Badger Meter ModMAG M2000 User manual

®
Badger Meter Europa GmbH
ModMAG® M2000
ModBus® memory map
USER MANUAL
May 2018
MID_M2000_BA_MODBUS_02_1805

Contents
1. Overview.......................................................................................................................... 3
1.1 Write security .......................................................................................................... 3
1.2 Register name......................................................................................................... 4
1.3 Register address..................................................................................................... 4
1.4 Register type........................................................................................................... 4
1.5 Read / Write............................................................................................................ 4
1.6 FNC support............................................................................................................ 4
2. Memory maps by category............................................................................................. 6
2.1 Product identification............................................................................................... 6
2.2 Meter calibration...................................................................................................... 7
2.3 Meter measurement settings................................................................................... 7
2.4 Digital input ............................................................................................................. 8
2.5 Analog output.......................................................................................................... 8
2.6 Output #1................................................................................................................ 9
2.7 Output #2................................................................................................................ 9
2.8 Output #3...............................................................................................................10
2.9 Output #4...............................................................................................................10
2.10 Port A diagnostic counters......................................................................................11
2.11 Port B diagnostic counters......................................................................................11
2.12 Measurements .......................................................................................................12
2.13 Meter diagnostic counters ......................................................................................13
2.14 Miscellaneaous ......................................................................................................14
2.15 Verification tool support..........................................................................................14
2.16 Empty pipe.............................................................................................................14
2.17 Control commands.................................................................................................15
2.18 Security..................................................................................................................15
3. M2000 memory map by register address.....................................................................16
4. M2000 register write properties....................................................................................21
5. Troubleshooting ............................................................................................................29
6. Return of goods for repair / Harmlessness declaration..............................................30

Overview Page 3/30
MID_M2000_BA_MODBUS_02_1805
1. Overview
ModMAG®M2000 supports ModBus®RTU communications. Port A (pins 5, 6, 7) support
ModBus® RTU using RS232.The RS485 is supported as an accessory daughterboard. Verify
or configure the ModMAG® M2000 communication port B. Access the port settings at main
menu > communications > port B settings.
The tables to follow identify the ModBus®registers and attributes that exist in the ModMAG®
M2000 flow meter. Each register has attributes that are also specified in the tables.
Parameter
Value
Comments
Port address
001
Mandatory value of 001
Extended port address
-
Application specific. sets
ModBus
®
address of module
Baud rate
38400
ModBus® daughterboard
auto-bauds
Data bits
8
Mandatory value of 8
Parity
EVEN
Mandatory value of EVEN
Stop bits
1
Mandatory value of 1
1.1 Write security
Write security identifies the required security level of the register in order to be suc-
cessfully written. This attribute does not apply to the readability of the register and re-
gisters listed with admin, service or user are unprotected if the meter is not secured
(that is, admin pin is not programmed.)
•Firmware - Typically, read-only registers.This means only the flow meter firmware
has the privilege to update the register.
•Factory – Includes registers that can only be written by the factory
•Admin – Registers that require admin level access
•Service – Registers that require service level access
•User – Registers that require user level access
•None – Register is always unprotected
All registers can be protected by enabling security on the flow meter. Once the flow
meter is secured, all registers are write-protected unless remote privilege is granted.
All read accesses to registers are still accepted when the flow meter is secured.
Obtaining remote privilege for write operations requires a sequence of ModBus®
actions to take place. Remote login process is encrypted to ensure protection of the
log-in pins.
•Read the random value register (address 0x012B).
•Perform necessary calculations (contact Badger Meter for details).
•Write the remote login register (address 0x012F).
It is advised that a support application is written to perform this process and embed-
ded within the main application software used to access the flow meter.

Overview Page 4/30
MID_M2000_BA_MODBUS_02_1805
1.2 Register name
When applicable, describes the parameter so it can be associated within the display
menu items. Please note, not all registers are directly modifiable via the menu mana-
ger. Also, some registers are not accessible via the menu manager.
1.3 Register address
Register address defines the physical address that is required to be transmitted over
the ModBus®RTU serial link. Some third-party applications require the use of logical
addressing when communicating over ModBus®. The logical address determines the
ModBus®function code that is transmitted over the serial link.
Two logical address ranges are supported, 3xxxx and 4xxxx. Logical address range
3xxxx issues the read input register function code 0x04. Logical address range 4xxxx
issues the read holding register function code 0x03. All logical addresses start at in-
dex 1 (example, 30001 and 40001).
For example, suppose the application requires logical addressing and is targeting to
access the “Flow rate [User units]” register. The physical address for this register is
0xF1 or 241d. This register can be read from two different logical addresses (30242 or
40242). The logical address is calculated by adding the physical address to the logical
start address (30001 or 40001).
•30001 + 241 = 30242 (Issues function code 0x04 – Read Input Register)
•40001 + 241 = 40242 (Issues function code 0x03 – Read Holding Register)
1.4 Register type
Register type identifies the number of registers the parameter requires. Each register
is 16 bits. Supported register types include:
Register type Description
Number of
ModBus
®
registers
UCHAR16
Unsigned character (16 bits)
1
UCHAR16[x]
Unsigned character Array
X
UINT16
Unsigned integer (16 bits)
1
SINT16
Signed integer (16 bits)
1
UINT32
Unsigned integer (32 bits)
2
FLOAT32
Floating point (32 bits)
2
For FLOAT32 register types, these registers make use of IEEE-754 floating point
standard. For example, 1.0 is transmitted as 0x3F800000. ModBus®serial link will
transmit the most significant byte first, 0x3F, followed by 0x80, 0x00, 0x00.
1.5 Read / Write
The Read/Write attribute identifies if the parameter is read-only or writeable.
Parameters that are read only are specified as such, otherwise, the parameter can be
considered accessible with write commands.
1.6 FNC support
FNC support identifies the ModBus®function codes (commands) available to access
the register. Supported ModBus®function codes include:

Overview Page 5/30
MID_M2000_BA_MODBUS_02_1805
ModBus®function code
Description
0x03
Read holding register
0x04
Read input register
0x06
Preset single register (write)
0x10
Preset multiple registers (write multiple)
Important:
Write function codes are not accepted while menu navigation is in process.
Write function codes update only the working register located in volatile memory. Any
sequence of writes must be followed by a write of value 0x01 to the “Command Action
Request Register”, address 0x0125. Otherwise changes will be lost if the flow meter is
power cycled or reset.
For efficiency, it is possible with read function codes, 0x03 and 0x04, to read blocks of
registers.This allows for the ability to read multiple registers in one transmission.

Memory maps by category Page 6/30
MID_M2000_BA_MODBUS_02_1805
2. Memory maps by category
2.1 Product identification
No.
Write
security
Register name
Register
address
Register Type
Read /
Write
FNC support
1
Firmware
Product code
0x0000
UINT16
Read only
0x03, 0x04
2
Firmware
Product name
0x0001
UCHAR16[8]
Read only
0x03, 0x04
3
Firmware
Firmware name
0x0009
UCHAR16[16]
Read only
0x03, 0x04
4
Factory
Application
Version
0x0019
UCHAR16[10]
--
0x03, 0x04, 0x06,
0x10
5
Firmware
Compile date
[MM:DD:YYYY]
0x0023
UCHAR16[16]
Read only
0x03, 0x04
6
Firmware
Compline time
[HH:MM:SS]
0x0033
UCHAR16[16]
Read only
0x03, 0x04
7
Factory
PCB serial
number
0x0043
UCHAR16[5]
--
0x03, 0x04, 0x10
8
Firmware
OTP boot
checksum
0x0048
UCHAR16[3]
Read only
0x03, 0x04
9
Firmware
Flash OS
checksum
0x004B
UCHAR16[3]
Read only
0x03, 0x04
10
Firmware
Boot version
0x004E
UCHAR16[5]
Read only
0x03, 0x04
11
Firmware
OS version
0x0053
UCHAR16[4]
Read only
0x03, 0x04
12
None
Daughterboard
product type
0x0057
UINT16
Port B
0x03, 0x04, 0x06,
0x10
13
None
Daughterboard
major version
0x0058
UINT16
Port B
0x03, 0x04, 0x06,
0x10
14
None
Daughterboard
minor verion
0x0059
UINT16
Port B
0x03, 0x04, 0x06,
0x10
15
Factory
Power on splash
line 1
0x005A
UCHAR16[11]
--
0x03, 0x04, 0x06,
0x10
16
Factory
Poser on splash
line 2
0x0156
UCHAR16[11]
--
0x03, 0x04, 0x06,
0x10
17
None
Meter tag name
0x0161
UCHAR16[17]
--
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 7/30
MID_M2000_BA_MODBUS_02_1805
2.2 Meter calibration
2.3 Meter measurement settings
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
31 User Flow unit 0x0083 UINT16 --
0x03, 0x04,
0x06, 0x10
32 User Volume unit 0x0084 UINT16 --
0x03, 0x04,
0x06, 0x10
33 User Unit multiplier 0x0085 UINT16 --
0x03, 0x04,
0x06, 0x10
34 User
Zero scale flow [User
units] 0x010D FLOAT32 --
0x03, 0x04,
0x10
35 User Full scale velocity [m/s] 0x0086 FLOAT32 --
0x03, 0x04,
0x10
36 User Full scale flow [User units] 0x0090 FLOAT32 --
0x03, 0x04,
0x10
37 User Low flow cutoff [%] 0x008E FLOAT32 --
0x03, 0x04,
0x10
38 User Flow direction 0x0092 UINT16 --
0x03, 0x04,
0x06, 0x10
39 User Damping factor [s] 0x0093 UINT16 --
0x03, 0x04,
0x06, 0x10
No
.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
18
Admin
Detector diameter
0x006F UINT16 --
0x03, 0x04,
0x06, 0x10
19
Admin
Detector diameter
Other [mm] 0x0070 UINT16 --
0x03, 0x04,
0x06, 0x10
20
Admin
Detector factor
0x0071 FLOAT32 --
0x03, 0x04,
0x10
21
Firmware
[Factory]
Detector factor 0x0073 FLOAT32 Read only 0x03, 0x04
22
Admin
Detector offset [m/s]
0x0075 FLOAT32 --
0x03, 0x04,
0x10
23
Firmware
[Factory]
Detector offset
0x0077 FLOAT32 Read only 0x03, 0x04
24
Admin
Amplifier factor
0x0079 FLOAT32 --
0x03, 0x04,
0x10
25
Firmware
[Factory]
Amplifier factor
0x007B FLOAT32 Read only 0x03, 0x04
26
Admin
Detector current [mA]
0x007D FLOAT32 --
0x03, 0x04,
0x10
27
Firmware
[Factory]
Detector current [mA]
0x007F FLOAT32 Read only 0x03, 0x04
28
Service
Power line frequency [Hz]
0x0081 UINT16 --
0x03, 0x04,
0x06, 0x10
29
Admin
Excitation frequency [Hz]
0x0082 UINT16 --
0x03, 0x04,
0x06, 0x10
30
Service
Scale factor [%]
0x010B FLOAT32 --
0x03, 0x04,
0x10

Memory maps by category Page 8/30
MID_M2000_BA_MODBUS_02_1805
2.4 Digital input
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
40 Service
Digital input:
Input operation 0x0094 UINT16 --
0x03, 0x04, 0x06,
0x10
41
Firmware
Digital input: Status 0x0155 UINT16
Read only
0x03; 0x04
2.5 Analog output
No.
Write
security Register name
Register
address
Register
Type
Read /
Write
FNC
support
42 Service Analog output range 0x0095 UINT16 --
0x03, 0x04,
0x06, 0x10
43
Firmware
Analog output offset 0x0096 FLOAT32
Read only
0x03; 0x04
44 Admin
Analog output calibration
point A [A]
0x0126 FLOAT32 --
0x03, 0x04,
0x10
45 Admin
Analog output calibration
point B [A]
0x0128 FLOAT32 --
0x03, 0x04,
0x10
46
Firmware
[FACTORY] Analog output:
Calibration point A [A]
0x0088 FLOAT32 Read only 0x03; 0x04
47
Firmware
[FACTORY] Analog output:
Calibration point B [A]
0x008C FLOAT32 Read only 0x03; 0x04
48
Firmware
Analog output slope 0x0131 FLOAT32
Read only
0x03; 0x04
49
Service
Analog customer offset
4 mA [A]
0x0133 FLOAT32 --
0x03, 0x04,
0x10
50
Service
Analog customer offset
20 mA [A]
0x0135 FLOAT32 --
0x03, 0x04,
0x10
51
Firmware
Analog output current [A] 0x014E FLOAT32
Read only
0x03; 0x04
52
Firmware
Analog output current string
[mA]
0x0150 FLOAT32 Read only 0x03; 0x04
53 Service Alarm mode 0x012E UINT16
0x03, 0x04,
0x06, 0x10
54 None Fixed current mode 0x008A FLOAT32 Port B
0x03, 0x04,
0x10

Memory maps by category Page 9/30
MID_M2000_BA_MODBUS_02_1805
2.6 Output #1
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
55 Service
Output #1:
Pulses per unit [m3] 0x0098 FLOAT32 -- 0x03, 0x04, 0x10
56 Service
Output #1:
Pulses per unit [User units] 0x009C FLOAT32 -- 0x03, 0x04, 0x10
57 Service
Output #1:
Pulses width [ms] 0x00A0 UINT16 --
0x03, 0x04, 0x06,
0x10
58 Service
Output #1:
Flow alarm minimum [%] 0x00A1 UINT16 --
0x03, 0x04, 0x06,
0x10
59 Service
Output #1:
Flow alarm maximum [%] 0x00A2 UINT16 --
0x03, 0x04, 0x06,
0x10
60 Service
Output #1:
Output mode 0x00A3 UINT16 --
0x03, 0x04, 0x06,
0x10
61 Service
Output #1:
Ouput operation 0x00A4 UINT16 --
0x03, 0x04, 0x06,
0x10
2.7 Output #2
No.
Write
security Register name
Register
address
Register
Type
Read /
Write FNC support
62 Service
Output #2:
Pulses per unit [m
3
]
0x00A5 FLOAT32 -- 0x03, 0x04, 0x10
63 Service
Output #2:
Pulses per unit [User units]
0x00A9 FLOAT32 -- 0x03, 0x04, 0x10
64 Service
Output #2:
Pulses width [ms]
0x00AD UINT16 --
0x03, 0x04, 0x06,
0x10
65 Service
Output #2:
Flow alarm minimum [%]
0x00AE UINT16 --
0x03, 0x04, 0x06,
0x10
66 Service
Output #2:
Flow alarm maximum [%]
0x00AF UINT16 --
0x03, 0x04, 0x06,
0x10
67 Service
Output #2:
Output mode
0x00B0 UINT16 --
0x03, 0x04, 0x06,
0x10
68 Service
Output #2:
Ouput operation 0x00B1 UINT16 --
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 10/30
MID_M2000_BA_MODBUS_02_1805
2.8 Output #3
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
69 Service
Output #3:
Full scale frequency [Hz] 0x00B2 UINT16 --
0x03, 0x04, 0x06,
0x10
70 Service
Output #3:
Flow alarm minimum [%] 0x00B3 UINT16 --
0x03, 0x04, 0x06,
0x10
71 Service
Output #3:
Flow alarm maximum [%] 0x00B4 UINT16 --
0x03, 0x04, 0x06,
0x10
72 Service
Output #3:
Output mode 0x00B5 UINT16 --
0x03, 0x04, 0x06,
0x10
73 Service
Output #3:
Hardware select 0x00B6 UINT16 --
0x03, 0x04, 0x06,
0x10
74 Service
Output #3:
Output operation 0x00B7 UINT16 --
0x03, 0x04, 0x06,
0x10
2.9 Output #4
No.
Write
security Register name
Register
address
Register
Type
Read /
Write FNC support
75 Service
Output #4:
Flow alarm minimum [%] 0x00B8 UINT16 --
0x03, 0x04, 0x06,
0x10
76 Service
Output #4:
Flow alarm maximum [%]
0x00B9 UINT16 --
0x03, 0x04, 0x06,
0x10
77 Service
Output #4:
Output mode
0x00BA UINT16 --
0x03, 0x04, 0x06,
0x10
78 Service
Output #4:
Hardware select
0x00BB UINT16 --
0x03, 0x04, 0x06,
0x10
79 Service
Output #4:
Output operation
0x00BC UINT16 --
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 11/30
MID_M2000_BA_MODBUS_02_1805
2.10 Port A diagnostic counters
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
80 Firmware
Port A:
Packets processed 0x00BD UINT16 Read only 0x03, 0x04
81 Firmware
Port A:
Bradcast packets 0x00BE UINT16 Read only 0x03, 0x04
82 Firmware
Port A:
CRC errors 0x00BF UINT16 Read only 0x03, 0x04
83 Firmware
Port A:
Packets received 0x00C0 UINT16 Read only 0x03, 0x04
84 Firmware
Port A:
Packets sent 0x00C1 UINT16 Read only 0x03, 0x04
85 Firmware
Port A:
Parity errors 0x00C2 UINT16 Read only 0x03, 0x04
86 Firmware
Port A:
Framing errors 0x00C3 UINT16 Read only 0x03, 0x04
87 Firmware
Port A:
Overrun errors 0x00C4 UINT16 Read only 0x03, 0x04
88 Firmware
Port A:
Break detects 0x00C5 UINT16 Read only 0x03, 0x04
2.11 Port B diagnostic counters
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
90 Firmware
Port B:
Packets processed
0x00C6 UINT16 Read only 0x03, 0x04
90 Firmware
Port B:
Bradcast packets
0x00C7 UINT16 Read only 0x03, 0x04
91 Firmware
Port B:
CRC errors
0x00C8 UINT16 Read only 0x03, 0x04
92 Firmware
Port B:
Packets received
0x00C9 UINT16 Read only 0x03, 0x04
93 Firmware
Port B:
Packets sent 0x00CA UINT16 Read only 0x03, 0x04
94 Firmware
Port B:
Parity errors 0x00CB UINT16 Read only 0x03, 0x04
95 Firmware
Port B:
Framing errors 0x00CC UINT16 Read only 0x03, 0x04
96 Firmware
Port B:
Overrun errors 0x00CD UINT16 Read only 0x03, 0x04
97 Firmware
Port B:
Break detects 0x00CE UINT16 Read only 0x03, 0x04

Memory maps by category Page 12/30
MID_M2000_BA_MODBUS_02_1805
2.12 Measurements
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
98 Firmware
T1/T+[m3]
0x00CF
FLOAT32
Read only 0x03, 0x04
99 Firmware
T1/T+ [User units]
0x00D3
FLOAT32
Read only 0x03, 0x04
100
Firmware
T1/T+ Display string
0x0137
UCHAR16[8]
Read only
0x03, 0x04
101 Firmware
T2/T- [m3]
0x00D7
FLOAT32
Read only 0x03, 0x04
102 Firmware
T2/T- [User units]
0x00DB
FLOAT32
Read only 0x03, 0x04
103
Firmware
T2/T- Display string
0x013F
UCHAR16[8]
Read only
0x03, 0x04
104 Firmware
T3/TN [m3]
0x00DF
FLOAT32
Read only 0x03, 0x04
105 Firmware
T3/TN [User units]
0x00E3
FLOAT32
Read only 0x03, 0x04
106
Firmware
T3/TN Display string
0x0147
UCHAR16[8]
Read only
0x03, 0x04
107 Firmware
T1/T+ Rollover
counter 0x00E7 UINT16 Read only 0x03, 0x04
108 Firmware
T2/T- Rollover
counter 0x00E8 UINT16 Read only 0x03, 0x04
109 Firmware
Flow velocity [m/s]
0x00E9
FLOAT32
Read only 0x03, 0x04
110 Firmware
Flow rate [m3/s]
0x00ED
FLOAT32
Read only 0x03, 0x04
111 Firmware
Flow rate [User units]
0x00F1
FLOAT32
Read only 0x03, 0x04
112 Firmware
Relative flow rate [%]
0x00F3
FLOAT32
Read only 0x03, 0x04
113 Firmware
Preset batch
totalizer [m
3
]
0x00EB
FLOAT32
Read only 0x03, 0x04
114 Firmware
Preset batch totalizer
[User units]
0x00EF
FLOAT32
Read only 0x03, 0x04
115
Firmware
Flow direction
0 = no flow
1 = forward
2 = reverse
0x012D
UINT16
Read only
0x03, 0x04

Memory maps by category Page 13/30
MID_M2000_BA_MODBUS_02_1805
2.13 Meter diagnostic counters
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
116 Firmware Power up counter 0x00F5
UINT16
Read only 0x03, 0x04
117 Firmware Detector error counter 0x00F6
UINT16
Read only 0x03, 0x04
118 Firmware Empty pipe counter 0x00F7
UINT16
Read only 0x03, 0x04
119 Firmware Full scale counter 0x00F8
UINT16
Read only 0x03, 0x04
120 Firmware
Totalizer overflow
counter 0x00F9 UINT16 Read only 0x03, 0x04
121 -- Reserved 0x00FA
UINT16
Read only 0x03, 0x04
122 -- Reserved 0x00FB
UINT16
Read only 0x03, 0x04
123 Firmware Pulse sync counter 0x00FC
UINT16
Read only 0x03, 0x04
124 Firmware ADC Interrupt counter 0x00FD
UINT16
Read only 0x03, 0x04
125 Firmware ADC range counter 0x00FE
UINT16
Read only 0x03, 0x04
126 Firmware WDT resets counter 0x00FF
UINT16
Read only 0x03, 0x04
127 Firmware WDT location 0x0100
UINT16
Read only 0x03, 0x04
128 Firmware System error # 0x0101
UINT16
Read only 0x03, 0x04
129 Firmware Token error counter 0x0102
UINT16
Read only 0x03, 0x04
130 -- Reserved 0x0103
UINT16
Read only 0x03, 0x04
131 -- Reserved 0x0104
UINT16
Read only 0x03, 0x04
132 -- Reserved 0x0105
UINT16
Read only 0x03, 0x04
133 Firmware
Meter status (see
below) 0x0106 UINT16 Read only 0x03, 0x04
134 Firmware
Action request
overflows 0x0109 UINT16 Read only 0x03, 0x04
135 Firmware
Measurement
overflows
0x010A UINT16 Read only 0x03, 0x04
136 Firmware Remote resets 0x0154
UINT16
Read only 0x03, 0x04
Additional information to No. 133 meter status (register 0x0106)
Bit no.
Description
Bit no.
Description
BIT 0
Detector Error
BIT 8
ADC Range Error
BIT 1
Empty Pipe Error
BIT 9
Reserved
BIT 2
Full Scale Flow Error
BIT 10
Reserved
BIT 3
Totalizer Rollover Error
BIT 11
Reserved
BIT 4
Totalizer Rollover Status
BIT 12
Token Error
BIT 5
Flow Simulation Status
BIT 13
Unused
BIT 6
Pulse Synchronization Warning
BIT 14
Unused
BIT 7
ADC Interrupt Error
BIT 15
Unused

Memory maps by category Page 14/30
MID_M2000_BA_MODBUS_02_1805
2.14 Miscellaneaous
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
137
Firmwar
e
Power loss totalizer
[seconds] 0x0107 UINT16 -- 0x03, 0x04
138 User Display backlights mode 0x010F UINT16 --
0x03, 0x04, 0x06,
0x10
139 Service Preset batch amount [m3] 0x0110
FLOAT32
-- 0x03, 0x04
140 Admin Menu reset allowed 0x0112 UINT16 --
0x03, 0x04, 0x06,
0x10
141 User Menu language setting 0x0114 UINT16 --
0x03, 0x04, 0x06,
0x10
142 User
File System -
Number of records to read 0x0117 UINT16 --
0x03, 0x04, 0x06,
0x10
143 None Configuration status 0x011D UINT16 Port B
0x03, 0x04, 0x06,
0x10
144 None Port B extended address 0x0118 UINT16 Port B
0x03, 0x04, 0x06,
0x10
2.15 Verification tool support
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
145 Firmware
Analog input
measure value 0x0115 FLOAT32
Read
only 0x03, 0x04
146 Admin
Analog input
measure counter 0x0119 UINT16 --
0x03, 0x04, 0x06,
0x10
147 Firmware
Empty pipe actual
Resistance [ohms] 0x011A FLOAT32
Read
only 0x03, 0x04
2.16 Empty pipe
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
148 Admin
Empty pipe
calibration [volts] 0x011E FLOAT32 -- 0x03, 0x04, 0x10
149 Firmware
Empty pipe
measure value [volts] 0x0120 FLOAT32 Read only 0x03, 0x04
150 Admin
Full pipe
calibration [volts] 0x0122 FLOAT32 -- 0x03, 0x04, 0x10
151 Service Empty pipe mode 0x0124 UINT16 --
0x03, 0x04, 0x06,
0x10

Memory maps by category Page 15/30
MID_M2000_BA_MODBUS_02_1805
2.17 Control commands
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
152 None
Command action
request 0x0125 UINT16 --
0x03, 0x04, 0x06,
0x10
153 Service Flow simulation 0x012A SINT16 --
0x03, 0x04, 0x06,
0x10
2.18 Security
No.
Write
security
Register name
Register
address
Register
Type
Read /
Write
FNC support
154 Firmware Security status 0x011C UINT16
Read
only 0x03, 0x04
155 Firmware Random value 0x012B UINT32
Read
only 0x03, 0x04
156 Firmware Remote login 0x012F UINT32
Read
only 0x10

M2000 memory map by register address Page 16/30
MID_M2000_BA_MODBUS_02_1805
3. M2000 memory map by register address
Register address
Register name
Register type
0x0000
Product code
UINT16
0x0001
Product name
UCHAR16[8]
0x0009
Firmware name
UCHAR16[16]
0x0013
Reserved
UINT16
0x0019
Application Version
UCHAR16[10]
0x0023
Compile Date [MM:DD:YYYY]
UCHAR16[16]
0x0033
Compile Time [HH:MM:SS]
UCHAR16[16]
0x0043
PCB serial number
UCHAR16[5]
0x0048
OTP boot checksum
UCHAR16[3]
0x004B
Flash OS checksum
UCHAR16[3]
0x004E
Boot version
UCHAR16[5]
0x0053
OS version
UCHAR16[4]
0x0057
Daughterboard product type
UINT16
0x0058
Daughterboard major version
UINT16
0x0059
Daughterboard minor version
UINT16
0x005A
Power on splash line 1
UCHAR16[11]
0x0065
Reserved (to addr 0x006E)
UINT16[10]
0x006F
Detector diameter
UINT16
0x0070
Detector diamether other [mm]
UINT16
0x0071
Detector factor
FLOAT32
0x0073
[FACTORY] Detector factor
FLOAT32
0x0075
Detector offset [m/s]
FLOAT32
0x0077
[FACTORY] Decetor offset
FLOAT32
0x0079
Amplifier factor
FLOAT32
0x007B
[FACTORY] Amplifier factor
FLOAT32
0x007D
Detector current [m3/s]
FLOAT32
0x007F
[FACTORY] Detector current [mA]
FLOAT32
0x0081
Power line frequency [Hz]
UINT16
0x0082
Excitation frequency [Hz]
UINT16
0x0083
Flow unit
UINT16
0x0084
Volume unit
UINT16
0x0085
Unit multiplier
UINT16
0x0086
Full scale velocity [m/s]
FLOAT32
0x0088
[FACTORY] Analog output calitbration
Point A [A]
FLOAT32
0x008A
Fixed current mode
FLOAT32
0x008C
[FACTORY] Analog output calibration
Point A [A] FLOAT32
0x008E
Low flow cutoff [%]
FLOAT32
0x0090
Full scale flow [User units]
FLOAT32
0x0092
Flow direction
UINT16
0x0093
Damping factor [s]
UINT16

M2000 memory map by register address Page 17/30
MID_M2000_BA_MODBUS_02_1805
Register address
Register name
Register type
0x0094
Digital input: Input operation
UINT16
0x0095
Analog output range
UINT16
0x0096
Analog output offset
FLOAT32
0x0098
Output #1: Pulses per unit [m3]
FLOAT32
0x009A
Reserved (to addr 0x09B)
UINT16 [2]
0x009C
Output #1: Pulses per unit [User unit]
FLOAT32
0x009E
Reserved (to addr 0x009F)
UINT16 [2]
0x00A0
Output #1: Pulse width [ms]
UINT16
0x00A1
Output #1: Flow alarm minimum [%]
UINT16
0x00A2
Ouput #1: Flow alarm maximum [%]
UINT16
0x00A3
Ouput #1: Output mode
UINT16
0x00A4
Ouput #1: Output operation
UINT16
0x00A5
Ouput #2: Pulses per unit [m3]
FLOAT32
0x00A7
Reserved (to addr 0x00A8)
UINT16 [2]
0x00A9
Ouput #2: Pulses per unit [User unit]
FLOAT32
0x00AB
Reserved (to addr 0x00AC)
UINT16 [2]
0x00AD
Ouput #2: Pulse width [ms]
UINT16
0x00AE
Ouput #2: Flow alarm minimum [%]
UINT16
0x00AF
Ouput #2: Flow alarm maximum[%]
UINT16
0x00B0
Ouput #2: Ouput mode
UINT16
0x00B1
Ouput #2: Ouput operation
UINT16
0x00B2
Ouput #3: Full scale frequency [Hz]
UINT16
0x00B3
Ouput #3: Flow alarm minimum [%]
UINT16
0x00B4
Ouput #3: Flow alarm maximum[%]
UINT16
0x00B5
Ouput #3: Ouput mode
UINT16
0x00B6
Ouput #3: Hardware select
UINT16
0x00B7
Ouput #3: Output operation
UINT16
0x00B8
Ouput #4: Flow alarm minimum [%]
UINT16
0x00B9
Ouput #4: Flow alarm maximum[%]
UINT16
0x00BA
Ouput #4: Ouput mode
UINT16
0x00BB
Ouput #4: Hardware select
UINT16
0x00BC
Ouput #4: Output operation
UINT16
0x00BD
Port A: Packets processed
UINT16
0x00BE
Port A: Broadcast Packet
UINT16
0x00BF
Port A: CRC errors
UINT16
0x00C0
Port A: Packets received
UINT16
0x00C1
Port A: Packets sent
UINT16
0x00C2
Port A: Parity errors
UINT16
0x00C3
Port A: Framing errors
UINT16
0x00C4
Port A: Overrun errors
UINT16
0x00C5
Port A: Break detects
UINT16
0x00C6
Port B: Packets processed
UINT16
0x00C7
Port B: Broadcast packets
UINT16
0x00C8
Port B: CRC errors
UINT16

M2000 memory map by register address Page 18/30
MID_M2000_BA_MODBUS_02_1805
Register address
Register name
Register type
0x00FD
ADC interrupt counter
UINT16
0x00FE
ADC range counter
UINT16
0x00FF
WDT resets counter
UINT16
0x0100
WDT location
UINT16
0x0101
System error #
UINT16
0x0102
Reserved
UINT16
0x0103
Reserved
UINT16
0x0104
Reserved
UINT16
0x0105
Reserved
UINT16
0x0106
Meter status
UINT16
0x0107
Power loss totalizer [seconds]
UINT32
0x0109
Achtion request overflows
UINT16
0x010A
Measurement overflows
UINT16
0x010B
Scale factor [%]
FLOAT32
0x010D
Zero scale flow [user units]
FLOAT32
0x010F
Display backlight mode
UINT16
0x0110
Preset batch amount [m3]
FLOAT32
0x0112
Menu reset allowed
UINT16
0x0114
Menu language settings
UINT16
0x0115
Analog input measure value
FLOAT32
0x0117
File system – Numer ov records to read
UINT16
0x0118
Port B extended address
UINT16
0x0119
Analog input measure counter
UINT16
0x011A
Empty pipe actual resistance [ohms]
FLOAT32
0x011C
Security status
UINT16
0x011D
Configuration status
UINT16
0x011E
Empty pipe calibration [volts]
FLOAT32
0x0120
Empty pipe measure value [volts]
FLOAT32
0x0122
Full pipe calibration [volts]
FLOAT32
0x0124
Empty pipe mode
UINT16
0x0125
Command action request
UINT16
0x0126
Analog output calibration point A [A]
FLOAT32
0x0128
Analog output calibration point B [A]
FLOAT32
0x012A
Flow simulation
SINT16
0x012B
Random value
UINT32
0x012D
Flow direction
UINT16
0x012E
Alarm mode
UINT16
0x012F
Remote login
UINT32
0x00C3
Port A: Framing errors
UINT16
0x00C4
Port A: Overrun errors
UINT16
0x00C5
Port A: Break detects
UINT16
0x00C6
Port B: Packets processed
UINT16
0x00C7
Port B: Broadcast packets
UINT16
0x00C8
Port B: CRC errors
UINT16

M2000 memory map by register address Page 19/30
MID_M2000_BA_MODBUS_02_1805
Register address
Register name
Register type
0x00C9
Port B: Packets received
UINT16
0x00CA
Port B: Packets sent
UINT16
0x00CB
Port B: Parity errors
UINT16
0x00CC
Port B: Framing errors
UINT16
0x00CD
Port B: Overrun errors
UINT16
0x00CE
Port B: Break detects
UINT16
0x00CF
T1 /T+ [m3]
FLOAT32
0x00D1
Reserved (to addr 0x00D2) – FLOAT 64
UINT16 [2]
0x00D3
T1 /T+ [user units]
FLOAT32
0x00D5
Reserved (to addr 0x00D6) – FLOAT 64
UINT16 [2]
0x00D7
T2 /T- [m3]
FLOAT32
0x00D9
Reserved (to addr 0x00DA) – FLOAT 64
UINT16 [2]
0x00DB
T2 /T- [user units]
FLOAT32
0x00DD
Reserved (to addr 0x00DE) – FLOAT 64
UINT16 [2]
0x00DF
T3 /TN [m3]
FLOAT32
0x00E1
Reserved (to addr 0x00E2) – FLOAT 64
UINT16 [2]
0x00E3
T3 /TN [user units]
FLOAT32
0x00E5
Reserved (to addr 0x00E6) – FLOAT 64
UINT16 [2]
0x00E7
T1 /T+ Rollover counter
UINT16
0x00E8
T2 /T- Rollover counter
UINT16
0x00E9
Flow velocity [m/s]
FLOAT32
0x00EB
Preset batch totalizer [m3]
FLOAT32
0x00ED
Flow rate [m3/s]
FLOAT32
0x00EF
Preset batch totalizer [user units]
FLOAT32
0x00F1
Flow rate [user units]
FLOAT32
0x00F3
Relative flow rate [%]
FLOAT32
0x00F5
Power up counter
UINT16
0x00F6
Detector error counter
UINT16
0x00F7
Empty pipe counter
UINT16
0x00F8
Full scale counter
UINT16
0x00F9
Totalizer overflow counter
UINT16
0x00FA
Reserved
UINT16
0x00FB
Reserved
UINT16
0x00FC
Pulse sync counter
UINT16

M2000 memory map by register address Page 20/30
MID_M2000_BA_MODBUS_02_1805
Register address
Register name
Register type
0x0131
Analog output slope
FLOAT32
0x0133
Analog customer offset 4 mA [A]
FLOAT32
0x0135
Analog customer offset 20 mA[A]
FLOAT32
0x0137
T1 /T+ Display string
UCHAR16 [8]
0x013F
T2 /T- Display string
UCHAR16 [8]
0x0147
T3 /TN Display string
UCHAR16 [8]
0x014E
Analog output current [A]
FLOAT32
0x0150
Analog output current string [mA]
UCHAR16 [4]
0x0154
Remote resets
UINT16
0x0155
Digital input: Status
UINT16
0x0156
Power on splash line 2
UCHAR16 [11]
0x0161
Meter tag name
UCHAR16 [17]
0x0172
Reserved (to addr 0x01FF)
UINT16 [142]