ST7-EN-003

ST7-HV PROGRAMMABLE SYSTEM

MODBUS RTU PROTOCOL

TECHNICAL SPECIFICATIONS
ST-007-EN-R1V1

Page 1 of 15
 ST7-EN-003

Important Notices
Silver-Tec Ltd policy is one of continuous improvement of product characteristics; therefore this
manual can be changed at any time without prior notice. All technical information and data given in
this manual have been carefully checked. However, this does not exclude that it may contain
mistakes or spelling errors. Silver-Tec Ltd shall not be liable in any manner whatsoever of
consequences possibly resulting from errors or changes in this manual.

Proprietary Rights
This publication and all information herein are the property of Silver-Tec Ltd. Copying and
reproduction rights on this publication, disclosure rights of information herein and the right to use
such information contained in this publication can be obtained exclusively by means of a written
authorization signed by a duly empowered Silver-Tec Ltd manager.

List of Revisions

Index of revision Brief Description of the Content Issuing date

Rev. 0 Preliminary version 30-10-2007
Extended addressing mode introduced on
Rev. 1 11-06-2010
release software 3.2
Added 32 not programmable system variables
VINSYS, used to execute the commands of
ACK, CT, RESET, EV. Amendment introduced on
Rev. 1V1 07-03-2014
the software release 3.5 of ST7-HV-MD8001-N-
1 card and on software release 2.3.6 of ST7-
HV-CP1101-N card

Page 2 of 15
 ST7-EN-003

INDEX
1 ST7-HV-MD8001-N MODBUS RTU CARD _____________________ 4
1.1 DESCRIPTION ___________________________________________________________________ 4
1.2 CHARACTERISTICS______________________________________________________________ 4
1.3 SIGNALS _________________________________________________________________________ 4
1.4 CONFIGURATION _______________________________________________________________ 4
1.6 SLAVE operating mode (Standard addressing) _______________________________ 6
1.1 SLAVE operating mode (Extended addressing) _______________________________ 6
1.1 Description of system variables VINSYS ______________________________________ 7
1.2 Modbus exception codes _______________________________________________________ 7
1.3 MASTER operating mode _______________________________________________________ 9
1.5 Implementation of RTU Modbus protocol _____________________________________ 9
1.8 Function 01 – Multiple reading of Input variables (Bytes) __________________ 10
1.9 Function 02 – Multiple reading of Output variables (Bytes) ________________ 10
1-10 Function 03 – Multiple reading of analogue variables (Word) ____________ 11
1.11 Function 05 – Writing of a single Input variable (bit) _____________________ 13
1.12 Function 08 – Diagnostics of serial line ____________________________________ 13
1.13 Function 15 – Multiple writing of Output variables (Bytes) _______________ 14
1.14 CONNECTIONS _______________________________________________________________ 15
1.15 ORDERING INFORMATIONS _________________________________________________ 15

Page 3 of 15
 ST7-EN-003

1 ST7-HV-MD8001-N MODBUS RTU CARD

1.1 DESCRIPTION
Communication card with RTU Master/slave Modbus protocol. Its Output supplies
two independent connections, a RS485 Half Duplex and a RS232. It manages the
following modbus variables:
512 Input variables (32 x 16-bit words)
32 Input system variables (2 x 16 bit words in slave mode)
512 Output variables (32 x 16-bit words)
1024 16-bit analogue variables.
The analogue variables boast the engineered values relative to 4-20mA analogue
cards ST7-HV-IC5001, ST7-HV-IC5002, ST7-HV-IC5003.

1. 1.2 CHARACTERISTICS
 Redundancy: NO
 Operating modes: Master/Slave.
 Interfaces: N°1 RS232 + N°1 RS485
 Supply voltage: 22-29Vdc
 Absorption in idle status: 16mA
 Operating temperature: -10 / +50 °C
 Storage temperature: -30 / +80 °C
 Maximum humidity: 95% without condensate

2. 1.3 SIGNALS
Eight LEDs are located on the front panel that performs the following functions:
Led Signal
Active It turns on steady with an Input in active status
Disabled It turns on steady with a disabled Input or Output variable
Fault It flashes after a communication failure. (Only in Master mode)
Master It turns on steady in the Master status.
TX RS232 It turns on at each transmission on RS232 door
RX RS232 It turns on at each receipt on RS232 door
TX RS485 It turns on at each transmission on RS485 door
RX RS485 It turns on at each receipt on RS485 door

3. 1.4 CONFIGURATION
Through configuration program Silver-Pro7, it is possible to set the following parameters for each
point of the single devices, based on the type of device:

Parameter Type Mode

Operating mode Input NA / NO
Alarm/Active status Input Held/Not held
Alarm signalling methods Input Normal /Silent / Buzzer only
Activation mode Output Fixed-NE, Fixed-ND, Periodical, Impulsive-1
Period Output from 1 to 15 seconds (only in impulsive and periodical modes)

The configuration of modbus addresses and communication parameters takes place through two 8-
position dip switches located on board of the card.

Page 4 of 15
 ST7-EN-003

SW1 Configuration of modbus address

Dip switch SW1 dips 1÷7 configures the card’s modbus address in 1÷127 range. In slave mode, it
defines the card’s modbus address, while in master mode, it defines the address of the slave
peripheral, to which the commands are sent. Address 00 is not allowed.

SW1-1 Weight 1 modbus address (on = active)

SW1-2 Weight 2 modbus address (on = active)
SW1-3 Weight 4 modbus address (on = active)
SW1-4 Weight 8 modbus address (on = active)
SW1-5 Weight 16 modbus address (on = active)
SW1-6 Weight 32 modbus address (on = active)
SW1-7 Weight 64 modbus address (on = active)

Dip. 8 set addressing mode in slave operating mode. In Master operating mode this dip. Is not
used.

SW1-8 Addressing Mode Allowed address range

OFF Standard addressing 1÷127
ON Extended addressing 1÷32

SW2 Configuration of modbus parameters

Dips 1-2-3 of switch SW2 configure the Baud rate according to the following table:

SW2-1 SW2-2 SW2-3 Baud Rate

Off Off Off 1200
On Off Off 2400
Off On Off 4800
On On Off 9600
Off Off On 19200
On Off On 38400
Off On On 57600
On On On 115200

Dips 4-5 of switch SW2 configure the parity and number of stop bits.

SW2-4 SW2-5 Parity

Off Off No parity
On Off Even
Off On Odd
On On Not allowed

Dips 6-7-8 of switch SW2 configure the other options

ON 2 stop bits
SW2-6
OFF 1 stop bits
ON Card in Master mode
SW2-7
OFF Card in Slave mode
ON It freezes the last acquired status in case of disconnection with the Slave (*)
SW2-8
OFF It puts in fault status all the entities in case of Slave disconnection (*)

(*) Valid only in Master mode

In addition, JP1 Jumper is present on the card to enable the 120 ohm termination resistance on
RS485 line.

JP1 ON Termination on primary enabled RS485 line

Page 5 of 15
 ST7-EN-003

OFF Termination on primary disabled RS485 line

1.6 SLAVE operating mode (Standard addressing)

In this operating mode, the card manages the following functions:

Slave Function Start End

Data
Address Code address address
01-05-15 0 511 V-IN (512 bit)
01-05-15 512 543 V-INSYS (32 bit)
1..127
02 0 511 V-OUT (512 bit)
03 0 1023 Analog values (1024 word)

1.1 SLAVE operating mode (Extended addressing)

In this operating mode, the card manages the following functions:

Slave Function Start End

Data
Address Code address address
01-05-15 0 511 V-IN (512 bit)
02 512 1023 V-OUT (512 bit)
01-05-15 1024 1055 V-INSYS (32 bit)
1 03 0 1023 Analog values (1024 word)
03 1024 1055 V-IN 32 word (32x16=512bit)
03 1056 1087 V-OUT 32 word (32x16=512bit)
03 1088 1089 V-INSYS 2 word (2x16=32bit)
01-05-15 2000 2511 V-IN (512 bit)
02 2512 3023 V-OUT (512 bit)
01-05-15 3024 3055 V-INSYS (32 bit)
2 03 2000 3023 Analog values (1024 word)
03 3024 3055 V-IN 32 word (32x16=512bit)
03 3056 3087 V-OUT 32 word (32x16=512bit)
03 3088 3089 V-INSYS 2 word (2x16=32bit)
01-05-15 4000 4511 V-IN (512 bit)
02 4512 5023 V-OUT (512 bit)
01-05-15 5024 5055 V-INSYS (32 bit)
3 03 4000 5023 Analog values (1024 word)
03 5024 5055 V-IN 32 word (32x16=512bit)
03 5056 5087 V-OUT 32 word (32x16=512bit)
03 5088 5089 V-INSYS 2 word (2x16=32bit)
01-05-15 6000 6511 V-IN (512 bit)
02 6512 7023 V-OUT (512 bit)
01-05-15 7024 7055 V-INSYS (32 bit)
4 03 6000 7023 Analog values (1024 word)
03 7024 7055 V-IN 32 word (32x16=512bit)
03 7056 7087 V-OUT 32 word (32x16=512bit)
03 7088 7089 V-INSYS 2 word (2x16=32bit)
01-05-15 8000 8511 V-IN (512 bit)
02 8512 9023 V-OUT (512 bit)
01-05-15 9024 9055 V-INSYS (32 bit)
5 03 8000 9023 Analog values (1024 word)
03 9024 9055 V-IN 32 word (32x16=512bit)
03 9056 9087 V-OUT 32 word (32x16=512bit)
03 9088 9089 V-INSYS 2 word (2x16=32bit)

OFFSET = (slave address - 1) x 2000

Note: In extended addressing mode the slave address shall be set between 1 and 5.

Page 6 of 15
 ST7-EN-003

Description of system variables VINSYS

Address Function
Description Notes
Offset Code
0 Silence Panel Command executed with variable = 1
1 Silence Sounder Command executed with variable = 1
2 01-03-05-15 Reset Panel Command executed with variable = 1
3 Evacuate Command executed with variable = 1
4÷31 Not Used Command executed with variable = 1

Slave
1
2
… Virtual
.. Inputs
512
1
2
… Virtual
.. Outputs
512
1
2 16 Bit
… Analog
.. Variables
130

The card in Slave mode replies to the Master’s requests on RS232 and on RS485 door with the
following parameters:
Baud Rate: Configurable of 1200/115200 Bps
Parity: Even/Odd/None configurable
Stop bit: 1/2 configurable
Maximum reply time: 100 milliseconds
Typical reply time: 50 milliseconds

After a request coming from the master, the slave behaves as follows:

Request Reply
The slave receives a message with no errors and is able to The Slave replies to the master, by sending the requested
formulate the reply data
The slave receives a wrong message after a communication
The Slave does not send any reply to the Master
error (Parity error / Frame error)
The slave receives a wrong message after a communication
The Slave does not send any reply to the Master
error (CRC error)
The slave receives a message with no communication The Slave sends an exception code to the Master, notifying
errors but it is not able to satisfy the reply it about the type of error

1.2 Modbus exception codes

In Slave mode, the card manages the following exception codes:

Code Name DESCRIPTION

01 Illegal function Non supported function
02 Illegal address Non valid address for the type of function
03 Illegal values Non valid data for the type of function

Page 7 of 15
 ST7-EN-003

04 Slave device error Error on peripheral (e.g. in case of failure of the central unit)
06 Busy Slave device The requested data is not currently available (e.g. during initialization)

Page 8 of 15
 ST7-EN-003

1.3 MASTER operating mode

This operating mode is exclusively used to connect two units of ST7-HV type to each other in
point/point Master/Slave mode. In this operating mode, the card performs the following functions:

Function DESCRIPTION Parameters

0x02 Multiple reading V-OUT Initial address = 1, bit no. = 512
0x15 Multiple writing V-IN Initial address = 1, bit no. = 512

- Function 0x02 reads 512 bits (virtual Outputs) from the slave peripheral and after their variation,
it updates its virtual Inputs. It is performed every second.
- Function 0x15 reads 512 bits (virtual Inputs) from the slave peripheral after the variation of its
virtual Outputs. It is performed in normal conditions every 10 seconds and instantaneously after
the status variation of an Output.
Master Slave
1 1
2 2
… Virtual … Virtual
.. Inputs .. Outputs
512 512
1 1
2 2
… Virtual … Virtual
.. Outputs .. Inputs
512 512

The card in Master mode performs interrogations using RS485 connection. If no response is received
then interrogation are performed using RS232 connection with the following parameters:
Baud Rate: Configurable of 1200/115200 Bps
Parity: Even/Odd/None configurable
Stop bit: 1/2 configurable
Scan Rate in reading mode: 1 second
Scan Rate in writing mode: 10 seconds of instantaneous rest on Output variation
Timeout replies from Slave: 2 seconds

4. 1.5 Implementation of RTU Modbus protocol

The structure of messages relative to the Modbus protocol is the following:

T1 Slave Address T1
Function Code Data CRC
T2 T2
1 byte N° byte(s) 2 byte(s)
T3 1 byte T3

- The Slave Address field contains the address of the peripheral to which the command is sent.
- The Function Code contains the code of the function requested by the Master.
- The Data field contains the data sent to the Slave or the Slave’s reply to a command.
- The CRC field contains the checksum value relative to the message.
- Sequence T1-T2-T3 represents the time during which data on the communication bus must not
be exchanged in order to allow the devices available to identify the end of a message and the
beginning of the following one. This time is equal to 3.5 characters and therefore it depends on
the set communication speed.

Page 9 of 15
 ST7-EN-003

1.8 Function 01 – Multiple reading of Input variables (Bytes)

This function is used to read the status of contiguous bits relative to the Input variables from 1 to
512. In the request, the start address and the number of contiguous bits that must be read are
specified. In the reply, bits are grouped up in 8-bit bytes.
Request
Function Code 1 Byte 0x01
Initial address 2 Bytes It depends on the addressing mode
Bit number 2 Bytes from 1 to 512
Reply
Function Code 1 Byte 0x01
Number of Bytes returned 1 Byte N*
Bit status n Bytes n=N or N+1
N= bit number /8 If the rest of the division is different from 0 N=N+1
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/02/03/04/06

In the following example, it is requested to read 20 contiguous bits starting from address 46.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 01 Function Code 01
Address HI 00 Number of bytes sent 03
Address LOW 2D Bits status value 27-20 xx
Bit number HI 00 Bits status value 35-28 xx
Bit number LOW 14 Bits status value 36-39* xx
* bits 40-43 are forced to zero
5. 1.9 Function 02 – Multiple reading of Output variables (Bytes)
This function is used to read the status of contiguous bits relative to the Output variables from 1 to
512. In the request, the start address and the number of contiguous bits that must be read are
specified. In the reply, bits are grouped up in 8-bit bytes.

Request
Function Code 1 Byte 0x02
Initial address 2 Bytes It depends on the addressing mode
Bit number 2 Bytes from 1 to 512
Reply
Function Code 1 Byte 0x02
Number of Bytes returned 1 Byte N*
Bit status n Bytes n=N or N+1
N= bit number /8 If the result is different from 0 N=N+1
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/02/03/04/06

In the following example, it is requested to read 24 contiguous bits starting from address 1.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 02 Function Code 02
Address HI 00 Number of bytes sent 03
Address LOW 00 Bits status value 27-20 xx
Bit number HI 00 Bits status value 35-28 xx
Bit number LOW 18 Bits status value 36-43 xx

Page 10 of 15
 ST7-EN-003

1-10 Function 03 – Multiple reading of analogue variables (Word)

This function is used to read the status of contiguous bits relative to the analogue variables from 1
to 1024. In the request, the start address and the number of contiguous words that must be read
are specified. In reply, variables are grouped up in 16-bit words. These variables represent the value
of ST7-HV-IC5001, ST7-HV-IC5002, ST7-HV-IC5003 cards defined in configuration as Modbus type.
With this function it is possible to read up to 125 analogue variables with a single command. The
address table relative to analogue variables depends on the position of the analogue cards in the
racks. The first channel of the first analogue card corresponds to address 1, the second channel
corresponds to address 2 and so on.
example: The following ST7-HV-IC5001 cards of modbus type are available in the station:
Card A: rack 1 pos 5
Card B: rack 1 pos 6
Card C: rack 1 pos 10
Card D: rack 5 pos 1
Card E: rack 6 pos 13

The mapping is the following:

Card A: address 1
Card B: address 2
Card C: address 3
Card D: address 4
Card E: address 5

In this case, command 0x03 must comply with the following parameters:
- Initial address between 1 and 5
- number of words to read between 1 and 5
- The sum of the initial address and the number of words to read must NOT be higher than 6

Request
Function Code 1 Byte 0x03
Initial address 2 Bytes It depends on the addressing mode
Word number 2 Bytes N=From 1 to 125
Reply
Function Code 1 Byte 0x03
Number of Bytes returned 1 Byte 2xN*
Status of variables N Bytes N x 2 bytes
N = Word number
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/02/03/04/06

In the following example, it is requested to read 3 words starting from address 20.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 03 Function Code 03
Address HI 00 Number of bytes sent 06
Address LOW 13 registry value HI (20) xx
Word number HI 00 Registry value LOW (20) xx
Word number LOW 03 registry value HI (21) xx
Registry value LOW (21) xx
Value of registry HI (22) xx
Registry value LOW (22) xx

Page 11 of 15
 ST7-EN-003

NB: Analogue value can assume following exception values:

-32766 Analog value not available
-32767 Device/Card failure

Page 12 of 15
 ST7-EN-003

1.11 Function 05 – Writing of a single Input variable (bit)

This function is used to write/edit a single Input variable of address 1 to 512. The change of status
ON/OFF takes place by writing a constant in the reply message to the slave. The constant is written
in two bytes. For the ON status, the constant will be 0x00 and 0xFF, while for the OFF status, the
constant will be 0x00 and 0x00. Any other value has no effect on the variable.

Request
Function Code 1 Byte 0x05
Variable address 2 Bytes It depends on the addressing mode
Value 2 Bytes 0x00,0xFF=HI 0x00,0x00=LOW
Reply
Function Code 1 Byte 0x05
Variable address 2 Bytes from 0 to 511
Value 2 Bytes 0x00,0xFF=HI 0x00,0x00=LOW
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/02/03/04/06

In the following example, Input variable 128 is forced to 1.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 05 Function Code 05
Variable address HI 00 Variable address HI 00
Variable Address LOW 7F Variable Address LOW 80
Value HI FF Value HI FF
value LOW 00 value LOW 00

6. 1.12 Function 08 – Diagnostics of serial line

This function is used to test the communication status of the serial line. This function is only
supported by the sub-function 00 that allows to return the received data to the Master.

Request
Function Code 1 Byte 0x08
Sub-function code 2 Bytes 0x00, 0x00
Value 2 Bytes N x 2 bytes
Reply
Function Code 1 Byte 0x08
Sub-function code 2 Bytes 0x00, 0x00
Value 2 Bytes N x 2 bytes
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/03/04/06/06

In the example below, command 08 is represented with sub-function 00.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 08 Function Code 08
Sub-function HI 00 Sub-function HI 00
Sub-function LOW 00 Sub-function LOW 00
Value HI 27 Value HI 27
value LOW AA value LOW AA

Page 13 of 15
 ST7-EN-003

1.13 Function 15 – Multiple writing of Output variables (Bytes)

This function is used to read the status of contiguous bits relative to the Output variables from 1 to
512. In the request, the start address, the number of contiguous bits that must be read, the
number of N* bytes that follow and N* bytes with Output status ON/OFF are specified. In the
reply, the requested bits are grouped up in 8-bit bytes.

Request
Function Code 1 Byte 0x15
Initial address 2 Bytes It depends on the addressing mode
Bit number 2 Bytes from 1 to 512
Number of bytes 1 Byte N*
Bit value N*x 1 byte
N= bit number /8 If the result is different from 0 N=N+1

Reply
Function Code 1 Byte 0x15
Initial address 2 Bytes from 0 to 511
Bit number 2 Bytes from 1 to 512
Errors
Function Code 1 Byte Function Code + 0x80H
Error code 1 Byte 01/02/03/04/06

In the example below, it is requested to write 10 contiguous bits starting from address 20. The bit
value to write is contained in two CD 01 Hex bytes. The binary representation of Outputs is the
following:

bit 1 1 0 0 1 1 0 1 0 0 0 0 0 0 0 1
Output 27 26 25 24 23 22 21 20 - - - - - - 29 28

The first transmitted byte (CD) is relative to address from 27 to 20. The following transmitted byte
(01) is relative to addresses 28-29. Non used bytes must be brought to zero.

Request Reply
Field Name Hex value Field Name Hex value
Function Code 0F Function Code 0F
Address HI 00 Address HI 00
Address LOW 13 Address LOW 13
Bit number HI 00 Bit number HI 00
Bit number LOW 0A Bit number LOW 0A
Number of bytes 02
Byte number LOW CD
Byte number LOW 18

Page 14 of 15
 ST7-EN-003

7. 1.14 CONNECTIONS

Connection between I/O module and field devices depends on the type of bus used..

With bus ST7-HV-E2004-1 the I/O module is internally connected to one of the 8 terminal
blocks with 18 screw terminals mounted on the PCB.

With bus ST7-HV-BP1402-N The module is connected to the field terminal block by the ST7-HV-
PC2401-S 6-conductor multipolar cable.

Connections

Termination with ST7-HV-

Function Termination with ST7-HV-BP1402-N
E2004-1
1
RS232 TX Data 232-TX 1 White
4
7
RS232 RX Data 232-RX 2 Brown
10
13
RS232 GND GND 3 Green
16
2
RS485 + +RS485 4 Yellow
5
8 ST7-
RS485 - -RS485 5 Grey HV/PC2401-
11 S
14
RS485 GND GND ST7-HV-E2004-1 6 Pink
17
3
6
9
12
+25V (500mA max.) +25V 15
0V 0V 18
Field connections

8. 1.15 ORDERING INFORMATIONS

Part Number DESCRIPTION notes

ST7-HV-MD8001- Module for RTU Modbus protocol Non redounding
N-1
ST7-HV-FT3202-N Termination with 8 terminals for ST7-HV-MD8001-N-1
modules
ST7-HV-CFT20/2 Flat cable for termination module ST7-HV-FT3202-N Length 2 metres
ST7-HV-PC2401- Termination cable for ST7-HV-MD8001-N-1 modules Length 3 metres
S
TCC-100I RS-232 to RS-422/485 converter with optical isolation
MB3170 RS232/RS485 to Modbus TCP converter

Page 15 of 15