7390697uk 3106

Device manual
CAN GSM quad-band modem

for CANopen networks UK
(with/without GPS receiver)
CR3105
CR3106
09 / 2009
7390697 / 00
Device manual CR3105/CR3106
Inhalt
1 Preliminary note�� 4
1.1 Symbols used�� 4
1.2 Further documentation �� 4
2 Safety instructions�� 5
2.1 General�� 5
2.2 Air traffic �� 5
2.3 Explosives�� 5
2.4 Electronic equipment�� 5
2.5 Antenna(s)�� 5
2.6 Loss/theft of the SIM card or the radio modem�� 5
3 Functions and features �� 6
3.1 Application overview�� 6
4 Installation�� 7
5 Electrical connection�� 8
5.1 Operating voltage and CAN interface�� 8
5.2 Serial interface �� 8
5.3 Antenna(s)�� 9
6 Operating and display elements �� 10
6.1 LEDs�� 10
7 Set-up ��11
7.1 SIM card ��11
7.2 Opening the lid ��11
7.3 Insertion of the SIM card��11
7.4 Removal of the SIM card�� 12
8 Operating modes and programming �� 13
8.1 Without control program �� 13
8.1.1 Operation with "CAN to SMS" or "SMS to CAN" function�� 13
8.1.2 Basic software�� 13
8.2 With control program CoDeSys 2.3�� 13
8.2.1 Electronic Data Sheet�� 13
8.2.2 Library ifm_CANCOM_Vxxxxxx �� 14
8.2.3 Function TELEDATA_SMS�� 15
8.2.4 Function TELEDATA_DATA_TO_SMS�� 17
8.2.5 Function TELEDATA_DIRECT�� 18
8.2.6 Function TELEDATA_GET_GPS_DATA�� 20
8.2.7 SMS data format�� 22
8.2.8 Data security�� 22
8.2.9 Device-specific communication profile�� 23
8.3 GPRS functions�� 23
9 Technical data�� 25
9.1 CR3105�� 25
2
9.2 CR3106�� 26
10 Troubleshooting�� 27
10.1 GSM network search and troubleshooting �� 27
11 Maintenance, repair, disposal �� 28
12 Approvals/standards �� 28
13 Terms and abbreviations�� 29
14 Appendix �� 31
14.1 Object directory (Communication profile area)�� 31 UK
14.2 Object directory (Manufacturer specific profile area)�� 36
14.3 EMCY objects�� 57
14.4 Status PDOs�� 58
14.4.1 Modem status�� 58
14.4.2 Sending status �� 60
14.4.3 Receiving status�� 61
14.4.4 Modem online�� 62
14.5 Master command PDOs �� 63
14.5.1 Request modem status�� 63
14.5.2 Transmit transmission buffer to remote station�� 64
14.5.3 Select buffer or source for read operation�� 65
3
1 Preliminary note
1.1 Symbols used
► Instruction
> Reaction, result
[...] Designation of buttons, switches or LEDs
Reference to the kind and source of a hazard
Instruction to avoid a hazard
→ Target, reference
1.2 Further documentation

If the radio modem is operated using the control program CoDeSys 2.3 and an ifm
controller "ecomat100 R360", further documentation is available on the internet.
Programming manual CoDeSys 2.3:
www.ifm-electronic.com → Data sheet direct: → e.g. CR0020 → Download/Software¹
System manual R360 (CoDeSys 2.3):

www.ifm-electronic.com → Data sheet direct: → e.g. CR0020 → Additional data
NMEA protocol with the structure of the supported GPS data records and structure
of the possible SMS commands:
www.ifm-electronic.com → Data sheet direct: → e.g. CR3106 → Additional data
¹) Downloads with registration
4
2 Safety instructions
These instructions are part of the device. They contain information and illustrations
about the correct handling of the radio modem and must be read before installa-
tion or use.
2.1 General
Adhere to the information in the documentation. Non-observance of the instruc-
tions, operation which is not in accordance with use as prescribed below, wrong
installation or handling can affect the safety of people and machinery.
The device must only be installed, connected and put into operation by a qualified UK
electrician.
Disconnect the device externally before handling it.
In case of malfunction of the device or queries please contact the manufacturer.
Tampering with the device can lead to serious risks for the safety of people and
machinery. This is not permitted and leads to an exclusion of liability and warranty.
2.2 Air traffic

The GSM radio modem must not be operated on board of aircraft.
Using it in an aircraft can affect the navigation and communication systems. An
offence can lead to legal action against the offender.
2.3 Explosives
In general, radio equipment must not be used in the vicinity of petrol stations, fuel
depots, chemical plants or blasting operations.
Do not transport and store any flammable gases, liquids or explosive substances
in the part of the vehicle where the radio modem is installed.
2.4 Electronic equipment

Operation can affect the function of electronic equipment which is not properly
screened.
Disconnect the radio modem in the vicinity of medical equipment. Please contact
the manufacturer of the corresponding device or equipment in case of problems.
2.5 Antenna(s)
Operation without antenna(s) can lead to destruction of the radio modem.
2.6 Loss/theft of the SIM card or the radio modem

To prevent misuse, immediately inform your network operator in case of loss or
theft of the SIM card or the radio modem.
5
3 Functions and features

The device is a GSM radio modem with integrated CAN gateway for the direct con-
nection to the controller. All data is transmitted via the CAN bus with the CANopen
protocol.
The radio modem can be directly integrated into the machine or mobile system.
A 5-pin M12 connector is used for the CAN connection and voltage supply.
��

��
��
��
��
��
��
��
��
��
��
��
��
��
��
��
��
��
��
��
3.1 Application overview

●● Remote parameter setting of controllers and sensors in mobile machines and
systems
●● Remote diagnosis of system states, e.g. monitoring the connected actuators for
short circuit and wire break
●● Transmission of alarm messages as SMS, e-mail or fax
●● Reading process data from the machine which is in operation
●● Reading out of data blocks from the user memory in the online mode
●● Location tracking of mobile machines (only with GPS receiver, article no.
CR3106)
6
4 Installation
To ensure that the radio modem is protected against electrical interference the
housing of the modem must be connected to the ground of the vehicle.
This is, for example, guaranteed when the radio modem is fixed to the conductive
parts of the vehicle using the supplied mounting brackets.
The screws under the 4 caps are used to fix the angle brackets.
UK
� �
►► Remove the 4 caps on the side of the radio modem to fix the angle brackets.
►► Choose the suitable mounting variant A or B depending on available space.
►► Adhere to the safety instructions (→ 1 Safety instructions).
7
5 Electrical connection
5.1 Operating voltage and CAN interface
M12 connector (5-pole) Pin Potential

Operating voltage 1 GND
4 3 2 10...30 V DC
5 CAN interface 3 CAN_GND
1 2 4 CAN_H
5 CAN_L
Since the CAN interface of the radio modem is electrically separated the potential
CAN_GND of all CAN participants must be linked.
Otherwise a safe device function is not ensured or the CAN interface can be de-
stroyed.
►► The potential GND of the operating voltage must be connected separately, i.e.
CAN_GND and GND of the operating voltage must not be linked.
5.2 Serial interface
Sub-D plug (9-pole) Pin Potential

1 n.c.
Device → PC 2 TxD
1
6
7
2 Device ← PC 3 RxD
3
8
9
4 Data Set Ready 4 DSR
5
Signal Ground 5 GND
6...9 n.c.
The serial interface provides the following options depending on the firmware ver-
sion of the device1.
●● Firmware update with "CANremote Downloader"
●● Configuration of the device with "CANremote Configurator"
●● Serial data transmission in the online mode via GSM or GPRS
Information about the available software tools at:
www.ifm-electronic.com → Data sheet direct: → e.g. CR3105 → Download/Software²
¹) The firmware version can be determined using the tool "CANremote Configura-
tor" or via the CANopen object directory Idx 100A.
²) Downloads with registration
8
5.3 Antenna(s)
►► When mounting the antenna(s) in vehicles avoid the vicinity of fuel tanks,
vessels with explosives or insufficiently screened electronic components (→ 1
Safety instructions).
►► Do not install the antenna(s) in enclosed metal constructions such as driver's
cabs (screening Faraday effect).
►► Do not extend or shorten the cable of the antenna(s)!
NOTE UK
Operation of the radio modem without antenna(s) may lead to the destruction of
the device.
A good antenna signal is the prerequisite for a stable direct online transmission. In
case of problems change the position of the antennas or the mobile equipment if
necessary. A loosely tightened antenna connector also causes signal loss!
►► Please observe the notes of the antenna manufacturer.
9
6 Operating and display elements

6.1 LEDs
��
��
��
��
��
��
LED Colour State Description

CAN green off No supply voltage
on CANopen status: PREOPERATIONAL / PREPARED
(modem in stand-by mode)
flashing CANopen status: OPERATIONAL (modem active)
ERROR red off CAN data transmission ok
flashing CAN data transmission disturbed
ON green off No supply voltage
on Supply voltage ok
RS-232 green off Serial interface not active
flashing Serial interface active / GSM network search
GSM green off No network connection to the provider
on Network connection to the provider
flashing GSM direct connection
GPS green off GPS receiver not active
(CR3106)
on GPS receiver has received valid data
flashing GPS receiver has received invalid data
In the initialisation phase (about 5 s) the LEDs indicate no defined status.

If all the LEDs flash simultaneously, the radio modem is in the configuration mode
(switch the device off/on (reset) = back in normal operation).
If all LEDs are constantly "On" simultaneously, the radio modem is in the firmware
update mode (switch the device off/on (reset) = back in normal operation).
10
7 Set-up
7.1 SIM card
The radio modem can only be operated with a valid SIM card (Subscriber Identity
Module). You obtain this card as well as your personal identification number (PIN
number) from your network operator or GSM service provider. The PIN number
enables access to the radio modem and the GSM network. With this card you can
also store messages (SMS) and telephone numbers.
For the direct transmission via modem (online mode) you require a SIM card which
supports the GSM data service. If you want to use the SIM card only in conjunction UK
with the radio modem it is in some cases possible to make so-called 'data only'
contracts with the provider. In that case the online costs are considerably lower.
Some prepaid cards do not support the direct online transmission!
NOTE
The SIM card and its contacts can be easily damaged by scratching or bending.
Therefore use the card carefully and avoid touching the contacts.
NOTE
Always disconnect the radio modem before you insert or remove the card.
7.2 Opening the lid

The lid of the radio modem is equipped with a special spring hinge.
��
��
1. direction of pressure
►► To open the lid slight pressure must be applied to the hinge.

When the device is mounted, a screwdriver or a similar flat object can be used
to open the lid.
7.3 Insertion of the SIM card

►► Disconnect the radio modem from power.
►► Press the SIM eject button using a pointed object (e.g. ballpen).
11
>> The SIM card holder will then slightly protrude from the slot and can be re-
moved.
►► Insert the SIM card of the network operator or of the GSM service provider into
the slot of the card holder.
��
��
1. slot (SIM card holder)

2. SIM eject button
►► Insert the card holder with the SIM card into the slot without much pressure
until you feel a stop.
NOTE
When inserting the card, make sure that the SIM card holder is exactly in the
guides of the slot and that it is not jammed.
7.4 Removal of the SIM card

►► Disconnect the radio modem from power.
►► Open the lid (→ 6.1.1 Opening the lid)
►► Press the SIM eject button using a pointed object.
►► Remove the card holder.
►► Remove the SIM card from the card holder.
12
8 Operating modes and programming

8.1 Without control program
8.1.1 Operation with "CAN to SMS" or "SMS to CAN" function
The device can detect CAN messages on the bus and transmit them as SMS with-
out a special control program. The receipt of a specially formatted SMS triggers a
CAN message on the bus. It does not make any difference if the device is used as
CAN Layer 2 or as CANopen system.
The device must be configured accordingly (→ software tool "CANremote Configu- UK
rator" and documentation "Structure of the SMS messages").
www.ifm-electronic.com → Data sheet direct: → CR310… → Additional data
8.1.2 Basic software

The radio modem on the PC evaluation side is operated without a special control
program with the software tool "CANremote Basis" (→ Functions and features, dia-
gram and software tool "CANremote Basis").
8.2 With control program CoDeSys 2.3
8.2.1 Electronic Data Sheet

Parameter setting of the device functions and of the CAN interface is directly done
from the application programmed with CoDeSys 2.3. To do so, the "Electronic Data
Sheet" (EDS) is integrated via the CoDeSys PLC configuration.
CoDeSys dialogue "control and CANopen configuration" (example)
13
For a description of the setting and application of the "PLC and CANopen configu-
ration" dialogue see the CoDeSys manual and the CoDeSys online help.
The EDS contains the description of all parameters of the device in a format de-
fined by CANopen. The EDS files are provided by ifm electronic for all ifm CAN-
open slaves.
The EDS files are available at:
www.ifm-electronic.com → Data sheet direct: → CR310… → Download/Software*
*) Download area with registration
8.2.2 Library ifm_CANCOM_Vxxxxxx

If an ifm ecomat R360 controller is used as CANopen master, the IEC 61131
library "ifm_CANCOM_Vxxxxx.lib" can be integrated into the control program. This
ifm library contains all the necessary functions for communication between radio
modem and the ecomat R360 controller.
These are (overview):
●● SMS functions
TELEDATA_SMS (main function, must always be integrated!)
TELEDATA_DATA_TO_SMS
●● Modem-to-modem functions
TELEDATA_DIRECT
●● GPS functions (only for CR3106)
TELEDATA_GET_GPS_DATA
●● Help functions
Teledata_Clear_Sim, Teledata_Get_All_Providers, etc.
(are used by TELEDATA_SMS and TELEDATA_DIRECT and usually need not
be used by the user any more)
●● Global status variables (for the radio modem status information)
PROVIDER, MODEMTYPE, etc.
14
8.2.3 Function TELEDATA_SMS
UK
●● Library:
ifm_CANCOM_Vxxxxx.lib
●● Purpose:
Initialises the radio modem and enables the transmission of SMS strings or an
SMS message. This function block must be integrated with all operating modes
(e.g. direct transmission)!
●● Parameters:
Input Data type Description

NET_STARTED BOOL TRUE: CAN network was started successfully (OPERATIONAL)
WITH_CRC BOOL TRUE: Transmission with checksum
PASSWORD WORD Password
GSM BOOL TRUE: SMS transmission is activated, a rising edge is waited for
FAX BOOL TRUE: SMS transmission to a fax machine is activated, a rising
edge is waited for
EMAIL BOOL TRUE: SMS transmission to an e-mail address is activated, a rising
edge is waited for
RECEIVER DWORD Tel. no., fax no. or e-mail address of the receiver as string (allocation
via ADR operator)
TX_MESSAGE DWORD Transmission message as string (allocation via ADR operator)
CLEAR_SMS BOOL TRUE: Stored messages are cleared
NODE_ID BYTE Node ID of the radio modem
GLOBALDATA DWORD Global structure variable "CANCOM_GLOBAL_STRUCT"
(allocation via ADR operator)
Output Data type Description

ONLINE BOOL TRUE: Radio modem has connection to the network operator, SMS
transmission possible
15

TX_STATUS BYTE Radio modem status
0 not working
1 finished
2 busy
3 error
TX_CNT WORD Number of messages transmitted
RECEIVED BOOL TRUE: Received new messages
RX_CNT BYTE Number of messages received
RX_MESSAGE STRING (255) Received message as a string (max. 255 characters)
IS_DATA_SMS BOOL TRUE: SMS contains binary coded data
Notes:
Before starting the function with ENABLE = TRUE the CAN network must be
started with the functions "COP_MSTR_MAIN" and "COP_MSTR_BOOTUP".
If not described otherwise, a "FALSE" signal with Boolean data types is always the
negation of the described "TRUE" signal.
16
8.2.4 Function TELEDATA_DATA_TO_SMS
●● Library:
ifm_CANCOM_Vxxxxx.lib UK
●● Purpose:
Converts binary data for the radio modem to an SMS string (text data). This
function is available for reasons of compatibility.
In principle, the function "CAN to SMS" is recommended.
www.ifm-electronic.com → Data sheet direct: → CR310… → Additional data
→Structure of the SMS messages
●● Parameters:

ENABLE BOOL TRUE: Conversion is to be carried out
SRC DWORD Address of the source data (e.g. ARRAY OF BYTES)
LEN BYTE Number of bytes
DST WORD Start address of the converted data in the target controller
(e.g. 0 = %MB0)
PASSWORD WORD Password
WITH_CRC BOOL TRUE: conversion with CRC check

SMS STRING (255) Data in SMS format
Notes:
This function is needed if binary data is to be transmitted in an SMS message.
Since an SMS message may only contain text data, the binary data must be con-
verted with this function.
In the receiving controller the data is stored in a predefined flag area. The user can
determine the start address via "DST".
The start address results from "DST" x 256.
The converted SMS string can be assigned to the function input "TX_MESSAGE"
of the function "TELEDATA_SMS.
To reduce the cycle time the ENABLE input should be reset again after a success-
ful conversion.
17
8.2.5 Function TELEDATA_DIRECT
●● Library:
●● Purpose:
Enables radio modem to operate as transmitter and receiver as direct modem
between two CR310x modems.
●● Parameters

NET_STARTED BOOL TRUE: CAN network was started successfully (OPERATIONAL)
DIAL BOOL TRUE: Establish direct transmission.
Only call when the output "ONLINE" in the function TELEDATA_
SMS is TRUE!
DISCONNECT BOOL TRUE: Interrupt direct connection
PHONENUMBER DWORD Telephone number as STRING (allocation via ADR operator)
PASSWORD DWORD Password as STRING (allocation via ADR operator, password must
be configured in the target device)
NODE_ID BYTE CANopen node number of the radio modem
GLOBALDATA DWORD Structure variable "CANCOM_GLOBAL_STRUCT" (allocation via
ADR operator)

RESULT BYTE 0 no action
1 finished
2 dialling process
3 error, set input DIAL until result 1 or 3
STATE BYTE Status of the dialling process
0 transmit telephone number to radio modem
1 password request remote station
2 transmit password (confirmation of password remote station)
4 switch on CAN transparent mode
5 confirmation of remote station "CAN ON"
6 finished
99 error
18
Notes:
This function enables the establishment of an online direct connection with the
radio modem via the R360 controller. As remote station a radio modem is expected
as well; a connection to a standard analogue modem is not possible!
After the connection has been established all CAN objects which are configured
in the radio modem and which are currently active on the bus are transmitted or
received. It is also possible to establish a direct connection between 2 controllers.
If the device on the opposite side is only called, no control program is required for
the radio modem.
UK
Before this function is called, the function block "TELEDATA_SMS" must be inte-
grated!
19
8.2.6 Function TELEDATA_GET_GPS_DATA
●● Library:
●● Purpose:
Reading the GPS data into the controller.
●● Parameters:

GPGGA BOOL TRUE: Call "GPS fix data"
GPGLL BOOL TRUE: Call "Geographics position latitude/longitude"
GPSA BOOL TRUE: Call "GPS DOP and active satellites"
GPGSV BOOL TRUE: Call "GPS satellites in view"
GPRMC BOOL TRUE: Call "Recommended minimum specific GPS transmit data"
GPVTG BOOL TRUE: Call "Track made good and ground speed"
GPZDA BOOL TRUE: Call "Time and date"
GLOBALDATA DWORD Structure variable "CANCOM_GLOBAL_STRUCT" (allocation via
ADR operator)

RESULT BYTE 0 no action
1 finished
2 function working
3 error
DATA STRING (80) GPS data output as string
Notes:
This function block is only supported by devices with GPS functionality. The data
correspond to the NMEA-0183 format.
Only one input at a time may be set. The corresponding input must be set until the
output "RESULT" provides the result 1 or 3.
Before this function is called, the function block "TELEDATA_SMS" must be inte-
grated!
20
If requested, further information about the NMEA protocol and the supported GPS
data records is available as PDF file on the internet.
www.ifm-electronic.com → Data sheet direct: → CR3106 → Additional data
UK
21
8.2.7 SMS data format

Since only text characters can be transmitted as SMS, the following format has
been chosen for the transmission of binary data:
# pw_L pw_H adr_L adr_H d0 d1 d2 dn crc_L crc_H #
# Start sign
pw_L Password Low
pw_H Password High
adr_L Address Low
adr_H Address High
d0 Data byte 1
d1 Data byte 2
d2 Data byte 3
dn Data byte n
crc_L Checksum Low (optional)
crc_H Checksum High (optional)
# End sign
●● All numerical values are indicated in the 2-digit Hex format.
●● Byte sequence within words: first low byte then high byte!
●● The number of data bytes is limited by the max. SMS length.
●● If required CRC can be used. The receiving application program determines by
means of the input parameter "WITH_CRC" on the function block "TELEDATE_
SMS" if the last 2 bytes are rated as CRC. The CRC contains the 2 address
bytes and all data bytes. The number of data bytes must be even (16-bit CRC).
The CRC is formed by means of "parallel signature formation and signature
length 16". The generator polynomial is X15+X12+X5+1.
If the password and/or the CRC are not correct the received data is not stored
(→ section "Data security").
●● The conversion of binary data into text data (SMS format) is carried out by
means of the function DATA_TO_SMS.
Example: #07220000123456787210#
Start sign # #07220000123456787210#
Password hex 2207 #07220000123456787210#
Address hex 0000 #07220000123456787210#
Data bytes hex 12, 34, 56, 78 #07220000123456787210#
Checksum hex 1072 #07220000123456787210#
End sign # #07220000123456787210#
The 4 bytes hex 12, 34, 56 and 78 are stored in ascending order as from the flag
address %MB0.
8.2.8 Data security

SMS messages are transmitted over a secure connection (according to the GSM
standard). Received data is only stored in the library if a security protocol is used.
22
In case of the direct modem connection (online mode) the 2 modems set the same
transmission protocol. To do so, 2 securing mechanisms against faulty, invalid
or corrupted data are implemented in radio modem, i.e. monitoring via the GSM
radio link protocol (GSM standard) and creating an additional checksum within the
firmware. Invalid or corrupted data is rejected.
NOTE
In case of invalid or corrupted data there will be no automatic repetition. This has
to be carried out by the user.
To see if CAN objects were lost or rejected, one byte should be used as "mes- UK
sage counter", for example.
8.2.9 Device-specific communication profile

The CAN communication is based on the communication profile CiA-DS 301.
Since there is at present no device profile for CAN modems, a communication
protocol based on process data objects (PDOs) was used.
In the CANopen network the radio modem operates as a slave. It uses 2 asyn-
chronous PDOs.
●● PDO 1 serves as a status or command channel for the remote transmission of
data
Type: Status PDO Direction: modem → master
Type: master command PDO Direction: master → modem
●● PDO 2* is used for the actual transmission of the user data blocks and longer
status/control information (e.g. phone number, network operator, etc.).
Type: Data PDO Direction: modem → master
Type: master data PDO Direction: master → modem
*) PDO 2 will no longer be used as from CR3105/06. The control commands will be available in the object
directory as from CR3105/06. The segmented data transmission is only supported for reasons of compati-
bility.
Larger data volumes (data length > 7 bytes) were transmitted in segments (blocks) up to CR3103/04. A
segment consists of a start message and a number of data messages. The start message specifies the
number of bytes to be transmitted in the following data messages and the source and target of these data.
The acknowledgement contains the number of user data received by the receiver.
The transmitter checks this with the number of messages sent. In case of a dispar-
ity the data transmission is aborted.
A time monitoring has also been implemented on the receiver and transmitter side
which aborts the data transmission if there has been no communication for 2 s.
8.3 GPRS functions

Use of the GPRS functions presupposes a special firmware and a corresponding
infrastructure.
23
For information about the GPRS mode please contact our ifm support.
www.ifm-electronic.com → Data sheet direct: → CR3106 → Additional data → Over-
view of ifm contacts
24
9 Technical data
9.1 CR3105
Control systems
CR3105 ��
CAN
GSM quad-band modem
�
for the transfer of
��
SMS messages �
�
and data packets
� �
UK
��
CAN gateway
with CANopen interface
1) SMA antenna connector
2) CANopen interface
Operating voltage 3) Lid
10...30 V DC 4)
5)
SIM card
RS-232 interface
��
Application remote diagnosis, maintenance and parameter setting

of CAN control systems for mobile applications
Mechanical data
Housing aluminium
Dimensions (W x H x D) 128 x 85 x 35 mm
Installation with mounting tabs
(prepared mounting bores on the sides, see mounting variants)
Protection rating IP 65
Operating temperature -30...65 °C
Storage temperature -40...80 °C
Weight 290 g
Electrical data
Operating voltage 10...30 V DC
Current consumption (at 24 V DC) 95 mA (standard operation), 170 mA (transmission)
Transmitter power 2W
Frequency band 850/900/1800/1900 MHz
Transmission rate max. 9,600 bits/s (real value depends on the network provider)
EMC 89/336/EC
Interfaces
CAN interface CAN interface 2.0 B, ISO 11898
M12 plug for operating voltage and CAN bus, 5 pins (type Lumberg)
CAN electrically separated
Baud rate 20 Kbits/s...1 Mbits/s (default setting 125 Kbits/s)
Communication profile CANopen, CiA DS 301 version 3.0
Node ID (default) hex 20 (= 32)
Serial interface RS-232, 9-pole Sub-D plug (pin)
Antenna terminals type SMA connector (adapter SMA/FME enclosed)
GSM modem
GSM profile GSM 850/900/1800/1900
\DATEN\100\DB-FORM—PZD/03/12/96
SMS class (Short Message Service) text mode

SMS character length max. 160 characters (corresp. to 7 bits/character)
Size of data packet max. 16 Kbytes
Safety V.42 data compression RLP
ifm electronic gmbh • Friedrichstraße 1 • 45128 Essen We reserve the right to make technical alterations without prior notice! CR3105 / page 1
25
11.9.2009
9.2 CR3106
Control systems
CR3106 ��
CAN
GSM/GPS quad-band modem
�
for the transfer of
��
�
SMS messages �
and data packets
CAN gateway � ��
with CANopen interface

1) SMA antenna connector
GPS receiver 2) CANopen interface
3) Lid
4) SIM card
10...30 V DC 5) RS-232 interface
��
Application remote diagnosis, maintenance, parameter setting and location tracking

of CAN control systems for mobile applications
Mechanical data
Housing aluminium
Dimensions (W x H x D) 128 x 85 x 35 mm
Installation with mounting tabs
(prepared mounting bores on the sides, see mounting variants)
Protection rating IP 65
Operating temperature -30...65 °C
Storage temperature -40...80 °C
Weight 290 g
Electrical data
Operating voltage 10...30 V DC
Current consumption (at 24 V DC) 95 mA (standard operation), 170 mA (transmission)
Transmitter power 2W
Frequency band 850/900/1800/1900 MHz
Transmission rate max. 9,600 bits/s (real value depends on the network provider)
EMC 89/336/EC
Interfaces
CAN interface CAN interface 2.0 B, ISO 11898
M12 plug for operating voltage and CAN bus, 5 pins (type Lumberg)
CAN electrically separated
Baud rate 20 Kbits/s...1 Mbit/s (default setting 125 Kbits/s)
Communication profile CANopen, CiA DS 301 version 3.0
Node ID (default) hex 20 (= 32)
Serial interface RS-232, 9-pole Sub-D plug (pin)
Antenna terminals (GSM/GPS) type SMA connector (adapter SMA/FME enclosed)
GSM modem
GSM profile GSM 850/900/1800/1900
\DATEN\100\DB-FORM—PZD/03/12/96
SMS class (Short Message Service) text mode

SMS character length max. 160 characters (corresp. to 7 bits/character)
Size of data packet max. 16 Kbytes
Safety V.42 data compression RLP
GPS receiver 16 channels, NMEA 0183 compatible
ifm electronic gmbh • Friedrichstraße 1 • 45128 Essen We reserve the right to make technical alterations without prior notice! CR3106 / page 1 11.9.2009
26
10 Troubleshooting
10.1 GSM network search and troubleshooting
The radio modem can be set up without CAN bus, controller or communication to
other software.
As soon as voltage is supplied to the device it starts searching a GSM network
independently. The radio modem CR3105 should find a network after 30 seconds
at the latest, the CR3106 after approx. 60 seconds.
If the network search was successful, the GSM LED is constantly lit green. If this is UK
not the case there may be the following error causes:
Error cause Possible cause

SIM card ●● not inserted
●● jammed
●● contacts soiled
●● does not support the available GSM network
●● PIN no. configured incorrectly (→ CANremote Configurator)
GSM antenna ●● not connected
●● antenna connector only tightened loosely
●● field intensity too low
CAN master master always resets the radio modem
(as a test operate the radio modem without CAN master)
GSM network no network available
RS-232 cable ●● The device is connected to the PC via the serial interface and
passes into the configuration mode
(all LEDs flash simultaneously)
●● Pin 4 (DSR) of the serial interface is set to logic "high" and the
device is in the update mode
(all LEDs are constantly "on" simultaneously)
●● The device does not boot when the serial interface is connected to
the PC and the configuration software is not active
(all LEDs are "off")
Avoid change of position in the online mode!

The passing on of a network connection from one radio cell to the next ("Hando-
ver") during a direct modem connection may lead to faulty transmissions. So it is
possible in some cases that the handover cannot be carried out correctly and the
connection is interrupted.
This may e.g. be connected to the fact that no capacities are available on the
"new" transmitter or that the handover is not carried out fast enough and the con-
tact to the "old" transmitter is interrupted.
Therefore a change of position during a direct modem connection should be
avoided.
27
11 Maintenance, repair, disposal

►► Do not open the housing, as the device does not contain any components
which must be maintained by the user. The device must only be repaired by the
manufacturer.
►► Dispose of the device in accordance with the national environmental regula-
tions.
12 Approvals/standards
Test standards and provisions → 9 Technical data
The CE Declaration of Conformity is available at:
www.ifm-electronic.com → Data sheet direct: → CR310… → Approvals
28
13 Terms and abbreviations

0b ... binary value (for bit coding), e.g. 0b0001 0000
0d ... decimal value, e.g. 0d100
0x ... hexadecimal value, e.g. 0x64 (= 100 decimal)
Baud rate transmission speed (1 baud = 1 bit/s)
CAL CAN Application Layer
CAN-based network protocol on application level
CAN controller area network (bus system for the use in mobile vehicles)
CAN_H CAN high; CAN connection/cable with high voltage level
CAN_L CAN low; CAN connection/cable with low voltage level
CANopen CAN-based network protocol on application level with an open configuration interface
(object directory). UK
CiA "CAN in Automation e.V."
(user and manufacturer organisation in Germany/Erlangen)
definition and control body for CAN and CAN-based network protocols
CiA DS draft standard (published CiA specification which usually has not been modified or
supplemented for one year)
CiA DSP draft standard proposal (published CiA specification draft)
CiA WD work draft (work draft accepted for discussion within CiA)
CiA DS 301 specification for CANopen communication profile;
describes the basic communication between network participants such as the transfer
of process data in real time, the exchange of data between devices or the configura-
tion stage;
supplemented by the following CiA specifications depending on the application:
CiA DS 401 device profile for digital and analogue I/O modules
CiA DS 402 device profile for drives
CiA DS 403 device profile for HMI
CiA DS 404 device profile for measurement and control technology
CiA DS 405 specification for interfaces to programmable systems (IEC 61131-3)
CiA DS 406 device profile for encoders
CiA DS 407 application profile for local public transport
COB CANopen communication object (PDO, SDO, EMCY, ...)
COB-ID CANopen identifier of a communication object
Communication cycle the synchronisation time to be monitored; max. time between 2 synch objects
EMCY object emergency object (alarm message; device indicates an error)
Error Reg error register (entry with an error code)
Guarding Error node or network participant could or can no longer be found
guard MASTER: one or several SLAVES no longer reply
guard SLAVE: no polling of the device (SLAVE)
Guard Time during this time the network participant expects a "node guarding" of the network
master
Heartbeat cyclic monitoring with parameter setting among network participants
in contrast to "node guarding" no superior NMT master is required
ID (also Identifier) identifier; identifies a CAN message; the numerical value of the ID also contains a
priority for the access to the bus system
ID 0 = top priority
Idx index; together with the S index it forms the address of an entry in the object directory
Life Time Factor number of attempts in case of a missing guarding reply
Monitoring is used to describe the error class (guarding monitoring, synch etc.).
NMT network management
NMT master/slaves the NMT master controls the operating states of the NMT slaves
Node Guarding adjustable cyclic monitoring of slave network participants by a higher master node as
well as the monitoring of this polling process by the slave participants
Node-ID node identifier (identification of a participant in the CANopen network)
Object (also OBJ) term for data/messages which can be exchanged in the CANopen network
29
Object directory contains all CANopen communication parameters of a device as well as device-specif-
ic parameters and data;
access to the individual entries is possible via the index and S-index
Operational operating state of a CANopen participant;
in this mode SDOs, NMT commands and PDOs can be transferred
PDO Process Data Object; in the CANopen network for transfer of process data in real time
such as the speed of a motor
PDOs have a higher priority than SDOs; in contrast to the SDOs they are transferred
without confirmation. PDOs consist of a CAN message with identifier and up to 8
bytes of user data.
PDO Mapping describes the application data transferred with a PDO
Pre-Op preoperational; operating state of a CANopen participant;
after application of the supply voltage each participant automatically goes into this
state;
in the CANopen network only SDOs and NMT commands can be transferred in this
mode but no process data
Prepared (also stopped) operating state of a CANopen participant
in this mode only NMT commands are transferred
Rec PDO receive process data object
(also Rx PDO)
ro read only (unidirectional)
rw read-write (bidirectional)
Rx-Queue receive buffer
s16 data type signed 16 bits (incl. sign, 16-bit format)
SDO Service Data Object;
with this object direct access to the object directory of a network participant is pos-
sible (read/write); an SDO can consist of several CAN messages; the transfer of the
individual messages is confirmed by the addressed participant
with the SDOs devices can be configured and parameters can be set
Server SDO process and parameter set to make the object directory of a network participant avail-
able to other participants (clients)
S-Idx (also SIdx) subindex within the object directory of a CANopen device
Start Guarding start node guarding
str data type string (variable for strings such as text "load")
Sync Error missing synch object OBJ in the adjustable synchronisation time
Sync OBJ synchronisation object for simultaneous update in the complete network or
for accepting process data of the respective parameterised PDOs
Sync Windows time during which the synchronous PDOs have to be transferred
Time Stamp time stamp to align existing clocks in network participants
Trans Type type of process data transmission; synchronous, asynchronous
Trans PDO transmit process data object
(also Tx PDO)
Trans SDO transmit service data object
(also Tx SDO)
Tx-Queue transmit buffer
u8 (16, 32) data type unsigned 8 (16, 32) bits (unsigned, 8 (16, 32) bit format)
wo write only
30
Firmware Manual CANlink GSM
5.6
14 CANopen
AppendixObject Dictionary (Communication Area)
Below, you will find the description of the CANlink GSM devices’ CANopen object directory�
14.1 Object directory (Communication profile area)
Index Sub- Name Data Default Description
Index type/
Attribute
1000 0 Device Type u32 0x12D DS 301

ro
Generic CANopen device (with
supported communication
profile) UK
1001 0 Error Register u8 Bit coded according to profile
ro 301 supporting:
Ob 0000 0000: no error
Ob 0000 0001: generic error
Ob 0001 0001: communication
error
Ob 1000 0001: manufacturer
specific
1008 0 Manufacturer V�String RMGPRSP

Device Name ro <VS 2101>
<CS RM>
1009 0 Manufacturer V�String HV05�00

Hardware Version ro
100A 0 Manufacturer V�String SV08�28

Software Version ro
1017 0 Producer u16 0

Heartbeat Time rw
1018 0 Identity Object u8 4

ro
1 Vendor ID u32 0x524d

ro
2 Product code u32 0x1

ro
3 Revision Code u32 0x1

ro
4 Serial Number u32 0x00

ro
 2007 RM Michaelides Software & Elektronik GmbH • Donaustr� 14 • 36043 Fulda • Germany • clgsm_fw_e�doc 21
31

Index type/
Attribute
1400 0 Receive PDO u8 2

Communication ro
Parameter 0
1 COB-ID u32 Node ID + 0x200

ro
2 Transmission u8 255
Type ro

Communication ro
Parameter 1

ro
Type ro

Communication ro
Parameter 2

ro
Type ro
1600 0 Receive PDO u8 8 Number of sub-index entries

Mapping ro
Parameter 0
1-8 PDO Mapping u32 0x00050008 Fixed mapping, independent of

Entry X ro Object Dictionary

Mapping ro
Parameter 1

22  2007 RM Michaelides Software & Elektronik GmbH • Donaustr� 14 • 36043 Fulda • Germany • clgsm_fw_e�doc
32

Index type/
Attribute

Mapping ro
Parameter 2
1 PDO Mapping u32 0x62000108

Entry 1 ro
1800 0 Transmit PDO u8 5

Communication ro UK
Parameter 0
1 COB-ID u32 Node ID + 0x40000180 PDO is valid, is no RTR

ro message and has an 11-bit
identifier
2 Transmission u8 255 Event-driven transmission

Type ro
3 Inhibit Time u16 0x0000

rw
4 Reserved u8 0x00
5 Event Timer u8 0x00 Disabled

rw
33

Index type/
Attribute

Communication ro
Parameter 1

identifier

Type ro

rw
4 Reserved u8 0x00

rw

Communication ro
Parameter 2

identifier

Type ro

rw
4 Reserved u8 0x00

rw
34

Index type/
Attribute
1A00 0 Transmit PDO u8 8 Number of sub-index entries

Mapping ro
Parameter 0


Mapping ro UK
Parameter 1


Mapping ro
Parameter 2

Entry 1 ro

Entry 2 ro
35
14.2
5.8 Object directory
CANopen (Manufacturer
Object Dictionary specific profile area)
(Manufacturer-Specific Area)
Index Sub- Name Data type/ Default Description
Index Attribute
20F0 0 Node ID1 u8 32 Node ID of the device within

rw a CANopen network
20F1 0 Node ID2 u8 255 Node ID of the device within

rw a CANopen network�
Changes of the node ID will only apply if the
values of OD 0x20F0 and 0x20F1 are the
same
Entry will always read 255 if

not directly written before
20F2 0 CAN Baudrate 1 u8 3 CAN baud rate of the device:

rw
0: 1000 kBaud
1: 500 kBaud
2: 250 kBaud
3: 125 kBaud
4: 100 kBaud
5: 50 kBaud
6: 20 kBaud
7: 10 kBaud
20F3 0 CAN Baudrate 2 u8 255 CAN baud rate of the device�

rw
Changes of the CAN baud rate will only
apply if the values of OD 0x20F2 and
0x20F3 are the same
Entry will always read 255 if

not directly written before
36

Index Attribute
20F4 0 Disable CANopen u8 0 Switch off CANopen stack objects while an

Objects rw online connection is established (CSD or
GPRS)
0x00: CANopen stack completely active
during online connection
0x55: The following CANopen objects of the
device are disabled:
- NMT-Receive Objects
- SDO-Server Receive Object
- SDO-Server Transmit Object
- Emergency Transmit Object
UK
- PDO-Receive Object
- PDO-Transmit Object
20F8 0 Disable segmented u8 Proprietary Segmented Transfer Protocol

PDO transfer rw via PDO 2
0x00: Segmented Transfer Protocol via
PDO 2 enabled
0x55: Segmented Transfer Protocol via
PDO 2 disabled
Segmented Transfer
Protocol via PDO 2 enabled
is required for a CSD
connection with the
GSM Base Station where
the device
works as a PC modem
5000 0 SIM PIN 1 Domain 10 „9999“ PIN number of the SIM card
wo
Four-digit string which is required for
registering with the GSM network provider
This value is only required if

this feature is not disabled
in the SIM card
5001 0 SIM PIN 2 Domain 4 „9999“ PIN number of the SIM card
wo
Changes of the PIN number will only apply
if the values of OD 0x5000 and 0x5001 are
the same�
Changes will only apply

after the device has been
switched off/on
37

Index Attribute
5002 0 SMS SSC Domain 20 “+49171076 Telephone number of the SMS service
rw 0000” center that is used to transmit the SMS�
This number depends on the GSM network
provider�
Examples for Germany:
"+491710760000": D1 T-Mobile
"+491722270333": D2 Vodafone
5004 0 SMS FAX Header Domain 10 “99” The SMS Fax Header that is used to
rw redirect an SMS to a fax machine� This
number depends on the GSM network
provider�
"99": D1 T-Mobile
"99": D2 Vodafone
5006 0 SMS EMAIL Header Domain 20 “8000” The SMS E-mail Header that is used to
rw redirect an SMS to an e-mail address� This
number depends on the GSM network
provider�
"8000": D1 T-Mobile
"3400": D2 Vodafone
5007 0 GSM Operator u8 2 Number of sub entries for selecting the

Selection rw GSM operator
Function for assigning the GSM operator
manually
1 Manual GSM u8 0 Enable/disable manual GSM operator

Operator Selection rw selection
0x00: Automatic GSM operator selection
0x55: Manual GSM operator selection
enabled� Operator has to be
specified in Sub-Index 2
2 GSM Operator u32 Network code of the GSM Operator that

Network Code rw should be used if manual GSM Operator
Selection is enabled
5008 0 CSD MAX Online u16 20 Maximum Time in minutes the

Time rw GSM device is allowed to be online in the
CSD Online Mode� If this time has elapsed,
the device will automatically disconnect the
CSD connection�
38

Index Attribute
500A 0 CSD Online Domain 8 “GSMONLIN” Password for accessing the

Password rw device called in CSD Online Mode
500C 0 Online Object 1 CAN u8 0 Entry is only supported for reasons of

ID TYPE rw compatibility and should not be used for
new developments� The CAN ID type of
Online Object 1 can now be changed via
OD 0x5020, Sub-Index 1
500E 0 Online Object 1

Mask Register
u32
rw
Entry is only supported for reasons of
compatibility and should not be used for UK
new developments� The mask register of
Online Object 1 can now be changed via
OD 0x5022, Sub-Index 1�
5010 0 Online Object 1 u32 Entry is only supported for reasons of

CAN-ID rw compatibility and should not be used for
new developments� The CAN ID of Online
Object 1 can now be changed via OD
0x5020, Sub-Index 1
5020 0 Online Object U8 16 Number of Online Objects available for

Activate Type CANID ro filtering
1-16 Online CAN U32 With this array, it is possible to

Object ID X rw enable/disable individual CAN objects, to
determine if an 11-bit or a 29-bit CAN
message should be sent and to specify the
CAN ID relevant for filtering�
Together with the values of the mask
register (OD 0x5022) and this CAN ID
register, it is possible to specify which CAN
messages are being transmitted while the
Online Mode is active�
Bit 31 = 0: Online object is active
Bit 31 = 1: Online object is inactive
Bit 30: not used
Bit 29 = 0: 11-bit type
Bit 29 = 1: 29-bit type
Bits 0 to 28: CAN identifier
39

Index Attribute
5022 0 Online Object Mask u8 16 Number of available Online Objects

ro available for filtering
1-16 Online Object u32 With this array, it is possible to set the
Mask X rw mask register for filtering CAN messages
5024 0 Online Objects u8 16 Number of Online Objects available for

MinRec Cycle Time ro filtering
1-16 REC ONLINE u8 With this array, it is possible to set the

CYCLE TIME X rw online cycle time� This period must elapse
before another CAN message matching
the ID of this object will be sent�
If this value is set to zero, this feature is
disabled�
5028 0 Object File Mode u8 16 Number of objects configurable for relevant

Relevant Data Bytes ro data bytes in Transmit Logging File
This value is only relevant

for the GPRS Transmit File
Logging Mode
1-16 Online Object X File u8 Indicates which bytes of CAN messages

Mode Relevant rw that were passing the filter will be logged in
Databyte a file�
Each Sub-Index of this OD entry will
represent a filter object of the GSM
device� Every Bit Position of the byte value
in each Sub-Index represents a byte of the
CAN message�
Each bit set to 1 indicates that the
respective CAN message byte will be
logged in the file�
Each bit, which is set to 0 indicates, that
the respective CAN message byte will not
be logged
Example:
50F0 Sub-Index 2 = 0x03 only data bytes 1
and 2 from the Online Object 2 will be
stored in the transmit file
50F0 Sub-Index 3 = 0xFF all data bytes 1
to 8 from Online Object 3 will be stored in
the transmit file�
40

Index Attribute

EN/DISABLE rw compatibility and should not be used for
new developments� The Online Object 2
can now be enabled/disabled via OD
0x5022, Sub-Index 2

CAN ID TYPE rw compatibility and should not be used for
new developments� The CAN ID type of
Online Object 2 can now be changed using
OD 0x5020, Sub-Index 2 UK
Mask Register rw compatibility and should not be used for

CAN ID rw compatibility and should not be used for
Object 2 can now be changed via OD
0x5020, Sub-Index 2

EN/DISABLE rw compatibility and should not be used for
new developments� The Online Object 3
can now be enabled/disabled using OD
0x5022, Sub-Index 3

CAN ID TYPE rw compatibility and should not be used for
new developments� The CAN ID Type of

Mask Register rw compatibility and should not be used for

CAN ID rw compatibility and should not be used for
Object 3 can now be changed using OD
0x5020, Sub-Index 3
41

Index Attribute
50C0 0 GSM Active Network Domain 17 Contains the current GSM network
Provider ro provider
50D0 0 GSM Engine Version Domain 17 Contains the hardware and software
ro version of the internal GSM engine
50D1 0 GSM Engine IMEI Domain 17 Contains the number of the GSM engine,
Number ro which is unique in the world� This number
is used for authorization purposes at the
Proemion server�
50D2 0 GSM SIM Card Domain 34 Contains the number of the SIM Card,
Number ro which is unique in the world� This number
is used for identification purposes at the
Proemion server�
50D3 0 GSM Calling Number Domain 34 Contains the number of the caller if the
Identification ro device is called from outside� If the
caller has not enabled the identification
function, this entry contains the string
"Unknown"�
50E0 0 GSM 1900Mhz u8 0 Entry is only supported for reasons of

Frequency Band rw compatibility and should not be used for
new developments� It has no functionality
in the devices�
5101 0 GSM Registration u16 Counts how many times the

Counter ro device has registered with a GSM provider�
5102 0 ON OFF Switch u16 Counts how many times the

Counter ro device has been switched on�
5103 0 SMS Receive u16 Counts how many SMS have been
Counter ro received since the last reset of the counter�
5104 0 SMS Transmit u16 Counts how many SMS have been sent
Counter ro since the last reset of this counter�
5105 0 Operating Hours u32 Operating Hours with a resolution of 6

ro minutes�
42

Index Attribute
5120 0 SMS Destination Domain 30 Destination number for Direct SMS Mode�
Phone Fax Number rw The telephone number must only be
entered if the SMS is sent to a mobile
phone or fax�
Telephone numbers must be entered in the
international numbering format
(e�g� +49171��)
5121 0 SMS Destination Domain 60 Destination E-mail address for Direct SMS
E-Mail Address rw Mode� The E-mail address must only be
entered if the SMS is sent to an E-mail
UK
account�
5122 0 SMS Send Text Domain 160 The SMS transmit buffer contains the
rw contents of the SMS
5123 0 SMS Send u8 SMS Send Command

Command rw
1: Send the SMS_Send_Text as an SMS
to the SMS destination number
2: Send the SMS_Send_Text as a fax to
the SMS Destination Number
3: Send the SMS_Send_Text as an E-mail
to the E-Mail Address
The value will be reset to 0 if the
transmission was successful
5124 0 SMS Send u16 Enter a value that is to be added to the

Sequence Number rw SMS send queue� It will be inserted into
the SMS Send PDO1 to identify which
SMS was sent�
5125 0 SMS Send Queue u8 1: Clear all SMS Send Objects in the SMS
Reset rw Send Queue�
The value will automatically be reset to 0�
5130 0 SMS Receive SMS u8 Select the SMS SIM address for reading a
SIM Address rw received SMS message�
The SIM address of a received short
message is indicated in PDO1 when a new
SMS is received�
5131 0 SMS Receive u8 1: Read the SMS SIM address that is

Command rw selected in OD 0x5130�
The value will be reset to 0 if the read
process has finished�
43

Index Attribute
5132 0 SMS Receive Text Domain Contains the received SMS text after
ro reading the SIM address using OD 0x5130
and 0x5131�
5133 0 SMS Receive Time Domain Contains the time at which the received
ro SMS was stored in the SSC� Value will be
valid after reading a SIM address using OD
0x5130 and 0x5131�
5134 0 SMS Receive Domain Contains the sender address of the

Originator ro received SMS� Value will be valid after
reading a SIM address using OD 0x5130
and 0x5131�
5140 0 SMS Event Text u8 4 Contains the number of Sub-Indexes that

ro can be filled with SMS texts sent in the
case of an event
1-4 SMS Event Text X Domain 80 SMS text that will be sent if event X occurs�
rw
5150 0 SMS Event u8 4 Contains the number of Sub-Indexes to set

Destination ro the destination number for the Event SMS
1-4 SMS Event Domain 40 This entry contains destination X for the
Destination X rw Event SMS Function� It is possible to
assign up to four destinations to each
event� The assignment of destination
numbers to an event is done in OD 0x5173
Telephone numbers must be entered in
ASCII characters using the international
numbering format (e�g� +49171��)
5155 0 SMS Event Activate u8 4 Contains the number of Sub-Indexes to

Functions ro enable/disable the SMS Event Function
1-4 SMS Event Activate u8 Enable/disable SMS Event Function X

Function X rw
0x00: SMS Event Function X disabled
0x55: SMS Event Function X enabled
44

Index Attribute
515a 0 SMS Event u8 4 Contains the number of Sub-Indexes to

Functions Input ro select the source CAN Online Object for
Source the SMS Event Function
1-4 SMS Event u8 Select the source CAN Online Object for
Functions Input rw SMS Event Function X
Source X
1 to 0x10 = CAN Online Objects 1 to 16
Check that the CAN mask
for the selected CAN Online
Object is set to relevant UK
(0x1FFFFFFF (29-bit ID) or
0x7FF (11-bit ID))�
Otherwise it cannot be
determined which message
of the filtered range caused
the event
515F 0 SMS Event u8 4 Contains the number of Sub-Indexes to

Functions Trigger ro select the trigger level for the input signal
Level of an active SMS Event Function
1-4 SMS Event u32 Select the trigger level X for the input
Functions Trigger rw signal at which the SMS Event Function
Level X will be triggered�
5162 0 SMS Event u8 4 Contains the number of Sub-Indexes to

Functions Hysteresis ro select the hysteresis level of the input
Level signal for an active SMS Event Function
1-4 SMS Even u32 Select the hysteresis level at which an

Hysteresis Level X rw executed event will be reset�
The event will be automatically reset if the
device itself is reset�
45

Index Attribute

Functions Startbit ro select the start position from where to
interpret the trigger level indicated in OD
0x515F�
1-4 SMS Event u8 Start position in the CAN message from

Functions Startbit X rw which to start the interpretation of the
trigger level
0: data byte 1, bit position 0

Functions Datatype+ ro select data type and byte ordering
Byte Ordering
1-4 SMS Event u8 Describes the data type and byte ordering
Functions Datatype+ rw used in the CAN message
Byte Ordering X
Data types:
05 UNSIGNED8
06 UNSIGNED16
07 UNSIGNED32
Byte Ordering:
If MSB Bit (Bit8) =1: MSB first
(Big Endian)
If MSB Bit (Bit8) =0: LSB first
(Little Endian)
46

Index Attribute
516E 0 SMS Event u8 4 Contains the number of Sub-Indexes to

Functions Conditions ro select the trigger condition for the Event
SMS Function
1-4 SMS Event u8 Describes the trigger condition that must

Functions rw be met together with the trigger level
Condition X indicated in OD 0x515F to send the Event
SMS�
0: >
1: >=
2: =
UK
3: <
4: <=

Functions ro select the SMS destination number to
Destinations which the SMS event text will be sent in
the case of an event
1-4 SMS Event u8 Select the SMS destination numbers to

Functions rw which the SMS event text will be sent if the
Destination X event condition occurs�
Bit 0 = 1: SMS destination 1

Functions Cycletime ro select the SMS Event Function cycle time
1-4 SMS Event u8 SMS Event Function cycle time in minutes

Functions rw that has to elapse before the assigned
Cycletime X CAN object selected in OD 0x515A (input
source) will be monitored again after an
event has been triggered�
Setting the cycle time to zero will disable
this feature
Since the CAN object is
disabled while the cycle
time is not elapsed, a drop
below the configured
hysteresis value may not be
detected!
47

Index Attribute
517D 0 SMS Event u8 4 Contains the number of sub-IDs to

Functions Repeats ro configure the SMS Event repeats
1-4 SMS Event u8 Indicates how often the SMS will be

Functions Repeats X rw repeated after the first message, if the
condition remains active for a longer time�
The duration between two repeats
depends on the cycle time configured in
OD 0x5178�
0 – 254: Number of repeats
255: Messages will be sent as long as
condition remains active
5201 0 GPS NMEA GGA V string 90 GPS GGA dataset

Dataset ro (standard NMEA message format)
This index is only available
in devices with a
GPS receiver
5202 0 GPS NMEA GLL V string 90 GPS GLL dataset

in devices with a
GPS receiver
5203 0 GPS NMEA GSA V string 90 GPS GSA dataset

in devices with a
GPS receiver
5204 0 GPS NMEA GSV V string 90 GPS GSV dataset

in devices with a
GPS receiver
48

Index Attribute
5205 0 GPS NMEA RMC V string 90 GPS RMC dataset

in devices with a
GPS receiver
5206 0 GPS NMEA VTG V string 90 GPS VTG dataset

This index is only available UK
in devices with a
GPS receiver
5207 0 GPS NMEA ZDA V string 90 GPS ZDA dataset

in devices with a
GPS receiver
5220 0 GPS Active Satellites u8 Number of satellites currently in view

ro
in devices with a
GPS receiver
5221 0 GPS Dilution u8 Quality of the GPS signal

ro
(0-99)
in devices with a
GPS receiver
5250 0 GSM Network State u8 Current state of the GSM network

ro connection
0: Not connected
1: Registered with home network
2: Not registered, searching for network
3: Registration refused by network
provider
4: Unknown
5: Registered in external network
49

Index Attribute
5251 0 GSM Signal Quality u8 Quality of the GSM signal

ro
0: -113dBm or less
1: -111dBm
2-30: Between -109 and -53dBm
31: -51dBm or more
99: Unknown
5252 0 GSM Modemresult u8 Connection status of the GSM engine

ro
0: Ok
1: Modem has established a connection
2: Modem is called
3: No connection
4: Unknown command
5: No dialing tone or no dialing possible
10: GPRS internet connection active
11: TCP socket via GPRS is established
255: Modem timeout occurred
5300 0 GPRS ISP NUMBER Domain 10 *99***1# Number that has to be dialed in order to
rw get a connection to the internet via the
GPRS network provider�
5301 0 GPRS DNS1 Domain 16 193�254� IP address of the GPRS provider's first
rw 160�001 Domain Name Server
5302 0 GPRS DNS2 Domain 16 IP address of the GPRS provider's second

rw Domain Name Server
This field is empty if the GPRS provider
does not have a second DNS
5303 0 GPRS Username Domain 21 CAN_GPRS User name to be submitted to the ISP
rw
5304 0 GPRS Password Domain 9 t-d1 Password to be submitted to the ISP

rw
5305 0 GPRS PPP u8 0 Protocol used for authentication to the ISP

Authentication rw (PAP or CHAP)
0: PAP (only supported value)
50

Index Attribute
5306 0 GPRS APN Domain 51 1,"IP", Internet access point name of the ISP
rw "internet�
Examples:
t-d1�de"
T-Mobile Germany:
1,"IP","internet�t -mobile"
Vodafone:
1,"IP","web�vodafone�de"
5307 0 GPRS QOS Domain 16 1,3,4,3,0,0 Minimum GPRS connection quality

rw required by the device UK
5310 0 GPRS Local IP Domain 16 IP address currently assigned to the device
Address ro from the ISP
This information is only

provided while a GPRS
connection is active�
5350 0 GPRS Start Stop u8 0 Opens or closes an Internet session

Internet Session rw manually�
Can also be used to determine if an
internet connection is active
0: Stop the internet connection
1: Start the internet connection
5351 0 GPRS Remote IP Domain 20 gateway� Address or domain name of the server to
Address rw proemion�com connect to (usually: address of the
Proemion server)
5352 0 GPRS Remote Port u16 60000 Port of the server to connect to
Number rw (usually: port of the Proemion server)
5353 0 GPRS TCP Socket u8 0 Selects the connection type that is to be

Mode rw used for transmitting data to a server�
0: Device establishes a TCP/IP
connection to the RM Proemion Server
1: Device establishes a TCP/IP http
connection to an http web server
(HTTP Client Application)
This setting is not stored in
the EEPROM!
After the device is
reset, the default value will
be present
51

Index Attribute
5355 0 GPRS Max Online u16 0xFFFF Maximum time in minutes after which the
Time rw Internet connection is automatically
terminated
0xFFFF: Never terminate an active Internet
connection
5356 0 GPRS Auto Online u8 0 Determines if the device automatically

Mode rw goes online after booting up
0x00: Do not establish automatic GPRS
online connection
0x55: Establish GPRS online connection
automatically after boot-up
5400 0 GPRS Proemion Domain 12 Name of the file transmitted by the

Receive Filename ro Proemion server to the device
5401 0 GPRS Proemion Domain Contents of the file transmitted by the

Receive File 1280 Proemion server to the device
ro
5402 0 GPRS Proemion u8 Indicates that new file is available

Receive File rw
0x00: No file available for reading
Indication
0x01: New file available for reading
Must be reset by the
CANopen Master to receive
new files from the Proemion
server
5420 0 GPSR Proemion Domain 12 Name of the file to be transmitted from the
Transmit Filename rw device to the Proemion server
5421 0 GPRS Proemion Domain Contents of the file to be transmitted from

Transmit File 1280 the device to the Proemion server
rw
52

Index Attribute
5422 0 GPRS Proemion u8 0 Command to send data to the Proemion

Transmit File rw server
Command
0x00: Ready for transmission (new data
can be written to OD 0x5420 and
0x5421
0x01: Transmit data block to Proemion
server
0x81: Transmit data block to Proemion
server, close file on server and make
it visible to server application
UK
The CANopen Master must
wait for this value to be
reset by the Proemion
server, then it can send
new files to the Proemion
server
5425 0 GPRS Proemion u8 0 The GPRS Logging Mode can be used to

Transmit File Mode rw automatically transmit logged CAN
messages to the Proemion server�
This function is only
available in
devices with a DATA
FLASH� If no DATA FLASH
is available, enabling this
function does not have any
influence on the
functionality of the device�
Bit 0 = 0: Deactivate Transmit Logging File

Mode
Bit 0 = 1: Activate Transmit Logging File
Mode
Bit 1: Not used
Bit 2 = 0: Local I/O state is not added to file
header
Bit 2 = 1: Add the local I/O state
(Dig�Out1, Dig�Out2,
An�In1, An�In2) to the logging File
header
This function is only
relevant for
devices with local I/O
interface
53

Index Attribute
Bit 3 = 0: Counter values are not added to

the logging file header
Bit 3 = 1: Add the GSM registration,
operating hour and SMS counter
values to the Transmit Logging
File Header
Bit 4 = 0: GPS position is not added to the
logging file header
Bit 4 = 1: Add GPS position (latitude,
longitude), time and date values
to the logging file header
Bit 5 = 0: Text from OD 0x5427 is not
added to the logging file header
Bit 5 = 1: Add the text from OD 0x5427
to the logging file header
Bit 6 = 0: J1939 mode is deactivated
Bit 6 = 1: Logged messages are stored in
the J1939 PGN format� The
J1939 transport protocol type
BAM is enabled and in addition
he CANopen boot-up message is
suppressed by the J1939 mode
Bit 7 = 0: Timestamp is not added to the
logged CAN messages
Bit 7 = 1: Time stamp (32 bit counter with
100 microseconds resolution) is
added after the last data byte of
every CAN message in the
logging file�
For a complete
documentation of how the
produced file on the
Proemion server is looking
like, please see the 'Binary
File Format - CLF'
documentation available
form Proemion
5426 0 GPRS Proemion u16 Interval in which the relevant data bytes of
Transmit File Logging rw a CAN message (configured in OD
Sample Time 0x5028) are taken and stored in the
logging file�
5427 0 GPRS Proemion Domain 12 User defined file header ASCII text, which
Transmit File Logging rw is inserted on top of the Transmit Logging
Blockheader File
54

Index Attribute
5428 0 GPRS Proemion u8 Specifies the logging file size in steps of

Transmit File Size rw 1�3 Kbytes, which has to be reached
before the file is transmitted to the
Proemion server�
Valid values: 1 to 250
5440 0 HTTP Client Domain Hostname of the HTTP Server the device
Hostname rw GSM should connect to
(Only required, if GPRS_TCP_Socket_
Mode (OD 0x5353) is set to 1) UK
5441 0 HTTP Client Domain Path to the HTML file on the target server
Pathname rw including html file name�
(Only required, if GPRS_TCP_Socket_
Mode (OD 0x5353) is set to 1)
The parameter must not

start with a slash
5442 0 HTTP Client u8 5 Number of parameters that can be used to

Parameter ro transmit data from the device to the
HTTP server�
1-5 HTTP Client Domain Parameter X in the HTML GET message

Parameter X rw sent to the HTTP server�
The respective value of this parameter has
to be entered in OD 0x5443
5443 0 HTTP Client Value u8 5 Number of values that can be used to

ro transmit data from the device to the
HTTP server�
1-5 HTTP Client Value X Domain Value X in the HTML GET message sent to
rw the HTTP server�
The parameter name of this value has to
be entered in OD 0x5442
55

Index Attribute
5445 0 HTTP Client Transmit u8 Command to send the http GET Request
Value rw to the http Web Server
0x00: Ready for transmission
(new data can be written to
OD 0x5442 and 0x5443
0x01: Transmit data block to the HTTP
web server
The CANopen Master must
wait for this value to be
reset, then it can send new
files to the HTTP server
5f00 0 Read Write EEP Domain 8KB Read/Write the complete EEPROM
Parameter File rw contents�
This parameter can be used to read the
current configuration or to send a new
configuration to the device�
56
5.9 CANopen EMCY Objects of the RM GSM Devices
Below
14.3 you will find
EMCY the description of the RM GSM device's CANopen EMCY Objects
objects
EMCY Code Error Reg Status code Description
0x6100 0x81 0x00 “Internal Software”

- Tx queue overflow (e�g� device cannot get bus access)
- Reset only by restart
0x8100 0x11 0x00 “Communication Error”

- Overrun, Error state
- Reset by next communication
0x6200 0x81 0x1X "User software“ UK

- The last GSM frame consists an invalid checksum during
the active GSM Online connection� The LSB bit toggles
after receiving an invalid GSM frame
0x4200 0x09 0x00 “Temperature”

- GSM engine is exceeding operation temperature
0xF002 0x81 0x00 “GSM CME Error”

- Generic Error that occurred during GSM network
communication�
0xF003 0x81 0x00 “GSM CMS Error”

- Error that occurred during GSM SMS transmission�
0xF004 0x81 0x00 “SIM Error”

- Submitted PIN was not correct
57

14.4 Status PDOs
5.1 CANlink
14.4.1 GSM
Modem Device Status PDOs
status
PDO type: Status PDO
PDO number: CANopen Tx PDO 1
Direction: Device to CAN
Contents of the PDO: Status of GSM modem
Comments: Contains modem status
DB0 DB1 DB2 DB3 DB4 DB5 DB6 DB7
PDO Mux Mod� Type Netw� -State Sign� -Qual� PIN State GSM Init� Modem GSM Init/
Cnt/ SIM Result State
Memory
Parameter Description Value Comments
PDO-Mux Modem status 0
Mod. -Type Modem Type 0: GSM modem
Netw.- State Network status 0: Not connected

1: Registered with home network
2: Not registered, searching for
network
3: Registration refused by network
provider
4: Unknown
5: Registered in external network
Sign.- Qual. Signal Quality 0: -113dBm or less

1: -111dBm
2-30: Between -109 and -53dBm
31: -51dBm or more
99: Unknown
PIN State State of PIN 0: PIN is wrong or not ready GSM services are only available
with a valid PIN
1: PIN is ok
Never switch on
the device
several times
with the wrong
PIN, otherwise
the SIM card will
be locked.
58
GSM Init. Cnt/ GSM Initialization GSM Initialization Counter: 1-14 GSM Init/State (DB7) and Modem
SIM Memory/ counter / Number of Result (DB6) determine the value of
SIM memory:
Data memory positions DB5�
Depends on the SIM card used,
Protection on the SIM card/ DB7 = 1 => DB5 GSM Init�Cnt�
typ� 10-14
Data Protection in
CSD Block Mode Data protection: DB7 = 0 => DB5 SIM memory
and Online Mode 0: No data protection DB6 = 1 => DB5 Data protection
1: Data protection enabled (DB7 has no meaning!)
Modem Result Contains result 0: Ok GSM Init/ State also determines the
code of the GSM contents of DB5 (see DB5 for further
modem
1: Modem has contact with
information) UK
receiver
2: Modem is called
3: No connection
4: Error
5: No dialing tone or no
dialing possible
10: GPRS connection active
11: GPRS connection +
Proemion TCP connection
active
255: Modem timeout occurred
GSM Init/State as well
GSM Init/State Contains the 0: Modem is ready GSM Init/State also determines the
initialization state of contents of DB5 (see DB5 for further
1: Modem is in initialization mode
the modem information)
59
14.4.2 Firmware
Sending Manual CANlink GSM
status
PDO type: Device status PDO
Contents of the PDO: Sending status
Comments: Contains the sending status of the modem
PDO Mux Sent DB2 DB3 DB4 DB5 DB6 DB7

Message
Type
PDO-Mux Sending status 1 Reports that data has been sent via
GSM/GPRS or contains respective error
message
Sent Message Determines the type Successful data Shows if data or a file have been sent
Type of sent message transmission using the using SMS services or GPRS/Proemion
following service: services
0x00: SMS service
0x20: GPRS/Proemion
services
If Sent Message Type = 0 (SMS):
DB2 SMS Transmit Number of SMS sent using this SIM

Counter High card (high byte)
DB3 SMS Transmit Number of SMS sent using this SIM

Counter Low card (low byte)
DB6 Sent SMS High byte of number entered To identify SMS messages, which were
Sequence Number into Object Dictionary 0x5124 transmitted to the device using
High (SMS Send Sequence the Object Dictionary, a sequence
Number) number can be assigned manually to
each short message� As soon as an
DB7 Sent SMS Low byte of number entered in SMS is sent, this PDO can be used to
Sequence Number Object Dictionary 0x5124 determine which of the stored messages
Low (SMS Send Sequence is sent�
Number) This function is not
available if the
message was sent
using the
segmented PDO
transfer�
60
14.4.3 Firmware Manual CANlink GSM

Receiving status
Contents of the PDO: Receiving status
Comments: Contains the receiving status of the modem
PDO Mux Received DB2 DB3 DB4 DB5 DB6 DB7

Type
UK
PDO-Mux Receiving status 2 Reports that new data has been

received by the GSM modem
Received Type Determines New data has been received: Shows if data or a file have been
received type received using SMS services or via
0: Via SMS
a GPRS/Proemion connection�
2: Via GPRS/Proemion
connection
If Received Type = 0 (SMS):
DB2 SIM Card address SIM card memory address where

the new SMS has been saved
61

14.4.4 Modem online
Contents of the PDO: Modem online
Comments: Reports that the device is online or busy
PDO Mux Internal

Communication
Type
PDO-Mux Modem online or 4 This PDO is sent if a CAN bus

busy member tries to request information
from the GSM modem while it is busy
or online
Internal 0: GSM modem is online

Communication
1: GSM modem transmits SMS
Type
2: GSM modem receives SMS
3: GSM modem is already
processing a request
62

14.5 Master command PDOs
5.3 CAN
14.5.1 command
Request PDOs
modem status
PDO type: Device command PDO
PDO number: CANopen RX PDO 1
Direction: CAN to device
Contents of the PDO: Request modem status
Comments:

UK
PDO Mux DB1 DB2 DB3 DB4 DB5 DB6 DB7
PDO-Mux Modem command 0

Mux
DB1 Modem command =0: Request modem status These commands

are only supported
>0: Commands for proprietary
for reasons of
segmented PDO2 transfer�
compatibility and
should not be used
for new
developments
63
14.5.2 Firmware Manual CANlink GSM

Transmit transmission buffer to remote station
PDO number: CANopen Rx PDO 1
Contents of the PDO: Transmit the contents of the sending buffer to a receiver
Start/Stop GPRS services
Comments: Prior to sending this PDO, depending on the command, a valid
destination has to be entered or the send buffer has to be loaded
with data to be sent�
PDO Mux Sending SMS Trans�

Type / GPRS Type
service
PDO-Mux Send/Receive 1
buffer
Sending Type / Specifies type of 0: Establish an online connection Requires a telephone number stored in
GPRS service transmission / to a GSM or analog network OD 0x5120� For reasons of
the GPRS service compatibility, it is also possible to
that has to be transmit the destination number via
started /stopped segmented PDO transfer
1: Establish an online connection Requires a telephone number stored in
to an ISDN network OD 0x5120� For reasons of
compatibility, it is also possible to
transmit the destination number via
segmented PDO transfer
2: Transmit an SMS This command is only supported for
reasons of compatibility and should not
be used for new developments� SMS
transmission is now completely
handled using OD entries 0x5120 –
0x5123
64

14.5.3 Select buffer or source for read operation
PDO number: CANopen Rx PDO 1
Contents of the PDO: Select buffer or source for read operation
Comments:
PDO Mux Receive DB2

Buffer /
Source UK
Selector
PDO-Mux Read receive 2 This command is only supported for

buffer reasons of compatibility and should
not be used for new developments�
SMS transmission is now completely
handled using OD entries 0x5130 –
0x5134
65

7390697uk 3106

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

7390697uk 3106

Hochgeladen von

Copyright:

Verfügbare Formate

Device manual

CAN GSM quad-band modem

1.2 Further documentation

System manual R360 (CoDeSys 2.3):

¹) Downloads with registration

2.2 Air traffic

2.4 Electronic equipment

2.6 Loss/theft of the SIM card or the radio modem

3 Functions and features

����� ������������������� ������ ������ ���

3.1 Application overview

M12 connector (5-pole) Pin Potential

5.2 Serial interface

Sub-D plug (9-pole) Pin Potential

6 Operating and display elements

LED Colour State Description

In the initialisation phase (about 5 s) the LEDs indicate no defined status.

7.2 Opening the lid

►► To open the lid slight pressure must be applied to the hinge.

7.3 Insertion of the SIM card

1. slot (SIM card holder)

7.4 Removal of the SIM card

8 Operating modes and programming

8.1.2 Basic software

8.2 With control program CoDeSys 2.3

8.2.1 Electronic Data Sheet

CoDeSys dialogue "control and CANopen configuration" (example)

*) Download area with registration

8.2.2 Library ifm_CANCOM_Vxxxxxx

8.2.3 Function TELEDATA_SMS

Input Data type Description

Output Data type Description

Output Data type Description

8.2.4 Function TELEDATA_DATA_TO_SMS

Input Data type Description

Output Data type Description

8.2.5 Function TELEDATA_DIRECT

Input Data type Description

Output Data type Description

8.2.6 Function TELEDATA_GET_GPS_DATA

Input Data type Description

Output Data type Description

8.2.7 SMS data format

8.2.8 Data security

8.2.9 Device-specific communication profile

8.3 GPRS functions

Application remote diagnosis, maintenance and parameter setting

SMS class (Short Message Service) text mode

with CANopen interface

Application remote diagnosis, maintenance, parameter setting and location tracking

SMS class (Short Message Service) text mode

GPS receiver 16 channels, NMEA 0183 compatible

Error cause Possible cause

Avoid change of position in the online mode!

11 Maintenance, repair, disposal

13 Terms and abbreviations

1000 0 Device Type u32 0x12D DS 301

1008 0 Manufacturer V�String RMGPRSP

1009 0 Manufacturer V�String HV05�00

100A 0 Manufacturer V�String SV08�28

1017 0 Producer u16 0

1018 0 Identity Object u8 4

1 Vendor ID u32 0x524d

��