4G Cellular IoT

Modbus MQTT RTU

S275
User Manual
Ver 2.7

Date Issued: 2020-08-05

King Pigeon Hi-Tech. Co., Ltd.

www.iot-solution.com
 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Table of contents
1. Brief Introduction -------------------------------------------------------------------------------3
2. Safety Directions---------------------------------------------------------------------------------4
3. Standard Packing List---------------------------------------------------------------------------4
4. Mainly Features----------------------------------------------------------------------------------5
5. Physical Layout and Installation Diagram-------------------------------------------------6
6. Settings & Operations -------------------------------------------------------------------------11
7. Example Of Applications---------------------------------------------------------------------36
8. Device SMS Command and SMS APP------------------------------------------------------52
9. Device GPRS/3G/4G Communication Protocol------------------------------------------55
10. Upgrade Firmware-----------------------------------------------------------------------------73
11. Cellular Module Upgrade---------------------------------------------------------------------73
12. Warranty------------------------------------------------------------------------------------------74
This handbook has been designed as a guide to the installation and operation of S273/S274/275
GSM/SMS/GPRS/3G/4G Cellular IoT Modbus RTU
Statements contained in the handbook are general guidelines only and in no way are designed to supersede the
instructions contained with other products.
We recommend that the advice of a registered electrician be sought before any Installation work commences.
King Pigeon Hi-Tech.Co., Ltd, its employees and distributors, accept no liability for any loss or damage including
consequential damage due to reliance on any material contained in this handbook.
King Pigeon Hi-Tech.Co., Ltd, its employees and distributors, accept no liability for GSM Network upgrading or
SIMCard upgrading due to the technology specifications contained in this handbook.

【UPGRADE HISTORY】
CONFIGURATO FIRMWARE HARDWARE
DATE DESCRIPTION
R VERSION VERSION VERSION
1.DIN status revised to reverse from V2.4
version, only support V2.5 configurator
2018.12.
V2.5 V2.5 V2.4 software.
13
2.The total value range function of DIN1
pulse count upgraded.
2020.7.2 1. Add DIN1-3 pulse counter
V2.7 V2.7 V2.7
3 2. Add MQTT

Page 2 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Model List

Temp& Mapping Registers

Model DIN AIN DO SD card USB RS485
Humi Boolean 16Bit 32Bit 64Bit
S272 8 6 4 1 8G 1 1 64 64 × ×
S275 8 6 4 1 8G 1 1 64 128 64 64
1.Default version is GSM/GPRS module inside.
Notice
2.For 3G WCDMA, 4G LTE version, please tell our sales where would you like to use them.

S27 Application Example

Page 3 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

S27 Setting Process Diagram

1. Brief introduction

The Cellular IoT Modbus RTU is an industrial class, high reliability, high stability, and programmable Remote
Terminal Unit (RTU). It embedded 32-Bit High Performance Microprocessor MCU, inbuilt industrial Cellular
module. It provides 8 digital inputs, 6 analog or PT100 Resistance Temperature Detector (RTD) inputs, 4 relay
outputs, 1 ambient sensor input for monitoring onsite temperature and humidity, and RS485 serial port, supports
80/224/320 mapping registers via Modbus RTU protocol. It can monitoring and operates the I/O ports by SMS, APP,
Web Server, internet, timers and programmed inter-lock events automatically.

The Cellular IoT Modbus RTU inbuilt TCP/IP protocol stack make it suitable for internet of things (IoT) applications,
it can be easily to operate by the provided cloud, app, and web server, or integrated to you IoT applications
according to the TCP/UDP protocol, or integrated to SCADA systems by standard Modbus TCP protocol, too. This is
very useful if you need remote control onsite devices with low cost solution.
The Cellular IoT Modbus RTU is design for working in the harsh industrial application environment, widely used in a
variety of industrial automation, security monitoring system, automatically measurement and control system, BTS
monitoring, remote data acquisition, telemetrically systems, automatically control system. It can be used as a
remote switch, remote I/O, remote smart PLC, timer switches.

The Cellular IoT Modbus RTU can be used as remote access control for BTS monitoring, the authorized users can
open the gate or turn on the machine with a free charge call at specified time, this is useful for daily maintenance
to save the time of traditional authorized.

The Cellular IoT Modbus RTU supports transparent data transmission and performs as Modbus Slave over
GPRS/3G/4G network and RS485 serial port. Moreover, the Cellular IoT Modbus RTU can be used as Modbus RTU
Master to reading smart meters, I/O modules, PLC, and converts to SMS alert once triggered the threshold value,
or transmit data to remote server over GPRS/3G/4G network.

Page 4 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Typically applications:

BTS Monitoring, Security Alarm System applications, Supervision and monitoring alarm systems, Automatic
monitoring system, Vending Machines security protection, Pumping Stations, Tanks, Oil or Water levels, Buildings
and Real Estate, Weather Stations, River Monitoring and Flood Control, Oil and gas pipelines, Corrosion protection,
Temperatures, water leakage applications, Wellheads, boat, vehicle, Energy saving, street lights control system,
Valve controls, Transformer stations, Unmanned machine rooms, Control room application, Automation System,
M2M, Access Control System, etc.

2.Safety Directions
Safe Startup
Do not use the unit when using GSM/3G/4G equipment is prohibited or might bring disturbance or
danger.
Interference
All wireless equipment might interfere network signals of the unit and influence its performance.

3. Standard Packing List

Gateway X1; AC/DC Adaptor X1; GSM/3G/4G Antenna X1;User Manual X1; PC Configurator X1 .
Note: The package does not include any SIM card.

Optional: 35mm Standard DIN rail fixed Bracket

4. 1Mainly Features

 GSM/GPRS/3G/4G network communication, can be operated from anywhere, no distance limitation;

 Wide range power supply 9~36VDC with over voltage and phase-reversal protection;

 Embedded ARM Cortex -M4 32 Bit RISC Core, 168 MHz inside, RTOS system, reliable performance
with in-built watchdog;
 8 digital inputs, compatibles dry and wet contact. Logic level: 0~0. 5V or short circuit treated as close, +3~30V
or open circuits treated as open.DIN0 as a high-speed pulse counter, sampling frequency: 1MHz;DIN1~3 as
low-speed pulse counter, anti-shake time can be set 1~2000ms, default 1ms;
 DIN1 as arm and disarm function;

Page 5 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
 4 relay output (5A/30VDC,5A/250VAC), can auto control by timer, alarm-link and remote control by SMS,
cloud. The first DO can set time to control by authorize number;
 1 temperature & humidity sensor input for monitoring onsite environment, the sensor model is AM2301,
Measures temperatures from -40-80°C,0.5°C accuracy, Relative Humidity from 0-99RH%, accuracy is 3%;
 6 analog inputs, 12bits resolution, supports 0-5V, 0-20mA, 4-20mA output transducers;
 Inbuilt 8G SD card to save up to tens of thousands historical data and events;
 1 RS485 port, support Modbus slave protocol, can link up to SCADA、HMI、DSC. Support Modbus Master
protocol, can extend up to 16 Modbus Salve device, e.g.: Data Acquisition Module, meters, generator, PLC,
VFD, etc., and 320 tags can set alarm value and content, also support data transparent transmission;
 Powerful SMS function: Threshold high SMS alert, SMS set, SMS inquiry, SMS command for Modbus PLC..., and
SMS monitoring communication with Slaves;
 Inbuilt 2 DC output for external transducers to save wiring cost;
 Automatically resend the data while communication interrupt or failure, and failure will alert by SMS text to
users;
 Supports remotely restart the RTU, and configure& operate it by SMS commands remotely;
 10 SMS Alert and auto dial numbers for receiving alarm message, can program to receive specified alarm
message. The authorized numbers also can dial to open the door or turn on/off machine with a free charge
call at the specified time;
 Inbuilt inter-lock logic programmer and powerful timer program function;
 Modular structure design, replace a module can upgrade the network from 2G to 3G/4G or 3G to 4G;
 Support SMS, dial, GPRS, 3G , 4G network for alert, USB port for configuration and upgrade firmware;
 Inbuilt large capacity automatically rechargeable backup battery, alert when external power failure;
 Support TCP/UDP, MQTT,Modbus TCP, Modbus RTU over TCP, King Pigeon IoT RTU protocol and data
transparent transmission function;
 Using metal shell, protection class IP30. Metal shell and system security isolation, especially suitable for
industrial applications in the field;
 L195 * W88 * H30mm, compatible wall installation and DIN35mm industrial rail installation.

4. 2 Specifications
Item Reference Scope
DC Power supply Standard adapter: DC 12V/2A Range 9-36VDC
Power consumption Standby:12V/50mA; Working Max.: 12V/150mA
GSM Frequency 850/900/1800/1900Mhz
3G/4G Optional: WCDMA/TDD-LTE/FDD-LTE
TCP/IP stack TCP,UDP
SIM interface Supporting 3V and 1.8V SIM Card
External antenna SMA Antenna interface, 50 Ohm, Gain: 3dB
Serial Interfaces 1 USB Port
SMS, GPRS UDP,TCP, MQTT,Modbus RTU over TCP and King Pigeon RTU
Protocols
protocol.
RS485 1 RS485, Support Transparent transmission and Modbus RTU Slave,

Page 6 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Modbus RTU Master.
Digital Inputs 8 Digital input, NC/NO type, one of it can be used as Pulse Counters;
Analog Inputs 6 Analog Inputs. 12 bit resolution, 0-5V or 0-20mA or 4-20mA;
Temp.&Hum Inputs Temperature range: -40°C to +80°C, Humidity Range: 0~100%RH;
Relay Outputs 4, Rated: 5A/30VDC,5A/250VAC
Power Outputs 2 Port, for external device;
Extend I/O Tags Max.320
Memory Capacity Internal 8G SD card inside, can save the data for 100000events.
Backup Battery 3.7V 900mAH
Temperature range -20-+70 °C
Humidity range Relative humidity 95% (condensation free)
Exterior dimension 195mm*88mm*30mm
Net Weight 350g

5. Physical Layout and Installation Diagram

5.1 Control Unit size and physical layout

Page 7 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

LED Indicator Definition

Power RTU status indicator, LED ON when switched RTU on..

Cellular network indicator. When 2G register network, off 2 seconds, on 0.5s and
so on; When 3G 4G register network, on 2s, off 0.5s...Flicks quickly means data
transmission.
Alarm Alarm Indicator, alarm will ON and flick. Normally is OFF;
Arm Arm/Disarmed Indicator, Arm is ON, disarmed is OFF.
RTU running status indicator, ON or OFF stands for RTU halted, flicks slowly stands for
Run
RTU running.
RS485 When transmitting data by RS485, the LED will flick, otherwise, it is off.
Backside Switch & Button Definition

SIM Card Slot For SIM Card Installation, only supports 1.8V/3V SIM Card
Power Switch For switch ON or OFF the RTU
Upgrade For upgrade firmware purpose only. Only when upgrade new firmware version will use it,

Page 8 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Firmware Switch otherwise keep it at Work Side all the time.
Power Connector Definition

DC IN+ External DC Power input port, Connect to 1.5A@9~36V DC power, positive electrode.
DC IN- External DC Power Input port, contact to negative electrode
Power source output port, positive electrode. Provides power from RTU to external
transducers or sensors or detectors. The output current should less than the power from
DC Out+
DC IN inputs. If adapter current is 2A, then suggest external transducer current to be less
than 1.5A
DC Out - Power source output port, Negative electrode.
DIP Switch Definition

For setting the RTU Mode is in Configuration Mode or Run mode.

Switch it to upside is Set Mode, under this mode, the user can use PC Configurator via
SET/RUN USB cable to configure the RTU Parameters or Read Parameter settings.
Switch it to Downside is Run Mode, under this mode, the RTU is in Running mode.
Tips: When device mode changed, need to switch off/on the device.
The 1st channel of analog input type switch. If not use this channel then no matter is
upside or downside.
Switch it to upside stands for the 1st analog input should connect to 0~5V voltage output
0/V/mA transducer.
Switch it to Downside stands for the 1st analog input should connect to 0~20mA or
4~20mA current output transducer.
Tips: The wrong side will cause device can't read the analog value.
The 2nd to 6th channel of analog input type switch. If not use this channel then no matter
is upside or downside.
Switch it to upside stands for the related analog input should connect to 0~5V voltage
1/V/mA~5/V/mA
output transducer.
Switch it to Downside stands for the related analog input should connect to 0~20mA or
4~20mA current output transducer.
Analog Input Definition

Analog inputs, Sampling frequency 200mS, 12bits resolution, supports 0-5V, 0-20mA, 4-20mA output
transducers, please refer to abovementioned DIP Switch Definition to connect the correct transducers.
The 1st Channel Analog input. + stands for positive electrode, - stands for negative
0+/0-
electrode.
The 2nd ~6th Channel Analog input. + stands for positive electrode, - stands for negative
1+/1- ~5+/5-
electrode.
Digital Input Definition

Page 9 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Dry contact or wet contact, sampling frequency 200mS . Logic level: 0~0. 5V or short circuit treated as close,
+3~30V or open circuits treated as open. One of the input can be used as counter, sampling frequency is
1Mhz,the second input can be used for Arm/Disarm.
0 The 1st digital input, positive electrode.
1~7 The 2nd~8th digital input, positive electrode.
GND GND for digital inputs, negative electrode.
ATN Port Connector Definition
ATN GSM/3G/4G Antenna connector, 50Ohm, SMA male.
USB Port Connector Definition
USB USB port, for configuration and upgrading firmware and exporting historical data;
Temperature Humidity Sensor Port Definitions

Temperature & Humidity sensor AM230x input. Measurement Range: Temperature:

T/H
-40°C to +80°C, Humidity: 0~100%RH.
Digital Solid Relay Output Connector Definition

Solid Relay inside for outputs, Rated Capacity: 5A/30VDC,5A/250VAC.

The 1st Channel Solid Relay Output. + stands for positive electrode, - stands for negative
0+/0-
electrode.
The 2nd ~ 4th Channel Solid Relay Output. + stands for positive electrode, - stands for
1+/1- ~ 3+/3-
negative electrode.
RS232/RS485 Ports Definition

GND Ground
A/B RS485 A /B

5.2 Wiring

Page 10 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

6. Settings&Operation
The GSM SMS GPRS 3G 4G Cellular IoT Modbus RTU is user-friendly design. The user can setup it or export historic
data by the PC Configuration through USB cable, and upgrade firmware by USB port. The GSM SMS GPRS 3G 4G

Page 11 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Cellular IoT Modbus RTU also can be configured some basically parameters by SMS Commands, please refer to SMS
Command App or Command List.
Tips!
1) Please insert the SIM Card firstly, and install the GSM/3G/4G Antenna, please power on to check the LEDs status according to above
mentioned LED Definitions, keep switch on it during the programming.
2) The PC Configuration in the CD, please click it to run it. Also can download from www.GPRS-M2M.com under S273/4/5 page
directly.
Below is the steps to setup the parameters by PC Configuration, please follow it step by step.

Start to Configure:
Step1: Install the Configurator
Download from www.GPRS-M2M.com, then installs it on the computer.

Step2: Connection
Please insert the SIM Card, and install the GSM/3G/4G Antenna.

Step3: Switch the DIP Switch to Setup Mode. (Before Power On the RTU)
Switch it to upside is Set Mode, under this mode, the user can use PC Configurator via USB cable to
configure the RTU Parameters or Read Parameter settings.
Notice:
Please switch it to Downside after you finished the configurations. Otherwise, the RTU cannot work properly. The Downside is
Run Mode, under this mode; the RTU is in Running mode.

Notice:when setting,pls switch to set

mode,after save settings,pls switch
to Run mode.(in Run mode,can’t
save settings)

Step4: Connect the Gateway to the PC by USB Cable. And connect the external DC Power to DC Power Ports,
Power on, and switch on the device, see below:

Step5: Install USB Drvier

Install the USB Driver to the computer from the CD firstly. When successful, it can be found out at the device
manager of the XP or Windows 7 or Win8/Win10, please see the below photo. Also, the driver for different
OS can be downloaded from Silicon Laboratories, Inc. http://www.silabs.com , the model is CP210x.

Page 12 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Step6: Run the Configurator (Compatible with Windows XP/7/8/10)

Tips: In some computer, it required download net framework 4.0 while installation, then please click “Yes” to go to
Microsoft website to download this service pack.

Please click to run it. Enter the password, default is 1234. Then you can enter the

configuration page as below:

Notice:
If display the below windows, then means the RTU connect to the PC failure. The reasons are below:

1) USB Driver installation failure;

2) USB Cable connection is disconnected;
3) The DIP Switch in RUN mode, not in SET mode;
4) The Upgrade Firmware Switch at Load side, not at Work side.
5) Power Switch switched off or DC Power Connection is disconnected.

Step7: Choose the correct "COM port" in device manager above, enter the password(default is

Page 13 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
1234),click the "OK" to connect and start to program
Details please check the picture as below:

Tips: If not connect successfully, will not enter into next step. Pls check if USB connect well, or COM port and
password correct or not.

Setting Self-checking
Phenomenon Possible Reason
1. USB Driver installation failure;
2. COM Port not correct or USB driver installation failure;
3. Device not enter into setting mode:
1) Only power light on, that means the Upgrade Firmware Switch at Load side,
Can't enter software not at Work side. Solution: Switch the power switch to OFF---->
Upgrade switch to Work side----> Power switch to ON.
2) Signal light flicks, that means device in working mode. Maybe had not
rebooted the device after switch mode switch to Set.
(In setting mode, Power light normal ON, Run light flicks, other lights Off.)
1. The Upgrade Firmware Switch at Load side, not at Work side.
Solution: Switch the power switch to OFF---->Upgrade switch to Work side---->
After switching panel on,
Power switch to ON;
only Power light on, panel
2. SD card fall out from the slot. Solution: Shake panel to listen if there is voice or
can't work
not;
3. In upgrade mode, use upgrade tool erased the firmware.
1. The Upgrade Firmware Switch at Load side, not at Work side.
Solution: Switch the power switch to OFF---->Upgrade switch to Work side---->
Can't enter into working
Power switch to ON;
mode
2. Device in setting mode. Solution: Switch device OFF---->Mode switch to
"Run"---->Switch the device on.
1. Have not installed driver;
2. PC system problem cause driver installation failure, can't support Apple OS
Can't find COM Port
system.
3.Check USB line, and try other common driver software such as "Drive TheLife".
In working mode, the Have not set the device ID. Solution: In setting mode, set device ID---->Switch the
device not response the device to Run mode.
Modbus command
After switching panel on, After parameter setting, although clicked "Save" in every page, but missed the

Page 14 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
not running according to final "Save Setting" in the menu.
parameter setting Solution: Back to Set mode---->Click "Save" Button after setting one
page---->After all page set successfully, click "Save Setting" in the menu.

Terms usually used by Cellular IoT Modbus RTU

Cellular IoT RTU, Modbus RTU, Modbus Master, Modbus Slave, Modbus RTU Over TCP,
Modbus TCP, Arm, Disarm...

Configurator software interface and running

Select card and enter setting

Save : Click it to save all of the PC Configurator parameters to the RTU;

Import Configuration file: Click it to load additional configuration file to the Configurator;
Export Configuration file: Click it to save the present configuration parameters as a profile for next RTU
configurating or backup the parameter settings.
Tips: The Import and export configuration file is very useful while you need to program bulks of RTU with similar parameters.
After programmed the first unit then you can export profile to save it, for the second RTU then you can load profile directly to save
you time.
Factory Reset: Click it to recovery the parameters to factory defaults.

Page 15 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Notice:
1. After setting or revising parameter, need to click the "Save" button of this page, then click "Save Settings" in menu for
saving parameters in device
2. Before S275 export configuration, need to read Slaves configuration details first, to avoid Slaves information missing.
3.Easy way to revise parameter: Open parameter setting page---->Click "Read" button to get device current value
---->Revise and click "Save" button---->Click the "Save Settings" button in the menu.
4. Switch the device mode to "Run" as below, otherwise it will not work;

Upside is Set mode,switch to downside is Run mode.Pls set the device

in Set mode,and save settings,then switch to Run mode.In Run
mode,settings can not be saved and effective!!!

5. Reboot the device, switch the Power Switch to OFF, then switch it to ON, the device will enter into normal
running mode after that

Basic Settings
Reminder: Please click the "Read" for previous parameter before starting to set.

Modify Password: This is for modifying the RTU’s Password, default is 1234.
Synchronous device time: This is to setup the RTU’s time for daily report or other timers. After click Write
the RTU Time, the RTU will be synchronous the same time as the PC. If connect to King Pigeon Cloud

Page 16 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Server, no need this step.
Device ID: Non-necessary. This is mainly for monitoring center to identify the RTU;
If communicate via Modbus protocol, device ID only can be 1~247.
Device description: This is the description of the RTU, e.g.: installation address,
usage instructions and so on.
Add Timestamp to Alarm SMS: Tick it stands for while alarm occurrence, the Alarm SMS
will include the RTU’S current time information at the SMS Content.
Arm automatically when Power On: Tick it stands for once the RTU powered up, the RTU
will enter into Arm Mode automatically.
Auto Arm after Disarmed: Fill the timeout to enter into Armed Mode automatically after
disarmed operation. This is useful for security protection applications.
Tips:
Arm: Under this mode, any alarm occurrence will send SMS and dial the authorized numbers immediately. And execute the
programmed I/O outputs.
Disarmed: Under this mode, alarm occurrence will not send SMS & dial the authorized numbers.
Timer Reporting SMS Content Settings: Tick the related items to add its value/status to the
Timer report SMS contents.
Alarm SMS Content Settings: Ticks the related items to add its value/status to the Alarm
SMS Contents.

Alarm Number Settings

This is to setup the Authorized User Telephone Numbers to receive the Alarm SMS or dial. Tick it stands for
while the related event alarm occurrence will send SMS to this number.

Reminder:
Please remember that click "Save" -" Save Settings" button to save it after parameter be written, below pages
are the same.

Page 17 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Power On: Tick it stands for while the RTU powered up, will automatically send SMS to this number,
include device model, version, description, IMEI, status, signal value etc....
Timer Report: Tick it stands for Timer report SMS will send to this number.
Arm/Disarm: Tick it stands for Arm or Disarm the RTU, will send SMS to this number.
Low Signal: Tick it stands for while GSM/3G/4G Network signal strength lower than 14 will send SMS
to this number.
Power Lost: Tick it stands for while external DC Power loss will send SMS to this number.
Power Recovery: Tick it stands for while external DC Power recovery, will send SMS to this number.
GPRS Failure: Tick it stands for while GPRS connection re-try 3 times and still failure will send
SMS to this number.
Relay Switch: Tick it stands for while the Digital Solid Relay Output action will send SMS to
this number.
Slave Alarm: Tick it stands for the salve tag triggered will send SMS to this number.
Slave Failure: Tick it stands for when slave communication failure alarm verify time arrive,
will send SMS to this number.

Digital Output Relay Output Setting

This page is to setup the Output parameters and definite the output usages. The outputs will be used
in the Interlock Page for programmable logic events.

Output Type: Support 3 output types. The user can choose the Output Type for the relay
outputs, includes Open Door, Switch ON/OFF, Siren. The relay 2 and 3 only used for Switch
ON/OFF; Relay 0 can option as Open Door and Switch ON/OFF; Relay 1 can option as Siren
and Switch ON/OFF.
1) Open Door: Only the first Channel(DO0) can be setup as Open Door, use it for electric lock.
If setup as Open Door, then the authorized number calls in RTU, can open the electric

Page 18 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Lock directly or output a pulse signal and disarmed the RTU directly. See Access Control
page about the authorized number.
Notice:
If relay 0 used for Open Door, then can't be action as normal Switch ON/OFF.

Application:
When RTU installed in generator room, many workers out and in, not convenience and safe for everyone
taking keys. This function can authorize the person to remotely control the door and disarm the device within
appointed time, avoid fault anti-thief alert. After worker maintenance the generator room, can touch the
inside Arm/Disarm switch button to arm device, DIN2 can do this.

2) Switch ON/OFF: For switch on/off device.

3) Siren: This is for output pulse signal for siren sounds, If setup as Siren, then while the RTU
alarm and ticked the Siren function in AIN or DIN trigger pages, then this channel will
execute the setting parameters.

Channel Name: to setup the Output Channel name, e.g.: Pump or Motor and so on, in order
to identify it in SMS Contents.
Open Description: Stands for when the Relay Open, send what SMS to the authorized numbers;
Close Description: Stands for when the Relay Close, send what SMS to the authorized numbers.
Close Time: Stands for the relay close and last time, default 0 second, means always close.
Repeat Times: Stands for how many times does this relay should to repeat.
Interval Time: Stands for interval how many seconds then the relay repeat the action again.
Match with "Repeat Times" can work as pulse output, unit: second.
ON/OFF SMS: Tick it stands for while the Recovery action, will also send SMS to the
authorized numbers;

Access Control Setting

This page is for setting which authorized number at what time can dial to the RTU and let the first channel
(DO0) output a pulse output.
Only when the output types of the first channel (DO0) setup as Open Door can dial to control it.
It is very useful for serviceman dial to open the electric lock door and disarmed at specified time of the
Room. Also this function can be used as authorized number dial in the RTU to output a pulse output or
always close then call again open the relay at specified time. In this condition, please setup the output type
of DO0 as Open Door, and setup other parameters correctly, and remember to setup the Auto Arm after
Disarmed time as 0 to keep the RTU in Armed Mode if required.

Page 19 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Tick the box ahead the User No. stands for enable the first Authorized number can dial in to let the first
channel (DO0) output a pulse output.

Start Time: Stands for from what time this authorized number can dial in to control it.
End Time: Stands for till what time this authorized number cannot dial in to control it.
Always: Stands for this authorized number can dial in to control it all the time.

DI Trigger Settings
This page is for setting the digital input alarm conditions and usages.

Page 20 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Input Type: The user can choose the input type for related channel. Includes: Counter, Arm/Disarm,
NC, NO, Change and Disabled.
1) Disabled: Not use this channel.
2) NC: For connecting Normal close type detector, open will alarm.
3) NO: For connecting normal open type detector, close will alarm.
4) Change: For connecting normal open or normal close type detector, once the status
changed, will be treated as alarm.
5) Counter: DIN0 as a high-speed pulse counter, sampling frequency: 1MHz;
DIN1~3 as low-speed pulse counter, anti-shake time can be set 1~2000ms, default 1ms;
Need to tick up the Pulse Counter box to setup initial value and interval alarm value and
total alarm value. E.g.: contact a PIR sensor to count how many people pass through the
ATM machine and so on.
6) Arm/Disarm: Only the Second Channel (DIN1) can be used as Arm/Disarm Switch. For
connecting a pulse output type switch to Arm or Disarmed the RTU.
Alarm SMS: Under Arm or 24h status, once triggered will send this SMS content to
authorized numbers.
Recovery SMS: Under Arm or 24h status, if tick the "Recovery Alarm", when triggered digital input
recovery normal will send this SMS content to authorize number.
Change SMS: Under Arm or 24hr status, only when digital input choose "Change" type, once
action will send this SMS to authorize number.
Current Status: Stands for input’s current status.
Alarm Verify Time: Stands for when the digital input Close or Open last time more than this
value, will be treated as a true alarm, if less than this value, then will not alarm.
Siren: Tick it stands for while this digital input triggering, the DO that output type was setup as
Siren will execute its output parameters.
24Hr: Tick it stands for no matter the RTU is in Arm or Disarmed mode, this digital input triggered
will alarm.
Initial Value: When DIN0 as counter, the value begin to count.
Interval Alarm Value: DIN0 as counter, under Arm or 24hr status, when counter value arrive
"Interval Alarm Value" will send SMS to authorize number.

Page 21 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Total Alarm Value: When counter value arrive "Total Alarm Value", will automatically refresh it
to "Initial Value". Under Arm or 24hr status, will call and SMS to authorize number.
Step Alarm SMS: When step alarm, will send this SMS to authorize number.
Total Alarm SMS: When arrive total max value, will send this SMS to authorize number.

DI/AI Alarm Settings

This page is for setup while DI/AI alarm, send SMS & Dial to which authorized numbers. Tick it stands for
enable to send SMS or dial the related authorized number, see below page is for DI settings, the AI Alarm
Settings is the same:

AI Trigger Settings
This page is to setup the analog input alarm conditions and analog input parameter. AIN can be used for
monitoring temperature, current, voltage, power factor, water level, pressure, environment, wind speed...
And also one channel temperature and humidity transducer can be connected as below:

Page 22 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Input Type: The user can choose the input type for related channel. Includes: Disable, 0~5V, 0~20mA,
4~20mA.
1) Disabled: Not use this channel.
2) 0~5V: For connecting transducers that output voltage 0~5V. Please remember to switch
the related channel DIP switch to V side, see DIP Switch Definitions.
3) 0~20mA: For connecting transducers that output current 0~20mA, Please remember to
switch the related channel DIP switch to A side, see DIP Switch Definitions.
4) 4~20mA: For connecting For connecting transducers that output current 0~20mA, Please
remember to switch the related channel DIP switch to A side, see DIP Switch Definitions.
5) Temperature and Humidity: Enable/Disable support. Only accept AMS230x series sensor,
the temperature maximum is 80, minimum is -40, and Humidity maximum is 100,
minimum is 0, cannot change them.
High Alarm SMS: Under Arm or 24h status, once current value higher than threshold high value will
send this SMS content to authorized numbers.
Low Alarm SMS: Under Arm or 24h status, once current value lower than threshold low value will
send this SMS content to authorized numbers.
Recovery SMS: Under Arm or 24h status, if tick the "Recovery Alarm", when current value recovery
normal will send this SMS content to authorize number.
Maximum: The transducer’s maximum measure range. E.g.:100 Celsius degree. Usually it can
be found out at the transducer’s specification.
Minimum: The transducer’s minimum measure range. E.g : -50 Celsius degree. Usually it can
be found out at the transducer’s specification.
Current Value: Stands for input’s current value of the transducers.
Threshold High: The high value(reached) need to alarm; Example: set 50Celsius degree to alert.
Threshold Low: The low value(reached) need to alarm; Example: set -30Celsius degree to alert.
Recovery Alarm: Tick it stands for when the analog input recovery, will send SMS to the
authorized numbers.
Siren: Tick it stands for while this input triggering, the DO that output type was setup as Siren

Page 23 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
will execute the its output parameters.
24Hr: Tick it stands for no matter the RTU is in Arm or Disarmed mode, this input triggered
will alarm.

Timer Settings
This page is for setup hour timer and periodically timer, it is useful for scheduling when to execute what
action automatically or it with repeat this action according to the interval time. Total can program 10
scheduling events. Tick it stands for enable this timer event:

Reminder:
When GPRS/3G/4G data transmission protocol is King Pigeon IoT RTU Protocol, the periodically auto upload
default enable and upload every 5 minutes.
Tick stands for enable this timer function, otherwise is disable.
Weekly+Hour+Minute: Stands for what day and at what time does the RTU should start to
execute the action and interval how many seconds then repeat to execute the action.
Interval: Stands for interval how many seconds does the RTU should repeat to execute the action.
If setup it as 0, then this event will not be repeated.
Action: Stands for what action does the RTU should to execute at the specified time.

Question: Have set the timer SMS report, but finally not get the SMS.
Solution: Have no ticked the "Timer Reporting SMS Content" in first Basic Parameter Settings page.

Logic Trigger Setting

This page is for setup if what happen, then what action does the RTU should execute, it is a programmable
logic events. Total can program up to 40 logic events for automatically control purposes.

Page 24 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Event: Stands for if this occurrence.

Action: Stands for then what action does the RTU should execute.

RS485 Serial Port Setting

This page is for setup the serial port parameters. Over the RS485, the S275 RTU can be used as Modbus RTU
Slave, Modbus RTU Master and transparent transmission.

Modbus RTU Master: Stands for the RS485 used for Modbus RTU Master.
Modbus RTU Slave: Stands for the RS485 used for Modbus RTU Slave, and the "Scan rate", "Time
out" and "Slave failure verify time " of Master function will be disable.
Baud Rate: 1200/2400/4800/9600/19200/38400/57600/115200 optional.

Page 25 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Data Bit: 8 bit.
Parity Bit: None, Even and Odd optional.
Stop Bit: 1 or 2 stop bit optional.
Scan rate: When RS485 used as Master, the interval time between two polling command.
Time out: When RS485 used as Master, after sending command to slave, the longest time waiting for
slave data back. If longer than this setting value, will ensure slave no response.
Slave failure verity time: When RS485 used as Master, if no response time between Master and Slave
longer than this value, will send SMS to authorize number.

Modbus RTU Slave function:

When RS485 as Modbus RTU Slave, can be connected to HMI, SCADA, DCS, PLC... as below:

RTU I/O Register List and function code:

Read Input Coil (Function Code 02: Read Coil)

Register Address
Definition Description
(Decimal)
DIN0 value, when dry contact, NC=1, NO=0; When wet
0 RTU DIN0
contract, 0~0.5V=1, 3~24V=0
DIN1 value, when dry contact, NC=1, NO=0; When wet
1 RTU DIN1
contract, 0~0.5V=1, 3~24V=0
DIN2 value, when dry contact, NC=1, NO=0; When wet
2 RTU DIN2
contract, 0~0.5V=1, 3~24V=0
DIN3 value, when dry contact, NC=1, NO=0; When wet
3 RTU DIN3
contract, 0~0.5V=1, 3~24V=0
DIN4 value, when dry contact, NC=1, NO=0; When wet
4 RTU DIN4
contract, 0~0.5V=1, 3~24V=0
DIN5 value, when dry contact, NC=1, NO=0; When wet
5 RTU DIN5
contract, 0~0.5V=1, 3~24V=0
DIN6 value, when dry contact, NC=1, NO=0; When wet
6 RTU DIN6
contract, 0~0.5V=1, 3~24V=0
DIN7 value, when dry contact, NC=1, NO=0; When wet
7 RTU DIN7
contract, 0~0.5V=1, 3~24V=0

Read Input Register (Function Code 4: Read Input Register.)

Page 26 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Register Address
Definition Data Type Description
(Decimal)
AIN0 value, real value= AIN0
0 RTU AIN0
value/100
AIN1 value, real value= AIN0
2 RTU AIN1
value/100
AIN2 value, real value= AIN0
4 RTU AIN2
32 Bit Signed ABCD value/100
1 Byte in Modbus protocol AIN3 value, real value= AIN0
6 RTU AIN3
value/100
AIN4 value, real value= AIN0
8 RTU AIN4
value/100
AIN5 value, real value= AIN0
10 RTU AIN5
value/100
(reserved, not
12--13 ... ...
work)
16 Bit Unsigned AB External power voltage, real
14 RTU Power
1 Byte in Modbus protocol value= Power value/100
(reserved, not
15--23 ... ...
work)
AM2301 Temperature value
16 Bit Signed AB
24 (*100), real value=
RTU Temperature 1 Byte in Modbus protocol
Temperature value/100
AM2301 Humidity value
16 Bit Signed AB
25 RTU Humidity (*100), real value= Humidity
1 Byte in Modbus protocol
value/100.
RTU DIN0 Count This value Enable when DIN0 as
26 32 Bit Unsigned
Value counter mode

Read and Write Holding Coil (Function Code 1, Function Code 5, Function Code 15.)
Register Address
Definition Description
(Decimal)
0 RTU DO0 DO0 Value, Read/Write, 1=Close, 0=Open
1 RTU DO1 DO1 Value, Read/Write, 1=Close, 0=Open
2 RTU DO2 DO2 Value, Read/Write, 1=Close, 0=Open
3 RTU DO3 DO3 Value, Read/Write, 1=Close, 0=Open
4--63 (reserved, not work)

Transparent Transmission:
The RS485 can be used as transparent transmission, transmit the device data on this serial port to
GPRS/3G/4G, the device not deal with or store any data, only do as a data transmit channel, converter serial
port to TCP/IP.
This function can be used for connecting PLC, Remote I/O data acquisition module, Smart meter, Power

Page 27 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
monitoring moduel, Smart transducer, Diesel generator, Accumulator battery monitoring system...

Modbus RTU Master function:

When RS485 as Modbus RTU Master with mapping registers, support max 16 slaves for connecting PLC,
Remote I/O data acquisition module, Smart meter, Power monitoring module, Smart transducer, Diesel
generator, UPS, Accumulator battery monitoring system...; Can mapping register value from Slave to
Master, these registers’ can be setup high or low threshold value, and NC/NO type, moreover, can enable
to send SMS to users once alarm occurrence by the registers if required. Also can remote control Slaves
by writing coil.

Page 28 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Mapping Register Table and function code:

Reminder:
1.Use this function code when connect to Modbus RTU/Modbus TCP upper computer via GPRS/3G/4G (Device as Modbus
RTU Slave). Stands for when Cloud communication with S275, the S275 is Modbus RTU Slave of Cloud Server.
2. When device connect to Modbus RTU/Modbus TCP upper computer via GPRS/3G/4G (Device as Modbus
RTU Slave). The I/O of S275 itself refer to "Modbus RTU Slave function" above.
Boolean Slave Register Assignment Table(S272 &S275)

Holding Coil (Function Code 1, Function Code 5, Function Code 15.)

Boolean Register Address
Definition Description
(Decimal)
Boolean type, slave mapping address, can mapping slave
64 Boolean 64
input coil and holding coil status.
65 Boolean 65 Same as above
125 data similar as
…… Same as above
above
127 Boolean 127 Same as above

16 Bit Slave Register Assignment Table(S272 &S275)

Support 03/06/16 function code, 1 data take one address in Modbus protocol, total can mapping 128 slave data.
Read and Write Holding Register (Function Code 03,Function Code 06, Function Code 16)
16 Bit Register Address
Definition Data Type Description
(Decimal)
According to configurator set
mapping rules, this address will
Sort AB, its data type sort slave mapping data to AB,
20000 16 Bit data 20000 according to slave stock in this address, for cloud
mapping data type easy reading together, can
mapping slave inputting and
holding register.
20001 16 Bit data 20001 Same as above Same as above
20002 16 Bit data 20002 Same as above Same as above
124 data similar as
………. Same as above Same as above
above
20127 16 Bit data 20127 Same as above Same as above

32 Bit Slave Register Assignment Table

Page 29 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Support 03/06/16 function code, 1 data take two address in Modbus protocol, total can mapping 64 slave data.
Holding Register
32 Bit Register Address
Definition Data Type Description
(Decimal)
According to configurator set
mapping rules, this address will
Sort ABCD, its data type sort slave mapping data to ABCD,
20128 32 Bit data 20128 according to slave stock in this address, for cloud
mapping data type easy reading together, can
mapping slave inputting and
holding register.
20130 32 Bit data 20130 Same as above Same as above
20132 32 Bit data 20132 Same as above Same as above
60 data similar as
………. Same as above Same as above
above
20254 32 Bit data 20254 Same as above Same as above

64 Bit Slave Register Assignment Table

Support 03/06/16 function code, 1 data take four address in Modbus protocol, total can mapping 64 slave data.
Holding Register
64 Bit Register Address
Definition Data Type Description
(Decimal)
According to configurator set
mapping rules, this address will
Sort ABCDEFGH, its data sort slave mapping data to
20256 64 Bit data 20256 type according to slave ABCDEFGH, stock in this address,
mapping data type for cloud easy reading together,
can mapping slave inputting and
holding register.
20260 64 Bit data 20260 Same as above Same as above
20264 64 Bit data 20264 Same as above Same as above
60 data similar as
………. Same as above Same as above
above
20508 64 Bit data 20508 Same as above Same as above

Notice:
The difference of S273/S274/S275 is that they have different mapping register qty, but their device I/O register qty are same.
The above is for S275 register address, the S274 and S273 mapping register address range as below. Pls remember to set the
the device ID first before reading register data.

Model No.
S272 S275
Slave Mapping
Register Range (Decimal) (Decimal)

Page 30 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Boolean mapping address 64-127 64-127
16 Bit data mapping address 20000-20127 20000-20063
32 Bit data mapping address None 200128-20190
64 Bit data mapping address None 20256-20508

Adding Slave (Extend I/O tags or Modbus RTU converter to SMS alarm gate way)
When RS485 as Modbus RTU Master, can extend I/O tags, support max 16 slaves for connecting PLC,
Remote I/O data acquisition module, Smart meter,UPS , Power monitoring...
When RS485 as Modbus RTU Master, the device will polling the slaves , read the salve register value
to device mapping address and stock them as below. The yellow part is mapping register area.

Slave Mapping list:

This page is for adding, revising and deleting the slaves. Pls read the salves mapping list first before right click
editing start.

Page 31 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Slave Address: Stands for the Modbus RTU Slave ID.

Data Type: Stand for "Boolean", "16 Bit", "32 Bit", "64 Bit".
Function Code: Stand for Modbus RTU protocol function code, command for slave reading and writing.
Slave Register Starting Address: The starting register address for slave data reading and writing.
Reading Register Quantity: How many data quantity need to read, used for mapping to device register
address.
Mapping Address-Start: Stand for mapping the slave start register data to the device start mapping address.
Mapping Address-End: Calculate the end mapping address according to start address and reading data
quantity.

The example of Mapping Register as below:

Mxxx remote I/O module, slave register start address is 100, reading data qty is 3, the device(S273/4/5)
mapping register start address is 1; Smart meter slave register start address is 6, readding data qty is 4, the
device mapping register start address is 4.
----If so, when reading/writing device register 1~3, actually is reading/writing 100, 101, 102 register of Mxxx
remote I/O module; When reading/writing device register 4~7, actually is reading/writing 6~9 register of
smart meter.

Page 32 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Slave Settings:
Step1: Connect the slave to device(S272/5) RS485 port.

Step2: Find the salve port communication parameter and register address from user manual.

Step3: Write device RS485 parameter according to slave port communication parameter, pls ensure both
parameter are same, others communication failure, refer to "port setting" part.

Step4: Set RS485 port as Modbus RTU Master, then set polling and time out parameter, refer to "port setting"
part.

Step5: Back to Slave Mapping page as below, right click the line to add.

Page 33 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Click Add Slave as below:

If one slave have multi register, then need to add seperately according to register type; For exmaple, Mxxx
remote I/O module, with digital and analog inputs, need to add the digital(Boolean) first, then add the
analog(16 Bit).

Step6: Right click the line to edit the slave.

Page 34 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Click the "Edit Slave" to list the register according to chosen type (Boolean, 16 Bit, 32 Bit, 64 Bit). Boolean list
edit as below:

Address Mapping: Used for device to mapping slave register address.

Channel Name: Setup channel name, alarm/recovery send "channel name + alarm content" to authorize
number, need to tick Slave Alarm function in number setting page.
Data Type: Fixed, already chosen when add slave.
Input Type: NO NC optional, default NO. Choose NO: Normal is NO, not alarm when read 0, alarm when read
1; Choose NC: Normal status is NC, not alarm when read 1, alarm when read 0.

Page 35 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Alarm Verify Time: Stands for unnormal value last time more than this value, will send alarm SMS to authorize
number.
Alarm SMS Content: When alarm happen, send SMS "channel name + content" to authorize number.
Recovery SMS Content: When alarm recovery, send SMS "channel name + content" to authorize number.
Enable Recovery SMS: Tick it, then can send SMS to authorize number when recovery.
Relay X: X=0~3, unnormal value will alarm-link relative relay.
Enable: Tick it stand for enable alarm function.

Reminder:
If need SMS Alarm function, pls tick Slave Alarm function for authorize number in Number Settings page.

16 Bit, 32 Bit, 64 Bit list edit as below:

Address Mapping: Used for device to mapping slave register address.

Channel Name: Setup channel name, alarm/recovery send "channel name + alarm content" to authorize
number, need to tick Slave Alarm function in number setting page.
Data Type: Optional according to slave data type, ABCDEFG stands for sorting data in the slave register.
Ratio: Real value=read register value*ratio.alarm threshold high low value is read register value *ratio.But
when GPRS/3G/4G acquisition data will not multiple the ratio.
Threshold High: When new value above higher than this value, will send SMS alarm to authorize number.
Threshold Low: When new value above lower than this value, will send SMS alarm to authorize number.
Alarm Verify Time: Stands for unnormal value last time more than this value, will send alarm SMS to authorize
number.
High Alarm SMS Content: When threshold high alarm happen, will send "channel name + this content" to
authorize number.
Low Alarm SMS Content: When threshold low alarm happen, will send "channel name + this content" to
authorize number.
Recovery SMS Content: When alarm recovery, send SMS "channel name + this content" to authorize number.
Enable Recovery SMS: Tick it, then can send SMS to authorize number when recovery.

Page 36 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Relay X: X=0~3, unnormal value will alarm-link relative relay.
Enable: Tick it stand for enable alarm function.
Reminder:
1.If need SMS Alarm function, pls tick Slave Alarm function for authorize number in Number Settings page.
2. When 16 Bit used for extend AIN inputs, can't convert acquisition ADC value to actual one according to range. For example:
When Mxxx remote I/O module extend AIN, since Mxxx AIN register value is ADC, then device(S273/4/5) read value is also ADC
value. But DAM122 AIN value is calculated to actual value according to range, then stored in register, so the value device read, is
also calculated value.

When add slave, function code choose 16, then write value page as below:

Page 37 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Revise value, click OK, will write the value to slave corresponding register
And can mapping the register to device, read its function code for slave data current status, to check if set
successfully or not.

Step7: Click "Save" when operate finished, then click "Save Setting" in the menu, to save parameter to device.
Delete Slave:

Right click the slave which need to delete---->click the "Delete Slave"----> click "Save"---->click the "Save
Settings" in the menu as below:

Inquiry Slave Current Value:

Click "Register" page to real time check slave current value.
Reminder:
Before reading data, pls read slave list from "Slave Mapping List" first, then can check slave current value in "Register" page:

Page 38 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Network Settings
This page used for setting device parameters connect to networks.The device can compatible with many third
party upper computer system. And it can communication with monitoring software or clould via GPRS/3G/4G
as below:

1) Modbus RTU Protocol, means Modbus RTU over TCP, commucation with upper computer system. For
example, connect to www.kpiiot.com cloud server. Domain: modbusrtu.kprtu.com, Port: 4000.
2) Modbus TCP Protocol, commucation with upper computer system. For example, connect to
www.my-m2m.com cloud server. Domain: modbus.dtuip.com, Port: 6655.
3）MQTT Protocol,connect to www.my-m2m.com cloud server. Domain: modbus.dtuip.com, Port: 6655.

Note:If connect to KPIIOT or my-m2m cloud,only need ask King Pigeon sales for log in message,other part no

Page 39 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
need fill,keep as default.
Communication Protocol: "Disable", "Modbus RTU protocol", "IoT RTU protocol" or "Modbus TCP protocol"
“MQTT”optional.
Protocol: TCP or UDP optional.
Access Point Name: APN, cellular operator provide.
User Name: User Name,operator provide.
Password: Network password, operator provide.
Sever 1/2 IP/DNS: Server IP address or DNS.
Listen Port: Stands for the server’s listen port.
Server Connection Strategy: Only support "Prefer server 1" function, no "Both connection" now. When server
1 disconnect, will connect to server 2 automatically.
Login Message: Server register handshake protocol package. When transparent transmission or Modbus
protocol, this item used for device ID, provided by cloud. Contact King Pigeon sales if need to connect
www.kpiiot.com cloud server.
Login ACK Message: Once set, device need response within 10 seconds after device send login message,
otherwise it will continue send login message according to "Reconnection Times" ,still not response will
offline once time, then try to reconnect, according to "Server Offline 3 Times, Device Reconnection Time".
Logout Message: Once server send to device, device will be offline.
Heartbeat Message: Heartbeat content to avoid network offline.
Heartbeat ACK Message: Once set, device need response within 6 seconds after device send heartbeat
message, otherwise it will continue send login message according to "Reconnection Times" ,still not response
will offline once time, then try to reconnect, according to "Server Offline 3 Times, Device Reconnection Time".
Heartbeat Interval: Network keep online heartbeat interval time.
No Response Resend Times: After setting heartbeat and login message, if server no response, the times
which server will send data.
Login Message Strategy: "Send Once When Login Server", "Plus It In Front Of Every Packet", "Both Of Them"
optional. "Plus It In Front Of Every Packet" when data transmission.

Historical Record
The device inbuilt 8G SD card, store alarm and historical records. For saving historical records, need to set the
saving historical records interval time in "Periodically Timer" page.
For historical record, once it full, will automatically remove the earlier records for new records. And can save
as CS format for other purpose usage.

Page 40 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Total: Display device current historical records qty, "Read All" or "Read Record from xx to xx" optional.
Clear: Clear the screen.
Read: Read historical records.
Save as CSV: Historical records export as CSV file.
Erase RTU Records: Click this button will erase all device historical records, be careful.

7. Example Of Applications

Device working self-checking:

(1) Under setting mode, switch Dip to "Set"---->Switch device on---->Running configurator, choose port and
password enter into software basic parameter settings---->Click "Read the computer time"---->Then click
"Write the RTU time" for device time setting. At the same time, tick "√" for "Arm automatically when power
on", then click "Save" button as below:

(2) Under "Number Settings" page, write authorize number and tick the times needed. For example, if need
power on, external power off/recovery SMS, then tick and write as below:

Page 41 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(3) Click "Save Settings"---->Switch device off---->Switch working mode to "Run"---->Put it SIM card and switch
device on. 1~2 min after SIM card register network, power on SMS should be received---->The cut the external
power, the power lost SMS should be received---->Connect the power support to device again, then power
recovery SMS should be received. Thus, the device communication self-checking finished.

Device connect analog transducer:

If AIN0 need to connect a temperature transducer, transducer output 4~20mA signal, measurement range:
-40~100℃, when temperature last 2 seconds higher than 35℃ need to alarm, last 2 seconds lower than 20℃
also need a alarm, then set as below:

(1) Switch device off, then switch AIN0 input type to "mA";

(2) Wire connect temperature transducer to AIN0 input as below:

Page 42 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(3) Basic setting according (1) and (2) in "Device working self-checking";

(4) Enter into "AIN Trigger" page---->Set input type to "4~20mA"---->Write "High/Low Alarm
SMS"---->"Maximum": 100, "Miximum": -40, "Threshold High": 35, "Threshold Low": 20, "Verify Time": 2. If
still need recovery alarm SMS, then need to tick "Recovery Alarm", and write content in "Recovery
SMS"---->After that, click "Save" as below:

Page 43 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(5) In "AIN Alarm" page, tick the corresponding items for authorize number. For example, when AIN0 alarm,
will can and send SMS to authorize number "0" , remember to click "Save" as below:

(6) Click "Save Settings" in the menu, then switch device off;
(7) Switch DIP mode to "Run", working mode as below:

Page 44 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
(8) Switch the device on, then device enter into working mode.

Application:
When monitoring cabinet temperature, if higher than 38℃, need to start the cabinet fan; If lower than 25℃,
need to close the fan.
Need: Temperature/Humidity transducer AM2301 and 1 channel relay output, if choose the first relay DO0,
the set as below:

(1) Switch device off---->connect temperature/humidity transducer to T/H port---->connect the cabinet fan to
DO0 output as below:

(2) Basic setting according (1) and (2) in "Device working self-checking";
(3) In "Output Settings" page, set first relay DOUT0, output type: Switch on/off, channel name: cabinet fan,
close time: 0, 0 means always close. Click "Save" button as below:

(4) In "AIN Trigger Setting" page, set temperature type "Enable"---->Humidity and AIN0~7 choose "Disable" if
not use---->Set corresponding alarm SMS content---->Threshold high: 38 and Threshold low: 25---->Recovery
and verify time according to need---->Click "Save" button as below:

Page 45 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(5) In "Interlock Settings" page, Event choose "Temperature high alarm", Action: "DO0 close"---->Click "Add"
button, stands for when temperature high than 38℃, device will close DO0 to start the cabinet fan; Same
operate for low alarm setting, then temperature lower than 25℃, device will open DO0 to close the fan
automatically---->Click "Save" button as below:

(6) Click "Save Settings" button, then switch device off;

(7) Switch the DIP mode to "Run";

(8) Switch the device on, enter into working mode.

Page 46 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
RS485 extend I/O tags and Modbus converter SMS alarm:
When RS485 as Modbus RTU Master, can extend I/O tags, support max 16 slaves for connecting PLC,
Remote I/O data acquisition module, Smart meter,UPS , Power monitoring...
When RS485 as Modbus RTU Master, the device will polling the slaves , read the salve register value
to device mapping address and stock them. Could server can read and control via GPRS/3G/4G networks
according to King Pigeon RTU protocol, Modbus RTU over TCP or Modbus TCP protocol. Now remote I/O
module M100 (2DI, 2DO,2AI) as example:

Reminder:
The AIN data acquisition of Mxxx is ADC current or ADC voltage, device never calculated according to AIN max or min range. If
need extend AIN to read calculated real value, pls choose the acquisition module with inside converter function, such as DAM:

Model List
DAM114 2AIN 12 Bit resolution, default input 4~20mA
DAM116 4AIN 12 Bit resolution, default input 4~20mA
DAM118 2PT RTD 12 Bit resolution, default PT-100, 2/3 wire connection
DAM120 4PT RTD 12 Bit resolution, default PT-100, 2/3 wire connection
DAM122 2AI+2PT Same as above
DAM124 4AI+4PT Same as above

(1) When order M100, if need relay output, need to mark DO as relay when place order;

(2) According to M100 user manual, set port Baud Rate and device ID as below:
M100 port parameter: Baud Rate (9600), Byte Size (8), Stop Bit (1), Parity (Even), M100 device ID: 1.

(3) Connect M100 to device, GND not necessary;

Page 47 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(4) Basic setting according (1) and (2) in "Device working self-checking";

(5) In "Serial Port" setting page, set device parameter as below:

A) RS485 choose as "Modbus RTU Master";

B) Baud Rate, Data Bit, Parity Bit, Stop Bit port parameter setting need to be corresponding with M100,
otherwise not working; If one more slaves, all slave port parameter need to be corresponding with Master.

C) Scan Rate, Time out, Slave fault verity time can be according to default, if the slaves qty a little more, can
set bigger value;

D) Click the "Save" button.

(6) In "Slave Mapping List" , right click a line---->Click "Add Slave". If have added slave information before,
need to click "Read" first, to avoid other slave device information been covered.

Page 48 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(7) Set slave M100 basic parameter, if one slave have multi input type and function code, need to set data
type, function code and mapping register relationship seperately as below:
A) Slave address: Refer to step (2), it is 1;
B) Set register mapping and function code:
○1 According to M100 user manual, the DI data type and function code as below:

So the parameter set as below, the DI set to Boolean type, Function code 02, Register starting address 0,
Register quantity 2.

Page 49 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Click "Ok"---->Right click this line in "Slave" list---->Click "Edit Slave" as below:

Then M100 DIN1 mapping address is 64, DIN2 mapping address is 65, DIN1 and DIN2 parameter can be
editable. "√" Enable stands for enable this channel, "√" Relay 0 stands for when DIN1 trigger, DO0 will close.
And "Alarm SMS Content", "Recovery SMS content" can be editable. After that, click "OK" as below:

○2 In "Slave Mapping List" page, right click blank line---->Choose "Add Slave"---->DO Data type and Function
code as below according to M100 user manual.

So set DO parameter as below, set DO Data type to Boolean, Function code 1, Register start address 0,
Register quantity 2.

Page 50 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Click "Ok"---->Right click this line in "Slave" list---->Click "Edit Slave" to edit the channel.

So set DO parameter as below, set DO Data type to Boolean, Function code 15, Register start address 1,
Register quantity 2. Click "Add Slave" as below:

Click "Ok"----> Right click this line in "Slave" list---->Click "Edit Slave" to edit the channel.

○3 In "Slave Mapping List" page, right click blank line---->Choose "Add Slave". According to M100 user manual,
AIN data is high byte in front, low byte behind, data type and function code as below:

Page 51 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

So set AIN parameter as below, set AIN Data Type to 16 Bit, Function code 4, Register start address 0,
Register quantity 2.

Click "Ok"----> Right click this line in "Slave" list---->Click "Edit Slave" to edit the channel.
The M100 AIN data acquisition is ADC current or ADC voltage value, device have not calculated according to
AIN max and min range. So the "Ratio" no need to write, both "Threshold High" and "Threshold Low" are ADC
value.

(8) Paramter setting finished, since slave address is from same one device, the Slaves address are same, Data
type and Function code are not same. Click save button to write parameter into device.

Page 52 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(9) Click "Save Settings" in the menu, then switch device off.
(10) Switch the DIP mode to "Run".
(11) Switch the device on, enter into working mode, device running according parameter setting.

RS485 connected as Modbus RTU Slave:

Device support Modbus RTU slave function, can connect to HMI, SCADA, DCS, MES system. It can be used for
field data acquisition, remote SMS alarm, remote dial alarm and GPRS/3G/4G to cloud...

For example, when device as Modbus RTU slave, connect to HMI as below:
(1) Connect device to HMI via RS485 port, set HMI RS485 port parameter;
(2) Basic setting according (1) and (2) in "Device working self-checking";
(3) In "Basic Parameter Settings" page, set "Device ID", range is 1~247 in Modbus protocol as below:

(3) In "Serial Port" setting page, set device parameter as below:

A) RS485 used as "Modbus RTU Slave";
B) Baud Rate, Data Bit, Parity Bit, Stop Bit setting should be corresponding with HMI, otherwise commucation

Page 53 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
will be failure. If multi Masters, all Masters paramter should corresponding with device;
C) No need set: "Scan Rate", "Time Out", "Slave Fault Verify Time";
D) Click "Save" button.

(5) Click "Save Settings" in the menu, switch the device off;
(6) Switch DIP mode to "Run";
(7) In HMI configurator software, set the Modbus RTU Register address of device. Refer to [RS485 Serial Port
Setting---->Modbus RTU Slave Funtction---->Device I/O Register Address and Function code];
(8) Switch the device on, enter into working mode, device running according parameter setting.

Transparent Transmission As DTU:

Device can support data transparent transmission: DTU function. Could server transmit data to device via
GPRS/3G/4G, device will transfer the data to RS485 port directly wihtout deal with. Once device receive data
from RS485, also transmit to cloud server directly via GPRS/3G/4G, refere to "Serial Port Transparent
Transmission". When device RS485 port no need mapping slave, or connect to others which is not standard
Modbus RTU protocol, then can choose transparent transmission as below:

(1) Items connect to device via RS485, set RS485 port parameter;

(2) Basic setting according (1) and (2) in "Device working self-checking";

(3) In "Serial Port" setting page, device parameter as below:

A) Choose RS485 as "Transparent Transmission";

B) Baud Rate, Data Bit, Parity Bit, Stop Bit setting should be corresponding with items, otherwise
commucation will be failure. If multi items, all items paramter should corresponding with device;
C) No need set: "Scan Rate", "Time Out", "Slave Fault Verify Time";
D) Click "Save" button.

Page 54 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(4) In "GPRS Setting" page, set "Communication Data" as "Modbus RTU Protocol", then set "Server IP/DNS"
and "Port", also can set handshake protocol like "Login Message" below:

(5) Click "Save Settings" in the menu, then switch device off.
(6) Switch the DIP mode to "Run".
(7) Switch the device on, enter into working mode, device running as transparent transmission when data
communication between cloud server and items.

Device connect to www.My-M2M.com cloud configuration,

wechat notify application

Page 55 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Device can connect to cloud and SCADA via GPRS/3G/4G network, also can connect to clients own server and
King Pigeon www.My-M2M.com clould server. King Pigeon my-m2m.com cloud as sample below:

King Pigeon my m2m cloud support Modbus TCP, cloud configuration, wechat alarm function, welcomed
editable function.
(1) Basic setting according (1) and (2) in "Device working self-checking";
(2) In "Basic Parameter" setting page, set device ID, range 1~247 in Modbus RTU protocol as below:

(3) In "GPRS" setting page, set parameter as below:

When Communication Data as "Modbus RTU Protocol", then server IP/DNS should be: modbus.dtuip.com,
port is 6651, pls contact King Pigeon Sales for "Login Message Writing";
When Communication Data as "Modbus TCP Protocol", then server IP/DNS should be: modbus.dtuip.com,
port is 6655, pls contact King Pigeon Sales for "Login Message Writing";
When Communication Data as "King Pigeon RTU/Definition Protocol", then server IP/DNS should be:
rtu-m2m.com , port is 8001, pls provide device IMEI to King Pigeon Sales (Only used for S272).

(4) Click "Save Settings" in the menu, then switch device off.

Page 56 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
(5) Switch the DIP mode to "Run".
(6) Switch the device on, enter into working mode, then Slave and Master I/O can connect to network.

8. Device SMS Command and SMS APP

The user can send SMS commands to setup or operate the device, also can use the APP to control it easier.
The APP is under SMS communication, but their makes the program and operation easier than edit SMS every
time.

The Android APP search "M2M RTU" or click to download link:

http://nc-apk.wdjcdn.com/9/c8/1fd8e70a8634e9b4763a6a7114888c89.apk

The IOS APP search "M2M RTU" or click to download link (IOS 7.0 version or above support):
https://itunes.apple.com/us/app/gsm-3g-m2m-rtu/id1095288504?l=zh&ls=1&mt=8

Or can scan QR code below:

SMS APP interface as below:

SMS Command List:

Page 57 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
The SMS commands will be used for remote control the RTU are below:

1) Commands error return SMS

Event Return SMS Content
Any incorrect Command SMS Format Error, Please check Caps Lock in Command!
2) External DC Status
Event Return SMS Content
External DC goes off External DC Power Goes OFF
External DC Power Goes ON External DC Power Goes ON
3) Modify Password, 4digits, default is 1234
SMS Command Return SMS Content
Old Password＋P＋New Password This is the New Password, please remember it carefully.
4) Arm/Disarm SMS Command
SMS Command Return SMS Content
Arm password+AA Armed
Disarm password+BB Disarmed

5) Set RTU time, format is 2015-05-22 15:20:30W01, the W01 stands for Monday, W07 stands for Sunday.
SMS Command Return SMS Content
password+Dxxxx-xx-xxTxx: xx: xxWxx xxxx(Y)XX(M)XX(D)xx(H)X(M)xx(W)
6) Inquiry Current Status SMS Command
SMS Command Return SMS Content
password+EE Armed/Disarmed
Model:
Version:
IMEI:
GSM Signal Value:
External DC Power Goes OFF/ON
7) Setup 10 User number(Alarm Number&Access Control Number), max 21digits. ( Return 0~4 or 5~9
separately while setting.)
SMS Command Return SMS Content
Setup password＋A＋series number+T+tel number Tel1: ---
Tel2: ---
Notice: Tel3: 13570810254
Series number = 0~9 Tel4: ---
Tel5: ---
Inquiry password+A Return all numbers
Delete password+A+series number Return 0~4 or 5~9 numbers.
8) Authority User Number to access control: authorized number can dial to disarm and open the door.
SMS Command Return SMS Content
Setup Specified access control time: Tel1: ---
password＋B＋series number+S+start time+E+endtime Tel2: ---
Always can access control: Tel3: 13570810254
password＋B＋series number+P Tel4: ---
Notice: Tel5: ---
Time format is 201505231230, stands for year, month, date, hour, minute.
Inquiry password+B Return all authorized user numbers

Page 58 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Delete password+B+series number Return all authorized user numbers
9) Setup Daily Report time
SMS Command Return SMS Content
Setup password+DR+series number+T+time Daily SMS Report at: xx:xx
Notice:
Series number =0~9, e.g.: 1234DR1T12:30
Inquiry password+DR
Delete password+DRDEL

10)Inquiry DIN Status

SMS Command Return SMS Content
Inquiry Status password+DINE DIN1:Open/Close
DIN2: Open/Close
-----
11) Setup AIN Name
SMS Command Return SMS Content
Set Threshold password+AINR+channel number+Lxxx+Hxxx AINx: Low:xxx,High:xxx.
Inquiry Threshold password+AINR+ channel number<nnnnnnnn> AINx: Low:xxx, High:xxx.
AINy: Low:xxx, High:xxx.
Delete Threshold password+AINR+ channel number+DEL
Set AIN measurement password+AINM+ channel number+Lxxx+Hxxx AINx: Min:xxx,Max:xxx
range
Inquiry measurement password+AINM+ channel number<nnnnnnnn> AINx: Min:xxx, Max:xxx.
range AINy: Min:xxx, Max:xxx.
Delete measurement password+AINM+channel number+DEL
range
Inquiry AIN Current password+AINE+channel number<nnnnnnnn> AINx：xxxx ,+【Normal/Higher/Lower】
Value
Inquiry All AIN Current password+AINE AIN0：xxxx ,+【Normal/Higher/Lower】
Value AIN1：xxxx ,+【Normal/Higher/Lower】
----
12)SMS Control Digital Output
SMS Command Return SMS Content
Set DO Name password+DO+channel number+T DOx:xxxx
Inquiry DO Name password+DO+ channel number<nnnn>
Delete DO Name password+DO+ channel number+DEL
Switch ON(Close) password+DOC+ channel number<nnnn> , can close multi DOx: ON
channel, till next event trigger or SMS command. DOy:ON
Switch OFF(Open) password+DOO+ channel number<nnnn> DOx: OFF
DOy:OFF
Inquiry DO Current password+DOE+ channel number<nnnn> DOx: ON/OFF
Status DOy:ON/OFF
Inquiry all DO Current password+DOE DO1: ON/OFF
Status DO2:ON/OFF
---
Time Switch ON password+DOLC+ channel number<nnnn> , can close multi

Page 59 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
(Close) channel, till time setting in configurator software finished.
Set Pulse Output time password+DOT+xxx (3 digital, unit is seconds) Pulse Output Time:xxxS
Inquiry pulse output password+DOT Pulse Output Time:xxxS
time
Pulse Ouput password+DOP+channel number<nnnn> No SMS Return

13)Set Server Parameter(Can not setup DNS by SMS)

SMS Command Return SMS Content
Set Server IP password+IP+ IPaddress+P+Com port Server:
Port:
Inquiry password+IP
Delete password+IPDEL

14)Set GPRS APN/USER NAME/PASSWORD

SMS Command Return SMS Content
Set password+AP+apn+#+username+#+userpassword APN:
Inquiry password+AP User Name:
Delete password+APDEL Password:

15)GPRS Online
SMS Command Return SMS Content
password+GPRSonline GPRS always online
16)Delete Historical Data
SMS Command Return SMS Content
password+HISDEL Delete all historical records
17)Clear/Inquiry Pulse Counter Value
SMS Command Return SMS Content
Clear Pulse Counter Value password+DIN0CLR Clear Successfully
Inquiry Pulse Counter Value password+PR Counter Current Value: XX

9. Device GPRS/3G/4G Communication Protocol

Device can connect to Cloud and SCADA via GPRS/3G/4G network, support Transparent Transmission, Modbus
RTU over TCP, Modbus TCP and King Pigeon RTU protocol. User also can connect device to third party cloud or
server.

Device Networks Topology:

Communication Networks:

Page 60 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

Message communication sequence:

Transparent Transmission

Page 61 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Pls refer to "Transparent Transmission" content above.

King Pigeon IoT RTU Protocol/ Definition Protocol

If users need device send alarm data, or timely send data to server, can choose this communication protocol.
Set "Communication Data" in "GPRS" setting page, need to choose "King Pigeon RTU/Definition protocol",
"Protocol" choose TCP, set the Domain/IP/Port of connecting server, other parameter setting according to
server.

Notice:
1) When Modbus TCP or Modbus RTU over TCP communication protocol adopted, device used as Internet remote server or
slave device of cloud. So device ID is necessary for server polling device address data, and Internet remote server and cloud
used for Modbus Master function.
2) When Modbus TCP or Modbus RTU over TCP communication protocol adopted, cloud server can remotely read and write
device register address and slave mapping register address, according to Modbus TCP or Modbus RTU protocol. Device register
address and function code refer to "RS485 Serial Port Setting---->Modbus RTU Slave Function---->Device I/O Register Address and
Function Code"; Mapping register address and function code refer to " RS485 Serial Port Setting---->Modbus RTU Master
Function---->Mapping Register List and Function Code".

Modbus TCP Protocol

Device can connect to server or cloud to build TCP connection automatically via GPRS/3G/4G networks. After
building TCP connection, server or SCADA or cloud can send Modbus TCP command to device for Modbus TCP
communication.

Modbus RTU Over TCP

After device switched on, automatically connect to server or cloud to build TCP connection via GPRS/3G/4G
networks. Users can set handshake protocol, login message, heartbeat or other parameter according to cloud
server. After TCP connection, server or SCADA or cloud can send Modbus RTU command to device, to build
Modbus RTU networks which based on TCP connection.

For Modbus RTU over TCP protocol, setting as below:

(1) In "Basic Parameter" setting, set device ID, range 1~247 in Modbus RTU protocol, click "Save" as below:

(1) In "GPRS" setting page, "Communication Data" choose "Modbus RTU Protocol", means communication
with Modbus RTU over TCP. After setting server IP/DNS and other parameter, click "Save" button as below:

Page 62 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU

(4) Click "Save Settings" in the menu, then switch device off.
(5) Switch the DIP mode to "Run".
(6) Switch the device on, enter into working mode, then Slave and Master I/O can connect to network via
Modbus RTU protocol.

Modbus RTU over TCP Communication Application

Modbus RTU over TCP communication protocol application, server as Modbus (RTU) Master, device as
Modbus (RTU) slave. If device ID is 1, and already connected to remote clould server via GPRS/3G/4G
networks.

Read device relay DO status:

Device's relay DO register address as holding coil, address 0~3, refer to "Device I/O Register Address and
Function Code".

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 01H Read holding coil type, function code 01
DO Origin Range: 0000-0003, address refer to "Device I/O Register
2 00 00H
Register Address Address and Function Code"
Read DO Register
2 00 04H Range: 0001H-0004H, Read DO qty
Qty
16CRC Verify 2 3D C9 CRC0 CRC1 low byte in front, high byte in behind
Receiver Return Data Format:

Page 63 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 01H Read holding coil
Return Byte
1 01H Return Data Length
Length
02H means 4 DO status, high 4 byte invalid, low 4 Byte 2
converter Binary as below
DO3(bit3) DO2（bit2） DO1（bit1） DO1（bit0）
Returning Data
1 02H 0 0 1 0
Open Open Close Open
Device current relay status: DO0,DO2,DO3 = Open, DO1=
Close
16CRC Verify 2 D0 49H CRC0 CRC1 low byte in front, high behind

Example: Read 4 relays DO0~DO3 status, device address as 1 :

Server send: 01 01 00 00 00 04 3D C9
01H= Device address; 01H= Read relay function code; 00 00H= Read starting relay DO0 address;
00 04H= Read serial 4 DO status; 3D C9H CRC= Verify.
Device answer: 01 01 01 02 D0 49
01H= Device address; 01H= Read relay function code; 01H= Return data byte qty; 02H= Returning data, stands
for Binary 0000 0010 high 4 byte invalid, low 4 byte 0010, sort as DO3 DO2 DO1 DO0 status, D0 49HCRC verify.
If read DO or multi DO status, only need to revise " DO Origin Register Address " and " Read DO Register Qty ",
calculate the CRC again, returning data according to description data.

Control device DO output:

1) Control 1 channel device DO output

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 05H Write single holding coil type, function code 05
DO Register
2 00 00H Range: 0000-0003, stands for DO0-DO3
Address
This value: FF 00H or 00 00H, FF 00H= Close relay, 00
Active 2 FF 00H
00H= Open relay
16CRC Verify 2 8C 3AH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Page 64 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 05H Write single holding coil type, function code 05
DO Register
2 00 00H Range: 0000-0003, stands for DO0-DO3
Address
This value: FF 00H or 00 00H, FF 00H= Already actived
Active 2 FF 00H
close relay, 00 00H= Already actived open relay
16CRC Verify 2 8C 3AH CRC0 CRC1 low byte in front, high behind

Example: Control relay DO0 close, then:

Server send: 01 05 00 00 FF 00 8C 3A
01H= Device address; 05H= Control single relay command; 00 00 H DO0= Address; FF 00H= DO0 close;
8C 3A H16 byte CRC verify.
Device answer: 01 05 00 00 FF 00 8C 3A
01H= Device address; 05H= Control single relay command; 00 00 H DO0= Address; FF 00H= Active DO0 close;
8C 3AH 16 byte CRC verify.
If single control other relay outputs, only need to change "DO Register Address" and "Active", calculate CRC
verify again.

2) Multi control DO outputs

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to setting address
Function Code 1 0FH Write multi holding coil
DO Starting Range: 0000-0003, stands for DO0-DO3
2 00 00H
Register Address
Control Relay Qty: 0-4
2 00 04H
Qty
Write Byte Qty 1 01H Write 1 byte, since device only 4DO, use 4 binary can do it
0FH stands for 4 DO status, high 4 byte invalid, low 4 byte F
converter to binary as below
DO3(bit3) DO2（bit2） DO1（bit1） DO1（bit0）
Writing Data 1 0FH
1 1 1 1
Active close Active close Active close Active close
1= Active close，0= Active open
16CRC Verify 2 7E 92H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Page 65 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to setting address
Function Code 1 0FH Write multi holding coil
DO Register Address 2 00 00H Range: 0000-0003, stands for DO0-DO3
Active Relay Qty 2 00 04H Qty: 0-4, stands for how many relays already actived
16CRC Verify 2 54 08H CRC0 CRC1 low byte in front, high behind

Example: Close device 4 DO at same time, then:

Server send: 01 0F 00 00 00 04 01 0F 7E 92
01H= Device address; 0FH= Control multi relay; 00 00H= Relay DO0 starting address; 00 04H= Control 4 relays;
01H= Send data qty; 0FH= Data sent converter to binary 0000 1111 high 4 byte invalid, low 4 byte 1111 sort to
match DO3 DO2 DO1 DO0, 1 stands for close relay, 7E 92H CRC verify.
Device answer: 01 0F 00 00 00 04 54 08
01H= Device address; 0FH= Control multi relay; 00 00H= Relay DO0 starting address; 00 04H= Actived 4 relays;
54 08H CRC verify.
If need to control multi relays at same time, only need to change "Relay Starting Address", "Control Relay Qty",
"Write Data" and calculate "CRC Verify" again.

Read device DIN status:

Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 02H 02 read input coil DIN status
DIN Register
2 00 00H Range: 0000-0007, stands for DIN0-DIN7
Address
Read DIN Register
2 00 08H Read qty of DIN status
Qty
16CRC Verify 2 79 CCH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device
1 01H 01H Device, Range: 1-247, according to setting address
Address
Function
1 02H 02 read input coil DIN status
Code
Return Bytes
1 01H Range: 0000-0007, stands for DIN0-DIN7
Qty

Page 66 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
FFH converter to binary 1111 1111 from high to low byte, stands for
DIN7-DIN0 status
DIN7 DIN6 DIN5 DIN4 DIN3 DIN2 DIN1 DIN0
Returning
1 FFH (bit7) (bit6) (bit5) (bit4) (bit3) (bit2) (bit1) (bit0)
Data
1 1 1 1 1 1 1 1
Close Close Close Close Close Close Close Close
1= Close, 0= Open

16CRC Verify 2 E1 C8H CRC0 CRC1 low byte in front, high behind

Example: Inquiry device 8 DIN data at same time, then:

Server send: 01 02 00 00 00 08 79 CC
01H= Device address; 02H= Inquiry DIN status; 00 00HDIN= Starting address; 00 08H= Serial reading 8 DIN
status; 79 CC H CRC verify.
Device answer: 01 02 01 FF E1 C8
01H= Device address; 02H= Inquiry DIN status; 01H= Returning data bytes qty; FFH DIN status, every byte
stands for one DIN status, FFH converter to binary 1111 1111 from high to low byte, stands for DIN7-DIN0
status, 0= Open, 1= Close, E1 C8H 16 byte CRC verify.
If need to inquiry multi DIN status, only need to change "DIN Starting Address", "Reading DIN Register Qty",
calculate CRC verify again.

Read device AIN DIN pulse count value, temperature and humidity value, external power voltage value:
Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 04H 04 read input register
One address can read 2 bytes.
Register AIN address range: 0000-000BH, One AIN data take two address,
Starting 2 00 00H temperature address: 0018H, humidity address: 0019H, DIN1 count
Address value address: 001A, 001B
External power voltage address: 000E。
Read Register Read qty of input register, read AIN0 to DIN0 count value address,
2 00 1CH
Qty total 28 register, 0000H to 0001BH.
16CRC Verify 2 F1 C3H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device
1 01H 01H Device, Range: 1-247, according to setting address
Address
Function
1 04H 04 read input register
Code

Page 67 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
One address can read 2 bytes.
AIN address range: 0000-000BH, One AIN data take two address,
Data Bytes
1 38H temperature address: 0018H, humidity address: 0019H, DIN0 count value
Range
address: 001A,001B
External power voltage address: 000E。
N= Returning bytes, sample data 56 points:
00 00 00
AIN AIN0 AIN1 AIN2 AIN3 AIN4 AIN5
E7 00 00
Receivin 00 00 00 00 00 00 00 00 00 00 00 00
00 DD 00
g Data 00 E7H 00 00 00 DCH 00 DEH 00 DFH
00 00 DD
DDH DDH
00 00 00
Decimal 194 207 0 0 0 0
DC 00 00
Value
00 DE 00
Real 1.94 2.07 0 0 0 0
00 00 DF
Value
00 00 00
Returning
N 00 04 C6
Data Other External Power Temperatur Humidity DIN0 Count
01 9A 00
Value Voltage e Value
00 00 01
Receivin 04 C6H 0B 36H 1B E4H 00 00 00 0B
00 01 00
g Data
01 00 01
Decimal 1222 2870 7140 11
00 01 00
Value
01 00 01
Real 12.22V 28.7℃ 71.4%RH 11 times
0B 36 1B
Value
E4 00 00
AIN, External Power Voltage, Temperature, Humidity real value=Register
00 0BH
value/100。
16CRC
2 A9 3CH CRC0 CRC1 low byte in front, high behind
Verify

Example: Inquiry device 28 input type register at same time, start from address 0. Include 6 AIN, one device
temperature, humidity, external power voltage, DIN0 count value, then:
Server send: 01 04 00 00 00 1C F1 C3
01H= Device address; 04H= Read input register value; 00 00H AIN0= Starting address; 00 1CH= Serial reading
28 input register value; F1 C3H CRC verify.
Device answer: 01 04 38 00 00 00 E7 00 00 00 DD 00 00 00 DD 00 00 00 DC 00 00 00 DE 00 00 00 DF 00 00 00
00 04 C6 01 9A 00 00 00 01 00 01 00 01 00 01 00 01 00 01 00 01 0B 36 1B E4 00 00 00 0B A9 3C
01H= Device address; 04H= Read input register value; 56 bytes data after 38H, 00 00 00 E7H AIN0 value, 00 00
00 0DD AIN1 value, 00 00 00 DDH AIN2 value, 00 00 00 DCH AIN3 value, 00 00 00 DEH AIN4 value, 00 00 00
DFH AIN5 value, 00 00 00 00H invalid value, 04 C6H external power voltage value, 01 9A 00 00 00 01 00 01 00
01 00 01 00 01 00 01 00 01H invalid value, 0B 36H temperature value, 1B 36H humidity value, 00 00 00 0BH
DIN0 count value, A9 3C CRC verify.

Read Boolean mapping address data, belong to holding coil type:

Page 68 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 01H Read Holding Coil type, Function Code 01
Boolean Register Range: 0040H-007FH, Address refer to "Mapping
2 00 40H
Starting Address Register Address and Function Code"
Read Register Range: 0001H-0040H, Boolean mapping address, total 64
2 00 0AH
Qty address
16CRC Verify 2 BD D9H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 01H Read Holding Coil
Return Bytes Return data length
1 02H
Length
High byte means low address data, low byte means high data,
According to Modbus protocol, fix 73 01H real value to 01 73H
converter binary as below:
BIT Bit Bit Bit Bit Bit Bit
Bit15 Bit8
N Position 14 13 12 11 10 9
N= Boolean Invali Inv Inv Inv Inv Inva
73 72
Returning Data Returni Address d alid alid alid alid lid
73 01H
ng Value 0 0 0 0 0 0 0 1
bytes BIT
Bit7 Bit6 Bit5 Bit4 Bit3 Bit2 Bit1 Bit0
length Position
Boolean
71 70 69 68 67 66 65 64
Address
Value 0 1 1 1 0 0 1 1
Eg: Read 10 value, high 10 byte address value looked as invalid
16CRC Verify 2 5D 0CH CRC0 CRC1 low byte in front, high behind

Example: Read 10 mapping Boolean value starting from address 64, then:
Server send: 01 01 00 40 00 0A BD D9
01H= Device address; 01H= Read holding coil; 00 40H= Read Boolean value starting from address 64; 00 0AH=
Serial reading 10 Boolean status; BD D9H CRC verify.
Device answer: 01 01 02 73 01 5D 0C
01H= Device address; 01H= Read holding coil; 02H= Returning data bytes; 73 01H= 10 Boolean status read,
refer to table above; 5D OCH CRC verify.

Page 69 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
Revise Boolean mapping address data, belong to holding coil type:
If need to revise slaves connected, need to add slave and use function code 15 for mapping command in
configurator software. After mapping address value changed, will revise to write RS485 matched slave address
data.
Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 05H Write single Holding Coil type, Function Code 05
Boolean Mapping Range: 0040H-007FH, address refer to "Mapping Register
2 00 40H
Register Address Address and Function code"
Writing Value 2 FF 00H This value: FF 00H or 00 00H, FF 00H= Write 1, 00 00H= Write 0
16CRC Verify 2 8D EEH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, according to the data Master send
Function Code 1 05H Write single Holding Coil type, Function Code 05
Boolean Register Range: 0040H-007FH, address refer to "Mapping Register
2 00 40
Address Address and Function code"
This value: FF 00H or 00 00H, FF 00H= Write 1, 00 00H=
Writing Value 2 FF 00H
Write 0
16CRC Verify 2 8D EEH CRC0 CRC1 low byte in front, high behind

Example: Revise Boolean mapping address 64 status value, revise to 1, then:

Server send: 01 05 00 40 FF 00 8D EE
01H= Device address; 05H= Revise Boolean value; 00 40 H= Revise mapping address; FF 00H= Write 1, 8D
EEH16 byte CRC verify.
Device answer: 01 05 00 40 FF 00 8D EE
01H= Device address; 05H= Revise Boolean value; 00 40 H= Revise mapping address; FF 00H= Write 1, 8D
EEH16 byte CRC verify.
If need revise multi, pls refer to Modbus protocol, Function code 15.

Read data type mapping address, belong to holding register:

Master Send Data Format:
Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 03H 03 command read holding register
Mapping Register One address can read 2 bytes.
2 4E 20H
Starting Address Address range: 4E20H-501CH, mapping data type address

Page 70 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
range, address refer to "Mapping Register Address and Function
code"
Read Mapping
2 00 0AH Read qty of input register
Register Qty
16CRC Verify 2 3D 2FH CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device
1 01H 01H Device, Range: 1-247, according to setting address
Address
Function
1 03H 04 command read input register
Code
Data Bytes One address can read 2 bytes.
1 14H
Range
N= Returning bytes, sample data 56 points:
Mapping
20000 20001 20002 20003 20004
Address
Receive
00 14 00 1E 00 Data 00 14H 00 1EH 00 28H 00 32H 00 4BH
N= 28 00 32 00 4B Mapping
Returning 20005 20006 20007 20008 20009
Returnin 00 41 00 0A 00 Address
Data
g Bytes 25 00 14 00 Receive
2AH Data 00 41H 00 0AH 00 25 00 14 00 2A

Mapping address data real value need to calculate slave

mapping data type according device RS485 connected, refer to "
Mapping Register Address and Function code"
16CRC Verify 2 FB 34H CRC0 CRC1 low byte in front, high behind

Example: Read 10 mapping address data, start from 20000, then:

Server send: 01 03 4E 20 00 0A D3 2F
01H= Device address; 03H= Read holding register; 4E 20H= Read starting address, decimal 20000 00 0AH read
10 register value, D3 2FH 16 byte CRC verify.
Device answer: 01 03 14 00 14 00 1E 00 28 00 32 00 4B 00 41 00 0A 00 25 00 14 00 2A FB 34
01H= Device address; 03H= Read holding register; 14H return 20 bytes, 00 14 00 1E 00 28 00 32 00 4B 00 41
00 0A 00 25 00 14 00 2A return data, refer to table above, FB 34H 16 byte CRC verify.

Revise data type mapping address, belong to holding register:

If need to revise slave data which RS485 connected, need to add slave and use function code 16 for mapping
command in configurator software. After mapping address value changed, will revise to write RS485 matched
slave address data.

Page 71 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
If the data type of address 20000 mapping salves is signed-int AB:

Master Send Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 06H Write single holding register
Mapping Address range: 4E20H-501CH, mapping data type address range,
2 4E 20H
Register Address address refer to "Mapping Register Address and Function code"
Writing Data 2 00 64H Sample data writing value is decimal 100
16CRC Verify 2 9E C3H CRC0 CRC1 low byte in front, high behind

Receiver Return Data Format:

Data
Content Bytes Description
(H: HEX)
Device Address 1 01H 01H Device, Range: 1-247, according to setting address
Function Code 1 06H Write single holding register
Address range: 4E20H-501CH, mapping data type
Mapping
2 4E 20H address range, address refer to "Mapping Register
Register Address
Address and Function code"
Writing Data 2 00 64H Writing 100 successfully
16CRC Verify 2 9E C3H CRC0 CRC1 low byte in front, high behind

Example: If the data type of address 20000 mapping salves is signed-int AB, revise mapping address 20000
register to 100, then:
Server send: 01 06 4E 20 00 64 9E C3
01H= Device address; 06H= Revise single holding register value, 4E 20H= Revise address 20000 register value,
00 64H= Write to decimal value 100, 9E C3 H16 byte CRC verify.
Device answer: 01 06 4E 20 00 64 9E C3
01H= Device address; 06H= Revise single holding register value, 4E 20H= Revise address 20000 register value,
00 64H= Revise to decimal value 100, 9E C3 H16 byte CRC verify.
If need to revise multi data type mapping address, refer to Modbus protocol, Function code 16.

MQTT

Introduction to MQTT
MQTT is a client-server based message publish/subscribe transfer protocol. The MQTT protocol is lightweight,
simple, open, and easy to implement. These characteristics make it applicable to a wide range. In many cases,
including restricted environments, such as: machine-to-machine (M2M) communication and Internet of
Things (IoT). It has been widely used in communication sensors via satellite links, occasionally dialed medical
devices, smart homes, and some miniaturized devices. The MQTT protocol runs on TCP/IP or other network
protocols and provides orderly, lossless, bidirectional connections.

MQTT implementation principle

There are three kinds of identities in the MQTT protocol: publisher (Publish), broker (Broker) (server), and

Page 72 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
subscriber (Subscribe). Among them, the publisher and subscriber of the message are both clients, the
message broker is the server, and the message publisher can also be a subscriber. Take S27X connected to King
Pigeon cloud 2.0 platform as an example:

When the device publish I/O point data:

Publisher Publish Broker(King Publish Subscriber

S272/S275 Pigeon Cloud2.0) (account)
Subcribe

When the customer control the device:

Subscriber Publish Broker(King Publish Subscriber

(account) Pigeon Cloud2.0) (S272/S275)
Subcribe

Configuration:
Domain：（King Pigeon Cloud 2.0 default:mqtt.dtuip.com）
Server Port : Broker Server Port number（King Pigeon Cloud 2.0 default:1883）
Subscribe topic: Client subscribe topic
Publish topic: Device publish data topic
MQTT Client ID: The unique identity of the device, which can be a serial number, device ID, or IMEI(King
Pigeon Cloud 2.0 default is serial number)
MQTT user name: Device's account on the broker server (King Pigeon Cloud 2.0 default is MQTT)
MQTT password: Password of device's account on the broker server(King Pigeon Cloud 2.0 default is
MQTTPW)

After the configuration is complete, the client will initiate a connection to the server:
CONNECT: The client sends a” CONNECT “connection message request to the server;
CONNACK: The server responds with a “CONNACK” confirmation connection message, indicating that the
connection is successful;
After the client establishes a connection, it is a long connection, and the client can publish or subscribe to the
message on the server;
Take the device and the client's mobile phone as the client:
After the device publishes the topic on the broker proxy server, the customer can view the data through
subscription. That is, the device is the publisher and the customer's mobile phone is the subscriber.
Users can also publish topics through the MQTT server to control the device. That is, the user is the publisher
and the device is the subscriber.
Payload data format of device publish message
Publish Topic: MQTT client ID (filled in configuration software)

Page 73 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
{
"sensorDatas":
[
{
"flag":"DI1", //Read and write flag
"switcher":1 //data type and value
},
{
"flag":"AI1",
"value":10.00
}
{
"flag":"REG20000", // Register address and value
"value":1.00
}

],
"time":"1591841863",
//Time stamp (When power on,first time connection no time stamp,later connections
have time stamp)
"state":"alarm",
//Alarm and recovery (only for alarm or recovery data, but not for timely report)
"retransmit":"enable"
//Historical data (only for re-transmission of historical data, but not for real-time data)
}
Note:
//Read and write flag: the character is "flag", followed by "read and write identification of IO data points"
//Data type and value:
1. Switch-type data: the character is "switcher", followed by "0" or "1" (0 open, 1 closed)
2. Numerical data: the character is "value", followed by "specific value"
//Timestamp: the character is "time", followed by "specific timestamp "
//Alarm and recovery identification: the characters are "state", followed by "alarm" or "recovery" (alarm is alarm
data, recovery is recovery data)
//Historical data identification: the character is "retransmit", followed by "enable"
The data collected during the network disconnection will be temporarily stored in the device, and will be
republished when the network is recovered. It is identified by the "retransmit" character, indicating historical data.
(Need to enable MQTT data retransmission function in the configuration software)

Payload data format in device subscription message

Page 74 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
(The topic of the King Pigeon 2.0 platform downstream publish message is called "device serial
number/sensor ID", so the device subscribe topic needs to add the wildcard "/+" in order to
receive the data sent by the platform to achieve control)Subscribe topic: device serial number /+
(corresponding to the data filled in the subscribe topic item on the configuration software)
{
"sensorDatas":
[
{
"sensorsId": 211267, //platform sensor ID
"switcher":1, //data type :value
"flag":"DO1" // Read and write flag
}
],
"down":"down" //Platform downstream packet identification
}
Note:
//Platform sensor ID: the character is "sensorsID", followed by the ID number (ID is automatically generated by the
platform)
//Data type and value:
1. Switch-type data: the character is "switcher", followed by "0" or "1" (0 open, 1 closed)
2. Numerical data: the character is "value", followed by "specific value"
//Read and write flag: the character is "flag", followed by "read and write identification of IO data points"
//Downstream packet identification of the platform: the character is "down", followed by "down", which means
that this is the downlink data of the platform.
Device I/O data point read and write flag
Data Point Flag Type Description
DO DOx Switcher 0 is open, 1 is closed
DI DIx Switcher 0 is open, 1 is closed
AI AIx Value True value = original value
Temperature TEMP Value True value = original value
Humidity HUMI Value True value = original value
External power voltage EXTPWR Value True value = original value
DIN0 counter COUNT Value True value = original value
DIN1counter COUNT1 Value True value = original value
DIN2 counter COUNT2 Value True value = original value
DIN3counter COUNT3 Value True value = original value
Note：
“DOx”：DO0、DO1、DO2、DO3 ；
“DIx”：DI0、DI1、DI2、DI3、DI4、DI5、DI6、DI7；
“AIx”：AI0、AI1、AI2、AI3、AI4、AI5.

Mapping register read-write flag

Data Read&write Flag Data type Description
Boolean data REG64~REG127 Switcher According to the definition of
slave register data
16-bit data type REG20000~REG20127 Value According to the definition of

Page 75 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
slave register data
32-bit data type REG20128~REG20254 Value According to the definition of
slave register data
64-bit data type REG20256~REG20508 Value According to the definition of
slave register data

Note:
Mapping register read and write identification is unified as "REGx" (x is the address of the mapping register)

10. Upgrade Firmware

The device supports upgrade firmware via USB port directly. If you required upgrade, please contact us to
discuss and modify the firmware according to you requirements, we can provide the upgraded firmware to
you to upgrade them.

11. Cellular Module Upgrade

The device adopt modular structure design, when user local Gsm operator upgrade network, no need to
replace the whole hardware, only need to replace inbuilt communication module, easily upgrade Gsm to 3G,
or 3G to 4G network.

Page 76 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7

 GSM/SMS/GPRS/3G/4G
Cellular IoT Modbus RTU
12. Warranty
1) This system is warranted to be free of defects in material and workmanship for one year.
2) This warranty does not extend to any defect, malfunction or failure caused by abuse or misuse by the
Operating Instructions. In no event shall the manufacturer be liable for any alarm system altered by
purchasers

The End!
Any questions please help to contact us feel free.
Http://www.iot-solution.com

Page 77 of 77 King Pigeon Hi-Tech. Co., Ltd. Ver 2.7