Badger Meter ModMAG M2000 User manual

®
Badger Meter Europa GmbH
ModMAG® M2000
ModBus® memory map
USER MANUAL
May 2018
MID_M2000_BA_MODBUS_02_1805

Contents
1. Overview.......................................................................................................................... 3
1.1 Write security .......................................................................................................... 3
1.2 Register name......................................................................................................... 4
1.3 Register address..................................................................................................... 4
1.4 Register type........................................................................................................... 4
1.5 Read / Write............................................................................................................ 4
1.6 FNC support............................................................................................................ 4
2. Memory maps by category............................................................................................. 6
2.1 Product identification............................................................................................... 6
2.2 Meter calibration...................................................................................................... 7
2.3 Meter measurement settings................................................................................... 7
2.4 Digital input ............................................................................................................. 8
2.5 Analog output.......................................................................................................... 8
2.6 Output #1................................................................................................................ 9
2.7 Output #2................................................................................................................ 9
2.8 Output #3...............................................................................................................10
2.9 Output #4...............................................................................................................10
2.10 Port A diagnostic counters......................................................................................11
2.11 Port B diagnostic counters......................................................................................11
2.12 Measurements .......................................................................................................12
2.13 Meter diagnostic counters ......................................................................................13
2.14 Miscellaneaous ......................................................................................................14
2.15 Verification tool support..........................................................................................14
2.16 Empty pipe.............................................................................................................14
2.17 Control commands.................................................................................................15
2.18 Security..................................................................................................................15
3. M2000 memory map by register address.....................................................................16
4. M2000 register write properties....................................................................................21
5. Troubleshooting ............................................................................................................29
6. Return of goods for repair / Harmlessness declaration..............................................30

Overview Page 3/30
MID_M2000_BA_MODBUS_02_1805
1. Overview
ModMAG®M2000 supports ModBus®RTU communications. Port A (pins 5, 6, 7) support
ModBus® RTU using RS232.The RS485 is supported as an accessory daughterboard. Verify
or configure the ModMAG® M2000 communication port B. Access the port settings at main
menu > communications > port B settings.
The tables to follow identify the ModBus®registers and attributes that exist in the ModMAG®
M2000 flow meter. Each register has attributes that are also specified in the tables.
Parameter
Value
Comments
Port address
001
Mandatory value of 001
Extended port address
-
Application specific. sets
ModBus
®
address of module
Baud rate
38400
ModBus® daughterboard
auto-bauds
Data bits
8
Mandatory value of 8
Parity
EVEN
Mandatory value of EVEN
Stop bits
1
Mandatory value of 1
1.1 Write security
Write security identifies the required security level of the register in order to be suc-
cessfully written. This attribute does not apply to the readability of the register and re-
gisters listed with admin, service or user are unprotected if the meter is not secured
(that is, admin pin is not programmed.)
•Firmware - Typically, read-only registers.This means only the flow meter firmware
has the privilege to update the register.
•Factory – Includes registers that can only be written by the factory
•Admin – Registers that require admin level access
•Service – Registers that require service level access
•User – Registers that require user level access
•None – Register is always unprotected
All registers can be protected by enabling security on the flow meter. Once the flow
meter is secured, all registers are write-protected unless remote privilege is granted.
All read accesses to registers are still accepted when the flow meter is secured.
Obtaining remote privilege for write operations requires a sequence of ModBus®
actions to take place. Remote login process is encrypted to ensure protection of the
log-in pins.
•Read the random value register (address 0x012B).
•Perform necessary calculations (contact Badger Meter for details).
•Write the remote login register (address 0x012F).
It is advised that a support application is written to perform this process and embed-
ded within the main application software used to access the flow meter.

Overview Page 4/30
MID_M2000_BA_MODBUS_02_1805
1.2 Register name
When applicable, describes the parameter so it can be associated within the display
menu items. Please note, not all registers are directly modifiable via the menu mana-
ger. Also, some registers are not accessible via the menu manager.
1.3 Register address
Register address defines the physical address that is required to be transmitted over
the ModBus®RTU serial link. Some third-party applications require the use of logical
addressing when communicating over ModBus®. The logical address determines the
ModBus®function code that is transmitted over the serial link.
Two logical address ranges are supported, 3xxxx and 4xxxx. Logical address range
3xxxx issues the read input register function code 0x04. Logical address range 4xxxx
issues the read holding register function code 0x03. All logical addresses start at in-
dex 1 (example, 30001 and 40001).
For example, suppose the application requires logical addressing and is targeting to
access the “Flow rate [User units]” register. The physical address for this register is
0xF1 or 241d. This register can be read from two different logical addresses (30242 or
40242). The logical address is calculated by adding the physical address to the logical
start address (30001 or 40001).
•30001 + 241 = 30242 (Issues function code 0x04 – Read Input Register)
•40001 + 241 = 40242 (Issues function code 0x03 – Read Holding Register)
1.4 Register type
Register type identifies the number of registers the parameter requires. Each register
is 16 bits. Supported register types include:
Register type Description
Number of
ModBus
®
registers
UCHAR16
Unsigned character (16 bits)
1
UCHAR16[x]
Unsigned character Array
X
UINT16
Unsigned integer (16 bits)
1
SINT16
Signed integer (16 bits)
1
UINT32
Unsigned integer (32 bits)
2
FLOAT32
Floating point (32 bits)
2
For FLOAT32 register types, these registers make use of IEEE-754 floating point
standard. For example, 1.0 is transmitted as 0x3F800000. ModBus®serial link will
transmit the most significant byte first, 0x3F, followed by 0x80, 0x00, 0x00.
1.5 Read / Write
The Read/Write attribute identifies if the parameter is read-only or writeable.
Parameters that are read only are specified as such, otherwise, the parameter can be
considered accessible with write commands.
1.6 FNC support
FNC support identifies the ModBus®function codes (commands) available to access
the register. Supported ModBus®function codes include:

Overview Page 5/30
MID_M2000_BA_MODBUS_02_1805
ModBus®function code
Description
0x03
Read holding register
0x04
Read input register
0x06
Preset single register (write)
0x10
Preset multiple registers (write multiple)
Important:
Write function codes are not accepted while menu navigation is in process.
Write function codes update only the working register located in volatile memory. Any
sequence of writes must be followed by a write of value 0x01 to the “Command Action
Request Register”, address 0x0125. Otherwise changes will be lost if the flow meter is
power cycled or reset.
For efficiency, it is possible with read function codes, 0x03 and 0x04, to read blocks of
registers.This allows for the ability to read multiple registers in one transmission.

Memory maps by category Page 6/30
MID_M2000_BA_MODBUS_02_1805
2. Memory maps by category
2.1 Product identification
No.
Write
security
Register name
Register
address
Register Type
Read /
Write
FNC support
1
Firmware
Product code
0x0000
UINT16
Read only
0x03, 0x04
2
Firmware
Product name
0x0001
UCHAR16[8]
Read only
0x03, 0x04
3
Firmware
Firmware name
0x0009
UCHAR16[16]
Read only
0x03, 0x04
4
Factory
Application
Version
0x0019
UCHAR16[10]
--
0x03, 0x04, 0x06,
0x10
5
Firmware
Compile date
[MM:DD:YYYY]
0x0023
UCHAR16[16]
Read only
0x03, 0x04
6
Firmware
Compline time
[HH:MM:SS]
0x0033
UCHAR16[16]
Read only
0x03, 0x04
7
Factory
PCB serial
number
0x0043
UCHAR16[5]
--
0x03, 0x04, 0x10
8
Firmware
OTP boot
checksum
0x0048
UCHAR16[3]
Read only
0x03, 0x04
9
Firmware
Flash OS
checksum
0x004B
UCHAR16[3]
Read only
0x03, 0x04
10
Firmware
Boot version
0x004E
UCHAR16[5]
Read only
0x03, 0x04
11
Firmware
OS version
0x0053
UCHAR16[4]
Read only
0x03, 0x04
12
None
Daughterboard
product type
0x0057
UINT16
Port B
0x03, 0x04, 0x06,
0x10
13
None
Daughterboard
major version
0x0058
UINT16
Port B
0x03, 0x04, 0x06,
0x10
14
None
Daughterboard
minor verion
0x0059
UINT16
Port B
0x03, 0x04, 0x06,
0x10
15
Factory
Power on splash
line 1
0x005A
UCHAR16[11]
--
0x03, 0x04, 0x06,
0x10
16
Factory
Poser on splash
line 2
0x0156
UCHAR16[11]
--
0x03, 0x04, 0x06,
0x10
17
None
Meter tag name
0x0161
UCHAR16[17]
--
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 7/30
MID_M2000_BA_MODBUS_02_1805
2.2 Meter calibration
2.3 Meter measurement settings
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
31 User Flow unit 0x0083 UINT16 --
0x03, 0x04,
0x06, 0x10
32 User Volume unit 0x0084 UINT16 --
0x03, 0x04,
0x06, 0x10
33 User Unit multiplier 0x0085 UINT16 --
0x03, 0x04,
0x06, 0x10
34 User
Zero scale flow [User
units] 0x010D FLOAT32 --
0x03, 0x04,
0x10
35 User Full scale velocity [m/s] 0x0086 FLOAT32 --
0x03, 0x04,
0x10
36 User Full scale flow [User units] 0x0090 FLOAT32 --
0x03, 0x04,
0x10
37 User Low flow cutoff [%] 0x008E FLOAT32 --
0x03, 0x04,
0x10
38 User Flow direction 0x0092 UINT16 --
0x03, 0x04,
0x06, 0x10
39 User Damping factor [s] 0x0093 UINT16 --
0x03, 0x04,
0x06, 0x10
No
.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
18
Admin
Detector diameter
0x006F UINT16 --
0x03, 0x04,
0x06, 0x10
19
Admin
Detector diameter
Other [mm] 0x0070 UINT16 --
0x03, 0x04,
0x06, 0x10
20
Admin
Detector factor
0x0071 FLOAT32 --
0x03, 0x04,
0x10
21
Firmware
[Factory]
Detector factor 0x0073 FLOAT32 Read only 0x03, 0x04
22
Admin
Detector offset [m/s]
0x0075 FLOAT32 --
0x03, 0x04,
0x10
23
Firmware
[Factory]
Detector offset
0x0077 FLOAT32 Read only 0x03, 0x04
24
Admin
Amplifier factor
0x0079 FLOAT32 --
0x03, 0x04,
0x10
25
Firmware
[Factory]
Amplifier factor
0x007B FLOAT32 Read only 0x03, 0x04
26
Admin
Detector current [mA]
0x007D FLOAT32 --
0x03, 0x04,
0x10
27
Firmware
[Factory]
Detector current [mA]
0x007F FLOAT32 Read only 0x03, 0x04
28
Service
Power line frequency [Hz]
0x0081 UINT16 --
0x03, 0x04,
0x06, 0x10
29
Admin
Excitation frequency [Hz]
0x0082 UINT16 --
0x03, 0x04,
0x06, 0x10
30
Service
Scale factor [%]
0x010B FLOAT32 --
0x03, 0x04,
0x10

Memory maps by category Page 8/30
MID_M2000_BA_MODBUS_02_1805
2.4 Digital input
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
40 Service
Digital input:
Input operation 0x0094 UINT16 --
0x03, 0x04, 0x06,
0x10
41
Firmware
Digital input: Status 0x0155 UINT16
Read only
0x03; 0x04
2.5 Analog output
No.
Write
security Register name
Register
address
Register
Type
Read /
Write
FNC
support
42 Service Analog output range 0x0095 UINT16 --
0x03, 0x04,
0x06, 0x10
43
Firmware
Analog output offset 0x0096 FLOAT32
Read only
0x03; 0x04
44 Admin
Analog output calibration
point A [A]
0x0126 FLOAT32 --
0x03, 0x04,
0x10
45 Admin
Analog output calibration
point B [A]
0x0128 FLOAT32 --
0x03, 0x04,
0x10
46
Firmware
[FACTORY] Analog output:
Calibration point A [A]
0x0088 FLOAT32 Read only 0x03; 0x04
47
Firmware
[FACTORY] Analog output:
Calibration point B [A]
0x008C FLOAT32 Read only 0x03; 0x04
48
Firmware
Analog output slope 0x0131 FLOAT32
Read only
0x03; 0x04
49
Service
Analog customer offset
4 mA [A]
0x0133 FLOAT32 --
0x03, 0x04,
0x10
50
Service
Analog customer offset
20 mA [A]
0x0135 FLOAT32 --
0x03, 0x04,
0x10
51
Firmware
Analog output current [A] 0x014E FLOAT32
Read only
0x03; 0x04
52
Firmware
Analog output current string
[mA]
0x0150 FLOAT32 Read only 0x03; 0x04
53 Service Alarm mode 0x012E UINT16
0x03, 0x04,
0x06, 0x10
54 None Fixed current mode 0x008A FLOAT32 Port B
0x03, 0x04,
0x10

Memory maps by category Page 9/30
MID_M2000_BA_MODBUS_02_1805
2.6 Output #1
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
55 Service
Output #1:
Pulses per unit [m3] 0x0098 FLOAT32 -- 0x03, 0x04, 0x10
56 Service
Output #1:
Pulses per unit [User units] 0x009C FLOAT32 -- 0x03, 0x04, 0x10
57 Service
Output #1:
Pulses width [ms] 0x00A0 UINT16 --
0x03, 0x04, 0x06,
0x10
58 Service
Output #1:
Flow alarm minimum [%] 0x00A1 UINT16 --
0x03, 0x04, 0x06,
0x10
59 Service
Output #1:
Flow alarm maximum [%] 0x00A2 UINT16 --
0x03, 0x04, 0x06,
0x10
60 Service
Output #1:
Output mode 0x00A3 UINT16 --
0x03, 0x04, 0x06,
0x10
61 Service
Output #1:
Ouput operation 0x00A4 UINT16 --
0x03, 0x04, 0x06,
0x10
2.7 Output #2
No.
Write
security Register name
Register
address
Register
Type
Read /
Write FNC support
62 Service
Output #2:
Pulses per unit [m
3
]
0x00A5 FLOAT32 -- 0x03, 0x04, 0x10
63 Service
Output #2:
Pulses per unit [User units]
0x00A9 FLOAT32 -- 0x03, 0x04, 0x10
64 Service
Output #2:
Pulses width [ms]
0x00AD UINT16 --
0x03, 0x04, 0x06,
0x10
65 Service
Output #2:
Flow alarm minimum [%]
0x00AE UINT16 --
0x03, 0x04, 0x06,
0x10
66 Service
Output #2:
Flow alarm maximum [%]
0x00AF UINT16 --
0x03, 0x04, 0x06,
0x10
67 Service
Output #2:
Output mode
0x00B0 UINT16 --
0x03, 0x04, 0x06,
0x10
68 Service
Output #2:
Ouput operation 0x00B1 UINT16 --
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 10/30
MID_M2000_BA_MODBUS_02_1805
2.8 Output #3
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
69 Service
Output #3:
Full scale frequency [Hz] 0x00B2 UINT16 --
0x03, 0x04, 0x06,
0x10
70 Service
Output #3:
Flow alarm minimum [%] 0x00B3 UINT16 --
0x03, 0x04, 0x06,
0x10
71 Service
Output #3:
Flow alarm maximum [%] 0x00B4 UINT16 --
0x03, 0x04, 0x06,
0x10
72 Service
Output #3:
Output mode 0x00B5 UINT16 --
0x03, 0x04, 0x06,
0x10
73 Service
Output #3:
Hardware select 0x00B6 UINT16 --
0x03, 0x04, 0x06,
0x10
74 Service
Output #3:
Output operation 0x00B7 UINT16 --
0x03, 0x04, 0x06,
0x10
2.9 Output #4
No.
Write
security Register name
Register
address
Register
Type
Read /
Write FNC support
75 Service
Output #4:
Flow alarm minimum [%] 0x00B8 UINT16 --
0x03, 0x04, 0x06,
0x10
76 Service
Output #4:
Flow alarm maximum [%]
0x00B9 UINT16 --
0x03, 0x04, 0x06,
0x10
77 Service
Output #4:
Output mode
0x00BA UINT16 --
0x03, 0x04, 0x06,
0x10
78 Service
Output #4:
Hardware select
0x00BB UINT16 --
0x03, 0x04, 0x06,
0x10
79 Service
Output #4:
Output operation
0x00BC UINT16 --
0x03, 0x04, 0x06,
0x10