Elpro Technologies 105U-G User manual

ELPRO Technologies Pty Ltd, 9/12 Billabong Street, Stafford Q 4053, Australia.
Tel: [phone] Fax: [phone] Email: [email protected]
Web: www.elprotech.com
User Manual
105U-G Wireless Gateway

Important Notices
MAN_105G_1.16 Page 2
Thank you for your selection of the 105G module. We trust it will give you
many years of valuable service.
ATTENTION!
Incorrect termination of supply wires may
cause internal damage and will void warranty.
To ensure your 105G enjoys a long life,
double check ALL your connections with
the user’s manual
before turning the power on.

105U-G Wireless Gateway User Manual
Page 3©September 2004
Important Notice
ELPRO products are designed to be used in industrial environments, by experienced
industrial engineering personnel with adequate knowledge of safety design considerations.
ELPRO radio products are used on unprotected licence-free radio bands with radio noise and
interference. The products are designed to operate in the presence of noise and interference,
however in an extreme case, radio noise and interference could cause product operation
delays or operation failure. Like all industrial electronic products, ELPRO products can fail
in a variety of modes due to misuse, age, or malfunction. We recommend that users and
designers design systems using design techniques intended to prevent personal injury or
damage during product operation, and provide failure tolerant systems to prevent personal
injury or damage in the event of product failure. Designers must warn users of the equipment
or systems if adequate protection against failure has not been included in the system design.
Designers must include this Important Notice in operating procedures and system manuals.
These products should not be used in non-industrial applications, or life-support systems,
without consulting ELPRO Technologies first.
1. For 105G modules, a radio licence is not required in most countries, provided the
module is installed using the aerial and equipment configuration described in the 105U
Installation Guide. Check with your local 105G distributor for further information on
regulations.
2. For 105G modules, operation is authorised by the radio frequency regulatory authority
in your country on a non-protection basis. Although all care is taken in the design of
these units, there is no responsibility taken for sources of external interference. The
105U intelligent communications protocol aims to correct communication errors due
to interference and to retransmit the required output conditions regularly. However
some delay in the operation of outputs may occur during periods of interference.
Systems should be designed to be tolerant of these delays.
3. To avoid the risk of electrocution, the aerial, aerial cable, serial cables and all
terminals of the 105G module should be electrically protected. To provide maximum
surge and lightning protection, the module should be connected to a suitable earth and
the aerial, aerial cable, serial cables and the module should be installed as
recommended in the Installation Guide.
4. To avoid accidents during maintenance or adjustment of remotely controlled
equipment, all equipment should be first disconnected from the 105U module during
these adjustments. Equipment should carry clear markings to indicate remote or
automatic operation. E.g. "This equipment is remotely controlled and may start
without warning. Isolate at the switchboard before attempting adjustments."
5. The 105G module is not suitable for use in explosive environments without additional
protection.

Contents
MAN_105G_1.16 Page 4
Limited Warranty, Disclaimer and Limitation of Remedies
ELPRO products are warranted to be free from manufacturing defects for a period of 2 years
from the effective date of purchase. The effective date of purchase is decided solely by
ELPRO Technologies.
This warranty does not extend to:
- failures caused by the operation of the equipment outside the particular product's
specification, or
- use of the module not in accordance with this User Manual, or
- abuse, misuse, neglect or damage by external causes, or
-repairs, alterations, or modifications undertaken other than by an authorised Service
Agent.
ELPRO’s liability under this warranty is limited to the replacement or repair of the product.
This warranty is in lieu of and exclusive of all other warranties. This warranty does not
indemnify the purchaser of products for any consequential claim for damages or loss of
operations or profits and ELPRO is not liable for any consequential damages or loss of
operations or profits resulting from the use of these products. ELPRO is not liable for
damages, losses, costs, injury or harm incurred as a consequence of any representations,
warranties or conditions made by ELPRO or its representatives or by any other party, except
as expressed solely in this document.
How to Use This Manual
To receive the maximum benefit from your 105U-G product, please read the Introduction,
Installation and Operation chapters of this manual thoroughly before using the 105U-G.
Chapter Four Configuration explains how to configure the modules using the Configuration
Software available.
Chapter Six Troubleshooting will help if your system has problems.
The foldout sheet 105U-G Installation Guide is an installation drawing appropriate for most
applications.

105U-G Wireless Gateway User Manual
Page 5©September 2004
CONTENTS
Chapter 1 INTRODUCTION ...............................................................................................9
1.1 105G OVERVIEW 9
1.1.1 Modbus / DF1 105G 10
1.1.2 Profibus 105G 10
1.1.3 Ethernet 105G 11
1.1.4 DeviceNet 105G 12
1.1.5 Modbus Plus 105G 12
1.2 THE 105G STRUCTURE 13
1.2.1 On-board I/O 14
1.2.2 I/O Expansion - 105S modules 14
1.3 THE WIRELESS NETWORK 14
1.3.1 105U to 105G Network 14
1.3.2 105G to 105G Network 15
1.3.3 “Data Concentrator” Networks 16
1.3.4 105G Repeaters 17
Chapter 2 OPERATION.....................................................................................................19
2.1 START-UP 19
2.2 OPERATION 19
2.3 DATABASE 21
2.4 THE HOST - 105G LINK 23
2.4.1 Modbus / DF1 23
2.4.2 Profibus 23
2.4.3 Ethernet 24
2.5 RADIO SYSTEM DESIGN 24
2.5.1 Radio Signal Strength 24
2.5.2 Repeaters 25
2.6 RADIO COMMS FAILURE 25
2.6.1 Monitoring Communications Failure 26
2.7 SECURITY CONSIDERATIONS 26
Chapter 3 INSTALLATION ..............................................................................................28
3.1 GENERAL 28
3.2 ANTENNA INSTALLATION 28
3.2.1 Dipole antenna. 29
3.2.2 Yagi antenna. 30
3.3 POWER SUPPLY 31
3.3.1 AC Supply 32
3.3.2 DC Supply 32
3.3.3 Solar Supply 33
3.4 INPUT / OUTPUT 33
3.4.1 Digital Inputs / Outputs 33
3.5 SERIAL PORT 34
3.5.1 RS232 Serial Port 34
3.5.2 RS485 Serial Port 35
3.6 PROFIBUS PORT 37
3.7 ETHERNET PORT 38
3.8 MODBUS PLUS PORT 39
3.9 DEVICENET PORT 40
Chapter 4 CONFIGURATION...........................................................................................41
4.1 INTRODUCTION 41
4.2 CONFIGURATION PROGRAM 42
4.2.2 Security 46

Contents
MAN_105G_1.16 Page 6
4.3 MAPPINGS 105G TO 105U I/O MODULES 48
4.3.1 Mappings from Inputs at Remote 105U I/O Modules 48
4.3.2 Mappings from 105G to Outputs at Remote 105U I/O Modules 50
4.3.3 Don’t Send if in Comm Fail 52
4.3.4 Startup Polls 53
4.3.5 Polls to Remote Modules 53
4.4 MAPPINGS FROM 105G TO OTHER 105G MODULES 53
4.4.1 Entering a Block Mapping 55
4.4.2 Host Device Trigger 56
4.4.4 Real-Time 57
4.4.5 Change-of-State 59
4.4.6 Mixing Normal Mappings and Block Mappings 59
4.4.7 Comms Fail for Block Mappings 59
“Repeater-only” Configuration 60
4.5 CHANGE SENSITIVITY 60
4.6 SERIAL CONFIGURATION – MODBUS 62
4.6.1 MODBUS Slave 62
4.6.2 MODBUS Master 64
4.7 SERIAL CONFIGURATION - DF1 67
4.8 FIELDBUS CONFIGURATION 71
4.9 FIELDBUS CONFIGURATION - PROFIBUS SLAVE 76
4.10 FIELDBUS CONFIGURATION - PROFIBUS MASTER 77
4.10.1 GSD File 77
4.10.2 Protocol and Supported Functions 78
4.10.3 Configuration 78
4.10.4 Message Interface 89
Error Codes 109
DPV1 Return Codes 110
4.11 FIELDBUS CONFIGURATION - ETHERNET 111
4.11.1 Setting IP Address 111
4.11.3 EtherNet/IP 116
4.12 FIELDBUS CONFIGURATION – DEVICENET 120
4.12.1 DeviceNet Introduction 120
4.12.2 DeviceNet Address Setting 120
EDS File 121
4.12.3 Protocol and Supported Functions 121
4.13 FIELDBUS CONFIGURATION – MODBUS PLUS 121
4.13.1 Modbus Plus Introduction 121
4.13.2 Modbus Plus Addressing 122
4.13.3 Protocol & Supported Functions 122
4.13.4 Configuration 123
4.14 CONNECTING 105S SERIAL I/O 125
4.15 UPLOADING AND DOWNLOADING 126
4.15.1 Loading from a 105G 126
Chapter 5 SPECIFICATIONS..........................................................................................128
Chapter 6 DIAGNOSTICS...............................................................................................130
6.1 DIAGNOSTICS CHART 130
6.2 DIAGNOSTICS MENU 131
6.3 ETHERNET DIAGNOSTICS 138
6.4 FIELDBUS INDICATING LEDS140

105U-G Wireless Gateway User Manual
Page 7©September 2004
Chapter 7 WARRANTY ..................................................................................................145
Appendix 1 STATUS REGISTERS....................................................................................146
Appendix 2 IT Functionality ...........................................................................................148

105U-G Wireless Gateway User Manual
Page 9©September 2004
Chapter 1 INTRODUCTION
1.1 105G Overview
The 105U-G Wireless Gateway products provide a wireless interface between various
fieldbus protocols used in process and automation
applications. The 105U-G includes an integral
900MHz license-free radio transceiver, and
transfers transducer and control signals (I/O) using
a highly secure and highly reliable radio protocol.
The 105U radio protocol is designed for very
efficient radio band usage, with event reporting
communications, automatic acknowledgment and
error-correction, peer to peer addressing, multiple
path routing, and frequency encoding and data
encryption for system security.
Application types include:
•The 105U-G interfaces between 105U wireless
I/O and various fieldbus protocols. Connect
wireless I/O to PLC’s, DCS, SCADA or
Internet.
•Wireless extension of factory automation buses
such as Profibus.
•Wireless interconnectivity between different
fieldbuses - Ethernet to Profibus to Modbus to
DF1.
•Combined networks of the above.
The 105U-G has eight on-board discrete I/O. Each
I/O point can be configured individually as a contact input signal, or a discrete output signal.
Input signals can sent via its fieldbus connection to a host device (PLC, DCS etc) or be
transmitted by radio to other 105U units. The output signals can be driven by a host device,
or linked to inputs on remote 105U units.
This document assumes the reader is familiar with the operation of the 105U I/O modules -
for further information, please refer to the User Manuals for these products.
Profibus
Ethernet
Modbus
DF1
Internet
105U I/O
105U I/O
Direct I/O
105U-G Direct I/O
105U-G Profibus
105U-G
Profibus
105U-G
Profibus
Ethernet
105U I/O
105U I/O
Direct I/O
105U-G
Direct I/O
Profibus
Modbus
105U-G
105U-G
105U-G Modbus
105U-G
Ethernet
105U-G
Profibus

Chapter One Introduction
MAN_105G_1.16 Page 10
The 105U-G is referred to as the 105G for the rest of this document, to clearly differentiate
from normal 105U I/O modules.
Ordering information:
105U-G-MD1 Modbus Master & Slave / DF1 interface
105U-G-PR1 Profibus-DP Slave interface
105U-G-PR2 Profibus-DP Master interface
105U-G-ET1 Ethernet interface - Modbus TCP, Ethernet IP, FTP, HTML, Email
105U-G-DE1 DeviceNet Slave interface
105U-G-M+1 Modbus Plus Slave interface
1.1.1 Modbus / DF1 105G
The 105U-G-MD1 can be configured for Modbus master interface, Modbus slave, or DF1.
Modbus is a Master-Slave protocol originally developed by Modicon (now part of the
Schneider group). It became a popular interconnect protocol with many equipment
manufacturers. One Modbus master controls the Modbus network communications, which
can comprise up to 250 Modbus slave devices. The Modbus master can read or write I/O
values to/from Modbus slaves. The 105G can be configured as either Modbus Master or
Modbus Slave. The variation of Modbus supported by the 105G is “Modbus RTU” (also
known as “Modbus binary”).
DF1 is an Allen-Bradley protocol (Allen-Bradley is now part of the Rockwell Automation
group). DF1 offers both full-duplex (point to point) and half-duplex (multidrop) operation.
The 105G only supports the full-duplex operation - this is the default DF1 mode on most
equipment. DF1 full-duplex is a “peer-to-peer” protocol. Either DF1 device can initiate
commands to the other device, and both devices will respond to commands from the other
device.
The 105U-G-MD1 has two serial connections - RS232 and RS485, on the bottom end plate
of the module. The serial port provides both RS232 and RS485 hardware connections,
however both connections are paralleled internally - both connections cannot be used at the
same time. Either RS232 or RS485 can be used for Modbus communications, however only
the RS232 port can be used for DF1. The serial port must be configured to suit the host
device. Serial data rates between 1200 and 19200 baud may be selected, and character types
with 7 or 8 data bits, even/odd/none parity, and 1 or 2 stop bits may be selected.
The Modbus/DF1 105G has 4300 general-purpose I/O registers. Each discrete, analog and
pulse I/O point takes up one register.
1.1.2 Profibus 105G
The Profibus 105G provides Profibus-DP Slave functionality according to EN 50170.
Profibus is a popular automation fieldbus that originated in Germany and is used extensively
by Siemens and other automation suppliers.
The Profibus connection on the 105G is optically isolated RS485 using an on-board DC/DC
converter. The Profibus port has automatic baudrate detection (9600 bit/s - 12 Mbit/s).
The Profibus Slave 105G (PR1) will connect to a Profibus LAN controlled by an external
master device. The Profibus Master 105G (PR2) will control communications on a Profibus
LAN, and can connect to up to 125 Profibus slave devices.

105U-G Wireless Gateway User Manual
Page 11 © September 2004
The Profibus 105G I/O database has 4300 registers (each of 16 bit value), however the
Profibus interface limits the amount of I/O that can be transferred via the Profibus port.
Slave unit (PR1). The PR1 slave unit only supports 416 x 8 bit bytes of I/O. Of the 416
bytes of I/O, there is a maximum 244 input bytes and maximum 244 output bytes - that is,
if 244 input bytes are used then only 172 output bytes can be used (416 – 244). Each byte
can represent 8 discrete inputs or outputs, or an 8-bit value, or two bytes can represent a 16-
bit value. That is, analog or pulse I/O can be transferred as 8-bit registers (1 byte) or 16-bit
registers (2 consecutive bytes).
An “output” is a value coming into the 105G via the fieldbus (that is, a value written to the
105G from the Profibus master). An input is a value going out from the 105G via the
fieldbus (a value read by the Profibus master).
So a Profibus Slave 105G could handle up to 1952 (244 x 8) discrete inputs or 244 low
resolution analog inputs or 122 (244 x ½) high resolution analog inputs, or some combination
in between.
For example, a Profibus 105G can handle 400 discrete inputs, 240 discrete outputs, 90
analog inputs and 60 analog outputs (assume analogs are 16-bit). The number of input bytes
is 230 (400/8 + 90*2). The number of output bytes is 150 (240/8 + 60*2). The total number
of I/O bytes is 380. If the number of analog outputs was increased to 90, then the total
output bytes would be 210 (240/8 + 90*2), and the total number of I/O bytes is 440 - this
exceeds the capacity of the Profibus interface.
Master unit (PR2). The Profibus master interface supports 2048 input bytes and 2048 output
bytes. Each byte can be 8 discrete inputs or outputs, but analog or pulse I/O take up 1 byte
for low resolution values (8-bit) or 2 bytes for high resolution values (16-bit).
So a Profibus Master 105G can handle up to 4300 I/O total, but analog or pulse inputs are
limited to 2048 x 8-bit values or 1024 x 16-bit values. The same limit applies to outputs.
For example, a Profibus Master 105G can handle 2000 discrete inputs and 500 analog inputs
(assume analogs are 16-bit). The number of input bytes is 1250 (2000/8 + 500*2). The
same unit could handle 4000 discrete outputs and 750 analog outputs. The number of output
bytes is 2000 (4000/8 + 750*2). The total number of I/O is 3250 which is less than the total
limit of 4300.
1.1.3 Ethernet 105G
The Ethernet 105G provides several different types of Ethernet functionality:
•Modbus TCP. Modbus TCP uses Modbus as a base protocol within an Ethernet
communications structure. The 105G provides class 0, 1 and partially class 2 slave
functionality.
•EtherNet IP. EtherNet IP is the version of Ethernet used by Allen-Bradley devices. The
105G provides level 2 I/O server CIP (ControlNet and DeviceNet).
•Internet functionality. The 105G has 1.4Mbyte of non-volatile “flash” memory for
embedded web “pages” (dynamic HTTP), on-board file system, user downloadable web
pages thru FTP server, and email functionality (SMTP).
The Ethernet connection is a transformer isolated RJ45 connector, 10/100 Mbit/sec.
The Ethernet 105G I/O database has 4300 registers (each of 16 bit value), however the
Ethernet interface only supports 2048 input bytes and maximum 2048 output bytes. Each

Chapter One Introduction
MAN_105G_1.16 Page 12
byte can be 8 discrete inputs or outputs, but analog or pulse I/O take up 1 byte for low
resolution values (8-bit) or 2 bytes for high resolution values (16-bit).
An “output” is a value coming into the 105G via the fieldbus. An input is a value going out
from the 105G via the fieldbus.
So an Ethernet 105G can handle up to 4300 I/O total, but analog or pulse inputs are limited
to 2048 x 8-bit values or 1024 x 16-bit values. The same limit applies to outputs.
For example, an Ethernet 105G can handle 2000 discrete inputs and 500 analog inputs
(assume analogs are 16-bit). The number of input bytes is 1250 (2000/8 + 500*2). The
same unit could handle 4000 discrete outputs and 750 analog outputs. The number of output
bytes is 2000 (4000/8 + 750*2). The total number of I/O is 3250 which is less than the total
limit of 4300.
1.1.4 DeviceNet 105G
The DeviceNet 105G provides DeviceNet 2.0 Slave functionality. DeviceNet is an
automation fieldbus developed by Allen-Bradley (Rockwell Automation).
The DeviceNet connection on the 105G is optically isolated RS422 with selectable baudrate
between 125 and 500 Kbit/sec.
The 105G I/O database has 4300 registers (each of 16 bit value), however the DeviceNet
interface only supports 512 x 8 bit input bytes and 512 x 8 bit output bytes, and this limits
the amount of I/O that can be transferred via the DeviceNet port.
Each byte can represent 8 discrete inputs or outputs, or an 8-bit value, or two bytes can
represent a 16-bit value. That is, analog or pulse I/O can be transferred as 8-bit registers (1
byte) or 16-bit registers (2 consecutive bytes).
An “output” is a value coming into the 105G via the fieldbus (that is, a value written to the
105G from the DeviceNet master). An input is a value going out from the 105G via the
fieldbus (a value read by the DeviceNet master).
So a DeviceNet 105G can normally handle up to 4096 (512 x 8) discrete inputs or 512 low
resolution analog inputs or 256 (512 x ½) high resolution analog inputs, or some combination
in between. It can also handle the same number of outputs, however the total I/O count
cannot exceed the 105G database size of 4300.
1.1.5 Modbus Plus 105G
The Modbus Plus 105G provides Modbus Plus Slave functionality. The Modbus Plus
connection on the 105G is optically isolated RS485 with standard baudrate of 1 Mbit/sec.
The 105G I/O database has 4300 registers (each of 16 bit value), however the Modbus Plus
interface only supports 1024 input registers and maximum 1024 output registers. Each
register can be 16 discrete inputs or outputs, or one analog or counter 16-bit value.
An “output” is a value coming into the 105G via the fieldbus. An input is a value going out
from the 105G via the fieldbus.
So an Modbus Plus 105G can handle up to 4300 I/O total, but analog or pulse inputs are
limited to 1024 x 16-bit values. The same limit applies to outputs.
The Modbus Plus interface allows global data base transactions with routing for up to six
Modbus Plus networks.

105U-G Wireless Gateway User Manual
Page 13 © September 2004
1.2 The 105G Structure
The 105G has three functional sections:
•The Radio Interface consists of an I/O database (or "Process Image") that maintains the
latest values of all I/O in the wireless I/O system. The I/O database comprises 4300 x 16
bit I/O registers and 4300 x 16 bit status registers. There are also other registers in the
database that can be used for system management - they are discussed later in this
manual. NOTE – the terms ‘Radio Interface’ and ‘I/O database’ are used interchangeably
throughout the manual.
•The radio port allows the 105G to communicate with other 105G and/or 105U modules
using the 105U protocol (called “ELPRO 105U”). Messages from the 105U modules are
received by the radio port and used to update the input values in the 105G Radio Interface.
The radio port also creates the correct radio message to set outputs on the remote 105U
modules.
The ELPRO 105U protocol is an extremely efficient protocol for radio communications.
Radio messages can be sent using exception reporting - that is, when there is a change of
an input signal - or by read/write messages. Each message can comprise a single I/O
value, or multiple I/O values (termed a “block” of I/O). There are also update messages,
which are sent for integrity purposes. Messages include error checking, with the
destination address sending a return acknowledgment. Up to five attempts are made to
transmit the message if an
acknowledgment is not received.
The ELPRO 105U protocol is
designed to provide reliable radio
communications on an open
license-free radio channel.
•The Fieldbus port enables
communications between a host
device, which could be a PLC,
DCS, HMI, intelligent transducer,
etc), and the 105G Radio Interface
database. A “host device” may be
one or several devices connected to
the same fieldbus or network (for
example, an Ethernet LAN) - in this manual, the LAN is considered as a “host device”.
The fieldbus port decodes messages from the host device and reads or writes I/O values to the
database. The fieldbus port can also generate messages to the host device.
The 105G I/O database effectively isolates the fieldbus and the radio network. This provides
a high level of system performance. The 105U radio protocol is very efficient and reliable
for radio communications. It minimizes radio channel usage by "change-of-state" reporting,
and allows the use of intermediate repeater addresses. It also allows peer-to-peer (105U to
105U, 105G to 105G) and peer-to-master (105U to 105G) communications. PLC protocols,
by comparison, are designed to provide transfer of large I/O files by "wire" link. The 105G
retains the advantage of both protocols in their respective communications media.
FIELDBUS
INTERFACE
FIELDBUS
PROFIBUS
ETHERNET
MODBUS
DF1
DEVICENET
MODBUS +
RADIO
PORT
RADIO
INTERFACE
I/O
DATABASE
905U
RADIO
INTERFACE
105U-G
ON-BOARD I/O
EIGHT DISCRETE I/O SIGNALS

Chapter One Introduction
MAN_105G_1.16 Page 14
1.2.1 On-board I/O
The 105G has eight on-board discrete I/O. Each I/O point can be used as either a discrete
input (voltage free contact input) or discrete output (transistor output) - an I/O point cannot
be used as both input and output. Each I/O point is linked to two separate I/O registers in the
database - one for the “input” function and one for the “output” function.. If the output
register is set “on” by the fieldbus or by a radio message from a remote module, then the
105G will automatically set the input register for the same I/O point to “off”. This means that
the output register has priority over the input register - if there is a conflict, the input value
is ignored.
The 105G also has three internal inputs linked to I/O registers:
♦Supply voltage status - if the normal supply fails, this status is set on.
♦Low battery voltage. The 105G has an internal battery charger to trickle charge a back-up
battery. If the battery voltage is low, this status is set.
♦Battery voltage - the actual value of the connected battery voltage.
1.2.2 I/O Expansion - 105S modules
The 105G provides eight on-board discrete I/O. Where additional I/O is required, 105S
modules can be connected to the RS485 port of the 105G modules.
Note: 105S modules cannot be connected to the 105U-G-MD1 unit (as this unit uses the
RS485 port for Modbus or DF1 communications), unless this unit is configured as
“Repeater-only” and does not have a host device connected.
1.3 The Wireless Network
The 105G can communicate with up to 490 other addresses - this could be 490 other 105U
modules, or in the case of 105K modules, it could be many thousands of modules (as many
105K modules can share the same address). 105G modules may take up more than one
address under some circumstances.
Any 105G or 105U module can act as a radio repeater for other modules - that is, radio
messages can be passed onto other modules. Up to five repeater addresses can be configured
for messages transmitted to a 105G module.
Each module can have a unit address between 1 – 95, but the 105G also recognizes repeater
addresses in conjunction with the unit address as the module “identifier”. Hence module #2
is recognized as different to #2 via #57 - #57 being a repeater.
1.3.1 105U to 105G Network
In the wireless I/O system, the 105G acts as a normal 105U module (this covers 105U I/O,
105S I/O, 105U-K and 105U-C modules).
105U modules transmit messages to the 105G address and the 105G acknowledges these
messages like a normal 105U module. When a 105G transmits messages to change remote
outputs, it will "re-try" if it does not receive an acknowledgment, like a normal 105U module.
Remote 105U modules can connect to 105S modules in the normal way. The 105G host can
access I/O on 105S modules by using the intermediate 105U as a repeater.

105U-G Wireless Gateway User Manual
Page 15 © September 2004
105U modules can transmit input
messages directly to outputs on other
105U module, as well as the 105G. The
same input can be transmitted to different
addresses by entering two "mapping"
configurations at the remote module.
Normal 105U Messages
I/O registers in a 105G can be configured
(mapped) to outputs at remote 105U
modules, or I/O registers in 105G
modules. The 105G will transmit an I/O message when a “change-of-state” occurs for that
I/O register . Registers have a configurable “sensitivity” value - this determines how much
the register value has to change to trigger a change message. A change-of-state occurs when
the register value has changed by more than the sensitivity value since the last transmission.
The 105G also transmits periodic update messages if there has been no change - if an I/O
register is mapped to a remote output or another 105G, then that register can be configured
with an update time.
105G modules can transmit to 105G modules as well as other 105G modules. There can be
multiple 105G and 105C modules in a network - as well as 105U I/O. Because the 105U
protocol is peer-to-peer, there are few constraints on communications between multiple 105U
modules.
Poll Messages
A 105G can also generate poll messages to remote 105U modules. These poll messages act in
the same way as a start-up poll - the remote module immediately responds with update
messages for any I/O mappings configured to the 105G.
Poll messages can be triggered by:
•time period, configurable 1 – 4096 sec (1.1 hour), or
•real time clock, or
•on demand by the host device, by writing to a “trigger register” in the 105G
1.3.2 105G to 105G Network
Different types of 105G modules can communicate - for example, a Modbus 105G can
communicate with an Ethernet 105G. I/O registers in one 105G can be transmitted to I/O
registers in another 105G. When the 105G is configured, “mappings” can be entered linking
I/O registers to registers in another 105G.
105U-G
105U-3
105U-1 105S-2
505U-K
105U-G
105U-3
105U-1
PLC
105U-C
PLC

Chapter One Introduction
MAN_105G_1.16 Page 16
As well as the normal “I/O change” messages and update messages, the 105G has “block
read” and “block write” messages for use with other 105G modules. These messages will
transmit multiple register values instead of only one as in the normal 105U message. The
block read/write messages increase the efficiency of radio communications where a 105G
“sees” a large number of changes in its database at the one time. For example, if a host
writes a block of 100 signal values to a 105G, and 20 of these values have changed since the
last write-operation. If the block is mapped to another 105G, then the 105G can transmit all
20 values in one radio message, instead of 20 messages.
Normal I/O messages can be repeated by any type of 105U I/O module, however block
read/write messages can only be repeated by other 105G modules.
Block Read Message
A block read message is a request to another 105G to transmit the values of a consecutive
block of registers. The destination 105G will respond with the values, which will be stored in
a corresponding block of registers in the originating 105G. A block read message can be
triggered by:
•time period, configurable 1 – 4096 sec (1.1 hour), or
•real time clock, or
•on demand by the host device, by writing to a “trigger register” in the 105G.
Block Write Message
A block write message transmits a consecutive block of register values from one 105G to a
destination 105G. It can be triggered by:
•time period, configurable 1 – 4096 sec (1.1 hour), or
•real time clock, or
•on demand by the host device, by writing to a “trigger register” in the 105G, or
•a change-of-state event occurring within the block of I/O registers.
If a block write message has been configured to be transmitted on change-of-state, a “time
window” is configured. When a change-of-state occurs in one of the registers in the block,
the time window will be activated. All changes during the time window will be grouped
together and transmitted as one block write message. That is, the block write message will
not be sent immediately the first change-of-state occurs (unless the time window is
configured to zero), but will be sent at the end of the time window - any other registers in
the block that change during the time window will be sent as part of the same message. The
time window can be configured from 0 – 255 seconds.
1.3.3 “Data Concentrator” Networks
105G units can act as “data concentrator” units to collect I/O from a local network of 105U
wireless I/O modules and pass the I/O on to another 105G as a block.

105U-G Wireless Gateway User Manual
Page 17 © September 2004
This type of network reduces the amount of radio traffic and is suitable for systems with a
large number of I/O modules. The system is divided into local sub-networks, each with a
105G unit. The 105U modules transmit their I/O vlaues to the 105G. The 105G then
transfers these values to the “central” 105G using a block transfer which is very efficient
compared to a lot of individual I/O transmissions.
The data concentrator network is different than using the 105G as a repeater. A repeater re-
transmits each message in the same format. A data concentrator collects the I/O values as a
block, and transmits the complete block in one transmission.
1.3.4 105G Repeaters
Any 105U module can repeat a normal radio message, however only 105G modules can
repeat a block message. 105G units connected to a host device can also act as a repeater for
other modules.
Where a 105G is being used without a host device as a repeater or data-concentrator, it can
be configured as “Repeater-only”. This allows the RS232/485 port to be used for on-line
diagnostics. If the unit is a 105U-G-MD1, the “Repeater-only” configuration also allows this
module to connect to 105S serial I/O modules.
TO HOST
DEVICE
NETWORK OF
105U I/O UNITS
105U-G
105U-G
NETWORK OF
105U I/O UNITS
105U-G

105U-G Wireless Gateway User Manual
Page 19 © September 2004
Chapter 2 OPERATION
2.1 Start-up
The 105G operating software and the database configuration are stored in non-volatile
memory, however the database I/O register values are lost on power failure (in the same way
as a PLC).
On start-up, the 105G sends "start-up poll" messages to remote modules based on the source
address of inputs configured in the database (the start-up messages can be disabled by
configuration). The remote modules respond with update messages for their inputs, which
sets initial values in the 105G I/O database registers. The 105G provides a delay of 5 seconds
between each start-up poll, to allow the remote module to respond and to avoid overloading
the radio channel.
If there are a lot of remote modules, then this start-up stage may take a significant time, and
this should be allowed for in the system design. The 105G has an internal battery charger
feature and the use of a back-up battery should be considered if this start-up delay presents a
constraint to system reliability. Start-up polls may be disabled for individual remote modules
in the database configuration.
For the host device, the 105G provides an "Active" signal on the RS232 port (DCD pin 1). Its
purpose is to indicate to the host that the 105G is now processing output messages for the
remote modules. When the 105G powers down (or should an internal fault occur), the
"Active" signal resets (turn “off” or “0”). When the 105G starts-up, it holds the "Active"
signal in a reset condition (“off” or “0”) for a time equal to the number of remote addresses
(or modules) configured times 5 seconds plus any delay if remote addresses are offline. For
example, if there are 20 remote addresses configured in the 105G database, then the “active”
signal will be held in the reset state for 100 seconds (20 x 5). During this period, the 105G
will not change any output values in its database. After this time, the 105G will set the
"Active" signal (to “on” or “1”) - the host can then send messages to the 105G to update the
output values in the database.
2.2 Operation
The 105G database can hold values for 4300 I/O signals plus the 8 on-board I/O. The
database registers (also called I/O registers) can be accessed by both the radio port and the
fieldbus port. The host device can change values in the database via the fieldbus, and the
105G can transmit radio messages out with the new values. Radio messages can be received
with new values for database registers, and these new values can be written to the host device
or read by the host device, via the fieldbus.
The 105G operation must be configured before the 105G will function. Configuration is
achieved by creating a configuration file on a PC and downloading this file to the 105G. The
105G configuration may also be "uploaded" to a PC for viewing and modification. For more
information, refer to the Configuration section of this document.
Each I/O register in the 105G database has a 16-bit value. It doesn’t matter if the remote I/O
is digital (discrete), analog or pulse. The host protocol driver in the 105G will convert the 16
bit value into a value that the host will understand. For example, if the host device requests a

Chapter One Introduction
MAN_105G_1.16 Page 20
binary/digital read command, the 105G will convert the 16 bit value into a binary (1 bit) value
before it responds.
An example of normal operation - assume that a remote module has address 14 and the 105G
is address 1. Module #14 is configured with a mapping DI1 →I/O Reg 76 at #1. When DI1
turns "on", module #14 transmits a message. If the 105G can hear this message, it will
transmit an acknowledgment back to module #14, and updates the value of I/O register 76 in
the 105G database. The host device can read I/O register 76 via the data-bus, or the 105G
may write the value of I/O register 76 to the host device.
I/O registers that receive values from other 105U or G modules via radio are configured with
a “Communications fail time”. If the 105G does not receive a message for this I/O register
within the comms-fail time, then the I/O register is given a “comms fail” status which the host
device can read.
I/O registers that transmit out to other 105U or G modules are configured with an “update
time” and a “sensitivity”. The 105G will transmit a message to the configured remote output
whenever the I/O register value changes by the sensitivity amount – if it has not changed
within the update time, the 105G will send a message anyway. The 105G will make five
attempts to send a message - if it does not receive an acknowledgment from the remote
module, then the I/O register is given a “comms fail” status which the host device can read.
Each I/O register has an associated “status” register, which includes information such as
comms-fail status. As well as each I/O register having an individual comms-fail status, each
remote module has an overall comms fail status. This status is “set” (on) whenever a comms-
fail occurs for an individual I/O register, and is “reset” (off) whenever a message is received
from the remote module. The 105G can be configured to not send any update messages to a
remote module if it senses that the remote module is in “comms fail” - that is, if any I/O
register associated with the remote module is in “comms fail”. It will start sending update
messages again when the 105G receives a message from the remote module. The default
configuration is that output updates ARE sent during comms fail conditions.
105U-G
105U-1
DIN1
#14 #1

105U-G Wireless Gateway User Manual
Page 21 © September 2004
2.3 Database
The 105G database (Radio Interface) has 10 000 registers, each of 16 bit size. The structure
of the database is:
Registers Purpose
0 - 4299 I/O registers
4300 - 4399 On-board I/O
4401 - 4499 Comms-fail status and radio strengths for remote modules
5000 - 9499 Status registers - 16 bit status for each I/O signal
9500 - 9999 Status registers for block read/write messages
The register numbers may be used by the Host Protocol Driver to access I/O values and I/O
status information. Each configured I/O point has a 16 bit value (in registers 0000 - 4299),
and a 16 bit status value. The status register is located at 5000 plus the I/O value register. For
example, an I/O point in register number 2560 has a status value in register number 7560
(5000 + 2560).
Details of the status register are provided in Appendix A. The most important part of the
status register is the 15th or most significant bit - this indicates comm-fail status for the I/O
register. If the most significant bit is set, then the I/O register is in comms-fail.
The host device can read the status registers. For example, the communications status of an
output configured at register number 3001 can be examined by reading register number 8001
(5000 + 3001). If the register value is greater than 32767, then the 15th bit is set, indicating
that the output has a communications failure.
On-board I/O and Internal I/O
The 105G has eight discrete I/O points. These may be used as inputs or as outputs. Inputs are
linked to registers 4300-4307. That is, if a contact connected to DIO1 is “on”, then register
4300 is given an “on” value. Outputs are controlled from registers 4320-4327; that is, if
register 4327 is set to an “on” value, then output DIO8 is activated.
Whenever an output register is set “on”, the corresponding input register is automatically set
“off”. For example, if register 4321 is set to “1”, the 105G will also set 4301 to “0”. This
means that if both the input and output registers corresponding to the same I/O point are used
in the configuration, then the output register has priority.
Outputs may be written to by either the host device or by a remote 105U via the radio port.
Input values can be sent to the host device or to a remote module via the radio port.
The 105G also monitors its battery voltage and supply voltage. These are stored in registers
4310 and 4311 respectively, as 16 bit values, scaled so that a value of 16384 decimal (hex
4000) corresponds to 8 V, and a value of 49152 (hex C000) corresponds to 40V.
A low battery alarm is available at register 4308. This becomes active when the battery
voltage falls below 11.3V, and clears when the battery voltage rises above 11.8V. Supply

Chapter One Introduction
MAN_105G_1.16 Page 22
voltage is also monitored, and an alarm is available at register 4309. This becomes active if
the supply voltage falls below 8.0V, and clears when the supply voltage rises above 9.0V.
I/O Register Description I/O Register Description
4300 Input value DIO 1 4320 Output value DIO 1
4301 Input value DIO 2 4321 Output value DIO 2
4302 Input value DIO 3 4322 Output value DIO 3
4303 Input value DIO 4 4323 Output value DIO 4
4304 Input value DIO 5 4324 Output value DIO 5
4305 Input value DIO 6 4325 Output value DIO 6
4306 Input value DIO 7 4326 Output value DIO 7
4307 Input value DIO 8 4327 Output value DIO 8
4308 Low battery voltage status
4309 Supply voltage fail status
4310 Battery voltage value
4311 Supply voltage value