Reading refrigeration controllers over Modbus: Danfoss, Carel and Dixell

A refrigerated case or cold room already has a computer on it. The controller reads its own probes, runs the compressor or the valve, schedules defrosts and raises its own alarms. Most commercial controllers can also report all of that over Modbus RTU. Reading them adds the setpoint, the defrost state, the evaporator temperature and the controller's alarms to a monitoring system, which explain why a temperature moved.

This guide covers the four controller families met most often in European food retail and catering: the Danfoss EKC 202, the Carel MPXPRO and ir33, and the Dixell XR range. The register tables come from the Modbus profiles EpiSensor uses on these controllers, checked against the manufacturers' own documents. Where the two disagree, or a manufacturer does not publish a value, the guide says so.

Why read the controller, and why not only the controller

The controller's probes are placed for control. A Danfoss EKC 202D reads the air before and after the evaporator (S3 and S4) and the evaporator itself (S5). A Carel MPXPRO uses an outlet probe, an intake probe and a defrost probe. A Dixell XR uses a thermostat probe and an evaporator probe. None of them is placed at the warmest food position, and the setpoint can be changed by anyone with the controller's menu.

So use both signals:

EN 12830, the standard for temperature recorders, makes the same separation: the recorder's measurement must be independent of the one used to control the refrigeration. The EN 12830 guide explains when that standard applies. The probe placement guide covers where the independent probe goes, and how the controller's defrost state can stop false alarms.

The connection

Each of these controllers is a Modbus RTU slave on an RS-485 pair. A ZMB Modbus interface acts as the master: it polls the registers you set up and sends the values over the Zigbee mesh to a Gateway running Edge. No data cable runs back to a panel. A ZMB reads many registers per controller: 8 or more, and up to 16 or more depending on the model. A ZMB-30 adds its own 2.5 m waterproof temperature probe, so one device can read the controller and carry the independent food probe for the same unit.

Each controller has a device page with its register map and a read-only Edge template: Danfoss EKC 202, Danfoss ERC 21x, Danfoss AK-CC55, Eliwell IDNext, Carel MPXPRO, Carel ir33, Carel pRack, Dixell XR60CX, Dixell XR77CX and Dixell XR170C. The HACCP temperature monitoring guide shows the controller readings beside independent probes.

RS-485 Modbus has one master per bus. If a supervisor such as a Danfoss system manager or a Carel PlantVisor already polls the controllers, a second master on the same pair causes collisions. Read the data from the supervisor instead, or use a controller's second serial port where it has one. The RS-485 wiring guide covers termination and bias on a new bus.

Danfoss does not state the EKA 178A's serial settings in its public documents; the values above are the ones EpiSensor's profile used. Carel and Dixell fix their serial settings, and Carel controllers recognise the Carel or Modbus protocol automatically. EpiSensor's profile reads the ir33 at one stop bit and it answered, but Carel's MPXPRO and ir33 Universale manuals state two; use two. On a Carel MPXPRO network, only the Master is on RS-485. Slave units are reached through it, at the Master's address plus the Slave's number.

Reading a temperature register

All four families send temperatures the same way: a signed 16-bit integer in tenths of a degree, in a holding register read with function 03. Decoding takes three steps:

1. Read one register with function 03 at the zero-based address.
2. Treat the 16 bits as a signed integer (two's complement): values from 32,768 up are negative.
3. Multiply by 0.1 for °C, or °F if the controller's unit parameter is set to Fahrenheit.

A freezer that reads 6,535.6 °C has a signed register decoded as unsigned. The Modbus register decoder shows each interpretation of a raw word side by side.

In Edge, a ZMB register is set up with the slave address, the zero-based address in decimal or hex, the data format (signed 16-bit), Read from holding register (function 03), and Write left at Read only. Under names and scaling, set the multiplier to 0.1 and the unit to °C. A device template then copies the same set-up to every ZMB on the same controller model.

Danfoss EKC 202

Danfoss numbers every value with a parameter number (PNU), and the Modbus register is the PNU minus one, read with function 03. Values are in tenths, with a signed range.

All six were tested with EpiSensor's profiles and match Danfoss's parameter lists for the EKC 202B and 202D1. Register 2575 is the displayed value, which includes any display offset set in r04. The raw thermostat sensor, u69 Sair, is PNU 2589, register 2588.

The EKC 202A, B and C use Sair for control and S5 for defrost, or as a product or condenser sensor (o70). The EKC 202D blends S3 and S4 for control (r15), display (o17) and alarms (A36). Sensor faults are reported as alarm codes (E27 for S5, E29 for Sair; E25 and E26 for S3 and S4 on the 202D) and as alarm parameters, not as a special value in the temperature register.

Carel MPXPRO and ir33

Carel numbers its supervisor variables by type: analogue (A), integer (I) and digital (D). In the ir33+ table, the Modbus register for an analogue variable equals its Carel index, an integer variable is its index plus 100, and digital variables are read as coils with the same number.

Carel does not print the MPXPRO's supervisor variable list in its user manual, so the MPXPRO rows rest on EpiSensor's tests alone. EpiSensor's profile also lists a third ir33 register at 0x000F, which the ir33+ table does not define (11 to 14 are probe calibrations); leave it out unless your controller's own documentation names it.

Probe roles depend on configuration. On the MPXPRO, S1 is the outlet probe (Sm), S2 the defrost probe (Sd) and S3 the intake probe (Sr) by default. On the ir33, S1 controls, and parameter /A2 makes probe 2 a product, defrost or condenser probe. Probe faults are digital variables (10 to 13 on the ir33+), shown as E0 to E3 on the display.

Both controllers have a HACCP function that records high-temperature alarms (HA) and alarms after a power failure (HF) with date, time and duration, on models with a clock. It is off by default (parameter Htd = 0). The MPXPRO, with Carel's standard NTC probes, is declared to EN 13485 as a thermometer ("air, S, 1, −50T90 °C"), not to EN 12830 as a recorder.

Carel pRack

The pRack pR300 is a compressor rack controller, not a case controller. Its default supervisor address is 196, but its default protocol is pRACK Manager: set it to Modbus slave before you read it. Its pressures are in barg (or psig), not degrees, even where a register list labels every value °C. Carel supplies the complete supervisor variable list on request, so get it before you trust a pressure register.

Dixell XR series

Dixell's Modbus document fixes the line at 9600 baud, 8 data bits, no parity and one stop bit, with functions 03, 06 and 16. Probe values are laid out from 0x0100, each followed by a status register that carries the unit, the resolution, the alarm bits and the probe-error bit.

User parameters start at 0x0300, but their order differs between models and firmware, which is why the setpoint sits at a different address on each. Dixell does not publish the per-model parameter addresses in its general document, and the XR60CX probe addresses EpiSensor tested differ from the layout that document shows. Confirm each register against the controller's display before relying on it, and record the model and firmware with the profile.

The XR60CX needs one extra part. It has no RS-485 terminals. Its manual says the TTL serial line on the HOT KEY connector connects to a Modbus RTU monitoring system "by means of the external TTL/RS485 converter, XJ485-CX". Wire the converter's RS-485 side to the ZMB. The same connector also takes the HOT KEY programming key and the optional X-REP repeater display, and the X-REP "EXCLUDES the serial connection".

Probe roles: P1 is the thermostat (room) probe, P2 the evaporator probe, P3 configurable and P4 on the HOT KEY plug. The XR60CX and XR77CX alarm limits default to 110 °C high and −50 °C low (ALU and ALL), so out of the box their temperature alarms are effectively off.

Read only, always

Every one of these controllers accepts writes. Danfoss marks the setpoint, the differential, the alarm limits and the main switch r12 as read and write; writing 0 to r12 stops refrigeration. Carel allows parameter writes and commands for defrost, on and off. Dixell accepts functions 06 and 16 on its parameters.

A monitoring system has no reason to write any of them. Configure every register with Write set to Read only, and do not add a write function to a ZMB profile for a controller you do not own the control of. EpiSensor's profiles list write functions for the setpoints because the controller supports them, not because they should be used. A setpoint change belongs to the refrigeration engineer, at the controller.

Commissioning a controller read

1. Record the controller model, order code and firmware, and the probe configuration parameters.
2. Check that no other master polls the bus.
3. Set the serial line and address, and terminate the bus at both ends.
4. Set up the registers as signed 16-bit, function 03, multiplier 0.1, read only.
5. Compare each value with the controller's display, including one negative value on a freezer.
6. Note which probe each register reads (air, evaporator or display), so that nobody mistakes it for the food probe.
7. Check the defrost state against a real defrost, if you use it to block alarms.

The Modbus RS-485 commissioning guide covers the wider acceptance record, and the HACCP critical limits guide covers how the controller data supports a temperature record without replacing it.