OneFex CS-02TR User manual

CS-02TR/04TR User Manual
1/ 21
CS-02TR/CS-04TR
Network IO Controller
User Manual

CS-02TR/04TR User Manual
2/ 21
Catalog
Catalog.............................................................................................................................................2
1PRODUCT INTRODUCTION...............................................................................................4
1.1 FEATURES..................................................................................................................4
1.2 PARAMETER..............................................................................................................4
1.3 ITEM SELECTION .....................................................................................................5
1.4 Dimension....................................................................................................................5
2Wiring Instructions..................................................................................................................6
2.1 Terminal Definition......................................................................................................6
2.2 Power Supply..............................................................................................................6
2.3 RS485 Connection.....................................................................................................7
2.4 4G antenna/network cable connection....................................................................7
2.5 AI Wiring ......................................................................................................................8
2.6 DI Wiring......................................................................................................................8
2.7 DO Wiring....................................................................................................................9
3Communication Protocol and Data Format......................................................................10
3.1 Manual and Software Updating..............................................................................10
3.2 Communication Setting ...........................................................................................11
3.2.1 Device Address.............................................................................................11
3.2.2 Read/Set Baud Rate....................................................................................11
3.3 Communication Protocol Instructions....................................................................11
3.3.1 Modbus Register Instruction.......................................................................12
3.3.2 Storage rules for collecting sensor data....................................................14
3.3.3 Time interval parameters of devices..........................................................14
3.3.4 Local Logic Mode .........................................................................................15
3.3.5 Status Register List......................................................................................15
3.3.6 Active reporting protocol..............................................................................16
3.4 Configuration Software Instructions.......................................................................17
4Product Maintenance...........................................................................................................19
4.1 Device Usage Environment ....................................................................................19
4.2 FAQ.............................................................................................................................19
4.2.1 RS485 /RS232 communication, no response when device control......19
4.2.2 The DO can only be turned on but not turned off....................................20
4.2.3 485 interface cannot be used to establish communication and control
After the controller powered on..................................................................................20
4.2.4 Multiple devices on the 485 bus and ON/OFF operation failed to send
the broadcast address 254.........................................................................................20
4.2.5 PLC and the device cannot communicate normally................................21
5After-sale Service.................................................................................................................21
5.1 Commitment..............................................................................................................21
5.2 Disclaimer..................................................................................................................21
6Update History......................................................................................................................21

CS-02TR/04TR User Manual
3/ 21
Notice
❖Please read this manual carefully before use and save it for reference.
❖Please follow to the operating procedures and precautions in this manual.
❖Please open the package carefully and check whether the device and
accessories have been damaged due to transportation when you receive the
device.
Please contact us for return processing once damage occurs.
❖Please do not repair it yourself, and contact our technical support
department directly if the device fails.

CS-02TR/04TR User Manual
4/ 21
1 PRODUCT INTRODUCTION
CS-02TR/04TR is network controller that integrates DO (digital output), DI
(digital input), AI (analog input), and supports RS485/MODBUS protocol.
The communication method supports Ethernet/Cat1 networking, RS485
interface, 9~24V wide voltage power supply, and supports functions such as
logic control between analog acquisition and relay output.
Widely used in farms, agricultural greenhouses, IoT terminals, water
conservancy, electricity, gas collection and control and other application
scenarios, its unique logic control function can easily realize automatic water
supply, fertilization, start and stop valves It is an ideal device for small
automatic control scenes.
1.1 FEATURES
◆DO relay output*2/4, control valves, lights, pumps, inverters, etc.
◆DI switch value acquisition*2/4, connect to passive buttons,
photoelectric switches, liquid level switches, etc.
◆AI analog 20mA acquisition*2/4, supports standard 4-20mA sensors
such as temperature and humidity, liquid level, etc.
◆RS485 interface*1, support slave/master data acquisition can be
configured, up to 8 Modbus data points can be configured
◆Support the linkage of acquisition signal and output, sensor upper and
lower limit control, relay delay/cycle opening and closing
◆View the collected data through mobile terminal / WEB terminal, remote
start and stop, timing switch
1.2 PARAMETER
Technical
Parameter
Item#
CS-02TR-E
CS-02TR-C
CS-04TR-E
CS-04TR-C
Power/Work Indication
POWER/WORK/NET
POWER/WORK/NET/DO
Working Voltage
9-28V
Communication
Settings
Interface
Ethernet+RS485
Cat1+RS485
Ethernet+RS485
Cat1+RS485
Default Communication
Format
9600,n,8,1
Communication
Baud Rate
1200,2400,4800,9600(default),19200,38400,115200, can be set by software
Standard Modbus rtu
Protocol
√
√
√
√
Device Address
1-253; Default address:201; Can set by software
IO
DI
2
2
4
4
AI
2
2
4
4
DO (Contact Isolation)
2
2
4
4
Functions
Flash ON Flash OFF
√
√
√
√

CS-02TR/04TR User Manual
5/ 21
1.3 ITEM SELECTION
Item #
DO
AI
DI
Interface
Address Dial
CS-02TR-E
2
2
2
Ethernet+RS485
1-253;
Default ddress:201;
Can set by software
Flash
On
Flash
Off
NOLock Linkage
Lock Linkage
All Channel Lock
Linkage
2Device NOLock
Linkage
2Device Lock Linkage
CS-02TR-C
2
2
2
Cat1+RS485
CS-04TR-E
4
4
4
Ethernet+RS485
CS-04TR-C
4
4
4
Cat1+RS485
1.4 Dimension
CS-02TR: 115mm*90mm*40mm
CS-02TR: 155mm*100mm*29mm
NOLock Linkage
√
√
√
√
Lock Linkage
√
√
√
√
All Channel Lock
Linkage
√
√
√
√
2Device NOLock
Linkage
√
√
√
√
2Device Lock Linkage
√
√
√
√
Electrical&
Working
Performance
Contact capacity
10A/30VDC 10A/250VDC
Durability
100,000 times (Electrical）10,000,000 times (Mechanical)
Temperature
-40℃～70℃, Industrial Grade
Humidity
5～85%RH, Noncondensible
Dimension
115mm*90mm*40mm
155mm*100mm*29mm
Installation
35mm Din Rail Mounting
/ Screw Holes
Screw Holes
Software
Support
Working mode change
√
√
√
√
DO independent control
√
√
√
√
DI status query
√
√
√
√
Overall DO control
√
√
√
√
Debugging information
query
√
√
√
√
Support various
configuration software
√
√
√
√
Support Labview, etc.
√
√
√
√

CS-02TR/04TR User Manual
6/ 21
2 Wiring Instructions
2.1 Terminal Definition
DI AI DO Terminal Definition
Pin
Instruction
DI INPUT
VIN+
Positive power supply
VIN-
Negative power supply
DCOM
DI public terminal（=VIN-）
DI1
Digital input1
DI2
Digital input2
AI INPUT
AI1
Analog input1
AI2
Analog input2
DO OUTPUT
NO1
Normally Open1
COM1
Public1
NC1
Normally Close1
NO2
Normally Open2
COM2
Publoc2
NC2
Normally Close2
RS485 Communication Terminal Definition
Pin
Instruction
RS485
VIN+
Positive power supply
VIN-
Negative power supply
A/+
RS485 A
B/-
RS485 B
2.2 Power Supply
The power supply voltage of controller is DC9~24V, which can be powered
by terminals or DC plugs. Determine the positive and negative electrodes
according to the film and PCBAlogo.
After power cable is connected normally, PWR light of the controller is
always on, and WORK light flashes.
All VIN+ and VIN- interfaces on the controller are also internally connected
to the power input interface, and any set of interfaces can also supply power to
the device or active sensors.

CS-02TR/04TR User Manual
7/ 21
2.3 RS485 Connection
RS485 interface of the controller uses a 5mm terminal block. Support
MODBUS RTU protocol for control. It can be connected to PC, PLC or
configuration screen and other equipment for data acquisition and control.
485 serial port parameters of the controller are:
Baud rate 9600bps
Data bits 8 bits
Stop bit 1 bit
Check Digit NONE
Communication protocol: Modbus RTU
2.4 4G antenna/network cable connection
The 4G signal antenna interface of the controller is SMA female socket
(inner hole), and the external antenna is SMAmale head (inner needle). Rotate
and tighten.
Notice:
If you want to install the controller inside a metal box, you need to expose
the antenna to the metal box.
To prevent accidental damage to the 4G chip, install 4G antenna in place
before powering on the controller.

CS-02TR/04TR User Manual
8/ 21
2.5 AI Wiring
2.6 DI Wiring
Active Switch (Wet Contact): measuring signal with voltage (high and low level,
pulse), such as infrared detection, triode output, liquid level detection, smoke
detection, PLC output, flow monitoring.
Passive Switch (Dry Contact): passive contact signal, such as various switches,
buttons.

CS-02TR/04TR User Manual
9/ 21
2.7 DO Wiring

CS-02TR/04TR User Manual
10 / 21
Please add an AC contactor/intermediate relay between this device and the
load in the following four cases:
1. Load rated voltage>30VDC
2. Load rated voltage>250VAC
3. Non-Resistive Load Current>3A
4. Resistive load current>5A
3 Communication Protocol and Data Format
3.1 Manual and Software Updating
This manual and Config software will be updated through website, please
Download link: https:// www.onefexindustrial.com

CS-02TR/04TR User Manual
11 / 21
3.2 Communication Setting
3.2.1 Device Address
3.2.2 Read/Set Baud Rate
3.3 Communication Protocol Instructions
This controller supports standard Modbus commands. For detailed command
generation and parsing methods, you can refer to "Modbus Protocol English
Version" based on the register table in this article. This product supports
Modbus-RTU format.

CS-02TR/04TR User Manual
12 / 21
3.3.1Modbus Register Instruction
Register
Address
Type
Function
Type
Explanation
Defaults
03E8H
uint16
Communication Baud Rate
Read and write
RS485 interface baud rate, default
9600; [0-9600; 1-2400; 2-4800;
3-9600; 4-19200; 5-115200]
0
03E9H
uint16
Check Digit
Read and write
Check digit, default 0-none
0
03EAH
uint16
Device address
Read and write
The device address (same as the
serial port relay definition)
201
03EBH
uint16
Reserve
Read and write
Reserve
0
03ECH
uint16
Reserve
Read and write
Reserve
0
03EDH
uint16
Active reporting enabled
Read and write
0 does not report any data, nor does it
report data changes;
1 is active reporting and reporting of
switch value and relay status changes
1
03EEH
uint16
Slave polling collection
time interval
Read and write
Slave polling collection time interval;
unit: ms
500
03EFH
uint16
Active reporting time
interval
Read and write
Time interval for data summary
reporting, unit: s
60
03F0H
uint16
Slave acquisition interval
Read and write
The interval between two adjacent
instructions (from the end of the last
judgment to the next instruction), unit:
ms
500
03F1H
uint16
Command corresponding
timeout time
Read and write
Command response timeout,
unit ms
2000
03FAH
uint16
SLAVE ADDR1
Read and write
Slave node 1: address【H】+function
code【L】
0
03FBH
uint16
REG Start
Read and write
Slave 1: Register start address
0
03FCH
uint16
REG NUM
Read and write
Slave 2: Number of registers
0
03FDH
uint16
SLAVE ADDR2
Read and write
Slave node 24: address【H】+function
code【L】
0
03FEH
uint16
REG Start
Read and write
Slave 24: Register start address
0
03FFH
uint16
REG NUM
Read and write
Slave 24: Number of registers
0
043FH
uint16
SLAVE ADDR1
Read and write
Slave node 24: address【H】+function
code【L】
0
0440H
uint16
REG Start
Read and write
Slave 24: Register start address
0
0441H
uint16
REG NUM
Read and write
Slave 24: Number of registers
0
045AH
uint16
Logic
Read and write
0 Do not use linkage
1 When the input is closed, the output
is closed
2 When the input is closed, the output
is open
3 Output closes for a period of time,
0

CS-02TR/04TR User Manual
13 / 21
then opens
4 outputs open and close loop
5 Close when greater than the upper
limit, open when less than the lower
limit
6 Open when greater than the upper
limit, and close when it is less than
the lower limit
7 Input is greater than limit, output is
closed
8 Input is greater than limit, output is
disconnected
9 Jog input, control output
045BH
uint16
TimeDelayOn
Read and write
Delay disconnection time,
unit: seconds,
Modes 3 and 4 use
0
045CH
uint16
TimeDelayOff
Read and write
Disconnect time, unit: seconds,
used in mode 4
0
045DH
uint16
LogicH
Read and write
Upper limit of logical comparison,
used in modes 5, 6, 7, 8
0
045EH
uint16
LogicL
Read and write
Logic comparison lower limit, used in
modes 7 and 8
0
045FH
uint16
InputFunc&Id
Read and write
Function code of input signal + slave
ID
0
0460H
uint16
InputRegAdd r
Read and write
input register address
0
0461H
uint16
OutputFunc& Id
Read and write
Output function code + slave Id 0
0
0462H
uint16
OutputRegA ddr
Read and write
output register address
0
0463H
uint16
OutputRegN um
Read and write
Number of output registers
0
04A0H
uint16
Logic
Read and write
0 no logic
1 When the input is closed, the output
is closed
2 When the input is closed, the output
is open
3 Output closes for a period of time,
then opens
4 outputs open and close loop
5 Input is greater than limit, output is
closed
6 The input is greater than the limit,
the output is disconnected
7 Open when greater than the upper
limit, and close when it is less than
the lower limit
8 Close when greater than the upper
limit, open when less than the lower
0

CS-02TR/04TR User Manual
14 / 21
limit
9 Jog input, control output
04A1H
uint16
TimeDelayOn
Read and write
Delay off time in seconds, mode 3, 4
use
0
04A2H
uint16
TimeDelayOff
Read and write
Disconnect time in seconds, used in
mode 4
0
04A3H
uint16
LogicH
Read and write
Upper limit of logical comparison,
used in modes 5, 6, 7, 8
04A4H
uint16
LogicL
Read and write
Logic comparison lower limit, used in
modes 7 and 8
04A5H
uint16
InputFunc&Id
Read and write
Function code of input signal + slave
ID
0
04A6H
uint16
InputRegAdd r
Read and write
input register address
0
04A7H
uint16
OutputFunc& Id
Read and write
Output function code + slave Id 0
0
04A8H
uint16
OutputRegA ddr
Read and write
output register address
0
04A9H
uint16
OutputRegN um
Read and write
Number of output registers
0
3.3.2 Storage rules for collecting sensor data
The collected sensor data will store the valid data in the status register
according to collection sequence. The register addresses 0004H~0035H are
the register mechanism for storing valid data. Users can use the standard 03H
function code to read through RS485 interface or the server, or enable the
device's active reporting function to actively send data to the server (note that
data will not be actively sent to RS485 interface). The length of sent data is the
same as the valid data length of all the sensors collected, and the data packet
is sent to the server according to the standard 03H function code return format.
If one of the set sensors does not collect data, the register corresponding to
the valid data length of the sensor is filled with FFH.
In addition to the sensor device, the connected device type can also be
connected to relay device and switch value acquisition device. The
corresponding slave node configuration value can be changed to 01H and 02H
function codes. Please noted that the data collected by 01H and 02H function
codes sometimes has an odd number. At this time, in order to meet the 03H
function code rules reported actively, the device will automatically add 00H to
make the valid data an even byte.
3.3.3 Time interval parameters of devices
（1）Active reporting interval: the data interval for the device to actively report
the collected sensor data, the default is 60s, and the value range is 1~65535;
（2）Slave polling collection time interval: the time interval between collecting

CS-02TR/04TR User Manual
15 / 21
the sensor data of this round and the next round of sensor data, in ms, the
default is 500ms, and the value range is 1~65535;
（3）Slave acquisition time interval: in the process of collecting a round of
sensors, the interval time for different sensors to collect data, in ms, the default
is 500ms, and the value range is 1~65535;
（4）Command timeout time: In the process of collecting sensors, collect a
certain sensor data and wait for the timeout time. If no value is returned
beyond this value, this sensor will be skipped for the next sensor data
collection.
3.3.4 Local Logic Mode
(0) No logic: without any logic control.
(1) When input is closed, the output is closed: the relay state follows the digital
input state.
(2) When input is closed, the output is disconnected: the relay state reversely
follows the digital input state.
(3) The output is closed for a period of time, and then disconnected: delayed
disconnection, the minimum delay time is 1s, and the range is 1~65535.
(4) The output is open and closed cycle: set the closing time and opening time,
the relay will do the cycle opening and closing action.
(5) When the input is greater than the limit value, the output is closed: when
the read analog value is greater than the set value, the set relay is closed.
(6) When the input is greater than the limit value, the output is disconnected:
when the read analog value is greater than the set value, the set relay is
disconnected.
(7) Open when it is greater than the upper limit, and close when it is less than
the lower limit: the read analog value is opened when the value is greater than
the upper limit, and closed when it is less than the lower limit. In principle, the
upper limit is greater than the lower limit, and the middle area is a dead zone.
(8) Close when greater than the upper limit, open when it is less than the lower
limit: the same as mode 7, the relay operation is reversed.
(9) Jog input, control output: the switch value is closed and disconnected once,
and the relay state is reversed once.
Note that the above operations are all native device resource controls.
3.3.5Status Register List
The status register is a read-only register, and user can read the current data
parameters of the device locally or remotely through the 03H function code.
Register
Address
Type
Function
Type
Explanation
0000H
uint16
relay status
read only
Relay status register, high byte
is 00H; The low byte indicates

CS-02TR/04TR User Manual
16 / 21
the current relay state by bit
0001H
uint16
switch status
read only
Switch status register, high byte
is 00H
The low byte indicates the
current switch state by bit
0002H
uint16
The first
channel analog
value
read only
The first channel analog value
(range 4000-20000), the value is
enlarged by 1000 times
0003H
uint16
The second
channel analog
value
read only
The second channel analog
value (range 4000-20000), the
value is enlarged 1000 times
0004H
uint16
Slave value
register 1
read only
Used to store sensor data read
through RS485 interface, up to
50 registers (100 bytes) of raw
data
0005H
uint16
Slave value
register 2
read only
0006H
......
uint16
Slave value
register 3
read only
0035H
uint16
Slave value
register 50
read only
The data stored in the status register is the status of local resource and valid
data of the polled sensor. Among them, the four registers 0000H~0003H store
the status value of the controller's own resources (DO, DI, AI), and the fifty
registers 0004H~0035H store the valid data read from sensor, according to the
polling sensor order to store the data.
Pay attention to the following two points:
(1) When the polling sensor operation is not set, only the register value of the
address 0000H~0003H is valid (the local resources are valid);
(2) When the polling sensor operation is set, the valid data read from all
sensors are placed in the registers with addresses 0004H~0035H in
sequence.
The user can use standard Modbus RTU protocol to read the data in the status
register through the RS485 port, or remotely read the data through the server
using the standard Modbus RTU protocol.
3.3.6Active reporting protocol
The controller uses socket interface to connect to the client server, the data
reporting format uses standard Modbus RTU protocol, and needs to use HEX
(hexadecimal) for parsing.
The active reporting function is only enabled when user enables the function
(in the parameter register). Users can also not turn on active reporting function
but use standard Modbus RTU protocol 03H function code to actively read
data.

CS-02TR/04TR User Manual
17 / 21
（1）If the client server actively reads the data, the required status register
data can be read according to the standard Modbus RTU protocol 03H
function code;
（2）If uses active reporting function, the reporting protocol is as follows:
Add 03 num aa aa bb bb cc cc dd dd xx xx ...... crc1 crc2
Add：Controller Modbus address
03：03H function code of Modbus RTU;
num：Number of valid data bytes, without crc check bytes;
aa aa：relay status;
bb bb：switch status;
cc cc dd dd: The first and second analog values;
xx xx......：Sensor valid data
Note: When using active reporting function, the local resource status data is
fixed reporting data and cannot be removed.
3.4 Configuration Software Instructions
Select the correct serial port number, default baud rate is 9600; no
verification, selects item# IO222-E (according to the actual product
purchased), the default communication address is 201, the broadcast
address is 254, Then ‘’Connect”
Click the "Read Configuration" to read the current communication baud rate,
address, active reporting status, reporting period, and timeout time of the
device. You can set the corresponding parameters through "Set".

CS-02TR/04TR User Manual
18 / 21
‘’ linkage Settings" can read and configure logical functions.
“Node Settings” can read configuration of sensors and configure the
corresponding Node address, function code, start address, and length of
registers; controller can read the data of corresponding sensor in sequence
according to configuration sequence. If you want to delete a certain sensor, set
the corresponding value to 0 (select "None" for the function code).

CS-02TR/04TR User Manual
19 / 21
4 Product Maintenance
4.1 Device Usage Environment
1. The working voltage is 9~28V. If the input voltage is too high or too low, the
device may not work normally or even be damaged.
2. The DI input terminal adopts optocoupler isolation protection, and its
bearing voltage is 5~24V.
3. Do not overload for the DO output terminals. Please connect them correctly
within the allowable range (refer to the wiring diagram for details).
4. The allowable air humidity of the device is 5~85%RH, and it does not have
waterproof capability. Do not use it in condensation or liquid immersion
environments.
5. The controller is a component with a certain service life. When the
theoretical service life is reached, please replace it in time to avoid danger.
4.2 FAQ
4.2.1RS485 /RS232 communication, no response when device
control
Confirm whether the communication speed, communication address,
and wiring are correct.
You can use the broadcast address 254 to try to communicate with
unknown addresses;
Confirm whether the serial port number on the software is correct;
Check whether the power supply and work indicator are normal;
For the RS232 version, please correctly identify the RS232 serial port
module used as male or female.
The module TXD is connected to RX pin of the controller
The module RXD is connected to TX pin of the controller
The module GND is connected to GND pin of the controller

CS-02TR/04TR User Manual
20 / 21
4.2.2The DO can only be turned on but not turned off
Check Whether the read address reads the actual device address;
Check whether there is a return command in the debug information
column, and whether the return command is correct.
If reading address fails, there is no return command or abnormal
return command, check the communication line and communication
converter
When the controller and the controlled equipment share a DC power
supply, if the controlled equipment is heavily loaded, it may cause
insufficient power supply of the controller and DO cannot switch normally.
4.2.3485 interface cannot be used to establish communication
and control After the controller powered on.
1. Check whether the 485 line is reversed and whether the voltage is within
the specified range;
2. Fill in 254 for the device address on software to test whether it can be can
be controlled with different baud rates.
4.2.4Multiple devices on the 485 bus and ON/OFF operation
failed to send the broadcast address 254.
If there are multiple devices on the 485 bus, the address of each
device cannot be the same, and the broadcast address 254 cannot be
used for communication.
The broadcast address can be used when there is only one device on
the bus. When there is more than one device, please use the DIP switch
to distinguish the address to control, otherwise the command cannot be