BZ-TECH Serial MODBUS Gateway User manual

Wireless Sensors
Serial MODBUS (RTU/ASCII) Gateway
For Version 3.1
User’s Guide
- 1 -

Contents
1.0 - Serial MODBUS Gateway Overview
Features
Example Network Integration
Serial MODBUS Gateway Specifications
2.0 - Connecting the Serial MODBUS Gateway Hardware
2.1 - Connecting to a USB Programming Dongle
2.2 - Serial MODBUS Gateway Indicator Lights
3.0 - MODBUS Protocol Implementation
3.1 - Register Size
3.2 - Multi-byte Formatting
3.3 - Communication Defaults
3.4 - Communications Settings Reset Jumper
3.5 - Factory Reset
4.0 - Using the Gateway
4.0 - Gateway Coils
4.1 - Verifying that the Wireless is Active
4.2 - Resetting the Gateway
4.3 - Resetting the Wireless Network
4.4 - Resetting to Default Communications Settings
4.5 - Resetting the Gateway to Factory Settings
4.6 - Viewing and Modifying MODBUS Communications
4.7 - Setting Gateway Time
4.8 - Viewing Registered Wireless Devices
4.9 - Adding a Wireless Device to the Gateway
4.10 - Verifying Wireless Device Activity
4.11 - Viewing Wireless Device Data (Fast Read Method)
4.12 - Viewing Wireless Device Data (Advanced Method)
4.13 - Configuring Wireless Devices
4.14 - Configuration Rules to Abide By
4.15 – Wireless Device Sync Setting
5.0 - Upgrading Gateway Firmware
Reference Section
Ref.1 - Gateway Coils
Ref.2 - Wireless Device Coils
Ref.3 - Gateway Registers
Ref.4 - Wireless Device List Registers
Ref.5 - Fast Read Registers
Ref.6 - Wireless Device Registers
Error Reporting, Troubleshooting and Support
Warranty Information
Certifications (FCC and IC)
3
5
5
6
7
8
9
10
10
10
11
11
11
12
12
12
13
13
13
13
14
15
15
16
17
17
18
19
19
20
19
21
24
25
28
28
29
34
34
36
- 2 -

1.0 Serial MODBUS Gateway Overview
The BZ-TECH Serial MODBUS Gateway (SMG) acts as a data
concentrator for wireless sensor networks. This device allows
you to connect up to 50 wireless sensing devices, per gateway,
to your existing serial MODBUS RS-232C and RS-485 sensing
and control infrastructures.
BZ-TECH has recognized the importance of using open
standards like MODBUS, allowing wireless sensors to be used in
the majority of industrial applications. MODBUS is often used to
connect a supervisory computer with a remote terminal unit
(RTU) in supervisory control and data acquisition (SCADA)
systems. MODBUS allows for communication between many
devices connected to the same wired network. Therefore, BZ-
TECH SMG’s allow for seemingly unlimited wireless expansion
of a traditional wired network.
A system incorporating BZ-TECH SMG consists of the following:
•MODBUS Master – PLC, SCADA, etc.
•Existing RS-232C or RS-485 Infrastructure.
•Serial MODBUS Gateway (SMG).
•Wireless Sensors
For information about the MODBUS TCP interface,
please refer to documentation regarding the Ethernet Gateway
v3.0.
- 3 -

This device has been designed to operate with an approved antenna listed on
page 11, and having a maximum gain of 5.1 dBi. Antennas not included in this
list or having a gain greater than 5.1 dBi are strictly prohibited for use with this
device. The required antenna impedance is 50 ohms.
To reduce potential radio interference to other users, the antenna type and its
gain should be so chosen that the equivalent isotropically radiated power (EIRP)
is not more than that required for successful
communication.
FCC Approval (USA) - Refer To Page 34 for FCC Requirements.
IC Approval (Canada) - Refer To Page 35.
Contains FCC ID: ZTL-RFSC1 & IC: 9794A-RFSC1
This device complies with Part 15 of the FCC Rules. Operation is subject to
the following two conditions: (1) this device may not cause harmful
interference and (2) this device must accept any interference received,
including interference that may cause undesired operation.
- 4 -

Features
•Works with 900, 868 and 433MHz Sensor Networking
Solutions
•Communicates with MODBUS RTU / ASCII Protocols
•Supports RS-232C / RS-485 Interfacing
•3 LED Indicators (System, Wired and Wireless)
•NEMA 4X / IP65 Rated Enclosure
•RP SMA Antenna Connector (Antenna Included)
Example Network Integration
Wireless sensors integrate with existing MODBUS systems
allowing for additional environmental variables to be monitored.
- 5 -

Serial MODBUS Gateway Specifications
General
APN Interface Support
RFSC1 Module by
Frequencies: 433, 868 and 900 MHz
(Future support for WiFi and 500 mW
modules)
Antenna
Connector: RP-SMA
Gain: 3.0 dBi Standard
3 Wire Communication Interface
RS-232C
TXD (OUT), RXD (IN), and Ground /
Common
RS-485
D+, D-, and Ground / Common
Protocol Selector
Jumper for RS-232 and RS485
Power
Input Voltage Range
4.5 - 36.0 VDC
Minimum Current
Required
100mA (500mA Recommended)
Mechanical
Reset Feature
Communication / Factory Settings Reset
Jumper
Indicator Lights
Dual Color LEDs
Enclosure
Durable, Impact-Resistant UV Stabilized
Polycarbonate (IP65 of IEC 529 and NEMA
1, 2, 4, 4x, 12 and 13 Rated)
Dimensions
179.60 x 90.68 x 41.30 mm
Weight
16 ounces
Environmental
Operating Temperature
-40 to +85 °C (-40 to +185 °F)
Storage Temperature
-40 to +85 °C (-40 to +185 °F)
- 6 -

2.0 Connecting The Serial MODBUS Gateway
Hardware
This section contains details on how to connect the Serial
MODBUS Gateway (SMG) for testing and use.
The SMG has a communication select jumper. No Jumper
is RS-485, jumper on is RS-232C.
The SMG has a 5 wire connector already installed and
ready for connection. The table below shows the wire
mapping.
SMG 5-Wire Connector
Red:
4.5 – 36 VDC
Black:
Power ground
Orange:
RS-232C: TXD gateway’s transmitter data
connection. Connect the MODBUS master’s
receiver.
RS-485: D+ Non-inverting 485 transmitter/receiver.
White:
Signal ground, internally connected to power
ground.
Green:
RS-232C: RXD gateway’s receiver data connection.
Connect the MODBUS master’s transmitter.
RS-485: D- Inverting 485 transmitter/receiver.
- 7 -

2.1 Connecting the Serial MODBUS Gateway to
the USB Programming Dongle:
BZ-TECH provides MODBUS configuration software that
presents a GUI to the user and makes interfacing to the
MODBUS gateway easy. BZ-TECH also provides a USB to
RS485 dongle to connect the hardware to a PC. To use
the USB to RS485 dongle, connect the wires from the
MODBUS gateway as shown in the illustration below.
Note: The white wire is not used with the USB
programming dongle. The white should be left
unconnected but protected to prevent accidental shorting.
* Any COM port in a computer may be used with the
software.
Select the version that is compatible with your PC
operating system.
- 8 -

2.2 Serial MODBUS Gateway Indicator Lights
System - Indicates gateway status. A green light
indicates ready and working, a red light indicates there
is a hardware problem.
Wired - Indicates connectivity with MODBUS system.
A green light indicates ready and working, a red light
indicates there is a problem. A flashing green light
indicates active communication.
Wireless - Indicates wireless sensor network activity.
A green light indicates ready and working, a red light
indicates that no network has been formed (no sensors
are registered). A flashing green light indicates radio
traffic from the sensors.
Indicator Light Sequences:
Startup - All indicators flash red and green for ~4 seconds.
Internal Memory Failure - All indicators stay red after startup.
COM Reset - “Wired” indicator will flash red (1x/sec).
Factory Reset - All indicators will flash red quickly (5x/sec).
- 9 -

3.0 MODBUS Protocol Implementation
The Serial MG supports 2 transmission modes: RTU and
ASCII.
MODBUS Interfaces will support the following commands:
(FC refers to MODBUS Function Codes).
FC = 1: Read Coils
FC = 5: Write Single Coil
FC = 15: Write Multiple Coils
FC = 3: Read Holding Registers
FC = 6: Write Single Register
FC = 16: Write Multiple Registers
All other commands, exceptions, or other interface features
are not supported.
Note: Raw addressing starts at 0. For FC-specific addressing,
the address starts at 1 for coils and 40001 for holding registers.
Denoted in the literature as 0 / 1 or 1 / 40001.
3.1 Register Size
MODBUS permits the use of a variety of register size
specifications. This device uses the standard 16-bit
unsigned integer for its register size. Additionally, register-
data representation can take the form of multi-register data
types (i.e. 32-bit integer). These will be specified
specifically for all registers that require additional
formatting.
3.2 Multi-byte Formatting
MODBUS has specified the use of ‘Big-Endian’
representation for addresses and data items. This means
that when a numerical quantity larger than a single byte is
transmitted, the most significant byte is sent first.
- 10 -

3.3 Communication Defaults
•MODBUS slave ID or MODBUS address: 95 or 0x5F
•MODBUS-RTU, 8 data bits, No Parity, 1 Stop bit (8-N-1),
19200 baud
3.4 Communication Settings Reset Jumper
MUST OPEN ENCLOSURE TO ACCESS
If the device’s communications settings are unknown, it is
possible to reset the communication settings by placing a
jumper on the RESET jumper position when the gateway is
not powered. This jumper is scanned at power up or reset.
•Open jumper: Normal operation, Wireless and
MODBUS communications allowed to function.
•Closed jumper: Communications interface reset.
If the jumper is detected closed, the device must be power-
cycled, with the jumper in the open position, before the
device is allowed to operate normally. During COM reset
the “Wired” indicator light will flash red indicating that the
reset procedure is happening.
3.5 Factory Reset Jumper
MUST OPEN ENCLOSURE TO ACCESS.
While in communication reset state, if the device remains
powered and the reset jumper is deliberately removed and
replaced twice, a factory reset will occur on the device. All
indicators will flash red quickly (5x/sec) indicating that the
device has been successfully reset. Power-cycle the device
with the jumper in the open position to allow normal
operation.
NOTE: a factory reset will remove all known sensors and
settings from the device.
- 11 -

4.0 Using the Gateway - Coil and Register Map
This device has various coils and registers that allow the
user to access gateway and wireless device feature. Here
is a brief listing of the accessible coil and register map.
Resource Name
Acronym
Function
Code
Raw
Address
Gateway Coils
GWC
1-5
0-4
Wireless Device
Coils (50 total sets
of 4 coils)
WDC [0] thru
WDC [49]
2001-2200
2000-2199
Gateway Registers
GWR
40001-40010
0-9
Wireless Device
List (50 total sets
of 2 registers)
WDL [0] thru
WDL [99]
40101-40200
100-199
Fast Read Registers
(50 total sets of
7 registers)
FRR [0] thru
FRR [99]
41001-41350
1000-1349
Wireless Device
Registers (50 total
sets of 50 registers)
WDR [0] thru
WDR [99]
42001-44500
2000-4499
Please see the reference section for more detailed
information.
4.1 Verifying that the Wireless is Active
Read the “WACTIVE” Gateway Coil. (Function Code
address = 1, Raw Address = 0). A true coil denotes that
the system is configured sufficiently to communicate to
wireless device(s). A false coil means the gateway does
not have any registered wireless devices (WDL is empty).
- 12 -

4.2 Resetting the Gateway
Write the “RST_DEVICE” Gateway Coil (Function Code
address = 2, Raw Address = 1) to TRUE. The device will
reset one second after receiving this command. This
resets all wireless device data in the FRR. Additionally,
if any gateway settings (baud rate, MODBUS address,
communication mode) were modified, this causes these
settings to take effect.
4.3 Resetting the Wireless Network
Write the “RST_WNET” Gateway Coil (Function Code
address = 3, Raw Address = 2) to TRUE. The gateway will
take approximately 30 seconds to complete the wireless
network reset after the acknowledging this command. No
serial commands will be acknowledged during this time
(wired LED is red). This operation optimizes the RF
configurations for best performance and clears out all
devices from the WDL. The gateway will not be active
until at least one wireless device is registered.
4.4 Resetting to Default Communications Settings
Write the “RST_COM” Gateway Coil (Function Code
address = 4, Raw Address = 3) to TRUE. After setting this
coil to true, a device reset command must be issued (or
power cycling) before any of the new settings will take
effect.
Resets the baud rate, mode, and device ID back to defaults,
which are respectively: 19200, RTU: 8-N-1, 95.
4.5 Resetting the Gateway to Factory Settings
Write the “RST_FACTORY” Gateway Coil (Function Code
address = 5, Raw Address = 4) to TRUE. After setting this
coil to true, the device will reset automatically one second
after the write coil command is acknowledged. No manual
reset is required.
- 13 -

4.6 Viewing and Modifying MODBUS
Communication Settings
The BAUDRATE Gateway Register (Function Code 40006,
Raw Address 5) contains the baud rate setting. Encoded
options are:
0 : 2400
1 : 4800
2 : 9600
3 : 19200
4 : 38400
5 : 57600
6 : 115200
Example: Writing a value of 2 to this register will effectively
change the baud rate to 9600.
The COMMODE Gateway Register Function Code
address = 40007, Raw Address =6) contains the following
encoded options:
0 : RTU : 8-N-2
1 : RTU : 8-N-1
2 : RTU : 8-E-1
3 : RTU : 8-O-1
4 : ASCII : 7-N-2
5 : ASCII : 7-E-1
6 : ASCII : 7-O-1
Example: Writing a value of 2 to this register will effectively
change the communication mode to RTU: 8-E-1.
The ADDRESS Gateway Register (Function Code
address = 40008, Raw Address =7) contains the address
used by the MODBUS interface. Values of 1-247 are
permitted to be written.
Modifications to these registers are applied after a power-
cycle or gateway reset sequence.
Please see Ref.4 for more information.
- 14 -

4.7 Setting Gateway Time
GWTIME, consisting of GWTIME_H and GWTIME_L @
40011-40012 or RAW 10-11, is a UInt32 value that by
default represents the time in seconds from the point the
gateway was powered on or reset. A user, that has access
to some form of external time reference, can write to these
registers to set time. It is required that GWTIME_H is
written before GWTIME_L is written. Once GWTIME_L is
written the gateways time is officially updated with the
contents of GWTIME_H/L. Reading these register will
retrieve the gateway’s time in seconds.
The reference time used to set this time only needs to be
meaningful to the application it is used in. Most
applications do not require the Serial Modbus Gateway to
reference any time. If an application uses wireless device
synchronization settings, then the time must be set. As an
example, Current time is September 1st, 2016 at
17:05:15. If September 1st, 2016, 00:00:00 was referenced
as the beginning time, then the GWTIME can be set to (17
* 3600) + (5 * 60) + 15 = 61515. If January 1st, 2016,
00:00:00 was referenced as the beginning time, then
GWTIME can be set to (245 * 24 * 3600) + (17 * 3600) + (5
* 60) + 15 = 21229515. Both time references result in
accurate synchronization of remote wireless devices.
4.8 Viewing Registered Wireless Devices
The WD_CNT Gateway Register (Function Code
address = 40004, Raw Address =3) contains the number
of registered devices in the Wireless Device List (WDL).
A Value of 0 here denotes that no devices are registered
and the wireless is disabled.
The WDL consists of 50 set of 2-paired registers that
represents the Serial Identifier (SID) for the register device.
These registers can be read to discover the location of a
specific device in the list (SLOT).
Note: You need to have registered at least one sensor to
view/edit wireless device register data (WDR). Please see
Ref.4 for more information.
- 15 -

4.9 Adding a Wireless Device to the Gateway
Each device has a 32-bit serial identifier (SID). To add a
wireless device, this SID is written to the intended SLOT
(two registers at a time) in WDL registers.
Note: The two SLOT ID registers must be written to using
FC = 16 (Write to Multiple Registers) otherwise an error
will be generated. See section 3.0 for more details.
SLOT IDs can only be added one at a time.
For example: If you have sensor 43527 in hand and you
wanted to add this to SLOT 0, you would write the
following.
40101 / 100
0
40102 / 101
43527
To move a wireless device from one slot to another, the
SID of the wireless device only needs to be written to the
new SLOT. The old SLOT will be erased and prepared for
future use.
To delete a wireless device from the list, write a 0,0 into
the SLOT and the device will be erased and the SLOT is
prepared for future use.
When registering the first wireless device, the second LED
will go red signifying there is no wired communication
available, then the third LED will start flashing while the
wireless network resets. Please wait approximately 30
seconds (until all LEDs turn green, signifying a successful
network reset) after registering the first device, before at-
tempting any other tasks.
If the WDL SLOT is written to incorrectly, a “MODBUS IO
error message” is returned.
Please see Ref.3 for more information.
- 16 -

4.10 Verifying Wireless Device Activity
After a device is registered, the SLOT it was registered at
can be verified by reading the WDL. Once the slot is
known, a user can read the WDC [SLOT], WDR [SLOT],
and FRR [SLOT] associated with the wireless device.
If a wireless device is registered, but is not actively
communicating, the ACTIVE coil @ WDC[SLOT] offset 0
will be false.
When a wireless device is actively communicating, the
ACTIVE coil @ WDC[SLOT] offset 0 will be true.
4.11 Viewing Wireless Device Data
(Fast Read Method)
All Wireless Devices have two pieces of commonly useful
data:
1) if a threshold is breached or if the device is in an
exception state
2) the acquired data measurement.
Using the FRR, a user can quickly collect new data
generated by multiple devices registered on the gateway.
The purpose of these registers is to allow for efficient
access to the remote wireless device’s most current data.
When new data is available from any Wireless device the
FRR is updated with the newly reported values. The FRR
will zero itself out if no new data is received within a
defined period. The defined period is specified in the
Wireless Device Registers offset 18.
- 17 -

Any write to the first address in the FRR will zero out the
latest measurement and age. These records consist of
seven (7) registers per wireless device. The format of
these records are: AGE, DATA_0, DATA_1, DATA_2,
DATA_3, BATTERY, RSSI.
Fnct. Code ADDRESS = 41001+ (7 * SLOT)
Raw ADDRESS FORMULA = 1000+(7 * SLOT)
Please see Ref.5 for more information on these registers.
4.12 Viewing Wireless Device Data
(Advanced method)
For a user to see more data about a devices exception and
activity status, the ACTIVE coil @ WDC[SLOT] offset
0 and EXCEPTION coil @ WDC[SLOT] offset 1 can be
queried.
WDC F.C. FORMULA=2001+(4*SLOT)+OFFSET
WDC RAW ADDR FORMULA=2000+(4*SLOT)+OFFSET
Please see Ref.2 for more information on these coils.
For a user to see the detailed data from a device, read
register WDR [SLOT] offset 5 - 15. This will return device
battery voltage, signal strength, and specific status and
data from the device.
WDRF.C.FORMULA=42001+(50* SLOT) + OFFSET
WDR RAW ADDR FORMULA=2000+(50 * SLOT) +
OFFSET
Please see Ref.6 for more details on these registers.
- 18 -

4.13 Configuring Wireless Devices
(Standard Requests)
For a user to view and modify wireless device settings,
read/write to register WDR[SLOT] offset 19-23. These
registers contain information and settings relating to
communication intervals, retry, and failure recovery
behaviors.
Please see Ref.6 for more details on these registers.
After changes are made to these registers, the user can
use the PENDING_CFG coil @ WDC[SLOT] offset
2 to check the status of these changes. When this coil is
true, the pending changes have not been communicated
with the wireless device. When this coil is reset to false,
the wireless device has been updated with the change. We
recommend one update at a time.
4.14 Configuration Rules to Abide By
There are two important rules to obey when setting
Wireless Devices, to ensure optimum stability.
CFG_INTERVAL_EXCEPTION ≤CFG_INTERVAL_STANDARD
CFG_INTERVAL_STANDARD÷CFG_INT_TYPE_MEAS_PER_RPT≥1
AND
CFG_INTERVAL_EXCEPTION÷CFG_INT_TYPE_MEAS_PER_RPT≥1
- 19 -

4.15 Wireless Device Sync Setting
All “Interval Type” wireless devices contain configuration
CFG_INT_TYPE_SYNC @ offset 45 that enables them to
synchronize data reporting to an external clock. Value can
range from 0 – 5. If the value is 0 [default], the wireless
devices do not synchronize report interval and will report
data in respect to its startup time. If the value is 1 – 5, the
wireless device attempts to track its report time based on
the Serial Modus Gateway’s time. It is important that
GWTIME in the Gateway Registers is set with an
appropriate time reference. For instance, GWTIME could
be set to the number of seconds from January 1st, 2010,
00:00:00. Now when the Sync setting is not set to 0, the
wireless device will constantly adjust its reporting interval
to closely track a modulus of the gateway’s time. As an
example, if a wireless temperature sensor has a report
interval of 30 minutes and this sync setting is enabled, this
sensor will report its data near to 00:00, 00:30, 1:00, 1:30,
…, etc.
The difference in the enabled values of 1 – 5 correlate to
the number of “random seconds” that is included in the
calculation of next report interval. Theses setting are
useful in managing networks of different sizes. If 20
sensors were all configured to synchronize and deliver
data at the exact same time, the RF collisions would
cripple the sensor network. Please see table below for
recommend settings to be used with specific network
sizes.
Sync Setting
# of Devices
Random Time
1
1-2
1 Second
2
3-7
3 Seconds
3
8-15
7 Seconds
4
16-25
15 Seconds
5
26-50
30 Seconds
- 20 -