Airborne Particle

Counters

Modbus® Reference

This is a reference for the protocol and registry used by software to control and communicate with an
Airborne Particle Counter (APC). It is written for those who wish to develop their own software or to
troubleshoot communications.

Modbus Transaction
Modbus RTU is a 16-bit binary (versus ASCII) communications protocol that uses a “big-Endian”
representation for addresses and data items. This means that when a numerical quantity larger than a
single byte is transmitted, the most significant byte is sent first. For example: 16-bits value 0×1234 the
first byte sent is 0×12 then 0×34.

The following describes the generic processing of a Modbus transaction from the server side:
1. The client sends a request to a server.
2. Once the request has been processed by a server, a Modbus response (using the adequate Modbus
server transaction) is built. Depending on the result of the processing two types of response are built:
 A positive Modbus response. Where the response function code = the request function code.
 A Modbus exception response. Here the objective is to provide the client relevant information
concerning the error detected during the processing; the exception function code = the request
function code + 0×80. An exception code is provided to indicate the reason for the error.

RS-485 Information
Name Value
Baud Rate 19200
Data bits 8
Parity NONE
Stop bits 1
Handshake NONE

®
Modbus is a registered trademark of Schneider Automation, Inc.
Implemented Commands
Read Multiple Registers 0x03
This function code is used to read the contents of a contiguous block of holding registers in a remote
device. The Request Protocol Data Unit (PDU) specifies the starting register address and the number of
registers. The PDU Registers are addressed starting at zero. Therefore registers numbered 1–16 are
addressed as 0–15. The register data in the response message are packed as two bytes per register, with
the binary contents right justified within each byte. For each register, the first byte contains the high order
bits and the second byte contains the low order bits.
Request
Name Length Value
Address 1 Byte 0×00 to 0xFF
Function code 1 Byte 0×03
Starting Address 2 Bytes 0×0000 to 0xFFFF
Number of registers 2 Bytes 0x01 to 0x7D (1 to 125)
Checksum 2 bytes 0x0000 to 0xFFFF

Response
Name Length Value
Address 1 Byte 0×00 0xFF
Function code 1 Byte 0×03
Byte count 1 Byte 2x N -number of registers
Register value N x 2 Bytes
Checksum 2 bytes 0×0000 to 0xFFFF

Error
Name Length Value
Address 1 Byte 0×00 0xFF
Error code 1 Byte 0×83
Exception code 1 Byte 0x01, 0x02, 0x03, or 0x04
Checksum 2 bytes 0x0000 to 0xFFFF

Write Register 0x06

This function code is used to write a single holding register in a remote device. The Request PDU
specifies the address of the register to be written. Registers are addressed starting at zero; so therefore
register numbered 1 is addressed as 0. The normal response is an echo of the request which is returned
after the register contents have been written.
Request
Name Length Value
Address 1 Byte 0x00 0xFF
Function code 1 Byte 0x06
Register Address 2 Bytes 0x0000 to 0xFFFF
Register Value 2 Bytes 0x0000 to 0xFFFF
Checksum 2 bytes 0x0000 to 0xFFFF

-2-
Response
Name Length Value
Address 1 Byte 0×00 0xFF
Function code 1 Byte 0×06
Register Address 2 Bytes 0x0000 to 0xFFFF
Register Value 2 Bytes 0x0000 to 0xFFFF
Checksum 2 bytes 0x0000 to 0xFFFF

Error
Name Length Value
Address 1 Byte 0x00 0xFF
Error code 1 Byte 0x86
Exception code 1 Byte 01 02 03 or 04
Checksum 2 bytes 0x0000 to 0xFFFF

Register Reference for Airborne Particle Counters

The reference tables that follow contain a detailed listing of the register entries used by the Airborne
Particle Counter for Modbus and data storage.

Particle Counter Register Map

 Revision: 13

Data
Register Data Description Access EEPROM
Address R/W Description
Number Type or Default Level stored
Value
40001- Instrument
000-009 ASCII RO Model Number/Serial Number read:all Yes
40010 Basic Info
40011- Instrument read:all
010-019 ASCII R/W Instrument Location String Yes
40020 Basic Info write:2
Instrument Firmware Version.
40022 021 ASCII RO - read:all No
Stored as ASCII Major Version
Instrument Firmware Version.
40023 022 ASCII RO - read:all No
Stored as ASCII Minor Version
40024 023 UInt RO Register Map version. 13 read:all Yes
Instrument Location number.
read:all
40025 024 UInt R/W Address of instrument location 1 Yes
write:2
string.
Command Register. See
read:all
40026 025 UInt R/W following Table for command 0 Yes
write:2
list.
Status Register. See following
40027 026 UInt RO Table for Status register - read:all No
details.
Circular buffer length,
maximum number of records
Set by
40028 027 UInt RO that can be stored in the unit. read:all Yes
model
Remote = 3000
LCHH = 1500

-3-
 Data
Register Data Description Access EEPROM
Address R/W Description
Number Type or Default Level stored
Value
Circular buffer pointer. Record
Index. Points to record number
that user wishes to retrieve.
When this register equals
Record Count, most recent read:all
40029 028 UInt R/W 1 Yes
record is displayed. The write:2
register is automatically
updated with the address of
the last record when running in
the automatic mode.
Circular buffer Record Count.
Number of stored records. The
number is incremented every
read:all
40030 029 UInt R/W time when new record is 0 Yes
write:2
made, it will roll over at 65535.
Goes to zero if all records are
cleared.
read:all
40031 030 UInt R/W Unit Modbus Address 1 Yes
write:2
read:all
40053 052 UInt R/W IP address, bytes 3,2 0xC0A8 Yes
write:2
read:all
40054 053 UInt R/W IP address, bytes 1,0 0xC85A Yes
write:2
read:all
40055 054 UInt R/W IP mask, bytes 3,2 0xFFFF Yes
write:2
read:all
40056 055 UInt R/W IP mask, bytes 1,0 0xFF00 Yes
write:2
read:all
40057 056 UInt R/W IP gateway, bytes 3,2 - Yes
write:2
read:all
40058 057 UInt R/W IP gateway, bytes 1,0 - Yes
write:2
read:all
40059 058 UInt R/W IP PDNS, bytes 3,2 - Yes
write:2
read:all
40060 059 UInt R/W IP PDNS, bytes 1,0 - Yes
write:2
read:all
40061 060 UInt R/W IP SDNS, bytes 3,2 - Yes
write:2
read:all
40062 061 UInt R/W IP SDNS, bytes 1,0 - Yes
write:2
TCP/IP Utility Register, Bit 0:
read:all
40063 062 UInt R/W 1-enable DHCP, 0-disable 0 Yes
write:2
DHCP
Sample Time (Seconds),
read:all
40067 066 UInt R/W 65535 seconds = 18 hours, 12 300 Yes
write:2
minutes, 15 seconds.
Hold Time (Seconds), 65535
read:all
40068 067 UInt R/W seconds = 18 hours, 12 5 Yes
write:2
minutes, 15 seconds.
Sensor Particle Threshold
Set by
40069 068 UInt RO Size, Chan 1. 300d = 0.3 read:all Yes
Model
micron, 1d = 1 nm
Sensor Particle Threshold
Set by
40070 069 UInt RO Size, Chan 2. 500d = 0.5 read:all Yes
Model
micron, 1d = 1 nm
Sensor Particle Threshold
Set by
40071 070 UInt RO Size, Chan 3. 1000d = 1.0 read:all Yes
Model
micron, 1d = 1 nm
-4-
 Data
Register Data Description Access EEPROM
Address R/W Description
Number Type or Default Level stored
Value
Sensor Particle Threshold
Set by
40072 071 UInt RO Size, Chan 4. 5000d = 5.0 read:all Yes
Model
micron, 1d = 1 nm
40081 080 UInt RO Detector Firmware Read:all No
Sensor Cal Date, Year. Set by Cal
40082 081 UInt RO read:all Yes
Reported by sensor. Software
Sensor Cal Date, Month. Set by Cal
40083 082 UInt RO read:all Yes
Reported by sensor. Software
Sensor Cal Date, Day. Set by Cal
40084 083 UInt RO read:all Yes
Reported by sensor. Software
Sensor nominal Flow Rate,
100d=1CFM, 10d=0.1CFM, Set by
40085 084 UInt RO read:all Yes
177d=1.77CFM=50LPM. model
Reported by sensor.
Sensor Laser Current in
40086 085 UInt RO - read:all No
milliamps. Reported by sensor.
Sensor background light level
40087 086 UInt RO in millivolts. Reported by - read:all No
sensor.
Sensor total Laser-On time (in
40088 087 UInt RO 0 read:all Yes
hours) value High
Sensor total Laser-On time (in
40089 088 UInt RO 0 read:all Yes
hours) value Low
Set by Cal read:all
40097 096 UInt R/W Real Time Clock (RTC)Year No
Software write:2
Set by Cal read:all
40098 097 UInt R/W RTC Month No
Software write:2
Set by Cal read:all
40099 098 UInt R/W RTC Day No
Software write:2
Set by Cal read:all
40100 099 UInt R/W RTC Hours No
Software write:2
Set by Cal read:all
40101 100 UInt R/W RTC Minutes No
Software write:2
Set by Cal read:all
40102 101 UInt R/W RTC Seconds No
Software write:2
Counter alarm enable register,
read:all
40103 102 UInt R/W bit: 0-Channel 1, 1-Channel 2, 0 Yes
write:2
2-Channel 3, 3-Channel 4
Counter alarm status register,
40104 103 UInt RO bit: 0-Channel 1, 1-Channel 2, - read:all No
2-Channel 3, 3-Channel 4
40105 104 UInt RO Counter 1 real time value High - read:all No
40106 105 UInt RO Counter 1 real time value Low - read:all No
40107 106 UInt RO Counter 2 real time value High - read:all No
40108 107 UInt RO Counter 2 real time value Low - read:all No
40109 108 UInt RO Counter 3 real time value High - read:all No
40110 109 UInt RO Counter 3 real time value Low - read:all No
40111 110 UInt RO Counter 4 real time value High - read:all No
40112 111 UInt RO Counter 4 real time value Low - read:all No
read:all
40115 114 UInt R/W Counter 1 Alarm value High 0 Yes
write:2
read:all
40116 115 UInt R/W Counter 1 Alarm value Low 0 Yes
write:2

-5-
 Data
Register Data Description Access EEPROM
Address R/W Description
Number Type or Default Level stored
Value
read:all
40117 116 UInt R/W Counter 2 Alarm value High 0 Yes
write:2
read:all
40118 117 UInt R/W Counter 2 Alarm value Low 0 Yes
write:2
read:all
40119 118 UInt R/W Counter 3 Alarm value High 0 Yes
write:2
read:all
40120 119 UInt R/W Counter 3 Alarm value Low 0 Yes
write:2
read:all
40121 120 UInt R/W Counter 4 Alarm value High 0 Yes
write:2
read:all
40122 121 UInt R/W Counter 4 Alarm value Low 0 Yes
write:2
Relay Out Setup Register. See
read:all
40123 121 UInt RO following Table for Relay 0 Yes
write:2
register details.
40125- Tech level password 12 chars, read:2
124-129 ASCII R/W “admin” Yes
40130 char (0), char(1) write:2
40179 178 UInt RO Laser Current Raw ADC - read:all No
40180 179 UInt RO Laser Scatter Raw ADC - read:all No
40181 180 UInt RO Flow Pressure ADC - read:all No
40189 187 UInt RO Sensor FW version Major - read:all No
40190 188 Uint RO Sensor FW version Minor - read:all No
Probe Humidity (*10 for 1
40191 190 UInt RO read:all No
decimal point)
Probe Temperature (*10 for 1
40192 191 UInt RO read:all No
decimal point)
User Cal Humidity Value
(+/-10% adjust ->
0 = -10.0% read:all T/H
40193 192 UInt R/W 100
100 = 0.0% write:2 Probe
200 = +10.0%
101 = 0.1%)
User Cal Temperature Value
(+/-10° adjust ->
0 = -10.0° read:all T/H
40194 193 UInt R/W 100
100 = 0.0° write:2 Probe
200 = +10.0°
101 = 0.1%)
Temperature units of probe read:all
40195 194 UInt R/W 0 Yes
Temp (0 = °C, 1 = °F) write:2
Enable / Disable Temp read:all
40196 195 UInt R/W 0 Yes
Humidity Probe detection write:2
Last recorded data sample,
40209-
208-223 UInt RO format is same as Circular - read:all 1
224
Buffer Frame
Address of first byte of the
40225 224 UInt RO 0 read:all 1
circular buffer, high word
Address of first byte of the
40226 225 UInt RO 0 read:all 1
circular buffer, low word

-6-
Detailed Register Descriptions
Command Register
Address: 40026
Value Description
0 Stop counting
1 Start automatic mode
3 Start manual mode
4 Start pulse mode
11 Clear current record
12 Clear all records

The Stop counting and Start automatic modes are saved into NVRAM. In case of power outage the unit
will resume the automatic mode automatically. Other states are not stored. Pulse mode is only for the TSI
pulse module connected to the RJ45 mod bus connector. It cannot be used as stand alone in pulse mode.

Status Register
Address: 40027
Writing 0 to Status register will “log out” the user and set access privileges to public level.

The status of the instrument is tested every 30 seconds. In order for a status error to occur, the event
causing the error must be present for 1 reading.

Address Bit Description

40027 15-10 n/a
40027 9-8 Current user security access level, 00=All (public), 01=Tech, 10=Factory, 11=Factory
40027 7 Reserved
40027 6 Reserved
40027 5 Laser Current Alert, 1 = Alert, 0 =OK
40027 4 Particle Channel Threshold Alarm, 1 = Alarm, 0 = OK
40027 3 Service Status Alert, 1 = Service, 0 = OK
40027 2 Calibration critical values may be corrupt 1 = Service, 0 = OK
40027 1 Flow Alert, 1 = Alert, 0 = OK
40027 0 High Scatter Alert, 1 = Alert, 0 = OK

Alarm Enable Register

Address: 40102
Address Bit Description
40102 15-5 n/a
40103 4 Counter alarm enable register Global Counter, 1=Enabled, 0=Disabled
40103 3 Counter alarm enable register Channel 4, 1=Enabled, 0=Disabled
40103 2 Counter alarm enable register Channel 3, 1=Enabled, 0=Disabled
40103 1 Counter alarm enable register Channel 2, 1=Enabled, 0=Disabled
40103 0 Counter alarm enable register Channel 1, 1=Enabled, 0=Disabled

-7-
Alarm Status Register
Address: 40103
Address Bit Description
40102 15-5 n/a
40103 4 Counter alarm status register Global Counter, 1=Alarm, 0=No alarm
40103 3 Counter alarm status register Channel 4, 1=Alarm, 0=No alarm
40103 2 Counter alarm status register Channel 3, 1=Alarm, 0=No alarm
40103 1 Counter alarm status register Channel 2, 1=Alarm, 0=No alarm
40103 0 Counter alarm status register Channel 1, 1=Alarm, 0=No alarm

Relay Out Setup Register

This registry configures which alarm state will trigger the relay. One, many or all of the alarm states can
be attached to trigger the relay. The alarm suppressions is the number of consecutive measurement
periods where the alarm threshold must be met prior to triggering the relay. Selecting 0 will trigger the
alarm immediately upon recognizing an alarm. Selecting 1 will require the alarm state to be present in 2
consecutive measurement periods. Etc. The measurement period is set in register 40067.
Address: 40123
Address Bit Description
40123 15-8 Alarm Suppression Sample Delay (0 = no delay, 1 = delay 1 sample, etc) Range 0-255
40123 7 n/a
40123 6 Counter 4 Threshold alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 5 Counter 3 Threshold alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 4 Counter 2 Threshold alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 3 Counter 1 Threshold alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 2 Flow alert alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 1 Laser Current alarm (1 = Attach to Relay, 0 = Not attached to Relay)
40123 0 Laser Scatter alarm (1 = Attach to Relay, 0 = Not attached to Relay)

Circular Buffer Format

 The circular buffer starts at the 32-bit address stored at locations 40225-40226
 Each record is 32 bytes long.
 There is one type of records in the buffer
 The number of records since start of Auto Sample Mode is stored in 40030.

Counter Frame Description

Offset Length
Description
Address (Integer)
0 1 Date and time, yy,mm where year = high byte, month = low byte
1 1 Date and time, dd,hh where day = high byte, hour = low byte
2 1 Date and time, mm,ss where minute = high byte, seconds = low byte
3-4 2 Record Chan 1 Particle Counts, high word, low word
5-6 2 Record Chan 2 Particle Counts, high word, low word
7-8 2 Record Chan 3 Particle Counts, high word, low word
9 - 10 2 Record Chan 4 Particle Counts, high word, low word
11 1 Location ID - same as register 400025
12 1 Record Sample Time (Seconds)
13 1 Record Hold Time (Seconds)
Record Flow value (100d=1CFM, 10d=0.1CFM, 177d=1.77CFM=50LPM), high byte
14 1
Record Relative Humidity value, low byte (Divide value by 2 to get the correct reading)
Record Temperature value, high byte (Divid value by 2 and add 32 for °F, Divide value by 4
15 1 for °C)
Status register lower byte, low byte

-9-