(or commands at the C7000AT service interface)
Port: RS232
RS485
(via service interface, e.g.: port rs485)
Protocol: MODBUS
(via service interface: protokoll modbus)
Data point list: CUSTOM
(via service interface: dplist custom)
Baudrate: 9600
(via service interface: baudrate 9600)
4.3.2.3 Data point configuration

The following 2 step 3+4 must be repeated for all C7000IOC in the IO-bus.
3. Deleting the existing customized data point list for a C7000IOC by means of the IO-bus address.
Using the IO-bus address 32, all 32 data point lists are deleted.
via service interface: cacheclear <IO-bus address>

e.g.: cacheclear 1
4. Data point configuration for a C7000IOC by means of the IO-bus address. Stulz data point addres-
ses (not Modbus data point addresses) are only configured, if the data point list "custom“ has been
adjusted.
The Stulz data point addresses are in the first column of the newest data point list „STULZ_udpl_
141_modbus.pdf“.
The individually configured data points or data point blocks are attached in the customized data
point list. Notice, that Bit data points as any other data point types must be arranged blockwise.
via service interface:

cacheconf <IO-bus addr.> <Stulz-DP-addr.> <number of data points>
e.g.: ;first all Bit data points
cacheconf 1 1013 1 (unit on/off)
cacheconf 1 1010 1 (common alarm)
cacheconf 1 1000 1 (PC stop)
;then all register data points

cacheconf 1 1170 1 (Temperature according to control type)
cacheconf 1 1173 1 (Setpoint temperature according to control type)
cacheconf 1 1174 1 (Setpoint humidity according to control type)
The two data point blocks for Bits and register can be read out blockwise from address 0 by the
Modbus RTU BMS.
e.g. Bit data points are:

Address Designation Access function
0 Unit on/off 1, 2
1 Common alarm 1, 2
2 PC-stop 1, 2, 5
z.B. Register data points are:

Address Designation Access function
0 Temperature according to control type 3, 4
2 Setpoint temperature according to control type 3, 4, 16
4 Setpoint humidity according to control type 3, 4, 16
All register data point are of the type Real/Float (IEEE 754).
5. Final saving of the configuration in the permanent memory. The command below saves the con-
figuration. The process should not be delayed by further entries. You must wait 10 minutes, until
cutting the C7000AT from the power supply.
via service interface: cachesave
4.3.2.4 Checking the configuration
6. The result of the previous configuration steps can be checked by the command „cache“.
via service interface: cache
Me 00:> cache
Cache usage overview on IO-Bus:

--------------------------------
unit dps
---- -----
1 6
An overview of the unit data point lists arranged according to the IO-bus addresses of the C7000IOC
is edited.
The command also contains the possibilty to view each data point list in detail.
via service interface: cache <IO-bus address>
Me 00:> cache 1
Cache for unit 1:

pos. adr* value state
---- ----- ------ -----
0 1013 1. 0xCD
---- ----- ------ -----
1 1010 1. 0xCD
---- ----- ------ -----
2 1000 0. 0xCD
---- ----- ------ -----
0 1170 384. 0xCD
---- ----- ------ -----
2 1173 220. 0xCD
4 1174 220. 0xCD
*internal Stulz addresses
4.3.2.5 Test of the data point list
7. To test the configured customized data point list the BMS simulation program C7000-Service can
be used.
Now it is possible to update the complete data point list of a unit by 2 block requests in the Modbus
RTU – BMS.
1. Block request of all Bit data points from address 0

2. Block request of all register data points from address 0
additionally:
All Bit data points (number i) of all C7000IOCs (number n) connected at the C7000AT can be
read as one single Bit block. For this the BMS request must be directed to the unit with the lowest
IO-bus address and must have the size x = i*n.
The Bit data points must be identified by the BMS due to their position within the block and be
assigned the right controller.
This also works for register data points in principle, however the response of the destination unit
will then be very long. Per data point 4 Bytes are reserved in the response. The advantage is quickly
qualified this way as for smaller systems not too many requests will be necessary anyway.
If the admissible maximum size for a response is exceeded an error message is edited instead.
4.3.3 Result
The result is the possibility to update all data points of a C7000IO controller by 2 requests maximum (1 Bit
block and 1 register block).
A realistic eample:
i = 10 Bit data points/unit
j = 10 Register data points/unit
n=8 C7000IOC units in the IO bus
With this example, up to 18 requests per controller can be avoided (2 requests instead of 20, if previously
no block formation was possible).
In total, the refresh cycle for the complete IO bus (8 controllers) is reduced to 16 requests this way (instead
of up to 160).
Note:
If all Bit data points (number i) of all C7000IOC (number n) connected at the C7000AT are read out com-
monly as a single Bit block, the size of this Bit block is: x = i * n
x= i*n = 80 data points (of all units) in one Modbus request.
The refresh cycle would be reduced this way to 9 requests for the whole IO bus (8 controllers).
4.3.4 Restrictions
Caused by the cache memory size, 50 data points per C7000IOC can maximally be provided.
4.3.5 Appendix
Here you see the settings which have previously been made in this document as an example. This confi-
guration can be used as it is. The same configuration for another C7000IOC with the IO bus address 2 is
attached additionally.
To use this configuration the text must be saved into a file,
e.g. Config1.txt
, which can automatically configure the C7000AT by means of the C7000 service program.
Contents of Config1.txt:
;Configuration record for automatic reuse of manually entered commands.

;Only command lines completed by <enter> are recorded.
;You may want to edit this file to correct typos or to add more commands.
;Commands may be commented out by character ‚;‘. This allows to give structure to the configuration.
;
; dummy
port rs485
; ------------------------------------------------------------------
; Settings for the BMS interface
;
port rs485
;
protocol modbus
;
; necessary setting for a successful configuration
dplist custom
;
baudrate 9600
; ------------------------------------------------------------------
; deleting all data point lists
cacheclear 32
;
; ------------------------------------------------------------------
; configuration for C7000IOC with IO bus address 1
; Bit block
;
; unit on/off
cacheconf 1 1013 1
;
; common alarm
cacheconf 1 1010 1
;
; PC-stop
cacheconf 1 1000 1
;
; --------------
; Register block
;
; Temperature according to control mode
cacheconf 1 1170 1
;
; Setpoint temperature according to control mode
cacheconf 1 1173 1
;
; Setpoint humidity according to control mode
cacheconf 1 1174 1
;
; ------------------------------------------------------------------
; Configuration for C7000IOC with IO bus address 2
; Bit block
cacheconf 2 1013 1
cacheconf 2 1010 1
cacheconf 2 1000 1
;
; --------------
; Register block
cacheconf 2 1170 1
cacheconf 2 1173 1
cacheconf 2 1174 1
;
; ------------------------------------------------------------------
; Overview of all configured data point lists
cache
;
; ------------------------------------------------------------------
; Saving the configuration in the permanent memory
cachesave
5. Response times of the Stulz Gateway
1. dependent on the number of requested data points
Way of connection at the

request:
2. dependent on the number of requested controllers

request:
Response times of the Stulz Gateway

request:
2. dependent on the number of requested controllers

request:
Response times of the Stulz Gateway

request:
2. Comparison of the DP-lists

- dependent on the number of requested controllers
Data point list:

Modbus Protocol: 1. Realisation

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Modbus Protocol: 1. Realisation

Uploaded by

Copyright:

Available Formats

Modbus protocol

2.1 Realised functions

The commands for request and response consist of hexadecimal characters.

unit adr.: global address of the addressed stulz controller, 1 Byte

Byte Nr. 0 1 2 3 ..bytes+2 bytes+3 bytes+4

unit adr.: global address of the addressed stulz controller, 1 Byte

MSB Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 LSB

for ex.: 0x0B = 0000.1011

Response: <- 01t 01t 01t 02t D0t 49t t = transmit

Response: <- 01t 02t 01t 00t A1t 88t t = transmit

unit adr.: global address of the addressed stulz controller, 1 Byte

Byte Nr. 0 1 2 3 ..bytes+2 bytes+3 bytes+4

unit adr.: global address of the addressed stulz controller, 1 Byte

By function 5 single binary data points can be modiﬁed.

The data value is written to data point address dp addr..

unit addr.: global address of the addressed stulz controller, 1 Byte

unit addr.: global address of the addressed stulz controller, 1 Byte

By function 8 a connection and conﬁguration test can be made.

err id cmd Modbus function

The following error codes are supported:

err code Modbus Error Code Explanation

C7000AT-Menu: AT-Icon -> BMS -> Protocol -> MODBUS

C7000AT-Menu: AT-Icon -> BMS-> DP-List -> CLASSIC

The connection to a BMS can be carried out via RS232 or RS485.

C7000AT-Menu: AT-Icon -> BMS -> Port -> RS232

The following baudrates are available:

4.1 Modbus Classic

• Digital outputs, Modbus functions 1, 5

4.2 Modbus Fullsize (C7000AT) / Modbus (MIB)

4.3 Modbus Custom (only C7000AT)

4.3.2 Conﬁguration and start-up

4.3.2.1 Preparing the computer

4.3.2.2 Protocol settings at the C7000AT

(via service interface: protokoll modbus)

Data point list: CUSTOM

(via service interface: dplist custom)

4.3.2.3 Data point conﬁguration

via service interface: cacheclear <IO-bus address>

via service interface:

;then all register data points

e.g. Bit data points are:

z.B. Register data points are:

via service interface: cachesave

via service interface: cache

Cache usage overview on IO-Bus:

via service interface: cache <IO-bus address>

Cache for unit 1:

*internal Stulz addresses

1. Block request of all Bit data points from address 0

x= i*n = 80 data points (of all units) in one Modbus request.

To use this conﬁguration the text must be saved into a ﬁle,

;Conﬁguration record for automatic reuse of manually entered commands.

1. dependent on the number of requested data points

Way of connection at the

2. dependent on the number of requested controllers

Way of connection at the

1. dependent on the number of requested data points

Way of connection at the

2. dependent on the number of requested controllers

Way of connection at the

1. dependent on the number of requested data points

Way of connection at the

2. Comparison of the DP-lists