MODBUS COMMUNICATIONS ON THE

6000 SERIES CONTROL SYSTEM

 TABLE OF CONTENTS

1. INTRODUCTION ...............................................................................................................................................................1

2. MODBUS COMMUNICATIONS........................................................................................................................................1

2.1 Modbus Protocol - General Information .............................................................................................................1

2.1.1 RTU Framing....................................................................................................................................................2
2.1.2 How the Address Field is Handled.............................................................................................................2
2.1.3 ................................................................................................................How the Function Field is Handled 2
2.1.4 Contents of the Data Field............................................................................................................................3
2.1.5 Contents of the Error Checking Field........................................................................................................3
2.1.6 ...................................................................................................How Characters are Transmitted Serially 3
2.1.7 Error Checking Methods ..............................................................................................................................3

2.2 Information Specific to 6000 Series Controllers ...............................................................................................4

2.2.1 Controller setpoints .....................................................................................................................................4
2.2.2 Variable - Address Allocation Tables ........................................................................................................4
2.2.3 Additional Variable Information ..................................................................................................................7
2.2.4 Common Modbus Exception Codes ..........................................................................................................8
2.2.5 Supported Modbus Function Codes..........................................................................................................8
2.2.6 CRC Generation............................................................................................................................................12

i
Part No: 278-779
Issue No: 1

ii
1. INTRODUCTION Hardware -
RS-422 serial link
The 6000 series control panel is equipped with 2 serial
All units connected to a common RS-422 network
communications ports, one of which (RS-485) is used for inter-
Maximum cabling distance of 500m (special consideration
control communications and the other (RS-422) used for remote
should be paid to cable selection, routing and shielding).
communications and control functions. Two different
communications protocols are catered for over the RS-422
communications line, namely Modbus (RTU) and Servlink. These
two protocols are very different and so only one of these can be
used at any time on the 6000 series controller.

The Servlink communications protocol is a proprietary protocol

the details of which are not available to the general user and so
is termed as a closed protocol The Servlink protocol is used
exclusively with the PC1, PC2, TEL1, TEL2 and TEL3
communication options. The Modbus (RTU) protocol is an open
protocol and has been widely recognised within the industry as
an efficient and reliable communications standard. The rest of
this manual contains all the information necessary to interface
with the 6000 series controller over the Modbus (RTU) protocol.

To select which protocol will be used, enter the configuration

menu of the 6000 panel using the proper (level 3 - technician
level) software password, and scroll to the menu item labeled:
422 Protocol.

The selections under this menu item are:

1) Servlink
2) Modbus
3) Upload Setpoints

Note:
Ÿ Whenever the 422 Protocol setpoint is changed, the 6000
panel must be powered down, and powered up again to
reset to the proper protocol.

If Servlink is chosen for the protocol selection, the 6000 panel

will communicate in the Servlink protocol, which is only used in
conjunction with the various PC or TEL options.

If Modbus is chosen, the 6000 panel will communicate in

MODBUS (RTU) protocol, and make its information available
according to the address list as shown in the Variable-Address
Allocation table on page 10. Also, the Modbus Address,
Modbus Time-out and Modbus Reset Menu Items become
functional when the 422 Protocol is set to Modbus.

Note:
Ÿ If Upload Setpoints is chosen, the 6000 panel will switch to
a communications mode where it is waiting to see characters
on the 422 serial port that set it to transfer the contents of the
setpoint file to the PC. This task is run on the PC using the
‘download’ utility, and is limited to authorised service
representatives only.

2. MODBUS COMMUNICATIONS
2.1 Modbus Protocol - General Information

Modbus communications on 6000 series control systems

conforms to the Modbus standard as detailed by Modicon.
The Modicon standard for Modbus communications does
not specify any particular communications medium or baud
rate. It also has provision for two data transmission modes
(ASCII and RTU). The mode in which the 6000 series
control systems communicate using Modbus is outlined
below:

RTU/ASCII -
RTU will be implemented.

Protocol -
9600 Baud
8 bits
1 stop bit
No parity
1
Modbus is accessed on the master/slave principle, the Following the last transmitted character, a similar interval of at
protocol providing for one master and up to 8 slaves. The least 3.5 character times marks the end of the message. A new
master function cannot be performed by the 6000 series message can begin after this interval.
controller and is normally performed by 3rd party software.
The entire message frame must be transmitted as a continuous
Only the master initiates a transaction.
stream. If a silent interval of more than 1.5 character times
Transactions are either a query/response type where only a occurs before completion of the frame, the receiving device
single slave is addressed, or a broadcast/no response type flushes the incomplete message and assumes that the next
where all slaves are addressed. A transaction comprises a byte will be the address field of a new message.
single query and a single response frame or a single
Similarly, if a new message begins earlier than 3.5 character
broadcast frame.
times following a previous message, the receiving device will
The frame format, frame sequences, handling of consider it a continuation of the previous message. This will set
communications errors and exception conditions and the an error, as the value in the final CRC field will not be valid for
functions performed are all fixed as defined in the Modbus the combined messages. A typical message frame is shown
specification by Modicon. The allocation of variables to the below.
START ADDRESS FUNCTION DATA CRC END
particular memory addresses, while the types are fixed to
CHECK
general address areas, are open to interpretation by the
T1-T2- 8 bits 8 bits nx8 16 bits T1-T2-
manufacturer (see section ‘Variable - Address Allocation
T3-T4 bits T3-T4
Tables’ for an explanation of the address allocations for the
6000 series controller).

The Modbus protocol establishes the format for the master's 2.1.2 How the Address Field is Handled
query by placing into it the device (or broadcast) address, a
function code defining the requested action, any data to be The address field of a message frame contains two characters
sent, and an error-checking field. The slave's response (ASCII) or eight bits (RTU). Valid slave device addresses are in
message is also constructed using Modbus protocol. It the range of 0 ... 247 decimal. The individual slave devices are
contains fields confirming the action taken, any data to be assigned addresses in the range of 1…247. A master
returned, and an error-checking field. If an error occurred in addresses a slave by placing the slave address in the address
receipt of the message, or if the slave is unable to perform field of the message. When the slave sends its response, it
the requested action, the slave will construct an error places its own address in this address field of the response to
message and send it as its response. let the master know which slave is responding.

The function code in the query tells the addressed slave Address 0 is used for the broadcast address, which all slave
device what kind of action to perform. The data bytes contain devices recognise. When Modbus protocol is used on higher
any additional information that the slave will need to perform level networks, broadcasts may not be allowed or may be
the function. For example, function code 03 will query the replaced by other methods. For example, Modbus Plus uses a
slave to read holding registers and respond with their shared global database that can be updated with each token
contents. The data field must contain the information telling rotation.
the slave which register to start at and how many registers
2.1.3 How the Function Field is Handled
to read. The error check field provides a method for the slave
to validate the integrity of the message contents. The function code field of a message frame contains two
characters (ASCII) or eight bits (RTU). Valid codes are in the
If the slave makes a normal response, the function code in
range of 1 ... 255 decimal. Of these, some codes are applicable
the response is an echo of the function code in the query.
to all Modicon controllers, while some codes apply only to
The data bytes contain the data collected by the slave, such
certain models, and others are reserved for future use.
as register values or status. If an error occurs, the function
code is modified to indicate that the response is an error When a message is sent from a master to a slave device the
response, and the data bytes contain a code that describes function code field tells the slave what kind of action to perform.
the error. The error check field allows the master to confirm Examples are to read the ON / OFF states of a group of discrete
that the message contents are valid. coils or inputs; to read the data contents of a group of registers;
to read the diagnostic status of the slave; to write to designated
In either of the two serial transmission modes (ASCII or RTU),
coils or registers; or to allow loading, recording, or verifying the
a Modbus message is placed by the transmitting device into a
program within the slave.
frame that has a known beginning and ending point. This
allows receiving devices to begin at the start of the message, When the slave responds to the master, it uses the function
read the address portion and determine which device is code field to indicate either a normal (error-free) response or
addressed (or all devices, if the message is broadcast), and that some kind of error occurred (called an exception
to know when the message is completed. Partial messages response). For a normal response, the slave simply echoes
can be detected and errors can be set as a result. the original function code. For an exception response, the
slave returns a code that is equivalent to the original function
2.1.1 RTU Framing
code with its most significant bit set to a
In RTU mode, messages start with a silent interval of at least logic 1.
3.5 character times. This is most easily implemented as a
multiple of character times at the baud rate that is being used For example, a message from master to slave to read a group
on the network (shown as T1-T2-T3-T4 in the figure below). of holding registers would have the following function code:
The first field then transmitted is the device address.
0000 0011 (Hexadecimal 03)
The allowable characters transmitted for all fields are
If a slave device takes the requested action without error, it
hexadecimal 0 ... 9, A ... F. Networked devices monitor the
returns the same code in its response. If an exception occurs,
network bus continuously, including during the silent intervals.
it returns
When the first field (the address field) is received, each device
decodes it to find out if it is the addressed device. 1000 0011 (Hexadecimal 83)

2
In addition to its modification of the function code for an
exception response, the slave places a unique code into the
data field of the response message. This tells the master what
2.1.7 Error Checking Methods
kind of error occurred, or the reason for the exception.
Standard Modbus serial networks uses two kinds of error
The master device's application program has the responsibility
checking. Parity checking (even or odd) can be optionally
of handling exception responses. Typical processes are to
applied to each character. Frame checking (LRC or CRC) is
post subsequent retries of the message, to try diagnostic
applied to the entire message. Both the character check and
messages to the slave, and to notify operators.
message frame check are generated in the master device and
2.1.4 Contents of the Data Field applied to the message contents before transmission. The
slave device checks each character and the entire message
The data field is constructed using sets of two hexadecimal
frame during receipt.
digits, in the range of 00 to FF hexadecimal. These can be made
from a pair of ASCII characters, or from one RTU character, The master is configured by the user to wait for a predetermined
according to the network's serial transmission mode. time-out interval before aborting the transaction. This interval is
set to be long enough for any slave to respond normally. If the
The data field of messages sent from a master to slave devices
slave detects a transmission error, the message will not be acted
contains additional information which the slave must use to take
upon. The slave will not construct a response to the master.
the action defined by the function code. This can include items
Thus the time-out will expire and allow the master's program to
like discrete and register addresses, the quantity of items to be
handle the error.
handled, and the count of actual data bytes in the field.
Note:
For example, if the master requests a slave to read a group of
holding registers (function code 03), the data field specifies the Ÿ A message addressed to a non-existent slave device will
starting register and how many registers are to be read. If the also cause a time-out. Other networks such as MAP or
master writes to a group of registers in the slave (function code Modbus Plus use frame checking at a level above the Modbus
10 hexadecimal), the data field specifies the starting register, contents of the message. On those networks, the Modbus
how many registers to write, the count of data bytes to follow in message LRC or CRC check field does not apply. In the case
the data field, and the data to be written into the regsiters. of a transmission error, the communication protocols specific
to those networks notify the originating device that an error
If no error occurs, the data field of a response from a slave to a has occurred, and allow it to retry or abort according to how
master contains the data requested. If an error occurs, the field it has been set-up. If the message is delivered, but the slave
contains an exception code that the master application can use device cannot respond, a time-out error can occur which can
to determine the next action to be taken. be detected by the master's program.
The data field can be non-existent (of zero length) in certain Parity Checking: Users can configure controllers for Even or
kinds if messages. For example, in a request from a master Odd Parity checking, or for No Parity checking. This will
device for a slave to respond with its communications event log determine how the parity bit will be set in each character.
(function code 0B hexadecimal), the slave does not require any
additional information. The function code alone specifies the If either Even or Odd Parity is specified, the quantity of 1 bits
action. will be counted in the data portion of each character (seven
data bits for ASCII mode, or eight for RTU). The parity bit will
2.1.5 Contents of the Error Checking Field then be set to a 0 or 1 to result in an Even or Odd total of 1
bits. For example, these eight data bits are contained in an RTU
Two kinds of error-checking methods are used for standard
character frame:
Modbus networks. The error checking field contents depend
upon the method that is being used. 1100 0101
RTU: When RTU mode is used for character framing, the error The total quantity of 1 bits in the frame is four. If Even Parity is
checking field contains a 16-bit value implemented as two eight- used, the frame's parity bit will be a 0, making the total quantity
bit bytes. The error check value is the result of a Cyclical of 1 bits still an even number (four). If Odd Parity is used, the
Redundancy Check calculation performed on the message parity bit will be a 1, making an odd quantity (five).
contents.
When the message is transmitted, the parity bit is calculated
The CRC field is appended to the message as the last field in the and applied to the frame of each character. The receiving
message. When this is done, the low-order byte of the field is device counts the quantity of 1 bits and sets an error if they
appended first, followed by the high-order byte. The CRC high- are not the same as configured for that device (all devices on
order byte is the last byte to be sent in the message. the Modbus network must be configured to use the same
parity check method).
Additional information about error checking is contained later in
this section. Detailed steps for generating CRC fields can be Note that parity checking can only detect an error if an odd
found in section 2.2.6. number of bits are picked up or dropped in a character frame
during transmission. For example, if Odd Parity checking is
2.1.6 How Characters are Transmitted Serially
employed, and two 1 bits are dropped from a character
When messages are transmitted on standard Modbus serial containing three 1 bits, the result is still an odd count of 1 bits.
networks, each character or byte is sent in this order (left to
If No Parity checking is specified, no parity bit is transmitted
right):
and no parity check can be made. An additional stop bit is
Least Significant Bit (LSB) ... Most Significant Bit (MSB) transmitted to fill out the character frame.

With RTU character framing, the bit sequence is: CRC Checking: In RTU mode, messages include an error-
checking field that is based on a CRC method. The CRC field
With Parity Checking checks the contents of the entire message. It is applied
Start 1 2 3 4 5 6 7 8 Par Stop regardless of any parity check method used for the individual
characters of the message.
Without Parity Checking
Start 1 2 3 4 5 6 7 8 Stop Stop 3
The CRC field is two bytes, containing a 16-bit binary value. 2.2 Information Specific to 6000 Series Controllers
The CRC value is calculated by the transmitting device, which
2.2.1 Controller setpoints
appends the CRC to the message. The receiving device
recalculates a CRC during receipt of the message, and There are 3 setpoints which are directly related to the Modbus
compares the calculated value to the actual value it received communications within the setpoint menus of the 6000 series
in the CRC field. If the two values are not equal, an error controller. These are:
results.
Modbus Address
The CRC is started by first preloading a 16-bit register to all Modbus Time-out
1's. Then a process begins of applying successive eight-bit Modbus Reset
bytes of the message to the current contents of the register.
Only the eight bits of data in each character are used for The Modbus Address menu item is adjustable from 1 to 8. This
generating the CRC. Start and stop bits, and the parity bit, do address identifies the Modbus Slave to the Modbus Master using
not apply to the CRC. this address. The Modbus address chosen for any particular
6000 panel should be unique from any other devices on the
During generation of the CRC, each eight-bit character is Modbus network.
exclusive ORed with the register contents. Then the result is
shifted in the direction of the least significant bit (LSB), with a Note:
zero filled into the most significant bit (MSB) position. The LSB Ÿ The Network Address of the 6000 panel is not linked to the
is extracted and examined. If the LSB was a 1, the register is Modbus address in any way. See the GenPart 6000 manual
then exclusive ORed with a preset, fixed value. If the LSB for more information on the Network Address of the panel.
was a 0, no exclusive OR takes place.
Modbus Time-out is the time, in seconds, that the 6000 panel will
This process is repeated until eight shifts have been wait before either receiving a valid message from the Modbus
performed. After the last (eighth) shift, the next eight-bit byte master, or indicating a Modbus failure. The 6000 panel indicates
is exclusive ORed with the register's current value, and the a Modbus failure in the Load Control Monitor status menu, and is
process repeats for eight more shifts as described above. displayed in the upper right hand corner of the lower LCD
The final contents of the register, after all the bytes of the display. This display shows Link Failure (failure to receive a valid
message have been applied, is the CRC value. message from the master) as true/false, and an error number,
which is associated with the type of failure. For example LF-XF
When the CRC is appended to the message, the low-order 0 is the indication of a healthy Modbus connection with a Link
byte is appended first, followed by the high-order byte. failure of False and a failure number of 0. The Link failure is a
latching type indication, and requires the Modbus Reset Menu
Item to be toggled from True to False in order to reset. See
section ‘Common Modbus Exception Codes’ on page 16 for a list
of common error numbers which may be seen in the Load
Control Monitor Display.

The Modbus Reset is used to reset any failures indicated on the

Modbus serial communications, and also to restart the Modbus
Time-out timer from zero seconds. The Modbus Reset should be
left at FALSE, and only turned to TRUE to provide a reset action
on the Modbus. Once the reset is accomplished, the Modbus
Reset should be taken back to False once again.

Reply Time-out, Delay, and Number of Retries for the Modbus

Master must be configured to meet the requirements of the entire
system and cannot be recommended in this manual.

4
2.2.2 Variable - Address Allocation Tables
Address Data Type Scaling Description
1 BW ---- Change Input #1 (Auto)
2 BW ---- Change Input #2 (Test)
3 BW ---- Change Input #3 (Run With Load)
4 BW ---- Change Input #4 (Voltage Raise)
5 BW ---- Change Input #5 (Voltage Lower)
6 BW ---- Change Input #6 (Speed Raise)
7 BW ---- Change Input #7 (Speed Lower)
8 BW ---- Change Input #10 (Process I/E Input)
9 BW ---- Change Input #11 (Fault #1 - High Engine Temp)
10 BW ---- Change Input #12 (Fault #2 - Low Oil Pressure)
11 BW ---- Change Input #13 (Fault #3 - Emergency Stop)
12 BW ---- Change Input #14 (Fault #4)
13 BW ---- Change Input #15 (Fault #5)
14 BW ---- Change Input #16 (Fault #6)
16 BW ---- Commit All Alarms

10001 DI ---- Bus PT Switch Stable

10002 DI ---- Mains Stable Indication
10003 DI ---- Bus Stable Indication
10004 DI ---- Alarm Status
10005 DI ---- Loss of Mains Status
10006 DI ---- Relay #1 (Mains Brkr Close) Status
10007 DI ---- Relay #2 (Gen Brkr Close) Status
10008 DI ---- Relay #3 (Engine Preglow) Status
10009 DI ---- Relay #4 (Fuel Solenoid) Status
10010 DI ---- Relay #5 (Engine Crank) Status
10011 DI ---- Relay #6 (Visual Alarm) Status
10012 DI ---- Relay #7 ( Bus PT Connect) Status
10013 DI ---- Relay #8 (Mains PT Disconnect) Status
10014 DI ---- Relay #9 (Mains Brkr Trip) Status
10015 DI ---- Relay #10(Gen Brkr Trip) Status
10016 DI ---- Relay #11(Audible Alarm) Status
10017 DI ---- Relay #12 (Not Used) Status
10018 DI ---- Input #1 Status (Auto)
10019 DI ---- Input #2 Status (Test)
10020 DI ---- Input #3 Status (Run with Load)
10021 DI ---- Input #4 Status (Voltage Raise)
10022 DI ---- Input #5 Status (Voltage Lower)
10023 DI ---- Input #6 Status (Speed Raise)
10024 DI ---- Input #7 Status (Speed Lower)
10025 DI ---- Input #8 Status (Gen CB Aux.)
10026 DI ---- Input #9 Status (Mains CB Aux.)
10027 DI ---- Input #10 Status (Process I/E Input)
10028 DI ---- Input #11 Status (Fault #1 - High Engine Temp)
10029 DI ---- Input #12 Status (Fault #2 - Low Oil Pressure)
10030 DI ---- Input #13 Status (Fault #3 - Emergency Stop)
10031 DI ---- Input #14 Status (Fault #4)
10032 DI ---- Input #15 Status (Fault #5)
10033 DI ---- Input #16 Status (Fault #6)
10034 DI ---- SYNC_TIMEOUT Status
10035 DI ---- SYNC_RECLOSE Status
10036 DI ---- CRANK_FAIL Status
10037 DI ---- VOLTAGE_RANGE Status

4
Address Data Type Scaling Description
10038 DI ---- OVERSPEED Status
10039 DI ---- OVERCURRENT Status
10040 DI ---- REVERSE_POWER Status
10041 DI ---- LOSS_OF_EXCITATION Status
10042 DI ---- SPEED_FREQ_MISMATCH Status
10043 DI ---- H2O_HIGH_LIMIT Status
10044 DI ---- H2O_LOW_LIMIT Status
10045 DI ---- OIL_PRESS_HIGH_LIMIT Status
10046 DI ---- OIL_PRESS_LOW_LIMIT Status
10047 DI ---- BATT_VOLT_LOW_LIMIT Status
10048 DI ---- BATT_VOLT_HIGH_LIMIT Status
10049 DI ---- GEN_VOLT_LOW_LIMIT Status
10050 DI ---- GEN_VOLT_HIGH_LIMIT Status
10051 DI ---- GEN_FREQ_HIGH_LIMIT Status
10052 DI ---- GEN_FREQ_LOW_LIMIT Status
10053 DI ---- LOAD_HIGH_LIMIT Status
10054 DI ---- LOAD_LOW_LIMIT Status
10055 DI ---- PROCESS_HIGH_LIMIT Status
10056 DI ---- PROCESS_LOW_LIMIT Status
10057 DI ---- REMOTE_FAULT1 Status (High Engine Temp.)
10058 DI ---- REMOTE_FAULT2 Status (Low Oil Pressure)
10059 DI ---- REMOTE_FAULT3 Status (Emergency Stop)
10060 DI ---- REMOTE_FAULT4 Status
10061 DI ---- REMOTE_FAULT5 Status
10062 DI ---- REMOTE_FAULT6 Status
10063 DI ---- LOAD_SURGE Status
10064 DI ---- MAINS_VOLT_LOW_LIMIT Status
10065 DI ---- MAINS_VOLT_HIGH_LIMIT Status
10066 DI ---- MAINS_FREQ_HIGH_LIMIT Status
10067 DI ---- MAINS_FREQ_LOW_LIMIT Status
10068 DI ---- External LOM Status
10069 DI ---- Generator Output Stable
10070 DI ---- Voltage Sense Configuration
10071 DI ---- PF Leading/Lagging Indicator

30001 AI X10 Battery Voltage

30002 AI X10 Engine Oil Pressure
30003 AI ---- Engine Coolant Temperature
30004 AI ---- Engine Run Time
30005 AI ---- Engine kW/Hours
30006 AI ---- Engine RPM
30007 AI ---- Phase A/B Volts
30008 AI ---- Phase B/C Volts
30009 AI ---- Phase C/A Volts
30010 AI ---- Total kW
30011 AI ---- Total kVA
30012 AI X100 Generator Power Factor
30013 AI ---- Phase A kVAr
30014 AI ---- Phase B kVAr
30015 AI ---- Phase C kVAr
30016 AI ---- Total kVAr
30017 AI X10 Bus Output Frequency
30018 AI X10 Generator Output Frequency
30019 AI ---- Network Address
30020 AI ---- SYNC_TIMEOUT Action

5
Address Data Type Scaling Description
30021 AI ---- SYNC_RECLOSE Action
30022 AI ---- CRANK_FAIL Action
30023 AI ---- VOLTAGE_RANGE Action
30024 AI ---- OVERSPEED Action
30025 AI ---- OVERCURRENT Action
30026 AI ---- REVERSE_POWER Action
30027 AI ---- LOSS_OF_EXCITATION Action
30028 AI ---- SPEED_FREQ_MISMATCH Action
30029 AI ---- H2O_HIGH_LIMIT Action
30030 AI ---- H2O_LOW_LIMIT Action
30031 AI ---- OIL_PRESS_HIGH_LIMIT Action
30032 AI ---- OIL_PRESS_LOW_LIMIT Action
30033 AI ---- BATT_VOLT_LOW_LIMIT Action
30034 AI ---- BATT_VOLT_HIGH_LIMIT Action
30035 AI ---- GEN_VOLT_LOW_LIMIT Action
30036 AI ---- GEN_VOLT_HIGH_LIMIT Action
30037 AI ---- GEN_FREQ_HIGH_LIMIT Action
30038 AI ---- GEN_FREQ_LOW_LIMIT Action
30039 AI ---- LOAD_HIGH_LIMIT Action
30040 AI ---- LOAD_LOW_LIMIT Action
30041 AI ---- PROCESS_HIGH_LIMIT Action
30042 AI ---- PROCESS_LOW_LIMIT Action
30043 AI ---- REMOTE_FAULT1 Action (High Engine Temp)
30044 AI ---- REMOTE_FAULT2 Action (Low Oil Pressure)
30045 AI ---- REMOTE_FAULT3 Action (Emergency Stop)
30046 AI ---- REMOTE_FAULT4 Action
30047 Al ---- REMOTE FAULT5 Action
30048 AI ---- REMOTE_FAULT6 Action
30049 AI ---- LOAD_SURGE Action
30050 AI ---- MAINS_VOLT_LOW_LIMIT Action
30051 AI ---- MAINS_VOLT_HIGH_LIMIT Action
30052 AI ---- MAINS_FREQ_HIGH_LIMIT Action
30053 AI ---- MAINS_FREQ_LOW_LIMIT Action
30054 AI ---- External LOM Action
30055 AI ---- Phase A/Neutral Volts
30056 AI ---- Phase B/Neutral Volts
30057 AI ---- Phase C/Neutral Volts
30058 AI ---- Mains/Bus Phase A/Neutral Volts
30059 AI ---- Phase A current
30060 AI ---- Phase B current
30061 AI ---- Phase C current
30062 AI ---- Phase A kVA
30063 AI ---- Phase B kVA
30064 AI ---- Phase C kVA
30065 AI ---- Voltage Bias Analog Output (0-100%)
30066 AI ---- Speed Bias Analog Output (0-100%)
30067 AI ---- Load Control Mode
30068 AI ---- Synchronizer Mode
30069 AI ---- Number of Unacknowledged Alarms
30070 AI ---- Unit Network Priority
30071 AI ---- Current Master Unit
30072 AI ---- Engine Status
30073 AI ---- Synchroscope

40001 AW ---- Change Priority

6
2.2.3 Additional Variable Information Synch Control Indicated Meaning
Alarm Actions: Variables 30020 to 30048 are defined as Mode number
Alarm Action indication variables. These indicate the action Off 0 Synchroniser Off
associated with each particular alarm within the 6000 series ATS 1 Auto Transfer State.
control system. All 6 possible settings are represented by a Trying to open the
number from 0 to 5. The corresponding alarm actions are mains/utility breaker.
shown below: Parallel 2 Trying to close the
Generator Breaker.
In Sync 3 generator breaker /
Setting in 6000 Panel Indicated number
mains breaker closed
Disabled 0 successfully, and held
Warning 1 for sync timer.
Visual Alarm 2 ATS Return 4 Trying to open the
Audible Alarm 3 generator breaker.
Soft Shutdown 4 Parallel Mains 5 Trying to close the
Hard Shutdown 5 mains/utility breaker.
Gen Close Timer 6 Generator breaker close
Variables 30049 to 30053 are also alarm action indication issued. Checking for
variables but are associated with Mains/Utility supply good closure.
monitoring and loss of mains sensing. These indicate the Mains Close 7 Mains breaker close
action associated with each particular alarm within the 6000 Timer issued. Checking for
series control system. All 4 possible settings are good closure.
represented by a number from 0 to 3. The corresponding Gen Synch 8 Checking for successful
alarm actions are shown below: Timer closure of generator
breaker.
Setting in 6000 Panel Indicated number Mains Synch 9 Checking for successful
Master Unit: Variable 30071 indicates the Network Address of
Disabled 0
the current Master Unit in multiple unit systems. Units not
Warning 1 receiving the ‘AUTO’ input cannot display active master
Loss of Mains 2 information, and should not be relied upon for this information.
Loss of Mains with 3
Alarms Engine Status: Variable 30072 indicates the current engine
status and is represented by the following integer values:
Note:
Ÿ Variable 30054 is reserved for future use. Engine Status Indicated number

PF Leading / Lagging Indication: Variable 10071 Off 0

indicates whether the system load has a leading or a Preglow 1
lagging power factor. A ‘0’ indicates a lagging PF and a Crank 2
‘1’ indicates a leading PF. Run 3
When used in conjunction with variable 30012 an accurate Cooldown 4
power factor reading can be obtained. Spindown 5
Restart 6
Voltage Sense Configuration: Variable 10070
indicates the method of connection used on the voltage Phase Angle: Variable 30073 indicates the current phase
sensing circuitry. A ‘0’ indicates Line-Neutral (Wye or angle difference as indicated in the synchroscope screen of
Star) connections and a ‘1’ indicates Line-Line (Delta) the 6000 series control system. The Phase Angle reading is a
connections. value from 0 (phase matched at 12:00 on a standard
synchroscope) to +/- 180 degrees. Negative degree
Load Control Modes: Variable 30067 indicates the
measurements occur in the right half of the synchroscope,
current Load Control Mode of the 6000 series control
while positive measurements occur in the left half of the
system. This can be one of 5 modes which are
synchroscope.
represented by a number from 0 to 4. The control
modes and their assigned numbers are shown below: Changing Priority: When Decreasing (incrementing value) a
unit's priority, every active unit (in multiple unit configuration
Load Control Mode Indicated number and auto mode) on the same network with a higher priority
(lower value) than the unit which is currently having its priority
Off 0 changed, will increase (decrement value) priority when the
Droop 1 priority change is committed.
Isochronous 2
Baseload 3 And Inverse to this: When Increasing (decrementing value) a
Process 4 unit's priority, every active unit (in multiple unit configuration
and auto mode) on the same network with a lower priority
Refer to the 6000 series technical manual for a detailed (higher value) than the unit which is currently having its priority
explanation of the various load control modes. changed, will decrease (increment value) priority when the
priority change is committed.
Synchroniser Control Modes: Variable 30068 indicates
the current Load Control Mode of the 6000 series control A 20-second delay occurs after a priority change of master
system. This can be one of 10 modes which are units to allow proper record sorting for all units on the network.
represented by a number from 0 to 9. The control modes,
Changing Switch Inputs: Input changes are stored in two
their assigned numbers and meanings are shown above:
different registers in the 6000 series controller. One register
7
holds the hardware switch input, the other holds the Modbus Description: Reads the ON/OFF status of discrete outputs
switch input. If the controller recognises a change on either (addresses 00000-00016) in the slave.
input when compared with the current state of the switches
Query: The query message specifies the starting coil and
being used by
quantity of coils to be read. Coils are addressed starting at
the system, the controller will use the new switch settings,
zero: coils 1-16 are addressed as 0-15.
regardless of their source.
Here is an example of a request to read coils 1-10 from
In other words the 6000 series controller acts upon / reacts to
slave device 02:
the last valid command regardless of source. The control mode
switch inputs (variables 00001 to 00003 inclusive) are a
slightly special case in that the 6000 series controller will
require a transmission of all three variables before the control
mode change is considered to be valid. This is simply to
eliminate the possibility of intermediate control modes being
accepted as valid.

For example, if changing from ‘OFF’ (none of the three inputs

active) to ‘RUN’ (all three inputs active) it is possible for the
control to lapse into ‘AUTO’ or even ‘TEST’ modes as the input
states are changed one at a time. With hardware this is not a
problem as this normally occurs too quickly for the controller
to recognise the intermediate state but over Modbus, if a
command is lost several times due to noise or link failure then
this transition may never be fully completed so causing the
controller to lapse into an unwanted state.

Momentary Switches (Voltage Raise/Lower,

Speed Raise/Lower): Variables 00004 to 00007 inclusive
are internally timed to open after a one second ON time. This
means that if the controller receives an ON command via
Modbus for any of these four switches, the unit will turn the
switch ON for one second, and then turn the input OFF. If the
Modbus update for the ON command occurs again within the
one second period, the GCP will continue holding the switch
ON until one second after the last active Modbus ON update
was received.

2.2.4. Common Modbus Exception Codes

The following table shows all supported Modbus exception

codes:

Code Name Meaning

00 NO ERROR Good
01 Illegal Function The function received is not
an allowable action for the
addressed slave.
02 Illegal Data The address referenced in
Address the data field is not an
allowable address for the
addressed slave.
03 Illegal Data The amount of data requested
Value from the slave was too large
for the slave to return in a
single response.

The following table shows the extra codes which may

be displayed in the Load Control Monitor screen of the
6000 series controller

Code Name Meaning

09 Checksum There was an error in the
Error message checksum. This can
indicate link quality problems
and/or noise on the line.
10 Garbled Data was received by the
Message slave, however it is too short
to be a valid modbus
message/command.

2.2.5 Supported Modbus Function Codes

01 - Read Coil Status

8
 QUERY No. of Points Hi 00
Example No. of Points Lo 16
Field Name (Hex) Error Check Lo (CRC) ----
Error Check Hi (CRC) ----
Slave Address 02
Function 01
Starting Address Hi 00
Starting Address Lo 00
No. of Points Hi 00
No. of Points Lo 0A
Error Check Lo (CRC) ----
Error Check Hi (CRC) ----

Response: The coil status in the response message is packed

as one coil per bit of the data field. Status is indicated as:
1 = ON; 0 = OFF. The LSB of the first data byte contains the
coil addressed in the query. Other coils follow toward the high
order end of this byte, and from ‘low order to high order’ in
subsequent bytes.

If the returned coil quantity is not a multiple of eight the

remaining bits in the final data byte will be padded with zeros
(toward the high order end of the byte). The byte count field
specifies the quantity of complete bytes of data.

Here is an example of a response to the previous query:

RESPONSE
Example
Field Name (Hex)

Slave Address 02
Function 01
Byte Count 02
Data (Coils 07-00) CD
Data (Coils 10-08) 07
Error Check Lo (CRC) ----
Error Check Hi (CRC) ----

The status of coils 07-00 is shown as the byte value CD hex,

or binary 1100 1101. Coil 07 is the MSB of this byte, and coil
00 is the LSB. Left to right, the status of coils 07 through 00
is: ON-ON-OFF-OFF-ON-ON-OFF-ON.

By convention bits within a byte are shown with the MSB to

the left, and the LSB to the right. Thus the coils in the first
byte are ’07 through 00’, from left to right.

In the second and last byte the status of coils 08-10 are
shown as the byte value 07 Hex or binary 0000 0111. Coil 10
is the 6th bit from the left, or the 3rd bit from the right and coil
08 is the LSB of the byte. The status of coils 10-08 is: ON-
ON-ON. Note how the five remaining bits (toward the high
order end) are zero filled.

02 - Read Input Status

Description: Reads the ON/OFF status of discrete inputs in

the slave (addresses 10001-10071)

Query: The query message specifies the starting input and

quantity of inputs to be read. Inputs are addressed starting at
zero: inputs 1-16 are addressed as 0-15.

Here is an example of a request to read inputs 10001-10022

from slave device 02:

QUERY
Example
Field Name (Hex)

Slave Address 02
Function 02
Starting Address Hi 00
Starting Address Lo 00

9
Response: The input status in the response message is Here is an example of a response to the previous query:
packed as one input per bit of the data field. Status is
indicated as: RESPONSE
1 = ON; 0 = OFF. The LSB of the first data byte contains the Example
input addressed in the query. The other inputs follow toward Field Name (Hex)
the high order end of this byte, and from ‘low order to high
order’ in subsequent bytes. Slave Address 02
Function 02
If the returned input quantity is not a multiple of eight, the
Byte Count 02
remaining bits in the final data byte will be added with zeros
Data Hi (Register 40001) 00
(toward the high order end of the byte). The Byte Count field
Data Lo (Register 40001) 02
specifies the quantity of complete bytes of data.
Error Check Lo (CRC) ----
Here is an example of a response to the previous query: Error Check Hi (CRC) ----

RESPONSE The contents of register 40001 is shown as the two byte

Example values of 02 2B hex, or 02 decimal.
Field Name (Hex)
04 Read Input Registers
Slave Address 02
Description: Reads the binary contents of input registers
Function 02
(addresses 30001-30070) in the slave.
Byte Count 03
Data (Inputs 10008-10001) AC Query: The query message specifies the starting register and
Data (Inputs 10016-10009) DB the quantity of registers to be read. Registers are addressed
Data (Inputs 10022-10017) 35 starting at zero: registers 1-16 are addressed as 0-15.
Error Check Lo (CRC) ----
Here is an example of a request to read register 30009 from
Error Check Hi (CRC) ----
slave device 03:

The status of inputs 10008-10001 is shown as the byte value

QUERY
AC Hex, or binary 1010 1100. Input 10008 is the MSB of this
Example
byte, and input 10001 is the LSB. Left to right, the status of
Field Name (Hex)
inputs 10008 through 10001 is:
ON-OFF-ON-OFF-ON-ON-OFF-OFF.
Slave Address 03
The status of inputs 10022-10017 is shown as the byte value Function 04
35 hex, or binary 0011 0101. Input 10022 is the third bit Starting Address Hi 00
position from the left, and input 10017 is the LSB. The status Starting Address Lo 08
of inputs 10022 through 10017 is: ON-ON-OFF-ON-OFF-ON. No. of Points Hi 00
Note how the two remaining bits (toward the high order end) No. of Points Lo 01
are zero-filled. Error Check Lo (CRC) ----
Error Check Hi (CRC) ----
03 Read holding Registers

Description: Reads the binary contents of holding

Response: The register data in the response message are
registers (address 400001) in the slave.
packed as two bytes per register, with the binary contents
Query: The query message specifies the starting right justified within each byte. For each register, the first byte
register and quantity of registers to be read. Registers contains the high order bits and the second contains the low
are addressed starting at zero: register 1 is addressed order bits.
as 0.
Here is an example of a response to the previous query:
Here is an example of a request to read register 40001 from
slave device 1: RESPONSE
Example
QUERY Field Name (Hex)
Example
Field Name (Hex) Slave Address 03
Function 04
Slave Address 01 Byte Count 02
Function 03 Data Hi (Register 40001) 00
Starting Address Hi 00 Data Lo (Register 40001) 0A
Starting Address Lo 00 Error Check Lo (CRC) ----
No. of Points Hi 00 Error Check Hi (CRC) ----
No. of Points Lo 01
Error Check Lo (CRC) ----
The contents of register 30009 is shown as the two byte values
Error Check Hi (CRC) ----
of 00 0A hex, or 10 decimal.

Response: The register data in the response message are 05 Force Single Coil
packed as two bytes per register, with the binary contents
Description: Forces a single coil (addresses 00001-00016) to
right justified within each byte. For each register, the first
either ON or OFF. When broadcast the function forces the
byte contains the high order bits and the second contains the
same coil reference in all attached slaves.
low order bits.

10
Query: The query message specifies the coil reference to be Preset Data Hi 00
forced. Coils are addressed starting at zero: coil 1 is Preset Data Lo 03
addressed as 0. Error Check Lo (CRC) ----
Error Check Hi (CRC) ----
The requested ON/OFF state is specified by a constant in the
query data field. A value of FF 00 hex requests the coil to be
Response: The normal response is an echo of the query,
ON. A value of 00 00 requests it to be OFF. All other values are
returned after the register contents have been preset.
illegal and will not affect the coil.

Here is an example of a request to force coil 09 ON in slave

device 01:

QUERY
Example
Field Name (Hex)

Slave Address 01
Function 05
Coil Address Hi 00
Coil Address Lo 09
Force Data Hi FF
Force Data Lo 00
Error Check Lo (CRC) ----
Error Check Hi (CRC) ----

Response: The normal response is an echo of the query,

returned after the coil state has been forced.

Here is an example of a response to the previous query:

RESPONSE

Example
Field Name (Hex)

Slave Address 01
Function 05
Coil Address Hi 00
Coil Address Lo 09
Force Data Hi FF
Force Data Lo 00
Error Check Lo (CRC) ----
Error Check Hi (CRC) ----

06 Preset Single Register

Description: Presets a value into a single holding register

(address 40001). When broadcast, the function presets the
same register reference in all attached slaves.

Note:
Ÿ This function should not be broadcast on a network of
6000 series controllers as this would cause all units to be
preset to the same network priority.

Query: The query message specifies the register reference

to be preset. Registers are addressed starting at zero:
register 1 is addressed as 0.

The requested preset value is specified in the query data

field.

Here is an example of a request to preset register 40001 to

00 03 hex in slave device 02:

QUERY
Example
Field Name (Hex)

Slave Address 02
Function 06
Register Address Hi 00
Register Address Lo 00
11
Here is an example of a response to the previous query: Coil Address Hi 00
Coil Address Lo 04
RESPONSE Quantity of Coils Hi 00
Example Quantity of Coils Lo 0A
Field Name (Hex) Error Check Lo (CRC) ----
Error Check Hi (CRC) ----
Slave Address 02
Function 06
Register Address Hi 00 16 (10 Hex) - Preset Multiple Registers
Register Address Lo 00
Description: Presets values into a sequence of holding
Preset Data Hi 00
registers (40001 only in 6000 series control). When
Preset Data Lo 03
broadcast, the function presets the same register references
Error Check Lo (CRC) ----
in all attached slaves.
Error Check Hi (CRC) ----
Query: The query message specifies the register references
15 (0F Hex) – Force Multiple Coils to be preset. Registers are addressed starting at zero:
register 1 is addressed as 0.
Description: Forces each coil (addresses 00001-00016) in a
sequence of coils to either ON or OFF. When broadcast, the The requested preset values are specified in the query data
function forces the same coil references in all attached slaves. field. Data is packed as two bytes per register.

Query: The query message specifies the coil references to be Here is an example of a request to preset two registers
forced. Coils are addressed starting at zero: coil 1 is starting at 40002 to 00 0A and 01 02 Hex, in slave device 17:
addressed as 0.
QUERY
The requested ON/OFF states are specified by contents of the
Example
query data field. A logical ‘1’ in a bit position of the field requests
Field Name (Hex)
the corresponding coil to be ON.

A logical ‘ 0’ requests it to be OFF. Slave Address 11

Function 10
The following query shows an example of a request to force a Coil Address Hi 00
series of ten coils starting at coil 05 (addressed 04) in slave Coil Address Lo 01
device 05. No. of Registers Hi 00
The query data contents are two bytes: CD 01 Hex (1100 No. of Registers Lo 02
1101 0000 0001 binary). The binary bits correspond to the Byte Count 04
coils in the following way: Data Hi 00
Data Lo 0A
Bit: 1 1 0 0 1 1 0 1 0 0 0 0 0 0 0 1 Data Hi 01
Coil: 12 11 10 9 8 7 6 5 -- -- -- -- -- -- 14 13
Response: The normal response returns the slave address,
The first byte transmitted (CD Hex) addresses coils 12-05, with function code, starting address, and quantity of registers
the least significant bit addressing the lowest coil (05) in this set. preset.
The next byte transmitted (01 Hex) addresses coils 14-13, with
the least significant bit addressing the lowest coil (13) in this set. Here is an example of a response to the previous query:
Unused bits in the last data byte should be zero-filled.
QUERY
Example
QUERY
Field Name (Hex)
Example
Field Name (Hex)
Slave Address 11
Slave Address 05 Function 10
Function 0F Coil Address Hi 00
Coil Address Hi 00 Coil Address Lo 01
Coil Address Lo 04 No. of Registers Hi 00
Quantity of Coils Hi 00 No. of Registers Lo 02
Quantity of Coils Lo 0A Error Check Lo (CRC) ----
Byte Count 02 Error Check Hi (CRC) ----
Force Data Hi (Coils 12-05) CD
Force Data Lo (Coils 14-13) 01 Note:
Error Check Lo (CRC) ---- Ÿ The 6000 series controller has only one Holding Register
Error Check Hi (CRC) ---- and so it is recommended that the function code 06 (preset
single register) is used instead of this function. Including
Response: The normal response returns the slave address, the support for this function was done to ensure
function code, starting address, and quantity of coils forced. compatibility with all standard drivers available.
Here is an example of a response to the Query above: 2.2.6 CRC Generation

The Cyclical Redundancy Check (CRC) field is two bytes,

RESPONSE
containing a 16-bit binary value. The CRC value is calculated
Example
by the transmitting device, which appends the CRC to the
Field Name (Hex)
message. The receiving device recalculates a CRC during
receipt of the message, and compares the calculated value to
Slave Address 05
Function 0F
12
 the actual value it received in the CRC field. If the two values Indexing the CRC in this way provides faster execution than
are not equal, an error results. would be achieved by calculating a new CRC value with each
character from the message buffer.
In the case of the 6000 series control, this can be seen on the
Load Control Monitor screen of the 6000 series controller itself Note:
and is indicated by a link fault error code of 09 (displayed as Ÿ This function performs the swapping of the high/low CRC
‘LT-XT09’). bytes internally. The bytes are already swapped in the
The CRC is started by first preloading a 16-bit register to all CRC value that is returned by the function.
1’s. Therefore the CRC value returned from the function can be
The process begins by applying successive 8-bit bytes of directly placed into the message for transmission.
the message to the current contents of the register. Only the
eight bits of data in each character are used for generating The function field takes two arguments:
the CRC Start and stop bits, and the parity bit, do not apply to Unsigned char *puchMsg ; A pointer to the message
the CRC. buffer containing binary data
During generation of the CRC, each 8-bit character is exclusive to be used for generating the
ORed with the register contents. Then the result is shifted in the CRC.
direction of the least significant bit (LSB), with a zero filled into Unsigned short usDataLen ; The quantity of bytes in the
the most significant bit (MSB) position. The LSB is extracted and message buffer.
examined. If the LSB was a 1, the register is then exclusive
ORed with a preset, fixed value. If the LSB was a 0, no The function returns the CRC as a type unsigned short.
exclusive OR takes place.

This process is repeated until eight shifts have been performed.

After the last (eighth) shift, the next 8-bit character is exclusive
ORed with the register’s current value, and the process repeats
for eight more shifts as described above. The final contents of
the register, after all the characters of the message have been
applied, is the CRC value.

A procedure for generating CRC is:

1. Load a 16-bit register with FFFF hex (all 1’s). Call this the
CRC register.
2. Exclusive OR the first 8-bit byte of the message with the low
order byte of the 16-bit CRC register, putting the result in the
CRC register.
3. Shift the CRC register one bit to the right (toward the LSB),
zero-filling the MSB. Extract and examine the LSB.
4. (if the LSB was 0): Do nothing - proceed to step 5
(if the LSB was 1): Exclusive OR the CRC register with the
polynomial value
A001 hex (1010 0000 0000 0001).
5. Repeat steps 3 and 4 until 8 shifts have been performed.
When this is done, a complete 8-bit byte will have been
processed.
6. Repeat steps 2 through 5 for the next 8-bit byte of the
message. Continue doing this until all the bytes have been
processed.
7. The final contents of the CRC register is the CRC value.
8. When the CRC is placed into the message, its upper and
lower bytes must be swapped, i.e. the low order byte is
transmitted first, followed by the high order byte.

Placing the CRC into the Message: When the 16-bit CRC
(two 8-bit bytes) is transmitted in the message, the low order
byte will be transmitted first, followed by the high order byte.
For example, if the CRC value is 1241 hex (0001 0010 0100
0001):

Address Funct. Data Data Data Data CRC CRC

Count Lo Hi
(41) (12)

Example: An example of a C language function performing

CRC generation is shown here. All of the possible CRC
values are preloaded into two arrays, which are simply
indexed as the function increments through the message
buffer. One array contains all of the 256 possible CRC
values for the high order byte of the 16-bit CRC field, and
the other array contains all of the values for the low byte.

13
CRC Generation Function:

unsigned short CRC16(puchMsg, usDataLen)

unsigned char *puchMsg ; /* message to calculate CRC upon */

unsigned short usDataLen /* quantity of bytes in message */

unsigned char uchCRCHi = 0xFF ; /* high byte of CRC initialised

*/
unsigned char uchCRCLo = 0xFF ; /* low byte of CRC initialised */
unsigned uIndex ; /* will index into CRC lookup table */

while (usDataLen--) /* pass through message buffer

*/
{
uIndex = uchCRCHi ^ *puchMsgg++ ;/* calculate the CRC */
uchCRCHi = uchCRCLo ^ auchCRCHi [uIndex] ;
uchCRCLo = auchCRCLo [uIndex] ;
}

High-Order Byte Table

/* Table of CRC values for high-order byte */

static unsigned char auchCRCHi[] = {

0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01,
0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,
0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,. 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
0x40
} ;

Low-Order Byte Table

/* Table of CRC values for low-order byte */

static char auchCRCLo [] = {

0x00, 0xC0, 0xC1, 0x01, 0xC3, 0x03, 0x02, 0xC2, 0xC6, 0x06 0x07, 0xC7, 0x05, 0xC5, 0xC4,
0x04, 0xCC, 0x0C, 0x0D, 0xCD, 0x0F, 0xCF, 0xCE, 0x0E, 0x0A, 0xCA, 0xCB, 0x0B, 0xC9, 0x09,
0x08, 0xC8, 0xD8, 0x18, 0x19, 0xD9, 0x1B, 0xDB, 0xDA, 0x1A, 0x1E, 0xDE, 0xDF, 0x1F, 0xDD,
0x1d, 0x1C, 0xDC, 0x14, 0xD4, 0xD5, 0x15, 0xD7, 0x17, 0x16, 0xD6, 0xD2, 0x12, 0x13, 0xD3,
0x11, 0xD1, 0xD0, 0x10, 0xF0, 0x30, 0x31, 0xF1, 0x33, 0xF3, 0xF2, 0x32, 0x36, 0xF6, 0xF7,
0x37, 0xF5, 0x35, 0x34, 0xF4, 0x3C, 0xFC, 0xFD, 0x3D, 0xFF, 0x3F, 0x3E, 0xFE, 0xFA, 0x3A,
0x3B, 0xFB, 0x39, 0xF9, 0xF8, 0x38, 0x28, 0xE8, 0xE9, 0x29, 0xEB, 0x2B, 0x2A, 0xEA, 0xEE,
0x2E, 0x2F, 0xEF, 0x2D, 0xED, 0xEC, 0x2C, 0xE4, 0x24, 0x25, 0xE5, 0x27, 0xE7, 0xE6, 0x26,
0x22, 0xE2, 0xE3, 0x23, 0xE1, 0x21, 0x20, 0xE0, 0xA0, 0x60, 0x61, 0xA1, 0x63, 0xA3, 0xA2,
0x62, 0x66, 0xA6, 0xA7, 0x67, 0xA5, 0x65, 0x64, 0xA4, 0x6C, 0xAC, 0xAD, 0x6D, 0xAF, 0x6F,
0x6E, 0xAE, 0xAA, 0x6A, 0x6B, 0xAB, 0x69, 0xA9, 0xA8, 0x68, 0x78, 0xB8, 0xB9, 0x79, 0xBB,
0x7B, 0x7A, 0xBA, 0xBE, 0x7E, 0x7F, 0xBF, 0x7D, 0xBD, 0xBC, 0x7C, 0xB4, 0x74, 0x75, 0xB5,
0x77, 0xB7, 0xB6, 0x76, 0x72, 0xB2, 0xB3, 0x73, 0xB1, 0x71, 0x70, 0xB0, 0x50, 0x90, 0x91,
0x51, 0x93, 0x53, 0x52, 0x92, 0x96, 0x56, 0x57, 0x97, 0x55, 0x95, 0x94, 0x54, 0x9C, 0x5C,
0x5D, 0x9D, 0x5F, 0x9F, 0x9E, 0x5E, 0x5A, 0x9A, 0x9B, 0x5B, 0x99, 0x59, 0x58, 0x98, 0x88,
0x48, 0x49, 0x89, 0x4B, 0x8B, 0x8A, 0x4A, 0x4E, 0x8E, 0x8F, 0x4F, 0x8D, 0x4D, 0x4C, 0x8C,
0x44, 0x84, 0x85, 0x45, 0x87, 0x47, 0x46, 0x86, 0x82,. 0x42, 0x43, 0x83, 0x41, 0x81, 0x80,
0x40

12