Modbus Communication Protocol 5.10

In-Situ Modbus
Communication Protocol
Version 5.10
Level TROLL® 700, 500, 400

BaroTROLL® 500
Aqua TROLL® 100, 200
Rugged TROLL® 200,
Rugged BaroTROLL®
(Instruments developed with System Spec 1)
RDO® PRO
RDO® PRO-X
RDO® TITAN,
ConTROLL® PRO
(Instruments developed with System Spec 3)
Contents
1 Introduction ................................................................................................................. 6
2 Modbus Tutorial.......................................................................................................... 6
2.1 Modbus Description ............................................................................................ 6
2.2 Modbus Modes.................................................................................................... 7
2.3 Protocol Overview .............................................................................................. 7
General Message Formats ........................................................................................... 7
Data Addresses (Registers) ....................................................................................... 10
Function Codes ......................................................................................................... 11
Standard Message Formats ....................................................................................... 11
3 In-Situ Data Types .................................................................................................... 14
3.1 Short .................................................................................................................. 14
3.2 Unsigned Short.................................................................................................. 14
3.3 Long .................................................................................................................. 14
3.4 Unsigned Long .................................................................................................. 14
3.5 Float .................................................................................................................. 14
3.6 Double ............................................................................................................... 14
3.7 Character ........................................................................................................... 15
3.8 String ................................................................................................................. 15
3.9 Time .................................................................................................................. 15
4 Exception Codes ....................................................................................................... 16
5 Probe Register Map Layout ...................................................................................... 16
6 Probe Common Registers ......................................................................................... 17
6.1 Register Map Template Id ................................................................................ 19
6.2 Device Id ........................................................................................................... 19
6.3 Device Serial Number ....................................................................................... 19
6.4 Manufacture Date .............................................................................................. 19
6.5 Firmware, Boot Code, Hardware Versions ....................................................... 19
6.6 Max Data Logs .................................................................................................. 19
6.7 Total Data Log Memory ................................................................................... 19
6.8 Total Battery Ticks............................................................................................ 19
6.9 Last Battery Change .......................................................................................... 19
6.10 Device Name ..................................................................................................... 19
6.11 Site Name .......................................................................................................... 20
6.12 Coordinates ....................................................................................................... 20
6.13 Current Time ..................................................................................................... 20
6.14 Device Status .................................................................................................... 21
6.15 Used Battery Ticks ............................................................................................ 21
6.16 Serial Communication Configuration ............................................................... 22
Baud Rates ................................................................................................................ 22
RTU Settings ............................................................................................................. 23
ASCII Settings .......................................................................................................... 23
6.17 Max Message/Response Size ............................................................................ 23
6.18 Message Counters ............................................................................................. 23
6.19 Probe Connection Registers .............................................................................. 24
Modbus Networking - Level TROLL, BaroTROLL, Aqua TROLL & RDO PRO-X Page 2 of 62
Max Probe Connections ............................................................................................ 24
Probe Connection Status ........................................................................................... 24
Controller/Probe Addressing .................................................................................... 24
6.20 Sensor Connection Registers ............................................................................ 24
Max Sensor Connections .......................................................................................... 24
Sensor Connection Status ......................................................................................... 24
6.21 Sensor Map Registers ....................................................................................... 24
Sensor Id Registers ................................................................................................... 24
Sensor Status Register............................................................................................... 25
Sensor Command Register ........................................................................................ 25
Sensor Data Register Map Version Registers ........................................................... 25
Sensor Data Register Map Offsets ............................................................................ 25
Sensor Data Cache Timeout (SIS-3 Only) ................................................................ 26
6.22 Current Loop Configuration (SIS-3 Only) ........................................................ 26
6.23 Logged Record Registers (SIS-3 Only) ............................................................ 27
Number of Logged Records ...................................................................................... 27
Requested Log Record Number ................................................................................ 27
Record Time Stamp .................................................................................................. 27
Parameter Measured Value and Data Quality ........................................................... 27
7 Sensor Common Registers ........................................................................................ 28
7.1 Sensor Id Register ............................................................................................. 29
7.2 Sensor Status Register....................................................................................... 29
7.3 Calibration Times.............................................................................................. 29
7.4 Warm-up Time .................................................................................................. 29
7.5 Fast Sample Rate ............................................................................................... 29
7.6 Alarm Parameter Number ................................................................................. 29
7.7 Alarm Enable Bits ............................................................................................. 29
7.8 Alarm Set Points ............................................................................................... 30
7.9 Parameter Blocks .............................................................................................. 30
8 Level TROLL / BaroTROLL Registers .................................................................... 31
8.1 Pressure Units Id ............................................................................................... 31
8.2 Temperature Units Id ........................................................................................ 32
8.3 Level Parameter Id ............................................................................................ 32
8.4 Level Units Id ................................................................................................... 32
8.5 Sensor Calibration Registers ............................................................................. 32
Specific Gravity ........................................................................................................ 33
Pressure Offset .......................................................................................................... 33
Level Reference ........................................................................................................ 33
8.6 Other Level TROLL Registers .......................................................................... 34
Total Measurements Counter .................................................................................... 34
Battery Measurements Counter ................................................................................. 34
Analog Control Registers .......................................................................................... 34
9 Aqua TROLL 200 Registers ..................................................................................... 35
9.1 Pressure Units Id ............................................................................................... 37
9.2 Temperature Units Id ........................................................................................ 37
9.3 Level Parameter Id ............................................................................................ 37
9.4 Level Units Id ................................................................................................... 37
Specific Gravity ........................................................................................................ 38
Pressure Offset .......................................................................................................... 38
Level Reference ........................................................................................................ 39
Cell Offset and Cell Constant ................................................................................... 39
Local Gravity Constant ............................................................................................. 39
9.6 Other Aqua TROLL 200 Registers ................................................................... 40
Parameter Buffer Timeout ........................................................................................ 40
10 Aqua TROLL 100 Registers ..................................................................................... 41
10.2 Other Aqua TROLL 100 Registers ................................................................... 44
Parameter Buffer Timeout ........................................................................................ 44
11 Aqua TROLL 400 and 600 Registers ....................................................................... 45
12 RDO PRO / RDO PRO-X / RDO TITAN Registers ................................................ 45
12.1 RDO PRO / RDO PRO-X Calibration Registers. ............................................. 46
Live Salinity Value ................................................................................................... 46
Default Salinity Value ............................................................................................... 46
Live Barometric Pressure .......................................................................................... 46
Default Barometric Pressure ..................................................................................... 46
100% Saturation Calibration Values ......................................................................... 46
0% Saturation Calibration Values ............................................................................. 47
Calibration Slope and Offset ..................................................................................... 47
Calibration Procedure ............................................................................................... 47
13 ConTROLL PRO ...................................................................................................... 49
13.1 Probe Measurement Cache................................................................................ 50
13.2 Control PRO Measurement Registers ............................................................... 52
13.3 Other Registers.................................................................................................. 52
14 RS485 Network Guidelines ...................................................................................... 53
Appendix A: Exception Codes ......................................................................................... 54
Appendix B: Device Ids ................................................................................................... 56
Appendix C: Sensor Ids ................................................................................................... 57
Appendix D: Parameter Ids .............................................................................................. 58
Appendix E: Unit Ids ....................................................................................................... 59
Appendix F: Data Quality Ids .......................................................................................... 61
Appendix G: DB-9 pin Pinout ......................................................................................... 62
Revision History
Date Revision Description
08/09/2005 Draft Initial draft
08/29/2005 000 Initial release
09/29/2005 1.0 Added DB-9 pin out (Appendix D)
01/30/2006 2.0 Added section numbers, added Level TROLL 300 device ID, added RS485
Network Guidelines
3/16/2006 3.0 Added Revision History, added Level TROLL 300 & BaroTROLL fast
sampling to device register table
4/3/2006 4.0 Added Modbus Tutorial
11/16/2006 5.0 Updated for the Aqua TROLL 200
8/25/2008 5.1 Updated for the LevelTROLL 100
10/8/2008 5.2 Corrected RDO partial pressure parameter id.
Added Aqua TROLL 100.
Added Level TROLL 200.
11/05/2008 5.3 Added unit conversions for pressure
06/17/2009 5.4 Added sensor connection registers, SIS3 logging and analog configuration
registers, ConTROLL PRO
10/16/2009 5.5 Added clarification for register map designation 4XXXX
05/07/2010 5.6 Updated for Rugged TROLL product line
02/15/2011 5.7 Updated Slave-Id format to include device address.
01/03/2011 5.8 Updated for RDO TITAN.
09/10/2013 5.9 Updated for RDO PRO-X
07/02/2015 5.10 Updated Data Quality IDs, common registers 0005 and 0008 to show the
differences between Sys. 1 and Sys 3 instruments. Removed references to
obsolete products.
In-Situ, the In-Situ logo, TROLL, BaroTROLL, RDO PRO, RDO PRO-X and
ConTROLL PRO are registered trademarks of In-Situ Inc. © 2015 by In-Situ Inc. All
rights reserved.
1 Introduction
The In-Situ Rugged TROLL 200 and Rugged BaroTROLL support Modbus with their
direct connect cable accessory. All other instruments referenced in this document
support Modbus as their primary communication protocol.
Section 2 of this document is an In-Situ generated Modbus protocol tutorial intended to

accelerate the learning curve for someone new to the protocol.
The remaining sections of this document provide the information required to program a
PLC/DCS and/or SCADA system to poll data from an In-Situ Modbus device. The user is
expected to have a working knowledge of Modbus (or refer to Section 2 below).
This document is not an official protocol document. More information about Modbus,
including protocol specifications, can be downloaded from www.modbus.org.
2 Modbus Tutorial
2.1 Modbus Description
Modbus is a lightweight communication protocol developed in the late 1970’s by
Modicon as a digital communication protocol for its PLC’s. The protocol requires very
little code space and processing power to implement and has become a worldwide
favorite for embedded devices. Modbus is royalty free and the specifications and
standards can be downloaded from the web.
Modbus is a transport protocol. What this means is that Modbus does not have any
protocol features that indicate what types of data are being transported in a message
packet. This is similar to TCP/IP, the internet protocol standard. If we use TCP/IP as an
example, consider that when a person connects to a web site, the primary data content
being moved via TCP/IP is HTML. When a person downloads an instrument manual
from an FTP site, typically the data content being moved is an Adobe PDF file. In both
cases, TCP/IP is used as the protocol. The TCP/IP protocol simply ensures all the bytes
(whatever they represent) are transferred from point A to point B correctly. Modbus is
similar in concept. It provides a transport mechanism to move data safely over a
communication link from a device to a computer.
Modbus can be used on a wide variety of communication links. In most applications, the
protocol is used over an RS485 or RS232 link. This is because these types of
communication links are inexpensive and efficient, perfectly suited for communication
with embedded devices. Modbus can also be used over wireless radios, satellites, TCP/IP
(Ethernet, token ring, etc.) and any other protocol-independent communication link.
Modbus is designed to be a Master/Slave protocol. This means that the protocol assumes
that a single Master computer will initiate control and commands to the slave devices.
The slave devices do not send any data on the communication link unless specifically
asked for that data by the Master. This is very different from a typical computer network
like Ethernet which is peer-to-peer. In a peer-to-peer network, any device can
communicate with any other device. A peer-to-peer network requires that network
arbitration takes place so that there is only one device transmitting a message at a time.
This requires more costly hardware usually not available in a small device network.
2.2 Modbus Modes

Modbus message packets can be formatted in three ways, RTU, ASCII and IP.
• RTU is the format of choice for hard connected serial connections such as RS485
or RS232 because it is the most compact and therefore the most efficient.
• ASCII format is required for any kind of wireless serial communications because
it eliminates the message timing requirements needed for RTU mode. Message
timing can be erratic over a wireless link.
• IP formatted messages can be used when the messages are transported using a
secondary transport protocol such as TCP/IP. In this case the secondary transport
protocol ensures that all of the packet bytes are transported correctly.
Additionally, this format provides for packet sequence numbering because the
secondary transport layer eliminates the synchronous Master/Slave nature of the
serial RTU/ASCII formats.
In-Situ devices support RTU and ASCII modes.
2.3 Protocol Overview

Modbus provides message structures to read and write data to/from a device. The
protocol also provides for the extension of the protocol to permit customization of the
message structures. In-Situ adheres to the standard read/write message structures in its
implementations. Modbus does not provide as part of the standard, a suitable file transfer
message structure. For this function, In-Situ has used a protocol extension to satisfy the
downloading of data files from In-Situ devices.
General Message Formats

The general message format consists of a device address, a function code, a data payload
and a message validity checksum. For each of the 3 modes (RTU, ASCII and IP), the
message format changes as described below.
2.3.1.1 RTU Message Format

The RTU message format allows the transmission of bytes of data encompassing the full
range of values per byte 0-255. There are no start or ending characters to indicate the
beginning or end of the packet. The end of packet is signaled by a time delay equivalent
to a 3 byte transfer time on the communication link without any data transmitted.
Computer (Master) Message Format:

Device Function Data Payload CRC
Address Code
• Device Address: 1 byte field with a value ranging from 1 to 247. Broadcast
address is 0.
• Function Code: 1 byte field with a value range 1-127 representing the standard or
extended function code. The function code tells the device what operation is to
take place (i.e. Read/Write).
• Data Payload: 0-N bytes with information required to complete the requested
function code operation.
• CRC: 2 bytes with a value computed mathematically from the message bytes.
This value can be computed on both sides of the link and verified to ensure that
the bits of the message were transmitted and received correctly.
Device (Slave) Response Format:
Device Function Data Payload CRC

Address Code
• Device Address: Echo of device address sent in the message to the device. A
broadcast message will not generate a response.
• Function Code: Echo of the function code sent to the device in the message packet.
If an error occurs, the top bit of the byte is set and the data payload is the 1 byte
error code from the device.
• Data Payload: 0-N bytes with response data from the device. For an error
response, the payload will be a 1 byte value 1-255.
• CRC: 2 bytes with a value computed mathematically from the message bytes.
This value can be computed on both sides of the link and verified to ensure that
the bits of the message were transmitted and received correctly.
2.3.1.2 ASCII Message Format

The ASCII formatted message is for the most part identical in content to the RTU
formatted message with the addition of the Start Of Packet (SOP) and End Of Packet
(EOP) characters. The SOP character is a ‘:’ and the EOP is the combination carriage
return <CR> (0x0D) followed by a linefeed <LF> (0x0A).
The contents of the packet are converted to 2 byte hex characters 0-9 and A-F. For
example, the 1 byte device address 25 would be two bytes 0x3235 where 0x32 is the
ASCII character ‘2’ and 0x35 is the ASCII character ‘5’. This ensures that the message
contents never contain SOP or EOP characters.
The check value uses a different mathematical algorithm and is called an LRC.

Start Device Function Data Payload LRC End
Packet Address Code Packet
• Start Packet: the ‘:’ character signals the start of an ASCII packet.
• Device Address: 2 byte field containing the device address 1-247 in hex
characters.
extended function code in hex characters.
function code operation. Each data byte is represented in its two byte hex
character format.
• LRC: 2 bytes represented in hex characters with a value computed mathematically
from the message bytes. This value can be computed on both sides of the link and
verified to ensure that the bits of the message were transmitted and received
correctly.
• End Packet: the <CR><LF> characters.

Start Device Function Data Payload LRC End
Packet Address Code Packet
• Start Packet: the ‘:’ character signals the start of an ASCII packet.
• Device Address: 2 byte field containing the device address 1-247 in hex
characters.
extended function code in hex characters.
• Data Payload: 0-N bytes with response data from the device in hex characters.
For an error response, the payload will be a 1 byte value 1-255.
• LRC: 2 bytes represented in hex characters with a value computed mathematically
from the message bytes. This value can be computed on both sides of the link and
verified to ensure that the bits of the message were transmitted and received
correctly.
• End Packet: the <CR><LF> characters.
2.3.1.3 IP Message Format

The IP message format is based on the RTU format but eliminates the CRC because
TCP/IP will ensure that the message bytes are transmitted correctly. In-Situ devices do
not support this message format.
Additionally, TCP/IP is an asynchronous protocol. The significance is that the device

must send its response to the address of the sender (computer). This differs from the
serial RTU and ASCII formats where the protocol assumes only a single master device
(computer) which does not have an address. For this reason, the IP format has a different
header than the RTU serial formatted message.

Xac Id Protocol Msg Device Function Data Payload
Id Length Address Code
• Xac Id: 2 byte transaction id to provide for asynchronous messages.
• Protocol Id: 2 byte field – always 0.
• Length: 2 byte field represents number of bytes following.
• Device Address: 1 byte field with a value ranging from 1 to 247. Broadcast
address is 0.

Xac Id Protocol Msg Device Function Data Payload
Id Length Address Code
• Xac Id: transaction id echoed from message.

• Protocol Id: 2 byte field – always 0.
• Length: 2 byte field represents number of bytes following.
• Device Address: Echoed from message. No response for broadcast.
Data Addresses (Registers)

As shown in the section pertaining to message formats, the function code from the
Master’s message tells the Slave device what operation to perform. There are a number of
standard function codes defined by Modbus. These functions typically operate on atomic
chunks of data historically and generically called registers. A register is quite simply a
data address. A Modbus device will always have a published “Register Map” that
defines the numerical addresses of data values that can be accessed in the device.
Note: Register Maps typically use 1-based numbering system whereas the protocol
requires that the data address/register number passed to a device to be 0-based. In this
document, the register maps are 1-based.
Data addresses are associated with two atomic sizes of memory, 1 bit and 2 bytes (word).
These are divided into Read-Only Bits, Read/Write Bits, Read-Only Words and
Read/Write Words each with their own associated name as follows:
• Discretes: Read Only Bits
• Coils: Read/Write Bits
• Input Register: Read Only Word
• Holding Register: Read/Write Word
All In-Situ Registers are Holding Registers.
Function Codes
Function codes in a message packet tell the device what operation to perform. The
function code is always in the byte following the device address. Some of the standard
function codes are as follows:
01: Read Coil
02: Read Discrete
03: Read Holding Registers
04: Read Input Registers
05: Write Coil
06: Write single Holding Register
15: Write multiple Coils
16: Write multiple Holding Registers
17: Read slave device id
22: Mask write Holding Register
The slave id is an implementation defined response that will vary with manufacturer
and/or device.
Function codes from 65 to 72 and 100 to 110 can be used as custom function codes.
Standard Message Formats

In-Situ has implemented a sub-set of the standard function codes in every Modbus
product. These message formats are defined in this section.
2.3.1.4 Read Holding Registers

This command reads one or more registers from a device.
Message (8 bytes): Response (5 + N bytes):
Address 1 Byte 1-247 Address 1 Byte 1-247
Function Code 1 Byte 0x03 Function Code 1 Byte 0x03
Data Address 2 Bytes 0 to 0xFFFF Byte Count 1 Byte 0 to 0xFA
Register Count 2 Bytes 0 to 0x7D Data Payload N Bytes
CRC 2 Bytes CRC 2 Bytes
• Where Byte Count is the #bytes in the Data Payload (does not include CRC bytes).
Byte Count = 2 * Register Count.
2.3.1.5 Write Holding Register

This command sets a single register in a device.
Message (8 bytes): Response (8 bytes – message echo):

Data Address 2 Bytes 0 to 0xFFFF Data Address 2 Bytes 0 to 0xFFFF
Data Payload 2 Bytes 0 to 0xFFFF Data Payload 2 Bytes 0 to 0xFFFF
2.3.1.6 Write Holding Registers
This command sets one or more registers in a device.
Message (9 + N bytes): Response (8 bytes):
Register Count 2 Bytes 1 to 0x7B Register Count 2 Bytes 0 to 0x78
Byte Count 1 Byte 2 to 0xF0 CRC 2 Bytes
Data Payload N Bytes
CRC 2 Bytes
• Where Byte Count is the #bytes in the Data Payload (does not include CRC bytes).
Byte Count = 2*Register Count.
• The register count is limited to a single data format field. If an attempt is made ot
write a data field with an incorrect register count, the device will return a Modbus
exception response with error code 0x80.
2.3.1.7 Mask Write Register

This command will set and/or clear one or more bits in a single register.
Message : Response:
And_Mask 2 Bytes 0 to 0xFFFF And_Mask 2 Bytes 0 to 0xFFFF
Or_Mask 2 Bytes 0 to 0xFFFF Or_Mask 2 Bytes 0 to 0xFFFF
Register = (Register Value AND And_Mask) OR (Or_Mask AND (NOT And_Mask))

And_Mask: 0 = bits to change, 1 = bits to leave unchanged.
Or_Mask: 0 = bits to clear, 1 = bits to set.
Example: - set bit 1 (LSB), clear bit 2, leave remaining bits unchanged
Old Value: 0x007E 0000 0000 0111 1110
And_Mask: 0xFFFC 1111 1111 1111 1100
Or_Mask: 0x0001 0000 0000 0000 0001
New Value: 0x007D 0000 0000 0111 1101
This command is useful in a bit mapped register where the Master wants to set some bits
of a register that are mapped to a feature without disturbing the other bits of the register
that might be mapped to a different feature.
2.3.1.8 Report Slave Id
This command query’s a device for id information.
Message (4 bytes): Response (N bytes):
CRC 2 Bytes Byte Count 1 Byte 0 to 0xFF
Slave Id 1 Byte 0 to 0xFF
Run Status 1 Byte 0 to 0xFF
Data Payload N Bytes
CRC 2 Bytes
• The Data Payload layout is defined in the Slave Id Format section.

• The Byte Count field is the number of bytes from the Slave Id field to the end of
the Data Payload (excludes the 2 byte CRC).
• Run Status – must be 0x00 or 0xFF.
In-Situ Slave Id Layout Example

Byte Field Description Type Value
Offset
0 Device Address byte 1-247
1 Function Code byte 0x11
2 Byte Count byte 23
3 Slave Id byte 0x49 (‘I’)
4 Run Status Indicator byte 0x00 = Off, 0xFF = On
Device Specific Info
5 Slave Id Format Version Id byte 0x01
Format Version 1 Id Block
6-7 Manufacturer Id ushort 0x5349 (‘SI’)
8-9 Device Id ushort
10-11 Application Firmware Version ushort Version * 100
12-13 Boot Code Firmware Version ushort Version * 100
14-15 Hardware Version ushort
16-17 Register Map Template Id ushort
18-21 Device Serial Number ulong
22-23 Max Message/Response Size (bytes) ushort
24-25 Max Baud Rate Id ushort
26-27 CRC
The specific field values such as device id, baud id…etc are documented in the sections
that follow.
3 In-Situ Data Types
Modbus defines all I/O in terms of 2 byte blocks called registers. Modbus does not
formally define blocks for floating point values or strings. In the In-Situ implementation,
these fundamental types and others are handled by combining two or more registers. The
In-Situ data type implementations are defined in the following sections.
3.1 Short
A 2 byte signed integer contained in a single register data address. IEEE standard.
MSB SXXX XXXX XXXX XXXX LSB
Byte 0 Byte 1
where ‘S’ = sign bit.
3.2 Unsigned Short

A 2 byte unsigned integer contained in a single register data address. IEEE standard.
MSB XXXX XXXX XXXX XXXX LSB
Byte 0 Byte 1
3.3 Long
A 4 byte signed integer contained in two register data address’s. IEEE standard.
MSB SXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX LSB
Byte 0 Byte 1 Byte 2 Byte 3
where ‘S’ = sign bit.
3.4 Unsigned Long

A 4 byte unsigned integer contained in two register data address’s. IEEE standard.
MSB XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX LSB
3.5 Float
IEEE 4 byte numeric standard – 1 sign bit, 8-bit exponent, 23-bit mantissa.
MSB SXXX XXXX XMMM MMMM MMMM MMMM MMMM MMMM LSB
where ‘S’ = sign bit, ‘X’ = exponent bits and ‘M’ = mantissa bits.
3.6 Double
IEEE 8 byte numeric standard – 1 sign bit, 11-bit exponent, 64-bit mantissa.
MSB SXXX XXXX XXXX MMMM MMMM MMMM … MMMM MMMM LSB
where ‘S’ = sign bit, ‘X’ = exponent bits and ‘M’ = mantissa bits.
3.7 Character
A 2 byte Unicode character contained with a single register data address.
3.8 String
The number of consecutive registers in the register map will represent the maximum
string length in Unicode characters excluding any termination characters. For example, a
6 register string can have 6 Unicode characters. When reading/writing a string, all
register values must be transmitted. If the string to be written does not require the full
defined field length, the extra bytes must be padded with the value 0x0000 to reach full
length. A string termination character is not required, all registers may contain a character.
Failure of the Master device to transmit or request all registers of a string field will be
rejected by the Slave device with the Modbus exception error code 0x80.
3.9 Time
Represented by a 6 byte (3 register) number. The first 4 bytes represent the number of
seconds since 00:00:00 January 1, 1970 UTC, MSB first, not adjusted for DST. The 5 th
and 6th bytes are fractions of a second represented by the bits in powers of 2 starting with
the MSB. If a device does not have the ability to support the full fractions of a second
resolution available in the time format, unused bits must be set to 0.
Register (N) Register (N+1) Register (N+2)
MSB Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 LSB
Seconds after reference time, MSB First,

UTC
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

1/2 sec 1/4 sec 1/8 sec 1/16 sec 1/32 sec 1/64 sec 1/128 sec 1/256 sec
Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

1/512 sec 1/1024 sec 1/2048 sec 1/4096 sec 1/8192 sec 1/16384 sec 1/32768 sec 1/65536 sec
Time Example: For a time value of 0x001A5E00C000, the bytes 0x001A5E00 represent
the whole number of seconds from the reference time. The bytes 0xC000 represent the
additional fractional number of seconds as shown in the diagram above. In this example,
the whole number of seconds represents 20 days and the fractional seconds represents
750ms.
4 Exception Codes
In-Situ supports the standard modbus exception codes but also provides additional
exception codes to assist with troubleshooting problems. The exception codes are listed
in Appendix A.
5 Probe Register Map Layout

Each probe and sensor will follow a common layout pattern which provides consistency
and improves code reuse between platforms. All In-Situ registers are Holding
Registers. The common probe register map layout is as follows:
Probe Common Sensor Common Other Registers

Registers Registers xxxx-xxxx
9000 - 9209 1 - 38
Parameter
1 Registers
38 - 45
Parameter
2 Registers
46 - 53
Parameter N
Registers
Registers
xx – –xx+8
490xx 400xx
All registers in this document are 1-based. This means the actual packets sent to the
devices must have a data address 1 less than what the register number is in this
document.
6 Probe Common Registers
The new In-Situ communication system implemented by the Level TROLL and
BaroTROLL provides for a set of data fields that are to be at the same register address for
all devices. These common holding registers are defined in the table below:
Common Register Map

Register Size Mode Data Description
XXXX (registers) (R/W) Type
9000 1 R ushort Register Map Template Version (SIS Level)
9001 1 R/W ushort Device Id
9002-003 2 R/W ulong Device Serial Number
9004-006 3 R/W time Manufacture Date
9007 1 R ushort Firmware version * 100
9008 1 R ushort Boot Code version * 100
9009 1 R ushort Hardware version
9010 1 R ushort Max Data Logs
9011-012 2 R ulong Total Data Log Memory (bytes)
9013-014 2 R ulong Total Battery Ticks
9015-017 3 R/W time Last Battery Change
9018 1 Reserved
9019-050 32 R/W string Device Name
9051-082 32 R/W string Site Name
9083-086 4 R/W double Latitude Coordinate (degrees) (negative = east)
9087-090 4 R/W double Longitude Coordinate (degrees) (negative = south)
9091-094 4 R/W double Altitude Coordinate (meters)
9095-096 2 Reserved
9097-099 3 R/W time Current time (UTC)
9100-101 2 R 32 bits Device Status
9102-103 2 R/W ulong Used Battery Ticks
9104-105 2 R ulong Used Data Log Memory (bytes)
Communication Control Registers

9200 1 R/W ushort Device Address (1-247, default = 1)
9201 1 R/W ushort Serial Communication Configuration
9202 1 R/W ushort EOM timeout (1000-15000 ms, default = 1000)
9203 1 R/W ushort EOS timeout (5000-60000 ms, default = 5000)
9204 1 R ushort Max allowed baud rate id (0-7)
9205 1 R ushort Max Message/Response size (bytes)
9206-207 2 R/W ulong Good message counter
9208 1 R/W ushort Bad message counter
9209 1 R/W ushort Exception response counter
Probe Connection Registers
9297 1 R1 ushort Max Probe Connections (1-32)
9298-299 2 R1 32 bits Probe Connection Status
Sensor Connection Registers

9300 1 R1 ushort Max Sensor Connections (1-32)
9301-302 2 R1 32 bits Sensor Connection Status
Sensor Map Registers

9303 1 R1 ushort Connection 1 sensor id
9304 1 R1 16 bits Connection 1 sensor status
9305 1 R1/W2 ushort Connection 1 sensor command
9306 1 R1 ushort Connection 1 sensor data register map version
9307 1 R1 ushort Connection 1 sensor data register offset
9308-462 5 x 31 Connections 2-32 patterned after connection 1
9463 1 R1/W3 ushort Sensor Data Cache Timeout (0-60000 msec)
Current Loop Configuration Registers (Register Map Version 3+)

9501 1 R1/W3 ushort Current loop sensor number
9502 1 R1/W3 ushort Current loop parameter number
9503-504 2 R1/W3 float Current loop 20 mA setpoint (I20)
9505-506 2 R1/W3 float Current loop 4 mA setpoint (I4)
9507 1 R1/W3 ushort Current loop enable (0 = off, 1 = on)
Logged Record Registers (Register Map Version 3+)

9600-601 2 R1 ulong Number of logged records
9602-603 2 R1/W3 ulong Requested log record number
9604-606 3 R1 time Time stamp for record
9607-608 2 R1 float Parameter 1 measured value
9609 1 R1 ushort Parameter 1 data quality id
96010-696 29 x 3 R1 --- Parameters 2 – 30 (30 is max allowed #log parameters)
6.1 Register Map Template Id
This is a number that represents the version of the reserved register map supported by the
device. This provides for the modification of the reserved register map at a future date
and detection of this difference by the Master. This register is commonly referred to as
the System Interface Specification Level or (SIS Level).
6.2 Device Id
This is the id number for the device. Each device in the system will receive a unique id
number. See Appendix B for device ids.
6.3 Device Serial Number

This is a 6 digit serial number for the device. Serial numbers for devices in this system
will range from 000001 to 999999.
6.4 Manufacture Date

This is the date and time of manufacture in the In-Situ time format.
6.5 Firmware, Boot Code, Hardware Versions

The firmware and boot code versions will be the floating point version multiplied by 100
to create an integer. For example, version 1.32 will be stored as 132. The hardware
version will be a non-scaled integer that represents the circuit board version. The
hardware version will be calculated by the firmware based on parameters determined
from the circuit board components.
6.6 Max Data Logs

This register indicates the maximum number of data logs that can be stored in the device.
If data logs are not supported by the device, this register will be zero.
6.7 Total Data Log Memory

This represents the total amount of data log memory in bytes.
6.8 Total Battery Ticks

This represents the total battery capacity in “ticks”. A tick represents approximately 1
microamp-hour. For more see section below on Battery Status.
6.9 Last Battery Change

This represents the date and time of the last internal battery change. For Level TROLL
and BaroTROLL products, the internal battery is sealed and cannot be replaced. For
these products, this value will not change after manufacture.
6.10 Device Name

This is a general-purpose 32 character string representing a user-defined device name or
identifier.
• If an attempt is made to change the device name while logging, the device will
return an exception response with error code 0xA0 (Illegal write with running log).
6.11 Site Name

This is a 32 character string that represents the location where the instrument is recording
data.
• If an attempt is made to change the site while logging, the device will return an
exception response with error code 0xA0 (Illegal write with running log).
6.12 Coordinates
These registers are used by the computer to store the coordinates of a device when taking
measurements. The device expects coordinates in meters and degrees.
• A negative latitude value represents south, a negative longitude value represents
east.
• If an attempt is made to change the coordinates while logging, the device will
return an exception response with error code 0xA0 (Illegal write with running log).
6.13 Current Time

This represents the time in the device in UTC.
6.14 Device Status
The device status register holds general status information. Each set bit represents a
status value. There are a limited number of standardized predefined status values that all
devices will support. These predefined status values are contained in the lower register.
The upper register is reserved for device specific status values.
Device Status Bit Values

Bit Category Description
0 Alarm Sensor high alarm
1 Warning Sensor high warning
2 Warning Sensor low warning
3 Alarm Sensor low alarm
4 Warning Sensor calibration warning
5 Alarm Sensor malfunction
6-7 N/A Reserved
8 Status Power management disabled.
9 Status Device off line
10 Alarm Device hardware reset occurred
11 Alarm Device malfunction
12 Status No external power.
13 Warning Low battery – battery capacity < 5%
14 Warning Low memory – data log memory
capacity < 5%
15 N/A Reserved
16- N/A Available for device-specific status
31
Bits 0-7 of the device status register are reserved for sensor status. These bits are the
logical OR of bits 0-7 of the sensor status register in each sensor connection.
Bits 8-15 of the device status register are reserved for common device status. Any bit in
this range that is not applicable to a device will be set to zero.
Bits 16-31 of the device status register are available for device-specific status. Any bit in
this range that is not utilized by a device will be set to zero.
6.15 Used Battery Ticks

This represents the approximate number of microamp-hours that have been used by the
device.
6.16 Serial Communication Configuration
The 16 bits in this register are mapped to the communication parameters. The bits are
mapped as follows:
Bits Description
0 Modbus Transmission Mode
0 = RTU (default)
1=ASCII
1,2 & 3 Baud Rate Id
0 = 9600 (mandatory)
1 = 19200 (default)
2 = 38400
3 = 57600
4 = 115200
5 = 128000
6 = 230400
7 = 256000
4 Data Bits
0 = 7 data bits
1 = 8 data bits (default)
5,6 Parity Bits
0 = Even (default)
1 = Odd
2 = None
7 Stop Bits
0 = 1 Stop Bit (default)
1 = 2 Stop Bits
8-15 Unassigned
When the communication configuration register is changed, the Modbus response will be
sent to the Master at the current configuration (mode, baud, parity, data bits…etc). After
the response has been sent to the Master, the device will switch to the new settings.
The Master software must switch communications to the new settings after receiving a
positive Modbus response to the write message. The Master software should confirm the
new settings by reading back the device address and communication configuration
register.
Baud Rates
All devices will support 9600 and 19200 baud rates. A device will support all baud rates
from 9600 up to and including the maximum baud rate as specified by the Max Baud
Rate Id register.
• If the Master attempts to set the baud rate of a device to a non-supported value,
the device will respond with a Modbus exception error code 3 (Illegal Data
Value).
• Baud rates will be referenced in this document by the id 0-7.
• The Level TROLL and BaroTROLL support baud rates up to 3 (57600).
RTU Settings
Every device supporting serial communications will implement Modbus RTU. The
device will at a minimum support the standard settings defined below.
• 1 Start Bit
• 8 Data Bits
• 1 Parity Bit
• 1 Stop Bit
• Even Parity
Note: 7 data bits is not a valid setting for Modbus RTU communication. If an attempt is
made to write RTU mode with 7 data bits, the device will return an exception with error
code 0x84 (Write Illegal Value).
ASCII Settings
When implementing Modbus ASCII, the device will at a minimum support the standard
settings defined below.
• 1 Start Bit
• 7 Data Bits
• 1 Parity Bit
• 1 Stop Bit
• Even Parity
6.17 Max Message/Response Size

This register indicates to the Master the largest message or response the device can accept.
This may vary based on the hardware configuration of the device.
6.18 Message Counters

The message counter registers are to provide diagnostic information for troubleshooting
communication problems. The counters will not roll over and can only be cleared using
Win-Situ.
There are 3 message counter registers allocated as follows:

• Good Message Counter – count of number of properly formatted messages
received that are addressed to this device
• Bad Message Counter – count of number of improperly formatted messages
received (i.e. bad CRC). Bad messages might not be associated with this device
because it is impossible to determine if a bad message was addressed to the device
or not.
• Exception Response Counter – count of the number of messages received that
were rejected with a Modbus exception response.
6.19 Probe Connection Registers
Max Probe Connections
Each controller can have attached to it up to 32 probes. For the attached probes, the
controller acts as a gateway, passing thru messages to the connected probes. The
controller maps unique addresses to each connected probe starting at the next higher
modbus address than the controller (if controller is at address 5, first probe is at address
6). Messages sent to the controller for a probe will be remapped to the protocol and
address of the attached probe. Responses from a probe to the Modbus master are
protocol and address converted before being sent back to the master.
Probe Connection Status

Each bit when set indicates that the controller is actively connected to a probe on the
corresponding connection/port. The bit position 0-31 is used to determine the modbus
device address offset (from the controller) of the attached probe. For example, if bit 5 is
set and the controller is at address 5, then the probe on the 6 th port is at address 11.
Controller/Probe Addressing
Since controllers will map virtual device addresses to the connected probes, the
controller’s modbus address range must be less than the max 247 by the number of
allowed probes. For example, if a controller supports two probes, the max allows address
for the controller is 245 where address 246 is mapped to the first probe and address 247 is
mapped to the second probe.
6.20 Sensor Connection Registers

Max Sensor Connections
Each probe or controller can present up to 32 sensor images to the outside world. These
sensors may be real sensors plugged into physical ports, sensors on the internal PCB or it
may be virtual sensors created from derived information. This register tells how many
sensor images are being presented by the probe or controller at the time it is read.
Sensor Connection Status

Each bit when set indicates that the probe or controller is actively presenting a sensor
image on the corresponding port. The bit position 0-31 is used to determine the sensor
map register group to use to control the sensor or access its data block.
6.21 Sensor Map Registers

Sensor Id Registers
These registers duplicate the sensor id register provided in each sensor’s Sensor Data
Header Register block (refer to the Sensors section). If a sensor connection is open, the
probe shall return a zero. If an attempt is made to access a sensor id register that is not
mapped to a sensor (one that exceeds the maximum number of sensors supported by the
probe), the probe will return an exception response with error code 0x02 (illegal data
address).
Sensor Status Register
These registers duplicate the sensor status register provided in each sensor’s Sensor Data
Header Block (refer to the Sensors section). If a sensor connection is open, the probe
shall return a zero. If an attempt is made to access a sensor status register that is not
address).
Sensor Command Register

These registers are used to send commands to a sensor. The behavior of the sensor
command register and the commands available is different from SIS-1&2 and SIS-3. The
sensor command register is primarily used to calibrate the sensor. Failure of the
command is returned in the response exception.
If an attempt is made to access a sensor command register that is not mapped to a sensor
(one that exceeds the maximum number of sensors supported by the probe), the probe
will return an exception response with error code 0x02 (illegal data address).
Sensor Commands for SIS-3

Id Name Description
0xE000 Calibration Mode On Put sensor in the calibration mode.
0xE001 Calibration Update Commit new calibration to memory.
0xE002 Calibration Mode Off Put sensor in the normal operating mode.
0xE003 Restore Cal Defaults Restore factory default calibration for sensor only
0xE004 Restore sensor defaults Restore factory defaults for calibration,
parameters and units, sentinel values…etc for
sensor only
Sensor Data Register Map Version Registers

These registers specify the version of the sensor data register map pointed to by the
Sensor Data Register Offset registers. If a sensor connection is open, the probe shall
return a zero. If an attempt is made to access a sensor map version register that is not
address).
Sensor Data Register Map Offsets

These registers specify the register number of the first register in each sensor’s Sensor
Data Header Block (refer to the Sensors section). These registers assume the 4x (holding
register) reference id and therefore will not contain the reference id as part of the value
(i.e. 40001 will be stored as 1).
If an attempt is made to access a sensor status register that is not mapped to a sensor (one
that exceeds the maximum number of sensors supported by the probe), the probe will
return an exception response with error code 0x02 (illegal data address).
If a sensor connection is open (the sensor is not plugged in or is not part of the current
configuration) the probe shall return 0. This permits a valid block read of the mapped
sensor status registers regardless of the current configuration of the probe and sensors.
If an attempt is made to access a sensor connection register that is not mapped to a sensor
(one that exceeds the maximum number of sensors supported by the probe), the probe
will return an exception response with error code 0x02 (illegal data address).
Sensor Data Cache Timeout (SIS-3 Only)

Sensors shall measure all of their parameters whenever a parameter value register is read.
The parameters are recorded in a data cache and a cache timeout is started. If any
subsequent parameter value from the sensor is read within the specified cache timeout,
the device shall return the value recorded in the cache instead of making a new
measurement. The default value of the cache timeout is device specific. If the cache
timeout value is set to 0 milliseconds, each Modbus message to read one or more
parameters will cause a new sensor reading to be taken. Logs running on a probe will also
populate the data cache when a measurement is taken.
The end of session timeout supersedes the cache timeout – if an end of session timeout
occurs, the cache for all sensors shall be cleared.
6.22 Current Loop Configuration (SIS-3 Only)

This set of registers applies to probes that support a single analog output such as the
Level TROLL or Aqua TROLL. This feature is only available on SIS-3 and newer
probes.
Current Loop Sensor Number

This is the sensor connection number 1-32 assigned to the analog output signal.
Current Loop Parameter Number

This is the parameter number 1-16 on the sensor that is assigned to the analog output
signal.
Current Loop 20mA/4mA set point

These registers are used to assign the value that scales the analog output signal over a
range of values.
Current Loop Enable

This register can be used to enable or disable the analog output.
Current Loop Calculations

The required 4-20 mA current loop output shall be calculated as follows:
I = 4 + 16(Parameter – I4) / (I20 – I4)
Where Parameter is the sensor parameter value determined by the Current Loop Sensor
Number and Current Loop Parameter Number registers. The device shall not allow the
Current Loop 20 mA Setpoint (I20) and Current Loop 4 mA Setpoint (I4) registers to be
set equal to one another.
6.23 Logged Record Registers (SIS-3 Only)

This group of registers allows the Master to perform a single Read Registers command to
obtain the last logged record data for the most recent or currently active log. If logging is
not supported by the device, attempting to read these registers shall return a Modbus
exception with error code 0x02 (invalid address).
Number of Logged Records

This represents the number of records in the active or most recent log file. If there are no
log files on the device, this will be 0.
Requested Log Record Number

This value can be written to tell the device to retrieve a specific log record from the most
recent log file. If the user writes a number greater than the value in the Number of
Logged Records register, the device will return an exception code 0x03 (illegal data
value).
Record Time Stamp

This represents the time and date of the current log record in the record cache.
Parameter Measured Value and Data Quality

Each group of 3 registers represents the logged value and its quality id. The quality ids
are defined in Appendix F.
• Attempting to read a parameter register beyond the number of parameters

specified in the active log configuration shall return a Modbus exception with
error code 0x02.
• There are a maximum of 30 parameters allowed per log.
7 Sensor Common Registers
All sensors expose a common set of registers to support basic information and common
settings such as alarming, calibration dates…etc. The sensor common register set
precedes the device specific measurement holding registers and is always located in the
same block as described in the following table:
Register Size Mode & Access Data Description

XXXX (registers) Level Type
(R/W)
0001 1 R1 ushort Sensor Id (see pressure sensor slot registers)
0002 2 R1 ulong Sensor serial number
0004 1 R1 16 bits Sensor status (see pressure sensor slot registers)
0005 3 R1 time Last factory calibration (Level TROLL, Aqua TROLL
100, 200, BaroTROLL, Rugged TROLL, Rugged
BaroTROLL)
RDO cap start date/time (RDO PRO, RDO PRO-X, RDO

Titan, Aqua TROLL 400, 600 ConTROLL PRO)
0008 3 R1 time Next factory calibration; 0 = none required (Level
TROLL, Aqua TROLL 100, 200, BaroTROLL, Rugged
TROLL, Rugged BaroTROLL)
RDO cap end of usable life date/time; 0 = cap missing

(RDO PRO, RDO PRO-X, RDO Titan, Aqua TROLL
400, 600, ConTROLL PRO)
0011 3 R1 time Last user calibration
0014 3 R1/W2 time Next user calibration (0 = none required)
0017 1 R1 ushort Warm-up time in milliseconds = 100
0018 1 R1 ushort Fast sample rate in milliseconds
Level TROLL 400 = 500 msec
BaroTROLL 500 = 500 msec
0019 1 R1 ushort Number of sensor parameters = 3
0020 1 R1/W3 ushort Alarm and warning parameter number (1 – 3, default = 1)
0021 1 R1/W3 16 bits Alarm and warning enable bits (default = 0)
Bit 0 = High alarm enabled
Bit 1 = High warning enabled
Bit 2 = Low warning enabled
Bit 3 = Low alarm enabled
Bit 4 = Sensor calibration warning
0022 2 R1/W3 float High alarm set value (default = 0.0)
0024 2 R1/W3 float High alarm clear value (default = 0.0)
0026 2 R1/W3 float High warning set value (default = 0.0)
0028 2 R1/W3 float High warning clear value (default = 0.0)
0030 2 R1/W3 float Low warning clear value (default = 0.0)
0032 2 R1/W3 float Low warning set value (default = 0.0)
0034 2 R1/W3 float Low alarm clear value (default = 0.0)
0036 2 R1/W3 float Low alarm set value (default = 0.0)
First Parameter Block
0038 2 R1 float Measured value
0040 1 R1 ushort Parameter Id
0041 1 R1/W2 ushort Units Id
0042 1 R1 ushort Data Quality Id
0043 2 R1/W3 float Off line sentinel value
0045 1 R1 16 bits Available Units
Parameter Block 2-N
7.1 Sensor Id Register

The devices can be factory-configured to a variety of full-scale pressure ranges in both
gauge and absolute pressure formats. See Appendix C for Sensor Ids.
7.2 Sensor Status Register

Bits in this register signal the status of sensor operation. The lower 8 bits of each sensor
status register represent a common set of status bits and are to be logically OR’ed
together and placed in the lower 8 bits of the device status register.
Bit Description
0 Sensor high alarm
1 Sensor high warning
2 Sensor low warning
3 Sensor low alarm
4 Sensor calibration warning
5 Sensor malfunction
6-7 Reserved for future standard OR’ed sensor status bits (always return 0)
8, 9 Sensor mode (00 = Disabled, 01 = Enabled, 10 = Enabled-Continuous, 11 = Cal-Continuous)
10-15 Reserved for sensor-specific status (always return 0)
7.3 Calibration Times

These represent the expiration dates of the calibrations of the sensor. Data collected after
these dates will have its quality id marked as Out-Of-Calibration. If the calibration time
is zero, it is ignored.
7.4 Warm-up Time

Time required to prepare a sensor for a measurement. Some sensors require a significant
warm up and this needs to be accounted for when computing the best possible sample
rate.
7.5 Fast Sample Rate

Fastest measurement rate of the sensor after warm-up has completed.
7.6 Alarm Parameter Number

This is the parameter number associated with the alarm setpoints. The value can be 1-3
for the Level TROLL.
7.7 Alarm Enable Bits

This register provides for the capability to enable and disable Hi/Lo alarms and warning
values. The set points are defined in the registers following this one.
7.8 Alarm Set Points
Alarms and Warnings have trigger points called the “set value” and reset points called the
“clear value”.
• High clear set points cannot exceed their respective trigger set points (i.e., the
High Alarm clear value cannot be larger than the High Alarm set point).
• Low clear set points cannot be lower than their respective trigger set points.
• No restrictions exist on the relationships between the high/low alarm/warning set
points.
7.9 Parameter Blocks

After the sensor header register set, a series of one or more parameter blocks will contain
the register set pertaining to each parameter. The parameter block fields are as follows:
Measured Value – the value of the sensor parameter in the units specified in the
parameters Units Id register. The measured value might be cached for sensors that
require a long cycle time for a measurement.
Parameter Id – the id that is associated with the measured parameter from Appendix A.
This is not to be confused with the parameter number which represents the order of
parameters within the sensor block. The ability to write to the Parameter Id register is
device and parameter dependent.
Units Id – the id of the units used to represent the measured value. The entire range of
available units for a parameter do not have to be supported by a sensor. The ability to
write to the Units Id register is device and parameter dependent. If writing to the Units Id
register is supported, the device will convert the values in the Sentinel Value register and
Alarm Set Point registers (if the parameter is specified for alarm) to the specified units.
Data Quality Id – a value that contains additional information about the measured value.
For example, if the sensor is out of calibration, the quality value will indicate that the
measured value cannot be trusted. Quality ids are defined in Appendix C. Quality ids
cannot be OR’d together. The Quality value will represent only one possible quality state.
Sentinel Value – if the sensor is offline (i.e. for maintenance or calibration purposes) the
sensor will return the sentinel values for its parameters. These values can be defined by
the user such that they can be recognized as illegal values for the customers application.
The sentinel value allows the sensor and probe to continue to respond to requests for data
from a PLC or SCADA system while the sensor is offline which helps eliminate
numerous problems associated with reporting and alarming.
Available Units – Unit Ids are grouped in blocks of 16 with each block corresponding to
a measurement type. Each bit in the Available Units register corresponds to a unit id,
with bit 0 corresponding to the first unit id in the measurement block assigned to the
Parameter Id (see Appendix B). For example, if the Parameter Id is 5 (Level), bit 0
corresponds to unit id 33 (mm) and bit 15 corresponds to unit id 48. Each bit that is set
indicates that the corresponding unit id is available to be written to the parameter’s Units
Id register.
8 Level TROLL / BaroTROLL Registers

The device specific measurement holding registers are as follows:

(R/W)
Parameter # 1 - Pressure
0040 1 R1 ushort Parameter Id = 2 (pressure)
17 = PSI (default)
19 = KPa
20 = bar
21 = mbar
22 = mmHg
0043 2 R1/W3 float Off line sentinel value (default = 0.0)
0045 1 R1 16 bits Available Units = 0x0005
Parameter # 2 - Temperature
0048 1 R1 ushort Parameter Id = 1 (temperature)
1 = C (default)
2 = F
Parameter # 3 – Level (Level TROLL only)
0054 2 R1 float Measured value, Lm
0056 1 R1/W2 ushort Parameter Id
3 = level, depth (default)
4 = level, top of casing
5 = level, elevation
33 = millimeters
34 = centimeters
35 = meters
37 = inches
38 = feet (default)
8.1 Pressure Units Id

This register can be changed only when the device is not logging. If an attempt is made
to change this register while logging, the device will return an exception response with
error code 0xA0.
Pressure is factory calibrated in PSI. Conversion to other units is as follows.
KPa = 6.894757 * PSI

bar = 0.06894757 * PSI
mbar = 68.94757 * PSI
mmHg = 51.71492 * PSI
inHg = 2.036021 * PSI
cmH2O = 70.30696 * PSI
inH2O = 27.67990 * PSI
8.2 Temperature Units Id

error code 0xA0.
Temperature is factory calibrated in C. Conversion to other units is as follows.
F = 1.8 * C + 32
8.3 Level Parameter Id

error code 0xA0.
8.4 Level Units Id

error code 0xA0.
Millimeters = 1000 * meters

Centimeters = 100 * meters
Inches = 39.37008 * meters
Feet = 3.280840 * meters
8.5 Sensor Calibration Registers

Values in the configuration registers determine how the sensor parameters are calculated.

(R/W)
0100 2 R1/W3 float Specific Gravity (default = 1.0)
0102 2 R1/W3 float Pressure Offset, Po (default = 0.0)
0104 2 R1/W3 float Level Reference, Lr (default = 0.0)
0106 2 R1/W3 Float Pressure Reference (default = 0.0)
Specific Gravity
Pressures (PSI) are converted to level (meters) accounting for the specific gravity (SG) of
the fluid according to the following equation. Values will be in the range 0.1 to 10.0
inclusive. This register can be changed only when the device is not logging. If an
attempt is made to change this register while logging, the device will return an exception
response with error code 0xA0.
L(P) = (P * 0.70307) / SG
Pressure Offset
The pressure offset is subtracted from the pressure reading (P) to correct for offset errors
in the pressure sensor. This register can be changed only by using the WinSitu software
or 3rd party software using the In-Situ Software Development Kit (SDK). The measured
pressure is presented as:
Pm = P - Po
Level Reference
This value is used to reference a level reading to an independently established value.
Master software must ensure that the level value is written in the currently selected units.
When this register is written, the device will measure and record the current pressure
reading P m as reference pressure Pr in the currently selected pressure units. This value
will be converted to the appropriate units when the Level Units Id register is written. The
following equations are used to calculate level based on the level parameter id selection.
Parameter Description Equation

Id
3 Level, depth Lm = L(Pm )
4 Level, top of casing Lm = Lr - L(Pm – Pr)
5 Level, elevation Lm = Lr + L(Pm – Pr)
8.6 Other Level TROLL Registers
Level TROLL 300, 500, 700 and BaroTROLL 500 only

(R/W)
0108 1 R1 ushort Probe Register Map Template Version (1)
0109 1 R1 ushort External Power Voltage (millivolts)
0110 1 R1 ushort Internal Battery Voltage (millivolts)
0111 2 R1 ulong Total Measurements Counter
0113 2 R1 ulong Battery Measurements Counter
Level TROLL/Rugged TROLL 200 and Rugged BaroTROLL only

(R/W)
7007 1 R1/W3 ushort Parameter buffer timeout (milliseconds), 0-5000, default
= 1000
Total Measurements Counter

The device counts the total number of sensor measurements made. The count is
incremented whenever a sensor measurement is made by reading a sensor parameter
register, or when a sensor parameter is read for a data log.
Battery Measurements Counter

The device counts the number of sensor measurements made while operating from the
internal battery. The count is incremented whenever a sensor measurement is made by
reading a sensor parameter register, or when a sensor parameter is read for a data log.
The count is not incremented if the device is operating from external power.
Analog Control Registers

Level TROLL 300, 400, 500 and 700 and BaroTROLL 500 only – there is no analog
output on a Rugged TROLL 200 or Rugged BaroTROLL.
(R/W)
0115 1 R1/W3 ushort Current loop parameter number (1-3, default = 1)
0116 2 R1/W3 float 20 mA setpoint (I20, default = full scale pressure)
0118 2 R1/W3 float 4 mA setpoint (I4, default = 0)
9 Aqua TROLL 200 Registers
The device specific measurement registers for the Aqua TROLL 200 are as follows:

(R/W)
17 = PSI (default)
19 = KPa
20 = bar
21 = mbar
22 = mmHg
1 = C (default)
2 = F
Parameter # 3 – Level
0054 2 R1 float Measured value, Lm
0056 1 R1/W2 ushort Parameter Id
3 = level, depth (default)
4 = level, top of casing
5 = level, elevation
33 = millimeters
34 = centimeters
35 = meters
37 = inches
38 = feet (default)
Parameter # 4 – Actual Conductivity
0062 2 R1 float Measured value, AC
0064 1 R1 ushort Parameter Id = 9 (actual conductivity)
65 = microsiemens per centimeter (default)
66 = millisiemens per centimeter
0069 1 R1 16 bits Available Units = 0x0003 (3)
Parameter # 5 – Specific Conductivity
0070 2 R1 float Measured value, SC
0072 1 R1 ushort Parameter Id = 10 (specific conductivity)
Parameter # 6 – Salinity
0078 2 R1 float Measured value, S
0080 1 R1 ushort Parameter Id = 12 (salinity)
97 = Practical Salinity Units PSU (default)
Parameter # 7 – Total Dissolved Solids
0086 2 R1 float Measured value, TDS
0088 1 R1 ushort Parameter Id = 13 (TDS)
113 = parts per million
114 = parts per thousand (default)
Parameter # 8 – Resistivity
0094 2 R1 float Measured value, R
0096 1 R1 ushort Parameter Id = 11 (resistivity)
81 = ohm-cm (default)
Parameter # 9 – Density of Water
0102 2 R1 float Measured value, p
0104 1 R1 ushort Parameter Id = 14 (density of water)
129 = g/cm3 (default)
9.1 Pressure Units Id

error code 0xA0.
Pressure is factory calibrated in PSI. Conversion to other units is as follows.
KPa = 6.894757 * PSI
9.2 Temperature Units Id

error code 0xA0.
Temperature is factory calibrated in C. Conversion to other units is as follows.
F = 1.8 * C + 32
9.3 Level Parameter Id

error code 0xA0.
9.4 Level Units Id

error code 0xA0.

(R/W)
0118 1 R1 ushort Sensor data register map version
0119 1 R1 ushort Sensor firmware version * 100
0120 2 R1/W3 float Pressure Offset, Po (default = 0.0)
0122 2 R1/W3 float Specific Gravity (default = 1.0)
0124 2 R1/W3 float Level Reference, Lr (default = 0.0)
0126 2 R1/W3 float Pressure Reference, Pr (default = 0.0)
0128 2 R1/W3 float Cell Offset, K0 (default = 0.0)
0130 2 R1/W3 float Cell Constant, K (default = 1.0)
0132 2 R1/W3 float Reference Temperature, Tref in °C (default = 25)
0134 2 R1/W3 float Alpha Coefficient 0 (default = 1.0)
0136 2 R1/W3 float Alpha Coefficient 1 (default = -0.0191)
0150 2 R1/W3 float Beta Coefficient  (default = 1.0)
0152 2 R1/W3 float TDS Conversion Factor CFTDS in ppt (default = 0.65)
0154 2 R1/W3 float Local gravity constant (pg) for density corrected level
calculations (default = 0.0 for no correction)
Specific Gravity
Pressures (PSI) are converted to level (meters) accounting for the specific gravity (SG) of
the fluid according to the following equation. Values will be in the range 0.1 to 10.0
inclusive. This register can be changed only when the device is not logging. If an
attempt is made to change this register while logging, the device will return an exception
response with error code 0xA0.
L(P) = (P * 0.70307) / SG
Pressure Offset
The pressure offset is subtracted from the pressure reading (P) to correct for offset errors
in the pressure sensor. This register can be changed only by using the WinSitu software
or 3rd party software using the In-Situ Software Development Kit (SDK). The measured
pressure is presented as:
Pm = P - Po
Level Reference
This value is used to reference a level reading to an independently established value.
Master software must ensure that the level value is written in the currently selected units.
When this register is written, the device will measure and record the current pressure
reading P m as reference pressure Pr in the currently selected pressure units. This value
will be converted to the appropriate units when the Level Units Id register is written. The
following equations are used to calculate level based on the level parameter id selection.
Parameter Description Equation

Id
3 Level, depth Lm = L(Pm )
4 Level, top of casing Lm = Lr - L(Pm – Pr)
5 Level, elevation Lm = Lr + L(Pm – Pr)
Cell Offset and Cell Constant

These values are used to calibrate conductivity to user standards. These registers can
only be written when the sensor is in the cal-continuous mode. When either of these
registers are written, the device will set the last user calibration time to the current time
and set the next user calibration time to zero. Actual conductivity (AC) is calculated as
follows.
AC = K0 + K * ACf
Where ACf is the actual conductivity value computed using the factory calibrated cell
constant. For a single point calibration, K0 is set to zero.
Local Gravity Constant

If the local gravity constant is non-zero, pressures (PSI) are converted to level (meters)
accounting for the measured fluid density (p) and the local gravity constant (pg)
according to the following equation. Values for pg shall be in the range 0.9 to 1.1
inclusive. This register shall only be able to be written when the device is not logging. If
an attempt is made to change this register while logging, the device will return an
exception response with error code 0xA0. The value contained in the specific gravity
register is ignored.
L(P) = (P * 0.70307) / (p * pg)
9.6 Other Aqua TROLL 200 Registers
Register Size Mode & Data Description

XXXX (registers) Access Level Type
(R/W)
7007 1 R1/W3 ushort Parameter buffer timeout (milliseconds), 0-5000, default =
1750

The device counts the total number of sensor measurements made. The count is
incremented whenever a sensor measurement is made by reading a sensor parameter

The device counts the number of sensor measurements made while operating from the
internal battery. The count is incremented whenever a sensor measurement is made by
reading a sensor parameter register, or when a sensor parameter is read for a data log.
The count is not incremented if the device is operating from external power.
Parameter Buffer Timeout

The device measures all parameters when a measured parameter value register is read,
records the values in a parameter buffer, then starts the parameter buffer timer. If any
parameter is read again within the specified buffer timeout, the device will return
parameter values from the parameter buffer instead of making a new measurement.

(R/W)
9501 1 R1/W3 ushort Current loop sensor number (can only be 1)
9502 1 R1/W3 ushort Current loop parameter number (1-N, default = 1)
9507 1 R1/W3 ushort Current loop enable (0 = off, 1 = on, default = 0)
10 Aqua TROLL 100 Registers
The Aqua TROLL 100 does not support the pressure and level parameters. Its device
specific measurement registers are arranged as follows:

(R/W)
Parameter # 1 – Actual Conductivity
0038 2 R1 float Measured value, AC
0040 1 R1 ushort Parameter Id = 9 (actual conductivity)
1 = C (default)
2 = F
Parameter # 3 – Specific Conductivity
0054 2 R1 float Measured value, SC
0056 1 R1 ushort Parameter Id = 10 (specific conductivity)
Parameter # 4 – Salinity
0062 2 R1 float Measured value, S
0064 1 R1 ushort Parameter Id = 12 (salinity)
97 = Practical Salinity Units PSU (default)
Parameter # 5 – Total Dissolved Solids
0070 2 R1 float Measured value, TDS
0072 1 R1 ushort Parameter Id = 13 (TDS)
113 = parts per million
114 = parts per thousand (default)
Parameter # 6 – Resistivity
0078 2 R1 float Measured value, R
0080 1 R1 ushort Parameter Id = 11 (resistivity)
81 = ohm-cm (default)
Parameter # 7 – Density of Water
0086 2 R1 float Measured value, p
0088 1 R1 ushort Parameter Id = 14 (density of water)
129 = g/cm3 (default)

(R/W)
0118 1 R1 ushort Sensor data register map version
0119 1 R1 ushort Sensor firmware version * 100
0128 2 R1/W3 float Cell Offset, K0 (default = 0.0)
0130 2 R1/W3 float Cell Constant, K (default = 1.0)
0132 2 R1/W3 float Reference Temperature, Tref in °C (default = 25)
0134 2 R1/W3 float Alpha Coefficient  (default = 0.0191)
0136 2 R1/W3 float Beta Coefficient 0 (default = 1.0)
0152 2 R1/W3 float TDS Conversion Factor CFTDS in ppt
(software limited range 0.001 to 10.000, default = 0.65,
resolution 0.001)
10.2 Other Aqua TROLL 100 Registers

(R/W)
7007 1 R1/W3 ushort Parameter buffer timeout (milliseconds), 0-5000, default =
1750

The device shall count the total number of sensor measurements made. The count shall
be incremented whenever a sensor measurement is made by reading a sensor parameter

The device shall count the number of sensor measurements made while operating from
the internal battery. The count shall be incremented whenever a sensor measurement is
made by reading a sensor parameter register, or when a sensor parameter is read for a
data log. The count shall not be incremented if the device is operating from external
power.
Parameter Buffer Timeout

The device measures all parameters when a measured parameter value register is read,
records the values in a parameter buffer, then starts the parameter buffer timer. If any
parameter is read again within the specified buffer timeout, the device shall return
parameter values from the parameter buffer instead of making a new measurement.

(R/W)
9501 1 R1/W3 ushort Current loop sensor number (can only be 1)
9502 1 R1/W3 ushort Current loop parameter number (1-N, default = 1)
9507 1 R1/W3 ushort Current loop enable (0 = off, 1 = on, default = 0)
11 Aqua TROLL 400 and 600 Registers
See the instrument manuals for device specific registers.
12 RDO PRO / RDO PRO-X / RDO TITAN Registers

The device specific measurement registers are as follows:

(R/W)
Dissolved Oxygen Concentration
0038 2 R1 float Measured value, C0
0040 1 R1 ushort Parameter Id = 20
117 = mg/L (default)
118 = µg/L
0042 1 R1 ushort Data Quality Id (See Sensor Health Table in the
instrument Operator’s manuals)
Temperature
0048 1 R1 ushort Parameter Id = 1
1 = C (default)
2 = F
Dissolved Oxygen %Saturation
0056 1 R1/W2 ushort Parameter Id = 21
177 = percent saturation (default)
Oxygen Partial Pressure
26 = torr (default)
12.1 RDO PRO / RDO PRO-X Calibration Registers.

(R/W)
0118 2 R1/W3 float Live salinity value (PSU)
0120 2 R1/W3 float Default salinity value (PSU, default = 0.0)
0122 2 R1/W3 float Live barometric pressure (mbar)
0124 2 R1/W3 float Default barometric pressure (mbar, default = 1013.25)
0126 2 R1/W3 float 100% saturation calibration reading (mg/L)
0128 2 R1/W3 float 100% saturation temperature reading (°C)
0130 2 R1/W3 float 100% saturation salinity value (PSU)
0132 2 R1/W3 float 100% saturation barometric pressure (mbar)
0134 2 R1/W3 float 0% saturation calibration reading (mg/L)
0136 2 R1/W3 float 0% saturation temperature reading (°C)
0138 2 R1/W3 float Calibration slope (default = 1.0)
0140 2 R1/W3 float Calibration offset (default = 0.0)
Live Salinity Value

The live salinity value is used to correct the oxygen concentration value for salinity.
Values must be written in Practical Salinity Units (PSU) in the range 0 to 42 PSU. This
is not a measured parameter.
Default Salinity Value

The default salinity value is loaded into the live salinity value register when power is first
applied to the probe. The default salinity value is used in calculations until a live salinity
value is written. This is not a measured parameter.
Live Barometric Pressure

The live barometric pressure is used in the calculation of percent saturation and to
determine the theoretical saturation point during calibration. Values must be written in
millibars in the range 506.625 to 1114.675 mbar. This is not a measured parameter.
Default Barometric Pressure

The default barometric pressure is loaded into the live barometric pressure register when
power is applied to the probe. The default barometric pressure is used in calculations
until a live barometric pressure is written. This is not a measured parameter.
100% Saturation Calibration Values

These values represent the sensor conditions while the probe is in a 100% saturation
calibration environment. These are not measured values, they are written by the
controller during the calibration process.
Writes to these registers are only accepted if the probe is in the calibration mode. The
probe will return exception 0x85 (invalid device command sequence) if an attempt is
made to write these registers when the calibration mode is off.
0% Saturation Calibration Values

These values represent the sensor conditions while the probe is in a 0% saturation
calibration environment. These are not measured values, they are written by the
controller during the calibration process.
Writes to these registers are only accepted if the probe is in the calibration mode. The
probe will return exception 0x85 (invalid device command sequence) if an attempt is
made to write these registers when the calibration mode is off.
Calibration Slope and Offset

These values represent the slope and offset that will be applied to the raw concentration
reading from the sensor to generate the final values reported by the sensor parameters.
These registers may be written independently of the normal internal calibration procedure.
Calibration Procedure
The probe is calibrated using the following procedure.
1. Write the Calibration Mode On command (0xE000) to the sensor command

register 49305.
2. Update the live salinity and barometric pressure registers if necessary.
3. Prompt the user to place the probe in a 100% saturation environment.
4. Read the oxygen concentration and temperature parameters. When these values
have reached equilibrium, record them in their respective 100% saturation
calibration registers. Write the current live salinity and barometric pressure
readings to their respective calibration registers.
5. Prompt the user to place the probe in a 0% saturation environment. When these
registers have reached equilibrium, record them in their respective 0% saturation
calibration registers. If a zero calibration is not to be performed, these registers
can be set to zero or left at their previous values.
6. Write the Calibration Update command (0xE001) to the sensor command register.
The sensor will calculate a new slope and offset, will write the current time to the
last user calibration time register, and set the next user calibration time register to
zero (disabled). If the concentrations at 100% and 0% saturation are equal the
probe will return an exception response with code 0x97 (invalid calibration) and
not attempt to compute a new slope and offset due to possible division by zero. If
the slope does not calculate between 0.85 and 1.20 inclusive, or the offset does
not calculate between -0.2 and +0.2 inclusive, the probe will return an exception
response with code 0x97 (invalid calibration) The slope and offset will be
available for read but will not be committed to flash.
7. Optional: read the last user calibration time register, add the next calibration
interval, and write the result to the next user calibration time register.
8. Write the Calibration Mode Off command (0xE002) to the sensor command
register to place the sensor in normal operation. If the calibration mode is turned
off without a calibration update command, or the calibration command returned
an exception, the previous calibration shall be restored.
13 ConTROLL PRO
This series of devices act as both controllers and modbus gateways to the attached probes.
The controllers are vented and have an internal virtual sensor that supports Barometer
and Temperature parameters. The controller can support up to two attached probes at
factory default communication settings. A diagram of the physical configuration is
shown below:
Physical Layout
PLC/SCADA
Any Modbus Network
ConTROLL PRO
Address N
Connection 1 Connection 2
Terminated Terminated
RS485 network RS485 network
Up To 1250 m Up To 1250 m
Probe A Probe B
Address 1 Address 1
The Controller will have a contiguous address block associated with it that begins at the
controller’s assigned device address and ends at the controller’s device address plus the
maximum number of connections supported by the controller. The Controller will
always occupy the same number of contiguous addresses regardless of the number of
probes actually connected.
For example, a controller that supports two probes and is set to address 5 will occupy
three network addresses assigned as follows:
Network Address Addressed Device

5 Controller.
6 Probe connection 1.
7 Probe connection 2.
The logical or network representation from a SCADA perspective is as shown below:
Physical Layout
PLC/SCADA
Modbus Network
ConTROLL PRO Probe A Probe B

Address N Address N+1 Address N+2
The Controller will pass through any messages sent between the SCADA/PLC and Probe
A or B. The Controller must also poll the probes for measured values to control the
analog outputs, relays and internal log as well as the local display. When the Controller is
polling the probes for measured values, the SCADA/PLC will get a modbus exception
0x06 (slave device busy).
13.1 Probe Measurement Cache

The ConTROLL PRO will cache and expose modbus registers for the PLC/SCADA to
read up to 30 parameter values of the attached probes and itself at the ConTROLL device
address. The maximum number of parameters cached from each probe is limited to 14.
If a probe does not have 14 parameters, the cached values are packed into consecutive
registers. The Probe A values are first, followed by Probe B and the ConTROLL PRO
parameters last. The first register of the cache is 47100.
Example 1 – single RDO PRO attached to Probe A port:

(R/W)
7100 2 R1 float Probe A: RDO PRO DO Concentration
7102 2 R1 float Probe A: RDO PRO Temperature
7104 2 R1 float Probe A: RDO PRO DO % Saturation
7106 2 R1 float Probe A: RDO PRO Oxygen Partial Pressure
7108 2 R1 float ConTROLL PRO: Baro Pressure
7110 2 R1 float ConTROLL PRO: Temperature
7112-158 2 R1 float Cached parameter 7 – 30 NOT USED
Example 2 – two RDO PRO’s attached to Probe A and B ports:
(R/W)
7108 2 R1 float Probe B: RDO PRO DO Concentration
7110 2 R1 float Probe B: RDO PRO Temperature
7112 2 R1 float Probe B: RDO PRO DO % Saturation
7114 2 R1 float Probe B: RDO PRO Oxygen Partial Pressure
7120-158 2 R1 float NOT USED
Example 3 – RDO PRO on Probe A port, Aqua TROLL on Probe B port:

(R/W)
7108 2 R1 float Probe B: AquaTROLL Pressure
7110 2 R1 float Probe B: AquaTROLL Temperature
7112 2 R1 float Probe B: AquaTROLL Level
7114 2 R1 float Probe B: AquaTROLL Actual Conductivity
7116 2 R1 float Probe B: AquaTROLL Specific Conductivity
7118 2 R1 float Probe B: AquaTROLL Salinity
7120 2 R1 float Probe B: AquaTROLL Total Dissolved Solids
7122 2 R1 float Probe B: AquaTROLL Resistivity
7124 2 R1 float Probe B: AquaTROLL Density of Water
7130-158 2 R1 float NOT USED
13.2 Control PRO Measurement Registers
The device specific measurement registers are as follows:

(R/W)
17 = PSI (default)
19 = KPa
20 = bar
21 = mbar
22 = mmHg
1 = C (default)
2 = F
13.3 Other Registers

(R/W)
14 RS485 Network Guidelines
In-Situ uses RS485 as its main digital communications link. RS485/422 is often used in
an industrial setting as a small device network. There are some installation guidelines to
follow when configuring an RS485 network with implications to use with the Level
TROLL or Aqua TROLL.
RS485 Rule#1:
RS485 is a bus network. It does not work when configured in a star network topology.
This means that a user can have a network that looks like 1 long wire (up to 4000 ft) with
short stubs hanging off the main branch with a device. Each stub must be less than 1
meter in length. See picture below:
RS485 Rule#2
There should only be a 100 ohm terminating resistor at the end of the network. The bus is
terminated on the long main bus wire at the opposite end from the Master.
RS485 Rule#3
This rule is not really specific to RS485; rather it applies to any situation where you have
long wires running across the ground or in the ground connected back to a computer.
Always add an optical isolator to the link between the main bus wire and the Master
device. This reduces the chance that a nearby lightning strike will damage the Master
device.
RS485 Rule#4
Only 32 devices per network, including the Master.
Implications to Level TROLL / Aqua TROLL users are as follows:

These devices are typically deployed on a cable of much greater length than the 1 meter
stub supported by RS485. The above documented Rule#1 requires that only two devices
are on an individual RS485 link, the PLC and the TROLL. Many PLC’s support multiple
RS485 networks which can be used to connect multiple TROLLs to a single PLC.
Appendix A: Exception Codes
Standard Modbus Exception Codes
Code Name Description
1 Illegal Function The function code received in the query is not an allowable action
for the slave. If a Poll Program Complete command was issued,
this code indicates that no program function preceded it.
2 Illegal Data Address The data address received in the query is not an allowable address
for the slave.
3 Illegal Data Value A value contained in the query data field is not an allowable value
for the slave.
4 Slave Device Failure An unrecoverable error occurred while the slave was attempting to
perform the requested action.
5 Acknowledge The slave has accepted the request and is processing it, but a long
duration of time will be required to do so. This response is returned
to prevent a timeout error from occurring in the master. The master
can next issue a Poll Program Complete message to determine if
processing is completed.
This exception code may not be supported by the devices
6 Slave Device Busy The slave is engaged in processing a long–duration program
command. The master should retransmit the message
later when the slave is free.
8 Memory Parity Error Specialized use in conjunction with function codes 20 and 21
and reference type 6, to indicate that the extended file area
failed to pass a consistency check.
The server (or slave) attempted to read record file, but
detected a parity error in the memory. The client (or master)
can retry the request, but service may be required on the
server (or slave) device.
0x0A Gateway Path Specialized use in conjunction with gateways, indicates that
Unavailable the gateway was unable to allocate an internal communication
path from the input port to the output port for processing the
request. Usually means that the gateway is misconfigured or
overloaded.
This exception code may not be supported by the devices.
0x0B Gateway Target Device Specialized use in conjunction with gateways, indicates that no
Failed To Respond response was obtained from the target device. Usually means
that the device is not present on the network.
This exception code may be used by controllers, but is not used
by probes.
Extended Modbus Exception Codes
Code Name Description
0x80 Field Mismatch Mismatch between register number, count and field size.
0x81 Write Only Register Attempting to read a Write Only register.
0x82 Read Only Register Attempting to write a Read Only register.
0x83 Access Level Attempting to Read/Write a register with invalid access level.
0x84 Write Value Attempting to write an illegal field value.
0x85 Command Sequence Invalid device command register sequence.
0x86 File Sequence Invalid file command register sequence.
0x87 File Command Invalid file command.
0x88 File Number Invalid file number.
0x89 File Size Invalid file size.
0x8A File Data The file data block transferred to device is invalid.
0x8B File Interval Invalid file interval.
0x90 Gateway Error Invalid probe command on controller gateway.
0x91 Sensor Sequence Invalid sensor command register sequence.
0x92 Sensor Mode Invalid change to sensor mode, or attempting to read/write with an
invalid sensor mode set.
0x93 Sensor Config Attempting a sensor operation on a sensor port that is not part of the
current configuration.
0x94 Sensor Missing Attempting a sensor operation on a sensor port with no sensor
connected.
0x95 Sensor Invalid Attempting a sensor operation on a sensor port that has a sensor that is
not compatible with the sensor that was originally configured.
0x96 Sensor Firmware Attempting a sensor operation on a sensor with no application code.
0xA0 Data Log Register Attempting to write a register that is read-only during logging.
0xA1 Data Log Memory Data log memory is full.
0xA2 Data Log Directory Data log directory is full.
0xA3 Data Log Edit Log configuration cannot be edited.
0xA4 Data Log Sequence Invalid data log command sequence.
Appendix B: Device Ids
Device Ids
Device Id Description
1-32767 Reserved for probes
1 Level TROLL® 500
2 Level TROLL® 700
3 BaroTROLL® 500
4 Level TROLL® 300
5 Aqua TROLL® 200
7 Aqua TROLL® 600
10 Aqua TROLL® 100
11 Flow TROLL® 500
12 RDO® PRO
16 Rugged TROLL® 200
17 Rugged BaroTROLL®
18 Aqua TROLL® 400
19 RDO® TITAN
21 smarTROLL
26 Aqua TROLL® 600 Vented
30 Level TROLL® 400
31 RDO® PRO-X
33 Aqua TROLL® 500
34 Aqua TROLL® 500 Vented
32768- Reserved for controllers
65534
32768 Con TROLL PRO ACL
32769 Con TROLL PRO AC
32770 Con TROLL PRO DCL
32771 Wireless TROLL Com/smarTROLL Power Pack/Wireless Rugged TROLL Com
65535 Reserved for factory use
Appendix C: Sensor Ids
Sensor Ids
Sensor Id Description
1 Temperature
2 5 PSI full-scale gauge pressure with level and temperature (3.5m/11.5ft)
3 15 PSI full-scale gauge pressure with level and temperature (11m/35ft)
8 1000 PSI full-scale absolute pressure with level and temperature (703m/2306.4 ft)
9 30 PSI full-scale absolute pressure with level and temperature (10.9m/35.8ft)
12 500 PSI full-scale absolute pressure with level and temperature (341.3m/1120ft)
13 30 PSI full-scale absolute pressure with temperature (barometric)
14 5 PSI full-scale gauge pressure with level, temperature, and conductivity (3.5m/11.5ft)
15 15 PSI full-scale gauge pressure with level, temperature, and conductivity (11m/35ft)
20 Not Used
21 30 PSI full-scale absolute pressure with level, temperature, and conductivity (10.9m/35.8ft)
24 500 PSI full-scale absolute pressure with level, temperature, and conductivity (341.3m/1120ft)
25 16.5 PSI full-scale absolute pressure (barometric)
26 pH analog sensor
27 pH/ORP analog sensor
28 Dissolved Oxygen Clark Cell analog sensor
29 Nitrate (NO3-) analog sensor
30 Ammonium (NH4+) analog sensor
31 Chloride (Cl-) analog sensor
32 100 foot full-scale level with absolute pressure and temperature (30m/100ft)
35 Conductivity and temperature
36 5 PSI full-scale gauge pressure with temperature, head, and flow.
42 Optical dissolved oxygen with temperature.
43 1 Bar (15 PSI) full-scale gauge pressure with level and temperature (11m/35ft)
Appendix D: Parameter Ids
Parameter Ids
Id Parameters
1 Temperature
2 Pressure
3 Depth
4 Level, Depth to Water
5 Level, Surface Elevation
6 Latitude
7 Longitude
8 Elevation
9 Actual Conductivity
10 Specific Conductivity
11 Resistivity
12 Salinity
13 Total Dissolved Solids
14 Density of Water
15 Specific Gravity
16 Barometric Pressure
17 pH
18 pH mV
19 ORP
20 Dissolved Oxygen concentration
21 Dissolved Oxygen % saturation
22 Nitrate (NO3-)
23 Ammonium (NH4+)
24 Chloride (Cl-)
25 Turbidity
26 Battery Voltage
27 Head
28 Flow
29 Total Flow
30 Oxygen Partial Pressure
Appendix E: Unit Ids
Unit Ids
Id Abbreviation Units
0 None
Temperature (1-16)
1 C Celsius
2 F Fahrenheit
3 K Kelvin
Pressure, Barometric Pressure (17-32)
17 PSI Pounds per square inch
18 Pa Pascals
19 kPa Kilopascals
20 Bar bars
21 mBar millibars
22 mmHg Millimeters of Mercury (0C)
23 inHg Inches of Mercury (0C)
24 cmH2O Centimeters of water (4C)
25 inH2O Inches of water (4C)
26 Torr Torr
Distance/Length (33-48)
33 mm millimeters
34 cm Centimeters
35 m Meters
36 km Kilometer
37 in Inches
38 ft Feet
Coordinates (49-64)
49 deg Degrees
50 min Minutes
51 sec Seconds
Conductivity (65-80)
65 uS/cm Microsiemens per centimeter
66 mS/cm Millisiemens per centimeter
Resistivity (81-96)
81 ohm-cm Ohm-centimeters
Salinity (97-112)
97 PSU Practical Salinity Units
Concentration (113-128)
113 ppm Parts per million
114 ppt Parts per thousand
115 ppm N Parts per million Nitrogen
116 ppm Cl Parts per million Chloride
117 mg/L milligrams per liter
118 µg/L micrograms per liter
119 µM/L micromoles per liter
Density (129-144)
129 g/cm3 Grams per cubic centimeter
pH (145-160)
145 pH pH
Id Abbreviation Units
Voltage (161-176)
161 µV micro Volts
162 mV milli Volts
163 V Volts
Dissolved Oxygen (DO) % Saturation (177-192)
177 % sat Percent saturation
Turbidity (193-208)
193 FNU formazin nephelometric units
194 NTU nephelometric turbidity units
195 FTU formazin turbidity units
Flow (209-224)
209 ft3/s Cubic feet per second
3
210 ft /min Cubic feet per minute
211 ft3/hr Cubic feet per hour
212 ft3/day Cubic feet per day
213 gal/s Gallons per second
214 gal/min Gallons per minute
215 gal/hr Gallons per hour
216 MGD Millions of gallons per day
217 m3/sec Cubic meters per second
218 m3/min Cubic meters per minute
219 m3/hr Cubic meters per hour
220 m3/day Cubic meters per day
221 l/s Liters per second
222 acre-ft/day Acre feet per day
Volume (225-240)
225 ft3 Cubic feet
226 gal Gallons
227 mgal Millions of gallons
228 m3 Cubic meters
229 l Liters
230 acre-ft Acre feet
Appendix F: Data Quality Ids
Instruments developed using System Spec. 1
Level TROLL® 700, 500, 400
BaroTROLL® 500
Rugged TROLL® 200
Rugged BaroTROLL®
Data Quality Ids
Id Name Description
0 Normal Parameter measured without errors using a current calibration.
1 User Uncal Parameter measured without errors using an expired user calibration.
2 Factory Uncal Parameter measured without errors using an expired factory calibration.
3 Error Parameter measured with error, sentinel value supplied.
4 Warm-up Sensor is warming up, sentinel value supplied.
5 Disabled Sensor is disabled, sentinel value supplied.
6 Calibrating Sensor is calibrating, calibration value supplied.
7 Off Line Device is off line, sentinel value supplied.
8 Warning Parameter measured without errors but does not meet normal quality criteria.
Instruments developed using System Spec. 3

RDO® PRO
RDO® PRO-X
RDO® TITAN,
ConTROLL® PRO
Data Quality Ids
Id Name Description
0 Normal Parameter measured without errors using a current calibration.
1 User Cal Parameter measured without errors using an expired user calibration.
Expired
2 Factory Cal Parameter measured without errors using an expired factory calibration.
Expired
3 Error Parameter measured with error, sentinel value supplied.
4 Warm-up Sensor is warming up, sentinel value supplied.
5 Sensor Warning Parameter measured but does not meet normal quality criteria. Either the sensor
has sustained moderate damage, or the recommended lifespan has been reached.
6 Calibrating Sensor is calibrating, calibration value supplied.
7 Off Line Sensor communication failed, sentinel value supplied. Make sure the sensor cap
is installed and properly seated.
Appendix G: DB-9 pin Pinout
Pin Signal Name

1 Carrier Detector DCD
2 Receive Data RXD
3 Transmit Data TXD
4 Data Terminal Ready DTR
5 Signal Ground/Common GND
6 Data Set Ready DSR
7 Request to Send RTS
8 Clear to Send CTS
9 Ring Indicator RI

Modbus Communication Protocol 5.10

Uploaded by

Copyright:

Available Formats

Modbus Communication Protocol 5.10

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Modbus Communication Protocol 5.10

Uploaded by

Copyright:

Available Formats

In-Situ Modbus

Level TROLL® 700, 500, 400

Section 2 of this document is an In-Situ generated Modbus protocol tutorial intended to

2.2 Modbus Modes

In-Situ devices support RTU and ASCII modes.

2.3 Protocol Overview

General Message Formats

2.3.1.1 RTU Message Format

Computer (Master) Message Format:

Device (Slave) Response Format:

Device Function Data Payload CRC

2.3.1.2 ASCII Message Format

Computer (Master) Message Format:

Device (Slave) Response Format:

2.3.1.3 IP Message Format

Additionally, TCP/IP is an asynchronous protocol. The significance is that the device

Computer (Master) Message Format:

Device (Slave) Response Format:

• Xac Id: transaction id echoed from message.

Data Addresses (Registers)

All In-Situ Registers are Holding Registers.

Standard Message Formats

2.3.1.4 Read Holding Registers

2.3.1.5 Write Holding Register

Message (8 bytes): Response (8 bytes – message echo):

2.3.1.7 Mask Write Register

Register = (Register Value AND And_Mask) OR (Or_Mask AND (NOT And_Mask))

• The Data Payload layout is defined in the Slave Id Format section.

In-Situ Slave Id Layout Example

3.2 Unsigned Short

3.4 Unsigned Long

MSB Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 LSB

Seconds after reference time, MSB First,

Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

5 Probe Register Map Layout

Probe Common Sensor Common Other Registers

Common Register Map

Communication Control Registers

Register Size Mode Data Description

Sensor Connection Registers

Sensor Map Registers

Current Loop Configuration Registers (Register Map Version 3+)

Logged Record Registers (Register Map Version 3+)

6.3 Device Serial Number

6.4 Manufacture Date

6.5 Firmware, Boot Code, Hardware Versions

6.6 Max Data Logs

6.7 Total Data Log Memory

6.8 Total Battery Ticks

6.9 Last Battery Change

6.10 Device Name

6.11 Site Name

6.13 Current Time

Device Status Bit Values

6.15 Used Battery Ticks

6.17 Max Message/Response Size

6.18 Message Counters

There are 3 message counter registers allocated as follows: