Modbus For Dedicated Controls: Functional Profile and User Manual

GRUNDFOS INSTRUCTIONS
Modbus for Dedicated Controls

CIM 200 Modbus RTU
CIM 250 GSM/GPRS
CIM 500 Ethernet for Modbus TCP
Functional profile and user manual
Original functional profile and user manual.
CONTENTS
Page
1.
Symbols used in this document
2.
2.1
2.2
2.3
Introduction
About this functional profile
Assumptions
Definitions and abbreviations
4
4
4
4
3.
3.1
3.2
3.3
3.4
System
Modbus
Modbus
Modbus
Modbus
5
5
5
5
5
4.
4.1
4.2
4.3
4.4
Specifications
CIM module general data
CIM 200 Modbus RTU
CIM 250 GSM/GPRS
CIM 500 Modbus TCP
5.
5.1
5.2
5.3
5.4
5.5
Modbus RTU, CIM 200 setup

Setting the Modbus transmission speed
Setting the parity
Modbus address selection
Termination resistor
Status LEDs
8
8
9
9
9
10
6.
6.1
6.2
Modbus GSM/GPRS, CIM 250 setup

Installation
Status LEDs
11
11
13
7.
7.1
7.2
7.3
7.4
7.5
7.6
Modbus TCP, CIM 500 setup

Connecting the Ethernet cable
Setting the Industrial Ethernet protocol
Setting up the IP-addresses
Establish connection to the Web server
Status LEDs
DATA and LINK LEDs
14
14
14
14
15
15
15
8.
Modbus function code overview
16
9.
9.1
9.2
9.3
9.4
9.5
9.6
9.7
9.8
9.9
9.10
9.11
9.12
9.13
9.14
9.15
9.16
9.17
9.18
9.19
Modbus register overview

Register block overview
CIM configuration register block
CIM status register block
Pit control and configuration register block
Pit status register block
Pit data register block
Pump 1 register block
Alarm simulation register block
User register block
Name string register block
Hour log register block
Event log register block
Data log index register block
Data log series register block
17
17
18
19
20
23
31
33
35
37
39
41
43
45
45
45
46
47
48
49
10.
10.1
10.2
10.3
10.4
Modbus RTU commissioning, step-by-step guides

Hardware setup (CIM 200)
Hardware setup (CIM 250 GSM call-up)
Hardware setup (CIM 250 GPRS connection)
Modbus TCP communication setup (CIM 500)
50
50
50
50
51
11.
11.1
11.2
11.3
11.4
11.5
11.6
11.7
11.8
Detailed descriptions of functionality

SCADA PIN code protection
Reading the event log
Reading the configurable data log series
Separation of reads and writes
Control bit acknowledgement
GSM call-up connection
GSM call-back connection
Use of SMS messages
52
52
52
53
55
55
56
56
57
description
RTU (CIM 200)
GSM/GPRS (CIM 250)
TCP (CIM 500)
6
6
6
7
7
11.9
11.10
11.11
11.12
11.13
GPRS connection
Interlocking
Real-time clock
Event simulation
Alarms and warnings
57
60
61
61
62
12.
12.1
12.2
12.3
12.4
12.5
12.6
12.7
Modbus RTU telegram examples

Modbus telegram overview
Read holding registers (0x03)
Read input registers (0x04)
Write single register (0x06)
Write multiple registers (0x10)
Diagnostics (0x08)
Diagnostics register interpretation
65
65
65
65
66
66
67
67
13.
13.1
13.2
Application example
Adaptation of pit graphics to installation values
Main status
68
69
69
14.
Modbus function code overview
73
15.
15.1
15.2
15.3
15.4
15.5
15.6
Modbus telegram examples

Diagnostics: return query data
Reading the CIM configuration register block
Reading the pit water level
Reading the pit alarms
Setting pit auto mode
Interlocking the pit
74
74
74
74
75
75
76
16.
16.1
16.2
16.3
Fault finding
Fault finding CIM 200
77
77
79
81
17.
Modbus RTU rotary switch addresses
83
18.
Grundfos alarm and warning codes
84
1. Symbols used in this document

Warning
If these safety instructions are not observed,
it may result in personal injury.
Caution
If these safety instructions are not observed,

it may result in malfunction or damage to the
equipment.
Note
Notes or instructions that make the job easier

and ensure safe operation.
English (GB)
English (GB) Functional profile and user manual
English (GB)
2. Introduction
2.1 About this functional profile
GSM
Global System for Mobile

communications.
Pressure (Head).
HTTP
Hyper Text Transfer Protocol.

The protocol commonly used to navigate
the world wide web.
IANA
Internet Assigned Numbers Authority.
This functional profile describes the:
CIM 200 Modbus RTU
CIM250 Modbus GSM/GPRS
CIM 500 Modbus Ethernet for Modbus TCP
for the following Grundfos products:
IP
Internet Protocol.
Grundfos Dedicated Controls 361
LED
Light-Emitting Diode.
Grundfos Dedicated Controls 362.
MAC
Media Access Control. Unique network

address for a piece of hardware.
Modbus
A serial communications protocol

commonly used in industry and building
automation systems.
Modbus RTU
Modbus is a fieldbus used worldwide.

The RTU version is used for wired
networks (CIM 200) and for call-up
connections over telephone networks
(CIM 250).
Modbus TCP
Modbus is a fieldbus used worldwide.

The TCP version is adapted for use as an
application protocol on TCP/IP using
either GPRS (CIM 250) or Ethernet
(CIM 500) as basis.
MP 204
Grundfos motor protector.
PIN
Personal Identification Number

(SIM cards).
Ping
Packet InterNet Groper. A software utility

that tests connectivity between two TCP/
IP hosts.
Personal Unblocking Key (SIM cards).
In the following, the two supported controllers are referred to as

CU 36X.
The data in this document are subject to change without prior
notice. Grundfos cannot be held responsible for any problems
caused directly or indirectly by using information in this functional
profile.
2.2 Assumptions
This functional profile assumes that the reader is familiar with
commissioning and programming of Modbus devices. The reader
should also have some basic knowledge of the Modbus protocol
and technical specifications.
It is also assumed that an existing Modbus network with a
Modbus master is present.
2.3 Definitions and abbreviations

0b
Prefix for binary number.
0x
Prefix for hexadecimal number.
3G
3rd-generation mobile telephony network.
PUK
4G
4th-generation mobile telephony network.
Flow.
ARP
Address Resolution Protocol. Translates

IP-addresses to MAC-addresses.
R100
Grundfos handheld infrared remote

control.
Ensures that both crossover cable types

and non-crossover cable types can be
used.
SELV
Separated or Safety Extra-Low Voltage.
Auto-MDIX
SELV-E
Separated or Safety Extra-Low Voltage

with Earth connection.
CAT5
Ethernet cable type: Has 4 twisted pairs of

wires.
SIM
SIM card, Subscriber Identity Module.
CAT5e
Enhanced CAT5 cable with better

performance.
SMA
SubMiniature version A. Coaxial radio

signal cable connection standard.
CAT6
Cable with very high performance.
SMTP
Simple Mail Transfer Protocol
SNTP
Simple Network Time Protocol. Used for

clocks synchronization between computer
systems.
TCP
Transmission Control Protocol.

Protocol suitable for Internet
communication and Industrial Ethernet
communication.
Transmission Control Protocol/Internet
Protocol. Protocol suitable for Internet
communication.
CIM
Communication Interface Module.
CRC
Cyclic Redundancy Check, a data error

detection method.
CSD
Circuit Switched Data. Connection is

established via a fixed connection
(a physical circuit or a reserved data
channel).
CU 36X
Grundfos control unit for Dedicated

Controls (CU 361 and CU 362).
TCP/IP
Dynamic Host Configuration Protocol.

Used to configure network devices so that
they can communicate on an IP network.
Transmission speed Bits transferred per second, bits/s.
DHCP
DNS
Domain Name System. Used to resolve

host names to IP addresses.
GENIbus
Proprietary Grundfos fieldbus standard.
GENIpro
Proprietary Grundfos fieldbus protocol.
GPRS
General Packet Radio Service,

technology to achieve TCP/IP
communication and internet access via
GSM.
Grundfos GO
A Grundfos handheld remote control

device for controlling Grundfos products
via infrared or radio. Based on smart
phone technology.
URL
Uniform Resource Locator. The IP

address used to connect to a server.
UTC
Coordinated Universal Time, the primary

time standard by which the world
regulates clocks and time.
UTF-8
Unicode Transformation Format

(character encoding).
VPN
Virtual Private Network.

A network using the Internet to connect
nodes. These systems use encryption and
other security mechanisms to ensure that
only authorised users can access the
network and that the data cannot be
intercepted.
3. System description
English (GB)
3.4 Modbus TCP (CIM 500)
3.1 Modbus
The Grundfos Dedicated Controls CU 36X control unit is
connected to up to six Grundfos wastewater pumps. It offers
status information as well as control and monitoring of a
wastewater pit via a user-friendly control panel with display.
CU 36X
The CIM 200/250/500 is an add-on communication module to be

fitted in the CU 36X, using a 10-pin connection. This enables
communication with a PLC, SCADA system, etc.
CIM 500
Modbus TCP
Via the Modbus RTU connection, it is possible to control the

pumps and read status, measured values, logs, etc.
3.2 Modbus RTU (CIM 200)

TM04 3409 4408
Sensor input
8
9
CU 36X
1 2 3
CIM 200
Fig. 3
Modbus RTU
CIM 500 solution for Dedicated Controls. Up to six

pumps can be connected to CU 36X.
TM04 3409 4408
Sensor input
Fig. 1

3.3 Modbus GSM/GPRS (CIM 250)

The CIM 250 is an add-on communication module to be fitted in
the CU 36X, using a 10-pin connection. This enables GSM/GPRS
communication with a PLC, SCADA system, mobile phone, etc.
Via the GSM/GPRS connection, it is possible to control the
pumps and read status, measured values, logs, etc.
GSM/GPRS CU 36X
CU 361
CIM 250
TM04 4903 2209
Sensor input
Fig. 2

English (GB)
4. Specifications
4.1 CIM module general data
General data
Description
Comments
Ambient humidity
30 % to 95 %
Relative, non-condensing.
Operating temperature
-20 C to +45 C
Storage temperature
-25 C to +70 C
Battery, lithium-ion
The battery will only be charged if the

battery temperature is within 0 C to
+45 C.
CIM 250 only.
GENIbus visual diagnostics
LED2
Will be in one of these states:

Off, constantly green, flashing red, constantly red.
See section 5.5 Status LEDs.
4.2 CIM 200 Modbus RTU

The table below provides an overview of the specifications for the
Grundfos CIM 200. For further details, please refer to the specific
sections of this functional profile.
Modbus RTU specifications
Description
Comments
Modbus connector
Screw-type terminal
3 pins.
See section 5. Modbus RTU, CIM 200 setup.
Modbus connection type
RS-485, 2-wire + common
Conductors: D0, D1 and Common.

See section 5. Modbus RTU, CIM 200 setup.
Maximum cable length
1200 m
Equals 4000 ft.
Slave address
1-247
Set via rotary switches SW6 and SW7.

See section 5.3 Modbus address selection.
Line termination
On or off
Set via DIP switches SW1 and SW2.

See section 5.4 Termination resistor.
Recommended cable cross sectional

cobber area
0.20 - 0.25 mm2
AWG24 or AWG23
Supported transmission speeds
1200*, 2400*, 4800*, 9600, 19200,

38400 bits/s
Set via DIP switches SW4 and SW5.

See section 5.1 Setting the Modbus transmission
speed.
Start bit
Fixed value.
Data bits
Fixed value.
Stop bits
1 or 2
Set via DIP switch SW3.

See section 5.2 Setting the parity.
Parity bit
Even parity, odd parity* or no parity
Set via DIP switch SW3.

Modbus visual diagnostics
LED1
Off, flashing green, flashing red, constantly red.

Maximum number of Modbus devices
32
Using repeaters, this number can be increased.

Legal address range is 1-247.
Maximum Modbus telegram size
256 bytes
Total length. Node address and CRC included.

See section 12. Modbus RTU telegram examples.
Can only be set via software.
English (GB)
4.3 CIM 250 GSM/GPRS

Grundfos CIM 250. For further details, please refer to the specific
sections of this functional profile.
Modbus GSM/GPRS specifications
Description
Comments
Data protocol
Modbus RTU/Modbus TCP
GSM call-up uses RTU. GPRS uses TCP.
Slave address
Factory 231 (0xE7)
Can be changed via Modbus register 00003,

SoftwareDefinedModbusAddress.
GSM/GPRS visual diagnostics
LED1
Maximum Modbus telegram size
260 bytes
Total Modbus TCP/IP application data unit.

See fig. 25.
4.4 CIM 500 Modbus TCP

Grundfos CIM 500 for Modbus TCP. For further details, please
refer to the specific sections of this functional profile.
Modbus TCP specifications
Description
Comments
Application layer
DHCP, HTTP, Ping, FTP, SMTP, SNTP,

Modbus TCP
Rotary switch in position 1.
Transport layer
TCP
Internet layer
Internet protocol V4 (IPv4)
Link layer
ARP, media access control (Ethernet)
Ethernet cable
Screened/unscreened, twisted-pair
cables, CAT5, CAT5e or CAT6
Supports auto cable-crossover detecting

(Auto-MDIX).
100 metres at 10/100 Mbits/s
Corresponds to 328 feet.
Transmission speed
10 Mbits/s, 100 Mbits/s
Auto-detected.
Industrial Ethernet protocols
PROFINET IO, Modbus TCP
Selected with rotary switch, section 7.2.
5.1 Setting the Modbus transmission speed
TM04 1710 0908
The transmission speed must be set correctly before the CIM 200
Modbus module is ready to communicate with the Modbus
network. DIP switches SW4 and SW5 are used for setting the
transmission speed. See fig. 5.
SW4 SW5
Fig. 5
8
9
1 2 3
Fig. 4
Pos.
1
CIM 200 Modbus module

Designation
Description
D1
Modbus terminal D1
(positive data signal)
Modbus terminal D0
(negative data signal)
Common/GND
Modbus terminal
Common/GND
SW1/SW2
On/off switches for termination

resistor
SW3/SW4/SW5
Switches for selection of Modbus

parity and transmission speed
LED1
Red/green status LED for

Modbus communication
LED2
Red/green status LED for

internal communication between
the CIM 200 and the Grundfos
product
Available transmission speeds in bits/s: 1200, 2400, 4800, 9600,

19200 and 38400.
The first three transmission speeds are only available via
software settings, whereas the last three are available via DIP
switches.
Transmission speed [bits/s]
D0
Modbus transmission speed
DIP switch settings

TM04 1697 0908
English (GB)
5. Modbus RTU, CIM 200 setup
SW6
Hex switch for setting the

Modbus address (four most
significant bits)
SW7
Hex switch for setting the

Modbus address (four least
significant bits)
SW4
SW5
9600
OFF
ON
19200
OFF
OFF
38400
ON
OFF
Software-defined
ON
ON
Default transmission speed is 19200 bits per second, as per the

Modbus RTU standard.
Software-defined
When SW4 and SW5 are set to "software-defined", writing a
value to the holding register at address 00004 will set a new
transmission speed.
Use the following values for software-defined transmission
speeds:
Software-defined transmission
speed
Value to set in
register 00004
1200 bits/s
2400 bits/s
4800 bits/s
9600 bits/s
19200 bits/s
38400 bits/s
This value is set to 1200 bits/s as default.
A screened, twisted-pair cable must be used. The cable screen

must be connected to protective earth at both ends.
The communication interface does not support transmission

speeds above 38400 bits/s.
Recommended connection
The software-defined transmission speed value will be stored in

the communication interface and will remain after a power-off.
Modbus terminal
Colour code
Data signal
D1-TXD1
Yellow
Positive
D0-TXD0
Brown
Negative
Common/GND
Grey
Common/GND
A Modbus slave on a Modbus network must have a unique

address from 1-247. Address 0 is reserved for broadcasting, and
is not a valid slave address.
When software-defined transmission speed is

enabled (ON), software-defined parity and stop
bits are also enabled.
Note
To set the Modbus address, two hexadecimal rotary switches

(SW6 and SW7) are used. See fig. 7.
The parity can be set either manually by using SW3 or via

software-defined settings.
TM04 1706 0908
Manual setting of parity

Default byte format (11 bits):
1 start bit
8 data bits (least significant bit sent first)
1 parity bit (even parity)
1 stop bit.
SW6
Fig. 7
The default setting of the CIM 200 Modbus module is even parity
(1 stop bit). It is possible to change the parity using DIP switch
SW3. The parity can be changed to no parity (2 stop bits).
See fig. 6.
For a complete overview of Modbus addresses, see section

16. Fault finding.
The Modbus address must be set decimally
from 1 to 247.
TM04 1709 0908
Note
SW3
Fig. 6
5.4 Termination resistor

The termination resistor is fitted on the CIM 200 Modbus module
and has a value of 150 .
The CIM 200 has a DIP switch with two switches (SW1 and SW2)
for cutting the termination resistor in and out. Figure 8 shows the
DIP switches in cut-out state.
Parity
DIP switch settings

Parity
SW3
Even parity, 1 stop bit
OFF
No parity, 2 stop bits
ON
Software-defined parity and stop bits
SW1 SW2
When SW4 and SW5 are set to "software-defined", the value in

the holding registers at addresses 00009 and 00010 will override
the setting of SW3. See figures 5 and 6.
Software-defined parity
Value to set in
register 00009
No parity [default]
Even parity
Odd parity
Software-defined stop bit
Value to set in
register 00010
1 stop bit [default]
2 stop bits
The software-defined parity and stop bit values will be stored in

the communication interface and will remain after a power-off.
Note
SW7
Setting the Modbus address
TM04 1701 0908
Before the parity and stop bits can be set via

software-defined settings, SW4 and SW5 must be
set to ON.
Fig. 8
Cutting the termination resistor in and out
DIP switch settings

Status
SW1
Cut-in
Cut-out
SW2
ON
ON
OFF
OFF
ON
OFF
OFF
ON
Default setting: Termination resistor cut out.

Cable length
Grundfos recommends the following maximum lengths:
Bits/s
Terminated cable
Unterminated cable
[m/ft]
[m/ft]
1200-9600
1200/4000
1200/4000
19200
1200/4000
500/1700
38400
1200/4000
250/800
Note
To ensure a stable and reliable communication, it

is important that only the termination resistor of
the first and last units in the Modbus network are
cut in.
Note
All switch settings will be effective immediately

after setting the values, no power-off needed.
English (GB)
5.3 Modbus address selection
5.2 Setting the parity
5.5 Status LEDs
English (GB)
The CIM 200 Modbus module has two LEDs.See fig. 4.
Red/green status LED (LED1) for Modbus communication
Red/green status LED (LED2) for internal communication

between the CIM 200 and the Grundfos product.
LED1
Status
Description
Off
No Modbus communication.
Flashing green
Modbus communication active.
Flashing red
Fault in the Modbus communication.
Permanently red
Fault in the CIM 200 Modbus

configuration.
LED2
Status
Description
Off
The CIM 200 has been switched off.
Flashing red
No internal communication between the

CIM 200 and the Grundfos product.
Permanently red
The CIM 200 does not support the

Grundfos product connected.
Permanently green
Internal communication between the

CIM 200 and the Grundfos product is OK.
Note
10
During start-up, there may be a delay of up to

5 seconds before the LED2 status is updated.
6. Modbus GSM/GPRS, CIM 250 setup
Note
English (GB)
6.1 Installation
Before installation, make sure that the power
supply has been switched off and that it cannot
be accidentally switched on.
6.1.1 Fitting a GSM antenna

An antenna must be connected to the CIM 250 to establish
connection to the GSM network.
Note
External antenna
TM04 2642 1210
Fig. 9
Grundfos offers different kinds of antennas.

No antenna is supplied with the CIM 250. It must
be ordered separately.
Connect the antenna cable to the SMA connection (pos. 1) of the

CIM 250. The antenna must be installed outside the control
cabinet in a position with good reception conditions.
CIM 250 GSM module (top-side view)

1
Designation
Description
Battery socket
SIM card holder
SMA connection for GSM antenna
LED1
Yellow/green status LED for GSM/

GPRS communication
LED2
Red/green status LED for internal

communication between the CIM 250
and the Grundfos product.
SW1
Reset button.
Keep the button pressed for 5 seconds
to return to default settings.
2
TM04 2644 2808
Pos.
Fig. 10 Fitting an external GSM antenna

Pos.
Description
SMA connection for GSM antenna
Antenna cable for external GSM antenna
11
6.1.2 Inserting the SIM card
6.1.3 Connecting the battery and power supply

Warning
Procedure
The CIM 250 must only be connected to SELV or

SELV-E circuits.
1. Insert the SIM card into a mobile phone.

2. Remove the PIN code from the SIM card, or set the PIN code
to "4321". See the manual of the mobile phone.
Warning
The safety precautions listed below must be
observed carefully as improper handling of the
lithium-ion battery may result in injury or damage
from electrolyte leakage, heating ignition or
explosion.
3. Insert the SIM card into the CIM 250. See fig. 11.
The slanted edge of the SIM card must point
downwards (away from the connector).
Note
The connectors on the SIM card must face

inwards towards the CIM 250. See fig. 11.
These safety precautions must be observed:
Never use this battery pack in other battery chargers.
Do not dismantle or modify the battery.
Do not heat or incinerate the battery.
Do not pierce, crush or cause mechanical damage to the

battery.
Do not short-circuit the battery.
Do not allow the battery to get wet or be immersed in water.
Do not strike or throw the battery.
For long periods of storage, the temperature should be below

45 C.
Fig. 11 Inserting the SIM card

Pos.
Only insert the approved Grundfos battery pack (97631960).
TM04 2643 2808
Description
SIM card holder
SIM card
The CIM 250 is fitted with a lithium-ion battery. It is secured by a

velcro strap which absorbs vibrations and makes it easier to
replace the battery. Connect the battery to the CIM 250 as shown
in fig. 12.
Note
If a battery is not connected, the user will not

receive any SMS alarm message in case of a
power cut.
TM04 2645 2808
English (GB)
Before inserting the SIM card into the CIM 250, remove the PIN
code, or set the PIN code to "4321".
Fig. 12 Connecting the battery

Note
The battery will only be charged if the battery

temperature is within 0 C to +45 C.
Switch on the power supply. The CIM 250 is powered either by

the Grundfos product or by the battery.
The LED1 flashes yellow (searching for GSM network). When the
connection to the GSM network has been established, the LED1
will pulsate yellow (GSM network active). See fig. 13.
The LED2 must be constantly green, indicating that the CIM 250
has been fitted correctly in the Grundfos product.
6.1.4 Configuration
For software configuration of the CIM 250, which includes setting
of SMS functions and SCADA communication parameters, see
"CIM 250 SMS commands" (supplement to the installation and
operating instructions) on the CD-ROM supplied with the GSM
module.
12
English (GB)
6.2 Status LEDs

The CIM 250 GSM module has two LEDs.See fig. 9.
Yellow/green status LED (LED1) for GSM/GPRS

communication.

LED1 (yellow/green)
1
2
3
4
5
6
TM04 5194 4412
1 sec.
3 sec.
Yellow
Green
Fig. 13 LED1 status

Pos.
Status
Description
Flashing yellow
Searching for GSM

network.
Pulsating yellow
(single pulse)
Connection to the GSM

network has been
established.
Constantly yellow
Call-up connection has

been established.
Pulsating green
(single pulse)
Data are exchanged via

GPRS.
Pulsating green
(double pulse)
Data are exchanged via

the call-up connection.
Green (3 sec.)
Sending or receiving an
SMS message.
LED2 (red/green)
Status
Description
Off
The CIM 250 has been switched off.
Flashing red
No communication between the CIM 250

and the Grundfos product.
Constantly red

connected version of the Grundfos product.
Constantly green
The connection between the CIM 250 and

the Grundfos product is OK.
13
7.2 Setting the Industrial Ethernet protocol
Warning
The CIM 500 must only be connected to SELV or
SELV-E circuits.
The CIM 500 Ethernet module has a rotary switch for selection of
the Industrial Ethernet protocol. See fig. 16.
7.1 Connecting the Ethernet cable

TM05 7431 1013
RJ45 plugs and Ethernet cable must be used. The cable shield
must be connected to protective earth at both ends.
It is important to connect cable shield to earth
through earth clamp or to connect cable shield to
earth in the connector.
Note
The CIM 500 is designed for flexible network installation; the

built-in two port switch makes it possible to daisy chain from
product to product without the need of additional Ethernet
switches. The last product in the chain is only connected to one of
the Ethernet ports. Each Ethernet port has its own MAC address.
CIM
500
CIM
500
TM05 6435 4711
Ethernet
switch
CIM
500
CIM
500
Fig. 14 Example of Industrial Ethernet network
Fig. 16 Selecting the Industrial Ethernet protocol

Pos.
Description
PROFINET IO (Default from factory)
Modbus TCP
2..E
Reserved, LED1 will be permanently red to indicate an

invalid configuration
Reset to factory default

Note: The rotary switch has to be set in this position for
20 seconds to Reset to factory default. During this
period LED1 will be flashing red and green at the same
time to indicate reset will occur.
Note
Every change of the rotary switch setting, when

the module is powered on, will cause the module
to restart.
7.3 Setting up the IP-addresses

The CIM 500 Ethernet module is default set up to a fixed IP
address. It is possible to change the IP address settings from the
built in web server.
2
3
TM05 7431 1013
English (GB)
7. Modbus TCP, CIM 500 setup
Fig. 15 Example of Ethernet connection

Pos.
14
Description
Designation
Industrial Ethernet RJ45 Connector 1
ETH1
Industrial Ethernet RJ45 Connector 2
ETH2
Rotary switch for protocol selection
SW1
Data activity LED for Connector 1
DATA1
Link LED for Connector 1
LINK1
Data activity LED for Connector 2
DATA2
Link LED for Connector 2
LINK2
Green/red status LED for Ethernet

communication
LED 1
Green/red status LED for internal

communication between module and
pump.
LED 2
Default IP settings
used by web server
IP address:192.168.1.100
Subnet mask: 255.255.255.0
Gateway: 192.168.1.1
IP-settings for
Modbus TCP
Must be setup by the Web server
7.5 Status LEDs
The CIM 500 module can be configured using the built-in Web
server. To establish a connection from a PC to CIM 500 the
following steps are required:
The CIM 500 Ethernet module has two Status LEDs, (LED1 and
LED2).
Connect the PC and the CIM 500 module using an Ethernet

cable
Red/green status LED (LED1) for Ethernet communication
Configure the PC Ethernet port to the same subnetwork as the

CIM 500, e.g. 192.168.1.101, and the subnet mask to
255.255.255.0. See section A.1 How to configure an IP
address on your PC on page 86.

LED1
See fig. 15.
Open a standard Internet browser and type 192.168.1.100 in

the URL field.
Log in to the Web server using:

User
Password
Grundfos (factory default)

User and password may have been changed from
their factory default values.
TM05 6436 4712
Note
admin (factory default)
Fig. 17 CIM 500 connected to PC via Ethernet cable

For further information how to use the Web server, see section
A.2 Web server configuration on page 86.
Status
Description
Off
No Modbus TCP communication or

switched off.
Flashing green
Modbus TCP communication active.
Permanently red
CIM 500 module configuration fault.

See section 16.3.1.
Permanently red and

green
Error in firmware download.

See section 16.3.1.
Flashing red and

green
Resetting to factory default.

After 20 seconds the CIM 500 will
restart.
LED2
Status
Description
Off
The CIM 500 is switched off.
Flashing red
No internal communication between the

Note
Both ETH1 and ETH2 can be used to establish a

connection to the Web server.
Permanently red

Note
The web server can be accessed while the

selected Industrial Ethernet protocol is active.
Permanently green
Internal communication between the

CIM 500 and the Grundfos product is
OK.
Permanently red and

green
Memory fault.
Note
During start-up, there is a delay of up to

5 seconds before LED1 and LED2 status is
updated.
7.6 DATA and LINK LEDs

The CIM 500 Ethernet module has two connectivity LEDs related
to each RJ45 Connector. See fig. 15.
DATA1 and DATA2
These yellow LEDs indicate data traffic activity.
Status
Description
Yellow off
No data communication on RJ45 Connector.
Yellow
flashing
Data communication ongoing on RJ45 Connector.
Steady
yellow
Heavy network traffic on RJ45 Connector.
LINK1 and LINK2

These green LEDs shows whether the ethernet cable is properly
connected.
Status
Description
Green off
No Ethernet Link on RJ45 Connector
Green on
Ethernet Link on RJ45 Connector is OK
15
English (GB)
7.4 Establish connection to the Web server
English (GB)
8. Modbus function code overview

The supported function codes are shown in the table below:
Type
Code
16-bit data (registers)
Diagnostics
Note
Hex
Name
03
0x03
Read holding registers
04
0x04
Read input registers
06
0x06
Write single register
16
0x10
Write multiple registers
08
08
Diagnostics
See section 12.6 Diagnostics (0x08) for subcodes.
Reading or writing coils are not supported.
The same data are available in both holding registers and input
registers, meaning that either function (0x03 or 0x04) can be
used for reading data.
16
English (GB)
9. Modbus register overview

9.1 Register block overview
The Modbus RTU registers are grouped in the following register
blocks:
Start address
Register block
Permissions
Description
00001
CIM configuration
R/W
Configuration of the CIM module.
00021
CIM status
Status registers for the CIM module.
00101
Pit control and configuration
R/W
Registers for control and configuration of wastewater pit.
00201
Pit status
Registers for status from wastewater pit.
00301
Pit data
Registers for measured values from wastewater pit.
00401
Pump 1
Registers containing pump 1 data and status.
00451
Pump 2
00501
Pump 3
00551
Pump 4
00601
Pump 5
00651
Pump 6
00701
Alarm simulation
R/W
Registers for simulation of alarms and warnings.
00751
User
R/W
Registers where the user can freely store data.
00801
Name string
For reading the name string from the CU 361.
02001
Hour log
Registers containing 72-hour logs.
06001
Event log
Registers containing the latest 50 event log entries.
07001
Data log index
Index for the configurable data log series.
07301
Data log series
Configurable data log series.
All addresses contain registers. Some are bit-interpreted while

others are 16-bit values, or high/low order parts of 32-bit values.
A data value of 65535 (0xFFFF) indicates "not available" when
reading registers. The value of 65535 (0xFFFF) does not imply a
"disable" when writing values.
Each register block will be specified in more detail in the following
sections.
17
9.2 CIM configuration register block
English (GB)
Registers in this block can be read by means of function codes

0x03 and/or 0x04. They can be written as holding registers with
function codes 0x06 and 0x10.
CIM CIM CIM
200 250 500
Address Register name
Description
00001
SlaveMinimumReplyDelay
The minimum reply delay from the slave in ms.

Value range: 0-10000, i.e. up to 10 seconds reply delay. This delay is
typically used in conjunction with a radio modem. The delay value is
stored in the device and will remain after a power-off. The delay set here
will be added to the internal delay in the device.
Default value is 0.
00002
RegisterOffset
Not used.
00003
This register holds the active Modbus address. The default value is
0xE7 (231), and there is normally no need to change this value.
SoftwareDefinedModbusAddress Note: For CIM 200 this value is used only when the transmission speed
is set to "Software-defined" on the DIP switches SW4 and SW5.
Otherwise, it will be ignored by the slave.
00004
SoftwareDefinedBitRate
Modbus software-defined transmission speed enumeration.

The software-defined transmission speed value is stored in the device
and will remain after a power-off.
0: 1200 bits/s
1: 2400 bits/s
2: 4800 bits/s
3: 9600 bits/s
4: 19200 bits/s
5: 38400 bits/s.
Note: This value is used only when the transmission speed is set to
"Software-defined" on the DIP switches SW4 and SW5. Otherwise, it will
be ignored by the slave.
AutoAckControlBits
Used to select the behaviour of control bit acknowledgements from the

CIM.
0: Disabled.
Control bits are not automatically lowered when accepted by the device.
The user must lower the triggered control bit manually before the control
bit can be triggered again.
1: Enabled.
Control bits are automatically lowered when accepted by the device.
The user does not have to lower it manually [default].
00006
ReadWriteSeparation
Used to select value read-back behaviour.

The value in this register is stored in the device and will remain after a
power-off.
0: Register values can be written by both the Modbus master and the
CIM 250 (default).
1: Read-backs are put into separate registers by the CIM 250, hence
separating inputs from outputs. See section Fig. 25 Interlocking from
another controller.
00007
ScadaCallBackRegister
Used to select the register in the SCADA system that will be written
when a call-back request is sent via GPRS. See fig. 25.
00008
NoDataActivityTimeout
The elapsed time with no data activity before the module issues a
"GPRS restart".
SoftwareDefinedParity
Parity setting to be used when using "software-defined" settings.

0: No parity [default]
1: Even parity
2: Odd parity.
Note: For CIM 200 this value is used only when the transmission speed
is set to "Software-defined" on the DIP switches SW4 and SW5.
Otherwise, it will be ignored by the slave.
SoftwareDefinedStopBit
Stop bit setting to be used when using "software-defined" settings.

0: No stop bit
1: 1 stop bit [default]
2: 2 stop bits.
Note: For CIM 200 this value is used only when the transmission speed
is set to "Software-defined" on the DIP switches SW4 and SW5 by
selecting a value outside the range [0; 247]. Otherwise, it will be ignored
by the slave.
00005
00009
00010
18
Description
00011
PIN code for SCADA systems, etc.

If GeneralStatus.ScadaPinCodeEnabled (register 00029, bit 0) is
enabled, the correct PIN code must be entered in this register in order to
gain access to remote control and configuration.
Verify acceptance in GeneralStatus.WriteAccess (register 00029, bit 1).
Programming of the SCADA PIN code made via the SMS command
SETSCADACODE. See "CIM 250 SMS commands" (supplement to
installation and operating instructions) on the CD-ROM supplied with the
GSM module.
ScadaPinCode
CIM CIM CIM

200 250 500
9.3 CIM status register block

0x03 and/or 0x04. They are read-only. This block can be used for
various kinds of fault finding.
Address
Register name
00021
GENIbusCRCErrorCnt
Holds a CRC error counter for the GENIbus connection between CIM and CU 36X.
00022
GENIbusDataErrorCnt
Holds a CRC error counter for the GENIbus connection between CIM and CU 36X.
00023
VersionNumber
A Grundfos-specific version number. This is an unsigned integer value.
00024
ActualModbusAddress
Holds the current Modbus slave address of the device.

Valid value range: 1247.Note: not used for CIM 500.
00025
00026
GENIbusTXcountHI
GENIbusTXcountLO
Holds a transmit counter for total number of telegrams sent to the CU 36X on the
GENIbus connection.
00027
00028
GENIbusRXcountHI
GENIbusRXcountLO
Holds a receive counter for total number of telegrams received from the CU 36X on the
GENIbus connection.
GeneralStatus
Bit 0: ScadaPinCodeEnabled
PIN code functionality.

0: No PIN code required
1: PIN code required to perform remote control and configuration.
Activation of SCADA PIN code protection takes place via the SMS command
SCADACODE. See "CIM 250 SMS commands" (supplement to installation and
operating instructions) on the CD-ROM supplied with the GSM module.
GeneralStatus
Bit 1: WriteAccess
Remote write access.

0: No write access (the PIN code is incorrect).
1: Full write access (the PIN code is either correct or not enabled).
00029
Description
00030
UnitFamily
Grundfos product family.
00031
UnitType
Grundfos product type.
00032
UnitVersion
Grundfos product version.
19
English (GB)
Address Register name
9.4 Pit control and configuration register block
English (GB)

0x03 and/or 0x04. They can be written as holding registers with
function codes 0x06 and 0x10.
Address
Register name
Scale
Description
PitControl
Bit 0: ResetAlarm
bool
Control bit that resets alarms and warnings from the CU 36X.
0 = No resetting
1 = Resetting alarm.
This control bit is triggered on rising edge only, i.e. setting logical 0 to 1.
See section 9.2 CIM configuration register block, address 00005, for
acknowledgement behaviour.
PitControl
Bit 1: RESERVED
bool
Control bit that resets the SCADA event log in the CU 36X.
0 = No resetting
1 = Resetting event log.
bool
Control bit that interlocks the pit (stops all pumps) for a specified time
interval (see the InterlockTimeout register 00226), meaning that the pit
will automatically go back to "Auto" mode after timeout.
0 = No command
1 = Pit interlocked (status is read from OperatingMode register 00203).
bool
Control bit that sets the pit to "Auto" mode.

0 = No command
1 = Pit in "Auto" mode (status is read from OperatingMode register
00203).
PitControl
Bit 5: CallBackAck
bool
Control bit that acknowledges a call-back from the CU 36X.

0: No command
1: Acknowledging the call-back.
PitControl
Bit 6: ResetUserDefCounter1
bool
Reset the user-defined counter 1

0: No resetting
1: Reset counter
PitControl
bool

0: No resetting
1: Reset counter
PitControl
bool

0: No resetting
1: Reset counter
PitControl
Bit 9: CallBackTest
bool
Activates the call-back test function

0: No command
1: Activates call-back test
RelayControl
Bit 0: SetCustomRelay
bool
Control bit that sets the value of the custom relay.

0 = Relay state logical 0
1 = Relay state logical 1.
CustomRelayPulse
Bit 1: PulseRelay
bool
Control bit that pulses the custom relay. 0 (no pulse) will be the resulting
state.
0 = No pulse
1 = Pulse.
enum
Remote manual control of pump 1.

0 = "Auto" mode (the pump is controlled by the CU 36X)
1 = Forced start
2 = Forced stop.
enum

1 = Forced start
2 = Forced stop.
PitControl
Bit 2: ResetEventLog
PitControl
Bit 3: InterlockPit
00101
PitControl
Bit 4: AutoPit
00102
00103
00104
20
PitPump1Control
PitPump2Control
00105
00106
Register name
PitPump3Control
PitPump4Control
Scale
Description
enum

1 = Forced start
2 = Forced stop.
enum

1 = Forced start
2 = Forced stop.
00107
PitPump5Control
enum

1 = Forced start
2 = Forced stop.
00108
PitPump6Control
enum

1 = Forced start
2 = Forced stop.
English (GB)
Address
00109
ScadaPinCode
unscaled
PIN code for SCADA systems, etc.

If PitStatus.ScadaPinCodeEnabled (register 00202, bit 4) is enabled, the
correct PIN code must be set in this register in order to gain access to
remote control and configuration.
Verify acceptance in PitStatus.WriteAccess (register 00202, bit 5).
00110
SetEventLogClearID
unscaled
Selects which records to clear in the event log.
00111
SetInterlockTimeout
1 min.
Interlock timeout value measured in minutes.

Status of this register is read in InterlockTimeout (register 00226).
00112
SetRealTimeClockHI
1 second
Setting the real-time clock in the CU 36X in seconds since midnight

January 1st 1970 (UNIX time).
First set SetRealTimeClockHI, then SetRealTimeClockLO in order to set
a new time in UNIX format.
1 second
Real-time clock: Second of the minute [0; 59].
00113
SetRealTimeClockLO
00114
SetRtcSecond
00115
SetRtcMinute
1 min.
Real-time clock: Minute of the hour [0; 59].
00116
SetRtcHour
1 hour
Real-time clock: Hour of the day [0; 23].
00117
SetRtcDay
1 day
Real-time clock: Day of the month [1; 31].
00118
SetRtcMonth
1 month
Real-time clock: Month of the year [1; 12].
00119
SetRtcYear
1 year
Real-time clock: Year [0; 254] = [year 2000; year 2254].
00120
SetRtc
Bit0: SetRtc
bool
Control bit that sets the new real-time clock in the CU 36X.
1 = Set new real-time clock from the registers 00114 to 00119.
00121
SetOverflowLevel
0.01 m
Setting a new level for activation of overflow level alarm.

If ReadWriteSeparation (register 00006, bit 0) is set to "0", the CIM will
overwrite this register value with the resulting level.
00122
SetHighLevel
0.01 m
Setting a new level for activation of high-level alarm.

00123
SetAlarmLevel
0.01 m
Setting a new level for activation of alarm level alarm.

00124
SetDryRunningLevel
0.01 m
Setting a new level for activation of dry-running alarm.

00125
SetFoamDrainingLevel
0.01 m
Setting a new level for foam-draining stop.

00126
SetStartLevelPump1
0.01 m
Setting a new start level, pump 1.

00127
SetStopLevelPump1
0.01 m
Setting a new stop level, pump 1.

00128
SetStartLevelPump2
0.01 m

00129
SetStopLevelPump2
0.01 m

21
English (GB)
Address
Register name
Scale
Description
00130
SetStartLevelPump3
0.01 m

00131
SetStopLevelPump3
0.01 m

If ReadWriteSeparation (register 00006, bit 0) is set to "0", the CIM
will overwrite this register value with the resulting level.
00132
SetStartLevelPump4
0.01 m

00133
SetStopLevelPump4
0.01 m

00134
SetStartLevelPump5
0.01 m

00135
SetStopLevelPump5
0.01 m

00136
SetStartLevelPump6
0.01 m

00137
SetStopLevelPump6
0.01 m

00138
SetCurrentMaxAlarmGrp1
0.01 A
Set current max. alarm for group 1
00139
SetCurrentMinAlarmGrp1
0.01 A
Set current min. alarm for group 1
00140
SetCurrentMaxWarnGrp1
0.01 A
Set current max. warning for group 1
00141
SetCurrentMinWantGrp1
0.01 A
Set current min. warning for group 1
00142
SetCurrentMaxAlarmGrp2
0.01 A
Set current max. alarm for group 2
00143
SetCurrentMinAlarmGrp2
0.01 A
Set current min. alarm for group 2
00144
SetCurrentMaxWarnGrp2
0.01 A
Set current max. warning for group 2
00145
SetCurrentMinWantGrp2
0.01 A
Set current min. warning for group 2
22

0x03 and/or 0x04. It is not possible to write to these registers.
Address
Register name
Scale
Description
bool
Indicates if a ResetAlarm control bit was acknowledged by the

device.
This bit is only active if AutoAckControlBits (register 00005,
bit 0) is set to "0".
0 = Not acknowledged
1 = Acknowledged.
bool
Indicates if a SetRtc (real-time clock) control bit was

acknowledged by the device. This bit is only active if
AutoAckControlBits (register 00005, bit 0) is set to "0".
1 = Acknowledged.
bool
Indicates if a ResetEventLog control bit was acknowledged by

the device.
1 = Acknowledged.
bool
Indicates if an InterlockPit control bit was acknowledged by the

device.
1 = Acknowledged.
bool
Indicates if an AutoPit control bit was acknowledged by the

device.
1 = Acknowledged.
AcknowledgeRegister
Bit 5: AckCallBack
bool
Indicates if a CallBack control bit was acknowledged by the

device.
0: Not acknowledged
1: Acknowledged.
PitStatus
Bit 0: RESERVED
PitStatus
Bit 1: AlarmActive
bool
Alarm condition.
0 = No active alarms
1 = One or more active alarms.
PitStatus
Bit 2: WarningActive
bool
Warning condition.
0 = No active warnings
1 = One or more active warnings.
PitStatus
Bit 3: ManualControl
bool
Manual control condition.

0 = No manual control
1 = Manual control.
bool
PIN code functionality.

0 = No PIN code required
1 = PIN code required to perform remote control and
configuration.
bool
Remote write access.

0 = No write access (PIN code is incorrect)
1 = Full write access (PIN code is either correct or not
enabled).
AcknowledgeRegister
Bit 0: AckResetAlarm
AcknowledgeRegister
Bit 1: AckSetRtc
AcknowledgeRegister
Bit 2: AckResetEventLog
00201
AcknowledgeRegister
Bit 3: AckInterlockPit
AcknowledgeRegister
Bit 4: AckAutoPit
00202
PitStatus
Bit 4: ScadaPinCodeEnabled
PitStatus
Bit 5: WriteAccess
23
English (GB)
9.5 Pit status register block
English (GB)
Address
00203
00204
00205
24
Register name
Scale
Description
OperatingMode
enum
Register for reading the actual operating mode of the pit.

0 = Standby (stopped from level control)
1 = Start-up delay
2 = Pumping
3 = Stop delay
4 = Pumping max.
5 = Stopped
6 = Foam-draining
7 = Daily emptying
8 = Pump anti-seizing
9 = Manual control (all enabled pumps in manual control mode)
10 = Interlock control (the pit is interlocked)
11 = Mains supply fault
12 = Level sensor fault
13 = All enabled pumps in alarm
14 = All pumps out of operation
15 = CU 36X controller in service mode
PitPumpsPresence
Bit 0: Pump1Presence
bool
Presence of pump 1.
0 = Not present
1 = Present.
PitPumpsPresence
bool
Presence of pump 2.
0 = Not present
1 = Present.
PitPumpsPresence
bool
Presence of pump 3.
0 = Not present
1 = Present.
PitPumpsPresence
bool
Presence of pump 4.
0 = Not present
1 = Present.
PitPumpsPresence
bool
Presence of pump 5.
0 = Not present
1 = Present.
PitPumpsPresence
bool
Presence of pump 6.
0 = Not present
1 = Present.
PitPumpsPresence
Bit 6: Mixer
bool
Presence of mixer
0 = Not present
1 = Present.
PitPumpsDisabled
Bit 0: Pump1Disabled
bool
Enabled/disabled state of pump 1.

0 = Enabled
1 = Disabled.
PitPumpsDisabled
bool

0 = Enabled
1 = Disabled.
PitPumpsDisabled
bool

0 = Enabled
1 = Disabled.
PitPumpsDisabled
bool

0 = Enabled
1 = Disabled.
PitPumpsDisabled
bool

0 = Enabled
1 = Disabled.
PitPumpsDisabled
bool

0 = Enabled
1 = Disabled.
PitPumpsDisabled
Bit 6: MixerDisabled
bool
Enabled/disabled state of mixer.

0 = Enabled
1 = Disabled.
00206
00207
00208
Register name
Scale
Description
PitPumpsRunning
Bit 0: Pump1Running
bool
Running state of pump 1.

0 = Not running
1 = Running.
PitPumpsRunning
Bit 1: Pump2Running
bool

0 = Not running
1 = Running.
PitPumpsRunning
Bit 2: Pump3Running
bool

0 = Not running
1 = Running.
PitPumpsRunning
Bit 3: Pump4Running
bool

0 = Not running
1 = Running.
PitPumpsRunning
Bit 4: Pump5Running
bool

0 = Not running
1 = Running.
PitPumpsRunning
Bit 5: Pump6Running
bool

0 = Not running
1 = Running.
PitPumpsRunning
Bit 6: MixerRunning
bool
Running state of mixer.

0 = Not running
1 = Running.
PitPumpsMonitoringFault
Bit 0: Pump1MonitoringFault
bool
Fault state of pump 1 monitoring devices, e.g. IO 111.

0 = No fault
1 = Fault in auxiliary equipment or sensors.
bool

0 = No fault
bool

0 = No fault
bool

0 = No fault
bool

0 = No fault
bool

0 = No fault
Bit 6: MixerMonitoringFault
bool
Monitoring fault on mixer

0 = No fault
PitPumpsWarning
Bit 0: Pump1Warning
bool
Warning state of pump 1.

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 1: Pump2Warning
bool

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 2: Pump3Warning
bool

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 3: Pump4Warning
bool

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 4: Pump5Warning
bool

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 5: Pump6Warning
bool

0 = No warning
1 = Warning.
PitPumpsWarning
Bit 6: MixerWarning
bool
Warning state of mixer.

0 = No warning
1 = Warning.
English (GB)
Address
25
English (GB)
Address
Register name
Scale
Description
PitPumpsAlarm
Bit 0: Pump1Alarm
bool
Alarm state of pump 1.

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 1: Pump2Alarm
bool

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 2: Pump3Alarm
bool

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 3: Pump4Alarm
bool

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 4: Pump5Alarm
bool

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 5: Pump6Alarm
bool

0 = No alarm
1 = Alarm.
PitPumpsAlarm
Bit 6: MixerAlarm
bool
Alarm state of mixer.

0 = No alarm
1 = Alarm.
00210
PitAlarms1
bits
Pit alarm events, item 1.

Bit-interpreted. See section Fig. 25 Interlocking from another
controller.
00211
PitAlarms2
bits
Pit alarm events, item 2.

Bit-interpreted. See section Fig. 25 Interlocking from another
controller.
PitAlarms3
Bit 0: DischargePressureSignalFault
bool
Discharge pressure sensor signal fault

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 1: WaterOnFloor
bool
Water on floor alarm

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 2: GasDetected
bool
Gas detected alarm

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 3: UserEvent1
bool
User event 1 alarm

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 4: UserEvent2
bool
User event 2 alarm

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 5: UserEvent3
bool
User event 3 alarm

0 = No Alarm
1 = Alarm present
PitAlarms3
Bit 6: UserEvent4
bool
User event 4 alarm

0 = No Alarm
1 = Alarm present
00213
PitWarnings1
bits
Pit warning events, item 1.

Bit-interpreted. See fig. 25.
00214
PitWarnings2
bits
Pit warning events, item 2.

Bit-interpreted. See fig. 25.
00209
00212
26
Register name
Scale
Description
PitWarnings3
Bit 0: DischargePressureSignalFault
bool

0 = No warning
1 = Warning present
PitWarnings3
Bit 1: WaterOnFloor
bool
Water on floor warning

0 = No warning
1 = Warning present
PitWarnings3
Bit 2: GasDetected
bool
Gas detected warning

0 = No warning
1 = Warning present
PitWarnings3
Bit 3: UserEvent1
bool
User event 1 warning

0 = No warning
1 = Warning present
PitWarnings3
Bit 4: UserEvent2
bool

0 = No warning
1 = Warning present
PitWarnings3
Bit 5: UserEvent3
bool

0 = No warning
1 = Warning present
PitWarnings3
Bit 6: UserEvent4
bool

0 = No warning
1 = Warning present
00216
EventLogLatestID
unscaled
ID code of the latest event log.
00217
NumberOfFloatSwitches
enum
Number of installed float switches in the pit (0-5).
FloatSwitchesStatus
Bit 0: FloatSwitch1Status
bool
On/off state of float switch 1 (if installed).

0 = Off
1 = On.
FloatSwitchesStatus
bool

0 = Off
1 = On.
FloatSwitchesStatus
bool

0 = Off
1 = On.
FloatSwitchesStatus
bool

0 = Off
1 = On.
FloatSwitchesStatus
bool

0 = Off
1 = On.
FloatSwitchesStatus
Bit 5: ExtraOverflowSwitch
bool
On/off state of extra overflow float switch (if installed).

0 = Off
1 = On.
enum
Function of the float switch.

0 = Not used
1 = Dry running
2=3 = Stop of all pumps
4 = Stop
5 = Stop of first pump
6 = Stop of second pump
11 = Start/stop
12 = Start of first pump/stop
13 = Start
14 = Start of first pump
15 = Start of second pump
20 = Start of all pumps
21 = Alarm level
23 = High level.
00215
00218
00219
FloatSwitch1Function
English (GB)
Address
27
English (GB)
Address
00220
00221
00222
00223
28
Register name
Scale
Description
enum

0 = Not used
1 = Dry running
4 = Stop
11 = Start/stop
13 = Start
21 = Alarm level
23 = High level.
enum

0 = Not used
1 = Dry running
4 = Stop
11 = Start/stop
13 = Start
21 = Alarm level
23 = High level.
enum

0 = Not used
1 = Dry running
4 = Stop
11 = Start/stop
13 = Start
21 = Alarm level
23 = High level.
enum

0 = Not used
1 = Dry running
4 = Stop
11 = Start/stop
13 = Start
21 = Alarm level
23 = High level.
Register name
Scale
Description
PitSensors
Bits 0: UltrasonicLevelControlSensor
bool
Presence of ultrasonic level control sensor.

0 = Not present
1 = Present.
PitSensors
Bits 1: PressureSensor
bool
Presence of pressure sensor.

0 = Not present
1 = Present.
PitSensors
Bits 2: FloatSwitches
bool
Presence of float switches.

0 = Not present
1 = Present.
PitSensors
Bit 3: FlowSensor
bool
Presence of flow sensor.

0 = Not present
1 = Present.
PitSensors
Bit 4: Power/EnergySensor
bool
Presence of power or energy sensor.

0 = Not present
1 = Present.
PitSensors
Bit 5: UserDefinedSensor1
bool
Presence of user-defined sensor, analog input 1.

0 = Not present
1 = Present.
PitSensors
bool

0 = Not present
1 = Present.
PitSensors
bool

0 = Not present
1 = Present.
00225
DayCounterZeroTime
enum
Zero time for today and yesterday counters.

Range: 0-23 hours.
00226
InterlockTimeout
1 sec.
Actual interlock timeout value in minutes.

A new value can be set in the SetInterlockTimeout
(register 00111).
00227
InterlockRemainTime
1 sec.
Remaining interlock time.
00228
RealTimeClockHI
1s
The real-time clock in the CU 361 in seconds since midnight

January 1st 1970 (UNIX time). See section 11.11 Real-time
clock.
00224
English (GB)
Address
00229
RealTimeClockLO
00230
RtcSecond
1 second
Second of the minute [0; 59]. See section 11.11 Real-time

clock.
00231
RtcMinute
1 min.
Minute of the hour [0; 59]. See section 11.11 Real-time clock.
00232
RtcHour
1 hour
Hour of the day [0; 23]. See section 11.11 Real-time clock.
00233
RtcDay
1 day
Day of the month [1; 31]. See section 11.11 Real-time clock.
00234
RtcMonth
1 month
Month of the year [1; 12]. See section 11.11 Real-time clock.
00235
RtcYear
1 year
Year [0; 254] = [year 2000; year 2254]. See section

11.11 Real-time clock.
1%
Actual value of GSM signal level.

254 = Signal level not detectable.
255 = GSM network not available.
Note: Only for CIM 250.
00236
GSMSignalLevelActual
00237
GSMSignalLevelAverage
1%
Average value of GSM signal level.

254 = Signal level not detectable.
255 = GSM network not available.
00238
IPAddressHI
unscaled
High-order part of IP address (GPRS only).

00239
IPAddressLO
unscaled
Low-order part of IP address (GPRS only).

00240
OverflowLevel
0.01 m
Level for activation of overflow level alarm.
00241
HighLevel
0.01 m
Level for activation of high-level alarm.
00242
AlarmLevel
0.01 m
Level for activation of alarm level alarm.
00243
DryRunningLevel
0.01 m
Level for activation of dry-running level alarm.
00244
FoamDrainingLevel
0.01 m
Level for foam-draining stop.
00245
StartLevelPump1
0.01 m
Start level for pump 1.
00246
StopLevelPump1
0.01 m
Stop level for pump 1.
00247
StartLevelPump2
0.01 m
00248
StopLevelPump2
0.01 m
00249
StartLevelPump3
0.01 m
00250
StopLevelPump3
0.01 m
00251
StartLevelPump4
0.01 m
29
English (GB)
Address
Register name
Scale
Description
00252
StopLevelPump4
0.01 m
00253
StartLevelPump5
0.01 m
00254
StopLevelPump5
0.01 m
00255
StartLevelPump6
0.01 m
00256
StopLevelPump6
0.01 m
00257
FirstGroup2Pump
enum
First pump in group 2.

0=1=2 = Pump 2
3 = Pump 3
4 = Pump 4
5 = Pump 5
6 = Pump 6.
00258
BatteryVoltage
0.1 V
Voltage level on battery.
IOLogic
Bit 0: Output1
bool
Status of logic output 1.

0 = Off
1 = On.
IOLogic
Bit 1: Output2
bool

0 = Off
1 = On.
IOLogic
Bit 2: Output3
bool

0 = Off
1 = On.
IOLogic
Bit 3: Output4
bool

0 = Off
1 = On.
IOLogic
Bit 4: Output5
bool

0 = Off
1 = On.
IOLogic
Bit 5: Output6
bool

0 = Off
1 = On.
IOLogic
Bit 6: Output7
bool

0 = Off
1 = On.
IOLogic
Bit 7: Output8
bool

0 = Off
1 = On.
RandomStartLevelBand
0.01 m
Random start level band (first pump only).
00259
00260
30
English (GB)
9.6 Pit data register block

0x03 and/or 0x04. It is not possible to write to these registers.
The table below shows for which CU 36X type the registers are
supported.
0xFFFF indicates that the data value is not available.
Address
Register name
Scale
Description
00301
PitWaterLevel
0.01 m
Sensor-measured water level in the pit. Requires a level sensor.
00302
PitSwitchWaterLevel
enum
Float-switch-detected water level in the pit. Requires one or more float

switches.
Valid range: 0-5 (0x0000 - 0x0005).
00303
PitDepth
0.01 m
Depth of the pit.
00304
PitFlowIn
0.1 litre/s
Actual flow into the pit. Requires a flow sensor or flow calculation from
level sensor.
00305
PitAverageFlowIn
0.1 litre/s
Average flow into the pit. Requires a flow sensor or flow calculation from
level sensor.
00306
PitFlowOut
0.1 litre/s
Actual flow out of the pit. Requires a flow sensor or flow calculation from
level sensor.
00307
PitAverageFlowOut
0.1 litre/s
Average flow out of the pit. Requires a flow sensor or flow calculation
from level sensor.
00308
PitPowerHI
00309
PitPowerLO
1W
Power consumption of the pit. Requires a power sensor or MP 204.
0.1 kWh
Energy consumption of the pit. Requires a power sensor or MP 204.
00310
PitEnergyHI
00311
PitEnergyLO
00312
PitEnergyYesterday
0.1 kWh
Energy consumption of the pit yesterday. Requires a power sensor or

MP 204.
00313
PitEnergyToday
0.1 kWh
Energy consumption of the pit today. Requires a power sensor or

MP 204.
00314
PitSpecificEnergy
1 Wh/m3
Specific energy consumption of the pit. Requires a power sensor or

MP 204 and a flow sensor.
00315
PitPumpedVolumeHI
00316
PitPumpedVolumeLO
0.1 m3
Total pumped volume. Requires a flow sensor or flow calculation from

level sensor.
00317
PitPumpedVolumeYesterday
0.1 m3
Total pumped volume yesterday. Requires a flow sensor or flow

calculation from level sensor.
00318
PitPumpedVolumeToday
0.1 m3
Total pumped volume today. Requires a flow sensor or flow calculation

from level sensor.
00319
PitMixerStartsPerHour
unscaled
Number of mixer starts per hour. Requires the presence of a mixer.
00320
PitOverflowVolume
0.1 m3
Pit overflow volume. Requires a level sensor.
00321
PitOverflowVolumeYesterday
0.1 m3
Pit overflow volume yesterday. Requires a level sensor.
Pit overflow volume today. Requires a level sensor.
00322
PitOverflowVolumeToday
0.1 m
00323
PitOverflowTime
1 min.
00324
PitOverflowTimeYesterday
1 min.
Pit overflow time yesterday. Requires a level sensor or float switches.
00325
PitOverflowTimeToday
1 min.
Pit overflow time today. Requires a level sensor or float switches.
00326
PitOverflowCounter
unscaled
Number of pit overflows. Requires a level sensor or float switches.
00327
PitOverflowCounterYesterday
unscaled
Number of pit overflows yesterday. Requires a level sensor or float

switches.
00328
PitOverflowCounterToday
unscaled
Number of pit overflows today. Requires a level sensor or float switches.
00329
PitOperatingTimeHI
00330
PitOperatingTimeLO
1 min.
Total pit operating time (power-on time).
00331
Pit2PumpsOprTimeHI
00332
Pit2PumpsOprTimeLO
1 min.
Total operating time (two pumps operating simultaneously).
00333
Pit2PumpsOprTimeYesterday
1 min.
Operating time yesterday (two pumps operating simultaneously).
00334
Pit2PumpsOprTimeToday
1 min.
Operating time today (two pumps operating simultaneously).
00335
Pit3PumpsOprTimeHI
00336
Pit3PumpsOprTimeLO
1 min.
Total operating time (three pumps operating simultaneously).
00337
1 min.
Operating time yesterday (three pumps operating simultaneously).
00338
1 min.
Operating time today (three pumps operating simultaneously).
00339
Pit4PumpsOprTimeHI
00340
Pit4PumpsOprTimeLO
1 min.
Total operating time (four pumps operating simultaneously).
00341
1 min.
Operating time yesterday (four pumps operating simultaneously).
00342
1 min.
Operating time today (four pumps operating simultaneously).
Pit overflow time. Requires a level sensor or float switches.
31
English (GB)
Address
Register name
00343
Pit5PumpsOprTimeHI
Scale
Description
00344
Pit5PumpsOprTimeLO
1 min.
Total operating time (five pumps operating simultaneously).
00345
1 min.
Operating time yesterday (five pumps operating simultaneously).
00346
1 min.
Operating time today (five pumps operating simultaneously).
00347
Pit6PumpsOprTimeHI
00348
Pit6PumpsOprTimeLO
1 min.
Total operating time (six pumps operating simultaneously).
00349
1 min.
Operating time yesterday (six pumps operating simultaneously).
00350
1 min.
Operating time today (six pumps operating simultaneously).
00351
UserAnalogInput 1
0.1 %
User-defined measurement, analog input 1.
00352
UserAnalogInput 2
0.1 %
00353
UserAnalogInput 3
0.1 %
00354
Pit0PumpsOprTimeHI
00355
Pit0PumpsOprTimeLO
1 min.
Total operating time (no pumps operating).
00356
1 min.
Operating time yesterday (no pumps operating).
00357
1 min.
Operating time today (no pumps operating).
00358
Pit1PumpsOprTimeHI
00359
Pit1PumpsOprTimeLO
1 min.
Total operating time (one pump operating).
00360
1 min.
Operating time yesterday (one pump operating).
00361
1 min.
Operating time today (one pump operating).
00362
MixerRuntime
1 min.
Runtime for mixer.
00363
MixerStartCounter
unscaled
Start counter for mixer.
00364
UserDefCounter1
unscaled
User-defined counter 1
00365
UserDefCounter2
unscaled
00366
UserDefCounter3
unscaled
00367
PitOutletPressure
0.001 bar
Outlet pressure of the pit
32
English (GB)
9.7 Pump 1 register block

All register values are read-only, and 0xFFFF indicates that the
data value is not available.
Address
Register name
Scale
Description
Pump1Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump1Status
Bit 1: Running
bool
Running state of pump.

0 = Not running
1 = Running.
Pump1Status
Bit 2: MonitoringFault
bool
Fault state of pump monitoring devices.

0 = No fault
Pump1Status
Bit 3: Warning
bool
Warning state of pump.

0 = No warning
1 = Warning.
Pump1Status
Bit 4: Alarm
bool
Alarm state of pump.

0 = No alarm
1 = Alarm.
Pump1Status
Bit 5: IO111Present
bool
Presence of auxiliary equipment IO 111.

0 = Not present
1 = Present.
Pump1Status
Bit 6: IO111Fault
bool
Fault state of auxiliary equipment IO 111.

0 = No fault
1 = Fault.
Pump1Status
Bit 7: MP204Present
bool
Presence of auxiliary equipment MP 204.

0 = Not present
1 = Present.
Pump1Status
Bit 8: MP204Fault
bool
Fault state of auxiliary equipment MP 204.

0 = No fault
1 = Fault.
Pump1Status
Bit 9: CUEPresent
bool
Presence of auxiliary equipment CUE.

0 = Not present
1 = Present.
Pump1Status
Bit 10: CUEFault
bool
Fault state of auxiliary equipment CUE.

0 = No fault
1 = Fault.
Pump1Status
Bit 11: PumpDisabled
bool
Enabled/disabled state of pump.

0 = Enabled
1 = Disabled (e.g. for temporary maintenance).
enum
Control source of pump.

0 = Auto
1 = Switch
2 = Display
3 = Remote-controlled by bus.
enum
Pump connection type.

0 = The pump is controlled
1 min.
Total operating time.
1 min.
Time to next service.

Operating time yesterday.
00401
00402
Pump1ControlSource
from
from
from
from
the
the
the
the
CU 36X output relay.

IO 351B output relay.
CU 36X and VFD.
IO 351B and VFD.
00403
Pump1ConnectionType
00404
Pump1OperatingTimeHI
00405
Pump1OperatingTimeLO
00406
Pump1TimeToServiceHI
00407
Pump1TimeToServiceLO
00408
Pump1OperatingTimeYesterday
1 min.
00409
Pump1OperatingTimeToday
1 min.
Operating time today.
00410
Pump1LatestOperatingTime
1s
Operating time last time it was operated.
00411
Pump1StartCounterHI
00412
Pump1StartCounterLO
unscaled
Total number of pump starts.
00413
Pump1StartCounterYesterday
unscaled
Total number of pump starts yesterday.
00414
Pump1StartCounterToday
unscaled
Total number of pump starts today.
00415
Pump1StartsPerHour
unscaled
Number of pump starts within the last hour.
00416
Pump1Flow
0.1 litre/s
Calculated average or measured pump flow.
00417
Pump1LatestFlow
0.1 litre/s
Latest calculated/measured flow (capacity).
00418
Pump1Current
0.1 A
Motor current.
00419
Pump1LatestCurrent
0.1 A
Latest motor current.
33
English (GB)
Address
Register name
Scale
Description
00420
Pump1Voltage
0.1 V
Voltage.
00421
Pump1Insulation
10 k
Motor insulation resistance.
00422
Pump1WaterInOil
0.1 %
Motor water-in-oil measurement.
00423
Pump1Alarms1
bits
See section Fig. 25 Interlocking from another controller.
00424
Pump1Alarms2
bits
00425
Pump1Alarms3
bits
00426
Pump1Warnings1
bits
00427
Pump1Warnings2
bits
00428
Pump1Warnings3
bits
00429
Pump1MotorTemperature1
1 C
Motor temperature 1.
00430
1 C
00431
Pump1PowerHI
00432
Pump1PowerLO
1W
Power consumption.
00433
Pump1EnergyHI
00434
Pump1EnergyLO
0.1 kWh
Energy consumption.
00435
Pump1CosPhi
0.01
Motor cos .
00436
Pump1Frequency
0.1 Hz
Motor-applied frequency.
00437
Pump1VFDmode
enum
Mode of variable-frequency drive.

0 = VFD not controlled
1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
8 = Specific-energy test.
00438
Pump1Torque
0.1 Nm
Motor torque.
00439
Pump1iAsym
0.1 %
Line current asymmetry.
Pump1Sensors.WIO
Bit 0: WaterInOilSensor
bool
Presence of water-in-oil (WIO) sensor.

0 = Not present
1 = Present.
Pump1Sensors.Current
Bit 1: MotorCurrentSensor
bool
Presence of current sensor.

0 = Not present
1 = Present.
Pump1Alarms4
bits
Pump1Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump1Alarms4
Bit 14:
bool
Power sensor signal fault alarm

0 = No alarm
1 = Alarm
Pump1Warnings4
bits
Pump1Warnings4
Bit 13:
bool
Pump blocked warning

0 = No warning
1 = Warning
Pump1Warnings4
Bit 14:
bool
Power sensor signal fault warning

0 = No warning
1 = Warning
Pump1AntiBlockingCounter
bits
Number of anti blockings in the pump
00440
00441
00442
00443
34
English (GB)

Address
Register name
Scale
Description
Pump2Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump2Status
Bit 1: Running
bool

0 = Not running
1 = Running.
Pump2Status
bool

0 = No fault
Pump2Status
Bit 3: Warning
bool

0 = No warning
1 = Warning.
Pump2Status
Bit 4: Alarm
bool

0 = No alarm
1 = Alarm.
Pump2Status
Bit 5: IO111Present
bool

0 = Not present
1 = Present.
Pump2Status
Bit 6: IO111Fault
bool

0 = No fault
1 = Fault.
Pump2Status
Bit 7: MP204Present
bool

0 = Not present
1 = Present.
Pump2Status
Bit 8: MP204Fault
bool

0 = No fault
1 = Fault.
Pump2Status
Bit 9: CUEPresent
bool

0 = Not present
1 = Present.
Pump2Status
Bit 10: CUEFault
bool

0 = No fault
1 = Fault.
Pump2Status
bool

0 = Enabled
enum

0 = Auto
1 = Switch
2 = Display
enum

1 min.
1 min.
00451
00452
Pump2ControlSource
from
from
from
from
the
the
the
the

CU 36X and VFD.
IO 351B and VFD.
00453
Pump2ConnectionType
00454
00455
00456
00457
00458
1 min.
00459
1 min.
00460
1s
00461
Pump2StartCounterHI
00462
Pump2StartCounterLO
unscaled
00463
unscaled
00464
unscaled
00465
Pump2StartsPerHour
unscaled
00466
Pump2Flow
0.1 litre/s
00467
Pump2LatestFlow
0.1 litre/s
00468
Pump2Current
0.1 A
Motor current.
00469
Pump2LatestCurrent
0.1 A
35
English (GB)
Address
Register name
Scale
Description
00470
Pump2Voltage
0.1 V
Voltage.
00471
Pump2Insulation
10 k
00472
Pump2WaterInOil
0.1 %
00473
Pump2Alarms1
bits
00474
Pump2Alarms2
bits
00475
Pump2Alarms3
bits
00476
Pump2Warnings1
bits
00477
Pump2Warnings2
bits
00478
Pump2Warnings3
bits
00479
1 C
00480
1 C
00481
Pump2PowerHI
00482
Pump2PowerLO
1W
Power consumption.
00483
Pump2EnergyHI
00484
Pump2EnergyLO
0.1 kWh
Energy consumption.
00485
Pump2CosPhi
0.01
Motor cos .
00486
Pump2Frequency
0.1 Hz
00487
Pump2VFDmode
enum

1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
00488
Pump2Torque
0.1 Nm
Motor torque.
00489
Pump2Asym
0.1 %
Pump2Sensors.WIO
bool

0 = Not present
1 = Present.
bool

0 = Not present
1 = Present.
Pump2Alarms4
bits
Pump2Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump2Alarms4
Bit 14:
bool

0 = No alarm
1 = Alarm
Pump2Warnings4
bits
Pump2Warnings4
Bit 13:
bool

0 = No warning
1 = Warning
Pump2Warnings4
Bit 14:
bool

0 = No warning
1 = Warning
bits
00490
00491
00492
00493
36
English (GB)

Address
Register name
Scale
Description
Pump3Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump3Status
Bit 1: Running
bool

0 = Not running
1 = Running.
Pump3Status
bool

0 = No fault
Pump3Status
Bit 3: Warning
bool

0 = No warning
1 = Warning.
Pump3Status
Bit 4: Alarm
bool

0 = No alarm
1 = Alarm.
Pump3Status
Bit 5: IO111Present
bool

0 = Not present
1 = Present.
Pump3Status
Bit 6: IO111Fault
bool

0 = No fault
1 = Fault.
Pump3Status
Bit 7: MP204Present
bool

0 = Not present
1 = Present.
Pump3Status
Bit 8: MP204Fault
bool

0 = No fault
1 = Fault.
Pump3Status
Bit 9: CUEPresent
bool

0 = Not present
1 = Present.
Pump3Status
Bit 10: CUEFault
bool

0 = No fault
1 = Fault.
Pump3Status
bool

0 = Enabled
enum

0 = Auto
1 = Switch
2 = Display
enum

1 min.
1 min.
00501
00502
Pump3ControlSource
from
from
from
from
the
the
the
the

CU 36X and VFD.
IO 351B and VFD.
00503
Pump3ConnectionType
00504
00505
00506
00507
00508
1 min.
00509
1 min.
00510
1s
00511
Pump3StartCounterHI
00512
Pump3StartCounterLO
unscaled
00513
unscaled
00514
unscaled
00515
Pump3StartsPerHour
unscaled
00516
Pump3Flow
0.1 litre/s
00517
Pump3LatestFlow
0.1 litre/s
00518
Pump3Current
0.1 A
Motor current.
00519
Pump3LatestCurrent
0.1 A
37
English (GB)
Address
Register name
Scale
Description
00520
Pump3Voltage
0.1 V
Voltage.
00521
Pump3Insulation
10 k
00522
Pump3WaterInOil
0.1 %
00523
Pump3Alarms1
bits
See fig. 25.
00524
Pump3Alarms2
bits
See fig. 25.
00525
Pump3Alarms3
bits
See fig. 25.
00526
Pump3Warnings1
bits
See fig. 25.
00527
Pump3Warnings2
bits
See fig. 25.
00528
Pump3Warnings3
bits
See fig. 25.
00529
1 C
00530
1 C
00531
Pump3PowerHI
00532
Pump3PowerLO
1W
Power consumption.
00533
Pump3EnergyHI
00534
Pump3EnergyLO
0.1 kWh
Energy consumption.
00535
Pump3CosPhi
0.01
Motor cos .
00536
Pump3Frequency
0.1 Hz
00537
Pump3VFDmode
enum

1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
00538
Pump3Torque
0.1 Nm
Motor torque.
00539
Pump3Asym
0.1 %
Pump3Sensors.WIO
bool

0 = Not present
1 = Present.
bool

0 = Not present
1 = Present.
Pump3Alarms4
bits
See fig. 25.
Pump3Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump3Alarms4
Bit 14:
bool

0 = No alarm
1 = Alarm
Pump3Warnings4
bits
See fig. 25.
Pump3Warnings4
Bit 13:
bool

0 = No warning
1 = Warning
Pump3Warnings4
Bit 14:
bool

0 = No warning
1 = Warning
bits
00540
00541
00542
00543
38
English (GB)

Address
Register name
Scale
Description
Pump4Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump4Status
Bit 1: Running
bool

0 = Not running
1 = Running.
Pump4Status
bool

0 = No fault
Pump4Status
Bit 3: Warning
bool

0 = No warning
1 = Warning.
Pump4Status
Bit 4: Alarm
bool

0 = No alarm
1 = Alarm.
Pump4Status
Bit 5: IO111Present
bool

0 = Not present
1 = Present.
Pump4Status
Bit 6: IO111Fault
bool

0 = No fault
1 = Fault.
Pump4Status
Bit 7: MP204Present
bool

0 = Not present
1 = Present.
Pump4Status
Bit 8: MP204Fault
bool

0 = No fault
1 = Fault.
Pump4Status
Bit 9: CUEPresent
bool

0 = Not present
1 = Present.
Pump4Status
Bit 10: CUEFault
bool

0 = No fault
1 = Fault.
Pump4Status
bool

0 = Enabled
enum

0 = Auto
1 = Switch
2 = Display
enum

1 min.
1 min.
00551
00552
Pump4ControlSource
from
from
from
from
the
the
the
the

CU 36X and VFD.
IO 351B and VFD.
00553
Pump4ConnectionType
00554
00555
00556
00557
00558
1 min.
00559
1 min.
00560
1s
00561
Pump4StartCounterHI
00562
Pump4StartCounterLO
unscaled
00563
unscaled
00564
unscaled
00565
Pump4StartsPerHour
unscaled
00566
Pump4Flow
0.1 litre/s
00567
Pump4LatestFlow
0.1 litre/s
00568
Pump4Current
0.1 A
Motor current.
00569
Pump4LatestCurrent
0.1 A
39
English (GB)
Address
Register name
Scale
Description
00570
Pump4Voltage
0.1 V
Voltage.
00571
Pump4Insulation
10 k
00572
Pump4WaterInOil
0.1 %
00573
Pump4Alarms1
bits
00574
Pump4Alarms2
bits
00575
Pump4Alarms3
bits
00576
Pump4Warnings1
bits
00577
Pump4Warnings2
bits
00578
Pump4Warnings3
bits
00579
1 C
00580
1 C
00581
Pump4PowerHI
00582
Pump4PowerLO
1W
Power consumption.
00583
Pump4EnergyHI
00584
Pump4EnergyLO
0.1 kWh
Energy consumption.
00585
Pump4CosPhi
0.01
Motor cos .
00586
Pump4Frequency
0.1 Hz
00587
Pump4VFDmode
enum

1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
00588
Pump4Torque
0.1 Nm
Motor torque.
00589
Pump4Asym
0.1 %
Pump4Sensors.WIO
bool

0 = Not present
1 = Present.
bool

0 = Not present
1 = Present.
Pump4Alarms4
bits
Pump4Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump3Alarms4
Bit 14:
bool

0 = No alarm
1 = Alarm
Pump4Warnings4
bits
Pump4Warnings4
Bit 13:
bool

0 = No warning
1 = Warning
Pump4Warnings4
Bit 14:
bool

0 = No warning
1 = Warning
bits
00590
00591
00592
00593
40
English (GB)

Address
Register name
Scale
Description
Pump5Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump5Status
Bit 1: Running
bool

0 = Not running
1 = Running.
Pump5Status
bool

0 = No fault
Pump5Status
Bit 3: Warning
bool

0 = No warning
1 = Warning.
Pump5Status
Bit 4: Alarm
bool

0 = No alarm
1 = Alarm.
Pump5Status
Bit 5: IO111Present
bool

0 = Not present
1 = Present.
Pump5Status
Bit 6: IO111Fault
bool

0 = No fault
1 = Fault.
Pump5Status
Bit 7: MP204Present
bool

0 = Not present
1 = Present.
Pump5Status
Bit 8: MP204Fault
bool

0 = No fault
1 = Fault.
Pump5Status
Bit 9: CUEPresent
bool

0 = Not present
1 = Present.
Pump5Status
Bit 10: CUEFault
bool

0 = No fault
1 = Fault.
Pump5Status
bool

0 = Enabled
enum

0 = Auto
1 = Switch
2 = Display
enum

1 min.
1 min.
00601
00602
Pump5ControlSource
from
from
from
from
the
the
the
the

CU 36X and VFD.
IO 351B and VFD.
00603
Pump5ConnectionType
00604
00605
00606
00607
00608
1 min.
00609
1 min.
00610
1s
00611
Pump5StartCounterHI
00612
Pump5StartCounterLO
unscaled
00613
unscaled
00614
unscaled
00615
Pump5StartsPerHour
unscaled
00616
Pump5Flow
0.1 litre/s
00617
Pump5LatestFlow
0.1 litre/s
00618
Pump5Current
0.1 A
Motor current.
00619
Pump5LatestCurrent
0.1 A
41
English (GB)
Address
Register name
Scale
Description
00620
Pump5Voltage
0.1 V
Voltage.
00621
Pump5Insulation
10 k
00622
Pump5WaterInOil
0.1 %
00623
Pump5Alarms1
bits
00624
Pump5Alarms2
bits
00625
Pump5Alarms3
bits
00626
Pump5Warnings1
bits
00627
Pump5Warnings2
bits
00628
Pump5Warnings3
bits
00629
1 C
00630
1 C
00631
Pump5PowerHI
00632
Pump5PowerLO
1W
Power consumption.
00633
Pump5EnergyHI
00634
Pump5EnergyLO
0.1 kWh
Energy consumption.
00635
Pump5CosPhi
0.01
Motor cos .
00636
Pump5Frequency
0.1 Hz
00637
Pump5VFDmode
enum

1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
00638
Pump5Torque
0.1 Nm
Motor torque.
00639
Pump5Asym
0.1 %
Pump5Sensors.WIO
bool

0 = Not present
1 = Present.
bool

0 = Not present
1 = Present.
Pump5Alarms4
bits
Pump5Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump5Alarms4
Bit 14:
bool

0 = No alarm
1 = Alarm
Pump5Warnings4
bits
Pump5Warnings4
Bit 13:
bool

0 = No warning
1 = Warning
Pump5Warnings4
Bit 14:
bool

0 = No warning
1 = Warning
bits
00640
00641
00642
00643
42
English (GB)

Address
Register name
Scale
Description
Pump6Status
Bit 0: Presence
bool
Presence of pump.
0 = Not present
1 = Present.
Pump6Status
Bit 1: Running
bool

0 = Not running
1 = Running.
Pump6Status
bool

0 = No fault
Pump6Status
Bit 3: Warning
bool

0 = No warning
1 = Warning.
Pump6Status
Bit 4: Alarm
bool

0 = No alarm
1 = Alarm.
Pump6Status
Bit 5: IO111Present
bool

0 = Not present
1 = Present.
Pump6Status
Bit 6: IO111Fault
bool

0 = No fault
1 = Fault.
Pump6Status
Bit 7: MP204Present
bool

0 = Not present
1 = Present.
Pump6Status
Bit 8: MP204Fault
bool

0 = No fault
1 = Fault.
Pump6Status
Bit 9: CUEPresent
bool

0 = Not present
1 = Present.
Pump6Status
Bit 10: CUEFault
bool

0 = No fault
1 = Fault.
Pump6Status
bool

0 = Enabled
enum

0 = Auto
1 = Switch
2 = Display
enum

1 min.
1 min.
00651
00652
Pump6ControlSource
from
from
from
from
the
the
the
the

CU 36X and VFD.
IO 351B and VFD.
00653
Pump6ConnectionType
00654
00655
00656
00657
00658
1 min.
00659
1 min.
00660
1s
00661
Pump6StartCounterHI
00662
Pump6StartCounterLO
unscaled
00663
unscaled
00664
unscaled
00665
Pump6StartsPerHour
unscaled
00666
Pump6Flow
0.1 litre/s
00667
Pump6LatestFlow
0.1 litre/s
00668
Pump6Current
0.1 A
Motor current.
00669
Pump6LatestCurrent
0.1 A
43
English (GB)
Address
Register name
Scale
Description
00670
Pump6Voltage
0.1 V
Voltage.
00671
Pump6Insulation
10 k
00672
Pump6WaterInOil
0.1 %
00673
Pump6Alarms1
bits
00674
Pump6Alarms2
bits
00675
Pump6Alarms3
bits
00676
Pump6Warnings1
bits
00677
Pump6Warnings2
bits
00678
Pump6Warnings3
bits
00679
1 C
00680
1 C
00681
Pump6PowerHI
00682
Pump6PowerLO
1W
Power consumption.
00683
Pump6EnergyHI
00684
Pump6EnergyLO
0.1 kWh
Energy consumption.
00685
Pump6CosPhi
0.01
Motor cos .
00686
Pump6Frequency
0.1 Hz
00687
Pump6VFDmode
enum

1=2 = Stopped
3 = Reverse start
4 = Start flushing
5 = Normal
6 = Run flushing
7 = Stop flushing
00688
Pump6Torque
0.1 Nm
Motor torque.
00689
Pump6Asym
0.1 %
Pump6Sensors.WIO
bool

0 = Not present
1 = Present.
bool

0 = Not present
1 = Present.
Pump6Alarms4
bits
Pump6Alarms4
Bit: 13
bool
Pump blocked alarm

0 = No alarm
1 = Alarm
Pump6Alarms4
Bit 14:
bool

0 = No alarm
1 = Alarm
Pump6Warnings4
bits
Pump6Warnings4
Bit 13:
bool

0 = No warning
1 = Warning
Pump6Warnings4
Bit 14:
bool

0 = No warning
1 = Warning
bits
00690
00691
00692
00693
44
Address
Register name
Scale
Description
00701
SimulationEventCode
enum
Event code to simulate.
00702
SimulationEventSource
enum
Event source to simulate.
00703
SimulationEventDeviceNo
enum
Event device number to simulate.
00704
SimulationEventActionType
enum
0 = Warning
1 = Alarm
2 = Disabled.
00705
SimulationActivate
bool
Activation of simulation features.

0 = Deactivate simulation
1 = Activate simulation.
00706
SimulationStatus
Bit 0: SimulationActive
bool
State of simulation.
0 = Not active
1 = Active.
Scale
Description
unscaled
This area is for device labelling by the user. Neither the

CU 36X nor the CIM will modify this area.
The user area values are stored in the device and will
remain after a power-off.
Scale
Description
UTF-8
chars.
Name string read from the Dedicated Controls CU 36X.

UTF-8 is a variable-length character encoding for
Unicode. It can represent any character in the Unicode
standard.
It may take up to 60 seconds for a change to be visible.
English (GB)
9.13 Alarm simulation register block
9.14 User register block

Address
00751-00800
Register name
UserRegisters
9.15 Name string register block

Address
00801-00920
Register name
NameRegisterArea
45
9.16 Hour log register block
English (GB)
Generally the Modbus master application can select the relevant

log series and the relevant number of hours back in time.
Typically several communication sessions (request telegrams)
are needed to read the data.
The communication interface ensures that logged data is
protected against internal update during the time it is accessed
from Modbus, so that the Hour log constitutes a time-consistent
block (data coherency). Every time the real-time clock increments
by one hour, all the logged data in the Hour log is shifted one hour
back in time (and the oldest data set is cleared). The exact time
where this happens will be delayed a few seconds relative to the
hour incrementation, so to be sure to read Hour log data that has
been correctly updated, it is recommended to read data at least
30 seconds after the hour incrementation.
Address
Register name
Scale
Description
02001-02072
PitOverflowTimeHourLog172
1 min.
Pit, incremental overflow time, hour log 172.
02073-02144
PitOverflowCntHourLog172
unscaled
Pit, incremental number of overflows, hour log 172.
02145-02216
PitOverflowVolumeHourLog172
0.1 m3
Pit, incremental overflow volume, hour log 172.
02217-02288
PitSpecificEnergyHourLog172
Wh/m3
m3
Pit, specific energy, hour log 172.

Pit, incremental pumped volume, hour log 172.
02289-02360
PitVolumeHourLog172
0.1
02361-02432
PitEnergyHourLog172
0.1 kWh
Pit, incremental energy consumption, hour log 172.
02433-02504
Pit2PumpsOprTimeHourLog172
1 min.
Pit, incremental operating time (two pumps operating simultaneously),

hour log 172.
02505-02576
1 min.
Pit, incremental operating time (three pumps operating

simultaneously), hour log 172.
02577-02648
1 min.
Pit, incremental operating time (four pumps operating simultaneously),

hour log 172.
02649-02720
1 min.
Pit, incremental operating time (five pumps operating simultaneously),

hour log 172.
02721-02792
1 min.
Pit, incremental operating time (six pumps operating simultaneously),

hour log 172.
02793-02864
Pump1OprTimeHourLog172
1 min.
Pump 1, incremental operating time, hour log 172.
02865-02936
Pump1StartCntHourLog172
unscaled
Pump 1, incremental number of starts, hour log 172.
02937-03008
Pump1AvgFlowHourLog172
0.1 litre/s
Pump 1, average flow, hour log 172.
03009-03080
Pump1AvgCurrentHourLog172
0.1 A
Pump 1, average current, hour log 172.
03081-03152
1 min.
03153-03224
unscaled
03225-03296
0.1 litre/s
03297-03368
0.1 A
03369-03440
1 min.
03441-03512
unscaled
03513-03584
0.1 litre/s
03585-03656
0.1 A
03657-03728
1 min.
03729-03800
unscaled
03801-03872
0.1 litre/s
03873-03944
0.1 A
03945-04016
1 min.
04017-04088
unscaled
04089-04160
0.1 litre/s
04161-04232
0.1 A
04233-04304
1 min.
04305-04376
unscaled
04377-04448
0.1 litre/s
04449-04521
0.1 A
46
English (GB)
9.17 Event log register block

The event log contains the latest 50 event entries. Each entry
consists of seven registers, containing information about the
event.
Address
Register name
Scale
Description
06001
NoOfEventsInLog
unscaled
Number of events in the event log.
06002
EventIDLog1
unscaled
Event ID for logged event No 1.
06003
EventCodeLog1
enum
Event code for logged event No 1.
enum
Event source for logged event No 1.

0 = System
1 = CU 36X
2 = IO 351B
3 = IO 111, pump
4 = MP 204, pump
5 = Analog input
6 = Pump
7 = Add-on CIM module
8 = Battery/UPS
9 = Mixer
10 = Analog input, level sensor
11 = Analog input, flow sensor
12 = Analog input, power sensor
13 = Analog input, user-defined sensor
14 = CUE (variable-frequency drive).
unscaled
Device number related to the event or its recognition.

0 = No related number
1 = Value of related number, pump 1
6 = Value of related number, pump 6.
enum
Event type and condition of logged event No 1.

0=1 = Alarm condition appears
2 = Alarm condition disappears
3 = Warning condition appears
4 = Warning condition disappears.
1s
Seconds since midnight January 1st 1970 (UNIX time).
06004
06005
EventSourceLog1
EventDeviceNo
06006
EventTypeAndConditionLog1
06007
EventTimeStampLog1HI
06008
EventTimeStampLog1LO
06009-06344
Event log 249
06345
EventIDLog50
unscaled
Event ID for logged event No 50.
06346
EventCodeLog50
enum
Event code for logged event No 50.

Event source for logged event No 50.
06347
EventSourceLog50
enum
06348
EventDeviceNo
unscaled
Device number related to the event or its recognition.
06349
EventTypeAndConditionLog50
enum
Event type and condition of logged event No 50.
06350
EventTimeStampLog50HI
06351
EventTimeStampLog50LO
1s
Seconds since midnight January 1st 1970 (UNIX time).
47
9.18 Data log index register block
English (GB)
This is an index area for the configurable data log. The log data
index registers are read-only.
See section 11.3 Reading the configurable data log series for
detailed information on how to read the configurable log series.
By default the configurable logs are not set up. This can only be
done with a PC Tool or via the CU 36X control panel. For further
information, see installation and operating instructions for
Dedicated Controls.
Address
Register name
Scale
Description
07001
NoOfLogSeries
unscaled
Number of available log series [0; 64].
07002
LogSeries1ItemNo
unscaled
Log series 1 item number.

See section 11.3 Reading the configurable data log series.
07003
LogSeries1RegAddr
unscaled
Register start address of log series 1.
07004
LogSeries1SamplingTime
1s
Time period between samples in log series 1.
07005
LogSeries1NoOfSamples
unscaled
Number of samples in log series 1, N1.
07006
LogSeries2ItemNo
unscaled

07007
LogSeries2RegAddr
unscaled
Register start address of log series 2.
07008
1s
Time period between samples in log series 2.
07009
unscaled
Number of samples in log series 2, N2.
LogSeries#ItemNo
unscaled
Log series # item number.

LogSeries#RegAddr
unscaled
Register start address of log series #.
LogSeries#SamplingTime
1s
Time period between samples in log series #.
LogSeries#NoOfSamples
unscaled
Number of samples in log series #, N#.
07254
LogSeriesLItemNo
unscaled
Log series "L" item number (last series).

07255
LogSeriesLRegAddr
unscaled
Register start address of log series "L".
07256
LogSeriesLSamplingTime
1s
Time period between samples in log series "L".
07257
LogSeriesLNoOfSamples
unscaled
Number of samples in log series "L", NL.
07258
LogSeriesEndMark
unscaled
End mark to end the index. Is always 0.
indicates variable register address.
48
English (GB)
9.19 Data log series register block

Data area for the configurable data log series (max. 64 series).
The log data are read-only and have a fixed starting address, so
log series 1 always starts at register 07301.
See section 11.3 Reading the configurable data log series for
detailed information on how to read the configurable log series.
Address
Register name
Scale
Description
07301
LogSeries1ItemNo
unscaled

07302
1s
Time period between samples in log series 1, configurable

on the CU 36X control panel.
07303
unscaled
Number of samples in log series 1, N1, configurable on the

CU 36X control panel.
07304
LogSeries1TimeStampHI
07305
LogSeries1TimeStampLO
1s
Log series 1 Unix time stamp. Subtracting "Sampling time"

gives the time stamp of sample No 2 in this series, etc.
07306
LogSeries1Sample1
Value of log series 1 sample No 1.
LogSeries1SampleN1
Value of log series 1 sample No N1 (last sample in series).
LogSeries2ItemNo

Time period between samples in log series 2, configurable

on the CU 36X control panel.
LogSeries2TimeStampHI
LogSeries2TimeStampLO
Log series 2 Unix time stamp. Subtracting "Sampling time"

LogSeries2Sample1
Value of log series 2 sample No 1.
LogSeries2SampleN2
Value of log series 2 sample No N2 (last sample in series).
LogSeries#ItemNo
Log series # item number.

LogSeries#SamplingTime
Time period between samples in log series #.
LogSeries#NoOfSamples
Number of samples in log series #, N#.
LogSeries#TimeStampHI
LogSeries#TimeStampLO
Log series # Unix time stamp. Subtracting "Sampling time"

LogSeries#Sample1
Value of log series # sample No 1.
LogSeries#SampleN#
Value of log series # sample No N# (last sample in series).
LogSeriesLItemNo
Log series "L" item number.

LogSeriesLSamplingTime
Time period between samples in log series "L".
LogSeriesLNoOfSamples
Number of samples in log series "L", NL.
LogSeriesLTimeStampHI
-
Log series "L" Unix time stamp. Subtracting "Sampling

time" gives the time stamp of sample No 2 in this series,
etc.
Value of log series "L" sample No 1.
LogSeriesLTimeStampLO
LogSeriesLSample1
Value of log series "L" sample No NL (last sample in

series).
LogSeriesLSampleN1
indicates variable register address.
49
English (GB)
10. Modbus RTU commissioning, step-by-step guides

Note
If the sensor configuration is changed, restart

the CIM unit to ensure a correct scaling of the
sensor value.
10.1 Hardware setup (CIM 200)

Step
Action
Install the CIM 200 in the Grundfos pump according to the pump documentation.
Complete the pump configuration, e.g. sensor configuration and local mode.
This can be done either on the pump control panel, via the R100 or Grundfos GO Remote or Grundfos PC Tool E-Products.
Select the Modbus slave address (1-247).
Select the bit rate of the Modbus slave.
Select parity and stop bits of the Modbus slave (even parity with 1 stop bit or no parity with 2 stop bits).
If necessary, set line termination.
Connect the necessary cables from the CIM 200 to the Modbus network.
Confirm that the GENIbus LED is constantly green and that the Modbus LED is either off (if no master is actively polling the
slave) or flashing green (indicating error-free communication).
The CIM 200 is now ready to be accessed via the Modbus network.
10.2 Hardware setup (CIM 250 GSM call-up)

Step
Action
Install the CIM 250 in the Grundfos pump according to the pump documentation.
Fit a GSM antenna to the CIM module SMA connector. See section 6.1.1 Fitting a GSM antenna.
Insert the SIM card in the CIM 250. See section 6.1.2 Inserting the SIM card.
Power on the Grundfos product
Observe that LED2 turns steady green (see section 6.2 Status LEDs), indicating that the CIM module is fitted correctly.
Observe that LED1 blinks yellow and changes to yellow pulsing after approximately 30 s (see section 6.2 Status LEDs),
indicating that the GSM connection is working.
By making a call-up from a phone the connection can be verified (LED1 turns steady yellow).
For configuring the CIM 250 for a call-up connection, follow the instructions in the "CIM 250 SMS commands installation
and operating instructions" (included on CIM/CIU support files CD), section 2.1-3.
To verify the GSM settings after completion, the SMS command GSMSETTINGS can be used.
The CIM 250 is now ready to be accessed from a Modbus RTU master via GSM call-up (or via SMS commands).
10.3 Hardware setup (CIM 250 GPRS connection)

Step
Action
Install the CIM 250 in the Grundfos product according to the product documentation.
Fit a GSM antenna to the CIM module SMA connector. See section 6.1.1 Fitting a GSM antenna.
Insert the SIM card in the CIM 250. See section 6.1.2 Inserting the SIM card.
Power on the Grundfos product
Observe that LED2 turns steady green. See section 6.2 Status LEDs.
Observe that LED1 blinks yellow and changes to yellow pulsing after approximately 30 s (see section 6.2 Status LEDs),
indicating that the GSM connection is working.
For configuring the CIM 250 for a GPRS connection, follow the instructions in the "CIM 250 SMS commands installation
and operating instructions" (included on CIM support files CD), sections 2.1, 2.2 and 2.4.
To verify the GPRS setting after completion, the SMS command GPRSSETTING can be used.
To verify that the GPRS connection is working, the SMS command GPRSSTATUS can be used. The connection state
should be "Context active" if ready and "Connected" if a Modbus TCP master is already communicating.
The CIM 250 is now ready to be accessed from a Modbus TCP master via GPRS (or via SMS commands).
50
English (GB)
10.4 Modbus TCP communication setup (CIM 500)

Step
Action
Install the CIM 500 in the Grundfos Grundfos product according to the pump documentation.
Select position 1 at the protocol rotary switch. See section 7.2 Setting the Industrial Ethernet protocol.
Power on the Grundfos product, and observe LED2 turn steady green and LED1 remaining off.
Complete the pump configuration, e.g. sensor configuration and selection of local Operating mode, local Control mode and
local Setpoint (e.g. via Go Remote)
Connect one of the CIM 500 Ethernet ports (RJ45) to a PC using an Ethernet cable.
Configure the PC Ethernet port to the same subnetwork as the CIM 500 (e.g. 192.168.1.1) and the subnet mask to
255.255.255.0 (See "A.1 How to configure an IP address on your PC" on page 81).
Open your internet browser and make contact to the CIM 500 Web server.
Factory default address: 192.168.1.100
Log on to the Web server. Default:

User: admin
Password: Grundfos.
In the menu column to the left select: Configuration > Real time Ethernet protocol
10
Key in an IP address belonging to the same subnet as your PC (e.g. 192.168.1.2).
11
Key in the subnet mask 255.255.255.0, and leave the rest of the settings at their factory default values.
12
Click [Submit] to transfer the new settings, and close the Web browser.
CIM 500 is now ready to be accessed from a Modbus TCP master via one of its Ethernet ports. Use the IP address selected under
step 9. The Modbus address (Unit ID) in the Modbus TCP telegram is not used.
The CIM 500 LED 1 will be flashing green when Modbus TCP communication takes place.
You can use the two Ethernet ports for daisy chaining of CIM 500 modules.
It is possible to have connection to the Web server simultaneously with a connection to a Modbus TCP master.
It is possible to have connection to more Modbus TCP masters simultaneously, e.g. to have connection to PC Tool CIM while
connected to another Modbus TCP master.
51
English (GB)
11. Detailed descriptions of functionality

11.1 SCADA PIN code protection
It is always possible to get read access via Modbus, but if the
CU 36X control unit is SCADA PIN-code-protected
(PitStatus.ScadaPinCodeEnabled, register 00202, bit 4 = 1), write
access requires that the user has entered the correct PIN-code in
(ScadaPinCode, register 00109).
Writing the correct PIN code value will trigger the write access
control, and write access will be open, which can be verified with
the status bit PitStatus.WriteAccess (register 00202, bit 5 = 1).
To remove write access, the SCADA PIN code input register
(ScadaPinCode, register 00109) can be set with a value of 0.
The SCADA PIN code protection cannot be enabled or disabled
via Modbus.
11.2 Reading the event log

The event log has a size of 350 registers containing the latest
50 alarm and warning events. The number of contained event
logs can be read from NoOfEventsInLog (register 06001).
Each event is represented as an event record of seven registers:
EventID
EventCode
EventSource
EventDeviceNo
EventTypeAndCondition
EventTimeStampHI
EventTimeStampLO.
The EventID is a unique "tag" for the event record. These IDs are
incremented successively corresponding to the succession of the
events they represent. The event log can be handled in three
ways:
Reading the complete log (all 50 event records) regularly and

afterwards sorting "new" ones from "old" ones.
Reading the event ID of the latest record EventLogLatestID

(register 00216) and comparing with the event ID of the latest
record that has been read previously to see how many "new"
records have been generated. Then afterwards reading only
the "new" ones.
Clearing the event log with PitControl.ResetEventLog

(register 00101, bit 2) after it has been read. Then the event
log will always contain "new" events only.
Note
52
The CIM module ensures that logged data is

protected against internal update during the time
it is accessed from Modbus, so that the event log
constitutes a time-consistent block (data
coherency).
English (GB)
11.3 Reading the configurable data log series

LogSeriesItemNo
The log series item numbers are shown in the table below.
Note that the scaling of the registers with the present values is
identical to the scaling of the logged data values except for power
values where the scaling has been changed from [1 W] to [10 W]
to fit into 16 bit.
Log series item No
Log item register
Scale
0001
PitWaterLevel
0.01 m
0002
PitSwitchWaterLevel
Unscaled
0003
PitFlowIn
0.1 litre/s
0004
PitAverageFlowIn
0.1 litre/s
0005
PitFlowOut
0.1 litre/s
0006
PitAverageFlowOut
0.1 litre/s
0007
PitPower
10 W*
0008
PitSpecificEnergy
1 Wh/m3
0010
PitMixerStartPerH
Unscaled
0011
PitOutletPressure
0.001 bar
0012
PitEstimatedFlowOut
0.1 l/s
0500
UserAnalogInput1
0.1 %
0501
UserAnalogInput2
0.1 %
0502
UserAnalogInput3
0.1 %
1000
Pump1Flow
0.1 litre/s
1001
Pump1LatestFlow
0.1 litre/s
1002
Pump1Current
0.1 A
1003
Pump1Insulation
10 k
1004
Pump1WaterInOil
0.1 %
1005
1 C
1006
1 C
1007
Pump1CosPhi
0.01
1008
Pump1Power
10 W*
1009
Pump1Voltage
0.1 V
1010
Pump1LatestCurrent
0.1 A
1011
Pump1StartsPerH
Unscaled
1012
1s
1013
Pump1Frequency
0.01 Hz
1014
Pump1Torque
0.1 Nm
1015
Pump1CurrentAsymmmetry
0.1 %
2000
Pump2Flow
0.1 litre/s
2001
Pump2LatestFlow
0.1 litre/s
2002
Pump2Current
0.1 A
2003
Pump2Insulation
10 k
2004
Pump2WaterInOil
0.1 %
2005
1 C
2006
1 C
2007
Pump2CosPhi
0.01
2008
Pump2Power
10 W*
2009
Pump2Voltage
0.1 V
2010
Pump2LatestCurrent
0.1 A
2011
Pump2StartsPerH
Unscaled
2012
1s
2013
Pump2Frequency
0.01 Hz
2014
Pump2Torque
0.1 Nm
2015
0.1 %
3000
Pump3Flow
0.1 litre/s
3001
Pump3LatestFlow
0.1 litre/s
3002
Pump3Current
0.1 A
3003
Pump3Insulation
10 k
3004
Pump3WaterInOil
0.1 %
53
English (GB)
Log series item No
Log item register
Scale
3005
1 C
3006
1 C
3007
Pump3CosPhi
0.01
3008
Pump3Power
10 W*
3009
Pump3Voltage
0.1 V
3010
Pump3LatestCurrent
0.1 A
3011
Pump3StartsPerH
Unscaled
3012
1s
3013
Pump3Frequency
0.01 Hz
3014
Pump3Torque
0.1 Nm
3015
0.1 %
4000
Pump4Flow
0.1 litre/s
4001
Pump4LatestFlow
0.1 litre/s
4002
Pump4Current
0.1 A
4003
Pump4Insulation
10 k
4004
Pump4WaterInOil
0.1 %
4005
1 C
4006
1 C
4007
Pump4CosPhi
0.01
4008
Pump4Power
10 W*
4009
Pump4Voltage
0.1 V
4010
Pump4LatestCurrent
0.1 A
4011
Pump4StartsPerH
Unscaled
4012
1s
4013
Pump4Frequency
0.01 Hz
4014
Pump4Torque
0.1 Nm
4015
0.1 %
5000
Pump5Flow
0.1 litre/s
5001
Pump5LatestFlow
0.1 litre/s
5002
Pump5Current
0.1 A
5003
Pump5Insulation
10 k
5004
Pump5WaterInOil
0.1 %
5005
1 C
5006
1 C
5007
Pump5CosPhi
0.01
5008
Pump5Power
10 W*
5009
Pump5Voltage
0.1 V
5010
Pump5LatestCurrent
0.1 A
5011
Pump5StartsPerH
Unscaled
5012
1s
5013
Pump5Frequency
0.01 Hz
5014
Pump5Torque
0.1 Nm
5015
0.1 %
6000
Pump6Flow
0.1 litre/s
6001
Pump6LatestFlow
0.1 litre/s
6002
Pump6Current
0.1 A
6003
Pump6Insulation
10 k
6004
Pump6WaterInOil
0.1 %
6005
1 C
6006
1 C
6007
Pump6CosPhi
0.01
6008
Pump6Power
10 W*
6009
Pump6Voltage
0.1 V
6010
Pump6LatestCurrent
0.1 A
6011
Pump6StartsPerH
Unscaled
6012
1s
6013
Pump6Frequency
0.01 Hz
54
Log item register
Scale
6014
Pump6Torque
0.1 Nm
6015
0.1 %
English (GB)
Log series item No
* The data item PitPowerHI/LO (registers 00308 and 00309) has a resolution of 1 W, but the logging is in 10 W.
Log series max. limits
Total number of samples
40000 registers
Log series max. length
8192 registers (max. value for LogSeriesNoOfSamples)
Maximum number of log series
64 (max. value for NoOfLogSeries (register 07001))
11.4 Separation of reads and writes
11.5 Control bit acknowledgement
The functional profile supports Modbus holding registers, which

means that registers can be both read and written. By default,
most of the register values meant for writing by the Modbus
master will also be updated by the CU 36X control unit itself, to
reflect the actual value used by the CU 36X.
All control bits in the functional profile are triggered on the rising
edge of a bit. The system supports two different approaches to
control bit acknowledgement: Auto and manual.
Differences arise due to internal value limitations and because

some settings and control values can have other sources
(e.g. service port and display) that can change the actual values.
To avoid such conflicts, the profile has the option of read/write
separation with the option Config.ReadWriteSeparation
(register 00006, bit 1 = 1). Using this option means that all writing
registers [W] use an associated reading location [R] where the
resulting status of the writing always can be verified. In this case
reading and writing never take place via the same registers
(Pit Event Simulation registers being the only exceptions).
Reading a writing register only means reading what has
previously been written to the Modbus interface, and in the
general case this will not reflect what value the CU 36X control
unit is actually using.
0 = Disabled.
Control bits are not automatically lowered when accepted by the
device. The user must lower the control bit manually before the
control bit can be triggered again. When a control bit is accepted
by the device, the corresponding control bit acknowledgement will
be raised, and the user can lower the control bit.
Example 1
Setting and reading overflow level with ReadWriteSeparation
disabled [default].
The user writes a new value to SetOverflowLevel
(register 00121).
The resulting overflow level is then read from SetOverflowLevel
(register 00121).
The AutoAckControlBits setting (register 00005) sets the desired

approach:
1 = Enabled.
Control bits are automatically lowered when accepted by the
device, so the user does not have to lower it manually [default].
Example 1
ResetAlarm with auto-acknowledgement enabled [default].
The user sets the PitControl.ResetAlarm control bit
(register 00101, bit 0) to 1 to reset an alarm. When accepted
by the slave, the PitControl.ResetAlarm control bit is
automatically reset to 0. The user can then set the
PitControl.ResetAlarm control bit to 1 again to reset an alarm
again.
Note
AutoAckEnabled is the default setting.
Example 2
ResetAlarm with auto-acknowledgement disabled.
Note
ReadWriteSeparation is disabled by default.
Example 2
Setting and reading overflow level with ReadWriteSeparation
enabled.
The user writes a new value to SetOverflowLevel
(register 00121).
The resulting overflow level is then read from OverflowLevel
(register 00240), hence separating reads from writes.
The user sets the PitControl.ResetAlarm control bit

(register 00101, bit 0) to 1 to reset an alarm.
When accepted by the slave, the
AcknowledgeRegister.AckResetAlarm (register 00201, bit 0) is
set to 1, and the PitControl.ResetAlarm is still 1. The user
must then manually set PitControl.ResetAlarm to 0 before
another alarm can be reset. When doing so, the
AcknowledgeRegister.AckResetAlarm will revert to 0 as well.
55
11.7 GSM call-back connection
The call-up function in the Dedicated Controls wastewater system

is used for SCADA system communication via the GSM network.
Connection is established when the SCADA system dials the
CIM 250. The CIM 250 will automatically "pick up the phone" and
wait for data traffic in the form of Modbus RTU telegrams.
If an alarm appears in the Dedicated Controls wastewater system

and the SCADA call-back function in the CU 36X has been
enabled in general and also enabled for this particular alarm, the
CIM 250 will attempt to establish a phone connection to the
SCADA system. Dialling timeout is one minute, and if connection
is not established, the CIM 250 will hang up and enter a call-back
wait state. Call-back will be retried after one minute. This goes on
forever as long as the alarm condition persists. See fig. 19.
If legal data traffic has not been initiated within one minute, the
CIM 250 will hang up the line. This silence timeout is active
during the whole communication session. Whenever the SCADA
system has completed the Modbus communication, it hangs up
the line. This is detected by the CIM 250, which also hangs up the
line, and the call-up communication session is thereby
completed. See fig. 18.
GSM network
(e.g. SCADA)
Dialling
Connection establish
ed
Silence timeout after 1 min

without communication
Hangs up
the line.
Hang-up
Hangs up
the line.
Session
completed.
If connection is established, the CIM 250 will wait up to one

minute for data traffic. If no communication is initiated from the
SCADA system, the CIM 250 will hang up, enter a call-back wait
state and retry after one minute. See fig. 19.
The SCADA system is expected to start Modbus communication
when called. When the appropriate data have been requested or
written, the SCADA system must send a call-back
acknowledgement to the CIM 250 to signal that it has received
the information needed (Modbus writes to
PitControl.CallBackAck, register 00101, bit 5). This is to prevent
several call-backs based on the same event.
CIM 250
TM04 4905 2209
Fig. 18 Illustration of a GSM call-up session
If SCADA PIN code protection is enabled, the ScadaPinCode

(register 00109) has to be written with the correct value before
write access will be opened. It will then remain open until the callback session is completed.
To finally end the sequence, the SCADA system hangs up the
line. This is detected by the CIM 250, which also hangs up the
line, and the call-back communication session is thereby
completed.
GSM network,
e.g. SCADA
If SCADA PIN code protection is enabled, the ScadaPinCode

(register 00109) has to be written with the correct value before
write access will be opened. It will then remain open until the callup session is completed. The next call-up session also has to
write the ScadaPinCode to be able to write registers.
See installation and operating instructions for Dedicated
Controls.
CIM 250
Dialling
Call-bac
k No.
Dialling
timeout
after 1
min.
Connection es
tablished
Relevant settings in the CU 36X:

To find the parameter in the CU 36X, go to
Silence timeout after 1 min

without communication
Settings > Communication settings > SCADA settings >
SCADA PIN code enabled
SCADA PIN code.
Modbus CallBac
kAck
Hangs up
the line.
Modbus reply
Hang up
Hangs up
the line.
Session
completed.
Fig. 19 Principle illustration of a call-back session

SCADA call-back enabled
SCADA call-back phone number
SCADA PIN code.
Settings > Alarm settings >
56
SCADA call-back enabled for particular alarms.
TM04 4906 2209
English (GB)
11.6 GSM call-up connection
11.8.3 Change GSM module battery
The setting up and the use of the SMS functions are described in
the installation and operating instructions for Dedicated Controls.
If the CIM 250 detects that the optional CIM 250 battery is worn
out and must be replaced, it will send this message to all
numbers in the phone book:

Settings > Communication settings >
[Installation name]
SMS numbers
GSM Module Error:
SMS schedule
Change GSM Module battery
SMS heartbeat message
SMS authentication.
Apart from the SMS functionality described in the previous

sections which is related to the Dedicated Controls wastewater
system, the CIM 250 will send SMS messages in case of faults or
other special conditions of the CIM 250 itself.
Such messages do not depend on the CU 36X. They cannot be
disabled, but are generated by the CIM 250 and sent to all
numbers in the phone book.
Note
No SMS message will be sent if the phone book is

empty (for instance if the CIM 250 has not been
initialised).
The message is triggered by an event. If the CIM 250 is switched

off and on (the battery must also be removed), it will send the
message again if the cause of the message still exists.
11.8.1 No connection to product
If the communication between the CIM 250 and the CU 36X is
interrupted for more than one minute, the CIM 250 will send this
message to all numbers in the phone book.
[Installation name]
GSM Module Error:
No connection to product
Note
If the cause of the interruption is the fact that the

power supply to the product was interrupted, the
CIM 250 will send this message instead:
No mains supply, using battery. See below.
11.8.2 No mains supply, using battery

If the CIM 250 detects that it is being supplied from the optional
CIM 250 battery, it will send this message to all numbers in the
phone book:
11.8.4 GSM module battery low

If the CIM 250 detects that the optional CIM 250 battery level is
low, it will send this message to all numbers in the phone book:
[Installation name]
GSM Module Error:
GSM Module battery low
11.9 GPRS connection

GPRS (General Packet Radio Service) is a wireless, "allways on"
connection that remains active as long as the CIM 250 is within
range of the service. With GPRS it is possible to establish a
wireless connection to the internet and thus enable a remote
connection to a SCADA system computer or another PC
application. Typical data rates are 32-48 kbit/s.
The GPRS itself takes care of the wireless data transfer via the
GSM network. It plays the same role as Ethernet in a wired
network. On top of GPRS is the TCP/IP protocol, which enables
easy integration with the internet. The Modbus TCP protocol is
used on the application layer communicating with a TCP port
number (default 502). The difference when compared to the
fieldbus protocol Modbus RTU is the exclusion of the 16-bit CRC
checksum and the adding of a Modbus application program
header as illustrated below.
11.9.1 Subscription
The GSM service providers have different technical solutions for
GPRS to choose from. You have to select the service provider
and the technical solution that best suit your needs, and it must
be based on static IP addressing. You will get the following from
the GSM service provider:
A Subscriber Identity Module (SIM card).
An Access Point Name (APN) (e.g. "internet").
[Installation name]
Username (is fixed and cannot be changed by the user).
GSM Module Error:
Password (is fixed and cannot be changed by the user).
No mains supply, using battery
A static IP address.
This fault may disappear by itself, as the message is typically

triggered by a short power cut. In case of this special fault (but
not the other ones), the CIM 250 will send a message, telling that
the fault has disappeared:
Solutions based on a VPN (Virtual Private Network) involve the

use of special routers, e.g. GRE routers, Generic Routing
Encapsulation, which you will also get from the service provider.
[Installation name]
GSM Module:
Mains supply returned
If the battery is worn out or the CIM 250 has no battery, the
CIM 250 will not detect that the power supply to the CU 36X has
been interrupted, as it will loose power supply itself. Therefore, it
cannot send a message. To inform the user that there has been a
power cut, the CIM 250 will always send an SMS message when
the power supply has returned:
[Installation name]
GSM Module:
Power on occurred
57
English (GB)
11.8 Use of SMS messages
11.9.3 Status
Specific settings for GPRS communication in the CU 36X:
In the CU 36X display "Status > System > GSM/GPRS", you will
see the following information:

Settings > Communication settings > GPRS settings >
GPRS connection state
APN
"Detached": No connection to any GPRS service.
Username
"Attached": Connection to GPRS service established.
Password.
"Context active": IP address has been assigned, ready for a

client to establish a socket connection.
There are some advanced GPRS settings which have default

values that usually work, but in special cases, it might be
necessary to change some of them. This can only be done with
the Grundfos PC Tool WW Controls:
"Connected": A client has established a socket connection.

The system is ready for TCP/IP data exchange (or already
exchanging data).
Authentication: "Normal"/"Secure" (only used by some service

providers) (default is "Normal").
Total GPRS data sent (in kb).
Total GPRS data received (in kb).
Roaming: "Enabled"/"Disabled" (default is "Disabled").
IP address (e.g. 218.214.34.201).
Modbus TCP port number (default 502).
GENIpro port number (default 49152).
The same display also supplies statistical information about SMS

messages, call-up connections and GSM signal strength.
Other relevant settings in the CU 36X:

SCADA PIN code.

Modbus RTU telegram
Slave ID
Func
code ID
Modbus application program header

Transaction ID
Protocol ID
Length
Modbus TCP/IP data

Unit ID
Modbus TCP/IP application data unit

Fig. 20 Modbus TCP telegram
58
Data
Func
code ID
Data
CRC
TM04 4907 2209
English (GB)
11.9.2 Installation
1. The CIM 250 locates the GSM/GPRS service. The connection

state changes from "Detached" to "Attached".
2. The CIM 250 attempts to connect to the APN it has been
given and requests an IP address. The base station looks
through its record of legal SIM cards and finds the IP address
(the address associated with this SIM card) to assign to the
CIM 250. After the CIM 250 has got the IP address, the
connection state changes to "Context active".
3. The CIM 250 is now ready for a client (e.g. SCADA system) to
establish a socket connection and begin TCP/IP data
exchange. When a client connects the CU 36X, the
connection state will change to "Connected", and the GSM
status LED1 will indicate when data transfer takes place.
Note
When no GPRS data is being transferred, the

connection states "Attached", "Context active"
and "Connected". All show the same LED1 status
(short pulse).
A client, e.g. SCADA, establishes connection to a CU 36X by

specifying the IP address and the TCP port 502. Data transfer is
always initiated from the client in the form of a Modbus TCP
telegram embedded in a TCP/IP frame and directed to TCP port
502. To the client software, the connection to the CU 36X is
completely transparent.
The protection against unauthorised data access is high.
The access to the GSM network from the internet can only take
place via the VPN tunnel. See fig. 22. Moreover, data transfer
requires a Modbus master client, knowledge of the Modbus
functional profile and the use of a SCADA PIN code, if enabled.
The CIM 250 supervises the GPRS/GSM system to ensure that it
is still working. An automatic procedure ensures restarting of the
CIM 250 and repetition of the GPRS connection sequence in case
a deadlock situation has occurred. It also closes down socket
connections that are left open by the client and unused for more
than 24 hours.
It is possible to use SMS communication while GPRS
communication is active. However, in the "Connected" state the
delay time between reception and reply will increase.
If the connection state is different from "Connected", it is possible
to establish a call-up connection. When the call-up connection is
established, GPRS data exchange will be blocked until the call-up
is terminated by the caller.
A total of three Modbus clients can be connected to the Modbus
TCP port of the CU 36X and communicate simultaneously.
Each connection, called a socket connection, is handled
independently.
VPN tunnel
LAN
If all three sockets are used simultaneously, a "Silence timeout" of

only 5 minutes is used to prevent a complete occupation for a
long time.
If an alarm appears in the Dedicated Controls wastewater system
and the SCADA call-back function in the CU 36X has been
enabled in general and also enabled for this particular alarm, the
CIM 250 will attempt to establish a GPRS connection to the
SCADA system.
If the GPRS connection state is "Connected" (one or more socket
connections are established), the call-back function in the
CU 36X will use the GPRS connection and perform a GPRS callback to all clients connected to port 502. Otherwise it will use a
standard GSM call-back. See section 11.7 GSM call-back
connection.
A common standard for call-back via GPRS does not exist. In the
CU 36X, this function is implemented as a Modbus TCP write
telegram sent from the CIM 250. See fig. 21.
0x00
Protocol ID
0x00
0x00
Length
0x06
Slave address
Selected slave address,

The
selectedvalue
slave
0xE7 shown
is default
Function code
singlesingle
register
registe
0x06 WriteWrite
GRE router
0x01
Register address
0x00
0xFF00
0xFF00 writte
0xFF ValueValue
written to register
0x00 0x0001
Value to write
Fig. 21 Modbus TCP telegram used for call-back via GPRS

The call-back telegram is a "Write single register" function that
writes the value of 0x00FF to a specific register address in the
Modbus TCP master. Which register address to write to can be
programmed in the ScadaGprsCallBackRegister (register 00007).
In fig. 22 the address is 0x0001. The Modbus TCP master must
interpret this as a call-back request from the CU 36X and start
polling for data within one minute, otherwise the Modbus TCP
write telegram will be resent.
The SCADA system must complete its communication with the
CIM 250 by issuing a call-back acknowledgement.
If call-back is to be used, the SCADA system software (Modbus
GSM operator
Internet
SCADA system
value
of theof the
Has
the value
0x** Has the
latest transaction ID
0x** minus 10
Transaction ID
GRE router
GSM network
Base station APN
CIM 250 GSM

module installed
"Static"
User
Clients
Setup/status
TM04 4908 2209
IP address
PC Tool, etc.
Fig. 22 GPRS via VPN tunnel
59
English (GB)
When powering on a CU 36X with the correct GSM/GPRS setting,

the following GPRS connection sequence will take place:
TM04 4909 2809
11.9.4 Operation
4. The Modbus master raises the interlock bit

PitControl.InterlockPit (register 00101, bit 3), which will bring
the CU 36X into "interlock" mode. An interlock timeout is
initiated, corresponding to the current value of the
InterlockTimeout (register 00226) in the Modbus profile.
CIM 250
Modbus
st
te reque
TCP wri
Silence
timeout after 1
min. Modbus
TCP request
will be
retransmitted.
Note
Modbu
s TCP
CallBa
ckAck
Internal
acknowledge
of Call-back.
Ready for new
Call-back.
TM04 4910 2209
GPRS data exchange
Fig. 23 GPRS call-back sequence

Relevant settings in the CU 36X:
SCADA call-back enabled.
Settings > Alarm settings > System alarms >
SCADA call-back for particular alarms.
11.10.1 Interlocking from SCADA system via GSM/GPRS

Interlocking can be done from a Modbus master (like a SCADA
system) via the Modbus interface.
SCADA PIN code (if PIN code protection is used).
SCADA PIN code enabled/disabled.
Settings > Communication settings > Interlock settings >

Incoming interlock enabled.
For further information, see installation and operating instructions

for Dedicated Controls.
Interlocking procedure
1. The Modbus master (e.g. SCADA system or PLC) writes the
correct SCADA PIN code to the ScadaPinCode (register
00109) if PIN code protection is enabled.
Note
The SCADA system can verify that write access is

granted by reading the PitStatus.WriteAccess
(register 00202, bit 5) which will be logical 1 if
write access is granted.
2. The CU 36X Modbus slave verifies that the written

ScadaPinCode (register 00109) register value corresponds to
the SCADA PIN code entered by the user (CU 36X or PC Tool
WW Controls). If the codes match, the slave will accept data
writing from SCADA.
3. The Modbus master writes the InterlockTimeout
(register 00226) if this value should be controlled from the
master application. If it is not written, the existing value will be
used.
SCADA
5. The Modbus master can any time bring the CU 36X Modbus
slave back into "Auto" mode by raising the PitControl.AutoPit,
register 00101, bit 4.
11.10.2 Interlocking from another controller via SMS
Figure 11.13 illustrates the CU 36X SMS interlocking mechanism.
The CU 36X interlock master issues an SMS command
containing a 4-digit PIN code "pppp" matching the SMS PIN code
of the interlock slave CU 36X. Following the PIN code is the
interlock command "INTERLOCK" with an interlock timeout value
mmmm counting in minutes. Timeout values allowed: 1-1440 min.
(= 24 hours).
If the interlock is accepted (correct PIN code, correct command
and valid interlock timeout value), the interlock slave will change
its operating mode to "Interlock control".
The SMS PIN code in the interlock SMS command is optional if
the authentication method is "Both" and the interlock master
phone number is present in the interlock slave SMS phone
number list.
11.10 Interlocking
Whenever a rising edge PitControl.InterlockPit is

generated, the interlock timeout will be
reinitialised with the value of the InterlockTimeout
register. This is used to prolong an interlock
mode.
The interlock timeout value, however, is always optional. If it is

not included, the previously received value will be used.
By issuing the "Auto" command, the interlock master can instantly
terminate interlocking: "pppp AUTO".
The function of interlocking by SMS has the natural consequence
that interlocking is also possible via a mobile phone. In this case,
the user will be able to see the acknowledgement SMS (positive
or negative) replied back from the CU 36X.
The CU 36X interlock master can interlock up to three CU 36X
interlock slaves, each represented by a set of parameters that
have to be configured in the master for each of them.
Interlock, pit 1 >
Outgoing interlock slave phone number
Outgoing interlock SMS PIN code
Outgoing interlock SMS PIN code enabled
Outgoing interlock timeout.
The interlock slave has to be configured as described in the

installation and operating instructions for Dedicated Controls.
Settings > Communication settings > SMS authentication >
SMS PIN code pppp
SMS authentication method ("Via phone number", "Via PIN

code", "Both" or "None").
Incoming interlock enabled.
Modbus telegram(s)
ScadaPinCode
InterlockTimeout
PitControl.InterlockPit
CU 36X
User
SCADA PIN code
SCADA PIN code E/D
Modbus replies
"acknowledge"
Fig. 24 Interlocking from SCADA
60
Incoming interlock enabled
TM04 4911 2209
ScadaGprsCallBackRegister
English (GB)
GSM network,
e.g. SCADA
Interlock slave
Interlock master
Outgoing interlock slave phone number

Outgoing interlock SIM PIN code
Phone number
CU 36X
English (GB)
For each interlock slave:
pppp INTERLOCK mmmm

Interlock command SMS
Phone no
CU 36X
Outgoing interlock SMS PIN code enabled

Outgoing interlock timeout
TM04 4912 2209
INTERLOCKED
SMS acknowledgement
Incoming interlock enabled

SMS PIN code
SMS authentication method
Fig. 25 Interlocking from another controller
11.11 Real-time clock
11.12 Event simulation
The real-time clock can be set and/or read from the CU 36X in
two ways: Unix format or standard format.
It is possible to simulate alarm/warning events by writing

appropriate values to the following registers:
All time stamps in the event log and in the data log are also Unix
time format. Read the time with UNIXRealTimeClockHI
(register 00228) and UNIXRealTimeClockLO (register 00229), or
set a new time with SetRealTimeClockHI (register 00112) and
SetRealTimeClockLO (register 00113). The new time will be
activated in the CU 36X when writing the LO-order register. It is
recommended to write the HI/LO registers in the same telegram.
SimulationEventCode (register 00701)
SimulationEventSource (register 00702)
11.11.1 Unix time format

For further information, see
http://www.devshed.com/c/a/Administration/UNIXTime_Format_Demystified/1/
http://www.epochconverter.com/
11.11.2 Standard format

In the standard format, there are registers for specifying second,
minute, hour, day, month and year (year, offset by 2000) in a
human-readable way. With registers from 00230 to 00235 the
actual values can be read, and with registers 00114 to 00119 new
values can be set. The new values will be activated when writing
the value "1" to SetRtc (register 00120, bit 0).
SimulationEventDeviceNo (register 00703)
SimulationEventActionType (register 00704).
Afterwards it is possible to trigger the simulated event via

SimulationActivate (register 00705, bit 0). The event recording
will take place as if the event was real, but the system operation
will not be influenced.
The SimulationStatus (register 00706, bit 0) can be used to check
if event simulation is active. If the bit value is 0, there is no active
alarm simulation.
By writing a '0' to SimulationEventCode (register 00701) and
afterwards setting the SimulationActivate (register 00705, bit 0)
control bit, the simulated event is cancelled. It can also be
cancelled with the PitControl.ResetAlarm (register 00101, bit 0)
control bit.
Event simulation procedure
Write a valid event code (see section 9.13 Alarm simulation

register block) to SimulationEventCode (register 00701).
Write an event source number (see section 9.13 Alarm

simulation register block) to SimulationEventSource (register
00702).
Write a device number (see section 9.13 Alarm simulation

register block) to SimulationEventDeviceNo (register 00703).
Write an action type number (see section 9.13 Alarm

simulation register block) to SimulationEventActionType
(register 00704).
Activate the alarm simulation with the above settings by

writing 1 to SimulationActivate (register 00705, bit 0).
61
11.13 Alarms and warnings
English (GB)
These registers reflect the actual alarm/warning conditions of the

pit or the pump. Alarms/warnings which have acknowledgement
type "Auto-ack", will be cleared automatically when normal
conditions are restored. Alarms/warnings which have
acknowledgement type "Manual-ack", require a
PitControl.ResetAlarm command to be cleared.
Note
Warnings use the same bit interpretation as

alarms.
Description
Data item
Code
Event source
Pit alarms 1 (register 00210)

Overflow alarm
PitAlarms1.0
192
System
High-level alarm
PitAlarms1.1
191
System
System
Alarm level alarm
PitAlarms1.2
190
Dry-running alarm
PitAlarms1.3
57
System
Mains supply fault
PitAlarms1.4
System
Level float switch sequence inconsistency
PitAlarms1.5
205
System
Inconsistency between float switches and sensor
PitAlarms1.6
204
System
Signal fault, level/pressure sensor
PitAlarms1.7
168
AI (level sensor)
Signal fault, flow sensor
PitAlarms1.8
169
AI (flow sensor)
Signal fault, power meter sensor
PitAlarms1.9
186
AI (power sensor)
Fault, mixer contactor feedback
PitAlarms1.10
221
DI (mixer contactor)
Communication fault, I/O module
PitAlarms1.11
226
IO 351B
CIM fault (Communication Interface Module)
PitAlarms1.12
159
Add-on CIM module
SIM card fault
PitAlarms1.13
160
Add-on CIM module
Communication fault, main system (SCADA)
PitAlarms1.14
15
System
Power-on notice
PitAlarms1.15
247
System
Fault, battery/UPS
PitAlarms2.0
248
Battery/UPS
Hardware fault, type 1
PitAlarms2.1
72
CU 36X/IO 351B
Ethernet: No IP address from DHCP server
PitAlarms2.2
231
System
Ethernet: Auto-disabled due to misuse
PitAlarms2.3
232
System
Time for service, mixer
PitAlarms2.4
222
Mixer
Maximum number of mixer starts per hour exceeded
PitAlarms2.5
223
System
User-defined relay activated
PitAlarms2.6
246
CU 36X
External fault signal
PitAlarms2.8
System
Combi alarm No 1
PitAlarms2.9
227
System
Combi alarm No 2
PitAlarms2.10
227
System
Combi alarm No 3
PitAlarms2.11
227
System
Combi alarm No 4
PitAlarms2.12
227
System
Signal fault, user-defined sensor 1
PitAlarms2.13
188
User-defined sensor, analog input 1
PitAlarms2.14
188
PitAlarms2.15
188
PitAlarms3.0
168
AI (Pressure sensor)
Water on floor alarm
PitAlarms3.1
229
System
Gas detected alarm
PitAlarms3.2
235
System
Uster event 1 alarm
PitAlarms3.3
249
System
Uster event 2 alarm
PitAlarms3.4
250
System
Uster event 3 alarm
PitAlarms3.5
251
System
Uster event 4 alarm
PitAlarms3.6
252
System
RESERVED
PitAlarms3.7-15
62
Data item
Code
Event source
English (GB)
Description
Pump alarms 1 (registers 00423 (pump 1), 00473 (pump 2), 00523 (pump 3), 00573 (pump 4), 00623 (pump 5), 00673 (pump 6))
Motor temperature alarm, PTC1
PumpAlarms1.0
69
IO 111, pump No [1; 6]
Motor temperature alarm, PTC2
PumpAlarms1.1
70
IO 351B/MP 204, pump No [1; 6]
Motor stator temperature high (T1, Pt1000/Pt100)
PumpAlarms1.2
64
IO 111, pump No [1; 6]
Motor stator temperature high (T2, Pt1000/Pt100)
PumpAlarms1.3
71
MP 204, pump No [1; 6]
Motor support bearing temperature high (Pt100)
PumpAlarms1.4
145
IO 111, pump No [1; 6]
Motor main bearing temperature high (Pt100)
PumpAlarms1.5
146
IO 111, pump No [1; 6]
Motor insulation resistance low
PumpAlarms1.6
20
IO 111, pump No [1; 6]
Motor low voltage (no voltage)
PumpAlarms1.7
40
MP 204, pump No [1; 6]
Motor high voltage
PumpAlarms1.8
32
MP 204, pump No [1; 6]
Motor phase sequence reversal
PumpAlarms1.9
MP 204, pump No [1; 6]
Motor overload (maximum current)
PumpAlarms1.10
48
AI/MP 204, pump No [1; 6]
Motor underload (minimum current)
PumpAlarms1.11
56
AI/MP 204, pump No [1; 6]
Motor protector test trip
PumpAlarms1.12
27
DI/MP 204, pump No [1; 6]
Motor missing phase
PumpAlarms1.13
MP 204, pump No [1; 6]
Motor current asymmetry
PumpAlarms1.14
111
MP 204, pump No [1; 6]
Load continues even if the motor relay is off
PumpAlarms1.15
26
MP 204, pump No [1; 6]
Motor protector commanded (test) trip
PumpAlarms2.0
18
MP 204, pump No [1; 6]
Common phase error
PumpAlarms2.1
241
DI, pump No [1; 6]
Motor moisture switch
PumpAlarms2.2
22
IO 111, pump No [1; 6]
Motor/pump vibration high
PumpAlarms2.3
24
IO 111, pump No [1; 6]
Motor water-in-oil content too high (water in oil)
PumpAlarms2.4
11
AI/IO 111, pump No [1; 6]
Motor fault in mains supply
PumpAlarms2.5
DI, pump No [1; 6]
Motor contactor feedback fault
PumpAlarms2.6
220
DI, pump No [1; 6]
Motor max. starts per hour limit exceeded
PumpAlarms2.7
21
System, pump No [1; 6]
Motor operating time service limit exceeded
PumpAlarms2.8
12
Pump No [1; 6]
Too many pump auto-restarts (per 24 h)
PumpAlarms2.9
MP 204, pump No [1; 6]
Pump low flow
PumpAlarms2.10
58
Pump No [1; 6]
Pump max. continuous runtime limit exceeded
PumpAlarms2.11
245
System, pump No [1; 6]
Motor cos too high
PumpAlarms2.12
112
MP 204, pump No [1; 6]
Motor cos too low
PumpAlarms2.13
113
MP 204, pump No [1; 6]
Pump malfunction due to auxiliary component fault
PumpAlarms3.0
224
Pump No [1; 6]
Communication fault, pump module
PumpAlarms3.1
225
IO 111, pump No [1; 6]
On/Off/Auto switch fault
PumpAlarms3.2
244
DI, pump No [1; 6]
Signal fault, Pt100 sensor
PumpAlarms3.3
175
IO 111/MP 204, pump No [1; 6]
Signal fault, PTC sensor
PumpAlarms3.4
181
IO 111, pump No [1; 6]
Signal fault, water-in-oil (WIO)
PumpAlarms3.5
170
AI, pump No [1; 6]
Signal fault, bearing temperature sensor (Pt100),

general or top bearing
PumpAlarms3.6
179
IO 111, pump No [1; 6]
Signal fault, bearing temperature sensor (Pt100),

middle bearing
PumpAlarms3.7
180
IO 111, pump No [1; 6]
Communication fault, pump
PumpAlarms3.8
10
IO 111, pump No [1; 6]
Setup conflict
PumpAlarms3.9
25
IO 111, pump No [1; 6]
General hardware fault
PumpAlarms3.10
72
IO 111/MP 204, pump No [1; 6]
Signal fault, motor current sensor
PumpAlarms3.11
88
AI, pump No [1; 6]
Inrush fault
PumpAlarms3.12
155
CUE, pump No [1; 6]
Signal fault, sensor 2
PumpAlarms3.13
93
CUE, pump No [1; 6]
Motor bearing temperature high (Pt100) in drive end

(DE)
PumpAlarms3.14
148
CUE, pump No [1; 6]
Motor bearing temperature high (Pt100) in non-drive

end (NDE)
PumpAlarms3.15
149
CUE, pump No [1; 6]
63
English (GB)
Description
Data item
Code
Event source
Leakage current
PumpAlarms4.0
CUE, pump No [1; 6]
Signal fault, temperature 3 sensor
PumpAlarms4.1
176
CUE, pump No [1; 6]
Signal fault, (feedback) sensor 1
PumpAlarms4.2
89
CUE, pump No [1; 6]
Overcurrent
PumpAlarms4.3
49
CUE, pump No [1; 6]
Motor current protection activated
PumpAlarms4.4
55
CUE, pump No [1; 6]
Change bearings
PumpAlarms4.5
30
CUE, pump No [1; 6]
Lubricate bearings
PumpAlarms4.6
240
CUE, pump No [1; 6]
Automatic motor model recognition failed
PumpAlarms4.7
242
CUE, pump No [1; 6]
Communication fault, twin-head pump
PumpAlarms4.8
77
CUE, pump No [1; 6]
PumpAlarms4.9
91
CUE, pump No [1; 6]
Dry running
PumpAlarms4.10
57
CUE, pump No [1; 6]
VFD not ready
PumpAlarms4.11
213
IO 351B, pump No [1; 6]
Other
PumpAlarms4.12
16
CUE, pump No [1; 6]
64
12. Modbus RTU telegram examples

Note
CRC fields are not shown in the following

examples.
Field
Value
Address
0x01
Function code
0x03
Note
The Modbus data model states that registers

numbered X are addressed in telegrams as X - 1,
e.g. register 00104 (setpoint) is addressed as
00103 in a Modbus telegram.
Byte count
0x06
12.1 Modbus telegram overview

The maximum size of a Modbus RTU telegram is 256 bytes.
Telegrams must be separated by a silent interval of at least
3.5 character times.
The standard Modbus RTU telegram format is shown in the table
below.
Slave
address
Function
code
Data
CRC
1 byte
1 byte
0 to 252 bytes
2 bytes
A telegram starts with the slave address occupying one byte.

Then comes a variable-size data field. For each telegram, a CRC
is calculated and appended to the telegram (two bytes total).
All bytes in the telegram, except for the CRC itself, are included
in the check.
Note
The CRC bytes are not shown in the examples in

the following sections.
Register 108 HI
0x00
Register 108 LO
0x01
Register 109 HI
0x00
Register 109 LO
0x01
Register 110 HI
0x00
Register 110 LO
0x01
English (GB)
Example of response from slave to master
In the response, the byte count is six since there are three
registers of two bytes. All three registers hold the value of
0x0001.
12.3 Read input registers (0x04)

This function is used for reading input registers from the slave.
Input registers are read-only registers by definition. The request
telegram specifies the starting address (the address of the first
register to be read) and the number of holding registers to read.
In the telegram, register addresses start from zero, meaning that
registers numbered 0-16 are addressed as 0-15.
The register data in the response message are packed two bytes
per register. For each register, the first byte contains the highorder bits while the second byte contains the low-order bits.
Example of request from master to slave
12.2 Read holding registers (0x03)

This function is used for reading holding registers from the slave.
The request telegram specifies the starting address (the address
of the first register to be read) and the number of holding
registers to read. In the telegram, register addresses start from
zero, meaning that registers numbered 0-16 are addressed as
0-15.
The register data in the response message are packed two bytes
per register. For each register, the first byte contains the highorder bits while the second byte contains the low-order bits.
Field
Value
Address
0x01
Function code
0x04
Start address HI
0x10
Start address LO
0x10
Quantity HI
0x00
Quantity LO
0x03
Value
In the request, the slave with address 1 is asked to deliver three

contiguous registers starting from address 0x1010 = 4112
(meaning register 4113).
Address
0x01
Function code
0x03
Start address HI
0x00
Start address LO
0x6B
Address
0x01
Quantity HI
0x00
Function code
0x04
Quantity LO
0x03
Byte count
0x06
Field
In the request, the slave with address 1 is asked to deliver three

contiguous registers starting from address 0x006b = 107
(meaning register 108).
Field
Value
Register 4113 HI
0x22
Register 4113 LO
0x22
Register 4114 HI
0x22
Register 4114 LO
0x22
Register 4115 HI
0x22
Register 4115 LO
0x22
In the response, the byte count is six since there are three
registers of two bytes. All three registers hold the value of
0x2222.
65
English (GB)
12.4 Write single register (0x06)
12.5 Write multiple registers (0x10)
This function is used for writing a single holding register in the

slave. The request telegram specifies the address of the register
that is to be written. Register addresses start from zero, meaning
that a register numbered 10 is addressed as 9.
This function is used for writing a block of contiguous holding

registers in the slave. Register addresses start from zero,
meaning that a register numbered 100 is addressed as 99.
The normal response is an echo of the request, indicating that the

value was written.
Field
Value
Address
0x01
Function code
0x06
Address HI
0x10
Address LO
0x00
Value HI
0xAF
Value LO
0xFE
In the request, the slave with address 1 is asked to write the

value of 0xAFFE to the register at address 0x1000.
Field
Value

Field
Value
Address
0x01
Function code
0x10
Start address HI
0x00
Start address LO
0x20
Quantity HI
0x00
Quantity LO
0x02
Byte count
0x04
Register 33 HI
0x00
Register 33 LO
0x01
Register 34 HI
0xB0
Register 34 LO
0xB0
In the request, the slave with address 1 is asked to write the

value of 0x0001 to the register at address 0x0020 and the value
of 0xB0B0 to the register at address 0x0021.
Address
0x01
Function code
0x06
Address HI
0x10
Field
Address LO
0x00
Address
0x01
Value HI
0xAF
Function code
0x10
Value LO
0xFE
The response is an echo of the request.

Value
Start address HI
0x00
Start address LO
0x20
Quantity written HI
0x00
Quantity written LO
0x02
The response returns the function code, starting address and

quantity of registers written.
66
12.7 Diagnostics register interpretation
This function provides a test for checking the communication

system between the master and the Grundfos slave. It contains a
single-byte subcode to identify the test to be performed.
The diagnostics register is interpreted as follows:
The following subcodes are supported:
0x01
Bit Description
0
Communication failure (with the Grundfos product).
EEPROM self-test failed (the test is carried out when

system is booted).
Return query data

Data in this request are to be echoed in the
response. The response must be identical to the
request, so this function is often used to verify
Modbus communication.
Grundfos product not supported.
Modbus address offset is different from default value, i.e. it

differs from 0.
Using software-defined Modbus transmission speed.
Restart communications
All communication counters are cleared, and the
device is restarted.
RESERVED
RESERVED
RESERVED
RESERVED
RESERVED
Subcode Name
0x00
English (GB)
12.6 Diagnostics (0x08)
0x02
Return diagnostics register

Returns the 16-bit diagnostics register. See section
12.7 Diagnostics register interpretation.
0x04
Force listen only

Forces the device into listen-only mode. This
effectively mutes the device, making it unable to
communicate on the network. To bring the device
back to normal mode, a "Restart communications"
command (code 0x08, subcode 0x01) must be
issued.
0x0A
Clear counters and diagnostics register

Clears all counters and the diagnostics register
(these are also cleared on power-up/restart).
0x0B
Return bus message count

Returns the number of messages detected by the
slave.
0x0C
Return bus CRC error count

Returns the number of CRC errors in the slave.
0x0D
Return bus exception count

Returns the number of Modbus exception responses
that the slave has transmitted.
0x0E
Return slave message count

Returns the number of messages that the slave has
processed.
0x0F
Return slave no response count

Returns the number of messages for which the
slave has sent no response.
0x12
Return bus character overrun count

Returns the number of overruns in the slave.
0x14
Clear overrun counter

Clears the overrun counter (this is also cleared on
power-up/restart).
10 RESERVED
11 RESERVED
12 RESERVED
13 RESERVED
14 RESERVED
15 RESERVED
A bit value of 1 means true, unless otherwise specified.
The diagnostics register is read using function code 0x08 and
subcode 0x02.

Field
Value
Address
0x01
Function code
0x08
Subcode
0x00
Data
0xAB
Data
0xCD
The response is identical to the request.

Field
Value
Address
0x01
Function code
0x08
Subcode
0x00
Data
0xAB
Data
0xCD
67
English (GB)
13. Application example

Pit operation
Pit status
Pump 1
Pump 2
Setup
Event log
Hour log
Data log
Alarm/warning
Grey
47.9 m 3/h
Pump OK.
Yellow
Pump warning.
Red
Pump alarm (device alarm or monitoring fault).
Run/stop
High level
Start 2
S
Grey
Pump not running.
Green
Pump running.
Manual
Start 1
Stop
Dry run
4.24 m
S
1
Switch.
Display.
Remote.
Setup:
Opens a display for configuration of all the control levels.
Event log:
Opens a display for viewing the SCADA event log.
Hour log:
Opens a display for viewing the hourly logged values 3 days backwards.
Data log:
Opens a display for viewing the configurable data log series.
Crossover: The pump has been disabled.

Pump 1
Pit status
Operating mode: Start from switch
Pit operation
Water level
XX.XX m
Operating mode:
Average flow
XXX.X m3/h
Pit depth
XX.XX m
Interlock from SCADA
Latest flow
XXXXX m3/h
Actual flow
XXX.XX m3/h
Average flow
XXX.XX m3/h
Starts total
XXXXX
Power
XXX.XX kW
Custom relay
Auto
Interlock
Starts yesterday
XXXXX
Energy total
XXXXXX kWh
Starts today
XXXXX
Energy yesterday
XXXXXX kWh
Starts per hour
XXXXX/h
Energy today
XXXXXX kWh
Time
Specific energy
XX.XXX kWh/m3
Feb 26 2008 08.20
Opr. time total
XXXXX/h : XX min. Operating time
XXXXX h : XX min.
Opr. time yesterday
XXXXX/h : XX min. Volume total
XXXXX m3
Opr. time today
XXXXX/h : XX min. Volume yesterday
XXXXX.X m3
Latest opr. time
XXXXX/h : XX min. Volume today
XXXXX.X m3
Time to service
XXXXX/h
XXX.X /h
Mixer starts per hour
Motor
Overflow
Temperature
XXX C
XXXXX m3
Total volume
Actual current
XXX.X A
Overflow time
XXXXX h
Latest current
XXX.X A
Number of overflows
XXXXX
Water in oil
XX.X %
Overflow volume yesterday
XXXXX m3
Overflow time yesterday
XX h : XX min.
No. of overflows yesterday
XXX
Overflow volume today
XXXXX m3
Overflow time today
XX h : XX min.
Active alarms/warnings
No. of overflows today
XXX
Alarms
Opr. time, simultaneous opr. of two pumps
Remote pump control

Stop
Start
Auto
None
50 %
Warnings
Water-in-oil sensor signal fault
1 2
Total
Active alarms/warnings
Alarms
None
Warnings
None
Fig. 26 Application example
68
1 2
Yesterday
ON
Alarm ack.
Set time..
Off
Pump object graphics (the shown register addresses are for

pump 1):
13.2 Main status

13.2.1 Pit operation display
Presence (pump object drawn or not)

Pump#Status.Presence (register 00401, bit 0)
Note
Disabled (cross marking) Pump#Status.

Disabled (register 00401, bit 11)
Pumping mode (Running = green, Stopped = grey)
Pump#Status.Running (register 00401, bit 1).
Pump top colour (the shown register addresses are for

pump 1):
Red if an alarm is present in Pump#Status.Alarm (register
00401, bit 4) or a monitoring fault (fault in auxiliary device) in
Pump#Status.MonitoringFault (register 00401, bit 2)
Operating mode: OperatingMode (register 00203 [enum]).
The "Interlock" button will issue the PitControl.InterlockPit

(register 00101, bit 3) command, which brings the pit into
operating mode "Interlocked", and the "Auto" button will issue
the PitControl.AutoPit (register 00101, bit 4) command, which
brings it back into one of the automation modes.
The "Alarm Ack" button will issue the PitControl.ResetAlarm

(register 00101, bit 0) command, which will clear any alarm/
warning indication (not logs) which does not represent a
present alarm/warning condition, and will make the system
assume automation control without any autoacknowledgement delay.
The "Custom relay" buttons are "radio buttons". Selecting "On"

will issue the value 1 to data item SetCustomRelay
(register 00102), and selecting "Off" will issue the value 0.
Time (real-time clock in the CU 36X control unit):
Yellow if a warning is present in

Pump#Status.Warning (register 00401, bit 3)
Grey if everything is OK for the pump in question.
Pump control source (the shown register addresses are for

pump 1): Pump#ControlSource (register 00402 [enum]).
Letter marking of pump icon:
Auto = no marking
Switch = "S"
Display = "D"
Reading and displaying the time is done by using

RealTimeClockHI/LO (register 00228/00229 [unix time]) or
RtcSecond (register 00230), RtcMinute (register 00231),
RtcHour (register 00232), RtcDay (register 00233),
RtcMonth (register 00234), RtcYear (register 00235) if this
time format is preferred.
Remote = "R".
Number of float switches: NumberOfFloatSwitches

(register 00217).
Function of float switches 1 to 5:

FloatSwitch1Function (register 00219 [enum])
The "Set time" button opens a dialogue that can write the
data item SetRealTimeClockHI/LO (register 00112/00113
[unix time]).

FloatSwitch5Function (register 00223 [enum]).
13.2.2 Pit status display
Displayed switch position:
Water level: PitWaterLevel (register 00301 [0.01 m]).
Switch on (1) = up
Pit depth: PitDepth (register 00303 [0.01 m]).
Switch off (0) = down.
Actual flow: PitFlowOut (register 00306 [0.1 l/s]).
Value of float switches 1 to 5: FloatSwitchesStatus

(register 00218).
Average flow: PitAverageFlowOut (register 00307).
Total power consumption: PitPowerHI/LO

(register 00308/00309 [1 W]).
Total energy consumption: PitEnergyHI/LO

(register 00310/00311 [0.1 kWh]).
Energy consumption yesterday: PitEnergyYesterday

(register 00312 [0.1 kWh]).
Energy consumption today: PitEnergyToday

(register 00313 [0.1 kWh]).
Total pumping efficiency: PitSpecificEnergy

(register 00314 [1 Wh/m3]).
Total operating time: PitOperatingTimeHI/LO

(register 00329/00330 [1 min.]).
Total pumped volume: PitPumpedVolumeHI/LO

(register 00315/00316 [0.1 m3]).
Pumped volume yesterday: PitPumpedVolumeYesterday

(register 00317 [0.1 m3]).
Pumped volume today: PitPumpedVolumeToday

(register 00318 [0.1 m3]).
Number of mixer starts per hour: PitMixerStartsPerHour

(register 00319).
Total overflow volume: PitOverflowVolume (register 00320

[0.1 m3]).
Overflow volume yesterday (24 h):

PitOverflowVolumeYesterday (register 00321 [0.1 m3]).
Overflow volume today: PitOverflowVolumeToday

(register 00322 [0.1 m3]).
Type of level and flow measurements: PitSensors

(register 00224 [enum]).
Water level: PitWaterLevel (register 00301 [0.01 m]) shown as

a level sensor value and as a drawing of the water surface. If a
level sensor is not present, the level can be expressed relative
to the position of the installed float switches:
PitSwitchWaterLevel (register 00302 [enum]).
Before trying to operate the CU 361 control unit,

remember to write the ScadaPinCode
(register 00109) if PIN code protection has been
enabled.
Flow value:
PitFlowOut (register 00306 [0.1 l/s]) or
PitAverageFlowOut (register 00307 [0.1 l/s]).
69
English (GB)
13.1 Adaptation of pit graphics to installation values
Total overflow time: PitOverflowTime (register 00323 [1 min.]).
Overflow time yesterday (24 h): PitOverflowTimeYesterday

(register 00324 [1 min.]).
Latest operating time: Pump1LatestOprTime

(register 00410 [1 s]).
Overflow time today (24 h): PitOverflowTimeToday

Time to service: Pump1TimeToServiceHI/LO

(register 00406/00407 [1 min.]).
Total number of overflows: PitOverflowCounter

(register 00326).
Motor temperature: Pump1MotorTemperature1

(register 00429 [1 C]).
Motor current:
Number of overflows yesterday (24 h):

PitOverflowCounterYesterday (register 00327).
Number of overflows today (24 h): PitOverflowCounterToday

(register 00328).
One-pump operating time: (Pump1OprTimeHI/LO +

Pump2OprTimeHI/LO - Pit2PumpsOprTimeHI/LO).
Two-pump operating time (two pumps operating

simultaneously): Pit2PumpsOprTimeHI/LO
(register 00331/00332 [1 min.]).
Pump1Current (register 00418 [0.1 A])

Pump1LatestCurrent (register 00419 [0.1 A]).
Motor, water in oil: Pump1WaterInOil (register 00422 [0.1 %]).
Commanding the pumps (Manual from Remote):

Stop will issue the value PitPump1Control
(register 00103 [enum]) = 2, which brings the pump into
operating mode Stop from Remote.
Start will issue the value PitPump1Control
(register 00103 [enum]) = 1, which brings the pump into
operating mode Start from Remote.
One-pump operating time yesterday (24 h):

(Pump1OprTimeYesterday + Pump2OprTimeYesterday Pit2PumpsOprTimeYesterday).
Two-pump operating time yesterday (two pumps operating
simultaneously): Pit2PumpsOprTimeYesterday
Auto will issue the value PitPump1Control

(register 00103 [enum]) = 0, which brings the pump back
into its previous state.
Calculation of relative operating times:
See fig. 27 for logic and priority for the pump control, and note
that the control sources "Switch" and "Display" have higher
priority than Remote.
1 pump = (Pump1OprTimeHI/LO + Pump2OprTimeHI/LO Pit2PumpsOprTimeHI/LO) / PitOperatingTimeHI/LO

(register 00329/00330)
2 pumps = Pit2PumpsOprTimeHI/LO / PitOperatingTimeHI/
LO.
Switch
Stop
Auto
Active alarms and warnings:

PitAlarms1 (register 00210 [bits])
Display
Stop
PitWarnings1 (register 00213 [bits])

Remote
PitWarnings2 (register 00214 [bits])
Stop
13.2.3 Pump status display
Automation
The data item registers mentioned below are for pump 1.

Adding 50 to the register addresses will give you the equivalent
register addresses for pump 2.
Control source (Auto, Switch, Display, Remote):

Pump1ControlSource (register 00402 [enum]).
Note
Start
Auto
PitWarnings3 (register 00215 [bits]).
Operating mode (Started, Stopped):

Pump1Status.Running (register 00401, bit 1).
Start
Auto
Start
Stop
Start
TM04 3680 4808
English (GB)
Fig. 27 Logic and priority for the pump control
The above information can be combined in a text

like "Operating mode" from "Control source".
Note
Before trying to operate the pumps, remember to

write the ScadaPinCode (register 00109) if PIN
code protection has been enabled.
Average flow: Pump1Flow (register 00416 [0.1 l/s]).
Latest measured flow: Pump1LatestFlow

(register 00417 [0.1 l/s]).
Total number of pump starts: Pump1StartCounterHI/LO

(register 00411/00412).
Pump1Alarms2 (register 00424 [bits])
Number of pump starts yesterday (24 h):

Pump1StartCounterYesterday (register 00413).
Pump1Warnings1 (register 00426 [bits])
Number of pump starts today: Pump1StartCounterToday

(register 00414).
Pump1Warnings3 (register 00428 [bits]).
Number of pump starts per hour: Pump1StartsPerHour

(register 00415).
Total operating time: Pump1OprTimeHI/LO

(register 00404/00405 [1 min.]).
Operating time yesterday (24 h): Pump1OprTimeYesterday

Operating time today: Pump1OprTimeToday

70
Active alarms and warnings:

Pump1Warnings2 (register 00427 [bits])
Overflow level: SetOverflowLevel (register 00121 [0.01 m]).
The blue bar at the top of the screen is used to open and close
specific displays that can show specific data and change settings
of the pit control system.
High level: SetHighLevel (register 00122 [0.01 m]).
Alarm level: SetAlarmLevel (register 00123 [0.01 m]).
Dry-running level: SetDryRunningLevel (register 00124

[0.01 m]).
Foam-draining level: SetFoamDrainingLevel (register 00125

[0.01 m]).
Start levels for pumps 1 and 2:
The descriptions below refer to fig. 26.
The "Pit operation" button opens the "Pit operation" display.
The "Pit status" button opens the "Pit status" display.
The "Pump 1" and "Pump 2" buttons open the "Pump 1" and
"Pump 2" displays.
The "Setup" button opens the display for showing and

changing all the pump control levels. It might look as shown
below.
SetStartLevelPump1 (register 00126 [0.01 m])

SetStartLevelPump2 (register 00128 [0.01 m]).
SetStopLevelPump1 (register 00127 [0.01 m])

SetStopLevelPump2 (register 00129 [0.01 m]).
Pumping control levels

Overflow level
Stop levels for pumps 1 and 2:
XXX cm
High level
XXX cm
Alarm level
XXX cm
Dry-running level
XXX cm
Foam-draining level
XXX cm
Pump 1
Cancel
Update
Pump 2
Start level
XXX cm
XXX cm
Stop level
XXX cm
XXX cm
Note
These registers only reflect the actual values if

the WriteSetup.ReadWriteSeparation
(register 00006) bit is set to 0. Otherwise, reading
back the actual values has to take place via the
corresponding read-only registers, e.g.
OverflowLevel (register 00240).
Note
Before trying to change the settings, remember

to write the ScadaPinCode (register 00109) if PIN
code protection has been enabled.
The "Event log" button opens the display for showing a

scrollable list of event records (alarms and warnings).
The event log in the CU 36X contains the 50 latest events with
the newest one at the top.
Each record takes up seven registers and has the following

format:
<ID> <Code> <Description> <Source> <Type> <Time stamp>
The complete event log takes up 7 x 50 = 350 registers and is
located in the register area register 06001 to 06351.
An Event log example is shown on page 71.
Event log
ID
Code Description
341
192
Overflow
342
192
Overflow
343
222
344
Motor insulation resistance low
Note
Source
Type
Time
System
Alarm appearing
05-08-2008 09:25
System
Alarm disappearing
05-08-2008 11:09
Mixer
Warning appearing
07-08-2008 02:38
Pump 2
Warning appearing
11-08-2008 08:24
The time stamp is in Unix time format. In the

display example, it has been converted to a
human-readable format.
71
English (GB)
Display bar
Hour log
The "Hour log" button opens the display for showing the hour
log. The table below illustrates the structure of the data in the
Modbus registers and a way of visualising them.
Hour
Data
Pit overflow time [min.]
Number of pit overflows
3]
Registers
71
72
02001-02072
02073-02144
12
34
02145-02216
Specific energy [Wh/m3]
240
262
198
308
287
02217-02288
Pumped volume [m3]
67
69
72
45
23
02289-02360
Energy consumption [0.1 kWh]
342
456
514
178
123
02361-02432
Operating time (two pumps

operating simultaneously) [min.]
20
48
02433-02504
Overflow volume [0.1 m
Pump 1, operating time [min.]
23
56
60
14
12
02793-02864
Pump 1, number of starts
02865-02936
Pump 1, average flow [0.1 l/s]
452
468
458
433
446
02937-03008
Pump 1, average current [0.1 A]
252
248
241
240
242
03009-03080
Pump 2, operating time [min.]
21
52
63
15
11
03081-03152
Pump 2, number of starts
03153-03224
Pump 2, average flow [0.1 l/s]
458
451
471
438
444
03225-03296
Pump 2, average current [0.1 A]
250
239
240
229
240
03297-03368
Data Log
The "Data log" button opens the display for showing the
configurable data log.
The illustrations in fig. 28 show a way of visualising the pit water

level, motor current for pump 1 and motor current for pump 2.
Pit water level
Start 2
Start 1
Stop
Time
Pump 1, motor current
Time
Pump 2, motor current
Time
Fig. 28 Data logging
72
TM04 3429 4408
English (GB)
English (GB)
14. Modbus function code overview

The supported function codes are shown in the table below:
Type
Code
03
16-bit data
(registers)
Diagnostics
Note
Hex
Name
0x03 Read holding registers
04
0x04 Read input registers
06
0x06 Write single register
16
0x10 Write multiple registers
08
08
Diagnostics
See section 12.6 Diagnostics
(0x08) for subcodes.
Reading or writing coils are not supported.
The same data are available in both holding registers and input
registers, meaning that either function (0x03 or 0x04) can be
used for reading data.
73
English (GB)
15. Modbus telegram examples
15.2 Reading the CIM configuration register block
Note
CRC fields are not shown in the following

examples.
Note
The Modbus data model states that registers

numbered X are addressed in telegrams as X - 1,
e.g. register 00104 (setpoint) is addressed as
00103 in a Modbus telegram.
15.1 Diagnostics: return query data

This function is useful to ensure that the communication path and
slave configuration are correct. It will echo the request in the
response.
In the example, slave address 0x01 is used.
Request from master to slave
This section shows how to read the CIM configuration register

block (a total of four registers).
Field
Value
Description
Slave address
0x01
Function code
0x04
Start address HI
0x00
Start address LO
0x00
Start address
= 0x0001
Quantity HI
0x00
Quantity LO
0x04
Number of registers
= 0x0004
Field
Value
Description
Field
Value
Description
Slave address
0x01
Slave address
0x01
Function code
0x08
Diagnostics
Function code
0x04
Subcode
0x00
Echo request
Byte count
0x08
8 bytes follow
Data
0xAB
Test data
00001 HI
0x0A
Data
0xCD
Test data
00001 LO
0x00
SlaveMinimumReplyDelay
= 0x000A (10 ms)
00002 HI
0x00
00002 LO
0x00
00003 HI
0x00
00003 LO
0x00
00004 HI
0x00
00004 LO
0x04

Field
Value
Description
Slave address
0x01
Function code
0x08
Diagnostics
Subcode
0x00
Echo request
Data
0xAB
Test data
Data
0xCD
Test data
If there is no response from the slave, see section

16.1.2 CIM 200 Modbus communication faults.
RegisterOffset
= 0x0000 (no offset)
Reserved value
= 0x0000
ModbusBitRate
= 0x0004 (19200, software-defined)

15.3 Reading the pit water level

This section shows how to read and interpret the water level of
the pit.
Field
Value
Description
Slave address
0x01
Function code
0x04
Start address HI
0x01
Start address LO
0x2C
Start address (00301)

= 0x012D
Quantity HI
0x00
Quantity LO
0x01
Number of registers
= 0x0001

Field
Value
Description
Slave address
0x01
Function code
0x04
Byte count
0x02
2 bytes follow
00301 HI
0x00
00301 LO
0xDC
Pit water level

= 0x00DC (220)
A pit water level value of 220 [0.01 m] equals a water level of

2.20 metres.
74
15.5 Setting pit auto mode
This section shows how to read and interpret the three alarm
registers of the pit. The pit alarms start at Modbus register
address 209 = 0x00D1.
This section shows how to set "Auto" mode in the CU 36X.
In the example, slave address 0x01 is used. Note that the register
is reset by the CIM 200 when the command has been
acknowledged. The value is only triggered on rising edge.
The register on address 00101 is set to the following:
Field
Value
Description
Bit
Description
0 (do not reset)
Slave address
0x01
Function code
0x04
0 (do not reset alarms)
Start address HI
0x00
0 (do not reset history)
Start address LO
0xD0
Start address (00209)

= 0x00D1
2
3
0 (do not reset event log)
Number of registers
= 0x0003
0 (do not interlock the pit)
1 (set pit to "Auto" mode)
Quantity HI
0x00
Quantity LO
0x03
Hence the value to set is 0b000000000100000 = 0x0020.

Field
Value
Description
Slave address
0x01
Field
Value
Function code
0x04
Slave address
0x01
Byte count
0x06
6 bytes follow
Function code
0x06
00209 HI
0x00
Start address HI
0x00
00209 LO
0x08
Start address LO
0x64
ControlRegister address
= 00101 (0x0065)
00210 HI
0x00
Value HI
0x00
00210 LO
0x00
Value LO
0x20
00211 HI
0x00
00211 LO
0x00
Pit alarms 1
Pit alarms 2
Pit alarms 3

Description
ControlRegister value
= 32 (0x0020)

Field
Value
Description
Slave address
0x01
When reading the three pit alarm registers, the following data
becomes available:
Function code
0x06
Start address HI
0x00
Pit alarms 1 = 0b 0000 0000 0000 1000
Start address LO
0x64
= 00101 (0x0065)
Pit alarms 2 = 0b 0000 0000 0000 0000
Value HI
0x00
Value LO
0x03
Pit alarms 3 = 0b 0000 0000 0000 0000.

As seen from the alarms table, the bit for dry-running alarm is set
in pit alarms 1.
= 32 (0x0020)

Note
Writing control bits that are mutual exclusive

may lead to unpredictable results.
75
English (GB)
15.4 Reading the pit alarms
15.6 Interlocking the pit
English (GB)
This shows how to interlock the CU 36X.

In the example, slave address 0x01 is used. Note that the register
is reset by the CIM 200 when the command has been
acknowledged. The value is only triggered on rising edge.
The register on address 00101 is set to the following:
Bit
Description
0 (do not reset)
0 (do not reset alarms)
0 (do not reset history)
0 (do not reset event log)
1 (interlock the pit)
0 (set pit in "Auto" mode)
Hence the value to set is 0b000000000010000 = decimal 16 =

0x0010.
Field
Value
Description
Slave address
0x01
Function code
0x06
Start address HI
0x00
Start address LO
0x64
= 00101 (0x0065)
Value HI
0x00
Value LO
0x10
= 16 (0x0010)

Field
Value
Description
Slave address
0x01
Function code
0x06
Start address HI
0x00
= 00101 (0x0065)
Start address LO
0x64
Value HI
0x00
Value LO
0x10
= 16 (0x0010)

76
English (GB)
16. Fault finding

16.1 Fault finding CIM 200
Faults in a CIM/ 200 can be detected by observing the status of
the two communication LEDs. See the table below and section
4. Specifications.
16.1.1 LED status
Fault (LED status)
Possible cause
Remedy
1. Both LEDs (LED1 and LED2) remain off

when the power supply is connected.
a) The CIM 250 is fitted incorrectly in the

CU 36X.
Ensure that the CIM 250 is fitted/connected

correctly.
b) The CIM 200 is defective.
Replace the CIM 200.
2. The LED for internal communication

(LED2) is flashing red.
a) No internal communication between the

Ensure that the CIM 200 is fitted correctly in

the Grundfos CU36X.

(LED2) is constantly red.
a) The CIM 200 does not support the

Contact the nearest Grundfos company.
4. The Modbus LED (LED1) is constantly

red.
a) Fault in the CIM 200 Modbus

configuration.
5. The Modbus LED (LED1) is flashing red. a) Fault in the Modbus communication
(fault in parity or cyclic redundancy
check).
Check the transmission speed (switches

SW4 and SW5). If the switches are set to
"software-defined", an invalid value may
have been set via Modbus. Try one of the
preselected transmission speeds, e.g.
19200 bits/s.
Check that the Modbus address
(switches SW6 and SW7) has a valid
value [1-247].
Check the transmission speed (switches
SW4 and SW5).
See section 5.1 Setting the Modbus
transmission speed.
Check the parity setting (switch SW3).
Check the cable connection between the
CIM 200 and the Modbus network.
Check the termination resistor settings
(switches SW1 and SW2).
See section 5.4 Termination resistor.
77
16.1.2 CIM 200 Modbus communication faults
English (GB)
Fault
Possible cause
Remedy
1. The slave does not respond

to telegrams.
a) Configuration or wiring error.
Check the visual diagnostics on the Modbus

slave. Is the Grundfos GENIbus LED flashing
green and the Modbus LED off or flashing
green?
Ensure that the cable between the Modbus
master and the Modbus slave is connected
correctly. See section 5. Modbus RTU, CIM 200
setup for wiring recommendations.
Ensure that the slave address is configured
correctly, and that the correct slave address is
used in the Modbus master poll. See section
5.3 Modbus address selection for slave address
selection.
Ensure that the transmission speed and stop
bit/parity settings are configured correctly in
both master and slave.
Ensure that each end of the Modbus trunk cable
is terminated, if necessary. See section
5.4 Termination resistor for line termination of
the Grundfos slave.
Ensure that the bus topology for a Modbus
network is correct.
b) The slave may be in listen-only mode.
Either send a restart communications diagnostics

command, or restart the Grundfos product
manually.
c) If the holding register of address 00001

"SlaveMinimumReplyDelay" is set too high,
the master may time out before receiving the
response from the slave.
Increase the timeout span in the master in order to

communicate.
2. The slave responds with

exception response 0x01:
"Invalid function".
a) The master is trying to use an unsupported

function in the CIM.
See section 8. Modbus function code overview for

supported function codes. Note that reading and
writing coils are not supported, so only register
functions and diagnostics will be valid.
3. The slave responds with

exception response 0x02:
"Invalid data address".
a) The master is trying to read or write an invalid

data address. If a master tries to read register
addresses that are not listed in the tables, the
slave will respond with this exception
response. Some masters may automatically
try to read large blocks in one telegram, which
will cause problems if some of the registers in
the block are not supported. An example
would be reading the CIM configuration and
CIM status blocks in one telegram. This is not
possible since there are unused addresses
between the blocks.
Avoid reading or writing invalid data addresses.

Ensure that register X is addressed as X-1 in
Modbus telegrams, according to the Modbus
standard.
b) The register address offset may have been

changed from default.
Read the holding register at address 00002

"Register Offset" to see if this value is different
from 0. If so, write the value 0 to this address to
make the slave return to the default used in this
functional profile.
a) The value is unavailable. A data value of

0xFFFF does not necessarily indicate an error
condition. It means that the value is
unavailable from the Grundfos product.
See section 10. Modbus RTU commissioning,

step-by-step guides for available data.
4. The slave returns data

value 0xFFFF (65535).
5. The slave does not change a) Configuration error.

Modbus transmission speed
with register 0004.
b) An invalid value may be set in register 00004.
78
Set the transmission speed switches to "Softwaredefined". (Otherwise, the value in register 0004 is
ignored by the slave).
See section 5.1 Setting the Modbus transmission
speed for invalid values, and set correct value in
register 00004.
English (GB)

Faults in the CIM 250 can be detected by observing the status of
3.3 Modbus GSM/GPRS (CIM 250).
16.2.1 LED status
Fault (LED status)
Possible cause
Remedy


CU 36X.

correctly.


CU36X and the Grundfos product.
Ensure that the CIM 250 is fitted correctly in

the CU 36X.

(LED2) is constantly red.

Contact the nearest Grundfos company.
4. The LED for GSM/GPRS communication

(LED1) keeps flashing yellow.
See signal 1 in fig. 13 on page 13.
a) The SIM card has not been inserted in

CIM 250.
Insert the SIM card.

See section 6.1.2 Inserting the SIM card.
b) The SIM card has not been inserted

correctly in CIM 250.
Insert the SIM card.

c) The SIM card PIN code is not correct.
Enter the correct PIN code.

d) No connection to the GSM network.
Check the connection to the antenna.

Check the GSM coverage of the area
using e.g. a mobile phone.
Use an external antenna and experiment
with the position.
a) The CIM 250 has not been initialised.
Follow the configuration procedure in

"CIM 250 SMS commands" (supplement to
installation and operating instructions) on
the CD-ROM supplied with the GSM
module.
5. The LED for GSM/GPRS communication

is pulsating yellow with single pulse, but
the CIM 250 cannot send or receive
SMS messages.
79
16.2.2 CIM 250 Modbus GSM/GPRS communication faults
English (GB)
Fault
Possible cause
Remedy
1. The slave does not respond to

telegrams.
a) Configuration or installation error.
Ensure that the CIM 250 has contact with

the GSM network. The LED1 should be
pulsing yellow.
If the LED1 signal is incorrect, see
section 6. Modbus GSM/GPRS, CIM 250
setup for correct installation of the
CIM 250.
Ensure that the correct slave address is
used in the Modbus master poll.
See register 00003
SoftwareDefinedModbusAddress
(factory value is 00231).
b) The slave may be in listen-only mode.
Either send a restart communications

diagnostics command, or restart the
Grundfos product manually.
c) If the holding register of address 00001

"SlaveMinimumReplyDelay" is set too
high, the master may time out before
receiving the response from the slave.
Increase the reply delay in the master, or

reduce the "SlaveMinimumReplyDelay" in
order to communicate.
a) The master is trying to use an

unsupported function in the CIM 250.
See section 12. Modbus RTU telegram

examples for supported function codes.
Note that reading and writing coils are not
supported, so only register functions and
diagnostics will be valid.
2. The slave responds with exception

response 0x01: "Invalid function".

a) The master is trying to read or write an
response 0x02: "Invalid data address".
invalid data address. If a master tries to
read register addresses that are not listed
in the tables, the slave will respond with
this exception response. Some masters
may automatically try to read large blocks
in one telegram, which will cause
problems if some of the registers in the
block are not supported. An example
would be reading the CIM configuration
and CIM status register blocks in one
telegram. This is not possible since there
are unused addresses among the blocks.
Avoid reading or writing invalid data

addresses.
Ensure that register X is addressed as X - 1
in Modbus telegrams, according to the
Modbus standard.
4. The slave returns data value 0xFFFF

(65535).
a) The availability of data will in some cases

depend on a configuration or the actual
conditions of the system (e.g. trying to
request data from a Grundfos product
which is not present will return "data not
available" (0xFFFF)).
See section 10. Modbus RTU

commissioning, step-by-step guides for
available data.
5. The slave does not react to control

actions or to writing of settings.
a) The CIM 250 is SCADA PIN-code-protected

(GeneralStatus register 00029, bit 0 = 1),
and an incorrect PIN code has been
written.
Write access requires a correct PIN code

(ScadaPinCode, register 00011).
Writing the correct PIN code value will
trigger the write access control, and write
access will be open, which can be verified
with GeneralStatus, register 00029,
bit 1 = 1.
80
English (GB)

Faults in the CIM 500 can be detected by observing the status of
4.4 CIM 500 Modbus TCP.
16.3.1 LED status
Fault (LED status)
Possible cause
Remedy


CU 36X.

correctly.


Check that the CIM 500 is fitted correctly in

the Grundfos product.

(LED2) is permanently red.

Contact the nearest Grundfos
4. The Ethernet LED (LED1) is

permanently red.
a) Fault in the CIM 500 Modbus TCP

configuration.
Check that the rotary switch SW1 is set to 1
5. LED1 is permanently red and green at

the same time.
a) Error in firmware download.
Use the Web server to download the

firmware again.
6. LED2 is permanently red and green at

the same time.
a) Memory fault.
company.
Check that Modbus TCP IP address
configuration is correct
See "A.4 Modbus TCP configuration" on
page 87.
81
16.3.2 CIM 500 Modbus TCP communication faults
English (GB)
Fault
Possible cause
Remedy
1. The slave does not respond to

telegrams
a) Configuration or wiring error
Check the visual diagnostics on the

Modbus slave. Normal conditions are
that the Grundfos GENIbus LED (LED2)
is constantly green and that the Modbus
TCP LED (LED1) is off or flashing green.
If this is not fulfilled see section 16.3.1.
Ensure that the cable between the

Modbus TCP master and the Modbus
slave is connected correctly.
See section 7.1.
Ensure that the slave IP address is

configured correctly, and that the correct
slave IP address is used in the Modbus
master poll. See section 7.3.

response 0x01 "Invalid function"

response 0x02 "Invalid data address"
4. The slave returns data value 0xFFFF

(65535)
5. The slave does not react to control

actions or to writing of settings.
82
The master is trying to use an

unsupported function in the CIM 500.
See section 8. Modbus function code

overview for supported function codes.
Note that reading and writing coils are not
supported, so only register functions and
diagnostics will be valid.
a) The master is trying to read or write an

invalid data address. If a master tries to
read register addresses that are not
listed in the tables, the slave will
respond with this exception response.
Some masters may automatically try to
read large blocks in one telegram, which
will cause problems if some of the
registers in the block are not supported.
An example would be reading the CIM
configuration and CIM status blocks in
one telegram: this is not possible since
there are unused addresses between
the blocks.
Avoid reading or writing invalid data

addresses. Ensure that a block of registers
starting at address X is addressed as X - 1
in Modbus telegrams, according to the
Modbus standard.
b) The register address offset may have

been changed from default.
Read the holding register at address 00002

"Register Offset" to see if this value is
different from 0. If so, write the value 0 to
this address to make the slave return to the
default used in this functional profile.
a) The value is unavailable. A data value

of 0xFFFF does not necessarily indicate
an error condition. It means that the
value is unavailable from the Grundfos
product.
See section 10. Modbus RTU

commissioning, step-by-step guides for
available data.
The Grundfos product might be in

"Local" mode, in which case Operating
mode, Control mode and Setpoint
cannot be changed from bus.
Register 00201 bit 8 AccessMode must
be "1" (=Remote) for bus control to be
active.
Set the Grundfos product in "Remote mode"

by setting register 00101 bit 0
RemoteAccessReq to "1" (=Remote).
The Grundfos product should show
"Controlled from bus" when status is read
by handheld controllers R100 or GO
Remote.
Modbus
address
SW
6
SW
7
Modbus
address
SW
6
SW
7
Modbus
address
SW
6
SW
7
Modbus
address
SW
6
SW
7
Modbus
address
SW
6
SW
7
51
101
151
201
52
102
152
202
53
103
153
203
54
104
154
204
55
105
155
205
56
106
156
206
57
107
157
207
58
108
158
208
59
109
159
209
10
60
110
160
210
11
61
111
161
211
12
62
112
162
212
13
63
113
163
213
14
64
114
164
214
15
65
115
165
215
16
66
116
166
216
17
67
117
167
217
18
68
118
168
218
19
69
119
169
219
20
70
120
170
220
21
71
121
171
221
22
72
122
172
222
23
73
123
173
223
24
74
124
174
224
25
75
125
175
225
26
76
126
176
226
27
77
127
177
227
28
78
128
178
228
29
79
129
179
229
30
80
130
180
230
31
81
131
181
231
32
82
132
182
232
33
83
133
183
233
34
84
134
184
234
35
85
135
185
235
36
86
136
186
236
37
87
137
187
237
38
88
138
188
238
39
89
139
189
239
40
90
140
190
240
41
91
141
191
241
42
92
142
192
242
43
93
143
193
243
44
94
144
194
244
45
95
145
195
245
46
96
146
196
246
47
97
147
197
247
48
98
148
198
49
99
149
199
50
100
150
200
Example: To set the slave address to the value 142, set the
rotary switches SW6 and SW7 to "8" and "E", respectively.
Please note that 0 is not a valid slave address as this is used for
broadcasting.
Caution
It is very important to ensure that two devices do

not have the same address on the network. If two
devices have the same address, the result will be
an abnormal behaviour of the whole serial bus.
83
English (GB)
17. Modbus RTU rotary switch addresses
English (GB)
18. Grundfos alarm and warning codes

This is a general Grundfos alarm and warning code list. Not all
codes apply to all Grundfos products.
Code
Description
Code
Description
Code
Description
Leakage current
36
Discharge valve leakage
77
Communication fault, twin-head

pump
Missing phase
37
Suction valve leakage
78
Fault, speed plug
External fault signal
38
Vent valve defective
79
Functional fault, add-on module
Too many restarts
40
Undervoltage
80
Regenerative braking
41
Undervoltage transient
81
Verification error, data area (RAM)
Mains fault
42
Cut-in fault (dV/dt)
82
Verification error, code area (ROM,

FLASH)
Too many hardware shutdowns
45
Voltage asymmetry
83
Verification error, FE parameter

area (EEPROM)
PWM switching frequency

reduced
48
Overload
84
Memory access error
Phase sequence reversal
49
Overcurrent (i_line, i_dc, i_mo)
85
Verification error, BE parameter

area (EEPROM)
10
50
Motor protection function, general

shutdown (mpf)
88
Sensor fault
11
Water-in-oil fault (motor oil)
51
Blocked motor/pump
89
Signal fault, feedback sensor 1
12
Time for service

(general service information)
52
Motor slip high
90
Signal fault, speed sensor
13
Moisture alarm, analog
53
Stalled motor
91
14
Electronic DC-link protection

activated (ERP)
54
Motor protection function, 3 sec.

limit
92
Calibration fault, feedback sensor
15
Communication fault, main system

(SCADA)
55
Motor current protection activated

(MCP)
93
Signal fault, sensor 2
16
Other
56
Underload
94
Limit exceeded, sensor 1
17
Performance requirement cannot

be met
57
Dry running
95
Limit exceeded, sensor 2
18
Commanded alarm standby (trip)
58
Low flow
96
Setpoint signal outside range
19
Diaphragm break (dosing pump)
59
No flow
97
Signal fault, setpoint input
20
Insulation resistance low
60
Low input power
21
Too many starts per hour
64
Overtemperature
98
Signal fault, input for setpoint

influence
22
Moisture switch alarm, digital
65
Motor temperature 1
(t_m or t_mo or t_mo1)
99
Signal fault, input for analog

setpoint
23
Smart trim gap alarm
66
Temperature, control electronics

(t_e)
104
Software shutdown
24
Vibration
67
Temperature too high, internal

frequency converter module (t_m)
105
Electronic rectifier protection

activated (ERP)
25
Setup conflict
68
External temperature/water
temperature (t_w)
106
Electronic inverter protection

activated (EIP)
26
Load continues even if the motor

has been switched off
69
Thermal relay 1 in motor

(e.g. Klixon)
110
Skew load, electrical asymmetry
27
External motor protector activated

(e.g. MP 204)
70
Thermal relay 2 in motor

(e.g. thermistor)
111
Current asymmetry
28
Battery low
71
Motor temperature 2
(Pt100, t_mo2)
112
Cos too high
29
Turbine operation (impellers

forced backwards)
72
113
Cos too low
30
Change bearings (specific service

information)
73
Hardware shutdown (HSD)
120
Auxiliary winding fault

(single-phase motors)
31
Change varistor(s) (specific

service information)
74
Internal supply voltage too high
121
Auxiliary winding current too high

32
Overvoltage
75
Internal supply voltage too low
122
Auxiliary winding current too low

35
Gas in pump head, deaerating

problem
76
Internal communication fault
123
Start capacitor, low

84
Description
Code Description
Code
Description
124
Run capacitor, low

179
Signal fault, bearing temperature

sensor (Pt100), general or top
bearing
213
VFD not ready
144
Motor temperature 3
(Pt100, t_mo3)
180

sensor (Pt100), middle bearing
214
Water shortage, level 2
145
Bearing temperature high

(Pt100), in general or top bearing
181
Signal fault, PTC sensor

(short-circuited)
215
Soft pressure build-up timeout
146

(Pt100), middle bearing
182

sensor (Pt100), bottom bearing
216
Pilot pump alarm
147

(Pt100), bottom bearing
183
Signal fault, extra temperature

sensor
217
Alarm, general-purpose sensor

high
148
Motor bearing temperature high

(Pt100) in drive end (DE)
184
Signal fault, general-purpose sensor
218
Alarm, general-purpose sensor

low
149
Motor bearing temperature high

(Pt100) in non-drive end (NDE)
185
Unknown sensor type
219
Pressure relief not adequate
152
Communication fault, add-on

module
186
Signal fault, power meter sensor
220
Fault, motor contactor feedback
153
Fault, analog output
187
Signal fault, energy meter
221
Fault, mixer contactor feedback
154
Communication fault, display
188
Signal fault, user-defined sensor
222
English (GB)
Code
155
Inrush fault
189
Signal fault, level sensor
223
Maximum number of mixer starts

per hour exceeded
156
Communication fault, internal

frequency converter module
190
Sensor limit 1 exceeded

(e.g. alarm level in WW application)
224
Pump fault (due to auxiliary

component or general fault)
157
Real-time clock out of order
191

(e.g. high level in WW application)
225

module
158
Hardware circuit measurement

fault
192

(e.g. overflow level in WW application)
226
Communication fault, I/O module
159
CIM fault (Communication

Interface Module)
193
227
Combi event
160
GSM modem, SIM card fault
194
228
Not used
161
Sensor supply fault, 5 V
195
229
Not used
162
Sensor supply fault, 24 V
196
Operation with reduced efficiency
230
Network alarm
163
Measurement fault, motor

protection
197
Operation with reduced pressure
231
Ethernet: No IP address from

DHCP server
164
Signal fault, Liqtec sensor
198
Operation with increased power

consumption
232
Ethernet: Auto-disabled due to

misuse
165
Signal fault, analog input 1
199
Process out of range (monitoring/

estimation/calculation/control)
233
Ethernet: IP address conflict
166
200
Application alarm
236
Pump 1 fault
167
201
External sensor input high
237
Pump 2 fault
168
Signal fault, pressure sensor
202
External sensor input low
238
Pump 3 fault
169
Signal fault, flow sensor
203
Alarm on all pumps
239
Pump 4 fault
170
Signal fault, water-in-oil (WIO)

sensor
204
Inconsistency between sensors
240
Lubricate bearings (specific

service information)
171
Signal fault, moisture sensor
205
Level float switch sequence

inconsistency
241
Motor phase failure
172
Signal fault, atmospheric

pressure sensor
206
Water shortage, level 1
242
Automatic motor model

recognition failed
173
Signal fault, rotor position sensor

(Hall sensor)
207
Water leakage
243
Motor relay has been forced

(manually operated/commanded)
174
Signal fault, rotor origo sensor
208
Cavitation
244
Fault, On/Off/Auto switch
175
209
Non-return valve fault
245
Pump continuous runtime too

long
176
210
High pressure
246
User-defined relay has been

forced (manually operated/
commanded)
177
Signal fault, smart trim gap

sensor
211
Low pressure
247
Power-on notice (device/system

has been switched off)
178
Signal fault, vibration sensor
212
Diaphragm tank precharge pressure

out of range
248
Fault, battery/UPS
Subject to alterations.
85
The appendix describes the parts of the CIM 500 web server
needed for the configuration of a Modbus TCP Ethernet
connection. For other CIM 500 web server features, not
specifically related to Modbus TCP, see the CIM 500 Installation
& Operating instructions.
A.1 How to configure an IP address on your PC

For connecting a PC to the CIM 500 via Ethernet, the PC must be
set up to use a fixed (static) IP address belonging to the same
subnetwork as the CIM 500.
1. Open "Control Panel".
2. Enter "Network and Sharing Center".
3. Click [Change adapter settings].
4. Right-click and select "Properties" for Ethernet adapter.
Typically "Local Area Connection".
5. Select properties for "Internet Protocol Version 4(TCP/IPv4).
6. Select tab "Alternate Configuration".
7. Configure an IP address and subnet mask to be used by your
PC. See fig. 29.
TM05 7422 0913
Appendix
Appendix
Fig. 29 Example from Windows XP
A.2 Web server configuration

The built-in web server is an easy and effective way to monitor
status of the CIM 500 module and configure the available
functions and Industrial Ethernet protocols. The web server also
makes it possible to update the firmware of the CIM module, and
store/restore settings.
To establish a connection from a PC to CIM 500, proceed as
follows:
Before configuration
Check that PC and CIM module are connected via an Ethernet

cable.
Check that the PC Ethernet port is set to the same network as

the CIM module. For network configuration, see section A.1
How to configure an IP address on your PC.
To establish a connection from a PC to the CIM 500 for the first

time, the following steps are required:
1. Open a standard Internet browser and type 192.168.1.100 in
the URL address field.
2. Log in to the Web server.
86
TM05 6063 4412
Appendix
A.3 Login
Fig. 30 Login
User name
Enter user name. Default: admin.
Password
Enter password. Default: Grundfos.

User name and password can be changed on the
web server under "Grundfos Management"
Note
TM05 6064 4412
A.4 Modbus TCP configuration
Fig. 31 Real Time Ethernet Protocol Configuration - Modbus TCP

Object
Description
TCP Port Number
The default value is 502, the official IANA-assigned Modbus TCP port number. Number 502 will always be
active implicitly.
If you select another value in the Web server configuration field, both the new value and value 502 will be
active.
IP Address
The static IP address for CIM 500 on the Modbus TCP network.
Subnet mask
The subnet mask for the CIM 500 module on the Modbus TCP network.
Gateway
The default gateway for the Modbus TCP network.
Use DHCP
The CIM 500 module can be configured to automatically obtain the IP address from a DHCP server on the
network.
87
88
89
90
Finland
Lithuania
Spain
Bombas GRUNDFOS de Argentina S.A.

Ruta Panamericana km. 37.500 Centro
Industrial Garin
1619 Garn Pcia. de B.A.
Phone: +54-3327 414 444
Telefax: +54-3327 45 3190
OY GRUNDFOS Pumput AB
Mestarintie 11
FIN-01730 Vantaa
Phone: +358-(0)207 889 900
Telefax: +358-(0)207 889 550
GRUNDFOS Pumps UAB

Smolensko g. 6
LT-03201 Vilnius
Tel: + 370 52 395 430
Fax: + 370 52 395 431
Bombas GRUNDFOS Espaa S.A.

Camino de la Fuentecilla, s/n
E-28110 Algete (Madrid)
Tel.: +34-91-848 8800
Telefax: +34-91-628 0465
Australia
France
Malaysia
Sweden
Pompes GRUNDFOS Distribution S.A.

Parc dActivits de Chesnes
57, rue de Malacombe
F-38290 St. Quentin Fallavier (Lyon)
Tl.: +33-4 74 82 15 15
Tlcopie: +33-4 74 94 10 51
GRUNDFOS Pumps Sdn. Bhd.

7 Jalan Peguam U1/25
Glenmarie Industrial Park
40150 Shah Alam
Selangor
Phone: +60-3-5569 2922
Telefax: +60-3-5569 2866
GRUNDFOS AB
Box 333 (Lunnagrdsgatan 6)
431 24 Mlndal
Tel.: +46 31 332 23 000
Telefax: +46 31 331 94 60
GRUNDFOS Pumps Pty. Ltd.

P.O. Box 2040
Regency Park
South Australia 5942
Phone: +61-8-8461-4611
Telefax: +61-8-8340 0155
Austria
GRUNDFOS Pumpen Vertrieb Ges.m.b.H.
Grundfosstrae 2
A-5082 Grdig/Salzburg
Tel.: +43-6246-883-0
Telefax: +43-6246-883-30
Belgium
N.V. GRUNDFOS Bellux S.A.
Boomsesteenweg 81-83
B-2630 Aartselaar
Tl.: +32-3-870 7300
Tlcopie: +32-3-870 7301
Belarus

220125,
. , 11, . 56
.: +7 (375 17) 286 39 72, 286 39 73
: +7 (375 17) 286 39 71
E-mail: minsk@grundfos.com
Bosnia/Herzegovina
GRUNDFOS Sarajevo
Trg Heroja 16,
BiH-71000 Sarajevo
Phone: +387 33 713 290
Telefax: +387 33 659 079
e-mail: grundfos@bih.net.ba
Brazil
BOMBAS GRUNDFOS DO BRASIL
Av. Humberto de Alencar Castelo Branco,
630
CEP 09850 - 300
So Bernardo do Campo - SP
Phone: +55-11 4393 5533
Telefax: +55-11 4343 5015
Bulgaria
Grundfos Bulgaria EOOD
Slatina District
Iztochna Tangenta street no. 100
BG - 1592 Sofia
Tel. +359 2 49 22 200
Fax. +359 2 49 22 201
email: bulgaria@grundfos.bg
Canada
Germany
GRUNDFOS GMBH
Schlterstr. 33
40699 Erkrath
Tel.: +49-(0) 211 929 69-0
Telefax: +49-(0) 211 929 69-3799
e-mail: infoservice@grundfos.de
Service in Deutschland:
e-mail: kundendienst@grundfos.de
Mexico
HILGE GmbH & Co. KG

Hilgestrasse 37-47
55292 Bodenheim/Rhein
Germany
Tel.: +49 6135 75-0
Telefax: +49 6135 1737
e-mail: hilge@hilge.de
Netherlands
Greece
GRUNDFOS Hellas A.E.B.E.
20th km. Athinon-Markopoulou Av.
P.O. Box 71
GR-19002 Peania
Phone: +0030-210-66 83 400
Telefax: +0030-210-66 46 273
Hong Kong
GRUNDFOS Pumps (Hong Kong) Ltd.
Unit 1, Ground floor
Siu Wai Industrial Centre
29-33 Wing Hong Street &
68 King Lam Street, Cheung Sha Wan
Kowloon
Phone: +852-27861706 / 27861741
Telefax: +852-27858664
Hungary
GRUNDFOS Hungria Kft.
Park u. 8
H-2045 Trkblint,
Phone: +36-23 511 110
Telefax: +36-23 511 111
India
GRUNDFOS Pumps India Private Limited
118 Old Mahabalipuram Road
Thoraipakkam
Chennai 600 096
Phone: +91-44 2496 6800
Indonesia
GRUNDFOS Canada Inc.

2941 Brighton Road
Oakville, Ontario
L6H 6C9
Phone: +1-905 829 9533
Telefax: +1-905 829 9512
PT GRUNDFOS Pompa
Jl. Rawa Sumur III, Blok III / CC-1
Kawasan Industri, Pulogadung
Jakarta 13930
Phone: +62-21-460 6909
Telefax: +62-21-460 6910 / 460 6901
China
Ireland
GRUNDFOS Pumps (Shanghai) Co. Ltd.

50/F Maxdo Center No. 8 XingYi Rd.
Hongqiao development Zone
Shanghai 200336
PRC
Phone: +86 21 612 252 22
Telefax: +86 21 612 253 33
GRUNDFOS (Ireland) Ltd.

Unit A, Merrywell Business Park
Ballymount Road Lower
Dublin 12
Phone: +353-1-4089 800
Telefax: +353-1-4089 830
Croatia
GRUNDFOS Pompe Italia S.r.l.

Via Gran Sasso 4
I-20060 Truccazzano (Milano)
Tel.: +39-02-95838112
Telefax: +39-02-95309290 / 95838461
GRUNDFOS CROATIA d.o.o.

Cebini 37, Buzin
HR-10010 Zagreb
Phone: +385 1 6595 400
Telefax: +385 1 6595 499
www.grundfos.hr
Italy
Japan
GRUNDFOS s.r.o.
ajkovskho 21
779 00 Olomouc
Phone: +420-585-716 111
Telefax: +420-585-716 299
GRUNDFOS Pumps K.K.

Gotanda Metalion Bldg., 5F,
5-21-15, Higashi-gotanda
Shiagawa-ku, Tokyo
141-0022 Japan
Phone: +81 35 448 1391
Telefax: +81 35 448 9619
Denmark
Korea
Czech Republic
GRUNDFOS DK A/S
Martin Bachs Vej 3
DK-8850 Bjerringbro
Tlf.: +45-87 50 50 50
Telefax: +45-87 50 51 51
E-mail: info_GDK@grundfos.com
www.grundfos.com/DK
GRUNDFOS Pumps Korea Ltd.

6th Floor, Aju Building 679-5
Yeoksam-dong, Kangnam-ku, 135-916
Seoul, Korea
Phone: +82-2-5317 600
Telefax: +82-2-5633 725
Estonia
SIA GRUNDFOS Pumps Latvia

Deglava biznesa centrs
Augusta Deglava iel 60, LV-1035, Rga,
Tlr.: + 371 714 9640, 7 149 641
Fakss: + 371 914 9646
GRUNDFOS Pumps Eesti O

Peterburi tee 92G
11415 Tallinn
Tel: + 372 606 1690
Fax: + 372 606 1691
Latvia
Bombas GRUNDFOS de Mxico S.A. de

C.V.
Boulevard TLC No. 15
Parque Industrial Stiva Aeropuerto
Apodaca, N.L. 66600
Phone: +52-81-8144 4000
Telefax: +52-81-8144 4010
GRUNDFOS Netherlands
Veluwezoom 35
1326 AE Almere
Postbus 22015
1302 CA ALMERE
Tel.: +31-88-478 6336
Telefax: +31-88-478 6332
E-mail: info_gnl@grundfos.com
New Zealand
GRUNDFOS Pumps NZ Ltd.
17 Beatrice Tinsley Crescent
North Harbour Industrial Estate
Albany, Auckland
Phone: +64-9-415 3240
Telefax: +64-9-415 3250
Norway
GRUNDFOS Pumper A/S
Strmsveien 344
Postboks 235, Leirdal
N-1011 Oslo
Tlf.: +47-22 90 47 00
Telefax: +47-22 32 21 50
Poland
GRUNDFOS Pompy Sp. z o.o.
ul. Klonowa 23
Baranowo k. Poznania
PL-62-081 Przemierowo
Tel: (+48-61) 650 13 00
Fax: (+48-61) 650 13 50
Portugal
Bombas GRUNDFOS Portugal, S.A.
Rua Calvet de Magalhes, 241
Apartado 1079
P-2770-153 Pao de Arcos
Tel.: +351-21-440 76 00
Telefax: +351-21-440 76 90
Romania
Switzerland
GRUNDFOS Pumpen AG
Bruggacherstrasse 10
CH-8117 Fllanden/ZH
Tel.: +41-1-806 8111
Telefax: +41-1-806 8115
Taiwan
GRUNDFOS Pumps (Taiwan) Ltd.
7 Floor, 219 Min-Chuan Road
Taichung, Taiwan, R.O.C.
Phone: +886-4-2305 0868
Telefax: +886-4-2305 0878
Thailand
GRUNDFOS (Thailand) Ltd.
92 Chaloem Phrakiat Rama 9 Road,
Dokmai, Pravej, Bangkok 10250
Phone: +66-2-725 8999
Telefax: +66-2-725 8998
Turkey
GRUNDFOS POMPA San. ve Tic. Ltd. Sti.
Gebze Organize Sanayi Blgesi
Ihsan dede Caddesi,
2. yol 200. Sokak No. 204
41490 Gebze/ Kocaeli
Phone: +90 - 262-679 7979
Telefax: +90 - 262-679 7905
E-mail: satis@grundfos.com
Ukraine

01010 , . 8,
.:(+38 044) 390 40 50
.: (+38 044) 390 40 59
E-mail: ukraine@grundfos.com
United Arab Emirates

GRUNDFOS Gulf Distribution
P.O. Box 16768
Jebel Ali Free Zone
Dubai
Phone: +971 4 8815 166
Telefax: +971 4 8815 136
United Kingdom
GRUNDFOS Pumps Ltd.
Grovebury Road
Leighton Buzzard/Beds. LU7 4TL
Phone: +44-1525-850000
Telefax: +44-1525-850011
U.S.A.
GRUNDFOS Pompe Romnia SRL

Bd. Biruintei, nr 103
Pantelimon county Ilfov
Phone: +40 21 200 4100
Telefax: +40 21 200 4101
E-mail: romania@grundfos.ro
GRUNDFOS Pumps Corporation

17100 West 118th Terrace
Olathe, Kansas 66061
Phone: +1-913-227-3400
Telefax: +1-913-227-3500
Russia

, 109544 , .
39
. (+7) 495 737 30 00, 564 88 00
(+7) 495 737 75 36, 564 88 11
E-mail grundfos.moscow@grundfos.com
Grundfos Tashkent, Uzbekistan The Representative Office of Grundfos Kazakhstan in

Uzbekistan
38a, Oybek street, Tashkent
: (+998) 71 150 3290 / 71 150
3291
: (+998) 71 150 3292
Serbia
Addresses Revised 06.05.2013
GRUNDFOS Predstavnitvo Beograd

Dr. Milutina Ivkovia 2a/29
YU-11000 Beograd
Phone: +381 11 26 47 877 / 11 26 47 496
Telefax: +381 11 26 48 340
Singapore
GRUNDFOS (Singapore) Pte. Ltd.
25 Jalan Tukang
Singapore 619264
Phone: +65-6681 9688
Telefax: +65-6681 9689
Slovenia
GRUNDFOS d.o.o.
landrova 8b, SI-1231 Ljubljana-rnue
Phone: +386 1 568 0610
Telefax: +386 1 568 0619
E-mail: slovenia@grundfos.si
South Africa
GRUNDFOS (PTY) LTD
Corner Mountjoy and George Allen Roads
Wilbart Ext. 2
Bedfordview 2008
Phone: (+27) 11 579 4800
Fax: (+27) 11 455 6066
E-mail: lsmart@grundfos.com
Uzbekistan
Grundfos companies
Argentina
ECM: 1113692
www.grundfos.com
The name Grundfos, the Grundfos logo, and be think innovate are registered trademarks owned by Grundfos Holding A/S or Grundfos A/S, Denmark. All rights reserved worldwide.
98393520 0513
Copyright Grundfos Holding A/S

Modbus For Dedicated Controls: Functional Profile and User Manual

Uploaded by

Copyright:

Available Formats

Modbus For Dedicated Controls: Functional Profile and User Manual

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Modbus For Dedicated Controls: Functional Profile and User Manual

Uploaded by

Copyright:

Available Formats

GRUNDFOS INSTRUCTIONS

Modbus for Dedicated Controls

Functional profile and user manual

Original functional profile and user manual.

Symbols used in this document

Modbus RTU, CIM 200 setup

Modbus GSM/GPRS, CIM 250 setup

Modbus TCP, CIM 500 setup

Modbus function code overview

Modbus register overview

Modbus RTU commissioning, step-by-step guides

Detailed descriptions of functionality

Modbus RTU telegram examples

Modbus function code overview

Modbus telegram examples

Modbus RTU rotary switch addresses

Grundfos alarm and warning codes

1. Symbols used in this document

If these safety instructions are not observed,

Notes or instructions that make the job easier

English (GB) Functional profile and user manual

Global System for Mobile

Hyper Text Transfer Protocol.

Internet Assigned Numbers Authority.

This functional profile describes the:

CIM 200 Modbus RTU

CIM250 Modbus GSM/GPRS

CIM 500 Modbus Ethernet for Modbus TCP

for the following Grundfos products:

Grundfos Dedicated Controls 361

Grundfos Dedicated Controls 362.

Media Access Control. Unique network

A serial communications protocol

Modbus is a fieldbus used worldwide.

Modbus is a fieldbus used worldwide.

Grundfos motor protector.

Personal Identification Number

Packet InterNet Groper. A software utility

In the following, the two supported controllers are referred to as

2.3 Definitions and abbreviations

Prefix for binary number.

Prefix for hexadecimal number.

3rd-generation mobile telephony network.

4th-generation mobile telephony network.

Address Resolution Protocol. Translates

Grundfos handheld infrared remote

Ensures that both crossover cable types

Separated or Safety Extra-Low Voltage.

Separated or Safety Extra-Low Voltage

Ethernet cable type: Has 4 twisted pairs of

SIM card, Subscriber Identity Module.

Enhanced CAT5 cable with better

SubMiniature version A. Coaxial radio

Cable with very high performance.

Simple Mail Transfer Protocol

Simple Network Time Protocol. Used for

Transmission Control Protocol.

Communication Interface Module.

Cyclic Redundancy Check, a data error

1200, 2400, 4800*, 9600, 19200,