Walchem W600 Series User manual

W600/W900 Modbus
Instruction Manual
WAL C H EM , Iwaki America Inc.
Five Boynton Road Hopping Brook Park Holliston, MA 01746 USA :
TEL: [phone] WEB: www.walchem.com

Notice
© 2018 WALCHEM, Iwaki America Inc. (hereinafter “Walchem”)
5 Boynton Road, Holliston, MA 01746 USA
[phone]
All Rights Reserved
Printed in USA
Proprietary Material
The information and descriptions contained herein are the property of WALCHEM. Such information and
descriptions may not be copied or reproduced by any means, or disseminated or distributed without the
express prior written permission of WALCHEM, 5 Boynton Road, Holliston, MA 01746.
This document is for information purposes only and is subject to change without notice.
Statement of Limited Warranty
WALCHEM warrants equipment of its manufacture, and bearing its identification to be free from defects in
workmanship and material for a period of 24 months for electronics and 12 months for mechanical parts and
electrodes from date of delivery from the factory or authorized distributor under normal use and service and
otherwise when such equipment is used in accordance with instructions furnished by WALCHEM and for the
purposes disclosed in writing at the time of purchase, if any. WALCHEM’s liability under this warranty shall
be limited to replacement or repair, F.O.B. Holliston, MA U.S.A. of any defective equipment or part which,
having been returned to WALCHEM, transportation charges prepaid, has been inspected and determined by
WALCHEM to be defective. Replaceable elastomeric parts and glass components are expendable and are not
covered by any warranty.
THIS WARRANTY IS IN LIEU OF ANY OTHER WARRANTY, EITHER EXPRESS OR IMPLIED, AS TO
DESCRIPTION, QUALITY, MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE OR USE,
OR ANY OTHER MATTER.
180676 Rev E
June 2018

Table of Contents
1.0 SCOPE ............................................................................................................................................................... 5
2.0 INTRODUCTION ................................................................................................................................................ 5
3.0 OVERVIEW........................................................................................................................................................ 5
3.1 MODBUS SETTINGS ............................................................................................................................................ 6
4.0 MODBUS/TCP DRIVER ...................................................................................................................................... 6
4.1 MODBUS/TCP PROTOCOL ................................................................................................................................... 6
4.1.1 MBAP Header ........................................................................................................................................... 6
4.1.2 Protocol Data Unit .................................................................................................................................... 7
4.1.3 Modbus/TCP Function Codes ..................................................................................................................... 7
4.1.3.1 Function Code 1, Read Coils .............................................................................................................................. 8
4.1.3.2 Function Code 2, Read Discrete Inputs............................................................................................................... 8
4.1.3.3 Function Code 3, Read Holding Registers ........................................................................................................... 9
4.1.3.4 Function Code 4, Read Input Registers............................................................................................................... 9
4.1.3.5 Function Code 5, Write Single Coil ................................................................................................................... 10
4.1.3.6 Function Code 6, Write Single Holding Register................................................................................................ 10
4.1.3.7 Function Code 16, Write Multiple Holding Registers......................................................................................... 11
4.1.4 Modbus/TCP Exception Error Codes......................................................................................................... 11
4.2 TCP/IP INTERFACE .......................................................................................................................................... 12
4.3 DATA REFRESH................................................................................................................................................ 12
4.4 DATA ENCODING ............................................................................................................................................. 12
4.4.1 Coils and Discrete Inputs ......................................................................................................................... 12
4.4.1.1 Boolean.......................................................................................................................................................... 12
4.4.2 Holding Register and Input Registers ....................................................................................................... 12
4.4.2.1 16-Bit Word (Boolean) .................................................................................................................................... 12
4.4.2.2 16-Bit Word (Bitfield)...................................................................................................................................... 13
4.4.2.3 16-Bit Word (Status) ....................................................................................................................................... 13
4.4.2.4 16-Bit Word (Integer)...................................................................................................................................... 13
4.4.2.5 32-Bit Value (Integer)...................................................................................................................................... 13
4.4.2.6 32-Bit Value (Float)......................................................................................................................................... 13
4.4.2.7 32-Bit Inverse Data Format (Integer or Float) .................................................................................................. 14
5.0 DATA DICTIONARY.......................................................................................................................................... 14
5.1 ADDRESSING (0-OR 1-BASED)............................................................................................................................ 14
5.2 ADDRESS MAPS............................................................................................................................................... 14
5.2.1 W600 Controller – I/O Channel Address Maps ......................................................................................... 15
5.2.2 W900 Controller – I/O Channel Address Maps ......................................................................................... 16
5.2.3 Alternate Address Maps.......................................................................................................................... 18
5.3 TYPE-SPECIFIC ADDRESS MAPS ........................................................................................................................... 19
5.3.1 System Address Map............................................................................................................................... 19
5.3.2 Network Address Map............................................................................................................................. 20
5.3.3 Sensor Input Address Maps ..................................................................................................................... 21
5.3.3.1 Sensor Input (all types except Analog Input Flowmeter) Address Map .............................................................. 21
5.3.3.2 Analog Input Flowmeter Address Map............................................................................................................. 22
5.3.4 Digital Input Address Maps ..................................................................................................................... 23
5.3.4.1 Digital Input / DI State Type Address Map ....................................................................................................... 23
5.3.4.2 Digital Input / Contacting Flow Meter Type Address Map................................................................................. 24
5.3.4.3 Digital Input / Paddlewheel Flow Meter Type Address Map.............................................................................. 25
5.3.4.4 Digital Input / DI Counter Type Address Map ................................................................................................... 26
5.3.4.5 Digital Input / Flow Monitor Type Address Map............................................................................................... 27

5.3.5 Virtual Input Address Maps..................................................................................................................... 28
5.3.5.1 Virtual Input / Calculation & Raw Value Type Address Map.............................................................................. 28
5.3.5.2 Virtual Input / Redundant Sensor Type Address Map ....................................................................................... 29
5.3.5.3 Virtual Input / Disturbance Type Address Map................................................................................................. 30
5.3.6 Relay Output Address Maps.................................................................................................................... 31
5.3.6.1 Relay Output / Manual Control Mode Address Map......................................................................................... 31
5.3.6.2 Relay Output / On/Off & On/Off Disturbance Control Mode Address Map ........................................................ 32
5.3.6.3 Relay Output / Dual Setpoint Control Mode Address Map ................................................................................ 33
5.3.6.4 Relay Output / Time Proportional Control Mode Address Map ......................................................................... 34
5.3.6.5 Relay Output / Intermittent Sampling Control Mode Address Map................................................................... 35
5.3.6.6 Relay Output / Bleed And Feed Control Mode Address Map ............................................................................. 36
5.3.6.7 Relay Output / Bleed Then Feed Control Mode Address Map............................................................................ 37
5.3.6.8 Relay Output / Flow Timer Control Mode Address Map.................................................................................... 38
5.3.6.9 Relay Output / Counter Timer Control Mode Address Map............................................................................... 39
5.3.6.10 Relay Output / Target PPM Control Mode Address Map................................................................................... 40
5.3.6.11 Relay Output / PPM By Volume Control Mode Address Map ............................................................................ 41
5.3.6.12 Relay Output / Flow Meter Ratio Control Mode Address Map .......................................................................... 42
5.3.6.13 Relay Output / Volumetric Blend Control Mode Address Map........................................................................... 43
5.3.6.14 Relay Output / Percent Timer Control Mode Address Map ............................................................................... 44
5.3.6.15 Relay Output / Event Timer Control Mode Address Map .................................................................................. 45
5.3.6.16 Relay Output / Biocide Timer Control Mode Address Map................................................................................ 46
5.3.6.17 Relay Output / Spike Control Mode Address Map ............................................................................................ 47
5.3.6.18 Relay Output / Probe Wash Control Mode Address Map .................................................................................. 48
5.3.6.19 Relay Output / Plating Control Mode Address Map.......................................................................................... 49
5.3.6.20 Relay Output / Plating Follow Control Mode Address Map............................................................................... 50
5.3.6.21 Relay Output / Lag Output Control Mode Address Map ................................................................................... 51
5.3.6.22 Relay Output / Alarm Control Mode Address Map ........................................................................................... 52
5.3.7 Pulse Relay Output Address Maps........................................................................................................... 53
5.3.7.1 Pulse Relay Output / Manual Control Mode Address Map................................................................................ 53
5.3.7.2 Pulse Relay Output / Pulse Proportional Control Mode Address Map................................................................ 54
5.3.7.3 Pulse Relay Output / Flow Proportional Control Mode Address Map................................................................. 55
5.3.7.4 Pulse Relay Output / Pulse PID Control Mode Address Map.............................................................................. 56
5.3.7.5 Pulse Relay Output / Pulse Disturbance Control Mode Address Map................................................................. 57
5.3.7.6 Pulse Relay Output / Lag Output Address Map ................................................................................................ 58
5.3.8 Analog Output Address Maps.................................................................................................................. 59
5.3.8.1 Analog Output / Manual Control Mode Address Map ...................................................................................... 59
5.3.8.2 Analog Output / Retransmit Mode Address Map ............................................................................................. 60
5.3.8.3 Analog Output / Proportional Control Mode Address Map............................................................................... 61
5.3.8.4 Analog Output / Flow Proportional Control Mode Address Map....................................................................... 62
5.3.8.5 Analog Output / PID Control Mode Address Map............................................................................................. 63
5.3.8.6 Analog Output / Disturbance Control Mode Address Map................................................................................ 64
5.3.8.7 Analog Output / Lag Output Control Mode Address Map................................................................................. 65
5.3.9 Alternate Address Maps.......................................................................................................................... 66
5.3.9.1 Alternate Sensor Input Address Map ............................................................................................................... 66
5.3.9.2 Alternate Digital Input Address Map ............................................................................................................... 67
5.3.9.3 Alternate Virtual Input Address Map............................................................................................................... 68
5.3.9.4 Alternate Relay Output Address Map .............................................................................................................. 69
5.3.9.5 Alternate Analog Output Address Map............................................................................................................ 70
5.4 STATUS REGISTER CODES................................................................................................................................... 71
5.5 ALARM BITFIELDS ............................................................................................................................................ 73
5.5.1 System Alarm Bitfield.............................................................................................................................. 73
5.5.2 Network Alarm Bitfield ........................................................................................................................... 73
5.5.3 Sensor Input Alarm Bitfield...................................................................................................................... 74
5.5.4 Digital Input Alarm Bitfield...................................................................................................................... 74
5.5.5 Virtual Input Alarm Bitfield ..................................................................................................................... 75
5.5.6 Relay Output Alarm Bitfield..................................................................................................................... 75
5.5.7 Analog Output Alarm Bitfield .................................................................................................................. 76

1.0 SCOPE
This document is a User Interface Specification for the Walchem Modbus/TCP product feature for W600
and W900 Controllers. It contains mapping of the various dynamic variables to their Modbus/TCP
address locations.
This document supports the Modbus/TCP feature on controller software versions 3.01 and higher.
2.0 INTRODUCTION
The Modbus/TCP feature allows the Walchem controller to communicate with PC-based applications
such as WonderWare and Intellution HMI/SCADA programs, Building Energy Management systems,
Distributed Control Systems (DCS), as well as stand-alone HMI devices.
The controller is a Modbus Server, meaning that it can respond to requests from the HMI device. The
controller cannot initiate the flow of information. For example, it will not immediately send a new alarm
message. It will wait until the HMI device requests the current data contained in specific address
locations.
If the HMI device does not directly support the Modbus/TCP protocol, then a protocol translation
gateway may be required to convert from Modbus/TCP to a protocol that the device supports. Please
note that Modbus/RTU requires a serial interface, not Ethernet, and therefore is not directly compatible
with the Walchem controller.
3.0 OVERVIEW
Modbus/TCP, also known as Modbus TCP/IP, is a form of Modbus that uses the TCP/IP layers as a base
for controlling the communications between different devices. This is not to be confused with Modbus
over TCP/IP, which Walchem controllers do not support.
The Modbus/TCP protocol supports multiple types of data transactions, from reading single bits per
transaction, to advanced object oriented operations. However, to ensure the most compatible system
available, only a basic subset of these functions is supported in the controller.
The official Modbus/TCP protocol supports data addresses 5 digits in length. A de facto extended
standard exists which supports data addresses 6 digits in length. However, to ensure compatibility, the
Modbus/TCP feature supports only 5-digit data address system.
The Modbus/TCP feature supports reading and writing of single-bit Coils and 16-bit Holding Registers, as
well as read-only single-bit Discrete Inputs and 16-bit Input Registers. These data formats allow the
controller to establish blocks that contain all the process variables, set points, alarms, and input/output
status values that are made public to a Modbus/TCP client. These blocks of data are packaged so that it
can be read in 8-bit chunks (for a group of up to 8 Coils or Discrete Inputs) or 16-bit chunks (for a single
Holding Register or Input Register), regardless of the type of data within it. In the following sections, the
formatting, storing, and reading of this data are described.

6
3.1 Modbus Settings
Settings relating to the Modbus/TCP feature can be configured in the Remote Communication
Configuration Menu.
The ‘Verbose Logging’ setting is used to generate an Event log entry for every Modbus message into and
out of the controller. The information may be used in conjunction with an HMI log when
troubleshooting communications during commissioning. However, the additional logging adds a
significant load on the controller’s systems. Therefore, this feature should only be enabled temporarily
while actively troubleshooting communications. The setting automatically reverts to Disabled when the
controller is restarted.
Detailed information on the Remote Communication Configuration Menu can be found in the controller
Instruction Manual.
4.0 MODBUS/TCP DRIVER
4.1 Modbus/TCP Protocol
The Modbus protocol, as well as the Modbus/TCP variant, is well documented in the specifications
which are available at http://www.modbus.org, a website established by the Modbus Organization for
supporting and organizing the Modbus protocol.
The Modbus/TCP Application Data Unit (ADU) consists of 2 distinct sections:
Modbus Application Protocol (MBAP)
Header
Protocol Data Unit (PDU)
The total size of the ADU is between 9 and 263 bytes, depending on the function code and number of
data addresses requested.
4.1.1 MBAP Header
The Modbus/TCP extension adds 7 additional bytes to the original Modbus protocol, which allows for
the transport over the TCP/IP layers. These 7 bytes make up the MBAP Header:
Modbus Application Protocol (MBAP) Header
Name
Size
Description
Transaction Identifier 2 bytes
Identification of Request/Response transaction.
Copied from request to response
Protocol Identifier
2 bytes
0 = Modbus protocol.
Length
2 bytes
Number of following bytes (includes the Unit Identifier and PDU)
Unit Identifier 1 byte
Identification of Remote Device.
Can be used for broadcasting (unsupported).
The Unit Identifier has a special consideration in the Modbus/TCP implementation. If the value is 0, then
the request is a broadcast message and the packet will be processed, but no response will be generated.
If the value is non-zero, the packet will be processed and a response will be returned.
Normally the Slave ID, which is not present in the Modbus/TCP protocol, will be set in the HMI client
software to 1. The broadcast Unit Identifier address is not supported by the controller; all supported
function codes require a response message at all times.

7
4.1.2 Protocol Data Unit
The Protocol Data Unit (PDU) is made up of between 2 and 256 bytes, depending on the function and
number of data addresses requested:
Protocol Data Unit (PDU)
Name
Size
Description
Function Code 1 byte
Function Code identifier.
Can be any of the hexadecimal codes listed in the Function Code table.
Data Payload
1 – 255
byte(s)
Payload for request/response transactions.
Varies depending on function code and number of addresses requested.
4.1.3 Modbus/TCP Function Codes
The Modbus/TCP Server feature supports the following function codes:
Supported Function Codes
Function
Code
Name Description
Data Address
Range
FC1
(0x01)
Read Coils
Read up to 2000 consecutive 1-bit Coils within a single
request/response cycle.
0xxxx
FC2
(0x02)
Read Discrete
Inputs
Read up to 2000 consecutive 1-bit Discrete Inputs
within a single request/response cycle.
1xxxx
FC3
(0x03)
Read Holding
Registers
Read up to 125 consecutive 16-bit Holding Registers
within a single request/response cycle.
4xxxx
FC4
(0x04)
Read Input
Registers
Read up to 125 consecutive 16-bit Input Registers
within a single request/response cycle.
3xxxx
FC5
(0x05)
Write Single Coil
Write a single 1-bit Coil within a single
request/response cycle.
0xxxx
FC6
(0x06)
Write Single
Holding Register
Write a single 16-bit Holding Register within a single
request/response cycle.
4xxxx
FC16
(0x10)
Write Multiple
Holding Registers
Write up to 125 consecutive 16-bit Holding Registers
within a single request/response cycle.
4xxxx
The consecutive address limitations of the Coils, Discrete Inputs, Holding Registers, and Input Registers
were established for the Modbus/TCP standard to maintain consistency with the original Modbus
protocol standard, even though a TCP/IP packet can contain a larger payload.
The Modbus/TCP feature allows for Function Codes 1 and 2 to be used interchangeably for read
requests. For example, a read coils (FC1) request for data addresses 00605 through 00610 will always
return the same result as a read discrete inputs (FC2) request for data addresses 10605 through 10610.
Likewise, the Modbus/TCP feature allows for Function Codes 3 and 4 to also be used interchangeably for
read requests. For example, a read holding registers (FC3) request for data addresses 40587 through
40590 will always return the same result as a read input registers (FC4) request for data addresses
30587 through 30590. All addresses accessible as a Coil or Discrete Input may also be accessed as a
Holding Register or Input Register.
Only the 4 least significant digits of the data address are explicitly stated in the Modbus message, with
the most significant (5th) digit being derived from the function code. However, generally the entire
5-digit data address must be specified in the Tag Database of an HMI.

8
4.1.3.1 Function Code 1, Read Coils
Read Coils Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x01).
Starting Address
2 Bytes
The data address of the first Coil to read.
Quantity of Coils
2 Bytes
The number of Coils requested, maximum of 2000 per message.
Read Coils Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x01).
Byte Count
1 Byte
The number of data bytes to follow.
Coil Status
1-125 Bytes
8 Coils per byte, up to 2000 Coils per message.
Read Coils Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x81).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.3.2 Function Code 2, Read Discrete Inputs
Read Discrete Inputs Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x02).
Starting Address
2 Bytes
The data address of the first Discrete Input to read.
Quantity of
Discrete Inputs
2 Bytes
The number of Discrete Inputs requested, maximum of 2000 per
message.
Read Discrete Inputs Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x02).
Byte Count
1 Byte
The number of data bytes to follow.
Discrete Input
Status
1-125 Bytes
8 Discrete Inputs per byte, up to 2000 Discrete Inputs per
message.
Read Discrete Inputs Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x82).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes

9
4.1.3.3 Function Code 3, Read Holding Registers
Read Holding Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x03).
Starting Address
2 Bytes
The data address of the first Holding Register to read.
Quantity of
Holding Registers
2 Bytes
The total number of Holding Registers requested, maximum of
125 per message.
Read Holding Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x03).
Byte Count
1 Byte
The number of data bytes to follow.
Holding Register
Values
2-250 Bytes
1 Holding Register for every 2 bytes, maximum of 125 Holding
Registers per message.
Read Holding Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x83).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.3.4 Function Code 4, Read Input Registers
Read Input Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x04).
Starting Address
2 Bytes
The data address of the first Input Register to read.
Quantity of Input
Registers
2 Bytes
The total number of Input Registers requested, maximum of 125
per message.
Read Input Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x04).
Byte Count
1 Byte
The number of data bytes to follow.
Input Register
Values
2-250 Bytes
1 Input Register for every 2 bytes, maximum of 125 Input
Registers per message.
Read Input Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x84).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes

10
4.1.3.5 Function Code 5, Write Single Coil
Write Single Coil Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x05).
Coil Address
2 Bytes
The data address of the Coil to which to write.
Coil Value
2 Bytes
The value to write to the Coil (0xFF00 = On, 0x0000 = Off).
Write Single Coil Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x05).
Coil Address
2 Bytes
The data address of the Coil written.
Coil Value
2 Bytes
The value written to the Coil (0xFF00 = On, 0x0000 = Off).
Write Single Coil Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x85).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.3.6 Function Code 6, Write Single Holding Register
Write Single Holding Register Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x06).
Holding Register
Address
2 Bytes The data address of the Holding Register to which to write.
Holding Register
Value
2 Bytes The value to write to the Holding Register.
Write Single Holding Register Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x06).
Holding Register
Address
2 Bytes The data address of the Holding Register written.
Holding Register
Value
2 Bytes The value written to the Holding Register.
Write Single Holding Register Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x86).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes

11
4.1.3.7 Function Code 16, Write Multiple Holding Registers
Write Multiple Holding Registers Request PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x10).
Starting Address
2 Bytes
The data address of the first Holding Register to which to write.
Quantity of
Holding Registers
2 Bytes Number of Holding Registers to write.
Byte Count
1 Byte
The number of data bytes to follow.
Holding Register
Values
1-250 Bytes
2 bytes for every Holding Register, maximum of 125 Holding
Registers per message.
Write Multiple Holding Registers Response PDU
Name
Size
Description
Function Code
1 Byte
Function Code Identifier (0x10).
Starting Address
2 Bytes
The data address of the Holding Register written.
Quantity of
Holding Registers
2 Bytes Number of Holding Registers written.
Write Multiple Holding Registers Exception PDU
Name
Size
Description
Error Code
1 Byte
0x80 plus Function Code Identifier (0x90).
Exception Code
1 Byte
See 4.1.4 Modbus/TCP Exception Error Codes
4.1.4 Modbus/TCP Exception Error Codes
The Modbus/TCP feature supports the following Exception (Error) Codes:
Supported Exception Codes
Exception Code
Name
Description
0x01 Illegal Function
The function code received is not supported in the
controller.
0x02 Illegal Data Address
The data address received is not an allowable address within
the controller. This error will only be generated if the first
register requested is not valid for the function.
0x03 Illegal Data Value
A value contained in the query data field for a Write
command is not an allowable value for field. This error will
only be generated if the first register requested is not valid
for the function.
0x04 Slave Device Failure
An unrecoverable error occurred while the controller was
attempting to perform the requested action. This is a
general exception code indicating that the request was valid,
but the controller could provide a response.
When an exception occurs, the Response PDU contains a Function Code of 0x80 plus the original
hexadecimal Function Code.

12
4.2 TCP/IP Interface
The Modbus/TCP interface is attached to the TCP/IP stack that is implemented within the Walchem
controller. When the Modbus feature is Enabled, the controller will listen to all communications that
come in on the Modbus/TCP registered port 502. This port can be changed in the Remote
Communications Menu.
4.3 Data Refresh
To ensure continued connectivity, the Modbus/TCP client should not request data more frequently than
once every 5000 msec. Faster refresh rates are unsupported and may result in unexpected behavior.
4.4 Data Encoding
Modbus uses a ‘big-endian’ representation for addresses and data items. This means that within each
register, when a numerical quantity larger than a single byte is transmitted, the MOST significant byte is
sent first. The following topics describe the different types of encoding and show how the data is
encoded within the Modbus/TCP packet. Most client drivers will extract the data from the packet in the
correct format for use/display within the client environment.
4.4.1 Coils and Discrete Inputs
4.4.1.1 Boolean
Coils and Discrete Inputs can be used for digital input states, relay states, alarm states, and reset buttons
that are representable as a 1 or a 0. All binary data is packed from least significant bit to most significant
bit into a byte containing up to 8 Coils or Discrete Inputs. Bits not containing the value of a Coil or
Discrete Input are space holders and have a value of 0.
Byte Value
Coil 1
Coil 2
6 unused bits
0x02
(00000010)
0 1 000000
Reset buttons may also be packed as a 16-bit word when using the Write Single Coil function code.
(0xFF00 = On, 0x0000 = Off)
Word Value
Coil Value
Most Significant Byte
Least Significant Byte
0xFF00
(1111111100000000)
1
0xFF
(11111111)
0x00
(00000000)
4.4.2 Holding Register and Input Registers
4.4.2.1 16-Bit Word (Boolean)
Holding Registers and Input Registers can be used for digital input states, relay states, alarm states, and
reset buttons that are representable as a 1 or a 0. All binary data can be packed into a 16-Bit register,
with the least significant bit of the least significant byte being occupied by the 1-bit value. This is
functionally identical to a 16-bit integer.
Word Value
Bit Value
Most Significant Byte
Least Significant Byte
0x0001
(0000000000000001)
1
0x00
(00000000)
0x01
(00000001)

13
4.4.2.2 16-Bit Word (Bitfield)
Holding Registers and Input Registers can be used for Alarm Bitfields. An 8-Bit Alarm bitfield is packed
into the least significant byte of a 16-bit register. This is offered as a single-register alternative to
accessing alarm states individually. Bitfields can be decoded in section 5.5 Alarm Bitfields.
Word Value
Alarm Bitfield Value
Most Significant Byte
Least Significant Byte
0x00AA
(0000000010101010)
0xAA
0x00
(00000000)
0xAA
(10101010)
4.4.2.3 16-Bit Word (Status)
Holding Registers and Input Registers can be used for enumerated values such as status codes. An 8-Bit
status code is packed into the least significant byte of a 16-bit register. This is functionally identical to
the 16-bit integer. Status codes are defined in section 5.4 Status Register Codes.
Word Value
Alarm Bitfield Value
Most Significant Byte
Least Significant Byte
0x00AA
(0000000010101010)
0xAA
0x00
(00000000)
0xAA
(10101010)
4.4.2.4 16-Bit Word (Integer)
Holding Registers and Input Registers can be used for 16-bit integers containing HOA settings, and time
data that don’t require 32-bit integers. All 16-bit integers are unsigned.
Word Value
Most Significant Byte
Least Significant Byte
0x1234
0x12
0x34
4.4.2.5 32-Bit Value (Integer)
Holding Registers and Input Registers can be used for 32-bit integer data containing elapsed time values
and timestamps. The system clock register and all registers containing timestamps use the Unix Time
format, that counts the seconds passed since 12:00:00 am, January 1st, 1970. Registers are only 16 bits
wide; therefore, a request message must include 2 consecutive registers to read or write a 32-bit
integer. The 32-bit value is transmitted with the least significant word first, then the most significant
word. All 32-bit integers are unsigned.
Word Value
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Least Significant Word
Most Significant Word
0x12345678
0x56
0x78
0x12
0x34
4.4.2.6 32-Bit Value (Float)
Holding Registers and Input Registers can be used for 32-bit floating point data containing set points,
sensor readings, percentages, deadbands, etc. Registers are only 16 bits wide; therefore, a request
message must include 2 consecutive registers to read or write a 32-bit float. The 32-bit value is
transmitted with the least significant word first, then the most significant word.
Word Value
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Least Significant Word
Most Significant Word
0x12345678
0x56
0x78
0x12
0x34

14
4.4.2.7 32-Bit Inverse Data Format (Integer or Float)
32-bit integers and floats can use an inverse data format, where the contents of registers 1 and 2 are
switched. When inverse data format is selected, the 32-bit value is transmitted with the most significant
word first, then the least significant word. The data format setting can be modified in the Remote
Communications Settings Menu.
Word Value
Register 1
Register 2
Most Significant
Least Significant
Most Significant
Least Significant
Most Significant Word
Least Significant Word
0x12345678
0x12
0x34
0x56
0x78
5.0 DATA DICTIONARY
5.1 Addressing (0- or 1-Based)
The addressing within the Modbus/TCP protocol (that is, the data within the physical packet) is 0-based,
meaning the first element/item to be accessed is referenced by address 0. The Modbus standard for
handling and displaying data is 1-based, meaning the first element/data item to be accessed is
referenced by address 1.
For most client applications, users enter the 1-based number which is converted to 0-based addressing
at the protocol level. The addresses defined in the following address maps below are 1-based, as most
of the client applications work with this method. Register addresses for individual elements are derived
by adding the address offset in the appropriate Type-Specific Address Map to the starting address in the
I/O Channel Address Map below.
5.2 Address Maps
The address map is a function code-agnostic map that contains all data values that can be accessed as
Coils (0xxxx), Discrete Inputs (1xxxx), Holding Registers (4xxxx), and Input Registers (3xxxx).
The Address Map of the Modbus/TCP feature is modular; valid addresses are determined by the add-on
card configuration of the controller and the task being performed by each Input or Output. Each object
has a block of 36 addresses.
The Modbus/TCP feature allows all addresses to be accessed as registers. On the following address map
tables, values in BOLD can also be accessed as a Coil or Discrete Input.
As examples, to read the ‘Controller Firmware Version’ from the System Address Map (starting address
x0037) as an Input Register (FC4), the address indices 2 and 3 must be requested together: Addresses
30039 and 30040.
To read the ‘Low Alarm’ status for Sensor 2-1 in a W600 Controller as a Coil (FC1), the Sensor Input
Address Map indicates the starting address is x0865. Address index 28 must be requested: Address
00893. For the W900 Controller, the ‘Low Alarm’ status for Sensor 2-1 is x1729 + 28 = Address 01757.
To write the ‘Setpoint’ for Relay 3 (set to On/Off control mode) in the Relay On/Off Control Mode
Address Map (staring address x9001) as a Holding Register (FC6), the address indices 6 and 7 must be
used together: Addresses 49007 and 49008.

15
5.2.1 W600 Controller – I/O Channel Address Maps
The address ranges for each input/output channel in the W600 controller are as follows:
W600 Controller – I/O Channel Address Map
Object
Starting
Address
Ending
Address
Type-Specific Address Maps
System
x0037 x0072 See 5.3.1 System Address Map
Network
x0145
x0180
See 5.3.2 Network Address Map
Sensor Input 1-1
x0577 x0612
See 5.3.3 Sensor Input Address Maps
Sensor Input 1-2
x0613 x0648
Sensor Input 1-3
x0649 x0684
Sensor Input 2-1
x0865
x0900
Sensor Input 2-2
x0901
x0936
Sensor Input 2-3
x0937
x0972
Digital Input 1
x0289
x0324
See 5.3.4 Digital Input Address Maps
Digital Input 2
x0325 x0360
Digital Input 3
x0361 x0396
Digital Input 4
x0397
x0432
Digital Input 5
x0433 x0468
Digital Input 6
x0469 x0504
Virtual Input 1
x5761 x5796 See 5.3.5 Virtual Input Address Maps
Virtual Input 2
x5797
x5832
Relay Output 1
x8929
x8964
See 5.3.6 Relay Output Address Maps
Or
5.3.7 Pulse Relay Output Address Maps
Relay Output 2
x8965
x9000
Relay Output 3
x9001
x9036
Relay Output 4
x9037
x9072
Relay Output 5
x9073 x9108
Relay Output 6
x9109
x9144
Analog Output 1
x1153
x1188
See 5.3.8 Analog Output Address Maps
Analog Output 2
x1189 x1224

16
5.2.2 W900 Controller – I/O Channel Address Maps
The address ranges for each input/output channel in the W900 controller are as follows:
W900 Controller – I/O Channel Address Map
Object
Starting Address
Ending Address
Type-Specific Address Maps
System
x0037 x0072 See 5.3.1 System Address Map
Network
x0145 x0180 See 5.3.2 Network Address Map
Sensor Input 1-1
x1153 x1188
See 5.3.3 Sensor Input Address Maps
Note: When using P/N 191918 I/O card with
2 Analog Input + 4 Analog Output channels,
the two (4-20 mA) Sensor Inputs are mapped
from channels 1 and 2 into channels 5 and 6.
For example, if the card is installed in the third
I/O slot, the register address mapping is:
Analog Output 3-1: x2305 to x2340
Analog Output 3-2: x2341 to x2376
Analog Output 3-3: x2377 to x2412
Analog Output 3-4: x2413 to x2448
Sensor Input 3-1: x2449 to x2484
Sensor Input 3-2: x2485 to x2520
Sensor Input 1-2
x1189 x1224
Sensor Input 1-3
x1225 x1260
Sensor Input 1-4
x1261 x1296
Sensor Input 1-5
x1297
x1332
Sensor Input 1-6
x1333
x1368
Sensor Input 2-1
x1729
x1764
Sensor Input 2-2
x1765 x1800
Sensor Input 2-3
x1801
x1836
Sensor Input 2-4
x1837
x1872
Sensor Input 2-5
x1873 x1908
Sensor Input 2-6
x1909 x1944
Sensor Input 3-1
x2305 x2340
Sensor Input 3-2
x2341
x2376
Sensor Input 3-3
x2377
x2412
Sensor Input 3-4
x2413
x2448
Sensor Input 3-5
x2449
x2484
Sensor Input 3-6
x2485 x2520
Sensor Input 4-1
x2881 x2916
Sensor Input 4-2
x2917
x2952
Sensor Input 4-3
x2953 x2988
Sensor Input 4-4
x2989 x3024
Sensor Input 4-5
x3025 x3060
Sensor Input 4-6
x3061
x3096
Digital Input 1
x0577
x0612
See 5.3.4 Digital Input Address Maps
Digital Input 2
x0613
x0648
Digital Input 3
x0649
x0684
Digital Input 4
x0685 x0720
Digital Input 5
x0721 x0756
Digital Input 6
x0757
x0792
Digital Input 7
x0793 x0828
Digital Input 8
x0829 x0864
Digital Input 9
x0865 x0900
Digital Input 10
x0901
x0936
Digital Input 11
x0937
x0972
Digital Input 12
x0973
x1008

17
W900 Controller – I/O Channel Address Map
Object
Starting Address
Ending Address
Type-Specific Address Maps
Virtual Input 1
x5761
x5796
See 5.3.5 Virtual Input Address Maps
Virtual Input 2
x5797
x5832
Virtual Input 3
x5833
x5868
Virtual Input 4
x5869 x5904
Virtual Input 5
x5905 x5940
Virtual Input 6
x5941 x5976
Virtual Input 7
x5977 x6012
Virtual Input 8
x6013 x6048
Relay Output 1
x8929 x8964
See 5.3.6 Relay Output Address Maps
Or
5.3.7 Pulse Relay Output Address Maps
Relay Output 2
x8965
x9000
Relay Output 3
x9001
x9036
Relay Output 4
x9037
x9072
Relay Output 5
x9073 x9108
Relay Output 6
x9109
x9144
Relay Output 7
x9145 x9180
Relay Output 8
x9181 x9144
Analog Output 1-1
x1153 x1188
See 5.3.8 Analog Output Address Maps
Analog Output 1-2
x1189 x1224
Analog Output 1-3
x1225 x1260
Analog Output 1-4
x1261 x1296
Analog Output 2-1
x1729
x1764
Analog Output 2-2
x1765
x1800
Analog Output 2-3
x1801 x1836
Analog Output 2-4
x1837 x1872
Analog Output 3-1
x2305
x2340
Analog Output 3-2
x2341 x2376
Analog Output 3-3
x2377 x2412
Analog Output 3-4
x2413 x2448
Analog Output 4-1
x2881
x2916
Analog Output 4-2
x2917
x2952
Analog Output 4-3
x2953
x2988
Analog Output 4-4
x2989
x3024

18
5.2.3 Alternate Address Maps
The Alternate Address Maps provide a more efficient way to access similar data from different objects.
Using these address tables, the same field type is accessible using consecutive addresses. For example,
the primary values for all sensors installed in the controller can be accessed in a single Modbus FC4
request/response cycle starting at address 39217.
I/O Type Available Objects Type-Specific Alternate Address Map
Sensor Inputs
Primary Value
Status
Alarm Bitfield
Low, High Alarms
LoLo, HiHi Alarms
Calibration Required
See 5.3.9.1 Alternate Sensor Input / Temperature Input /
Analog Input Address Map
Digital Inputs
DI State
Interlock State
Total Time
Flowrate
Flow Total
Alarm Bitfield
Low, High Alarms
See 5.3.9.2 Alternate Digital Input Address Map
Virtual Inputs
Primary Value
Status
Alarm Bitfield
See 5.3.9.3 Alternate Virtual Input Address Map
Relay Outputs
Relay State
Pulse Output
Time On
Status
Alarm Bitfield
See 5.3.9.4 Alternate Relay Output Address Map
Analog Outputs
Analog Output
Time On
Status
Alarm Bitfield
See 5.3.9.5 Alternate Analog Output Address Map
Note that changing I/O card locations can affect the address used to access individual objects. For
example, if a W900 is configured with a Dual SI card in slot 1 and a Dual AI card in slot 3, the alternate
address mappings for the primary values are different if a Single SI card is inserted into slot 2:
Scenario #1: I/O Slot 2 Not Populated
Scenario #2: I/O Slot 2 Populated
Channel
Address
Alternate
Address
Channel
Address
Alternate
Address
I/O Slot 1: Dual Sensor Input Card
I/O Slot 1: Dual Sensor Input Card
Sensor Input 1-1
x1153
Sensor 1
x9217
Sensor Input 1-1
x1153
Sensor 1
x9217
Sensor Input 1-2
x1189
Sensor 2
x9219
Sensor Input 1-2
x1189
Sensor 2
x9219
Sensor Input 1-3
x1225
Sensor 3
x9221
Sensor Input 1-3
x1225
Sensor 3
x9221
Sensor Input 1-4
x1261
Sensor 4
x9223
Sensor Input 1-4
x1261
Sensor 4
x9223
I/O Slot 2: Not Populated
I/O Slot 2: Single Sensor Input Card
Sensor Input 2-1
x1729
Sensor 5
x9225
Sensor Input 2-2
x1765
Sensor 6
x9227
I/O Slot 3: Dual Analog Input Card
I/O Slot 3: Dual Analog Input Card
Sensor Input 3-1
x2305
Sensor 5
x9225
Sensor Input 3-1
x2305
Sensor 7
x9229
Sensor Input 3-2
x2341
Sensor 6
x9227
Sensor Input 3-2
x2341
Sensor 8
x9231

19
5.3 Type-Specific Address Maps
5.3.1 System Address Map
System Address Map
Address
Name
Data Encoding
Permissions
Value
0
Controller Time 32-Bit Integer Read Unix Time
1
2
Controller Firmware
Version
32-Bit Float Read
3
4
Date of Last Data Log 32-Bit Integer Read Unix Time
5
6
Controller Processor
Temperature
32-Bit Float Read °C
7
8
Network Card
Temperature
32-Bit Float Read °C
9
10
Digital Input Card
Temperature (W900 Only)
32-Bit Float Read °C
11
12
I/O Card 1 Temperature 32-Bit Float Read °C
13
14
I/O Card 2 Temperature 32-Bit Float Read °C
15
16
I/O Card 3 Temperature
(W900 Only)
32-Bit Float Read °C
17
18
I/O Card 4 Temperature
(W900 Only)
32-Bit Float Read °C
19
20
21
22
23
24
25
26
Battery Power 32-Bit Float Read Volt
27
28
+3.3 V Supply 32-Bit Float Read Volt
29
30
+5 V Supply 32-Bit Float Read Volt
31
32
+12 V Supply
(W900 Only)
32-Bit Float Read Volt
33
34
35
Alarm Bitfield
16-Bit Bitfield
Read
See 5.5.1 System Alarm Bitfield

20
5.3.2 Network Address Map
Network Address Map
Address Name
Data
Encoding
Permissions Value
0
VTouch Last Data Time 32-Bit Integer Read Unix Time
1
2
VTouch Last
Configuration Time
32-Bit Integer Read Unix Time
3
4
VTouch Refresh Rate 32-Bit Float Read/Write 1 – 1440 Minutes
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
Alarm Bitfield
16-Bit Bitfield
Read
See 5.5.2 Network Alarm Bitfield