Grundfos CIU 250 User manual

GRUNDFOS INSTRUCTIONS
Grundfos CIU 250
GSM for Grundfos MP 204
Functional profile and user manual

2
Original installation and operating instructions.
CONTENTS
Page
1. Symbols used in this document
2. Introduction
2.1 About this functional profile
This functional profile describes the CIU 250 (GSM/GPRS
Communication Interface Unit 250) for the Grundfos MP 204
motor protector.
In the following, the CIU 250 is referred to as "communication
interface".
The data in this document are subject to change without prior
notice. Grundfos cannot be held responsible for any problems
caused directly or indirectly by using information in this functional
profile.
2.2 Assumptions
This functional profile assumes that the reader is familiar with
commissioning and programming Modbus devices. The reader
should also have some basic knowledge of the Modbus protocol
and technical specifications.
It is also assumed that an existing GSM/GPRS network with
a Modbus master is present.
2.3 Definitions and abbreviations
1. Symbols used in this document 2
2. Introduction 2
2.1 About this functional profile 2
2.2 Assumptions 2
2.3 Definitions and abbreviations 2
2.4 System diagram 3
2.5 Specifications 4
3. CIM 250 GSM module 5
3.1 Installation 5
3.2 LEDs 7
4. Modbus function code overview 7
5. Functional profile 8
5.1 Register block overview 8
5.2 CIM configuration register block 8
5.3 CIM status register block 9
5.4 MP 204 control register block 10
5.5 MP 204 status register block 11
5.6 MP 204 data register block 13
5.7 Alarm simulation register block 14
5.8 User register block 14
6. GSM call-up connection to SCADA system 15
6.1 Call-up functional description 15
6.2 SCADA PIN code protection 15
6.3 GSM call-up options setup 15
7. GPRS connection 16
7.1 What is GPRS and Modbus TCP? 16
7.2 Subscription 16
7.3 Installation 16
7.4 Operation 17
8. Fault finding 19
8.1 LED status 19
8.2 Modbus GSM/GPRS communication faults 20
9. Data item overview 21
10. Grundfos alarm and warning codes 24
11. Modbus telegrams and function codes 26
11.1 Modbus telegram overview 26
11.2 Read holding registers (0x03) 27
11.3 Read input registers (0x04) 27
11.4 Write single register (0x06) 27
11.5 Write multiple registers (0x10) 28
11.6 Diagnostics (0x08) 28
11.7 Diagnostics register interpretation 29
12. Modbus telegram examples 30
12.1 Diagnostics: return query data 30
12.2 Reading the CIM configuration register block 30
12.3 Tripping the MP 204 30
12.4 Resetting an alarm 30
Caution
If these safety instructions are not observed,
it may result in malfunction or damage to the
equipment!
Note
Notes or instructions that make the job easier
and ensure safe operation.
0b Prefix "0b" indicates a binary number.
0x Prefix "0x" indicates a hexadecimal
number.
APN
Access Point Name.
Name used to identify a GPRS service
in the GSM mobile network.
CIM 250 Grundfos GSM Communication Interface
Module (built into the CIU 250).
CIU 250 Grundfos GSM/GPRS Communication
Interface Unit.
CRC Cyclic Redundancy Check.
A data error detection method.
CSD
Circuit Switched Data.
Connection is established via a fixed
connection (a physical circuit or
a reserved data channel).
GENIbus Proprietary Grundfos fieldbus standard.
GPRS General Packet Radio Service.
TCP/IP networking via GSM network.
GRE
Generic Routing Encapsulation.
A tunnelling protocol that can
encapsulate a TCP packet type inside
IP address tunnels, creating a virtual
point-to-point link between routers at
remote points over the internet.
GSM Global System for Mobile
communications.
LAN Local Area Network.
LED Light-Emitting Diode.
Modbus RTU
Modbus is a fieldbus used worldwide.
The RTU version is used for wired
networks and for call-up connections
over telephone networks.
Modbus TCP
Modbus is a fieldbus used worldwide.
The TCP version is adapted for use as
an application protocol on TCP/IP.
MP 204 Grundfos Motor Protector.
PIN Personal Identification Number
(SIM cards).
PUK Personal Unblocking Key (SIM cards).

3
2.4 System diagram
The Grundfos MP 204 is an electronic motor protector.
The MP 204 is connected to a Grundfos pump.
The system diagram gives an overview of how to connect the
CIU 250 to the Grundfos MP 204 via GENIbus.
The CIU 250 solution is a box with a power supply module and
a CIM 250 module. The CIU 250 can either be mounted on a
DIN rail or on a wall. See fig. 1.
Remote communication via the CIU 250 can be established by
using one of the following options:
• Modbus RTU protocol via a GSM connection
• Modbus TCP protocol via a GPRS connection
• SMS commands from a mobile phone.
Infrared remote communication can also be established with the
hand-held Grundfos R100 remote control. This is out of the scope
of this manual.
Fig. 1 CIU 250 solution for the MP 204 connected to a pump
SELV Separated or Safety Extra-Low Voltage.
SELV-E Separated or Safety Extra-Low Voltage
with Earth connection.
SIM SIM card, Subscriber Identity Module.
SMA SubMiniature version A.
Coaxial radio signal connection
standard.
TCP/IP Transmission Control Protocol/Internet
Protocol. Protocol suitable for internet
communication.
Transmission speed Bits transferred per second.
UTF-8 Unicode Transformation Format
(character encoding).
VPN Virtual Private Network.
A network using the internet to connect
nodes. These systems use encryption
and other security mechanisms to
ensure that only authorised users can
access the network and that the data
cannot be intercepted.
TM04 7444 0610
Grundfos MP 204 with pump
GSM/GPRS
CIU
R100
Pump
MP 204
motor
protector
GENIbus
RS-485

4
2.5 Specifications
The table below gives an overview of the specifications for the Grundfos CIU 250. For further details, please refer to the specific sections
of this functional profile.
General data Description Comments
Ambient humidity 30 % to 95 % Relative, non-condensing.
Battery, lithium-ion
The battery will only be charged if the
battery temperature is within 0 °C to
+45 °C.
GENIbus visual diagnostics LED2
Will be in one of these states:
Off, constantly green, flashing red, constantly red.
See section 3.2 LEDs.
Modbus GSM/GPRS specifications
Data protocol Modbus RTU/Modbus TCP
Modbus connection type GSM/GPRS
Slave address Factory 231 (0xE7) Can be changed via Modbus register 00003,
SetModbusAddress.
GSM/GPRS visual diagnostics LED1
Will be in one of these states:
Off, flashing green, flashing red, constantly red.
See section 3.2 LEDs.
Maximum Modbus telegram size 256 bytes Node address and CRC included.

5
3. CIM 250 GSM module
Fig. 2 CIM 250 GSM module (top side view)
3.1 Installation
3.1.1 Fitting a GSM antenna
An antenna must be connected to the CIM 250 to establish
connection to the GSM network.
External antenna
Connect the antenna cable to the SMA connection (pos. 1) of the
CIM 250. The antenna must be installed outside the control
cabinet in a position with good reception conditions.
Fig. 3 Fitting an external GSM antenna
3.1.2 Inserting the SIM card
Before inserting the SIM card into the CIM 250, remove the
PIN code, or set the PIN code to "4321".
Procedure
1. Insert the SIM card into a mobile phone.
2. Remove the PIN code from the SIM card, or set the PIN code
to "4321". See the manual of the mobile phone.
3. Insert the SIM card into the CIM 250. See fig. 4.
Fig. 4 Inserting the SIM card
TM04 2642 1210
Pos. Designation Description
1 Battery socket
2 SIM card holder
3 SMA connection for GSM antenna
4LED1 Yellow/green status LED for
GSM/GPRS communication
5LED2
Red/green status LED for internal
communication between the CIU 250
and MP 204
6SW1
Reset button.
Keep the button pressed for 5 seconds
to return to default settings.
Note
Before installation, make sure that the power
supply has been switched off and that it cannot
be accidentally switched on.
Note
If the CIU 250 is installed in a metal control
cabinet, Grundfos recommends to fit an external
GSM antenna.
Grundfos offers different kinds of antennas.
No antenna is supplied with the CIU 250. It has to
be ordered separately.
1
23 45
6
TM04 2644 2808
Pos. Description
1 SMA connection for GSM antenna
2 Antenna cable for external GSM antenna
Note
The slanted edge of the SIM card must point
downwards.
The connectors on the SIM card must point
downwards towards the CIM 250. See fig. 4.
TM04 2643 2808
Pos. Description
1 SIM card holder
2SIMcard
1
2
1
2

6
3.1.3 Connecting the battery and power supply
These safety precautions must be observed:
• Only insert the approved Grundfos battery pack (96881516).
• Never use this battery pack in other battery chargers.
• Do not dismantle or modify the battery.
• Do not heat or incinerate the battery.
• Do not pierce, crush or cause mechanical damage to the
battery.
• Do not short-circuit the battery.
• Do not allow the battery to get wet or be immersed in water.
• Do not strike or throw the battery.
• For long periods of storage, the temperature should be below
45 °C.
The CIM 250 is fitted with a lithium-ion battery. It is secured by
a velcro strap which absorbs vibrations and makes it easier to
replace the battery. Connect the battery to the CIM 250 as shown
in fig. 5.
Fig. 5 Connecting the battery
Switch on the power supply. The CIM 250 is powered either by
the CIU 250 or by the battery.
The LED1 is flashing yellow (searching for GSM network).
When the connection to the GSM network has been established,
the LED1 will pulsate yellow (GSM network active). See fig. 6.
The LED2 must be constantly green, indicating that the CIM 250
has been fitted correctly in the CIU 250.
3.1.4 Configuration
For software configuration of the CIU 250, which includes setting
of SMS functions and SCADA communication parameters, see
"CIM 25X SMS commands" (supplement to installation and
operating instructions) on the CD-ROM supplied with the GSM
module.
Warning
The CIM 250 must only be connected to SELV or
SELV-E circuits.
Warning
The safety precautions listed below must be
observed carefully as improper handling of the
lithium-ion battery may result in injury or damage
from electrolyte leakage, heating ignition or
explosion.
Note
If the battery is not connected, the user will not
receive any SMS alarm message in case of
a power cut.
TM04 2645 2808
Note
The battery will only be charged if the battery
temperature is within 0 °C to +45 °C.

7
3.2 LEDs
The CIM 250 GSM module has two LEDs.
See fig. 2.
• Yellow/green status LED (LED1) for GSM/GPRS communication
• Red/green status LED (LED2) for internal communication between the CIU 250 and the MP 204.
LED1 (yellow/green)
Fig. 6 LED1 status
LED2 (red/green)
4. Modbus function code overview
The supported function codes are shown in the table below:
The same data are available in both holding registers and input registers, meaning that either function (0x03 or 0x04) can be used for
reading data.
Examples illustrating the use of the supported function codes can be found in section 11. Modbus telegrams and function codes.
Modbus telegram examples illustrating the use of the functional profile can be found in section 12. Modbus telegram examples.
TM04 5194 2809
Searching for GSM network
Call-up connection active
Data via GPRS
Data via call-up connection
SMS message
1 sec.
3 sec.
1
6
4
5
3
2
Yellow Green
GSM network active
Pos. Status Description
1 Flashing yellow. Searching for GSM network.
2 Pulsating yellow (single pulse). Connection to the GSM network has been established.
3 Constantly yellow. Call-up connection has been established.
4 Pulsating green (single pulse). Data are exchanged via GPRS.
5 Pulsating green (double pulse). Data are exchanged via the call-up connection.
6 Green (3 sec.). Sending or receiving an SMS message.
Status Description
Off. The CIU 250 has been switched off.
Flashing red. No communication between the CIU 250 and the MP 204.
Constantly red. The CIU 250 does not support the connected version of the MP 204.
Constantly green. The connection between the CIU 250 and the MP 204 is OK.
Note
The CIU 250 must have finished its start-up sequence before the LED2 can be used for status. This means that a
certain delay may occur before the LED2 turns green after start-up of the CIU 250.
Type Code Hex Name
16-bit data (registers)
03 0x03 Read holding registers
04 0x04 Read input registers
06 0x06 Write single register
16 0x10 Write multiple registers
Diagnostics 08 08 Diagnostics
See section 11.6 Diagnostics (0x08) for subcodes.
Note
Reading or writing coils are not supported.

8
5. Functional profile
5.1 Register block overview
The Modbus RTU registers are grouped in the following register blocks:
All addresses contain registers. Some are bit-interpreted while others are 16-bit values, or part of 32-bit values. A data value of 65535
(0xFFFF) indicates "not available" when reading registers. The value of 65535 (0xFFFF) does not imply a "disable" when writing values.
Each register block will be specified in more detail in the following sections.
5.2 CIM configuration register block
Registers in this block can be read by means of function codes 0x03 and/or 0x04. They can be written as holding registers with function
codes 0x06 and 0x10.
Start address Register block Permissions Description
00001 CIM configuration R/W Configuration of the CIM module.
00021 CIM status R Status registers for the CIM module.
00101 MP 204 control R/W Registers for control of the MP 204.
00201 MP 204 status R Registers for status from the MP 204.
00301 MP 204 data R Registers for measured data values from the MP 204.
00701 Alarm simulation R/W Registers for alarm and warning simulation.
00751-
00800 User R/W The CIU 250 will not modify this area by itself.
Address Register name Description
00001 SlaveMinimumReplyDelay Not used.
00002 RegisterOffset
An address offset that is added to all addresses above 00100.
Default value is 0.
Note: This offset does not affect the CIM configuration register block or the CIM status
register block addresses. The register offset value is stored in the device and will remain
after a power-off.
For most applications, this offset should not be changed.
00003 SetModbusAddress
The value is stored in the device and will remain after a power-off.
Legal values are 1 - 247.
Default value of this register is 0xE7 (231), which should normally not be changed.
00004 SoftwareDefinedBitRate Not used.
00005 AutoAckControlBits
Used to select the behaviour of control bit acknowledgements from the CIU 250.
0 = Disabled.
Control bits are not automatically lowered when accepted by the device. The user must
lower the triggered control bit manually before the control bit can be triggered again.
1 = Enabled.
Control bits are automatically lowered when accepted by the device. The user does not
have to lower it manually [default].
General acknowledgement bit information register 00208 (when automatic
acknowledgement is disabled):
Acknowledgement bits will be set when the CIU 250 has accepted the corresponding
control bits, and the user can clear the control bits. The acknowledgement bit will
automatically be cleared to 0 by the CIU 250 when the control bit is cleared by the master
device, and a new command can be attempted by raising the control bit again.
00006 ReadWriteSeparation Not used.
00007-
00008 RESERVED -
00009 SoftwareDefinedParity Not used.
00010 SoftwareDefinedStopBit Not used.
00011 ScadaPinCode
PIN code for SCADA systems, etc.
If GeneralStatus.ScadaPinCodeEnabled (register 00029, bit 0) is enabled, the correct
PIN code must be entered in this register in order to gain access to remote control and
configuration.
Verify acceptance in GeneralStatus.WriteAccess (register 00029, bit 1).
Programming of the SCADA PIN code made via the SMS command SETSCADACODE.
See "CIM 25X SMS commands" (supplement to installation and operating instructions)
on the CD-ROM supplied with the GSM module.

9
5.3 CIM status register block
Registers in this block can be read by means of function codes 0x03 and/or 0x04. They are read-only. This block can be used for various
kinds of fault finding.
Address Register name Description
00021 GENIbusCRCErrorCnt Holds a CRC error counter for the connection between the CIU 250 and the MP 204.
00022 GENIbusDataErrorCnt Holds a data error counter for the connection between the CIU 250 and the MP 204.
00023 VersionNumber A Grundfos-specific version number. This is an unsigned integer value.
00024 ActualModbusAddress Holds the current Modbus slave address of the device.
Valid value range: 1…247.
00025
00026
GENIbusTXcountHI
GENIbusTXcountLO
Holds a transmit counter for total number of telegrams sent from the CIU 250 to the
MP 204.
00027
00028
GENIbusRXcountHI
GENIbusRXcountLO
Holds a receive counter for total number of telegrams received by the CIU 250 from the
MP 204.
00029
GeneralStatus
Bit 0: ScadaPinCodeEnabled
PIN code functionality.
0 = No PIN code required
1 = PIN code required to perform remote control and configuration.
Activation of SCADA PIN code protection takes place via the SMS command
SCADACODE. See "CIM 25X SMS commands" (supplement to installation and operating
instructions) on the CD-ROM supplied with the GSM module.
GeneralStatus
Bit 1: WriteAccess
Remote write access.
0 = No write access (the PIN code is incorrect).
1 = Full write access (the PIN code is either correct or not enabled).
00030 UnitFamily Grundfos product family.
00031 UnitType Grundfos product type.
00032 UnitVersion Grundfos product version.

10
5.4 MP 204 control register block
Registers in this block can be read by means of function codes 0x03 and/or 0x04. They can be written as holding registers with function
codes 0x06 and 0x10. The MP 204 will react to its last received command, no matter whether this command was triggered via Modbus,
with the R100 remote control or on the MP 204 operator buttons.
Address Register name Description
00101
ControlRegister
Bit 0: ResetAlarm
Control bit that resets alarms and warnings.
0 = No resetting
1 = Resetting alarm.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 1: CommandedTrip
Control bit that command-trips the MP 204.
Status is obtained from OperationMode (register 00202).
0 = No trip
1 = Trip.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 2: OnOffReq
Control bit that switches the pump on and off.
Status is obtained from OperationMode (register 00202).
0 = Off (stop)
1 = On (start).
ControlRegister
Bit 3: ProtectionEnabled
Control bit that enables/disables the general protection.
Status is obtained from StatusRegister (register 00201, bit 1).
0 = Protection disabled
1 = Protection enabled.
ControlRegister
Bit 5: ResetStartCounter
Control bit that resets the NumberOfStartsTripCounterHI/LO (registers 00342 and 00343).
0 = No resetting
1 = Resetting.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 6:
ResetRestartCounter
Control bit that resets the AutoRestartsTripCounterHI/LO (registers 00344 and 00345).
0 = No resetting
1 = Resetting.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 7: ResetLogs
Control bit that resets the maximum/minimum voltage and current logs and maximum number of
starts per hour log (registers 00348, 00349, 00350, 00351 and 00352).
0 = No resetting
1 = Resetting.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 8: ResetHourCounter
Control bit that resets the OperationTimeTripCounterHI/LO (registers 00338 and 00339).
0 = No resetting
1 = Resetting.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.
ControlRegister
Bit 9: ResetEnergyCounter
Control bit that resets the EnergyTripCounterHI/LO (registers 00332 and 00333).
0 = No resetting
1 = Resetting.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 5.2 CIM configuration register block, address 00005, for acknowledgement
behaviour.

11
5.5 MP 204 status register block
Registers in this register block can be read by means of function codes 0x03 and/or 0x04. They are read-only.
Address Register name Description
00201
StatusRegister
Bit 0: Rotation
Indicates if the pump is rotating (consuming power) or not.
0 = No rotation
1 = Rotation.
StatusRegister
Bit 1: ProtectionEnabled
Indicates if the general protection is enabled or disabled.
0 = Protection disabled
1 = Protection enabled.
Protection can be enabled/disabled with ControlRegister (register 00101, bit 3).
StatusRegister
Bit 2: Ready
Indicates if the MP 204 is ready or not.
0 = Not ready
1 = Ready.
StatusRegister
Bit 3: Fault
Indicates if there is a fault or not.
0 = No fault
1 = Fault.
StatusRegister
Bit 4: PTC
Indicates status of the PTC.
0 = Closed
1 = Open.
StatusRegister
Bit 5: PhaseSequence
Indicates the actual phase sequence.
0 = Phase sequence is right: L1-L2-L3
1 = Phase sequence is left: L3-L2-L1.
00202 OperationMode
Indicates the actual operating mode.
0 = Started (on, normal condition)
1 = Commanded trip (result of control register 00101, bit 1)
2 = Actuator stop (off) (result of control register 00101, bit 2)
3 = Protection stop.
00203 SystemMode
Indicates the actual system mode.
0 = Power-up
1 = Operating (normal condition)
2 = MP 204 fault.
00204 AlarmCode The Grundfos-specific alarm code. See section 10. Grundfos alarm and warning codes.
00205 WarningBits1
Bit-interpreted warnings
Bit 0 = Maximum voltage
Bit 1 = Minimum voltage
Bit 2 = Maximum line current
Bit 3 = Minimum line current
Bit 4 = Line current asymmetry
Bit 5 = RESERVED
Bit 6 = RESERVED
Bit 7 = RESERVED
Bit 8 = Insulation resistance
Bit 9 = Motor temperature (Tempcon)
Bit 10 = Motor temperature (PT resistor)
Bit 11 = RESERVED
Bit 12 = Maximum cos ϕwarning limit exceeded
Bit 13 = Minimum cos ϕwarning limit exceeded
Bit 14 = Starts per hour
Bit 15 = RESERVED.
00206 WarningBits2
Bit-interpreted warnings
Bit 0 = Start capacitor min.
Bit 1 = Run capacitor min.
Bit 2 = RESERVED
Bit 3 = Tempcon sensor signal fault
Bit 4 = Pt sensor signal fault
Bit 5 = Service warning: Operating time trip counter has exceeded its warning limit.
Bit 6 = Load continues even if the motor has been switched off
Bits 7-15 = RESERVED.
00207
Relays
Bit 0: ControlRelay
Indicates the status of the motor control relay.
0 = Relay opened
1 = Relay closed (power-on default after timeout).
Relays
Bit 1: SignalRelay
Indicates the status of the alarm signal relay.
0 = Relay opened (power-on default)
1 = Relay closed.

12
00208
AcknowledgeRegister
Bit 0: ResetAlarmAck
Indicates if a ResetAlarm control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bit 1: TripAck
Indicates if a commanded-trip control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bits 2-4: RESERVED -
AcknowledgeRegister
Bit 5: ResetStartCounterAck
Indicates if a ResetStartCounter control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bit 6: ResetRestartCounterAck
Indicates if a ResetRestartCounter control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bit 7: ResetLogsAck
Indicates if a ResetLogs control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bit 8: ResetHourCounterAck
Indicates if a ResetHourCounter control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
AcknowledgeRegister
Bit 9: ResetEnergyCounterAck
Indicates if a ResetEnergyCounter control bit was acknowledged by the device.
0 = No acknowledgement
1 = Control bit acknowledged.
This functionality is only used when AutoAckControlBits is disabled.
See section 5.2 CIM configuration register block, address 00005.
00236 GSMSignalLevelActual Actual level of GSM signal.
00237 GSMSignalLevelAverage Average level of GSM signal.
00238
00239
IPAddressHI
IPAddressLO IP address for GPRS communication.
Address Register name Description

13
5.6 MP 204 data register block
Registers in this block can be read by means of function codes 0x03 and/or 0x04. They are read-only. The table below shows the
availability of the data, depending on system configuration.
See section 9. Data item overview for more information on this register block.
Address Register name Scale Notes
00301 PhaseVoltageL1 0.1 V
00302 PhaseVoltageL2 0.1 V
00303 PhaseVoltageL3 0.1 V
00304 PhaseVoltageMean 0.1 V
00305 LineVoltageL1L2 0.1 V
00306 LineVoltageL2L3 0.1 V
00307 LineVoltageL3L1 0.1 V
00308 LineVoltageMean 0.1 V
00309 LineCurrentL1 0.1 A
00310 LineCurrentL2 0.1 A
00311 LineCurrentL3 0.1 A
00312 LineCurrentMean 0.1 A
00313 LineCurrentStart 0.1 A
00314 MotorTemp1 0.01 K
00315 MotorTemp2 0.01 K
00316 LineCurrentAsym 0.1 %
00317 CapacitorStart 1 μF
00318 CapacitorRun 1 μF
00319 CapacitorStartRef 1 μF
00320 CapacitorRunRef 1 μF
00321 LineFrequency 0.1 Hz
00322 VoltageAngleL1L2 1 degree
00323 VoltageAngleL1L3 1 degree
00324 CosPhiL1 0.01
00325 CosPhiL2 0.01
00326 CosPhiL3 0.01
00327 CosPhi 0.01
00328
00329
PowerHI
PowerLO 1 W
00330
00331
EnergyHI
EnergyLO 1 kWh
00332
00333
EnergyTripCounterHI
EnergyTripCounterLO 1 kWh Reset with ControlRegister
(register 00101, bit 9).
00334
00335
OperationTimeHI
OperationTimeLO 1 hour
00336
00337
TotalPoweredTimeHI
TotalPoweredTimeLO 1 hour
00338
00339
OperationTimeTripCounterHI
OperationTimeTripCounterLO 1 hour Reset with ControlRegister
(register 00101, bit 8).
00340
00341
NumberOfStartsHI
NumberOfStartsLO unscaled
00342
00343
NumberOfStartsTripCounterHI
NumberOfStartsTripCounterLO unscaled Reset with ControlRegister
(register 00101, bit 5).
00344
00345
AutoRestartsTripCounterHI
AutoRestartsTripCounterLO unscaled Reset with ControlRegister
(register 00101, bit 6).
00346 InsulationResistance 10 kΩ
00347 PhaseVoltageDistortion 0.01 %
00348 VoltageMaxLog 0.1 V
Reset with ControlRegister
(register 00101, bit 7).
00349 VoltageMinLog 0.1 V
00350 CurrentLineMaxLog 0.1 A
00351 CurrentLineMinLog 0.1 A
00352 StartsHourMaxLog unscaled
00353 StartsPerHour unscaled
00354 AutoRestartsPer24h unscaled

14
5.7 Alarm simulation register block
Registers in this register block can be read by means of function codes 0x03 and/or 0x04.
5.8 User register block
Address Register name Description
00701 SimulationWarningBits1 Used to generate simulated alarms/warnings.
Simulated alarms and warnings can be cleared with the ResetAlarm control bit (register 00101,
bit 0) or by pressing the "R" button on the MP 204. Bit interpretation like WarningBits1
(register 00205) and WarningBits2 (register 00206).
00702 SimulationWarningBits2
00703 SimulationAlarmBits1
00704 SimulationAlarmBits2
Address Register name Scale Description
00751-
00800 UserRegisters unscaled
This area is for device labelling by the user (SCADA system).
The CIU 250 will not modify this area by itself.
The user register values are stored in the device and will remain after a power-
off.

15
6. GSM call-up connection to SCADA system
6.1 Call-up functional description
The call-up function is used for SCADA system communication
via the GSM network. Connection is established when the
SCADA system dials the CIU 250. The CIU 250 will automatically
"pick up the phone call" and wait for data traffic in the form of
Modbus RTU telegrams.
If legal data traffic has not been initiated within one minute,
the CIU 250 will hang up the line. This silence timeout is active
during the whole communication session. Whenever the SCADA
system has completed the Modbus communication, it hangs up
the line. This is detected by the CIU 250, which also hangs up the
line, and the call-up communication session is thereby
completed. See fig. 7.
Fig. 7 Illustration of a GSM call-up session
6.2 SCADA PIN code protection
It is always possible to get read access via Modbus, but if the
CIU 250 is SCADA PIN-code-protected (GeneralStatus register
00029, bit 0 = 1), write access requires that the correct PIN code
(ScadaPinCode, register 00011) has been written. Writing the
correct PIN code value will trigger the write access control, and
write access will be open, which can be verified with
GeneralStatus, register 00029, bit 1 = 1).
For call-up connections with PIN code protection, the
ScadaPinCode register has to be written each time a new call-up
is made.
6.3 GSM call-up options setup
To prepare the CIU 250 for Modbus communication with a
SCADA system via GSM, some settings have to be made via
SMS commands:
• Setting a SCADA PIN code:
SETSCADACODE <access code>
will enable write access protection.
Default is an empty SCADA PIN code, meaning no protection.
• Activating the SCADA PIN code:
SCADACODE <ON | OFF>.
Default is "Off".
• Selecting the Modbus address:
MODBUSADDR <1-247>
Default value is 231.
To verify the SCADA GSM setting after completion, the SMS
command "SCADA" can be used.
For details about the use of SMS commands, see "CIM 25X SMS
commands" (supplement to installation and operating
instructions) on the CD-ROM supplied with the GSM module.
TM04 4905 2209
Dialling
Connection established
Hang-up
Modbus communication
Silence timeout after 1 min
without communication
GSM network
(e.g. SCADA) CIU 250
Hangs up
the line. Hangs up
the line.
Session
completed.

16
7. GPRS connection
7.1 What is GPRS and Modbus TCP?
GPRS (General Packet Radio Service) is a wireless, "always on" connection that remains active as long as the CIU 250 is within range of
the service. With GPRS it is possible to establish a wireless connection to the internet and thus enable a remote connection to a SCADA
system computer or another PC application. Typical data rates are 32 to 48 kbit/s.
The GPRS itself takes care of the wireless data transfer via the GSM network. It plays the same role as Ethernet in a wired network. On
top of GPRS is the TCP/IP protocol, which enables easy integration with the internet. The Modbus TCP protocol is used on the application
layer communicating with a TCP port number (default 502). The difference when compared to the fieldbus protocol Modbus RTU is the
exclusion of the 16-bit CRC checksum and the adding of a Modbus application program header as illustrated in fig. 8.
Fig. 8 Modbus TCP telegram
7.2 Subscription
The GSM service providers have different technical solutions for GPRS to choose from. You have to select the service provider and the
technical solution that best suit your system, and it must be based on static IP addressing. You will get the following from the GSM service
provider:
• A Subscriber Identity Module (SIM card).
• An Access Point Name (APN), e.g. "internet".
• A username (is fixed and cannot be changed by the user).
• A password (is fixed and cannot be changed by the user).
• A static IP address.
Solutions based on a VPN (Virtual Private Network) involve the use of special routers, e.g. GRE routers, Generic Routing Encapsulation,
which you will also get from the service provider.
7.3 Installation
To prepare the CIU 250 for GPRS communication, some settings have to be made via SMS commands:
• Select Access Point Name:
APN <ascii string>
This is always mandatory.
• Select Username:
USERNAME <ascii string>
The need for a username depends on your operator and the type of subscription.
• Select Password:
PASSWORD <ascii string>
The need for a password depends on your operator and the type of subscription.
Some advanced GPRS settings have default values that usually work, but in special cases, it might be necessary to change some of
them. This is also done via SMS commands.
• Select Authentication:
AUTHENTICATION <NORMAL | SECURE>
Only used by some service providers. Default value is "Normal".
• Select Connection type:
CONNECTION <SERVER | CLIENT | DISABLE>
Default value is "Server".
• Set GPRS roaming:
GPRSROAMING: <ON | OFF>
Default value is "Off".
• Select Modbus TCP port number:
MODBUSPORT <port no.>
Default value is 502.
• Select GENIpro port number:
GENIPROPORT <port no.>
Default value is 49152. This is only relevant when using Grundfos PC Tools.
It is possible to configure the GPRS connection with a single multi-parameter command:
• SETGPRS <parameter 1, parameter 2, parameter 3, …>
– <parameters>:<APN>,<Modbus port>,<GENIpro port>,<user name>,<password>,<authentication>,<connection>,<GPRS roaming>
TM04 4907 2209
Modbus RTU telegram
Modbus TCP/IP data
Modbus application program header
Modbus TCP/IP application data unit
Slave ID Func
code ID Data CRC
Data
Func
code ID
Unit IDLengthProtocol IDTransaction ID

17
Example
SETGPRS Grundfos.dk2.tdc,502,49888,Grundfos,4321,normal,server,off
To verify the GPRS setting after completion, the SMS command GPRSSETTING can be used. The command GPRSSTATUS can verify
if the GPRS connection is working.
The connection states have the following meaning:
– "Detached": Trying to locate GPRS service.
– "Attached": GPRS service located.
– "Context active": IP address has been assigned, ready for a client to establish a socket connection.
– "Connected": A client has established a socket connection. The system is ready for TCP/IP data exchange (or already exchanging
data).
For details about the use of SMS commands, see "CIM 25X SMS commands" (supplement to installation and operating instructions) on
the CD-ROM supplied with the GSM module.
7.4 Operation
When powering on a CIU 250 with the correct GPRS setting, the following GPRS connection sequence will take place:
1. The CIU 250 locates the GPRS service. The connection state changes from "Detached" to "Attached".
2. The CIU 250 attempts to connect to the APN it has been given and requests an IP address. The base station looks through its record
of legal SIM cards and finds the IP address (the address associated with this SIM card) to assign to the CIU 250. After the CIU 250 has
got the IP address, the connection state changes to "Context active".
3. The CIU 250 is now ready for a client (e.g. SCADA system) to establish a socket connection and begin TCP/IP data exchange. Whena
client connects the CIU 250, the connection state will change to "Connected", and the GSM status LED1 will indicate when data
transfer takes place. See section 3.2 LEDs.
A client (e.g. SCADA) establishes connection to a CIU 250 by specifying the IP address and the TCP port 502. Data transfer is always
initiated from the client in the form of a Modbus TCP telegram embedded in a TCP/IP frame and directed to TCP port 502. To the client
software, the connection to the CIU 250 is completely transparent.
The protection against unauthorised data access is high. The access to the GPRS network from the internet can only take place via the
VPN tunnel. See fig. 10. Moreover, data transfer requires a Modbus master client, knowledge of the Modbus functional profile and the use
of a SCADA PIN code (if enabled).
The CIU 250 supervises the GPRS system to ensure that it is still working. An automatic procedure ensures restarting of the CIU 250 and
repetition of the GPRS connection sequence in case a deadlock situation has occurred. It also closes down socket connections that are
left open by the client and unused for more than 24 hours.
It is possible to use SMS communication while GPRS communication is active. However, in the "Connected" state the delay time between
reception and reply will increase.
If the connection state is different from "Connected", it is possible to establish a call-up connection. When the call-up connection is
established, GPRS data exchange will be blocked until the call-up is terminated by the caller.
A total of three Modbus clients can be connected to the Modbus TCP port of the CIU 250 and communicate simultaneously. Each
connection, called a socket connection, is handled independently. If all three sockets are used simultaneously, a "Silence timeout" of only
one minute is used to prevent a complete occupation for a long time.
Fig. 9 GPRS connection from a PC to the CIU 250 directly via GPRS
Note
When no GPRS data is being transferred, the connection states "Attached", "Context active" and "Connected".
All show the same LED1 status (short pulse).
TM04 7309 1910
PC
GSM/GPRS
network
Base station
APN
CIU 250 with CIM 250
module and SIM card
Mobile phone
Setup, status and
control commands
via SMS
"Static"
IP address
"Static"
IP address

18
Fig. 10 GPRS connection via VPN tunnel
TM04 7129 1510
PC Tool, etc.
SCADA system
Clients
LAN
GRE router GRE router
VPN tunnel
Internet
GSM operator GSM/GPRS
network
Base station
APN
CIU 250 with
CIM 250 module
and SIM card
Mobile phone
"Static"
IP address
Setup, status and
control commands
via SMS

19
8. Fault finding
Faults in the CIU 250 can be detected by observing the status of the two communication LEDs. See the table below and section 3.2 LEDs.
8.1 LED status
CIU 250 connected to an MP 204
Fault (LED status) Possible cause Remedy
1. Both LEDs (LED1 and LED2) remain off
when the power supply is connected.
a) The CIU 250 is defective. Replace the CIU 250.
2. The LED for internal communication
(LED2) is flashing red.
a) No internal communication between the
CIU 250 and the MP 204.
• Check the cable connection between the
MP 204 and the CIU 250.
• Check that the individual conductors have
been fitted correctly.
• Check the power supply to the MP 204.
3. The LED for internal communication
(LED2) is constantly red.
a) The CIU 250 does not support the
connected version of the MP 204. Contact the nearest Grundfos company.
4. The LED for GSM/GPRS
communication (LED1) is flashing
yellow. See signal 1 in fig. 6on page 7.
a) The SIM card has not been inserted. Insert the SIM card.
See section 3.1.2 Inserting the SIM card.
b) The SIM card has not been inserted
correctly.
Insert the SIM card.
See section 3.1.2 Inserting the SIM card.
c) The SIM card PIN code is not correct. Enter the correct PIN code.
See section 3.1.2 Inserting the SIM card.
d) No connection to the GSM network. • Check the connection to the antenna.
• Check the GSM coverage of the area with
for instance a mobile phone.
• Use an external antenna and experiment
with the position.
5. The LED for GSM/GPRS
communication is pulsating yellow with
single pulse, but the CIM 250 cannot
send or receive SMS messages.
a) The CIM 250 has not been initialised. Follow the configuration procedure in
"CIM 25X SMS commands" (supplement to
installation and operating instructions) on
the CD-ROM supplied with the GSM
module.

20
8.2 Modbus GSM/GPRS communication faults
Fault Possible cause Remedy
1. The slave does not respond to
telegrams.
a) Configuration or installation error. • Ensure that the CIU 250 has contact with
the GSM network. The LED1 should be
pulsing yellow.
If the LED1 signal is incorrect, see
section 3. CIM 250 GSM module for
correct installation of the CIM 250.
• Ensure that the correct slave address is
used in the Modbus master poll.
See register 00003 ModbusAddress
(factory value is 00231).
b) The slave may be in listen-only mode. • Either send a restart communications
diagnostics command, or restart the
MP 204 manually.
c) If the holding register of address 00001
"SlaveMinimumReplyDelay" is set too
high, the master may time out before
receiving the response from the slave.
• Increase the reply delay in the master or
reduce the "SlaveMinimumReplyDelay"
in order to communicate.
2. The slave responds with exception
response 0x01: "Invalid function".
a) The master is trying to use an
unsupported function in the CIU 250.
• See section 4. Modbus function code
overview for supported function codes.
Note that reading and writing coils are not
supported, so only register functions and
diagnostics will be valid.
3. The slave responds with exception
response 0x02: "Invalid data address".
a) The master is trying to read or write an
invalid data address. If a master tries to
read register addresses that are not listed
in the tables, the slave will respond with
this exception response. Some masters
may automatically try to read large blocks
in one telegram, which will cause
problems if some of the registers in the
block are not supported. An example
would be reading the CIM configuration
and CIM status register blocks in one
telegram: this is not possible since there
are unused addresses among the blocks.
• Avoid reading or writing invalid data
addresses.
4. The slave returns data value 0xFFFF
(65535).
a) The availability of data will in some cases
depend on a configuration or the actual
conditions of the system (e.g. trying to
request data from a pump which is not
present will return "data not available"
(0xFFFF)).
• See section 9. Data item overview
for available data.
b) With its present configuration or operating
mode the MP 204 is unable to supply the
requested data.
-
5. The slave does not react to control
actions or to writing of settings.
a) The CIU 250 is SCADA PIN-code-
protected (GeneralStatus register 00029,
bit 0 = 1), and an incorrect PIN code has
been written.
Write access requires a correct PIN code
(ScadaPinCode, register 00011). Writing
the correct PIN code value will trigger the
write access control, and write access will
be open, which can be verified with
GeneralStatus, register 00029, bit 1 = 1.