MODBUS-RTU applied

to DIXELL devices.
 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

1. COMMANDS DESCRIPTION
1.1 READ HOLDING REGISTERS (0X03):
The command has the following format:

Slave Function Register Register Number Number CRC CRC

Address Code Address Address of of (LSByte) (MSByte)
(MSByte) (LSByte) Registers Registers
(MSByte) (LSByte)

Slave Address: Defined the device address that received the answer of reading data.

Function Code: code of the desired function = 0x03

Register address: is the address of the first register to be read

Number of Registers: Defines the number of Elements (Register) that the device has to return (es. 3 =
3 Registers). No more than 5 Elements allowed.

CRC : Defined the CRC calculated for the frame data received and has to be used to verify the integrity
of data received. It is calculated

The answer message has the following format:

Slave Function NumByte Byte Data 1 Byte Data n CRC CRC

address code (LSByte) (MSByte)

NumByte: Defined the number of bytes followed without CRC.

ByteData: byte data buffer.

ModBUS Communication Protocol v2_5 GB.doc Page 2 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

1.2 WRITE SINGLE REGISTERS (0X06):

This command is not available for all instruments.

The command has the following format:

Slave Function Register Register DATA DATA CRC CRC

Address Code Address Address (MSByte) (LSByte) (LSByte) (MSByte)
(MSByte) (LSByte)

Slave Address: Defined the device address that received the answer of reading data.

Function Code: code of the desired function = 0x06

Register address: is the address of the register to write to

Data: is the data to write

CRC : Defined the CRC calculated for the frame data received and has to be used to verify the integrity
of data received. It is calculated

The answer message is an Eco of the command you sent (it has the same format)

ModBUS Communication Protocol v2_5 GB.doc Page 3 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

1.3 WRITE HOLDING REGISTER (0X10):

The command has the following format:

Slave Function Register Register Number Number NumByte DATA CRC CRC
address Code Address Address of of (LSByte) (MSByte)
(MSByte) (LSByte) Registers Registers
(MSByte) (LSByte)

Slave Address: Defined the device address that received the answer of writing data.

Function Code: code of the desired function = 0x10

Register address: is the address of the first register to write to

Number of Registers. : Defines the number of registers to write to. No more than 5 Elements allowed.

NumByte: Defined the number of bytes followed without CRC. The number of bytes has to be double
respect the number of addressed Elements (NumByte = 2*Nreg).

CRC:
Defined the CRC calculated for the frame data received and has to be used to verify the integrity of data
received.

The answer has the following format:

Slave Function Register Register Number of Number of CRC CRC

Address code Address Address Registers Registers (LSByte) (MSByte)
(MSByte) (LSByte) (MSByte) (LSByte)

ModBUS Communication Protocol v2_5 GB.doc Page 4 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

√ Serial configuration for DIXELL controllers

Physical layer = RS485 (RS232 for XJ500 system)

Baud Rate = 9600 bps (19200 bps for XJ500 system)
Data Length = 8 bit
Parity = None
Stop Bit = 1
START/STOP = silent interval of 3 characters
MIN TIME BETWEEN TWO RETRY = 500 msec

XJ500 system, when linking by means of RS232 port and ModBUS protocol, RTS and DTR signals have to be kept
at logical level LOW.

√ Slave addresses:
This field range is 1-247. Address 0 is used for the broadcast address. In this case the slave execute the command
( only Write Holding Register command) but doesn’t return some response

√ Exceptions code:
Dixell’s devices answers with exception codes when they are not able to execute the last command received. The
exception configuration is:

1. Not implemented function (0x01)

In this case is requested a function that device is not able to support. Es: every time master sends a function
different from ‘0x03’ or ‘0x10’

2. Not implemented area (0x02)

In this case is requested a resource absent in the device. Es: every time is requested a Logic Area absent.

3. Area index not valid (0x03)

In this case the value of the selected resource is out of range. Example:
• Every time is requested an Element of a Logic Area absent.
• More than 5 Elements requested.
• Writing a parameter out of range
• Writing in a Logic Area just reading.

4. Read/Write error (0x04)

The device didn’t succeeded in reading or writing requested operation. Es: every time reading or writing operation
(Ram, E2, RTC and etc) is not ending correctly.

5. Busy state for slave active (0x06)

The device can’t execute requested operation because busy in another analogue operation. Master has to repeat
the same request in another time.

The exception answer has the following format:

Slave Function code OR hex(80) Exception code CRC CRC

address (LSByte) (MSByte)

ModBUS Communication Protocol v2_5 GB.doc Page 5 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

1.4 THE CRC:

The CRC value is calculated (on the entire message) by the transmitting device, which appends the CRC to the
message. The receiving device recalculates a CRC during receipt of the message and compares the calculated
value to the actual value it received in the CRC field. If the two values are not equal, an error results.
Here there is the code (in C format) to generate CRC.

#define MODBUS_GENERATOR 0xA001

Unsigned int CRC;
void ModbusCalcCRC(unsigned char* Frame,unsigned char LenFrame)
{
unsigned char CntByte;
unsigned char j;
unsigned char bitVal;
CRC = 0xFFFF;

For(CntByte=0;CntByte<LenFrame;CntByte++)
{
CRC ^= Frame[CntByte];
for(j=0;j<8;j++)
{
bitVal = CRC & 0x0001;
CRC = CRC >> 1;
if(bitVal == 1)
CRC ^= MODBUS_GENERATOR;
}
}
}

√ NOTE:
To uniform interpretation mode of data, all data areas will have the following format:

WORD (single data register)

MSByte LSByte
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0 Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

ModBUS Communication Protocol v2_5 GB.doc Page 6 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

2. REGISTRY ADDRESSES
In this section are reported the registry addresses to consider when acting directly with the controllers (If the device
is connected to an XJ500 this last have to be set in “Transparent Mode”, see next page).
Device’s address represent the “Slave address” to be set in the command structure while the “number of registers”
is always 1 (see command description).

IDENTIFICATION (read only)

REGISTER DESCRIPTION SIZE (register) NOTE
0 • Family code 1 MSByte: family code
• Release firmware LSByte: release firmware
1 • Device Code (MSWord) 1 See below
2 • Device Code (LSWord) 1 See below
3 •
4 •
5 • release firmware date 1 Day = bit15 / bit11
Month = bit10 / bit7
Year = bit6 / bit0
6 • EEPROM configuration 1
7 • Probe presence 1 if bit0=1, the probe 1 is present
if bit1=1, the probe 2 is present

DEVICE CODE EXAMPLE: ‘X R120C’ ….

Device Code (MSWord - MSByte) ASCII code char “R”
Device Code (MSWord - LSByte) ASCII code char “ ” (blank)
Device Code (LSWord) :

15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
Integer value “120” – [range (0-999) (1000 is null value)] (ASCII code char “C”) -hex(20)

ANALOGUE INPUTS (read only)

Register DESCRIPTION SIZE (register) NOTES
256 • Probe 1 (I°) 1 Probe value 1
257 • Probe 1 (II°) 1 Information about probe 1 (table 1)
258 • Probe 2 (I°) 1 Probe value 2
259 • Probe 2 (II°) 1 Information about probe 2 (table 1)
260 • Probe 3 (I°) 1 Probe value 3
261 • Probe 3 (II°) 1 Information about probe 3 (table 1)

table 1: Probe status

Byte Description
Byte (H) Measuring unit:
Bit0-1-2-3 0=NC,1=°C,2=°F,3=RH%,4=PSI,5=BAR,6=Rpm,7=mA,8=A,9=mV,10=V
11,12,13,14,15=not assigned.
Byte (H) bit 4 Probe resolution (1) decimal (0) integer
Byte (H) bit 5-6-7
Byte (L) bit 0 Low alarm active (1) Probe error (1-1)
Byte (L) bit 1 High alarm active (1)
Byte (L) bit 2-3-4-5-
6-7

USER PARAMETERS (Read/Write)

Register DESCRIPTION SIZE (register) NOTES
768 • first parameter value 1 For meaning, limits and range see the device
specifications
769 • second parameter value 1 For meaning, limits and range see the device
specifications
770 • third parameter value 1 For meaning, limits and range see the device
specifications
•
N • nth parameter value 1 For meaning, limits and range see the device
specifications
NOTE: Parameter list meaning depends on the instrument .

ModBUS Communication Protocol v2_5 GB.doc Page 7 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

In order to enable a function (device ON.OFF, defrost, etc..), you have to set the relevant bit of the MSByte to 1
(enable) or to 0 (disable). The writing of the status bit is allowed only when the relative bit of the LSByte is set to 1.

DEVICE STATUS (read-write)

Register DESCRIPTION SIZE NOTE
(Register)
1280 • slave status (I°) 1 The high bite states the operating status of the
device (when reading High byte and Low byte have
the same value. When writing low byte states which
status elements have to be written). See table 2
1281 • slave status (II°) 1 As above but the meaning of High byte is different…
1282 • slave status (III°) 1 As above but the meaning of High byte is different…

Register 1280 Device status

MSByte STATUS LSByte ENABLE MODIFY
Bit0 Device ON (1) OFF (0) bit0
Bit1 Defrost active (1). bit1
Bit2 Fast freezing active (1). bit2
Bit3 Keyboard lock (1). bit3
Bit4 Reset alarms (1) bit4
Bit5 bit5
Bit6 Energy Saving active (1) bit6
Bit7 Digital input status active (1) bit7

Register 1281 Device functions

MSByte STATUS LSByte ENABLE MODIFY
Bit0 On (1) / Off (0) acquisition (XJ500) bit0
Bit1 On (1) / Off (0) recording (XJ500) bit1
Bit2 Transparent mode ModBUS (1)(XJ500) bit2
Bit3 Bit3
Bit4 main menu (1) (XJ500) bit4
Bit5 “Holiday” Function (1) Bit5
Bit6 AUX Function (1) Bit6
Bit7 LIGHT Function (1) Bit7

Register 1282 Device functions

MSByte STATUS LSByte ENABLE MODIFY
Bit0 Device reset (1) bit0
Bit1 bit1
Bit2 bit2
bit3 bit3
bit4 bit4
bit5 bit5
bit6 bit6
bit7 bit7

XJ500 TRANSPARENT modes:

• When the XJ500 TRANSPARENT mode is activated, it links the device that is connected to the RS232
serial port to one of the controllers connected to the RS485 (these are not necessarily present in the XJ500
set-up.
• the transparency of a 232-MODBUS and a 485-MODBUS network is complete; rather, each ModBUS
command that the master sends to the RS232 serial port of the XJ is repeated to the SLAVE connected to
the RS485 output for the reply.
• The transparency of a 232-MODBUS and 485-DIXBUS network is partial; rather, it’s only valid for areas 3-
4-5 and for physical commands. Further information can be obtained through areas 50 and 51.
• The baud-rate for the RS232 serial port is 19200bps, while that of the RS485 serial port is 9600bps.
• If the acquisitions are active when the master sends a transparent start command, the XJ500 stops RS485
transmission for 10 seconds; when these 10 seconds are over, it exits transparency for time-out. Time-out
time is updated at each command it receives. Read the XJ500 status to be sure that the transparent mode
is activated.
• if the acquisitions are active when the master sends a transparency command, the XJ500 will not change
its status until it receives a transparency exit command or the acquisitions are activated.

ModBUS Communication Protocol v2_5 GB.doc Page 8 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

RELAY OUTPUTS STATUS (read)

Register DESCRIPTION SIZE NOTE
(Register)
The high bite states the operating status of
2048 • relay outputs status (I°) 1
the device. See table 3
As above but the meaning of High byte is
2049 • relay outputs status (II°) 1
different…
As above but the meaning of High byte is
2050 • relay outputs status (III°) 1
different…
As above but the meaning of High byte is
2051 • relay outputs status (III°) 1
different…

TABLE 3 : RELAY OUTPUTS

Register 2048 DEVICE OUTPUT RELAY I°
MSByte RELAY STATUS LSByte ENABLE MODIFY
bit0 On/Off relay bit0
bit1 Defrost 1 relay bit1
bit2 Defrost 2 relay bit2
bit3 Alarm relay bit3
bit4 Light relay bit4
bit5 Fan relay bit5
bit6 AUX1 relay bit6
bit7 AUX2 relay bit7

Register 2049 DEVICE OUTPUT RELAY II°

MSByte RELAY STATUS LSByte ENABLE MODIFY
Bit0 Load relay 1 bit0
Bit1 Load relay 2 bit1
Bit2 Load relay 3 bit2
Bit3 Load relay 4 bit3
Bit4 Load relay 5 bit4
Bit5 Load relay 6 bit5
Bit6 Relay out 1 (Generic) bit6
Bit7 Relay out 2 (Generic) bit7

Register 2050 DEVICE OUTPUT RELAY III°

MSByte RELAY STATUS LSByte ENABLE MODIFY
bit0 Load relay 7 bit0
bit1 Load relay 8 bit1
bit2 Load relay 9 bit2
bit3 Load relay 10 bit3
bit4 Load relay 11 bit4
bit5 bit5
bit6 bit6
bit7 bit7

XF series: Bit 6, register 2048, is the steam generator

XF series: Bit 7, register 2048, is the steam injector
XF series: Bit 6, register 2049, is the steam extractor

EAL TIME CLOCK (read-write)

Register DESCRIPTION SIZE NOTE
(Register)
2816 • Seconds / Minutes 1 MSByte = seconds LSByte = minutes
2817 • Hours / Day of week 1 MSByte = hours LSByte = day of week
(1-sun 7-sat)
2818 • Day / Month 1 MSByte = day LSByte = month
2819 • Year 1 Year

ModBUS Communication Protocol v2_5 GB.doc Page 9 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

ALARMS STATUS (read)

Register DESCRIPTION SIZE NOTE
(Register)
3328 • Alarms (I°) 1
Each bit states an alarm (see table 4)
3329 • Alarms (II°) 1
Each bit states an alarm (see table 4)

TABLE 4 : ALARMS
Register 3328 ALARMS LIST I°
MSByte LSByte
bit0 Load 9 alarm bit0 Load 1 alarm
Bit1 Load 10 alarm bit1 Load 2 alarm
bit2 Load 11 alarm bit2 Load 3 alarm
bit3 Door open or liquid level alarm bit3 Load 4 alarm
bit4 Generic Digital input alarm bit4 Load 5 alarm
bit5 Real Time clock alarm bit5 Load 6 alarm
bit6 Bit6 Load 7 alarm
bit7 Bit7 Load 8 alarm

Register 3329 ALARMS LIST II°

MSByte LSByte
Bit0 No link Alarm Bit0 ACQ general alarm (XJ500)
bit1 High pressure bit1 ACQ serious alarm (XJ500)
Bit2 Low Pressure bit2 REC alarm (XJ500)
bit3 bit3 REC serious alarm (XJ500)
bit4 bit4 Printer alarm (XJ500)
bit5 bit5 Printer serious alarm (XJ500)
bit6 bit6 Fax/Modem alarm (XJ500)
bit7 bit7 Fax/Modem serious alarm (XJ500)

The following section state the registry addresses to consider when reading information about controllers
connected to an XJ500.
XJ500 System ID represent the “Slave address” to be set in the command structure. The registry address is 12800
+ Adr parameter of the instrument you want to read. The “number of register” to read will give you back information
desired following the table below:
EXAMPLE: we want to read the device label of a controller (with address 5) connected to an XJ500 (whose “System
ID” is 0002). The structure of the reading command will be the following (please reefer to page 2):

Slave Function Register Address Number of Registers CRC

Address Code
02 03 12805 3 Automatically calculated

XJ500 NETWORK SETUP DEVICE (read address 12800+Adr)

Register DESCRIPTION SIZE NOTE
(register)
LSByte – relative
1 • Index 8
MSByte – absolute
LSByte – family code
2 • Code
MSByte – mask code
3 • Device label (I°)
4 • Device label (II°)
5 • General info See table 5
6 • Real configuration (I°)
7 • Real configuration (II°)
LSByte: probes present
8 • Probes presence
MSByte: probes enable to recording

ModBUS Communication Protocol v2_5 GB.doc Page 10 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

TABLE 5 : SETUP FOR XJ500 DEVICE NETWORK

Register General Info SETUP
MSByte LSByte
bit0 Save status Bit0-3 Measurement unit
0=NC,1=°C,2=°F,3=RH%,4=PSI,5=BAR
,6=Rpm,7=mA,8=A,9=mV,10=V
Bit1 Save alarm
bit2 Synchronise clock enable
bit3 Device enable
bit4 bit4
bit5 bit5
bit6 Bit6 Automatic print enable
bit7 Bit7

The following section state the registry addresses to consider when reading information about controllers
connected to an XJ500.
XJ500 System ID represent the “Slave address” to be set in the command structure. The registry address is 13056
+ Adr parameter of the instrument you want to read. The “number of register” to read will give you back information
desired following the table below:
EXAMPLE: we want to read probe 2 value of a controller (with address 12) connected to an XJ500 (whose “System
ID” is 0001). The structure of the reading command will be the following (please reefer to page 2):

Slave Function Register Address Number of Registers CRC

Address Code
01 03 13068 2 Automatically calculated

XJ 500 NETWORK RUN-TIME DEVICE INFORMATION (read address 13056+Adr)

Register DESCRIPTION SIZE NOTE
(Register)
1 • Probe 1 value 1
2 • Probe 2 value 1
3 • Probe 3 value 1
4 • Set Point 1
5 • Probe Status 1 LSByte: Probe 1 (*)
MSByte: Probe 2 (*)
6 • Probe Status 1 LSByte: Probe 3 (*)
MSByte: SET (*)
7 • Alarms (I°) 1
8 • Alarms (II°) 1 See table 6
9 • Status (I°) 1 See table 6
10 • Status (II°) 1 See table 6

(*) for each status byte, if bit 6=1 the probe resolution is decimal

TABLE 6 : ALARMS FOR XJ500 DEVICE NETWORK

Register Alarms (I°) ALARMS

MSByte LSByte
bit0 Load 9 alarm Bit0 Load 1 alarm
bit1 Load 10 alarm Bit1 Load 2 alarm
Bit2 Load 11 alarm Bit2 Load 3 alarm
bit3 Bit3 Load 4 alarm
bit4 bit4 Load 5 alarm
bit5 bit5 Load 6 alarm
bit6 bit6 Load 7 alarm
bit7 bit7 Load 8 alarm

ModBUS Communication Protocol v2_5 GB.doc Page 11 / 12

 

0RG%86578&RPPXQLFDWLRQSURWRFRO rel. 2.5

Register Alarms (II°) ALARMS

MSByte LSByte
bit0 bit0
Probe 1: 1-LA 2-HA 3-PF
Bit1 bit1
bit2 Digital Input alarm bit2
Probe 2: 1-LA 2-HA 3-PF
bit3 Digital Input alarm bit3
bit4 Real Time clock alarm bit4
Probe 3: 1-LA 2-HA 3-PF
bit5 bit5
bit6 Bit6
bit7 No Link alarm Bit7

Register Status (I°) STATUS

MSByte LSByte
bit0 Bit0 Load 7 Active
bit1 Bit1 Load 8 Active
Bit2 Bit2 Load 9 Active
bit3 Bit3 Digital input (status) active (XJA
controller)
bit4 Bit4
bit5 Bit5
bit6 Bit6
bit7 Bit7

Register Status (II°) STATUS

MSByte LSByte
bit0 Defrost 1 output active bit0 Device ON/OFF
Bit1 Defrost 2 output active Bit1 Defrost active
bit2 Load 1 output active Bit2 Fast freezing active
bit3 Load 2 output active Bit3 Energy Saving active
bit4 Load 3 output active Bit4 Alarm output active
bit5 Load 4 output active bit5 AUX output 1 active
bit6 Load 5 output active Bit6 AUX output 2 active
bit7 Load 6 output active Bit7 Fan output active

ModBUS Communication Protocol v2_5 GB.doc Page 12 / 12