Software for communication with the Modbus interface of the Danfoss EKC202 refrigerator controllers.
The interface is intended to be used in cojunction with the properietary ADAP-KOOL® system from Danfoss. No documentation regarding the purpose of the various modbus registers is provided, and thus the controller must be reverse enigneered.
A menu entry on the controller allows for setting the bus address. Menu entry o03 network address, allowed range is between 0 and 240.
For the impatient that does not want to read the entire README, it appears that modbus input register 2575 contains the reading from the thermistor. That is the relative address, you may add 30000 to obtain the true address. The transmitted modbus request contains the relative address however.
In order for the controller to support Modbus, the EKA178A extention module must be connected. The module consists of a Atmel Atmega32 microcontroller, a 6LB184 differential transciever, and a CM0403CG common mode choke connected between the transciever and the RS485 terminals.
The board connects to a 8-pin socket in the controller.
There are no labels on the screw terminals for the RS485 bus, the correct connection has been determined by inspecting the circuit board.
The microcontroller is located on the small circuit board in front, behind the seven segment display. The socket for the extention module is located to the left of the display.
The serial port UART parameters are not specified, however the following parameters generated a response from the server.
- Baud rate: 9600
- Data bits: 8
- Parity type: even
- Stop bits: 1
- Bit order: lsb first
As the registry map is undocumented, all possible registry addresses should be polled, until something interesting appears. This is achieved using Python with the pyserial module.
By sending a read coil status, or read input status command, the response is a modbus exception code 01 ILLEGAL FUNCTION. This indicates that these functions are unsupported. Please see the modbus spesification for more details.
Read coil status for controller address 02 Command: [02][01][00][02][00][64][9c][12] Response: [02][81][01][71][90]
Similarily for a read input status request
Command: [02][02][00][02][00][64][d8][12] Response: [02][81][01][71][90]
By performing a casual attempt at reading an input register the response is modbus exception 02 ILLEGAL DATA ADDRESS. [02][84][02][32][C1]
After iterating through some more registers the following data was obtained.
| Register no. | Response |
|---|---|
| 99 | 01:04:04:00:0a |
| 100 | 39:37 |
| 101 | 01:04:02:01:f4:b9:27 |
| 102 | 01:04:02:fe:0c:f9:55 |
| 103 | 01:04:02:00:00:b9:30 |
| 104 | 01:04:02:00:00:b9:30 |
| 112 | 01:04:02:00:00:b9:30 |
| 116 | 01:04:02:00:01:78:f0 |
| 124 | 01:04:02:00:00:b9:30 |
| 125 | 01:04:02:00:00:b9:30 |
| 149 | 01:04:02:00:00:b9:30 |
| 150 | 01:04:02:00:00:b9:30 |
A program was written to iterate through all 9999 registers. The resulting data is included in the file input_register_dump.txt. By analyzing this data and comparing it to data from a controller with a different temperature reading, it was determined that register 2575 and 2588 most likely contains the temperature information.