Reading Target Register Using ModBus on Promass F83


Thread Starter


We are trying to develop a small Application which suppose to read data from several Endress & Houser F83 Modbus flow meters using RS485. We have success with device construction and its communication and data acquisition properties stored in the DB. Also the construction of Modbus commands via DB is done. The problem is when we try to read a target register, (2017 - Temperature) we fail.

According to the Description of Device Functions of the "Proline Promass 83 MODBUS RS485 pdf" we have to build the following command to the device:

1. DeviceId
2. FunctionCode
3. StartRegister
4. Register count to read
5. CRC

And have to receive a float represented by 4 bytes (2 registers).

The number of register responsible for Temperature is 2017 (information in decimal numerical format) according to the specs.
The deviceId - is 48
The register count - 2
CRC is being generated.

So the final bytes array that being written to port looks like
[48] - SlaveId
[4] - Function code
[7] - MSB
[225] - LSB
[0] - MSB
[2] - LSB
[36] - CRC
[168] - CRC

The response we get looks like:
[48] - SlaveId
[4] - Function code
[4] - Bytes count (According to device specs)
[225] -MSB
[225] - LSB
[225] - MSB
[225] - LSB
[218] - ?
[211] - ?

These response bytes are not the bytes that we suppose to get.

P.S. Using the original manufacturer software we are able to get correct values. So it is 100% clear that device is OK.

Where do we go wrong?

Any help is appreciated. Thanks in advance!
1) In the industrial communications world, please specify number formats.

Are the values 225 received in the reply
[225] -MSB
[225] - LSB
decimal, octal or hexadecimal?

2) What are the question marks ? ? in the reply? The reply did not include ASCII value for a question mark, did it?

3) For the beginning register in your polling query, how is the number 7 225
[7] - MSB
[225] - LSB
supposed to relate to register 2017, where the temperature value resides?

2017 is 7E1 hex
2016 is 7E0 hex

Try each of those

4) Is there a comprehensive Modbus slave register map for this device?
To Harvard07,

>Try asking for the register pair starting at 2016.

Thanks! 100% success with 2016 to 2017. But the question is why?
> Thanks! 100% success with 2016 to 2017. But the question is why?

Normally the documentation would show this as Register Pair 42017/42018, and that is a dead give away that you must subtract 40001 to identify the starting register.

In this case they have already dropped the 40000 so intuitively try dropping the 1 for the target. Very common in Modbus Register Maps, be aware.