Greystone Energy - CDD CO2 Detector Modbus Implementation Specification

CO2 Detector Modbus Implementation Specification

1

OverviewThis document describes the implementation of the Modbus protocol used in the CO2 detector. It is intended toassist control system programmers who may need to add support to their systems to communicate with these CO2detectors. The CO2 detectors communicate on standard Modbus networks using either RTU or ASCII modetransmission. The CO2 detectors operate as slave devices (address from 01 to 32). They expect a Modbus masterdevice to transmit queries, which they will answer.

RTU mode message formatModbus framing 8 bit binary

Data bits

start bits --- 1data bits --- 8parity bits --- none, odd or evenstop bits --- 1or 2

Baud rate 300, 600, 1200, 2400, 4800, 9600 or 19200Duplex Half duplex

Error checkingCyclical Redundancy Check (CRC)CRC-16 --- polynomial x16+x15+x2+x0 0x8005 or reversed version 0xA001or CRC-CITT --- polynomial x16+x12+x5+x0 0x1021 or reversed version 0x8408

Latency More than 3.5 characters --- minimum, 50, 100, 150, 200, 250, 300 or 350 mS

ASCII mode message formatModbus framing ASCII characters 0…9, A…F

Data bits

start bits --- 1data bits --- 7parity bits --- none, odd or evenstop bits --- 1or 2

Baud rate 300, 600, 1200, 2400, 4800, 9600 or 19200

Duplex Half duplex

Error checking Longitudinal Redundancy Check (LRC)

Latency More than 3.5 characters --- minimum, 50, 100, 150, 200, 250, 300 or 350 mS

Framing supported and bit sequencesStart 1 2 3 4 5 6 7 8 StopStart 1 2 3 4 5 6 7 8 Stop StopStart 1 2 3 4 5 6 7 8 Odd Stop

RTUmode

Start 1 2 3 4 5 6 7 8 Even StopStart 1 2 3 4 5 6 7 Stop StopStart 1 2 3 4 5 6 7 Odd StopStart 1 2 3 4 5 6 7 Odd Stop StopStart 1 2 3 4 5 6 7 Even Stop

ASCIImode

Start 1 2 3 4 5 6 7 Even Stop Stop


2

Function codes (RTU mode)

0x01 --- Read coil statusQuery

Slaveaddress

(0x01 to 0x20)

Functioncode

(0x01)

StartingaddressMSB *

Startingaddress

LSB

Quantityof coilsMSB *

Quantityof coils

LSB

CRCLSB

CRCMSB

* Starting address = 0x0000 to 0xFFFF, Quantity of coils = 0x0000 to 0x7D0

Response

Slaveaddress

(0x01 to 0x20)

Functioncode

(0x01)

Bytecount

N*

Coil statusMSB

…Coil status

LSBCRCLSB

CRCMSB

* N= Quantity of coils /8 or Quantity of coils /8 +1 (if the remainder is not 0)

0x03 --- Read holding registersQuery

Slaveaddress

(0x01 to 0x20)

Functioncode

(0x03)


Startingaddress

LSB

Quantityof registers

MSB *


LSB

CRCLSB

CRCMSB

* Starting address = 0x0000 to 0xFFFF, Quantity of registers = 0x0000 to 0x7D

ResponseSlave

address(0x01 to 0x20)

Functioncode

(0x03)

Bytecount2N *

RegistervalueMSB

RegistervalueLSB

…CRCLSB

CRCMSB

* N= Quantity of registers

0x06 --- Write single registerQuery

Slaveaddress

(0x01 to 0x20)

Functioncode0x06

RegisteraddressMSB *

Registeraddress

LSB

Registervalue

MSB *

RegistervalueLSB

CRCLSB

CRCMSB

* Register address = 0x0000 to 0xFFFF, Registers value = 0x0000 to 0xFFFF

ResponseSlave

address(0x01 to 0x20)

Functioncode0x06


Registeraddress

LSB

Registervalue

MSB *

RegistervalueLSB

CRCLSB

CRCMSB

Exception response

Slave address(0x01 to 0x20)

Functioncode + 0x80

Exception code *0x01, 0x02, 0x03 or 0x04

CRCLSB

CRCMSB

* An exception response is only returned if the CRC is correct Exception code 01 --- illegal function, 02 --- illegal address, 03 --- illegal data value


3

Note: Currently, the only function codes supported are shown below:

0x03 --- Read CO2 PPMQuery


0x03 0x00 0x01 0x00 0x01CRCLSB

CRCMSB

Response

Slave address(0x01 to 0x20) 0x03 0x02

Register valueMSB (PPM)

Register valueLSB (PPM)

CRCLSB

CRCMSB

0x06 --- Write single register (OUT_LOW)Query


0x06 0x00 0x02 0x00Register value

LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0013, corresponding to 0 - 950 PPM

Response



LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0013, corresponding to 0 - 950 PPM

0x06 --- Write single register (OUT_HIGH)Query



LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x001B, corresponding to 1000 - 10,000 PPM

Response



LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x001B, corresponding to 0 – 10,000 PPM

0x06 --- Write single register (TRIP_SET)Query



LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0036, corresponding to 500 – 10,000 PPM

Response



LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0036, corresponding to 500 – 10,000 PPM


4

0x06 --- Write single register (HYST_SET)Query


0x06 0x00 0x050x00 Register value

LSB *CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0007, corresponding to 25 – 200 PPM

Response

Slave address(0x01 to 0x20) 0x06 0x00 0x05 0x00

Register valueLSB *

CRCLSB

CRCMSB

* Register value = 0x0000 to 0x0007, corresponding to 25 – 200 PPM

Function codes (ASCII mode)

0x01 --- Read coil statusQuery

Startcharacter(:) 0x3A

Slave address0x01 to 0x20MSB (0x30)

Slave address0x01 to 0x20

LSB

Functioncode (0x01)MSB (0x30)

Functioncode (0x01)LSB (0x31)


Startaddr

Startaddr

Startingaddress

LSB

Quantityof coilsMSB *

Quantityof coils

Quantityof coils

Quantityof coils

LSB

LRCMSB

LRCLSB

Return-line feed(CRLF)0x0D

Return-line feed(CRLF)0x0A

* Starting address = 0x0000 to 0xFFFF, Quantity of coils = 0x0000 to 0x7D0

Response

Start character(:) 0x3A

Slave address(0x01 to 0x20)MSB (0x30)


LSB



Byte countN *

MSB

Byte countN

LSB

Coil statusMSB

…Coil status

LSBLRCMSB

LRCLSB

Return-line feed(CRLF)0x0D

Return-line feed(CRLF)0x0A

* N = Quantity of coils /8 or Quantity of coils /8 +1 (if the remainder is not 0)

0x03 --- Read holding registersQuery




LSB




Startingaddress

Startingaddress

Startingaddress

LSB


MSB *

Quantityof

registers

Quantityof

registers


LSB

LRCMSB

LRCLSB

Return-linefeed (CRLF)

0x0D


0x0A

* Starting address = 0x0000 to 0xFFFF, Quantity of registers = 0x0000 to 0x7D

ResponseStart

character (:)0x3A



LSB



Bytecount

MSB *

BytecountLSB

Registervalue MSB

(PPM)

Registervalue

(PPM)

Registervalue

(PPM)

Registervalue LSB

(PPM)

LRCMSB

LRCLSB


0x0D


0x0A* N= Quantity of registers


5

0x06 --- Write single registerQuery




LSB

FunctionCode (0x01)MSB (0x30)

FunctionCode (0x01)LSB (0x36)


Regaddr

Regaddr

Registeraddress

LSB

RegistervalueMSB

Registervalue

Registervalue

RegistervalueLSB

LRCMSB

LRCLSB

Return-line feed(CRLF) 0x0D

Return-line feed(CRLF) 0x0A

* Register address = 0x0000 to 0xFFFF, Registers value = 0x0000 to 0xFFFF

Response




LSB

FunctionCode (0x01)MSB (0x30)

FunctionCode (0x01)LSB (0x36)


Regaddr

Regaddr

Registeraddress

LSB

RegistervalueMSB

Registervalue

Registervalue

RegistervalueLSB

LRCMSB

LRCLSB



Exception responseStart

character (:)0x3A



LSB

FunctionCode + 0x80

MSB

FunctionCode + 0x80

LSB

Exception code *0x01, 0x02, 0x03or 0x04 (0x30)

Exception code *0x01, 0x02, 0x03 or 0x04

(0x31, 0x32, 0x33 or 0x34)

LRCMSB

LRCLSB



* An exception response is only returned if the LRC is correct Exception code 01 --- illegal function, 02 --- illegal address, 03 --- illegal data value

Note: Currently, the only function codes supported are shown below:

0x03 --- Read CO2 PPMQuery

0x3ASlave address

(0x01 to 0x20)MSB (0x30)


LSB0x30 0x33 0x30 0x30 0x30 0x31

0x30 0x30 0x30 0x31LRCMSB

LRCLSB

0x0D 0x0A

Response

0x3ASlave address(0x01 to 0x20)MSB (0x30)


LSB0x30 0x33 0x30 0x32

Register valueMSB (PPM)

Register value(PPM)

Register value(PPM)

Register valueLSB (PPM)

LRCMSB

LRCLSB

0x0D 0x0A


6

0x06 --- Write single register (OUT_LOW)Query

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x32

0x30 0x30 Register valueRegister value

LSBLRCMSB

LRCLSB

0x0D 0x0A

Response

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x32


LSBLRCMSB

LRCLSB

0x0D 0x0A

0x06 --- Write single register (OUT_HIGH)Query

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x33


LSBLRCMSB

LRCLSB 0x0D 0x0A

Response

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x33


LSBLRCMSB

LRCLSB 0x0D 0x0A

0x06 --- Write single register (TRIP_SET)Query

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x34


LSBLRCMSB

LRCLSB

0x0D 0x0A

Response

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x34


LSBLRCMSB

LRCLSB

0x0D 0x0A


7

0x06 --- Write single register (HYST_SET)Query

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x35


LSBLRCMSB

LRCLSB

0x0D 0x0A

Response

0x3ASlave address

(0x01 to 0x20)MSB


LSB0x30 0x36 0x30 0x30 0x30 0x35


LSBLRCMSB

LRCLSB

0x0D 0x0A

Modbus Register addressing

Modbusaddress

Typicaloffset Units

Datatype Access Notes

40001 +0 Bit RUnsigned 16-bit integer

Bit0 1= CO2 in normal status, 0 = in abnormal statusBit1-15 unused

40002 +1 PPM WORD RUnsigned 16-bit integer

CO2 value

40003 +2 WORD WUnsigned 16-bit integerOUT_LOW = 0 to 0x13

ZERO = 50 * (OUT_LOW) = 0 to 950 PPM

40004 +3 WORD W

Unsigned 16-bit integerOUT_HIGH = 0 to 0x1B

SPAN = 1000 + 50 * (OUT_HIGH) = 1000 to 1500 PPMwhile OUT_HIGH = 0 to 0x0A

or1500 + 500 * (OUT_HIGH – 0x0A) = 2000 to 10000 PPM

while OUT_HIGH = 0x0B to 0x1B

40005 +4 WORD W

Unsigned 16-bit integerTRIP_SET = 0 to 0x36

TRIP = 500 + 50 * (TRIP_SET) = 500 to 1500 PPMwhile TRIP_SET = 0 to 0x14

or1500 + 250 * (TRIP_SET – 0x14) = 1750 to 10,000 PPM

while OUT_HIGH = 0x15 to 0x36

40006 +5 WORD WUnsigned 16-bit integerHYST_SET = 0 to 0x07

HYST = 25 * (1+HYST_SET) = 25 to 200

Documents

Greystone Energy - CDD CO2 Detector Modbus Implementation Specification