Hello
I have developed software to retrieve Modbus addresses from an old tank level measurement system manufactured by Fisher-Rosemount (Emerson).
This system involves installing at least two pressure transmitters on a tank at a specific height, operating based on the hydrostatic principle. Both instruments are connected to a central unit (HIU) installed just outside the tank

Everything is working correctly, but I have some uncertainty about the process of sending the Zero command to the connected instruments (the pressure transmitters)

page 5-15 and 5-16 here:
https://www.emerson.com/documents/a...c-interface-unit-modbus-protocol-en-76186.pdf

Does anyone know about this old measurement system?
On page 5-16, I can read the addresses of the slave devices connected to the central unit (HIU). The 'Hart device poll' register returns the value 3 (which is 11 in binary), indicating that slave 1 and 2 are active ( the pressure transmitters)

I tried to execute the 'Hart zero command' (page 5-15) by writing '2' to register 296. I don't receive any errors.
Afterwards, I attempted to read register 297 (HART Zero Acknowledge), but it returns a value of zero.
I expected a value of '1,' as in true or succes

The debug output shows a received Modbus frame with no errors. However, I am unsure whether the zeroing process was successful

Instrument 2 is in the atmosphere ( so not tank) , and the pressure read is so low that I'm unsure how to interpret it. I would prefer confirmation via Modbus.

Can any of you provide me with advice?
Thank you

 

I do not understand your interpretation of the HART device poll response of 03hex as being slaves 1 and 2. The table on page 5-16 shows 03hex as Slave 4. How do you get slaves 1 and 2 from the table information?

Does your master use zero-based addressing? If you're polling 30296 (one-based) or 40296 (one-based) then the poll really polling 0295, which is the HART error counter.

Does whatever documentation you have tell you what the HART zero Command does? Does the command force the transmitter to read zero with whatever applied pressure it sees at the moment the command is sent?

 

> Instrument 2 is in the atmosphere ( so not tank)

Usually the smart transmitter command to "zero" is used to zero out any offset due to either
- mounting position, physical tilt of the sensor's diaphragm or position
- applied pressure due to the installation circumstances

If the instrument is not mounted where it should be, re-zeroing might introduce an offset that would not be present in the mounted position. A sensitive, low range DP transmitter always has an offset of at least 1" w.c. when its diaphragm position is rotated from vertical position to a horizontal position, exposed to the atmosphere, no applied pressure.

Presumably these are flange mounted, not capillary seals, because capillary sealed transmitter have a whole different set of zeroing issues.

 

> Instrument 2 is in the atmosphere ( so not tank)

Usually the smart transmitter command to "zero" is used to zero out any offset due to either
- mounting position, physical tilt of the sensor's diaphragm or position
- applied pressure due to the installation circumstances

If the instrument is not mounted where it should be, re-zeroing might introduce an offset that would not be present in the mounted position. A sensitive, low range DP transmitter always has an offset of at least 1" w.c. when its diaphragm position is rotated from vertical position to a horizontal position, exposed to the atmosphere, no applied pressure.

Presumably these are flange mounted, not capillary seals, because capillary sealed transmitter have a whole different set of zeroing issues.

I wrote this software because the old software only works on old computers like 486. On modern computers, it returns an error message like 'error divided by zero.' I have already tried using emulators or programs that 'slow down' the execution speed

The old software is capable of run the zeroing, and I can see how the pressure goes to zero within a few seconds. In fact, I noticed that once the command is sent, it waits for a few seconds and then returns a successful message
I'm not sure what that pause is. The procedure would be to pass the slave address and then issue the zero command

The register 298 (Hart device poll) is a data type bits, so I presume that 3 means '11' in binary, which is bit0=1 and bit1=1
I'm thinking of using an RS-232 sniffer, that is, a board inserted between the old computer and the AIM402 ( the modbus 'receiver'), to read the zero command. Do you know of any sniffer boards?

 

bench-made sniffer DB9 hardware here:
https://electronics.stackexchange.com/questions/63865/rs-232-serial-sniffing

another construct-a-cable:
https://store.chipkin.com/articles/rs232-how-can-i-do-serial-port-sniffing-snooping-through-rs232