m2000 Users Manual

7/31/2019 m2000 Users Manual

1/75

Users Manual

M2000

Web to Wireless to ModbusCommunication System

M2M Communications CorporationBoise Research Center

12554 W. Bridger

Boise, ID 83713208 947 9500

[email protected]

Last revision: November 2007


2/75

M2M Communications 2 M2000 Users Manual

Table of Contents

Introduction ________________________________________________________________ 4

Operation is Very Simple ______________________________________________________ 5

How it Works _______________________________________________________________ 5

Modbus Communication______________________________________________________ 6 Intelligent Modbus Master _______________________________________________________ 6 Intelligent Modbus Slave ________________________________________________________ 6 Web-to-Wireless Modem ________________________________________________________ 6

Automatic Analysis and Reporting _____________________________________________ 7 Monitoring Modbus I/O Points ____________________________________________________ 7 Monitoring Analog Values from Modbus Registers_____________________________________ 7 Monitoring Bit Packed Modbus Registers ____________________________________________ 8 Writing to Modbus Devices _______________________________________________________ 9

Web-to-Wireless Modem _____________________________________________________ 10

Reporting to the M2M Web Server _____________________________________________ 11 Time Scheduled Reports _______________________________________________________ 11 Reports on Request ___________________________________________________________ 11

Getting Started ____________________________________________________________ 12 Tech Support ________________________________________________________________ 12

The M2000 Local Configuration Program _______________________________________ 13 Connecting the M2000 to a PC __________________________________________________ 13 Installing the Local Programmer on your PC ________________________________________ 13

Local Programmer Overview __________________________________________________ 13 File Menu ___________________________________________________________________ 14 Edit menu ___________________________________________________________________ 14 Device Tasks ________________________________________________________________ 15 View Menu __________________________________________________________________ 16 Help Menu __________________________________________________________________ 16

Editing the Operating Parameters ______________________________________________ 16 Read I/O points_______________________________________________________________ 16 Read Analog Registers _________________________________________________________ 18 Read Bit Packed Registers ______________________________________________________ 20 Write Registers for M2000 Master devices ________________________________________ 22 Time Scheduled Reports _______________________________________________________ 24 Configuration ________________________________________________________________ 25

Power Mode __________________________________________________ 25

Daily Call Limit ________________________________________________ 25Modbus Settings _______________________________________________ 26Master / Slave Selection _________________________________________ 26M2000 Master Polling Frequency __________________________________ 26Report RSSI to Modbus Register __________________________________ 27Cellular Channel Selection _______________________________________ 27

M2000 Slave Mode Commands _______________________________________________ 28 An Explanation of Addressing in the M2000 Slave ____________________________________ 29


3/75


M2000 Slave Mode Command Summary ________________________________________ 30

Sending & Receiving Data with the Web-to-Wireless Slave Modem ____________________ 31 Load Transmit Data into the M2000 _______________________________________________ 31 Send Transmit Data to the Web Server ____________________________________________ 34 Read Transmit Data from the M2000 ______________________________________________ 36 Read Transmit Result Code _____________________________________________________ 38 Read RSSI __________________________________________________________________ 39 Read M2000 Status ___________________________________________________________ 40 Read Data Received from the Web Server _________________________________________ 41 Clear Received Data Memory ___________________________________________________ 44

Writing Data to the Intelligent M2000 Slave for Automatic Analysis and Reporting _________ 46 Write Digital I/O Data to the M2000 _______________________________________________ 46 Write Register Data to the M2000 ________________________________________________ 47 Write Bit Packed Register Data to the M2000 _______________________________________ 50 Send I/O, Register, or Bit Packed Registers to the Web Server __________________________ 52

Exception Messages from the M2000 Slave ______________________________________ 54

Installing the M2000 ________________________________________________________ 57 Selecting an installation location _________________________________________________ 57 Testing the Receiver Strength ___________________________________________________ 57 Troubleshooting Tips __________________________________________________________ 58 Connecting to Modbus with RS232 _______________________________________________ 59 Connecting to Modbus with RS485 _______________________________________________ 59 Modbus Data Comm Setup _____________________________________________________ 60

RTU mode ___________________________________________________ 60ASCII mode __________________________________________________ 61

Troubleshooting the Modbus Connection ___________________________________________ 61

M2M Network Operation Center _______________________________________________ 62

Using the Web Site _________________________________________________________ 64 Logging In ___________________________________________________________________ 64 Viewing Monitored Inputs _______________________________________________________ 64 Device Setup ________________________________________________________________ 64 User Notifications by Voice or E-Mail ______________________________________________ 65 Inbound Voice Report: 1-877-747-9500 ___________________________________________ 67 Device Activity Log ____________________________________________________________ 67 Send Commands from the Web Server to the M2000 _________________________________ 67 Create Custom Commands _____________________________________________________ 69 Data Exporting _______________________________________________________________ 70

Miscellaneous Operational Details ____________________________________________ 70 LED Indicators _______________________________________________________________ 70 Daily Call Limits ______________________________________________________________ 72 Cellular Carrier Requirements ___________________________________________________ 72 Retry Algorithm _______________________________________________________________ 73

Hardware Specifications _____________________________________________________ 74 Antenna ____________________________________________________________________ 74 Cellular Radio ________________________________________________________________ 74 Power Supply / Enclosure Options ________________________________________________ 74 CPU / Memory _______________________________________________________________ 75 Environmental Considerations ___________________________________________________ 75 Part Numbers ________________________________________________________________ 75


4/75


Introduction

The M2M Wireless Communicator is a web-to-wireless remote monitoring and communicationsystem. Its internal GSM cellular modem provides two-way communications to the automatedM2M operations center and the www.m2mcomm.com web site. The GSM cellular networkprovides very wide spread coverage throughout North America with no requirement for a localcellular account. The small size and low cost make it suitable for a wide variety of generalmonitoring applications.

This users manual covers the M2000, which belongs to a family of several models:

M2000 Monitors and controls other Intelligent Electronic Devices (IEDs) using aModbus communication port.

M2500 Directly monitors 10 digital inputs, which can be configured as alarms, counters,or counter/timers. There is no Modbus port.

M2510 Combines both Monitor and control other Intelligent Electronic Devices (IEDs)using a Modbus port and monitor 10 direct connect digital inputs.

M3000 Directly monitors 10 digital inputs and 3 analog inputs. Controls 3 relay outputs.There is no Modbus port.

The models M2500, M2510, and M3000 are covered in separate manuals.


5/75


Operation is Very Simple

1. Set up the register values and I/O points to be read from and written to the Modbus device.

2. Connect the M2M Communicator to the device(s) to be monitored and turn it on.

3. The M2000 will automatically establish two-way communications over the public cellularnetwork to the www.m2mcomm.com web site.

4. Log onto your private page on the web site to:

View the last reported status of your equipment switch positions, diagnosticinformation, tank levels, temperature, pressure, number of pulses received.

Request an up-to-date report from the unit.

Configure selected events to trigger an immediate user notification by voice phone or E-mail.

5. Or Dial in to a toll-free number from any telephone to hear the status of your equipment.

How it Works

When an M2000 makes a call from anywhere in North America (where there is GSM cellularcoverage), it is recognized locally as a roaming cell phone. As a part of the standard roamingregistration protocol, the local cellular network automatically passes the module's identificationnumbers and data to the central cellular hub. The M2M module transmits your data in a normally

non-utilized data field. This technique allows the transmission of an identification number andthe time and date, plus 25 digits of customer specific data, all at a very low cost. At the M2Mnetwork operations center, the data is validated and processed for distribution to the end user.In addition, configuration and control information can be sent from the web server to the M2000.

This is called cellular control channel communications. The primary advantages of this methodare low cost and wide spread coverage throughout North America. The disadvantage is that thecustomer specific data packet is relatively small -- 25 digits per transmission. The controlchannel is best suited for applications that send a relatively small amount of data infrequently.

The M2000 maximizes the potential of the control channel technology by internallytesting the data from monitored devices and only transmitting data to the web server

when a reportable event occurs. Reports are only generated when:

A monitored register value or I/O point reaches a setpoint or limit, or

A time scheduled report is due, or

A report is requested from the web site


6/75


Modbus Communication

The M2000 communicates directly with Intelligent Electronic Devices (IED) such asProgrammable Logic Controllers, measuring instruments, annunciators, and displays.

The M2000 includes both a RS232 and a RS485 serial port and communicates using thestandard Modbus protocol.

Data passed to the M2000 will be wirelessly transmitted to the www.m2comm.com web sitewhere it can be stored, interpreted and displayed, or forwarded to another location.

The M2000 has three basic modes of communication with the IED:

Intelligent Modbus Master

As an intelligent Modbus Master, the M2000 polls and reads data from specified addressesin Modbus slave devices. It then compares this data to customer-defined setpoints andautomatically reports when a specified condition exists or when one of the limits is

exceeded.

Intelligent Modbus Slave

As an intelligent Modbus Slave, the M2000 is configured to receive commands and datafrom a Modbus Master device. The M2000 will then compare the data to customer-definedsetpoints and automatically report when a specified condition exists or when one of thelimits is exceeded.

The primary difference between the Intelligent Modbus Master and Intelligent Modbus Slaveis in how the transfer of data is initiated. Once the data is inside the M2000, it is analyzedand reported in the same way.

Web-to-Wireless Modem

In the Web-to-Wireless Slave Modem mode, the M2000 can be used as a completelyflexible wireless modbus-to-cellular-to-web communication system, much like a simplemodem. A Modbus Master device can load data into the M2000 and issue a transmitcommand. The M2000 does not analyze or format this data; it simply transmits the data toand from the web server.

When the M2000 is configured as a slave device, it can be used in both the:(1) Intelligent mode for automatic analysis and reporting and(2) Web-to-Wireless modem mode.

There are specific commands that are used for each mode and they do not conflict with eachother. For example, some data values can be loaded into the M2000 to be monitored andtested, while other data can be directly transmitted to the web server without further processingor interpretation.


7/75


Automatic Analysis and Reporting

When the M2000 is used as an Intelligent Master or Slave, there are three types of data that canbe transferred to the M2000 for automatic analysis and alarm reporting.

Monitoring Modbus I/O Points

The M2000 can monitor up to twelve digital inputs or outputs that have been read from Modbusdevices. If configured as a Master device, the M2000 will repeatedly read the requested pointsat a specified polling rate of every 1-240 seconds. As a slave, the M2000 will receive the datapoints from a Modbus Master device.

When an I/O point changes, and a specified alarm condition exists, the device will report theevent to the M2M Network Operation Center.

Alarm conditions can be specified for each digital point and can be defined as an openclose,closeopen or both. A separate and independent trigger time can be specified for eachdirection, in seconds, from 1-65535.

The M2000 Master uses Modbus command 01, Read Coil Status, to read the ON/OFFstatus of discrete outputs. Outputs can be read from unit numbers ranging from 1-32 andaddresses of 00001-09999.

The M2000 Master uses Modbus command 02, Read Input Status, to read the ON/OFFstatus of discrete inputs. Inputs can be read from unit numbers ranging from 1-32 andaddresses of 10001-19999.

The Modbus Master device uses Modbus command 05, Force Single Coil to write theON/OFF status of discrete inputs or outputs to the M2000 Slave.

Monitoring Analog Values from Modbus Registers

The M2000 can monitor up to twenty 16-bit binary, or analog, registers from Modbus slavedevices. The Master device will repeatedly read the requested registers at a specified pollingrate of every 1-240 seconds. When a specified range change occurs, the device will report theevent to the M2M Network Operation Center.

For each register, up to three setpoints or limits can be specified plus a trigger time and a dead

band. This creates up to four operating ranges such as low, normal, high, and alarm (or cold,cool, warm, and hot, etc.). When any range change is measured for the trigger time, a reportcan be made.

The limits can be set at any value from 0-65535. Trigger times are 0-240 seconds and deadbands can be specified from 0-250.


8/75


The M2000 Master uses Modbus command 03, Read Holding Registers, to read the binarycontents of holding registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 40001-49999.

The M2000 Master uses Modbus command 04, Read Input Registers, to read the binarycontents of input registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 30001-39999.

The Modbus Master device uses Modbus command #6, Load Single Register, or #16, LoadMultiple Registers, to write up to 20 values to the M2000 Slave.

Monitoring Bit Packed Modbus Registers

The M2000 can monitor up to four bit-packed holding registers from Modbus slave devices. TheMaster device will repeatedly read the requested registers at a specified polling rate of every 1-240 seconds. When a specified alarm condition exists, the device will report the event to theM2M Network Operation Center.

For each of the four registers, all 16 bits can be independently tested as discrete bits.

Alarm conditions can be specified for each bit and can be defined as an openclose (1 0),closeopen (0 1), or both. A separate and independent trigger time can be specified for eachdirection, in seconds, from 1-65535.

When any monitored bit change is detected for the trigger time, a report will be made.

The M2000 Master uses Modbus command 03, Read Holding Registers, to read the contents ofholding registers. Holding registers can be read from unit numbers ranging from 1-32 andaddresses of 40001-49999.

The M2000 Master uses Modbus command 04, Read Input Registers, to read the contents ofinput registers. Input registers can be read from unit numbers ranging from 1-32 and addresses of30001-39999.

A Modbus Master device uses Modbus command #6, Load Single Register, or #16, LoadMultiple Registers, to write the bit packed registers to the M2000 slave.


9/75


Writing to Modbus Devices

A M2000 Master can receive up to 20 unique data commands from the web server and thenpass them to pre-assigned holding registers or output points in a Modbus slave. Writeoperations can be one-time events based on a unique command sent from the web site, or canbe repeated continually at a specified frequency of every 1-240 seconds.

A M2000 Slave can receive up to 300 different data commands from the web server and thenpass them to a Modbus master upon request.

One-time commands are useful as remote output commands to turn a machine on or off or asconfiguration changes such as setpoint changes.

The data to be written can be predefined (with the local programming utility) as:

A fixed value of 0 or 1 to outputs in addresses 00001 to 09999, or

A fixed value of 0-65535 to holding registers in addresses 40000 to 49999, or

each piece of write data can also be read from one device or address and then written to a

specified output or holding register. If the write data is to be read from another device, there arefour ways to do it:

1) The M2000 Master uses Modbus command 01, Read Coil Status, to read the ON/OFF statusof discrete outputs. Discrete outputs can be read from unit numbers ranging from 1-32 andaddresses of 00001-09999.

2) The M2000 Master uses Modbus command 02, Read Input Status, to read the ON/OFFstatus of discrete inputs. Discrete inputs can be read from unit numbers ranging from 1-32 andaddresses of 10001-19999.

3) The M2000 Master uses Modbus command 03, Read Holding Registers, to read the binarycontents of holding registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 40001-49999.

4) The M2000 Master uses Modbus command 04, Read Input Registers, to read the binarycontents of input registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 30001-39999.

NOTE: If data is read from registers and then written to I/O points, the data in the registers mustbe equal to 0 or 1, or the slave device will reject it.

Regardless of whether the write data is fixed or dynamic, it is written in one of two ways:

1) The M2000 Master uses Modbus command 05, Force Single Coil, to set a single output to ONor OFF. Control outputs (0 or 1) can be written to unit numbers ranging from 1-32 and addressesof 00001-09999.

2) The M2000 Master uses Modbus command 06, Preset Single Register, to write to a singleholding register. Registers can be written in unit numbers ranging from 1-32 and addresses of40001-49999.


10/75


Web-to-Wireless Modem

In the Slave Modem Mode, the M2000 can be used as a completely flexible wireless modbus-to-cellular-to-web communication system, much like a simple modem.

In the slave modem mode, an intelligent modbus master such as a Personal Computer orProgrammable Logic Controller (PLC) can pass 24 digits of data to the M2000 and then tell the

M2000 to transmit that data (plus the cellular identification number and the date and time) to theweb site. The M2000 does not know or care what the data is or means; it simply passes thedata through the cellular network to the M2M Network Operations Center. At the M2M webserver, the 24 digits can be interpreted and displayed based on customer-designed rules or itcan be exported to another location.

Up to 300 unique commands or data values can also be sent to the M2000 from the M2M website. This data can be read from the M2000 by the modbus master at any time, and can be usedfor control or configuration purposes as desired.

All standard Modbus transmissions include either a LRC or CRC checksum as well as paritybits.

This guide assumes that the user has a basic knowledge of the Modus protocol, and does notattempt to explain the use of RTU and ASCII modes, parity checks, and CRC or LRC checksumgeneration. These topics are fully explained in the MODBUS Over Serial Line Specification andImplementation Guide Version 1.0 (filename: modbus_over_serial_line_V1.pdf). This file canbe downloaded from www.modbus.org or can be requested from M2M Communications techsupport.

Only Modbus RTU mode is supported by the M2000 slave mode. (ASCII mode is notsupported). Baud rate, parity, and the number of stop bits are programmable. Both RS232-DB9and RS485-RJ45 communication ports are provided.


11/75


Reporting to the M2M Web Server

The M2000 is a wireless remote monitoring device that communicates over the cellular networksusing the cellular control channel. It can transmit a report for several reasons. Some of thefeatures and reports are configurable and can be enabled or disabled by M2M and/or the user.

(1) The unit may be configured to send time scheduled status reports at a specified frequency.

(2) A report can be requested at any time from the web site.(3) When powered on, the unit will report Initial Power On, either as a registration call or a

power on call.(4) Reports will be sent when an IED register or I/O point changes to a new range.

The M2000 can send several different types of reports. The reports have been designed tomaximize the use of the data packet. Each report sends different register data as follows:

Power-On, registration, and configuration information

The range (1-4) and value (0-65535) of Registers 1-3 plus twelve I/O points (0 or 1)







The 16 bits of Bit Packed Registers 1-4

Modem Report User Defined Data

HINT: When selecting which of your Modbus registers are mapped to which M2000 registers, tryto group them according to function so that the related registers are reported together. Forexample, if a change to register #1 triggers a report, the report will include the values ofregisters 2 and 3, so use these three registers to report related information.

Time Scheduled Reports

Any or all of the reports (except the Power On call) can be time scheduled at a predefinedfrequency. Call frequencies can be set anywhere from once every hour to once every 240 hours(10 days). The factory default is disabled. Note that when this option is enabled, reports willbegin at the specified time (for example, one hour) after the unit is powered on. To scheduledaily calls at a specific time, leave this setting disabled and then schedule the time-scheduledreports to be enabled from the web site at a specific time. Daily status or heartbeat type callsshould normally be scheduled in the off-peak hours (10pm to 3am).

Reports on Request

In addition to automatic reports based on events or alarms and time-scheduled reports, you canrequest an individual report from the web site at any time. See the Send Commands function inthe web site discussion for operating details.

In the same Local Configuration Program setup screen where time scheduled reports aredefined, there is also an individual check box option to include the report in the Report All list.This is a convenient one-click command from the web site that will cause the M2000 to send allreports that are on the list.


12/75


Getting Started

Setting up your M2000 is a three-step process.

1. Configure the unit for your specific reporting requirements. Set up the unit as a Modbus

master or slave device. Specify the I/O points and registers to be monitored. Specify theconditions (limits and trigger times) to initiate automatic reports.

2. Connect to the Modbus device(s) that you want to monitor. If the M2000 is set up as aslave, configure the Master device to send the data to be monitored.

3. Set up your private page on the M2M (www.m2mcomm.com) web site. Enter descriptivelabels for the data registers or I/O points to be monitored. Set up rules that will initiateuser notifications by voice or E-mail for alarms or other important events.

This manual gives you the information you need to get set up. There are two primary sections:

Programming, installing, and using the M2000 Communicator, and

Using the M2M web site.

Tech Support

For assistance, questions, suggestions, or just to praise the product designers, feel free tocontact us. Official office hours are 8-5 Monday-Friday, although there is a very good chancethat someone helpful will be working on the weekend. The contact number is 208-947-9500.

For prompt answers by E-mail, please describe the problems carefully. The address [email protected].


13/75


The M2000 Local Configuration Program

The M2000 Communicator arrives from the factory programmed with basic default settings.Unless you are incredibly lucky, some of these settings will need to be adjusted to work properlywith your setup.

Connecting the M2000 to a PC

The upper RS232 serial port provides a connection to a Windows based PC.

Use a standard 9-pin serial cable to connect the upper RS232-DB9 connector to a PC serialport. The baud rate and other communication settings between the PC, Local Programmer andthe M2000 are predefined. The only exception is the selection of the computers COMM port.This can be selected with the File | Comm Port menu of the Local Configuration Program.

The Local Programmer can be used to create, edit and save profiles on the PC without beingconnected to the M2000. Obviously, data cannot be uploaded or downloaded to the unit until its

connected.

Installing the Local Programmer on your PC

The Local Programmer is a Visual Basic utility program that you will use to configure the M2000Communicator. It can be found in the Local Programmer directory of the CD that is included withthe M2000 and must be installed on your PC or laptop. It will then be used to create, display,edit, and save your configuration information. It can also be used to test the radio signal strengthand the connection to your Modbus device.

To install the Local Programmer, insert the M2M CD into your CD drive and run the

M2000_SETUP.EXE program that is located in the Local programmer directory. This will installthe utility on your computer. (The CD also includes useful documentation and applicationnotes.)

Local Programmer Overview

The program is a standard Windows based program. Along the top of the screen is the primarymenu. Below that are seven tabs that can be selected to display specific information. The datashown here in the main area of the screen is sample data for the Read Register window.


14/75


File Menu

The File Menu can be used to create a new profile, open a saved profile or to save a profile thatyou have edited. (A profile is a list of the programmable parameters and settings.)

It can also be used to download an entirely new Operating System to the M2000 when newfeatures are available.

It can also be used to specify the correct computer communication port or to exit the program

Edit menu

When a row in the data grid is selected, you can use the Edit menu to open the edit screen forthat row. An easier way is to just double click on the desired row to open it.


15/75


Device Tasks

The three Device Tasks under this menu heading will initiate an immediate command to aM2000, so these should be run only when connected to a powered-up unit (unless you REALLYlike watching the little hourglass).

Clear all Timers and Counters

For the M2000, clicking on this button will clear the Daily Call Count. This is useful when theunit has reached its daily maximum call limit and you wish to reset the count to zero. ThisClear Call Count command can also be sent from the web site.

Write Data to a Slave IED

This choice allows you to locally tell the M2000 Master to write data to an attached IED.Clicking this button will pop up a second screen that looks a lot like this:

Use this screen to select one or more of the 20 predefined write functions and to send themto the IED now. The actual write functions will be explained later in the Write Registersection. This screen is disabled if the M2000 is configured as a slave device.

Restore Factory Defaults

The third choice under the Device Task menu heading reloads the default profile for you. Thesame task can be accomplished with the File | New Profile selection. The new profile mustthen be downloaded to the unit using the File | Download Profile to Device.


16/75


View Menu

This selection sends an immediate request to the M2000 asking for all monitored data includingI/O data, register data, and system configuration data. The Configuration Data includes thecurrent Radio Signal Strength Indicator (RSSI). When the data is received, it will be displayedon the computer. This is very useful for locally verifying the radio signal strength and all IEDdata readings.

Help Menu

Displays the current software revision number of the utility program

Editing the Operating Parameters

There are seven tabs that are used to display and edit specific information. The basicfunctionality is the same for all of them. Open the window by clicking on the tab. A data grid for

that selection shows all of the current settings. Double click on any row to open the row forediting.

Master / Slave Mode Note: In the following screens, the addresses and unit numbers to bepolled are only used if the M2000 is configured as a Modbus master. If it is a slave, the data willbe passed from the Master to the M2000 and so there is no need to enter the addresses wherethe data is stored in the IED.

Digital Inputs

This screen is used to set up any direct connect digital inputs. Since the M2000 has no directconnect inputs, this window will be disabled.

Read I/O points

This screen shows the 12 digital inputs or outputs that can be monitored from a Modbus IED(Intelligent Electronic Device). Double click on one of the rows to open it. Use this screen toconfigure the IED reads.


17/75


The Unit # and Address represent the slave location to be polled for data by the Master Modeand they are not used if the M2000 is configured as a slave device, since the unit never polls theMaster device for data.

For Master mode devices only:

Modbus rules say that Outputs (Coil Status) are stored in memory locations 00001-09999 and Inputsare stored in 10001-19999. The M2000 master can read the status of either inputs or outputs. Eitherone will be read as a 0 or 1, where Open = 0 = Off and Closed = 1 = On.

If you request data from an address of 00001-09999, the unit will request an Output Value from the IEDslave. The actual command used is Modbus function 1.

If you enter an address of 10001-19999, it will request an Input Value from the IED. The actual

command is Modbus function 2.

The memory addresses must be selected to match those that are available in the Modbus slave.

The Unit # is the Modbus slave #. It can be set from 1-32. There is no broadcast address 0.

If the Enabled box is clicked, the address will be read and tested. If the Enabled box is notchecked, this address will not be read, tested, or reported.

(1) You can specify that a change should only be reported on open close or close open

state changes, or both, or neither.

(2) The unit will report the state of all 12 I/O points when any point changes state for longer thanthe programmable trigger time. The trigger time of each point is programmable on this screenand can be varied from a minimum of 1 second to a maximum of 65535 seconds (~ 18.2 hours).A different time can be specified for each input and each direction (open-closed and closed-open). Any change that does not remain stable for the specified trigger time will be ignored. Thefactory default trigger time is 5 seconds for both directions.


18/75


When an I/O state change occurs (open to close or close to open) for longer than the triggertime, the new condition will be reported to the web site using Report # 1. (This report reports all12 IED points plus registers 1,2,and 3.)

Entering a value in the Description field is optional and for your convenience only. It is saved onthe hard disc with the profile, but is not passed to the unit or to the web site.

Read Analog Registers

This screen shows the 20 analog registers that can be monitored from a Modbus IED. Doubleclick on one of the rows to open it. Use this screen to configure the register reads.

The Unit # and Address represent the slave location to be polled for data by the Master Modeand they are not used if the M2000 is configured as a slave device, since the unit never polls the

Master device for data.


Modbus rules say that Holding Registers are stored in locations 40001-49999 and Input Registers arestored in 30001-39999. The unit can read either type. Either one will be read as a value from 0 65535. The data read from each register may represent an actual 16-bit value such as a temperature orpressure or it may represent 16 bits of I/O data.

If you request data from an address of 40001-49999, the unit will request a Holding Register Valuefrom the IED (Modbus function 3).

If you enter an address of 30001-39999, the unit will request an Input Register Value from the IED(Modbus function 4).

The memory addresses must be selected to match those that are present in the Modbus device.

The Unit # is the slave unit #. It can be set from 1-32. There is no broadcast address 0.


19/75



There are three setpoints (limits) available for each register reading. You can enter one, two, orthree limits. If you enter only one limit, put it in limit 1. If you enter two limits, use limits 1 & 2. Anentry of 0 means that setpoint is disabled.

If the actual value read becomes equal to or greater than a setpoint, it will change into thehigher range. If it drops below a setpoint, it will be reported in the lower range. Three setpointscreates four ranges. For example, if monitoring a temperature, you might define four rangescalled cold, cool, warm, and hot. When a range change occurs for longer than the trigger time,both the new range and the new value will be reported to the web site.

SP# 1 SP# 2 SP# 3--------------------- | --------------------- | -------------------- | ---------------------

Range 1 Range 2 Range 3 Range 4Cold Cool Warm Hot

One data packet contains enough data to report all of the 12 I/O points plus three registervalues and current range.

When registers 1, 2, or 3 change range, registers 1, 2, and 3 will be reported






When registers 19 or 20 change range, registers 18, 19, and 20 will be reported

You may want to group your registers together if they have similar or related meanings to you.Then, if one of them changes, all three will be reported together.

The deadband, or hysterisis, value can be used to prevent a value form oscillating betweenranges. It is subtracted from a setpoint only when the range is decreasing.

Example: Say that setpoint #1 is 1000 and the deadband is 50. If the value is initially less than1000, the range will = 1. If the value increases to equal or above 1000, the range will change to#2 and the new value will be reported to the web site. To return to range #1, the value must dropto below 1000-50 = 950.



20/75


Read Bit Packed Registers

This screen shows the 4 bit packed registers that can be monitored from a Modbus IED. Doubleclick on one of the rows to open it. Use this screen to configure the register bit reads.

Any holding or input register can be tested as a bit-packed register. In this mode, all 16 bits canbe independently tested as discrete bits. When a bit changes, and a specified alarm conditionexists, the device will report the event to the M2M Network Operation Center.

The M2000 can test up to four bit-packed holding registers from Modbus slave devices.

The Unit # and Address represent the slave location to be polled for data by the Master Modeand they are not used if the M2000 is configured as a slave device, since the unit never polls the

Master device for data.


21/75


Alarm conditions can be specified for each bit and can be defined as an openclose (1 0),closeopen (0 1), or both. A separate and independent trigger time can be specified for eachdirection, in seconds, from 1-65535.

When any monitored bit change is detected for the trigger time, a report will be made.


The M2000 Master will repeatedly read the requested registers at a specified polling rate of every 1-240 seconds.

The M2000 uses Modbus command 03, Read Holding Registers, to read the binary contents of holdingregisters. Registers can be read from unit numbers ranging from 1-32 and addresses of 40001-49999

The memory addresses must be selected to match those that are present in the Modbus device.




When any monitored bit in any bit packed register changes, all four bit packed registers will bereported at one time.


22/75


Write Registers for M2000 Master devices

This screen shows the 20 values that can be written to a Modbus Slave. Double click on one ofthe rows to open it. Use this screen to configure the writes.

Write functions are based on predefined definitions. There are several variations.

The following screen shows how a write function can be defined to write a specific (fixed) valueto a Modbus register. This is useful for remotely controlling a slave device, or in this case,changing a Setpoint #1 to 220.

At the web site, you can create your own Custom Commands. Label each command with thesame description (that makes sense to the user) and specify the command number thatmatches the locally defined Write Function. When the command number is sent from the website, the corresponding command (the write that you have defined locally) will be sent to theslave device.


23/75


Another Example: Set up Command # 3 to: Write a value of 1 to slave unit # 4, address 0123.We will assume that this write will turn on a Pump # 5. You will assign the label Turn on Pump# 5 to Command # 3 at the web site and locally using this Write Register tab.

Modbus rules say that Single Coils (outputs) are written to locations 00001-99999 and registers

written to 40001-49999. The M2000 can write to either type of data to the IED. Outputs can bewritten as a 0 or 1. (The meaning of a 0 or 1 will be determined by the IED). Registers can bewritten as a value from 0 65535.

If you enter an address of 40001-49999, it will write a single register value to the IED(Using Modbus function 6).

If you enter an address of 00001-09999, it will write a single output to the IED(Using Modbus function 5).

In addition to writing a fixed value to a Modbus register, it is also possible to read a value fromone device or address and then write it to a specified output or holding register in another deviceor address.

This is useful for transferring data between slave devices. In some cases, the data that is beingmoved may also be used to trigger a reportable event in the M2000.

This predefined read and write operation can be remotely triggered at any time from the website (or from the Local Programmer). In addition, if the Enable Automatic Write button isclicked, the M2000 will repeatedly read and write the data at every polling time (every 1-240seconds). This results in a constantly updating operation.

If the write data is to be read from another device, there are four ways to do it:


24/75


1) The M2000 uses Modbus command 01, Read Coil Status, to read the ON/OFF status ofdiscrete outputs. Discrete outputs can be read from unit numbers ranging from 1-32 andaddresses of 00001-09999.

2) The M2000 uses Modbus command 02, Read Input Status, to read the ON/OFF status ofdiscrete inputs. Discrete inputs can be read from unit numbers ranging from 1-32 andaddresses of 10001-19999.

3) The M2000 uses Modbus command 03, Read Holding Registers, to read the binarycontents of holding registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 40001-49999.

4) The M2000 uses Modbus command 04, Read Input Registers, to read the binarycontents of input registers. Registers can be read from unit numbers ranging from 1-32 andaddresses of 30001-39999.

Regardless of whether the write data is fixed or dynamic, it is written in one of two ways:

1) The M2000 uses Modbus command 05, Force Single Coil, to set a single output to ON orOFF. Control outputs (0 or 1) can be written to unit numbers ranging from 1-32 and addressesof 00001-09999.

2) The M2000 uses Modbus command 06, Preset Single Register, to write to a singleholding register. Registers can be written in unit numbers ranging from 1-32 and addresses of40001-49999.



If the Enabled box is clicked, the address will be written to when requested. If the Enabled box isnot checked, it will not.

Time Scheduled Reports

This screen allows you to enable any of the reports (except the Power On call) as timescheduled reports. Double click on one of the rows to open the selected report. Use this screento enable the time-scheduled reports.


25/75


Checking the Include with the Report All website command will also add the report to the list ofreports that are reported with one click of the Report All button.

Any of the reports can be scheduled at a predefined frequency. When time scheduled reportsare enabled, the M2000 will call at set intervals to report its current readings, with the first call

coming at the specified amount of time after the unit is powered up. Call frequencies can be setanywhere from once every one hour to once every 240 hours (10 days). To schedule a report ata specific time of day, fill in the frequency, but leave the Enabled box unchecked and then usethe web site to initiate the first call at a specific time. All calls that follow the initial call will be atthe programmed frequency and starting at that point. Note that all daily status or heartbeat typecalls should be scheduled during the off-peak hours (10 pm to 3 am).

Configuration

This screen allows you to define the system configuration settings.

Power Mode

The M2000 always operates in the normal (always on) mode so this function is disabled.

Daily Call Limit

To reduce the number of calls that might result from over-active inputs or power cyclingconditions, the number of event-based calls per day can be limited. Time scheduled calls anduser requested status calls will continue to be placed even after this limit has been reached. Thedaily call limit should normally be selected so that the total number of calls is limited to no morethan 20 calls per day and no more than 400 calls per month. The daily limit can be set from 1 to20. The unlimited selection is for test and demo purposes only. The factory default setting is 10.


26/75


Modbus Settings

All settings that control how the M2000 communicates with Modbus device(s) are selected fromthis window. These settings must match those of the Modbus device(s) or the devices will notcommunicate.

The M2000 Master mode can communicate in either RTU or ASCII mode.

The M2000 Slave mode always operates in the RTU mode. The parity setting can be Even, Odd, or None.

The RS232 / RS485 selection chooses which serial port will be used.

The baud rate can be set to: 1200, 2400, 4800, 9600, 19200, or 38400 bps.

There are also some not-so-obvious details that should be adhered to on the Modbus device:

If RTU mode is used, the Modbus device should be set to 8 data bits and 1 start bit.

If ASCII mode is used, the Modbus device should be set to 7 data bits & 1 start bit.

If Even or Odd parity is selected, there is always 1 stop bit.

If No parity is selected, there will be normally be 2 stop bits. However, this can be set to 1stop bit if necessary

Master / Slave Selection

The M2000 can be configured as either for Master or Slave mode. This is a very significantchoice and affects many other parts of the M2000 operation.

As an intelligent Modbus Master, the M2000 polls and reads data from Modbus slave devices. Itthen compares this data to customer-defined setpoints and automatically reports when aspecified condition exists or when one of the limits is exceeded.

As an intelligent Modbus Slave, the M2000 is configured to accept commands and data from aModbus Master device. The M2000 will then compare the data to customer-defined setpointsand automatically report when a specified condition exists or when one of the limits is exceeded.

The primary difference between the Intelligent Modbus Master and Intelligent Modbus Slave isin how the transfer of data is initiated. Once the data is inside the M2000, it is analyzed andreported in the same way.

As a Master device, the M2000 supports both the RTU and the ASCII modes.As a Slave device, the M2000 supports only the RTU mode.

If Slave mode is selected, you should also specify the slave unit # address that is to be assignedto the M2000. If the master mode is selected, there is no unit #.

M2000 Master Polling Frequency

The M2000 Master can read up to 12 digital inputs or outputs and up to 20 binary and 4 bit-packed registers from Modbus slave devices. The M2000 will read the requested values at aspecified polling rate of every 1-240 seconds.


27/75


Note that there is an important relationship between the polling frequency and the selectedtrigger times. There are several ways that you can set up these two times to give undesiredresults.

(1) The IED is read only at the specified polling frequency. Changes that occur between thereadings will not be detected. If the reading is being made at a rate of once every 30 seconds, a

change lasting 5-10 seconds can easily be missed.

(2) Assume again that the IED values are read at a polling frequency of once every 30 seconds.If a trigger time is set to a lower value such as 5 seconds, the trigger time for any detectedchange will always expire 5 seconds after a reading is taken because the value is only beingtested once every 30 seconds. But in reality, the alarming value may have only existed for theone second when it was being read.

The easy and correct solution is to make the polling frequency much shorter than the triggertimes. For example, if the trigger times were set to one minute, a polling frequency of 10seconds would give you 6 readings during the testing period.

On the other hand, the trigger times should be set long enough so that all registers and I/Opoints can be read before the next read starts. If a large number of readings are being taken ata slow baud rate like 1200 bps, it can take several seconds to read them all. It is easy to watchthe bottom LED (LED3) and see that all how long all the readings are taking.

Report RSSI to Modbus Register

The M2000 Master can be configured to send the latest Radio Strength Signal Indication to aModbus slave device and address. The RSSI value will typically range from 8-40 where:

< 8 Inadequate

8-12 Weak13-16 Adequate17-24 Good25-32 Excellent> 33 Awesome

To convert the RSSI to dB, add the number to 114.

Cellular Channel Selection

The M2000 can be configured to operate on either cellular channel A or B. In addition, it can be

programmed to automatically select the correct channel for control channel operation.

If configured for auto selection, the unit will determine the proper cellular channel for operationeach time it is powered on. The process starts by sending a registration call to the M2M Commweb server on Channel B (the most commonly used channel). If the unit receives anacknowledgement from the web server, it will remain on that channel. However, if after oneminute, it has not received an acknowledgement, it will repeat the process on Channel A. Theprogram will continue to alternate channels until an acknowledgement is received. This cycle willnormally find the correct channel on the first try and will repeat only once. If it continues, the website is not receiving or responding to the units registration call.


28/75


The unit is shipped in the Automatic mode. For fixed locations, it is usually best to determine thecorrect cellular channel and set it to that. This will eliminate the cost of an ACK call at everypower on.

Clicking the Default button will restore the factory default configuration settings.

M2000 Slave Mode Commands

As a slave device, the M2000 will never attempt to poll or query a Master device for data.All data transfers are initiated by the Master device.

As an Intelligent Modbus Slave, the M2000 is configured to receive commands and data from aModbus Master device. The M2000 will then compare the data to customer-defined setpointsand automatically report when a specified condition exists or when one of the limits is exceeded.

The primary difference between the Intelligent Modbus Master and Intelligent Modbus Slave isin how the transfer of data is initiated. Once the data is inside the M2000, it is analyzed andreported in the same way.

In the Web-to-Wireless Slave Modem mode, the M2000 can be used as a completely flexiblewireless modbus-to-cellular-to-web communication system, much like a simple modem. AModbus Master device can load data into the M2000 and issue a transmit command. TheM2000 does not analyze or format this data; it simply transmits the data to and from the webserver.

When the M2000 is configured as a slave device, it can be used in both the:

(1) Intelligent mode for automatic analysis and reporting and(2) Web-to-Wireless modem mode.

There are specific commands that are used for each mode and they do not conflict with eachother. For example, some data values can be loaded into the M2000 to be monitored andtested, while other data can be directly transmitted to the web server without further processingor interpretation.

Note: Some of the data shown in the Local Configuration program is only used when in theMaster Mode.

The IED I/O, Read Register, and Read Register Bits windows include a Unit # and Address.

These are the data addresses that are to be polled by the Master Mode and are not used in theslave mode, since the unit never polls the Master device for data.

The Write Register window is used to define Write operations from the M2000 Master to slavedevices and is disabled if the M2000 is configured as a slave device.


29/75


An Explanation of Addressing in the M2000 Slave

In the world of Modbus, the address range indicates the type of data that is being used.

The M2000 slave supports several types of data and so several address ranges. The followingtable shows the relevant Modbus memory ranges and the associated data types, as well as the

equivalent addressing in the M2000:

The following values are in the decimal format.

Modbus Address Data Type M2000 Address00001 09999 Discrete Outputs 0 or 1 0 - 999810001 19999 Discrete Inputs 0 or 1 0 - 999830001 39999 Input Registers 16 bit 0 - 999840001 49999 Holding Registers 16 bit 0 - 9998

In each case, to convert the Modbus address to the M2000 address, subtract the tenthousands digit and then subtract one. For example, a Modbus address of 40002 will equal aM2000 address of: 40002 40000 1 = 0001.

This is the standard method that Modbus devices use to send addresses, so if you are using astandard Modbus PLC, controller, or other device, this conversion will probably be doneautomatically.

It may appear that the M2000 is storing several types of data at the same address, but dontworry! The function number that is used (such as 3, 5, 6, or 16) also tells the M2000 where tophysically store the data)

If you are writing a custom driver and dont care about Modbus conventions, simply send theM2000 address.


30/75


M2000 Slave Mode Command Summary

The M2000 supports several write and read functions that can be used to reliably send andreceive data to and from the www.m2mcomm.com web server.

Sending & Receiving Data with the Web-to-Wireless ModemEquivalent

M2000 Address Modbus Address

Write Functions Using Modbus Command # 6 or 16

Load Transmit Data into the M2000 00 11 40001 40012 Send Data to Web Server Now 12 40013 Clear Received Data Memory 14 40015

Read Functions Using Modbus Command # 3

Read Transmit Data from the M2000 00 11 40001 40012 Read the Transmit Result Code 12 40013 Read RSSI (Radio Signal Strength) 16 40017 Read M2000 Status 17 40018 Read Received Data 18 37 40019 40038

Automatic Analysis and Reporting Mode Commands

EquivalentWrite Functions M2000 Address Modbus Address

Write Digital I/O Data into the M2000 00 11 00001 00012for auto analysis & reporting or 10001 10012

Using Modbus Command # 5

Write Register Values into the M2000 2000 2019 42001 42020for auto analysis & reporting

Using Modbus Command # 6 or 16

Write Bit Packed Register Valuesinto the M2000 for 2020 2023 42021 42024

auto analysis & reportingUsing Modbus Command # 6 or 16

The next section explains the operation of each of these functions.


31/75


Sending & Receiving Data with the Web-to-Wireless Slave Modem

Load Transmit Data into the M2000

M2000 Address 0000 0011Modbus Address 40001 40012

The cellular modem radio always transmits 24 numerical digits. Therefore all data to betransmitted should be loaded into the M2000 as a string of 24 digits. Use this command to loadthe digits into the M2000 prior to sending them.

A digit = 0-9 only. No hex characters (A-F) or * or # are allowed

All data transmissions are 24 digits long.

The transmit data is cleared to 0 at power up.

If you have not specifically cleared or loaded all of the transmit data registers, thisfunction will send whatever was last stored in those registers.

A Modbus register is equal to 16 bits, or 2 bytes

The digits are sent to the M2000 as two digits per register (one digit per byte)

The transmit data is stored as 24 digits (in 12 registers) starting at the M2000s memoryaddress 0000 (corresponds to Modbus address 40001).

The 24 digits can be loaded in one single command or can be loaded as individual ormultiple registers (with 2 digits per register). The data can be loaded all at once or overtime as physical events occur. The data can remain in the M2000 indefinitely (but is notsaved during a power failure).

The data that has been loaded into the M2000 can be sent to the web site at anytime with the Send Transmit Data command. It can also be requested from theweb site with a single web site command or it can be set up as a time scheduled

report. As a time scheduled report, whatever is loaded into the M2000 will be sentto the web site at the specified frequency (every 1-240 hours). This data report isreferred to as Report #11 or Modem Report at the web site and in the localprogrammer utility.

The M2000s unit (slave) address can be set to any number from 1-32

Use Modbus function # 6 or 16 to write the registers to the M2000.

Example #1 of Load Transmit Data - using Modbus function 16

Pass 24 digits of data to the slave M2000 (addressed here as unit # 17 or 11 Hex)The data is string is: 123456789012345678901234There are actually 24 digits packed in 12 data registers.

Field Name Example (in hex) comments

Slave Address 11 unit # 17 in decimalFunction 10 command # 16 in decimalStarting Address Hi 00


32/75


Starting Address Lo 00No. of Registers Hi 00No. of Registers Lo 0C 12 registers in decimalByte Count 18 24 total bytes in decimalData 1 Hi 01Data 1 Lo 02Data 2 Hi 03

Data 2 Lo 04Data 3 Hi 05Data 3 Lo 06Data 4 Hi 07Data 4 Lo 08Data 5 Hi 09Data 5 Lo 00Data 6 Hi 01Data 6 Lo 02Data 7 Hi 03Data 7 Lo 04Data 8 Hi 05

Data 8 Lo 06Data 9 Hi 07Data 9 Lo 08Data 10 Hi 09Data 10 Lo 00Data 11 Hi 01Data 11 Lo 02Data 12 Hi 03Data 12 Lo 04Error Check (LRC or CRC) - - (2 bytes)

Normal Response:

Field Name Example (hex)

Slave Address 11Function 10Starting Address Hi 00Starting Address Lo 00No of Registers Hi 00No of Registers Lo 0CError Check (LRC or CRC) - - (2 bytes)

Example #2 of Load Transmit Data -- Using Modbus function 16:

Pass 4 digits of data to address 06 (Modbus address 40007) of the M2000 addressed as unit #1. The data string is: 6789


Slave Address 01 unit # 1


33/75


Function 10 command # 16 in decimalStarting Address Hi 00Starting Address Lo 06 starting address = 6No. of Registers Hi 00No. of Registers Lo 02 2 registers in decimalByte Count 04 4 total bytes in decimalData 1 Hi 06

Data 1 Lo 07Data 2 Hi 08Data 2 Lo 09Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 10Starting Address Hi 00

Starting Address Lo 06No of Registers Hi 00No of Registers Lo 02Error Check (LRC or CRC) - - (2 bytes)

Example #3 of Load Transmit Data - using Modbus function 6:

Pass one register of data to address 0001 (Modbus address 40002) of the M2000 slaveaddressed as unit # 9. The data string is 2345. Uses Modbus function 6.


Slave Address 09 unit # 9Function 06 command # 6Address Hi 00Address Lo 01 address = 0001Data Hi 23Data Lo 45Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 09Function 06Address Hi 00Address Lo 01Data Hi 23Data Lo 45Error Check (LRC or CRC) - - (2 bytes)


34/75


Send Transmit Data to the Web ServerM2000 Address 00012Modbus Address 40013

Command the M2000 to transmit the previously loaded data to the web server.

To initiate a transmission, load a value of 5A5A into register 0012, which is Modbusaddress 40013.

All data transmissions are 24 digits long. The transmit data registers are cleared to 0 atpower up. If you have not specifically loaded all of the transmit data registers, thisfunction will send whatever was last in those registers.

The M2000 slave unit address can be set to any number from 1-32

Its a good idea to check the Radio Signal Strength Indicator (RSSI) before transmitting.The unit will not transmit unless the RSSI is > 7.

The command register can be combined and loaded as a 13th register in the LoadTransmit Data function. This allows you to issue one command to load and send thedata.

Use Modbus function # 6 or 16

Example #1 of Send Transmit Data - Using Modbus function 16:

Pass the transmit command, 5A5A, to address 0012 (Modbus address 40013) of the M2000slave unit # 1.

Field Name Example (hex) Comments

Slave Address 01 Slave Unit # 1Function 10Starting Address Hi 00

Starting Address Lo 0C Starting Address 12 in decimalNo. of Registers Hi 00No. of Registers Lo 01 Write 1 registerByte Count 02 2 total bytes in decimalData Hi 5AData Lo 5AError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 10Starting Address Hi 00Starting Address Lo 0CNo. of Registers Hi 00No. of Registers Lo 01Error Check (LRC or CRC) - - (2 bytes)


35/75


Example #2 of Send Transmit Data - using Modbus function 6:

Pass the transmit command, 5A5A, to address 0012 (Modbus address 40013) of the M2000slave unit # 9.


Slave Address 09 unit # 9Function 06 command # 6Address Hi 00Address Lo 0C address = 0012Data Hi 5AData Lo 5AError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 09Function 06Address Hi 00Address Lo 0CData Hi 5AData Lo 5AError Check (LRC or CRC) - - (2 bytes)


36/75


Read Transmit Data from the M2000M2000 Address 00000 00011

Modbus Address 40001 40012

Use this command to read back the transmit data that you have previously loaded.

Digits are packed two to a register

The M2000 slave unit address can be set to any number from 1-32. Transmit Data is stored in 12 registers starting at memory address 0000, which is

Modbus address 40001.

One or more (up to 13) registers can be read using this function. Just specify the startingregister and the number of registers to be read.

The 12 registers of transmit data plus the Transmit Result Code can be read with onecommand by reading 13 registers starting at register 0000.

Use Modbus function #3 (Read Holding Registers)

Example of Read Transmit Data:

Read thirteen registers (12 registers of transmit data plus the result code) from unit # 1


Slave Address 01 Unit # 1Function 03Starting Address Hi 00Starting Address Lo 00 Starting AddressNo. of Points, Hi 00No. of Points, Lo 0D Read 13 registers (26 digits)

Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 03Byte Count 1A 26 bytes of dataData Hi (Register 40001) 01

Data Lo (Register 40001) 02Data Hi (Register 40002) 03Data Lo (Register 40002) 04Data Hi (Register 40003) 05Data Lo (Register 40003) 06Data Hi (Register 40004) 07Data Lo (Register 40004) 08Data Hi (Register 40005) 09Data Lo (Register 40005) 00Data Hi (Register 40006) 01


37/75


Data Lo (Register 40006) 02Data Hi (Register 40007) 03Data Lo (Register 40007) 04Data Hi (Register 40008) 05Data Lo (Register 40008) 06Data Hi (Register 40009) 07Data Lo (Register 40009) 08

Data Hi (Register 40010) 09Data Lo (Register 40010) 00Data Hi (Register 40011) 01Data Lo (Register 40011) 02Data Hi (Register 40012) 03Data Lo (Register 40012) 04Data Hi (Register 40013) 00 Result Code = 0Data Lo (Register 40013) 00 Result Code =0Error Check (LRC or CRC) - - (2 bytes)


38/75


Read Transmit Result CodeM2000 Address 0012Modbus Address 40013

After sending data, test the Transmit Result Code to verify a successful transmission.

The Transmit Result Code is a two digit number stored in one register at memory

address 0012 -- which is Modbus Address 40013. After transmitting data, the M2000 will change the transmit command (5A5A) to a Result

Code. This may take from 4-12 seconds depending on how long it takes for the celltower to acknowledge the transmission.

If the transmission fails, the M2000 will automatically begin a series of retries. This retryprocess can take up to 5 minutes if all the retries fail. During this time, the unit is busyand will not respond to Modbus queries.

The 12 registers of transmit data plus the Transmit Result Code can be read with onecommand by reading 13 registers starting at register 0000.


Transmit Result Codes:

Transmit Successful 0001Transmit Failed 5 times Aborted 0003Not sent - Daily Call Limit has been reached 0020Not Sent - Radio is Disabled 0021Inadequate RSSI Waiting for better signal 0023

Example of Read Transmit Result Code

Read one register # 0015 from unit # 32 (20 hex)


Slave Address 20Function 03Starting Address Hi 00Starting Address Lo 0C 12 decimalNo. of Points, Hi 00No. of Points, Lo 01Error Check (LRC or CRC) - - (2 bytes)

Normal Response: (Transmit Successful)


Slave Address 20Function 03Byte Count 02Data Hi (Register 40013) 00Data Lo (Register 40013) 01 Transmit SuccessfulError Check (LRC or CRC) - - (2 bytes)


39/75


Read RSSIM2000 Address 0016Modbus Address 40017

RSSI (Radio Signal Strength Indicator) is a two digit decimal (BCD) number stored atmemory address 0016, which is Modbus Address 40017

The Master Modbus device can read the RSSI at any time.

The RSSI number can be converted to db by adding it to 114. The meaning of the RSSIis:

There may be a time delay of up to one second before the reply message.


Example of Read RSSI



Slave Address 02Function 03Starting Address Hi 00Starting Address Lo 10 16 decimalNo. of Points, Hi 00No. of Points, Lo 01Error Check (LRC or CRC) - - (2 bytes)

Normal Response:

Assuming RSSI = 21 hex


Slave Address 02Function 03Byte Count 02Data Hi (Register 40017) 00Data Lo (Register 40017) 33 33 decimal = -81 dBError Check (LRC or CRC) - - (2 bytes)

Decimal Description Result

< 8 Inadequate Unit will not transmit8 -15 Weak Ok16-19 Adequate Ok20-27 Good Ok28-35 Excellent Ok>35 Awesome Ok


40/75


Read M2000 StatusM2000 Address 0017Modbus Address 40018

The M2000 Status Code is a two digit number stored at memory address 0017, which isModbus Address 40018

The Master Modbus device can read the Status Code at any time to determine whetheror not new data has arrived from the web site.

Reading the received data will clear it to 0.

The codes are:

00 Waiting for instructions, No new data received

02 New data has been received from the web site


Example of Read M2000 Status



Slave Address 01Function 03Starting Address Hi 00Starting Address Lo 11 17 decimalNo. of Points, Hi 00No. of Points, Lo 01Error Check (LRC or CRC) - - (2 bytes)

Normal Response:

(New data received)


Slave Address 01Function 03Byte Count 02Data Hi (Register 40018) 00Data Lo (Register 40018) 02 New data has been receivedError Check (LRC or CRC) - - (2 bytes)


41/75


Read Data Received from the Web ServerM2000 Address 0018 - 0037Modbus Address 40019 - 40038

From the M2M web server, up to 300 unique commands and data values can be sent tothe M2000 Slave device, and then passed to the Master device.

Each of these data transmissions counts as one message toward your monthly billing, sothey should be used carefully.

Each Received Data packet from the web server is a single 3-digit number ranging from100-399.

Multiple data packets can be sent as required for control or configuration purposes.

The M2000 will store the last twenty Received Data packets starting at memory location18 (Modbus 40019).

One register (two bytes) is used to hold one Received Data packet. The data is rightjustified, so the most significant nibble of the first byte will always = 0, such as 0123.

At power-up, the received data memory will be cleared to 0.

If the application expects data to be sent from the web site, the master should checkregularly for new data from the web site using the Read M2000 Status message. If thereis a new (unread) data message, the status will equal 2. Any full or partial read of thereceived data will clear the M2000 status to 0.

After the master reads the Received Data, it should issue a command to Reset theReceived Data. This will zero all 20 registers of Received Data, reset the memorypointer to the first register, and clear the M2000 status message. This is the only way toreset the pointer.

The M2000s storage buffer is filled in a circular manner. If the 20th memory locationbecomes full, the pointer will roll over to the first register so that the next Received Datawill be stored at the first register, overwriting existing data.

The M2000 slave unit address can be set to any number from 1-32.

One or more (up to 20) registers can be read using this function. Just specify the startingregister and the number of registers to be read. Any read of any data will reset theM2000 status to 0.



42/75


Example #1 of Read Received Data:

Read 20 received data packets in 20 registers # 0018-0037 from unit # 1 starting at address0018 (Modbus address 40019)


Slave Address 01Function 03Starting Address Hi 00Starting Address Lo 12 18 decimalNo. of Registers, Hi 00No. of Registers, Lo 14 20 decimalError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 03Byte Count 28 40 bytes in decimalData Hi (Register 40019) 00Data Lo (Register 40019) 01 Received Data 1 = 0001Data Hi (Register 40020) 02Data Lo (Register 40020) 03 Received Data 2 = 0203Data Hi (Register 40021) 00Data Lo (Register 40021) 04 Received Data 3 = 0004Data Hi (Register 40022) 01Data Lo (Register 40022) 06 Received Data 4 = 0106

Data Hi (Register 40023) 02Data Lo (Register 40023) 03 Received Data 5 = 0203Data Hi (Register 40024) 03Data Lo (Register 40024) 04 Received Data 6 = 0304Data Hi (Register 40025) 00Data Lo (Register 40025) 77 Received Data 7 = 0077Data Hi (Register 40026) 22Data Lo (Register 40026) 01 Received Data 8 = 0221Data Hi (Register 40027) 00Data Lo (Register 40027) 85 Received Data 9 = 0085Data Hi (Register 40028) 01Data Lo (Register 40028) 23 Received Data 10 = 0123

Data Hi (Register 40029) 01Data Lo (Register 40029) 11 Received Data 11 = 0111Data Hi (Register 40030) 02Data Lo (Register 40030) 03 Received Data 12 = 0203Data Hi (Register 40031) 00Data Lo (Register 40031) 04 Received Data 13 = 0004Data Hi (Register 40032) 01Data Lo (Register 40032) 06 Received Data 14 = 0106Data Hi (Register 40033) 00Data Lo (Register 40033) 03 Received Data 15 = 0003


43/75


Data Hi (Register 40034) 02Data Lo (Register 40034) 04 Received Data 16 = 0204Data Hi (Register 40035) 02Data Lo (Register 40035) 39 Received Data 17 = 0239Data Hi (Register 40036) 01Data Lo (Register 40036) 91 Received Data 18 = 0191Data Hi (Register 40037) 02

Data Lo (Register 40037) 15 Received Data 19 = 0215Data Hi (Register 40038) 02Data Lo (Register 40038) 45 Received Data 20 = 0245Error Check (LRC or CRC) - - (2 bytes)

Example #2 of Read Received Data:

Read 2 received data packets in 2 registers at # 0018 from unit # 1 starting at address 0018(Modbus address 40019)


Slave Address 01Function 03Starting Address Hi 00Starting Address Lo 12 18 decimalNo. of Registers, Hi 00No. of Registers, Lo 02 Read 2 registersError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 03Byte Count 04 4 bytesData Hi (Register 40019) 02Data Lo (Register 40019) 91 Received Data 1 = 0291Data Hi (Register 40020) 02Data Lo (Register 40020) 03 Received Data 2 = 0203



44/75


Clear Received Data MemoryM2000 Address 0014Modbus Address 40015

Command the M2000 to zero all Received Data registers and reset the memory pointer to thefirst register.

After the master reads a Received Data packet from the web site, it should issue acommand to Reset the Received Data. This will zero all 10 registers of Received Data,reset the memory pointer to the first register, and clear the M2000 status message.

To initiate the Reset function, load a value of 0505 into register 0014 which is Modbusaddress 40015

The M2000 slave unit address can be set to any number from 1-32

See Read Received Data for additional information on this function

Use Modbus function # 6 or 16

Example #2 of Clear Received Data: -- Using Modbus function # 16to slave unit # 19 (13 hex)


Slave Address 13 Unit # 19 in decimalFunction 10Starting Address Hi 00Starting Address Lo 0E Address = 0014No. of Registers Hi 00No. of Registers Lo 01Byte Count 02 2 total bytes in decimalData Hi 05Data Lo 05


Normal Response:


Slave Address 13Function 10Starting Address Hi 00Starting Address Lo 0ENo. of Registers Hi 00

No. of Registers Lo 01Error Check (LRC or CRC) - - (2 bytes)


45/75


Example #2 of Clear Received Data - using Modbus function 6:

Pass the Clear Data command, 0505, to address 0014 (Modbus address 40015) of the M2000slave unit # 9.


Slave Address 09 unit # 9Function 06 command # 6Address Hi 00Address Lo 0E address = 0014Data Hi 05Data Lo 05Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 09Function 06Address Hi 00Address Lo 0EData Hi 05Data Lo 05Error Check (LRC or CRC) - - (2 bytes)


46/75


Writing Data to the Intelligent M2000 Slave for Automatic Analysis and Reporting

Write Digital I/O Data to the M2000


Use this command to set or clear a single I/O bit in the M2000 for analysis and automatic alarmreporting

Up to 12 bits can be loaded into the M2000 for auto monitoring & analysis.

I/O data consists of 1-bit values, 0 or 1.

All data is cleared to 0 at power up.


Use Modbus function # 5 to write a 0 or 1 to the M2000 bit.

Sending a value of FF 00 sets one bit to 1 or ON.

Sending a value of 00 00 clears one bit to 0 or OFF.

Example of Load I/O Bits:

Set I/O bit #4 =1 in the M2000 slave addressed as unit # 1.


Slave Address 01 unit # 1Function 05 command # 5Starting Address Hi 00Starting Address Lo 03 starting address = 0003Force Data Hi FF FF00 sets the bit to 1Force Data Lo 00Error Check (LRC or CRC) - - (2 bytes)

The Normal Response is an echo of the query:


Slave Address 01 unit # 1

Function 05 command # 5Starting Address Hi 00Starting Address Lo 03 starting address = 0003Force Data Hi FF FF00 sets the bit to 1Force Data Lo 00Error Check (LRC or CRC) - - (2 bytes)


47/75


Write Register Data to the M2000


Use this command to load operational data into the M2000 registers for automatic analysis andalarm reporting

Up to 20 registers can be loaded into the M2000 for monitoring & analysis.

All register data consists of 16 bit values = two bytes. (0000-FFFF hex)



Use Modbus function # 16 to write either a single or multiple registers to the M2000.

Modbus function # 6 can be used to write a single register to the M2000.

Note that all M2000 automatic alarms have both setpoints and a trigger time. For example, theM2000 can be configured so that a range change may trigger a report if a setpoint is crossed formore than one minute. If this is the case, it would be advisable for the Master device to updatethe monitored value to the M2000 several times per minute. If you were to only update the value

say, once every 2 minutes, then every momentary change that is reported to the M2000 wouldlast more than one minute and would be reported.

Example #1 of Write Register Data -- Using Modbus function 16

Pass 20 register values (40 bytes) of data to address 2000 thru 2019 (Modbus registeraddresses 42001 thru 42020) in the slave M2000 (addressed here as unit # 17 or 11 Hex).


Slave Address 11 unit # 17 decimal

Function 10 command # 16 decimalStarting Address Hi 07 starting address = 2000Starting Address Lo D0No. of Registers Hi 00No. of Registers Lo 14 20 registersByte Count 28 40 total bytesData 1 Hi 01Data 1 Lo 2CData 2 Hi FFData 2 Lo 04Data 3 Hi 05Data 3 Lo CD

Data 4 Hi 07Data 4 Lo 08Data 5 Hi 1BData 5 Lo 00Data 6 Hi 01Data 6 Lo E2Data 7 Hi B3Data 7 Lo 04Data 8 Hi 05Data 8 Lo 06


48/75


Data 9 Hi 07Data 9 Lo 08Data 10 Hi 09Data 10 Lo 00Data 11 Hi 01Data 11 Lo 02Data 12 Hi 03

Data 12 Lo A4Data 13 Hi 05Data 13 Lo 06Data 14 Hi 07Data 14 Lo 08Data 15 Hi C9Data 15 Lo 10Data 16 Hi 1DData 16 Lo 02Data 17 Hi 03Data 17 Lo 04Data 18 Hi 05

Data 18 Lo 06Data 19 Hi 07Data 19 Lo 08Data 20 Hi 09Data 20 Lo 1FError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 11Function 10Starting Address Hi 07Starting Address Lo D0No of Registers Hi 00No of Registers Lo 14Error Check (LRC or CRC) - - (2 bytes)

Example #2 of Write Register Data - Using Modbus function 16:

Pass 2 registers of data to address 2012 & 2013 (Modbus address 42013 & 42014) of the

M2000 slave addressed as unit # 1. The data registers are: 678A and 12B0.


Slave Address 01 unit # 1Function 10 command # 16 in decimalStarting Address Hi 07Starting Address Lo DC starting address = 2012No. of Registers Hi 00No. of Registers Lo 02 2 registers in decimal


49/75


Byte Count 04 4 total bytes in decimalData 1 Hi 67Data 1 Lo 8AData 2 Hi 12Data 2 Lo B0Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 10Starting Address Hi 07Starting Address Lo DCNo of Registers Hi 00No of Registers Lo 02Error Check (LRC or CRC) - - (2 bytes)

Example #3 of Write Register Data - using Modbus function 6:

Pass one register of data to address 2001 (Modbus address 42002) of the M2000 slaveaddressed as unit # 4. The data is 678A. Uses Modbus function 6.


Slave Address 04 unit # 4Function 06 command # 6

Starting Address Hi 07Starting Address Lo D1 starting address = 2001Data Hi 67Data Lo 8AError Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 04

Function 06Starting Address Hi 07Starting Address Lo D1Data Hi 67Data Lo 8AError Check (LRC or CRC) - - (2 bytes)


50/75


Write Bit Packed Register Data to the M2000


Use this command to load bit packed operational data into the M2000 registers for automatic

analysis and alarm reporting

Up to 4 bit packed registers can be loaded into the M2000 for analysis.

All register data consists of 16 bit values = two bytes (0000-FFFF hex)



Use Modbus function # 6 or 16 to write the registers to the M2000.

Example #1 of Write Bit Packed Register Data - Using Modbus function 16

Pass 2 registers of bit packed data to address 2020 & 2021 (Modbus address 42021 & 42022)of the M2000 slave addressed as unit # 1. The data registers are: 678A and 12B0


Slave Address 01 unit # 1Function 10 command # 16 in decimalStarting Address Hi 07Starting Address Lo E4 starting address = 2020No. of Registers Hi 00No. of Registers Lo 02 2 registers in decimalByte Count 04 4 total bytes in decimal

Data 1 Hi 67Data 1 Lo 8AData 2 Hi 12Data 2 Lo B0Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 01Function 10Starting Address Hi 07Starting Address Lo E4No of Registers Hi 00No of Registers Lo 02Error Check (LRC or CRC) - - (2 bytes)


51/75


Example #2 of Write Bit Packed Register Data - using Modbus function 6:

Pass one register of data to address 2020 (Modbus address 42021) of the M2000 slaveaddressed as unit # 7. The data is 3456. Uses Modbus function 6.


Slave Address 07 unit # 7Function 06 command # 6Starting Address Hi 07Starting Address Lo E4 starting address = 2020Data Hi 34Data Lo 56Error Check (LRC or CRC) - - (2 bytes)

Normal Response:


Slave Address 07Function 06Starting Address Hi 07Starting Address Lo E4Data Hi 34Data Lo 56Error Check (LRC or CRC) - - (2 bytes)


52/75


Send I/O, Register, or Bit Packed Registers to the Web

Documents

m2000 Users Manual