Reading out Keller series 30 and 40 pressure sensors

✎ This article/section is a stub — some half-sorted notes, not necessarily checked, not necessarily correct. Feel free to ignore, or tell me about it.

Search for the PDF titled "Description of the Communication protocol for Series 30 and Series 40 pressure transmitters from KELLER"

The protocol is based on ModBus - basically an extension of it, with some footnotes.

The below describes are notes on basic use and readout. There are more possible interactions, but you can read the full docs for that.

The sensors use a RS485 bus - at 9600 baud (default) or 115200, and 8N1.

Sending and receiving packets

Most generally, packets consist of

• a device address (1 byte),
• a function code (1 byte),
  • In responses, the lowest 7 bits are the function code, the highest bit signals errors
• payload (≥0 byte, and apparently ≤6(verify))
• crc16 (2 bytes)

Device addresses:

• 0 is for broadcasting
• 1..249 is for use on a shared bus
• 250 is for non-bus use (every device responds to this)
• 251..255 are reserved

Notes:

• CRC16: The most generic variant (based on 0xA001 (/0x8005) polynomial, initial value 0xffff; see also Hashing_notes#CRC)

• Packets with invalid CRC16 are discarded

• Request packet is ≥4 bytes, a response packet ≥5

• A response message is at most 10 bytes long

Exception responses are five-byte responses: address, function code (with highest bit set), exception code, crc16 high, crc16 low. The error codes relevant here:

• • 1: function not implemented
  • 2: bad parameters (e.g. register address)
  • 3: bad data (frame makes no sense)
  • 32: not initialised (See function 48)

On timing:

• time between a response and the next request should be at least 1 byte's worth: ~1ms at 9600 baud and ~0.1ms at 115200 baud.
• devices have a timeout waiting for the next bytes within the same request: 1.5ms for 9600 baud, 0.20ms at 115200. (if you wait longer, the data will be ignored as a fragment)
• The sensor is guaranteed to respond within 1..100ms. For all but a few requests, it's much less: 1..3ms

Keller functions

Function 48: Initialize

After poweron you must send this to initialize a device. Basically a "hey device, acknowledge you're there", also reading out basic details about type and version.

Until you send this, any other request will return an error (exception 32)

Request packet, byte-by-byte:

• Device address
• 48
• CRC16 high byte
• CRC16 low byte

Response packet, byte-by-byte:

• Device address
• 48
• Class (0: prototype, 1:Transmitter, 2:Progres programmer, 3:Manometer, 5:Series 30)
• Group - ?
• Year - software version
• Week - software version
• Buf - length of transmission buffer
• Status - bit 0 signals whether device was already initialised
• CRC16 high byte
• CRC16 low byte

Function 69: Read serial number

Request packet, byte-by-byte:

• Device address
• 69
• CRC16 high byte
• CRC16 low byte

Response packet, byte-by-byte:

• Device address
• 69
• Four bytes (a big-endian uint32)
• CRC16 high byte
• CRC16 low byte

Function 73: Sensor readout (floating point)

Request packet, byte-by-byte:

• Device address
• 73
• channel of the sensor you want to read:
  • 0 for CH0, Calculated (what this contains is configured via )
  • 1 for P1, Pressure on sensor 1
  • 2 for P2, Pressure on sensor 2
  • 3 for T, Additional temperature sensor
  • 4 for TOB1, Temperature of pressure sensor 1
  • 5 for TOB2, Temperature of pressure sensor 2
• CRC16 high byte
• CRC16 low byte

Response packet, byte-by-byte:

• Device address
• 73
• Byte3 of 32-bit IEEE float
• Byte2 of that float
• Byte1 of that float
• Byte0 of that float
• Stat, which is 8 bits of status:
  • Bit7, /STD: 1: in powerup mode. 0: in standard ode
  • Bit6, ERR2: Error calculating analog-out (at saturation)
  • Bit5, TOB2: Error measuring/calculating TOB2
  • Bit4, TOB1: Error measuring/calculating TOB1
  • Bit3, T: Error measuring/calculating T
  • Bit2, P2: Error measuring/calculating P2
  • Bit1, P1: Error measuring/calculating P1
  • Bit0, CH0: Error measuring/calculating CH0
• CRC16 high byte
• CRC16 low byte

Others

There are other (Keller-specific) functions (34, 35, 64, 65, 101), but they have no meaning for these sensors.

What about 32 and 33?