Hanna Instruments HI510 User manual

INSTRUCTION MANUAL
Hanna Instruments Inc., 584 Park East Drive, Woonsocket, RI 02895 USA www.hannainst.com
HI510
HI520
Universal Process Controller
Modbus RTU Protocol and Remote Device Control

Dear Customer,
Thank you for choosing a Hanna Instruments®product.
Please read this instruction manual carefully as it provides details on Modbus RTU protocol, function codes,
controller wiring and setup configuration for remote control and monitoring.
This manual has been written as a companion for HI510 and HI520 process controller manuals.
Scan the QR code to download MAN510 or follow the link:
https://manuals.hannainst.com/HI510.
Scan the QR code to download MAN520 or follow the link:
https://manuals.hannainst.com/HI520.
If you need additional technical information, do not hesitate to e‑mail us at [email protected].
Visit www.hannainst.com for more information about Hanna Instruments and our products.
All rights are reserved. Reproduction in whole or in part is prohibited without the written consent of the copyright owner,
Hanna Instruments Inc., Woonsocket, Rhode Island, 02895, USA. Hanna Instruments reserves the right to modify the design,
construction, or appearance of its products without advance notice.

3 TABLE OF CONTENTS
TABLE OF CONTENTS
1. Introduction ...........................................................................................................................................................4
2. Modbus Protocol Basics...........................................................................................................................................4
3. Wiring & Settings Configuration.............................................................................................................................10
3.1. Wiring .................................................................................................................................................... 10
3.2. Setup ...................................................................................................................................................... 10
4. Operation Modes when Using Modbus....................................................................................................................13
4.1. Modbus General Steps .............................................................................................................................. 13
4.2. Modbus Special Holding Registers ............................................................................................................. 14
4.3. Retrieving Controller Parameters ................................................................................................................ 14
4.4. Editing & Saving Controller Parameters ...................................................................................................... 15
5. Modbus Functions.................................................................................................................................................16
5.1. Supported Function Codes ......................................................................................................................... 16
5.2. Exception Codes ....................................................................................................................................... 16
5.3. Coil Registers Functions (0xxxx Addresses) .................................................................................................. 17
5.4. Discrete Inputs Functions (1xxxx Addresses) ................................................................................................ 18
5.5. Input Registers Functions (3xxxx Addresses) ................................................................................................ 19
5.6. Holding Registers Functions (4xxxx Addresses) ............................................................................................ 38
6. Abbreviations.......................................................................................................................................................47
Certification...............................................................................................................................................................48
Recommendations for Users........................................................................................................................................48
Warranty ..................................................................................................................................................................48
General Safety Precautions & Installation Recommendations
HI510 and HI520 safety precautions and installation recommendations apply.
Procedures and instructions detailed in this section may require special precautions to ensure the safety of the
personnel performing the operations.
•
Electrical connection, installation, start‑up, operation, and maintenance must be carried out by
specialized personnel only.
•
The specialized personnel must have read and understood the instructions in this manual and should
adhere to them.
• User serviceable connections are all accessible inside the enclosure.
• Do not operate or energize the instrument with the case open.
• Before powering the controller, verify wiring has been done properly.
• Always disconnect the instrument from power when making electrical connections.
• Do not run other cables through the same cable gland with the power cable.
• A clearly marked disconnect switch must be installed in the vicinity of the instrument to ensure that
the electrical circuit is completely de‑energized for service or maintenance.

Introduction 4
1. INTRODUCTION
Modbus is a request‑response software protocol intended for efficient and immediate remote industrial process
control.
Main Features
• Allows immediate response to a problem with equipment (even from different plants)
• Minimizes production downtime as mechanical issues are quickly identified
• Traceability of stored data
• Monitors and controls processes remotely
2. MODBUS PROTOCOL BASICS
Modbus protocol defines a communication structure that occurs in pairs. One device initiates a request and then
waits for a response. The initiating device is responsible for initiating every interaction (query).
The initiating device can address individual requests (client responds) or initiate a broadcast message to several
clients (client does not respond).
Default parameters
Modbus communication protocol is implemented through a serial communication channel that makes controller
data available to a remote user. Physical layer is implemented on a RS485 line with the following default
parameters:
half duplex 8 bit data 1 start bit 1 stop bit no parity
RTU (Remote Terminal Unit) mode
Bytes are transferred as they are and checksum is calculated over CRC algorithm.
START ADDRESS FUNCTION DATA CRC CHECK END
T1‑T2‑T3‑T4 8 bits 8 bits N x 8 bits 16 bits T1‑T2‑T3‑T4
Note: T1-T2-T3-T4 = 3.5 characters times at no communication
• Address Field – client address range is 1 – 247 (0 kept for broadcasting).
• Function Field – values range is 1 – 255.
Field is used by client device to echo server query function field for normal case or sets most significant bit
of query function to 1 if an error occurs.
• Data Field – information regarding required operation.
Data field can be of various lengths or 0. Data uses “big‑endian” convention, whereby numerical data with
a size greater than 1 byte is sent with the most significant byte first e.g. 0x1234 is sent as 0x12,0x34.

5 Modbus Protocol Basics
General query message structure
SERVER
Device Address Function Code Query Data Error Check
CLIENT
Error Check Response Data Function Code Device Address
• Device Address – individual client address
• Function Code – type of action
• Query Data / Response Data – transmitted data
• Error Check – data integrity error check field
Changing a specific parameter
1. Enter Remote Control Edit Mode.
2. Change a specific Parameter Value.
3. Save Settings.
Edit
Mode
Inputs Controller is not in Manual, Calibration, or Local Edit Mode
•Set password register
•Set specific value for Remote Control Mode register
Actions A copy of the current settings is made.
All further requests (writings) will address that copy.
Outputs
Remote Control Edit Mode will be available for reading in Remote Control Mode register
• A timeout value is configured for the Remote Control Edit Mode
• Timeout is reloaded on each successful transaction
Change
Value
Inputs Controller is in Remote Control Edit Mode.
Actions Use write actions for coils or holding registers.
Outputs Settings are visible with read‑specific functions.
• Timeout for Remote Control Edit Mode is refreshed with each transaction
Save
Settings
Inputs Issue a specific value for Remote Control Mode register.
Actions Validity of changes made in the settings image area is tested.
If correct, settings are transferred to work area.
•
Controller enters Hold Mode to allow saving new values and process control
initialization
• Controller exits from Remote Control Edit Mode and enters Run Mode
Outputs Remote Control Mode register will be updated with the new values.

Modbus Protocol Basics 6
Modbus Functions
Modbus data types
• Coil (1 bit), read/write access, 1to 9999 address range
– forces the ON/OFF state of discrete outputs (DO) or modifies mode / status of client devices
• Discrete Input (1 bit), read‑only, 10001 to 19999 address range
– requests input status of field discrete inputs (DI) or the client devices status
• Input Register (16 bit), read‑only access, 30001 to 39999 address range
– provides field analog inputs (AI) or client device information
– floating or double integer data can be handled if consecutive addresses are assigned
• Holding Register (16 bit), read/write access, 40001 to 49999 address range
– receives data from field analog outputs (AO) or sets information on client devices
– floating or double integer data handled only if consecutive addresses are assigned
Access
type
Access
size Internal data type Function Name
Code
Dec
Code
Hex
Data
bit
Physical discrete inputs Read Discrete Inputs 20x02
Internal bits or
physical coils
Read Coils 10x01
Write Coil 50x05
Write Multiple Coils 15 0x0F
16 bit
Physical input register Read Input Register 40x04
Internal register or
physical output register
Read Holding Register 30x03
Write Single Register 60x06
Write Multiple Registers 16 0x10
Read/Write Multiple Registers 23 0x17
Mask Write Register 22 0x16
Read FIFO Queue 24 0x18
File record access Read File Record 20 0x14
Write File Record 21 0x15
Diagnostic
Read Exception Status 70x07
Diagnostic 80x08
Get COMM Event Counter 11 0x0B
Get COMM Event Log 12 0x0C
Report Server ID 17 0x11
Read Device ID 43 0x2B

7 Modbus Protocol Basics
Read Coils (0x01) Read from 1 to 2000 maximum contiguous status of coils
Request Function code 1 byte 0x01 1
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of coils 2 bytes 0x0001 to 0x07D0 1 to 2000
Normal
response
Function code 1 byte 0x01 1
Bytes count 1 byte N = Quantity of coils / 8
(if the remainder is other than 0, then N = N+1)
Coil status N×1 byte
Read Discrete Inputs (0x02) Read from 1 to 2000 maximum contiguous status of discrete inputs
Request Function code 1 byte 0x02 2
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of discrete inputs 2 bytes 0x0001 to 0x07D0 1 to 2000
Normal
response
Function code 1 byte 0x02 2
Bytes count 1 byte N = Quantity of discrete inputs / 8
(if the remainder is other than 0, then N = N+1)
Discrete inputs N×1 byte
Read Holding Registers (0x03) Read from 1 to 125 maximum contiguous holding registers
Request Function code 1 byte 0x03 3
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of holding registers 2 bytes 0x0001 to 0x007D 1 to 125
Normal
response
Function code 1 byte 0x03 3
Bytes count 1 byte 2×N N = 1 to 125
Holding register N×2 bytes
Read Input Registers (0x04) Read from 1 to 125 maximum contiguous input registers
Request Function code 1 byte 0x04 4
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of input registers 2 bytes 0x0001 to 0x007D 1 to 125
Normal
response
Function code 1 byte 0x04 4
Bytes count 1 byte 2×N N = 1 to 125
Input register N×2 bytes
Errors Function code 1 byte Function code + 0x80
Exception status 1 byte 01 or 02 or 03 or 04

Modbus Protocol Basics 8
Write Single Coil (0x05) Write a single output to either ON or OFF
Request Function code 1 byte 0x05 5
Coil address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Coil value 2 bytes 0x0000 or 0xFF00 0 or 65280
Normal
response
Function code 1 byte 0x05 5
Coil address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Coil value 2 bytes 0x0000 or 0xFF00 0 or 65280
Write Single Register (0x06) Write a single holding register
Request Function code 1 byte 0x06 6
Register address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Register value 2 bytes 0x0000 to 0xFFFF 0 to 65535
Normal
response
Function code 1 byte 0x06 6
Register address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Register value 2 bytes 0x0000 to 0xFFFF 0 to 65535
Write Multiple Coils (0x0F) Used to force each coil in a sequence of coils to either ON or OFF
Request Function code 1 byte 0x0F 15
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of outputs 2 bytes 0x0001 to 0x07B0 1 to 1968
Byte count 1 byte
N = Quantity of outputs / 8
(if the remainder is other than 0, then N = N+1)
Outputs Value N×1 byte
Normal
response
Function code 1 byte 0x 0F 15
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of outputs 2 bytes 0x0001 to 0x07B0 1 to 1968
Write Multiple Registers (0x10) Write a block of contiguous registers (1 to 123)
Request Function code 1 byte 0x10 16
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of registers 2 bytes 0x0001 to 0x007B 1 to 123
Byte count 1 byte
2×N (N = Quantity of Registers)
Registers value N×2 bytes
Normal
response
Function code 1 byte 0x10 16
Starting address 2 bytes 0x0000 to 0xFFFF 0 to 65535
Quantity of registers 2 bytes 0x0001 to 0x007B 1 to 123
Errors Function code 1 byte Function code + 0x80
Exception status 1 byte 01 or 02 or 03 or 04

9 Modbus Protocol Basics
Read Device Identification (function 43/14; 0x2B / 0x0E)
This function code allows reading the identification and additional information relative to the physical and
functional description of a remote device. The Read Device Identification interface is modeled as an address
space / composed of a set of addressable data elements identified by an object ID.
Controller responds to three types of queries:
• Queries for basic information i.e. mandatory objects (Vendor Name, Product Code, Revision Number)
• Queries for regular information i.e. optional objects (e.g. Model Name)
• Queries for extended information i.e. optional objects (e.g. private data regarding device location)
Controller responds to the following access requests.
• 01: request to get basic device identification (stream access)
• 04: request to get one specific identification object (individual access)
ID Category Type Data Description
0x00
Basic Mandatory
ASCII String
Vendor Name
0x01 Product Code
0x02 Major / Minor Revision Number
0x03
Regular Optional
Vendor URL
0x04 Product Name
0x05 Model Name
0x06 User Application Name
0x07…0x7F Reserved
0x80…0xFF Extended Device Dependent Private Objects
"Vendor Name" (ID = 0x00) query message structure (individual access)
Query Response
0x2B = Function Code
0x0E = MEI Type
0x04 = Read Device ID Code
0x00 = Object ID
0x2B = Function Code
0x0E = Modbus Encapsulated Interface
0x04 = Individual Object
0x81 = Conformity Level
0x00 = More Follows (NO)
0x00 = Next Object ID (None)
0x01 = Number of Objects (1 object)
0x00 = Object ID (Vendor Name)
0x11 = Object Length (17 characters)
"Hanna Instruments" = Object Value

Wiring & Settings Conguration 10
3. WIRING & SETTINGS CONFIGURATION
3.1. WIRING
Follow lead markings to ensure that output leads are correctly wired to the COMM position on the main board.
Note: removable terminal connector marked PROBE 2 is only part of HI520 (two-channel process controller)
hardware structure.
COMM
-BA+
IN1 IN2 A01 A02 A03 A04 PROBE 2
-BA+
PROBE 1
-BA+
Terminal 1
Terminal 2
3.2. SETUP
• Press the mkey to access the main menu.
• Press the ud keys to navigate to General setup.
• Enable Remote Control option.
• Press Setup to configure Communication Protocol parameters (to match the Modbus server).
Enable
b
Setup
3.2.1. Configurable parameters
Remote Control
Option: Enabled, Disabled
Option must be enabled when using the Modbus protocol.
The check mark confirms the option as enabled Нor disabled М.
HI510
HI520

11 Wiring & Settings Conguration
Displayed icons
Й remote connection to a Modbus server established
Л remote connection to a Modbus server established (controller operating in editing mode)
HI510
Ла
401
25.0
mV
°C
Measure ORP
HI520
Ф
ББ
У
Ла
6.43
401
25.0
25.0
pH
mV
°C
°C
pH & ORP
Comm Protocol (Communication Protocol)
Parameter indicates supported transmission mode (Modbus RTU).
Parameter Options Default
Modbus Protocol Modbus RTU Modbus RTU
Net Address 01 to 99 01
Baud Rate 9600, 19200, 38400, 57600, 115200, 256000 19200
Parity None, Even, Odd None
Stop Bits 1 or 2 bits 1 bit
RemLink_Timeout 60 to 1200 seconds 60 seconds
RemEdit_Timeout 30 to 1200 seconds 30 seconds
Bit Length 7 or 8 bits 8 bits
Net Address: sets the controller’s Modbus address.
• With item selected, press Set to modify.
•
Press the ud keys to increase or decrease the value (keep the key pressed to increase editing speed).
Press CFM to save.
Baud Rate: Set the desired speed for the serial communication (baud rate in bps.).
• With item selected, press Modify for the drop‑down list to display.
• Use the ud keys to navigate between options. Press Select to save.
Note: The controller and the Modbus Server must have the same Baud Rate.

Wiring & Settings Conguration 12
Parity: sets communication parity based on the parity mode of the connected device.
• With item selected, press Modify for the drop‑down list to display.
• Press the ud keys to navigate between options. Press Select to save.
Stop Bits: sets stop bit option based on the stop bit of the connected device.
• With item selected, press Modify for the drop‑down list to display.
• Use the ud keys to navigate between options. Press Select to save.
RemLink_Timeout
Number of seconds a remotely connected device should wait for a command acknowledgement before timing out.
• With item selected, press Set to modify.
•
Press the ud keys to increase or decrease the value (keep the key pressed to increase editing speed).
Press CFM to save.
RemEdit_Timeout
Number of seconds that a remotely connected device should wait before exiting Edit mode.
• With item selected, press Set to modify.
•
Press the ud keys to increase or decrease the value (keep the key pressed to increase editing speed).
Press CFM to save.

13 Operation Modes when Using Modbus
4. OPERATION MODES WHEN USING MODBUS
Mode Type Scope Description
Manual Local control, controller
operated manually
Controller operated manually.
Note: Remote Control is not available.
Local Edit Local edit of
settings & parameters
Local edit of controller’s settings and parameters.
Note: Remote Control is not available.
Calibration System calibration Allows for controller’s system calibration.
Note: Remote Control is not available.
Remote Control Remote Control Mode Remote operation is available.
When not enabled, controller reverts to manual mode.
Remote View View parameter &
settings values
Remote Control Mode must be enabled.
Use Modbus function codes to view or retrieve data.
Note: Parameters cannot be updated in this mode.
Remote Edit View & change
parameter and settings
values
Remote Control Mode must be enabled.
Value contained in the data field is outside range or not
accepted as configurable value.
Remote Save Saves data entered in
Edit Mode
Remote Control Mode must be enabled.
After editing/changing parameters, the controller is placed on
Hold and data saved.
Init
(Initialization)
Loads new parameter &
settings values
Following a Remote Save, the controller automatically
runs through an initialization procedure to ensure new
data/parameters are being used.
4.1. MODBUS GENERAL STEPS
Prerequisite for controller remote operation
The controller must not be in Manual, Calibration, or Local Edit Mode as these modes prevent remote operation.
Steps
1.
Ensure remote communication is enabled and serial communication parameters match the Modbus server.
`Displayed Йsymbol confirms connection to the server is established.
`40003 Holding Register contains status and link information that is not password protected.
2. Ensure the controller has the correct Modbus ID set for use with the Modbus server.
Default controller Modbus ID is 1(1 to 99 configurable range).
`
Each Modbus device has a configurable ID which must be set in order for the Modbus server to
communicate with the device.
3. Determine if the unit is password protected.
`If yes, continue with Step 4.
`If not, skip Step 4 and continue with Step 5.

Operation Modes when Using Modbus 14
4. Send a 32‑bit password to the controller using 2 consecutive Write Single Holding Register (06) Modbus
Function Codes or a single Write Multiple Holding Registers (16) Function Code to the controller.
The password register addresses are:
• 40001 – Lower half of 32‑bit value (bytes 1‑0)
• 40002 – Upper half of 32‑bit value (bytes 3‑2)
`
Enter the password to enable remote operation. The password does not need to be resent unless RemLink
or RemEdit timeouts are registered or settings are saved.
`Each Modbus transaction resets the timeout timer. (See RemLink_Timeout and RemEdit_Timeout ).
5. Continue data reading and writing.
Note: If during reading parameter values, a communication pause causes a Remote Link timeout, Modbus
General Steps need to be repeated.
4.2. MODBUS SPECIAL HOLDING REGISTERS
Three special holding registers can be read and written to, regardless of operating mode, to allow a Modbus
server to access controller’s password, check status, as well as view and set remote operating modes.
Address Register Size Note
40001 Remote Password 32‑bit Low part of 32‑bit password (bytes 1‑0)
40002 High part of 32‑bit password (bytes 3‑2)
40003 Remote Control
Mode 8‑bit B0 Remote link (read only) 0= No link between controller and server
1= Link established between controller and server
B1 Set Remote Control, View Mode
0= Controller settings configured locally
1= Controller settings configured remotely only
B2 Set Remote Control, Edit Mode
0= Settings cannot be configured remotely
1= Settings are configured remotely on an image of controller
configurable parameters
B3 Save Settings done on Remote Control, Edit Mode
1= Settings configured remotely (with controller in Edit Mode) are saved
pending validity check
4.3. RETRIEVING CONTROLLER PARAMETERS
1.
Ensure device is correctly configured for remote communication and RemLink or RemEdit have not timed out.
`Controller is ready for reading data.
`40003 Holding Register contains status and link information that is not password protected.
2.
Use function code Write Single Holding Register (06) to set B1 in 40003 Holding Register i.e. enable
remote viewing.
`Controller settings are locked (view only) and cannot be changed remotely (or locally).
3.
Use function code Read Holding register (03) to confirm the B1 has been set in 40003 Holding Register.
`Controller is in Remote View mode.

15 Operation Modes when Using Modbus
4. Use Read Coil (01), Read Input (02), Read Holding Register (03), or Read Input Register (04) function
codes to read parameter values off the controller. See Modbus Functions for register details.
5. Repeat step 4 as needed.
`Modbus Exception Codes may be encountered. See Exception Codes.
`Each transaction with the controller resets the timeout timer.
6. At the end of the process, use function code Write Single Holding Register (06) to clear B1 from 40003
Holding Register and disable remote viewing (allow local editing).
`Stopping Modbus server communication with the controller until the link timeout expires, causes the
Remote View mode to exit.
7.
Use function code Read Holding Register (03) to confirm the B1 has been cleared from 40003 Holding Register.
`Confirmation that controller exited Remote View mode.
4.4. EDITING & SAVING CONTROLLER PARAMETERS
1.
Ensure device is correctly configured for remote communication and RemLink or RemEdit have not timed out:
`controller is ready for reading data
`40003 Modbus Holding Register contains status and link information that is not password protected
2. Use function code Write Single Holding Register (06) to set B1 and B2 in 40003 Holding Register i.e.
enable remote editing.
`A copy of the controller’s settings is made and should be saved before exiting the Remote Edit mode
(any changes will be lost).
`Subsequent Modbus read/write transactions are with this copied image.
3.
Use function code Read Holding Register (03) to confirm B1 and B2 have been set in 40003 Holding Register.
`Confirms the controller is in the Remote Edit mode.
4.
Use correct Modbus function codes to read and write parameters. See Modbus Functions sections for details.
5. Repeat Step 4 as needed.
`Controller could return Modbus Exception Codes. See Exception Codes.
`Each transaction with the controller resets a timeout timer.
6.
At the end of process, use function Write Single Holding Register (06) to set B3 in 40003 Holding Register.
`A successfully sent command is followed by the controller entering Remote Save mode. A parameter's
working image is stored to the controller’s non‑volatile memory. During this time the controller enters
Hold Mode and the new values are stored. Subsequently, the controller runs an initialization process
to reload new values.
7.
Use function code Read Holding register (03) to confirm B2 and B3 have been cleared from 40003 Holding
Register during the Remote Save process.
`This confirms the controller has exited Remote Editing mode.

Modbus Functions 16
5. MODBUS FUNCTIONS
Controller’s parameters can be read or modified via Modbus functions.
Parameters are grouped based on their function.
Not all addresses are used; unused addresses are not shown.
5.1. SUPPORTED FUNCTION CODES
HI510 and HI520 support following standard Modbus function codes:
Decimal Hex Function Name
10x01 Read Coil
20x02 Read Input
30x03 Read Holding Register
40x04 Read Input Register
50x05 Write Single Coil
60x06 Write Single Holding Register
15 0x0F Write Multiple Coils
16 0x10 Write Multiple Holding Registers
43 0x2B Read Device ID
5.2. EXCEPTION CODES
Standard Modbus exception codes are returned by the controller for an unsuccessful programming request
using function code:
Code Name Description
01 Illegal function Received function code can not be executed as an action
02 Illegal data address Received data address can not be accessed
03 Illegal data value Value contained in data field is out of range or not allowed
04 Server device failure An error occurred while attempting to perform requested action

17 Modbus Functions
5.3. COIL REGISTERS FUNCTIONS (0XXXX ADDRESSES)
Decimal Hex Name
10x01 Read Coil
50x05 Write Single Coil
15 0x0F Write Multiple Coils
Address Coil Function
00001 Key Beep
00002 Error Beep
00003 Hold Input, enable
00004 Cleaning, enable
00012 AO1, enable 22 mA on Alarm
00013 AO2, enable 22 mA on Alarm
00014 AO3, enable 22 mA on Alarm
00015 AO4, enable 22 mA on Alarm
00017 Enable CH1
00018 CH1 Setpoint 1, enable control
00019 CH1 Setpoint 2, enable control
00020 CH1 Main Parameter, enable Alarm High
00021 CH1 Main Parameter, enable Alarm Low
00022 CH1 Temperature Parameter,
enable Alarm High
00023 CH1 Temperature Parameter,
enable Alarm Low
Address Coil Function
00025 Enable CH2
00026 CH2 Setpoint 1, enable control
00027 CH2 Setpoint 2, enable control
00028 CH2 Main Parameter, enable Alarm High
00029 CH2 Main Parameter, enable Alarm Low
00030 CH2 Temperature Parameter,
enable Alarm High
00031 CH2 Temperature Parameter,
enable Alarm Low
00033 Math CH, enable Alarm0_High
00034 Math CH, enable Alarm0_Low
00035 Math CH, enable Alarm1_High
00036 Math CH, enable Alarm1_Low
00037 Math CH, enable Alarm2_High
00038 Math CH, enable Alarm2_Low
00039 Math CH, enable Alarm3_High
00040 Math CH, enable Alarm3_Low
Note: Channel 2 (CH2)/Math Channel (Math CH) addresses do not apply to HI510.
Readings related to CH2/Math CH address items are routed as requests to the corresponding CH1 address item.
Writing to CH2/Math CH address items generates a response error.

Modbus Functions 18
5.4. DISCRETE INPUTS FUNCTIONS (1XXXX ADDRESSES)
Decimal Hex Name
20x02 Read Discrete Inputs
Address Input Function
10001 Hold In Alarm
10002 Main Power Failed Alarm
10003 Remote Control Enable Status
10004 Controller Key USR0 Status
10005 Controller Key Menu Status
10006 Controller Key ESC Status
10007 Controller Key USR1 Status
10008 Controller Key Up Status
10009 Controller Key Down Status
10010 Controller Key USR2 Status
10011 Controller Key Help Status
10012 Controller Key Right Status
10013 Digital Input 1 Value
10014 Digital Input 2 Value
10015 Smart Input Value
10019 Alarm Relay Value
10020 Relay 1 Value
10021 Relay 2 Value
10022 Relay 3 Value
10023 Relay 4 Value
10024 Relay 5 Value
10033 Controller EEPROM Memory Error
10034 EEPROM Analog Out Factory Calibration Error
10035 Controller EEPROM Memory Checksum Error
10036 Controller Flash Memory Error
10037 EEPROM SN Error
10038 Flash Ctrl MFS Error
10039 EEPROM Pressure Factory Calibration Error
10040 Analog Out Power Error
10041 Microcontroller Temperature Error
10042 IO Power Error
10049 CH1 Setpoint 1, Overtime Alarm
Address Input Function
10050 CH1 Setpoint 2, Overtime Alarm
10051 CH1 Main Parameter Alarm High
10052 CH1 Main Parameter Alarm Low
10053 CH1 Temperature Parameter Alarm High
10054 CH1 Temperature Parameter Alarm Low
10055 CH1 Main Parameter Over_Range Alarm
10056 CH1 Main Parameter Under_Range Alarm
10057 CH1 Temperature Parameter Over_Range Alarm
10058 CH1 Temperature Parameter Under_Range Alarm
10059 CH1 Probe Reconnect Alarm
10060 CH1 Number Probe Alarm
10061 CH1 Number Parameters Loaded Alarm
10062 CH1 Probe Error
10063 CH1 Temperature sensor broken
10065 CH2 Setpoint 1 Overtime Alarm
10066 CH2 Setpoint 2 Overtime Alarm
10067 CH2 Main Parameter Alarm High
10068 CH2 Main Parameter Alarm Low
10069 CH2 Temperature Parameter Alarm High
10070 CH2 Temperature Parameter Alarm Low
10071 CH2 Main Parameter Over_Range Alarm
10072 CH2 Main Parameter Under_Range Alarm
10073 CH2 Temperature Parameter Over_Range Alarm
10074 CH2 Temperature Parameter Under_Range Alarm
10075 CH2 Probe Reconnect Alarm
10076 CH2 Number Probe Alarm
10077 CH2 Number Parameters Loaded Alarm
10078 CH2 Probe Error
10079 CH2 Temperature Sensor Broken
10081 Math CH Alarm High Status
10082 Math CH Alarm Low Status
Note: Channel 2 (CH2)/Math Channel (Math CH) addresses do not apply to HI510.
Readings related to CH2/Math CH address items are routed as requests to the corresponding CH1 address item.
Writing to CH2/Math CH address items generates a response error.

19 Modbus Functions
5.5. INPUT REGISTERS FUNCTIONS (3XXXX ADDRESSES)
Decimal Hex Name
40x04 Read Input Register
Address Parameter Size Note
30501 Reserved 512 bytes Reserved for internal use,
not related to controller
status and settings.
30513 Controller Serial Number 12 bytes bytes 1‑0
30514 bytes 3‑2
30515 bytes 5‑4
30516 bytes 7‑6
30517 bytes 9‑8
30518 bytes 11‑10
30519 Controller FW Version 14 bytes bytes 1‑0
30520 bytes 3‑2
30521 bytes 5‑4
30522 bytes 7‑6
30523 bytes 9‑8
30524 bytes 11‑10
30525 bytes 13‑12
30526 Controller Status uint32_t bytes 1‑0
30527 bytes 3‑2
30528 Alarm Events uint64_t bytes 1‑0
30529 bytes 3‑2
30530 bytes 5‑4
30531 bytes 7‑6
30532 Error Events uint64_t bytes 1‑0
30533 bytes 3‑2
30534 bytes 5‑4
30535 bytes 7‑6
30536 Warning Events uint64_t bytes 1‑0
30537 bytes 3‑2
30538 bytes 5‑4
30539 bytes 7‑6
30540 Green LED Status Value uint8_t0= Off
1= On
2= Blink
30541 Red LED Status Value uint8_t0= Off
1= On
2= Blink
30542 Hold LED Status Value uint8_t0= Off
1= On
2= Blink
30543 Buzzer Value uint16_t0= Buzzer Off
>0= Time to sound x 100 ms

Modbus Functions 20
Address Parameter Size Note
30545 CH1 Main Parameter Value float Low part of float (bytes 1‑0)
30546 High part of float (bytes 3‑2)
30547 CH1 Main Parameter Engineering Unit 8 bytes bytes 1‑0
30548 bytes 3‑2
30549 bytes 5‑4
30550 bytes 7‑6
30551 CH1 Main Parameter Value Measure Resolution uint8_t
30552 CH1 Main Parameter Value Display Resolution uint8_t
30553 CH1 Main Parameter Measure Status uint8_tbit 0 = Measure Stable
bit 1 = Measure Underrange
bit 2 = Measure Overrange
bit 3 = Sensor Broke
bit 4 = Measurement Out of
Calibration Range
bit 5 = Measurement stays on a
Fixed Range
bit 6 = Measurement Source is
Manual
bit 7 = Measure Out of Range
30554 CH1 Temperature Parameter Value float Low part of float (bytes 1‑0)
30555 High part of float (bytes 3‑2)
30556 CH1 Temperature Parameter Engineering Unit 8 bytes bytes 1‑0
30557 bytes 3‑2
30558 bytes 5‑4
30559 bytes 7‑6
30560 CH1 Temperature Parameter Value Measure Resolution uint8_t
30561 CH1 Temperature Parameter Value Display Resolution uint8_t
30562 CH1 Temperature Parameter Measure Status uint8_tbit 0 = Measure Stable
bit 1 = Measure Underrange
bit 2 = Measure Overrange
bit 3 = Sensor Broke
bit 4 = Measurement Out of
Calibration Range
bit 5 = Measurement stays on a
Fixed Range
bit 6 = Measurement Source is
Manual
bit 7 = Measure Out of Range
30563 CH1 Aux. 1 Parameter Value float Low part of float (bytes 1‑0)
30564 High part of float (bytes 3‑2)
30565 CH1 Aux. 1 Parameter Engineering Unit 8 bytes bytes 1‑0
30566 bytes 3‑2
30567 bytes 5‑4
30568 bytes 7‑6
30569 CH1 Aux. 1 Parameter Value Measure Resolution uint8_t
30570 CH1 Aux. 1 Parameter Value Display Resolution uint8_t