MAC SENSOR DOUBLE OUTPUT SIGNAL

MODBUS PRESSURE LEVEL TRANSMITTER

COMMUNICATION PROTOCOL

I. Summary:
This protocol shall comply with the MODBUS communication protocol,
using the MODBUS protocol subset of RTU mode. RS485 half-duplex works.

II. Serial data format:

Serial Port Settings :No check ,8 bits of data,one stop bit.
For example: 9600,N,8,1, meaning 9600bps, no check, 8 bits data, one
stop bit.
The transmitter supports serial port baud rate are :
1200,2400,4800,9600,19200,38400,57600,115200
CRC check polynomial: 0xA001.

Data communication process are all handled in accordance with the

double-byte integer data, if the data identifies the float, write needs to
read the decimal point to determine the size of the data.

III. Communication formats

1. Read command format (03 function code) ,

For Example reading pressure (id 01 is pressure and 02 is for temperature)
A. Send command of read format:
Date Date Data Data
Function CRC16 CRC16
Address starting starting number number
code (L) (H)
(H) (L) (H) (L)
0X01 0X03 0X00 0X00 0X00 0X01 0X84 0X0A
B. Return to read data format:
For example
Function Data Date Date CRC16 CRC16
Address
Code length (H) (L) (L) (H)
0X01 0X03 0X02 0X00 0X01 0X79 0X84

For Example reading temperature (ID: 01 is pressure and 02 is for

temperature)
A. Send command of read Sensor ID format:
Date Date Data Data
Function CRC16 CRC16
Address starting starting number number
code (L) (H)
(H) (L) (H) (L)
0X02 0X03 0X00 0X00 0X00 0X01 0X84 0X39

B. Return to read data format:

For example
Function Data Date Date CRC16 CRC16
Address
Code length (H) (L) (L) (H)
0X02 0X03 0X02 0X00 0X02 0X7D 0X85

For example 2: (ID: 01 is pressure and 02 is for temperature)

A. Send command of read Sensor Pressure Data format:
Date Date Data Data
Function CRC16 CRC16
Address starting starting number number
code (L) (H)
(H) (L) (H) (L)
0X01 0X03 0X00 0X04 0X00 0X01 0XC5 0XCB

B. Return to read data format:

For example
Address Function Data Date Date CRC16 CRC16
 Code length (H) (L) (L) (H)
0X01 0X03 0X02 0X00 0X00 0XB8 0X44
this return data is mean pressure data is 0.
For example 3: (ID: 01 is pressure and 02 is for temperature)
A. Send command of read Sensor Temperature Data format:
Date Date Data Data
Function CRC16 CRC16
Address starting starting number number
code (L) (H)
(H) (L) (H) (L)
0X02 0X03 0X00 0X04 0X00 0X01 0XC5 0XF8

B. Return to read data format:

For example
Function Data Date Date CRC16 CRC16
Address
Code length (H) (L) (L) (H)
0X02 0X03 0X02 0X01 0X1F 0XBC 0X1C
this return data is mean Temperature data is 011F, which is mean 287.
And then use 03 function code to reading out the Decimal point:
A: 020300030001 (green code is Data starting address 0003 for Decimal point)
B: 02030200013D84 (red return code 0001 is mean Decimal point is 1)
So from above reading ID 02 temperature data, we can see temp data is 287 and Decimal point is 1,
which is mean last temperature output data is 28.7, then you can use Data starting address 0002 for
reading unit:

A: 020300020001 (green code is Data starting address 0002 for Unit)

B: 02030000FC44 (red return code 0000 is mean unit is ℃)

Then we get ID 02 temperature output is 28.7℃

2. Write command format (06 function code),

A. For example
Date
Function Date Date CRC16 CRC16
Address starting Date (H)
Code starting (L) (L) (L) (H)
(H)
0X01 0X06 0X00 0X00 0X00 0X02 0X08 0X0B

B. Returns read data format:

For example
Date
Function Date Dates Dates CRC16 CRC16
Address starting
Code starting (L) (H) (L) (L) (H)
(H)
0X01 0X06 0X00 0X00 0X00 0X02 0X08 0X0B

3. Abnormal responses being returned

Function CRC16 CRC16

Address Abnormal code
Code (L) (H)
0x01(Illegal function)
0X80 +
0X01 0x02(Illegal data address)
function code
0x03(Illegal data)

IV. Support commands and commands and data meaning

MODBUS-RTU Protocol command list as follows:

Data
Functio Date Dates Dates
starting Instruction meaning
n code number byte range/span
address
0x03 Function code to read data
0x03 0x0000 1 2 1-255 Read the slave address
0x03 0x0001 1 2 0- 1200
1- 2400
2- 4800
3- 9600
Read the baud rate
4- 19200
5- 38400
6- 57600
7- 115200
0x03 0x0003 1 2 0- ####
1- ###.# Decimal point respectively 0 to 3
2- ##.## decimal point
3- #.###
0x03 0x0002 1 2 0- Mpa（℃）
Pressure (temperature) units
1- Kpa
 2- Pa
3- Bar
4- mbar
5- kg/cm2
6- psi
7- mH2O
8- mmH2O
0x03 0x0004 1 2 -32768-3276
Measured output value
7
0x03 0x0005 1 2 -32768-3276 zero point of
7 pressure/level transmitter
0x03 0x0006 1 2 -32768-3276 Full scale of pressure/level
7 transmitter
0x03 0x000c 1 2 -32768-3276 Zero offset value, the factory
7 original define is 0
0x06 Write data function code
0x06 0x0000 2 1-255 Rewrite the address of salve
0x06 0x0001 2 0- 1200
1- 2400
2- 4800
3- 9600
Revise baud rate
4- 19200
5- 38400
6- 57600
7- 115200
0x06 0x000c 2 -32768-3276 Zero offset value.
7 Pressure output value= Calibration
measurements value + zero offset
value
Save and restore the factory setting
0x06 0x000F 2 0- Save to
user area
1- Save to
factory area

0X06 0x0010 2 1- Return to

the factory
parameter
Instruction:
1. Modify the baud rate when the transmitter can transmit to host the baud rate of reply to modify
the data and reply after transmitter baud rate will be modified in the target.
2. Modify the address is to modify the address before the response data, automatically modify
transmitter address after a reply.
3. Save the original value of the command will return and reply factory, said transmitter has
accepted the host command.
4. Restore factory data on May factory save parameters and the inconsistency of the user to save, so
which address, baud rate and the calibration data may be inconsistent, so after recovery plant
parameters have to search the transmitter.
5. The user allowed to change data is only three, respectively is address, address, baud rate, zero
offset value.
6. The average user is not allowed to modify the transducer calibration data, such as calibration and
changes, please ask for a transducer calibration software with your company. Users to send
commands to modify the calibration data can lead to abnormal transmitter output command code.
If you need to modify the calibration data, please use our company's calibration software.
7. If you need to read the data when the floating point number identification, such as 6.000, but the
provisions of this agreement the data are in plastic to communication, so that the data read is 6000,
and then according to the position of the decimal point to do operation, get 6.000, such as decimal
point is 3, it is 6000/10 (3), is 6000 divided by the third power of 10, 6.000 the data.
8. A detailed validation, please refer to our company to provide customer evaluation software.

The Factory Calibration Data Read And Save The Agreement

The factory calibration data read and write using the custom function code. This is generally
not made public.
Factory adopted the standard MODBUS protocol of write operation outside of the command to
do this, if it is a PLC, please check whether the PLC configuration software to support this function
code.
Factory data save the password protection, so before writing the data or save the data, please
write within the special offset specific password to complete the factory data save and modify.

Transmitter internal variables and the offset address list:

Offset ID Variable Data Meaning Remarks
0 DISL Show the low limit of Sensor Range Low Range Of Sensor
1 DISH Show the high limit of Sensor Range High Range Of Sensor
The factory calibration of the nonlinear
3 LINE The nonlinear correction data
error correction data
4 SN Internal circuit magnification meaningless
5 ADL The ADC values collected sensor's zero When the calibration data collected
6 ADH The ADC values collected sensor's span (calibration data)
 7 CLEAR The main variable offset value The main variable offset value
The greater value of the filter
8 Filt The main variable filter coefficients
coefficients, data more stability
This is the real time circuit board ADC
9 ADC The main ADC output value in real time
collection value
10 ID Circuit board ID Circuit board ID
11 GAIN The main variable gain coefficient This is the last add gain coefficient
Do not do anything to rewrite this value,
or transmitter internal data will be
12 VIF Internal variables calibration value
initialized again. it's said transducer
calibration data will be lost.

The factory calibration protocol:

Factory calibration protocol and source HM29 compatibility, data formats and calibration is
consistent, but used the custom function code and special address password function.
Read operation function code: 0 x47
Read operations without password protection, so can be read at random, in order to prevent
a memory leak, restricted the transmitter software reads the offset address range. Limit within 16.

Write functional code: 0 x48

Write the same limits the address range. Write no password restrictions, but the final factory
data save password restrictions, if the password is wrong, this data will not be saved to the
electricity storage.

Factory data write and read:

Normal writing data command: address is 1, offset 0
For example:
Send the command: 01 48 00 00 00 00 E1 C4
Return to command: 01 48 00 00 00 00 E1 C4

Normal read data command: address 1, offset 0

Send the command: 01 47 00 00 01 74 05
Return to command: 01 47 02 00 00 AC B4

The users area data preservation commands (write command) : address 1, offset address 0xFFFE,
Data 0x0000
Send the command: 01 06 FF FE 00 00 D8 2E
Return to command: 01 06 FF FE 00 00 D8 2E

Factory data restore command (write command) : address 1, offset 0xFFFD, data 0x0001
Send the command: 01 06 FF FD 00 01 E9 EE
Return the data: 01 06 FF FD 00 01 E9 EE
 Customers don't need to know the factory calibration save the password, because save data in
the user area is the same as save the data use factory password, the increase of gain coefficient will
be preserved by the user to save instructions on the user's electricity storage area, after the user to
change gain coefficient to send the user to save the order, this data will still be saved. Electricity is
still will be read and used at a time.
Factory figures released by the customer in accordance with the agreement to modify the
data read and write, and then according to the user's password can complete the modify and save
of data.