• CIM 500 Modbus Ethernet for Modbus TCP Modbus is a fieldbus used worldwide. The This functional profile applies to the following Grundfos products: RTU version is used for wired networks (CIM Modbus RTU 200) and for call-up connections over •...
The CIM 200/250/500 is an add-on communication module to be fitted in the CU 36X, using a 10-pin connection. This enables Modbus TCP communication with a PLC, SCADA system, etc.
5.5 Status LEDs. 4.2 CIM 200 Modbus RTU The table below provides an overview of the specifications for the Grundfos CIM 200. For further details, please refer to the specific sections of this functional profile. Modbus RTU specifications Description Comments 3 pins.
4.3 CIM 250 GSM/GPRS The table below provides an overview of the specifications for the Grundfos CIM 250. For further details, please refer to the specific sections of this functional profile. Modbus GSM/GPRS specifications Description Comments Data protocol Modbus RTU/Modbus TCP GSM call-up uses RTU.
5. Modbus RTU, CIM 200 setup 5.1 Setting the Modbus transmission speed The transmission speed must be set correctly before the CIM 200 Modbus module is ready to communicate with the Modbus network. DIP switches SW4 and SW5 are used for setting the transmission speed.
The termination resistor is fitted on the CIM 200 Modbus module and has a value of 150 Ω. The CIM 200 has a DIP switch with two switches (SW1 and SW2) for cutting the termination resistor in and out. Figure...
5.5 Status LEDs The CIM 200 Modbus module has two LEDs. See fig. 4. • Red/green status LED (LED1) for Modbus communication • Red/green status LED (LED2) for internal communication between the CIM 200 and the Grundfos product. LED1 Status Description No Modbus communication.
6.1.1 Fitting a GSM antenna An antenna must be connected to the CIM 250 to establish connection to the GSM network. Grundfos offers different kinds of antennas. No Note antenna is supplied with the CIM 250. It must be ordered separately.
The CIM 250 must only be connected to SELV or communication. SELV-E circuits. Red/green status LED (LED2) for internal communication between the CIM 250 and the Grundfos product. Warning LED1 (yellow/green) The safety precautions listed below must be observed carefully as improper handling of the...
7. Modbus TCP, CIM 500 setup 7.2 Setting the Industrial Ethernet protocol The CIM 500 Ethernet module has a rotary switch for selection of Warning the Industrial Ethernet protocol. See fig. 16. The CIM 500 must only be connected to SELV or SELV-E circuits.
Red/green status LED (LED2) for internal communication • Configure the PC Ethernet port to the same subnetwork as the between the CIM 500 and the Grundfos product. CIM 500, e.g. 192.168.1.101, and the subnet mask to LED1 255.255.255.0. See section A.1 How to configure an IP...
8. Modbus function code overview The supported function codes are shown in the table below: Type Code Name 0x03 Read holding registers 0x04 Read input registers 16-bit data (registers) 0x06 Write single register 0x10 Write multiple registers Diagnostics Diagnostics See section for subcodes.
9. Modbus register overview 9.1 Register block overview The Modbus RTU registers are grouped in the following register blocks: Start address Register block Permissions Description 00001 CIM configuration Configuration of the CIM module. 00021 CIM status Status registers for the CIM module. 00101 Pit control and configuration Registers for control and configuration of wastewater pit.
0xE7 (231), and there is normally no need to change this value. 00003 SoftwareDefinedModbusAddress Note: For CIM 200 this value is used only when the transmission speed ● ● is set to "Software-defined" on the DIP switches SW4 and SW5.
Page 17
Address Register name Description PIN code for SCADA systems, etc. If GeneralStatus.ScadaPinCodeEnabled (register 00029, bit 0) is enabled, the correct PIN code must be entered in this register in order to gain access to remote control and configuration. 00011 ScadaPinCode Verify acceptance in GeneralStatus.WriteAccess (register 00029, bit 1).
GENIbusDataErrorCnt Holds a CRC error counter for the GENIbus connection between CIM and CU 36X. 00023 VersionNumber A Grundfos-specific version number. This is an unsigned integer value. Holds the current Modbus slave address of the device. 00024 ActualModbusAddress Valid value range: 1…247. Not used for CIM 500.
9.5 Pit control and configuration register block Registers in this block can be read by means of function codes 0x03 and/or 0x04. They can be written as holding registers with function codes 0x06 and 0x10. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer.
Page 20
Address Register name Scale Description Control bit that sets the value of the custom relay. RelayControl Bool 0 = Relay state logical 0 Bit 0: SetCustomRelay 1 = Relay state logical 1. 00102 Control bit that pulses the custom relay. 0 (no pulse) will be the resulting CustomRelayPulse state.
Page 21
Address Register name Scale Description 00132 SetStartLevelPump4 0.01 m Setting a new start level, pump 4.* 00133 SetStopLevelPump4 0.01 m Setting a new stop level, pump 4.* 00134 SetStartLevelPump5 0.01 m Setting a new start level, pump 5.* 00135 SetStopLevelPump5 0.01 m Setting a new stop level, pump 5.* 00136...
Page 22
Address Register name Scale Description Sets the feedback sensor type for pump 3: 4 = Flow rate 5 = Level, pressure 00160 SetFeedbackSensorTypePump3 enum 6 = Level, Ultrasound 13 = User defined Sensor 1 14 = User defined sensor 2 15 = User defined sensor 3* Sets the feedback sensor type for pump 4: 4 = Flow rate...
Page 23
Address Register name Scale Description 00176 SetFixedFrequencyPump1 Fixed frequency for pump 1* 00177 SetFixedFrequencyPump2 Fixed frequency for pump 2* 00178 SetFixedFrequencyPump3 Fixed frequency for pump 3* 00179 SetFixedFrequencyPump4 Fixed frequency for pump 4* 00180 SetFixedFrequencyPump5 Fixed frequency for pump 5* 00181 SetFixedFrequencyPump6 Fixed frequency for pump 6*...
9.6 Pit status register block Registers in this block can be read by means of function codes 0x03 and/or 0x04. It is not possible to write to these registers. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale...
Page 25
Address Register name Scale Description PitStatus Bit 0: RESERVED Alarm condition. PitStatus Bool 0 = No active alarms Bit 1: AlarmActive 1 = One or more active alarms. Warning condition. PitStatus Bool 0 = No active warnings Bit 2: WarningActive 1 = One or more active warnings.
Page 26
Address Register name Scale Description Enabled/disabled state of pump 1. PitPumpsDisabled Bool 0 = Enabled Bit 0: Pump1Disabled 1 = Disabled. Enabled/disabled state of pump 2. PitPumpsDisabled Bool 0 = Enabled Bit 1: Pump2Disabled 1 = Disabled. Enabled/disabled state of pump 3. PitPumpsDisabled Bool 0 = Enabled...
Page 27
Address Register name Scale Description Warning state of pump 1. PitPumpsWarning Bool 0 = No warning Bit 0: Pump1Warning 1 = Warning. Warning state of pump 2. PitPumpsWarning Bool 0 = No warning Bit 1: Pump2Warning 1 = Warning. Warning state of pump 3. PitPumpsWarning Bool 0 = No warning...
Page 28
Address Register name Scale Description On/off state of float switch 1 (if installed). FloatSwitchesStatus Bool 0 = Off Bit 0: FloatSwitch1Status 1 = On. On/off state of float switch 2 (if installed). FloatSwitchesStatus Bool 0 = Off Bit 1: FloatSwitch2Status 1 = On.
Page 29
Address Register name Scale Description Function of the float switch. 0 = Not used 1 = Dry running 2 = - 3 = Stop of all pumps 4 = Stop 5 = Stop of first pump 6 = Stop of second pump 00222 FloatSwitch4Function enum...
Page 30
Address Register name Scale Description Year [0; 254] = [year 2000; year 2254]. See section 11.11 Real-time 00235 RtcYear 1 year clock. Actual value of GSM signal level. 254 = Signal level not detectable. 00236 GSMSignalLevelActual 255 = GSM network not available. Note: Only for CIM 250.
Page 31
Address Register name Scale Description 00261 ActualCurrentMaxAlarmGrp1 0.1 A Actual current max alarm for group 1 00262 ActualCurrentMinAlarmGrp1 0.1 A Actual current min alarm for group 1 00263 ActualCurrentMaxWarnGrp1 0.1 A Actual current max warning for group 1 00264 ActualCurrentMinWarnGrp1 0.1 A Actual current min warning for group 1 00265...
9.7 Pit data register block Registers in this block can be read by means of function codes 0x03 and/or 0x04. It is not possible to write to these registers. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. The table below shows for which CU 36X type the registers are supported.
Page 33
Address Register name Scale Description 00342 Pit4PumpsOprTimeToday 1 minute Operating time today (four pumps operating simultaneously). 00343 Pit5PumpsOprTimeHI 1 minute Total operating time (five pumps operating simultaneously). 00344 Pit5PumpsOprTimeLO 00345 Pit5PumpsOprTimeYesterday 1 minute Operating time yesterday (five pumps operating simultaneously). 00346 Pit5PumpsOprTimeToday 1 minute...
9.8 Pump 1 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 35
Address Register name Scale Description 00418 Pump1Current 0.1 A Motor current. 00419 Pump1LatestCurrent 0.1 A Latest motor current. 00420 Pump1Voltage 0.1 V Voltage. 00421 Pump1Insulation 10 kΩ Motor insulation resistance. 00422 Pump1WaterInOil 0.1 % Motor water-in-oil measurement. 00423 Pump1Alarms1 Bits See section 11.13 Alarms and warnings 00424...
9.9 Pump 2 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 37
Address Register name Scale Description 00468 Pump2Current 0.1 A Motor current. 00469 Pump2LatestCurrent 0.1 A Latest motor current. 00470 Pump2Voltage 0.1 V Voltage. 00471 Pump2Insulation 10 kΩ Motor insulation resistance. 00472 Pump2WaterInOil 0.1 % Motor water-in-oil measurement. 00473 Pump2Alarms1 Bits See section 11.13 Alarms and warnings 00474...
9.10 Pump 3 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 39
Address Register name Scale Description 00518 Pump3Current 0.1 A Motor current. 00519 Pump3LatestCurrent 0.1 A Latest motor current. 00520 Pump3Voltage 0.1 V Voltage. 00521 Pump3Insulation 10 kΩ Motor insulation resistance. 00522 Pump3WaterInOil 0.1 % Motor water-in-oil measurement. 00523 Pump3Alarms1 Bits See section 11.13 Alarms and warnings 00524...
9.11 Pump 4 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 41
Address Register name Scale Description 00568 Pump4Current 0.1 A Motor current. 00569 Pump4LatestCurrent 0.1 A Latest motor current. 00570 Pump4Voltage 0.1 V Voltage. 00571 Pump4Insulation 10 kΩ Motor insulation resistance. 00572 Pump4WaterInOil 0.1 % Motor water-in-oil measurement. 00573 Pump4Alarms1 Bits See section 11.13 Alarms and warnings 00574...
9.12 Pump 5 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 43
Address Register name Scale Description 00618 Pump5Current 0.1 A Motor current. 00619 Pump5LatestCurrent 0.1 A Latest motor current. 00620 Pump5Voltage 0.1 V Voltage. 00621 Pump5Insulation 10 kΩ Motor insulation resistance. 00622 Pump5WaterInOil 0.1 % Motor water-in-oil measurement. 00623 Pump5Alarms1 Bits See section 11.13 Alarms and warnings 00624...
9.13 Pump 6 register block All register values are read-only, and 0xFFFF indicates that the data value is not available. Unless otherwise stated, the data type used for counters and scaled values is always an unsigned integer. Address Register name Scale Description Presence of pump.
Page 45
Address Register name Scale Description 00668 Pump6Current 0.1 A Motor current. 00669 Pump6LatestCurrent 0.1 A Latest motor current. 00670 Pump6Voltage 0.1 V Voltage. 00671 Pump6Insulation 10 kΩ Motor insulation resistance. 00672 Pump6WaterInOil 0.1 % Motor water-in-oil measurement. 00673 Pump6Alarms1 Bits See section 11.13 Alarms and warnings 00674...
9.17 Hour log register block Generally the Modbus master application can select the relevant log series and the relevant number of hours back in time. Typically several communication sessions (request telegrams) are needed to read the data. The communication interface ensures that logged data is protected against internal update during the time it is accessed from Modbus, so that the Hour log constitutes a time-consistent block (data coherency).
9.18 Event log register block The event log contains the latest 50 event entries. Each entry consists of seven registers, containing information about the event. Address Register name Scale Description 06001 NoOfEventsInLog Unscaled Number of events in the event log. 06002 EventIDLog1 Unscaled...
9.19 Data log index register block This is an index area for the configurable data log. The log data index registers are read-only. See section 11.3 Reading the configurable data log series detailed information on how to read the configurable log series. By default the configurable logs are not set up.
9.20 Data log series register block Data area for the configurable data log series (max. 64 series). The log data are read-only and have a fixed starting address, so log series 1 always starts at register 07301. See section 11.3 Reading the configurable data log series detailed information on how to read the configurable log series.
Install the CIM 200 in the Grundfos pump according to the pump documentation. Complete the pump configuration, e.g. sensor configuration and local mode. This can be done either on the pump control panel, via the R100 or Grundfos GO Remote or Grundfos PC Tool E-Products. Select the Modbus slave address (1-247).
7.2 Setting the Industrial Ethernet protocol. Power on the Grundfos product, and observe LED2 turn steady green and LED1 remaining off. Complete the pump configuration, e.g. sensor configuration and selection of local Operating mode, local Control mode and local Setpoint (e.g. via Go Remote) Connect one of the CIM 500 Ethernet ports (RJ45) to a PC using an Ethernet cable.
11. Detailed descriptions of functionality 11.1 SCADA PIN code protection It is always possible to get read access via Modbus, but if the CU 36X control unit is SCADA PIN-code-protected (PitStatus.ScadaPinCodeEnabled, register 00202, bit 4 = 1), write access requires that the user has entered the correct PIN-code in (ScadaPinCode, register 00109).
11.3 Reading the configurable data log series LogSeriesItemNo The log series item numbers are shown in the table below. Note that the scaling of the registers with the present values is identical to the scaling of the logged data values except for power values where the scaling has been changed from [1 W] to [10 W] to fit into 16 bit.
Page 55
Log series item No Log item register Scale 3005 Pump3MotorTemperature1 1 °C 3006 Pump3MotorTemperature2 1 °C 3007 Pump3CosPhi 0.01 3008 Pump3Power 10 W* 3009 Pump3Voltage 0.1 V 3010 Pump3LatestCurrent 0.1 A 3011 Pump3StartsPerH Unscaled 3012 Pump3LatestOperatingTime 1 second 3013 Pump3Frequency 0.01 Hz 3014 Pump3Torque...
Log series item No Log item register Scale 6014 Pump6Torque 0.1 Nm 6015 Pump6CurrentAsymmmetry 0.1 % * The data item PitPowerHI/LO (registers 00308 and 00309) has a resolution of 1 W, but the logging is in 10 W. Log series max. limits Total number of samples 40000 registers Log series max.
11.6 GSM call-up connection 11.7 GSM call-back connection The call-up function in the Dedicated Controls wastewater system If an alarm appears in the Dedicated Controls wastewater system is used for SCADA system communication via the GSM network. and the SCADA call-back function in the CU 36X has been Connection is established when the SCADA system dials the CIM enabled in general and also enabled for this particular alarm, the 250.
11.8 Use of SMS messages 11.8.3 Change GSM module battery If the CIM 250 detects that the optional CIM 250 battery is worn The setting up and the use of the SMS functions are described in out and must be replaced, it will send this message to all the installation and operating instructions for Dedicated Controls.
Page 59
– Connected: A client has established a socket connection. necessary to change some of them. This can only be done with The system is ready for TCP/IP data exchange (or already the Grundfos PC Tool WW Controls: exchanging data). •...
Page 60
A common standard for call-back via GPRS does not exist. In the The call-back telegram is a "Write single register" function that CU 36X, this function is implemented as a Modbus TCP write writes the value of 0x00FF to a specific register address in the telegram sent from the CIM 250.
11.10 Interlocking 11.10.2 Interlocking from another controller via SMS Figure illustrates the CU 36X SMS interlocking 11.10.1 Interlocking from SCADA system via GSM/GPRS mechanism. The CU 36X interlock master issues an SMS Interlocking can be done from a Modbus master (like a SCADA command containing a 4-digit PIN code "pppp"...
11.13 Alarms and warnings These registers reflect the actual alarm/warning conditions of the pit or the pump. Alarms/warnings which have acknowledgement type "Auto-ack", will be cleared automatically when normal conditions are restored. Alarms/warnings which have acknowledgement type "Manual-ack", require a PitControl.ResetAlarm command to be cleared.
Page 64
Description Data item Code Event source Dosing pump mean pressure to low (Under pressure) PitAlarms/Warnings4.1 Dosing pump Gas in dosing pump head, deaerating problem PitAlarms/Warnings4.2 Dosing pump Dosing pump cavitation PitAlarms/Warnings4.3 Dosing pump Dosing pump pressure valve leakage PitAlarms/Warnings4.4 Dosing pump Dosing pump suction valve leakage PitAlarms/Warnings4.5 Dosing pump...
12. Modbus RTU telegram examples 12.3 Read input registers (0x04) This function is used for reading input registers from the slave. Note CRC fields are not shown in the following examples. Input registers are read-only registers by definition. The request telegram specifies the starting address (the address of the first The Modbus data model states that registers register to be read) and the number of holding registers to read.
12.4 Write single register (0x06) 12.5 Write multiple registers (0x10) This function is used for writing a single holding register in the This function is used for writing a block of contiguous holding slave. The request telegram specifies the address of the register registers in the slave.
12.7 Diagnostics register interpretation This function provides a test for checking the communication The diagnostics register is interpreted as follows: system between the master and the Grundfos slave. It contains a single-byte subcode to identify the test to be performed. Bit Description The following subcodes are supported: Communication failure (with the Grundfos product).
13.1 Adaptation of pit graphics to installation values 13.2 Main status • Pump object graphics (the shown register addresses are for 13.2.1 Pit operation display pump 1): Before trying to operate the CU 361 control unit, – Presence (pump object drawn or not) Note remember to write the ScadaPinCode (register Pump#Status.Presence (register 00401, bit 0)
Page 72
13.2.2 Pit status display 13.2.3 Pump status display • Water level: PitWaterLevel (register 00301 [0.01 m]). The data item registers mentioned below are for pump 1. Adding 50 to the register addresses will give you the equivalent register • Pit depth: PitDepth (register 00303 [0.01 m]). addresses for pump 2.
Page 73
• See fig. for logic and priority for the pump control, and note Display bar that the control sources "Switch" and "Display" have higher The blue bar at the top of the screen is used to open and close priority than Remote. specific displays that can show specific data and change settings of the pit control system.
Page 74
An example is shown below Event log Code Description Source Type Time Overflow System Alarm appearing 05-08-2008 09:25 Overflow System Alarm disappearing 05-08-2008 11:09 Time for service, mixer Mixer Warning appearing 07-08-2008 02:38 Motor insulation resistance low Pump 2 Warning appearing 11-08-2008 08:24 The time stamp is in Unix time format.
Page 75
Data Log • The "Data log" button opens the display for showing the configurable data log. The illustrations in fig. show a way of visualising the pit water level, motor current for pump 1 and motor current for pump 2. Pit water level Start 2 Start 1...
14. Modbus function code overview The supported function codes are shown in the table below: Type Code Hex Name 0x03 Read holding registers 0x04 Read input registers 16-bit data (registers) 0x06 Write single register 0x10 Write multiple registers Diagnostics Diagnostics See section 12.6 Diagnostics for subcodes.
15. Modbus telegram examples 15.2 Reading the CIM configuration register block This section shows how to read the CIM configuration register Note CRC fields are not shown in the following examples. block (a total of four registers). In the example, slave address 0x01 is used. The Modbus data model states that registers Request from master to slave numbered X are addressed in telegrams as X - 1,...
In the example, slave address 0x01 is used. Note that the register address 209 = 0x00D1. is reset by the CIM 200 when the command has been In the example, slave address 0x01 is used. acknowledged. The value is only triggered on rising edge.
This shows how to interlock the CU 36X. In the example, slave address 0x01 is used. Note that the register is reset by the CIM 200 when the command has been acknowledged. The value is only triggered on rising edge.
The CIM 200 is defective. Replace the CIM 200. 2. The LED for internal communication a) No internal communication between the Ensure that the CIM 200 is fitted correctly in (LED2) is flashing red. CIM 200 and the Grundfos product. the Grundfos CU36X.
Page 81
16.1.2 CIM 200 Modbus communication faults Fault Possible cause Remedy 1. The slave does not respond a) Configuration or wiring error. • Check the visual diagnostics on the Modbus to telegrams. slave. Is the Grundfos GENIbus LED flashing green and the Modbus LED off or flashing green? •...
No internal communication between the Ensure that the CIM 250 is fitted correctly in (LED2) is flashing red. CU36X and the Grundfos product. the CU 36X. 3. The LED for internal communication a) The CIM 250 does not support the Contact the nearest Grundfos company.
Page 83
(e.g. trying to available data. request data from a Grundfos product which is not present will return "data not available" (0xFFFF)). 5. The slave does not react to control...
Page 84
No internal communication between the Check that the CIM 500 is fitted correctly in (LED2) is flashing red. CIM 500 and the Grundfos product. the Grundfos product. 3. The LED for internal communication a) The CIM 500 does not support the Contact the nearest Grundfos company.
Page 85
Grundfos product. 5. The slave does not react to control a) The Grundfos product might be in Set the Grundfos product in "Remote mode" actions or to writing of settings. "Local" mode, in which case Operating...
17. Modbus RTU rotary switch addresses Modbus Modbus Modbus Modbus Modbus address address address address address Example: To set the slave address to the value 142, set the rotary switches SW6 and SW7 to "8" and "E", respectively. Please note that 0 is not a valid slave address as this is used for broadcasting.
Page 87
18. Grundfos alarm and warning codes This is a complete list of alarm and warning codes for Grundfos products. For the codes supported by booster systems, see the Alarms and warnings section. Code Description Code Description Code Description Signal fault, PTC sensor (short-...
Page 88
Code Description Code Description Code Description Gas in pump head, deaerating Run capacitor, low (single-phase Soft pressure build-up time-out problem motors) Signal fault, outdoor temperature Discharge valve leakage Pilot pump alarm sensor Signal fault, air temperature Alarm, general-purpose sensor Suction valve leakage sensor high Signal fault, shunt relative...
Page 89
Code Description Code Description Code Description Signal fault, temperature sensor 2 Fault, speed plug User-defined event 3 (t_mo2) Signal fault, temperature sensor 3 Functional fault, add-on module User-defined event 4 (t_mo3) Signal fault, Smart trim gap SMS data from DDD sensor not Hardware fault, type 2 sensor received within time...
Page 90
Appendix The appendix describes the parts of the CIM 500 web server needed for the configuration of a Modbus TCP Ethernet connection. For other CIM 500 web server features, not specifically related to Modbus TCP, see the installation and operating instructions for the CIM 500. A.1 How to configure an IP address on your PC For connecting a PC to the CIM 500 via Ethernet, the PC must be set up to use a fixed (static) IP address belonging to the same...
Page 91
User name and password can be changed on the User name Enter user name. Default: admin. Note web server under "UserManagement" Password Enter password. Default: Grundfos. A.4 Modbus TCP configuration Real Time Ethernet Protocol Configuration - Modbus TCP Fig. 3 Object Description The default value is 502, the official IANA-assigned Modbus TCP port number.
Need help?
Do you have a question about the CIM 200 and is the answer not in the manual?
Questions and answers