Siemens RS-485 User manual

CC1A7865.1en
31.10.2002
Siemens Building Technologies
HVAC Products
7865.1
Interface RS-485 RWF40...
The RS-485 interface is used for integrating RWF40… controllers into data networks
via MOD bus protocol.
Application examples:
- Process visualization
- Plant control
- Reporting
Master-slave principle
Communication between a PC (master) and a device (slave) via MOD bus is based on
the master-slave principle in the form of data query / instruction – reply.
A master computer controls the exchange of data and can address up to 99 controllers
via device addresses (slaves).

2/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Transmission mode (RTU)
The transmission mode used is the RTU (remote terminal unit) mode. Data are trans-
mitted in binary format (hexadecimal) with 8 bits.
The LSB (least significant bit) is transmitted first.
ASCII mode is not supported.
The data format describes the structure of the transmitted byte.
Data word Parity bit Stop bit ½ bit Number of bits
8 bit Not 1 9
Device address
The slaves’ device addresses can be selected between 1 and 99.
Device address 0 is reserved.
+A maximum of 31 slaves can be addressed via the RS-422 / RS-485 interface.
There are 2 choices of data exchange:
Query Data query / instructions delivered by the master to a slave via the re-
spective device address.
The addressed slave responds.
Broadcast Master instructions to all slaves via device address 0.
The addressed slaves do not respond.
A data query with device address 0 does not make sense.
A certain setpoint can be transmitted to all slaves, for example.
In that case, correct adoption of the value by the slaves should be
checked by subsequent setpoint readout.
Data format

3/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Communication sequence
Both the start and end of a data block are characterized by transmission pauses. The
maximum period of time that may elapse between 2 successive characters is 3 times
the period of time required for the transmission of one character.
The character transmission time (period of time required for the transmission of 1 char-
acter) is dependent on the Baud rate and the type of data format.
Using a data format of 8 data bits, no parity bit and 1 stop bit, the character transmis-
sion time is calculated as follows:
Character transmission time [ms] = 1000 * 9 bits / Baud rate
Data query by the master
Transmission time = n characters * 1000 * x bits / Baud rate
Identification of end of data query
3 characters * 1000 * x bits / Baud rate
Handling of data query by the slave (£250 ms)
Reply by the slave
Transmission time = n characters * 1000 * x bits / Baud rate
Identification of end of reply
3 characters * 1000 * x bits / Baud rate
Identification of the data query or end of the reply with a data format of 10 / 9 bits.
Waiting time = 3 characters * 1000 * x bits / Baud rate
Baud rate Data format [bits] Waiting time [ms]
9.600 9 2.813
19.200 9 1.406
Process
Example

4/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Data query sequence
The time sequence of a data query looks as follows:
Master
Slave
Data query
Reply
Data query
t0t1t0t2
7865z12e/1102
t0 Identification of end = 3 characters
(time is dependent on the Baud rate)
t1 This time is dependent on internal handling.
The maximum handling time is 250 ms
t2 This is the time required by the device to switch from the transmitting mode back
to the receiving mode.
This time must be observed by the master before it makes a new data query. It
must always be maintained, even if the new data query is sent to some other
device.
t2 ³20 ms
Communication during the slave’s internal handling time
The master is not allowed to make any data queries during the slave’s internal handling
time.
Data queries made during that period of time will be ignored by the slave.
Communication during the slave’s response time
The master is not allowed to make any data queries during the slave’s response time.
Data queries made during that period of time cause all data currently on the bus to
become obsolete.
Time sequence

5/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Structure of the data blocks
All data blocks use the same structure:
Slave address Function code Data field Checksum CRC16
1 byte 1 byte x byte 2 bytes
Every data block contains 4 fields:
Slave address Device address of a certain slave
Function code Function selection (reading or writing words)
Data field Contains the following information:
- Word address
- Number of words
- Word value
Checksum Identification of transmission errors
Fault handling
3 different error codes are used:
1 Invalid function
2 Invalid parameter address
8 Write access to parameter rejected
Slave address Function
XX OR 80 h
Error code Checksum CRC16
1 byte 1 byte 1 byte 2 bytes
The function code is OR linked with 0 x 80, that is, the MSB (most significant bit) will be
set to 1.
Data query:
01 02 00 70 00 04 CRC16
Reply:
01 82 01 CRC16
In the following cases, the slave does not reply:
- The checksum (CRC16) is wrong
- The instruction given by the master is incomplete or overdefined
- The number of words or bits to be read is zero
Data structure
Error codes
Reply in the event
of fault
Example
Special cases

6/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Checksum (CRC16)
The checksum (CRC16) is used to detect transmission errors.
If the evaluation reveals an error, the relevant device will not respond.
CRC = 0xFFF
CRC = CRC XOR ByteOfMessage
For (1 to 8)
CRC = SHR (CRC)
if (flag to the right = 1)
then
CRC = CRC XOR
0xA001
else
while (not all ByteOfMessage edited)
+The low byte of the checksum will be transmitted first.
Data query:
Reading 2 words from address 6 (CRC16 = 0x24A0)
0B 03 00 06 00 02 A0 24
CRC16
Reply:
(CRC16 = 0x6105)
0B 03 04 00 00 42 C8 61 05
Word 1 Word 2 CRC16
The following functions for the device will be available:
Function number Function
0x03 / 0x04 Reading n words (n £12)
0x06 Writing 1 word
0x10 Writing n words (n £2)
Calculation
Example

7/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Reading n words
This function is used to read n words from a certain address.
Slave address Function 0x03
or 0x04
Address of the
first word
Number of
words
(max. 12)
Checksum
CRC16
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Slave address Function 0x03
or 0x04
Number of
bytes read
Word value(s) Checksum
CRC16
1 byte 1 byte 1 byte x byte(s) 2 bytes
Reading the 2 setpoints of the controller
Word address = 0x0008 (setpoint SP1)
Data query:
0B 03 00 08 00 04 CRC16
Reply:
0B 03 08 0000 42C8 0000 4316 CRC16
Setpoint 1 (100) Setpoint 2 (150)
Writing 1 word
With the “Wordwriting” function, the data blocks for instruction and reply are identical.
Slave address Function 0x06 Word address Word value Checksum
CRC16
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Slave address Function 0x06 Word address Word value Checksum
CRC16
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Write limit value limit comparator 1 (AL1) (= 275)
Word address = 0x000C
Instruction: (write the first part of the value)
0B 06 00 0C 80 00 CRC16
Reply (like instruction):
0B 06 00 0C 80 00 CRC16
Instruction: (write the second part of the value)
0B 06 00 0D 43 89 CRC16
Reply (like instruction):
0B 06 00 0D 43 89 CRC16
Data query
Reply
Example
Instruction
Reply
Example

8/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Writing n words
Slave
address
Function
0x10
Address
of first
word
Number of
words
Number of
bytes
(max. 2)
Word
value(s)
Check-
sum
CRC16
1 byte 1 byte 2 bytes 2 bytes 1 byte x byte(s) 2 bytes
Slave address Function 0x10 Address of
first word
Number of
words
Checksum
CRC16
1 byte 1 byte 2 bytes 2 bytes 2 bytes
Write switch-on threshold (Hys1 = -10)
Word address = 0x0018
Instruction:
0B 10 00 18 00 02 04 00 00 C1 20 CRC16
Reply:
0B 10 00 18 00 02 CRC16
The high byte must be transmitted first.
Example: Configuration code C111: “9030“
MOD bus: 0B10 0024 00 02 04 0903
The following explanations apply under the condition that the master works with the
IEEE-754 format. Before transmitting a value, the bytes must be exchanged in a way
that the order corresponds to the presentation for the MOD bus (see illustration below).
M-23 bit normalized mantissa
E-exponent (complement to base 2)
S-Sign-bit; 1 = negative, 0 = positive
MOD-Bus
Master
Read
Write
MMMMMMMM MMMMMMMM SEEEEEEE EMMMMMMM
EMMMMMMM
SEEEEEEE MMMMMMMM MMMMMMMM
(IEEE 754)
7865z13e/1102
Example:
Transmission of decimal value “550“:
MOD bus: 0x80, 0x00, 0x44, 0x09
Following is a description of all process values (variables) with their addresses, data
type and type of access.
Where:
R / O Read only access
R / W Read and write access
float Float value (4 bytes / 2 words)
word Integer (2 bytes / 1 word)
The process values are subdivided into logic areas.
Instruction
Reply
Example
Data type “char“
Data type “float“

9/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Address tables
Address Data
type
Access Parameter Value range Default
value
0x0000 float R / O Actual value E1
0x0002 float R / O Actual value E2
0x0004 float R / O Actual value E3
0x0006 float R / W Current setpoint
0x0008 float R / W SP1 First setpoint SPL...SPH 0
0x000A float R / W SP2 (=dSP) Second setpoint SPL...SPH 0
Address Data
type
Access Parameter Value range Default
value
0x000C float R / W AL Limit value limit comparator -1999...9999 0
0x000E float R / W Pb1 Proportional band 0.1...9999 10
0x0010 float R / W dt Derivative action time 0...9999 80
0x0012 float R / W rt Integral action time 0...9999 350
0x0014 float R / W db Dead band (neutral zone) 0.0...100.0 1
0x0016 float R / W tt Actuator running time 10...3000 15
0x0018 float R / W Hys1 Switch-on threshold 0...-199.9 -5
0x001A float R / W Hys2 Switch-off threshold, bottom 0...Hys3 3
0x001C float R / W Hys3 Switch-off threshold, top 0.0...999.9 5
0x001E float R / W q Reaction threshold 0.0...999.9 0
0x0020 float R / W H Heating curve slope 0.0...4.0 1.0
0x0022 float R / W P Parallel displacement
room temperature
-90...90 0
Address Data
type
Access Parameter Value range Default
value
0x0024 char [4] R / W C111 9030
0x0026 char [4] R / W C112 0010
0x0028 char [4] R / W C113 0110
0x002A char [4] R / W C000 0000
0x002C float R / W SCL Normalization start value: Input 1 -1999...9999 0
0x002E float R / W SCH Normalization end value: Input 1 -1999...9999 100
0x0030 float R / W SCL2 Normalization start value: Input 2 -1999...9999 0
0x0032 float R / W SCH2 Normalization end value: Input 2 -1999...9999 100
0x0034 float R / W SPL Start value setpoint limitation -1999...9999 0
0x0036 float R / W SPH End value setpoint limitation -1999...9999 100
0x0038 float R / W OFF1 Offset input 1 -1999...9999 0
0x003A float R / W OFF2 Offset input 2 -1999...9999 0
0x003C float R / W OFF3 Offset input 3 -1999...9999 0
0x003E float R / W HYST Hysteresis of limit comparator 0...9999 1
0x0040 float R / W df1 Filter time constant input 1 0.0...100.0 1.0
0x0042 float R / W dF3 Filter time constant input 3 0...1440 1278
0x0044 float R / W dtt Bus detection timer 0...7200 * 30
0x0046 float R / O oLLo Start value actual value limit -1999...9999 -1999
0x0048 float R / O oLHi End value actual value limit -1999...9999 9999
* Timer = 0 means switched off
This parameter can only be changed via the management system
Process data
Parameter level
Configuration level

10/14
Siemens Building Technologies CC1A7865.1en
HVAC Products 31.10.2002
Address Data
type
Access Parameter Value range Default
value
0x0300 word [13] R / O Device data
0x0300 char SWVersion [11+1] Software version
0x0306 char VDNNr [13+1] VdN number
Address Data
type
Access Parameter Value range Default
value
0x0400 float R / O TEMP Actual value E3 (unfiltered)
0x0500 word R / W REM Activation remote operation 0...2 * 0
0x0501 word R / W ROFF Controller OFF in REMOTE
SETPOINT
0...1 ** 0
0x0502 float R / W RHYS1 Switch-on threshold REMOTE 0...-1999 HYS1
0x0504 float R / W RHYS2 Switch-off threshold bottom
REMOTE
0...RHYS3 HYS2
0x0506 float R / W RHYS3 Switch-off threshold top REMOTE 0...9999 HYS3
0x0508 float R / W SPR Setpoint REMOTE SPL...SPH SP1
0x050A word R / W RK1 Burner control remote operation 0...1 0
0x050B word R / W RK2 Relay K2 remote operation 0...1 0
0x050C word R / W RK3 Relay K3 remote operation 0...1 0
0x050D word R / W RK6 Relay LK remote operation 0...1 0
0x050E word R / W RSTEP Step control remote operation -100...100 0
0x050F float R / W RY Positioning output remote
operation
0...100 0
* 0 = local ** 1 = controller OFF
1 = remote setpoint
2 = fully remote
Device data
Remote operation