Ampcontrol iMAC2 Communications Manual

Designed and Manufactured in Australia by Ampcontrol Pty Ltd Integrated Monitoring and Control System iMAC2 Controller Modbus TCP/IP Communications Manual

Page 1 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART WARNING! The warning symbol highlights a potential risk of injury or death. Please share these warnings with other operators. CAUTION! The caution symbol highlights a potential risk of damage to equipment. Please share these cautions with other operators. NOTE The note symbol highlights key information. Please share these notes with other operators. ENVIRO The enviro (environmental) symbol highlights areas which may have an impact on the surrounding fauna and/or flora.

Page 2 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Copyright Notice The Ampcontrol iMAC Integrated Monitoring and Control system described in this document is the property of AMPCONTROL PTY LTD. It is furnished under a license agreement and is to be used only in accordance with the terms of the agreement. No part of the hardware or documentation may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, without prior written permission of AMPCONTROL PTY LTD. The iMAC signalling technique is protected by patent. Disclaimer While every effort has been made to assure the accuracy and clarity of this document, AMPCONTROL PTY LTD assumes no liability resulting from any omissions in this document, or from misuse of the information obtained herein. The information in this document has been carefully checked and is believed to be entirely reliable with all of the necessary information included. AMPCONTROL PTY LTD reserves the right to make changes to any products described herein to improve reliability, function, or design, and reserves the right to revise this document and make changes from time to time in content hereof with no obligation to notify any persons of revisions or changes. AMPCONTROL PTY LTD does not assume any liability arising out of the application or any use of any product or circuit described herein; neither does it convey license under its patent rights or the rights of others. Before You Begin Thank you for purchasing the Ampcontrol iMAC System. WARNING! In the interests of safety and correct equipment operation, please take the time to read and understand the content in this manual. This manual version V2 pertains to iMAC2 Controller Operating System Firmware v4.1. For superseded Operating System Firmware’s v3.5 or less, please refer to V1 of this manual. Ampcontrol Contact Details 7 Billbrooke Close, Cameron Park, NSW, 2285 P +61 1300 267 373 | F +61 2 4903 4888 EMAIL: [email protected] WEB: ampcontrolgroup.com

Page 3 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART TABLE OF CONTENTS DOCUMENT SCOPE ................................................................................................. 5 Document Scope .............................................................................................. 5 Supplementary Documents .............................................................................. 5 1.2.1 System Documentation ........................................................................... 5 1.2.2 Module Documentation ........................................................................... 5 iMAC2 CONTROLLER ETHERNET COMMUNICATIONS OVERVIEW ..................... 6 Specifications ................................................................................................... 6 Connecting to the Ethernet Port for the First Time ............................................ 7 Modbus TCP/IP Protocol ................................................................................ 10 THE iMAC2 CONTROLLER’S DATA POINT TABLE ................................................ 11 Data Point Table ............................................................................................. 11 System Data Segment .................................................................................... 12 3.2.1 System Data Register ........................................................................... 13 3.2.2 System Status Register ........................................................................ 14 3.2.3 EOL Series Resistance Register ........................................................... 15 3.2.4 Line Shunt Resistance Register ............................................................ 15 Module Data Segment .................................................................................... 16 3.3.1 Module Data Register ........................................................................... 16 3.3.2 Module Status Register ......................................................................... 17 3.3.3 Module Series Resistance Register ...................................................... 18 3.3.4 Module Error Register ........................................................................... 18 System Runtime Segment .............................................................................. 19 3.4.1 System Control Register ....................................................................... 19 3.4.2 System ID and LED Control Register .................................................... 21 3.4.3 EOL Serial Number Register ................................................................. 21 3.4.4 L1 Data Block Just Complete Register .................................................. 22 3.4.5 Application (SLP) Software Loop Timer Counter Register ..................... 22 3.4.6 Module Rollcall Registers ..................................................................... 23 3.4.7 Remote Key Press Register .................................................................. 26 3.4.8 Message System Page Control Register............................................... 26 3.4.9 Block Request Register ........................................................................ 27 3.4.10 EOL Offline Count Register ................................................................. 27 3.4.11 EOL Clash Count Register .................................................................. 27

Page 4 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART General Buffer Segments ............................................................................... 28 Non-Volatile Memory (NVM) System Variables Segment ............................... 29 3.6.1 Serial Communication Setup Registers ................................................. 30 3.6.2 SLP Fault Register ................................................................................ 31 User Non-Volatile Memory (NVM) Segment ................................................... 31 Controller Information Segment ...................................................................... 32 3.8.1 Controller Hardware Flags Register ...................................................... 33 3.8.2 Controller Temperature Register ........................................................... 33 3.8.3 Mimic Keypress Register ...................................................................... 34 3.8.4 LCD Display Data Registers ................................................................. 35 3.8.5 Unit Name Registers ............................................................................. 39 3.8.6 Hardware Version Registers ................................................................. 40 3.8.7 Firmware Version Registers .................................................................. 41 3.8.8 Software Version Registers................................................................... 42 3.8.9 Application (SLP) Software Registers ................................................... 43 3.8.10 Boot Loader Name .............................................................................. 44 3.8.11 Boot Loader Revision .......................................................................... 44 3.8.12 Hardware Name .................................................................................. 45 3.8.13 Hardware Revision ............................................................................. 45 3.8.14 Serial Number ..................................................................................... 46 3.8.15 Software Name ................................................................................... 47 3.8.16 Software Revision ............................................................................... 47 TABLE OF FIGURES Figure 2.1: Location of the Ethernet Communications Port ............................................ 6 Figure 2.2: Location of Ethernet Reset Switch ............................................................... 7 Figure 2.3: Updating the Ethernet Port Settings of the Connectable Device .................. 8 Figure 2.4: Updating the iMAC2 Controller Ethernet Port Settings ................................. 9 Figure 3.1: iMAC2 Controller Data Point Table ............................................................ 11 Figure 3.2: Sub-sections of the iMAC2 Controller’s Data Point Table .......................... 12 Figure 3.3: LCD Display Data Character Map .............................................................. 35 Figure 3.4 Recommended special character Unicode substitutions ............................. 35 Figure 3.5: Character Map for iMAC2 Controller LCD Screen ..................................... 36

Page 5 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART DOCUMENT SCOPE Document Scope This document is intended to provide a detailed explanation of the communications protocols supported by the iMAC2 Controller’s Ethernet port. This document is not intended to provide information on the operation of the overall iMAC System, individual modules or instruction on programming the iMAC2 Controller or modules. Please refer the relevant supplementary documents for this information. Supplementary Documents The iMAC2 Controller Ethernet Communications Manual is intended to be read in conjunction with the following documents: 1.2.1 System Documentation  IMAC2B009 iMAC2 System User Manual  IMAC2B011 iMAC2 Controller Web Interface Manual  IMACB094 iMAC System Installation Requirements  IMACB182 iMAC SIL Emergency Stop Qualification  IMACB005 iMAC Module Programming Manual 1.2.2 Module Documentation  IMACB003 iMAC RO4 Module Technical Datasheet  IMACB018 iMAC LPU Module Technical Datasheet  IMACB020 iMAC DI8 Module Technical Datasheet  IMACB045 iMAC IIM Module Technical Datasheet  IMACB046 iMAC DI4 Module Technical Datasheet  IMACB047 iMAC EOL/MEOL Module Technical Datasheet  IMACB060 iMAC LED4 Module Technical Datasheet  IMACB061 iMAC SSW Module Technical Datasheet  IMACB062 iMAC SQM Module Technical Datasheet  IMACB066 iMAC AIM Module Technical Datasheet  IMACB067 iMAC RTD1 Module Technical Datasheet  IMACB141 iMAC ARM Module Technical Datasheet  IMACB142 iMAC CRM Module Technical Datasheet  IMACB143 iMAC EMM Module Technical Datasheet  IMACB144 iMAC GRM Module Technical Datasheet  IMACB146 iMAC IRK Keypad Technical Datasheet  IMACB147 iMAC PIM Module Technical Datasheet  IMACB148 iMAC SIM-G Module Technical Datasheet  IMACB149 iMAC SIM-G2 Module Technical Datasheet  IMACB150 iMAC SIM-T Module Technical Datasheet  IMACB151 iMAC MLB Barrier Technical Datasheet  IMACB152 iMAC SLB Barrier Technical Datasheet  IMACB154 iMAC SIM-P Module Technical Datasheet  IMACB172 iMAC LIM Module Technical Datasheet

Page 6 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART iMAC2 CONTROLLER ETHERNET COMMUNICATIONS OVERVIEW The iMAC2 Controller is equipped with an Ethernet port and a serial communication port. This manual details the use of the Ethernet port. For information pertaining to the use of the serial communications port, refer to the IMACB153 iMAC Controller Serial Communications Manual. NOTE The Ethernet port is a read only communications port. The iMAC2 Controller has been manufactured in this way to maintain the SIL “Proven in Use” statistics of the previous iMAC Controller. Specifications Figure 2.1: Location of the Ethernet Communications Port Table 1: Ethernet Communications Port Specifications Ethernet TCP/IP Port Available Interfaces RJ45 10/100MB Auto Negotiation Applicable Standards IEEE 802.3u, IEEE 802.3x Cable Requirements 10BASE-T: UTP category 3, 4, 5 cable (maximum 100m) 100BASE-TX: UTP category 5, 5e cable (maximum 100m) EIA/TIA-568 100Ω STP (maximum 100m) Supported Protocols MODBUS TCP/IP (Port 502), NTP (for time synchronisation), Webserver (for configuration, data viewing and diagnostic functions) Maximum Request Rate 100ms Recommended Response Timeout 200ms Maximum Concurrent Web Connections The iMAC2 Controller allows four users to access the web server. Ethernet Communications Port Name Link Activity Link Speed Operation On when valid link is detected. Blinks when activity is detected. On when operating speed is 100Mbps. Off when the line speed is 10Mbps, or during line isolation. Link Activity LED (Yellow) Link Speed LED (Green) Colour Yellow Green

Page 7 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Connecting to the Ethernet Port for the First Time The iMAC2 Controller’s factory default Ethernet IPv4 settings are as follows: Table 2: Default Ethernet Communications Port Settings Default Ethernet IPv4 Settings IP Address 10.1.1.10 Subnet Mask 255.255.255.0 If the Controller’s IPv4 settings have been changed, they can be restored to the factory default settings by pressing the iMAC2 Controller’s Ethernet Reset button for 4 seconds (The internal iMAC2 Controller status LED will turn on solid while the reset button is depressed, after 4 seconds the LED will change to a fast flash to indicate settings have been reset to default, after which the button can then be released). Figure 2.2: Location of Ethernet Reset Switch Ethernet Reset Switch

Page 8 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART The iMAC2 Controller’s Ethernet port settings are not configurable via the HMI; they must be altered using the iMAC2 Web Interface. The Controller’s web server can be accessed using a one-to-one Ethernet connection with an Ethernet enabled device. Temporarily configure your device’s Ethernet port as follows: Figure 2.3: Updating the Ethernet Port Settings of the Connectable Device Once the network adaptor of the external device has been configured as shown in Figure 2.3, connect the iMAC2 Controller’s Ethernet port directly to your device’s Ethernet port, the iMAC 2 Controller should then be able to be pinged at 10.1.1.10. Once a successful ping has been performed, open a web browser (Chrome recommended) and enter the iMAC2 Controller’s IP address into the address bar: http://10.1.1.10; the iMAC2 Controller web pages should load within a few seconds.

Page 9 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Navigate to the Ethernet Settings page to configure the IP settings for the iMAC2 Controller: Figure 2.4: Updating the iMAC2 Controller Ethernet Port Settings For information on this process, refer to the IMAC2B011 iMAC2 Controller Web Interface Manual.

Page 10 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Modbus TCP/IP Protocol The iMAC2 Controller uses industry standard Modbus TCP/IP protocol for exchanging data with compatible Ethernet devices. The iMAC2 Controller facilitates a Modbus Slave (server) device. The default Modbus TCP/IP port number is 502. The iMAC2 Controller supports up to two Modbus Master (client) device connections. A single Modbus command is supported by the iMAC2 Controller’s Ethernet TCP/IP port for transferring register data from the iMAC2 Controller to a compatible Modbus Master (client) device:  Read Holding Registers (03) A summary of the supported command is as follows: Read Holding Registers (03) This command reads registers within the iMAC address space ($0000..$06A1) into the master device. Illegal Commands (01, 02, 04, 05, 06 to 127) The iMAC response to any of these commands is a Modbus exception. To all other commands (0,128...255) the iMAC controller will not respond.

Page 11 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART THE iMAC2 CONTROLLER’S DATA POINT TABLE The iMAC2 Controller’s Data Point Table is used for the exchange of all serial and Ethernet communication data. The Data Point Table is a list of 1697 16-bit registers with each data register having its own address in the range 0 to 1697 (0000h to 06A1h). Register addresses >=1536 (600h) can be accessed via the Ethernet port, register address <=1535 (5FFh) are accessible by both Serial and Ethernet ports. Data Point Table Figure 3.1: iMAC2 Controller Data Point Table The Data Point Table is broken up into a number of segments: System Data, Module Data, System Runtime Variables, Non-Volatile System Variables, Non-Volatile User Memory, Controller Information & two General Buffer segments. These are explained in detail in the following sections. Modbus Address Block: 000h-0FFh System Data Register Decimal 0 1 2 3 4 5 - - - - - - - - - - - - - - - - - - - - - - - - - 253 254 255 Hexadecimal 0h 1h 2h 3h 4h 5h - - - - - - - - - - - - - - - - - - - - - - - - - FDh FEh FFh Modbus Address Block: 100h-1FFh System Status Decimal 256 257 258 259 260 261 - - - - - - - - - - - - - - - - - - - - - - - - - 509 510 511 Hexadecimal 100h 101h 102h 103h 104h 105h - - - - - - - - - - - - - - - - - - - - - - - - - 1FDh 1FEh 1FFh Modbus Address Block: 200h-2FFh EOL Module Resistance Decimal 512 513 514 515 516 507 - - - - - - - - - - - - - - - - - - - - - - - - - 765 766 767 Hexadecimal 200h 201h 202h 203h 204h 205h - - - - - - - - - - - - - - - - - - - - - - - - - 2FDh 2FEh 2FFh Modbus Address Block: 300h-3FFh Line Shunt Decimal 768 769 770 771 772 773 - - - - - - - - - - - - - - - - - - - - - - - - - 1021 1022 1023 Hexadecimal 300h 301h 302h 303h 304h 305h - - - - - - - - - - - - - - - - - - - - - - - - - 3FDh 3FEh 3FFh Modbus Address Block: 400h-4FFh System Runtime Variables OneShot WORDBIT WORD Decimal 1024-1046 Hexadecimal 400h-416h Modbus Address Block: 500h-5FFh Decimal Hexadecimal Modbus Address Block: 600h-651h Decimal Hexadecimal 600h-6A1h iMAC2 Controller Data Point Table Application Software General Buffer 580h – 5FFh 1408-1535 580h-5FFh NVM System Variables 500h-51Fh 1280-1311 500h-51Fh User NVM 520h-57Fh Application Software General Buffer 480h – 4FFh 1152-1279 480h-4FFh 255x Module Status Registers (Modbus Table Address = iMAC Module's Address + 256) Modbus Table Addresses: 101h-1FFh 255x Module Data Registers (Modbus Table Address = iMAC Module's Address) Modbus Table Addresses: 001h-0FFh 255x Module Resistance Registers (Modbus Table Address = iMAC Module's Address + 512) Modbus Table Addresses: 201h – 2FFh 255x Module Error Registers (Modbus Table Address = iMAC Module's Address + 768) Modbus Table Addresses: 301h – 3FFh 1312-1407 520h-57Fh 1047-1151 417h-47Eh Controller Information (Ethernet Port Only) 600h-6A1h 1536-1697

Page 12 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Figure 3.2: Sub-sections of the iMAC2 Controller’s Data Point Table System Data Segment The System Data is a group of 4 registers that are addressed as follows: Address Register Content Decimal Hexadecimal 0 000h System Data (see bit definitions) 256 100h System Status (see bit definitions) 512 200h EOL Module Resistance 768 300h L1 Fieldbus Shunt Resistance System Data System Runtime Variables Non-Volatile System Variables Non-Volatile User Memory General Buffer Module Data Controller Information (Ethernet Port Only)

Page 13 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.2.1 System Data Register The bits within the System Data register are defined by the Controller’s application (SLP) software. Typical bit definitions are as below. Please refer to your specific application (SLP) software for actual definitions. WARNING! CRM and ARM modules require specific application (SLP) software to operate, please ensure that your application (SLP) software is configured correctly if you require CRM and/or ARM functions Address 0 (000h) System Data Register Address Bit Name Description r/w SLP Tag Dec. Hex. 0 000h 0 CRM Output/ GRM0 Output Set by specific application (SLP) software when the CR is closed. CRM or GRM modules can output this information. LED4 or RO4 modules can output this information if set to Address 0 w 1 ARM Output/ GRM1 Output Set by specific application (SLP) software when the AR is closed. ARM or GRM modules can output this information. LED4 or RO4 modules can output this information if set to Address 0 w 2 GRM2 Output Set as required in application (SLP) software. GRM modules can output this information. LED4 or RO4 modules can output this information if set to Address 0 w 3 GRM3 Output Set as required in application (SLP) software. GRM modules can output this information. LED4 or RO4 modules can output this information if set to Address 0 w 4 GRM4 Output Set as required in application (SLP) software. GRM modules can output this information w 5 GRM5 Output Set as required in application (SLP) software. GRM modules can output this information w 6 GRM6 Output Set as required in application (SLP) software. GRM modules can output this information w 7 GRM7 Output Set as required in application (SLP) software. GRM modules can output this information w 8 to 15 Application (SLP) Software Dependent

Page 14 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.2.2 System Status Register The bits within the System Status register have the following definitions: Address 256 (100h) System Status Register Address Bit Name Description r/w SLP Tag Dec. Hex. 256 100h 0 Refresh Cycle Complete Set by the controller at the end of every refresh cycle (refresh cycle = all 255 module addresses have been scanned). May be cleared by writing a 0 into this bit using application (SLP) software. r/w RefreshCycle 1 L1 Checksum Error Latch Set by the controller when a checksum error is detected on L1 fieldbus. May be cleared by writing a 0 into this bit using application (SLP) software. r/w L1ChksErr 2 L1 OK Latch Set by the controller when a L1 fieldbus scan completes with no errors detected. May be cleared by writing a 0 into this bit using application (SLP) software. r/w L1Ok 3 L2 Checksum Error Latch Set by the controller when a checksum error is detected on L2 fieldbus. May be cleared by writing a 0 into this bit using application (SLP) software. r/w L2ChksErr 4 Not Used / System Use Only / Do not use 5 Not Used / System Use Only / Do not use 6 Not Used / System Use Only / Do not use 7 L2 Active Set by controller when it detects an active fieldbus from another controller on its L2 port. Often used to condition the operation of the L2 LED on the controller. r/w L2Active 8 Control Relay (CR) state Status of the Control Relay. 1 = Energised. 0 = De-energised. r CtrlRelayState 9 Auxiliary Relay (AR) state Status of the Auxiliary Relay. 1 = Energised. 0 = De-energised. r AuxRelayState 10 EOL OK Set by controller when EOL module is being detected on the L1 fieldbus with no faults, clear otherwise. r EOL_OK 11 EOL Open Circuit Set by controller when EOL module is not detected on the L1 fieldbus and the fieldbus is not short circuited, clear otherwise. r EOL_OC 12 EOL Short Circuit Set by controller when the L1 fieldbus is short circuited (R<1000Ω), clear otherwise r EOL_SC 13 EOL Clashed Set by controller when two EOL modules are detected on the L1 fieldbus, clear otherwise. r EOL_CLASH

Page 15 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 256 (100h) System Status Register Address Bit Name Description r/w SLP Tag Dec. Hex. 14 Rx Active Set by controller when its serial port is receiving data r UART_Rx 15 Tx Active Set by controller when its serial port is transmitting data r UART_Tx 3.2.3 EOL Series Resistance Register The EOL Module Resistance register can be accessed at Address 512 (200h). This register contains the iMAC fieldbus loop resistance measured between iMAC controller and connected EOL module. Address 512 (200h) EOL Series Resistance Register Address Bit Name Description r/w SLP Tag Dec. Hex. 512 200h 0 to 15 EOL Resistance Measured series resistance of the L1 fieldbus loop from controller to EOL Module. Values are one to one, e.g. a reading of 00FFh (255) corresponds to a loop resistance of 255Ω Range: 0..1000 r EolSeriesRes 3.2.4 Line Shunt Resistance Register The Line Shunt Resistance register can be accessed at Address 768 (300h). This register contains the measured shunt resistance of the iMAC L1 fieldbus. Address 768 (300h) Line Shunt Resistance Register Address Bit Name Description r/w SLP Tag Dec. Hex. 768 300h 0 to 15 Shunt Resistance Measured leakage resistance between controller L1 fieldbus terminals. Values are one to one, e.g. a reading of 0FFFh (4095) corresponds to a shunt resistance of 4095Ω Range: 0..32768 r EolShuntRes

Page 16 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Module Data Segment The Module Data is a group of 1020 registers. Every iMAC module address (1..255) has four associated registers: DATA, STATUS, RESISTANCE and ERRORS. The relationship between module address and its four corresponding registers is defined as: Module Register Addresses Example: Register Addresses for a Module at Address 1 Register Content Decimal Hexadecimal Module Address (1..255) 1 001h Module Data (module dependant) Module Address + 256 257 101h Module Status (see bit definitions) Module Address + 512 513 201h Module Resistance Module Address + 768 769 301h Module Error Counters 3.3.1 Module Data Register The function of the bits within the Module Data register is dependent upon the type of module that is addressed to that location. For information on bit functionality for each module, refer to the individual iMAC module datasheets. Address 001 - 255 (001h - 0FFh) Module Data Register Address Bit Name Description r/w SLP Tag Dec. Hex. 001 to 255 001h to 0FFh 0 D0 / SYS0 Module Dependent (Refer to the individual module datasheets for bit definitions). Note: depending on corresponding Module Status Address ownership flags, this register will be input (default), output (system owned), or low-byte input/high-byte output (byte owned). Module Dependent 1 D1 / SYS1 2 D2 / SYS2 3 D3 / SYS3 4 D4 / SYS4 5 D5 / SYS5 6 D6 / SYS6 7 D7 / SYS7 8 D8 / SYS8 9 D9 / SYS9 10 D10 / SYS10 11 D11 / SYS11 12 D12 / SYS12 13 D13 / SYS13 14 D14 / SYS14 15 D15 / SYS15

Page 17 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.3.2 Module Status Register The Module Status register can be accessed at the address in the Data Point Table that corresponds to the Module Address + 256. The bits within the Module Status register have the following definitions, regardless of the module type that is configured at that particular address. Address 257 - 511 (101h - 1FFh) Module Status Register Address Bit Name Description r/w SLP Tag Dec. Hex. 257 to 511 101h to 1FFh 0 On Scan Bit Set by the controller when it first detects an input module address online on its L1 fieldbus. May be cleared by application (SLP) software. (POR=0) r/w OnScanBit 1 L1 Clash Bit Set by the controller when two input modules transmit different data on the same address, clear otherwise. r L1ClashBit 2 Global Select Must be intentionally set by application (SLP) software if the corresponding data address needs to be published up the L2 fieldbus, thus making it a Global Address. r/w Global 3 L1 Owned Bit Set by the controller when it detects an input module address on its L1 fieldbus, cleared if module not detected. r L1OwnBit 4 L2 Owned Bit Set by the controller when it detects the corresponding address on its L2 fieldbus. The Global Select bit for this address must be set to allow the controller to “see” up its L2 fieldbus. This should be done during the STARTUP segment of the application (SLP) software. r L2OwnBit 5 System Owned Bit Must be intentionally set application (SLP) software when the corresponding data register is to be owned by the system. Setting this bit forces the corresponding data register to be an output. All addresses are assumed to be an input unless this bit is set. If an input module is connected to a system owned address on L1, a L1 clash error will occur. w SysOwnBit 6 L2 Clash Bit Set by the controller when it detects the address is Online on both its L1 and L2 ports if the address Global Select bit is set. r L2ClashBit 7 Byte Owned Must be intentionally set by application (SLP) software when the corresponding data register is to be partially owned by the system. Low byte of data register remains as input, but SLP can now write into high byte for output functions. w HighByteBit 8 to 15 - General purpose use in application (SLP) software. w

Page 18 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.3.3 Module Series Resistance Register The Module Series Resistance register can be accessed at the address in the Data Point Table that corresponds to the Module Address + 512. This register contains the L1 fieldbus loop resistance to the connected module at the specified address. Address 513 - 767 (201h - 2FFh) Module Series Resistance Register Address Bit Name Description r/w SLP Tag Dec. Hex. 513 to 767 201h to 2FFh 0 to 15 Module Series Resistance Measured series resistance of the fieldbus loop between the iMAC Controller and the closest Module on the fieldbus with the corresponding address. Values are one to one, e.g. a reading of 00FFh (255) corresponds to a loop resistance of 255Ω Range: 0..1000Ω r User Defined 3.3.4 Module Error Register The Module Error register can be accessed at the address in the Data Point Table that corresponds to the Module Address + 768. This register contains two counters that monitor the number of data scans that occur with an ‘Offline Error’ or ‘Clash Error’ present at this address. The corresponding counter increments each time there is either an Offline or Clash error detected on the L1 Fieldbus. Once the counter reaches 255 it will auto-roll over to 0 on the next count. Address 769 - 1023 (301h - 3FFh) Module Error Register Address Bit Name Description r/w SLP Tag Dec. Hex. 769 to 1023 301h to 3FFh 0 to 7 Offline Count This count is incremented every data scan that there is no owner of the module address for which there was once an owner. r User Defined 8 to 15 Clash Count This count is incremented every time that a data scan occurs when L1 Clash = 1 (ie increments each time an address is scanned for which there are two modules with the same address that are transmitting different input data). r User Defined

Page 19 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART System Runtime Segment The System Runtime Registers are located in address range 1024 to 1151 (400h to 47Eh). The first 20 runtime registers are defined below, the remaining registers are reserved for system use and should not be accessed by the application (SLP) software. Address 1024 - 1151 (400h – 47Eh) System Runtime Registers Address Register Content Description SLP Tag Dec. Hex. 1024 400h System Control Relay Control, Digital Input Status, Sequence Control (see individual bit definitions) SystemControl 1025 401h System ID and LED control Rotary Switch and DIP Switch status, L1/L2 LED control (see individual bit definitions) SysIdLeds 1026 402h Reserved – Do not use - 1027 403h Reserved – Do not use - 1028 404h EOL Serial Number EOL Module Serial Number EolSerNum 1029 405h Reserved – Do not use - 1030 406h L1 Data Block Just Complete Contains block number of last successfully scanned block number. L1BlockJustDone 1031 407h Reserved – Do not use - 1032 408h Application (SLP) Software Loop Timer Counter SLP loop time in milliseconds LoopTimeSLP 1033 409h Module Rollcall Control Used for roll calling and programming iMAC modules (see individual register definitions) RollcallControl 1034 40Ah Rollcall Address RollcallAddress 1035 40Bh Rollcall Serial Number RollcallSerNum 1036 40Ch Rollcall Type Register RollcallModType 1037 40Dh Rollcall Block Number RollcallBlckNum 1038 40Eh Rollcall Parameter 1 RollcallParam1 1039 40Fh Rollcall Parameter 2 RollcallParam2 1040 410h Rollcall Parameter 3 RollcallParam3 1041 411h Rollcall Parameter 4 RollcallParam4 1042 412h Remote Key Press Valid Key Press codes will mimic the front panel keystrokes. KeyBoardOut 1043 413h Message System Page Control Contains page number of currently shown LCD display. PageTransfer 1044 414h Reserved – Do not use - 1045 415h EOL Offline Count Incremental counter for the number of scans the EOL module has been detected as offline. EOLS_OC 1046 416h EOL Clash Count Incremental counter for the number of scans the EOL module has been detected as clashed. EOLS_Clash 3.4.1 System Control Register The bits within the System Control register, Address 1024 (400h), have the following definitions:

Page 20 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 1024 (400h) System Control Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1024 400h 0 Start-up bit Set by controller on first SLP loop following power up r 1 Always 1 This bit is always set to 1 r 2 Down bit from L2 Sequence Down Bit from Upstream iMAC Controller r SeqDownFromL2 3 Up bit from L1 Sequence Up Bit from Downstream iMAC Controller/SQM module. r SeqUpFromL1 4 Input 1 iMAC Controller SW1 status: 1 = closed, 0 = open. r SwInput1 5 Input 2 iMAC Controller SW2 status: 1 = closed, 0 = open. r SwInput2 6 Input 3 iMAC Controller SW3 status: 1 = closed, 0 = open. r SwInput3 7 Reserved System Use Only r 8 Assert Control Relay Set by application (SLP) software to attempt to energise the CR relay. CR will energise if and only if EOL Module comms is also healthy. Clear to de-energise CR relay. w AsrtCtrlRelay 9 Assert Auxiliary Relay Set by application (SLP) software to energise AR relay. Clear to de-energise AR relay. w AsrtAuxRelay 10 Assert Up bit on L2 Upstream sequence control bit r/w SeqUpOnL2 11 Assert Down bit on L1 Downstream sequence control bit r/w SeqDownOnL1 12 Enable Modbus Flash Write Enables data to be written to the iMAC Controller’s flash memory using Modbus write commands r/w EnFlashWrite 13 Enable Full System Menu The following menu functions are disabled when FullSysMenu = 0 & enabled when FullSysMenu = 1 • System Menu ‘CLR DPT’ item • Maintenance page F1 - Clear individual OnScan Bit r/w FullSysMenu 14 Enable Min System Menu The following menu functions are disabled when MinSysMenu = 0 & enabled when MinSysMenu = 1 • System Menu (SHIFT+MENU) • Debug Menu • Maintenance page F4 – Clear individual OFFLINE/CLASH COUNTERS r/w MinSysMenu 15 Disable Modbus Master Write Commands to iMAC Slave Prevents Modbus Master devices writing to iMAC Controller Modbus registers r/w

Page 21 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.4.2 System ID and LED Control Register The bits within the System ID and LED Control register, Address 1025 (401h), have the following definitions: Address 1025 (401h) System ID and LED Control Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1025 401h 0 Rotary Switch Bit0 Binary Coded Decimal (BCD) value of the 16 Position Rotatory Switch on the side of the iMAC Controller. Rotary Switch ID is the index variable in many SLP commands r IDSW 1 Rotary Switch Bit1 r 2 Rotary Switch Bit2 r 3 Rotary Switch Bit3 r 4 DIP Switch 1 State of DIP Switch 1: 1 = ON, 0 = OFF r DipSw0 5 DIP Switch 2 State of DIP Switch 2: 1 = ON, 0 = OFF r DipSw1 6 DIP Switch 3 State of DIP Switch 3: 1 = ON, 0 = OFF r DipSw2 7 DIP Switch 4 State of DIP Switch 4: 1 = ON, 0 = OFF r DipSw3 8 LED L1 ON Sets the L1 LED to ON w Led1On 9 LED L1 FAST Flash Sets the L1 LED to a fast flash w Led1Fast 10 LED L1 SLOW Flash Sets the L1 LED to a slow flash w Led1Slow 11 LED L1 TOGGLE Now Toggles the state of the L1 LED w Led1Togg 12 LED L2 ON Sets the L2 LED to ON w Led2On 13 LED L2 FAST Flash Sets the L2 LED to a fast flash w Led2Fast 14 LED L2 SLOW Flash Sets the L2 LED to a slow flash w Led2Slow 15 LED L2 TOGGLE Now Toggles the state of the L2 LED w Led2Togg 3.4.3 EOL Serial Number Register The EOL Serial Number register can be accessed at Address 1028 (404h). This register contains the serial number of the EOL Module connected to the fieldbus. Address 1028 (404h) EOL Serial Number Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1028 404h 0 to 15 EOL Serial Number Contains the serial number of the EOL Module that is connected to the L1 fieldbus. r EolSerNum Note: if EOL clash errors are occurring (eg two EOL modules have been inadvertently connected to the L! fieldbus at the same time) the EOL serial number register value will be invalid.

Page 22 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.4.4 L1 Data Block Just Complete Register The L1 Data Block Just Complete register can be accessed at Address 1030 (406h). This register contains the block number of the Data Scan that has just been completed on the L1 fieldbus. Address 1030 (406h) L1 Data Block Just Complete Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1030 406h 0 to 15 L1 Data Block Just Complete Contains the block number of the last completed DataScan r L1BlockJustDone 3.4.5 Application (SLP) Software Loop Timer Counter Register The Application (SLP) Software Loop Timer Counter register can be accessed at Address 1032 (408h). This register contains the number of milliseconds that elapses during each loop of the SLP code. Address 1032 (408h) Application (SLP) Software Loop Timer Counter Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1032 408h 0 to 15 Application (SLP) Software Loop Timer Counter Contains the number of milliseconds that the iMAC Controller took to complete the last main loop of the application (SLP) software. r LoopTimeSLP

Page 23 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.4.6 Module Rollcall Registers Registers in address range 1033 to 1041 (409h to 411h) control the iMAC Controller’s Rollcall functions: Address 1033 to 1041 (409h to 411h) Module Rollcall Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1033 409h 0 Reset Rollcall Before a Rollcall procedure can commence, this bit must be set. The Controller will clear this bit when the Reset Rollcall is complete. r/w ResetRollcall 1 Next Rollcall Set this bit to initiate a Rollcall for the next serial number. The Controller will clear this bit when the Next Rollcall is complete. r/w NextRollcall 2 Next Rollcall, Force Address Set this bit to initiate a Forced Next Rollcall for the module with address specified in the Rollcall Address register (40Ah). The Controller will clear this bit when complete. r/w NextRollForce 3 Read Serial Number Set this bit to initiate a read from the module with serial number, generation number and block number specified in the Rollcall Serial Number register (40Bh), Generation number (409h bits 8 & 9) and the Rollcall Block Number register (40Dh) r/w RollcallSerNum 4 Write Serial Number Set this bit to initiate a write to the module with serial number, generation number and block number specified in the Rollcall Serial Number register (40Bh), Generation number (409h bits 8 & 9) and the Rollcall Block Number register (40Dh) r/w RollcallWrite 5 Rollcall Fail Set by controller following either a Next Rollcall or Next Rollcall Force Address function if it fails. Cleared otherwise. r/w RollcallFail 6 Read SN Fail Set by controller following a Read Serial Number function if it fails. Cleared otherwise. r/w RollReadFail 7 Write SN Fail Set by controller following a Write Serial Number function if it fails. Cleared otherwise. r/w RollWriteFail 8,9 Generation ID [9,8] [11] - Generation 4 [10] - Generation 3 [01] - Generation 2 [00] - Generation 1 These bits are set by controller following a Reset Rollcall or Next Rollcall function. The value of these bits is also used during Read Serial Number and Write Serial Number functions to target the required ‘generation number’ of the module. r/w - 10 to 15 Rollcall Generation Display Flags RollcallGen1Flg RollcallGen2Flg RollcallGen3Flg RollcallGen4Flg These bits are set by controller following a Reset Rollcall or Next Rollcall function. r RollcallGen1Flg RollcallGen2Flg RollcallGen3Flg RollcallGen4Flg

Page 24 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 1033 to 1041 (409h to 411h) Module Rollcall Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1034 40Ah 0 to 15 Rollcall Address This register contains the address of the module that has been rollcalled. Alternatively, this register is used to specify the address of the module for a forced rollcall function. r/w RollcallAddress 1035 40Bh 0 to 15 Rollcall Serial Number This register contains the serial number for the module that has been rollcalled. Alternatively, this register is used to specify the serial number for read/write serial number functions. r/w RollcallSerNum 1036 40Ch 0 to 15 Rollcall Type This register contains the module type number (0..63) of the module that has been rollcalled. r RollcallModType 1037 40Dh 0 to 15 Rollcall Block Number This register contains the block number of the module that has been rollcalled. Alternatively, this register is used to specify the block number for read/write serial number functions. r/w RollcallBlckNum 1038 40Eh 0 to 15 Rollcall Parameter 1 This register contains Parameter 1 for the module that has been rollcalled. Alternatively, this register is used to specify Parameter 1 for read/write serial number functions. r/w RollcallParam1 1039 40Fh 0 to 15 Rollcall Parameter 2 This register contains Parameter 2 for the module that has been rollcalled. Alternatively, this register is used to specify Parameter 2 for read/write serial number functions. r/w RollcallParam2 1040 410h 0 to 15 Rollcall Parameter 3 This register contains Parameter 3 for the module that has been rollcalled. Alternatively, this register is used to specify Parameter 3 for read/write serial number functions. r/w RollcallParam3 1041 411h 0 to 15 Rollcall Parameter 4 This register contains Parameter 4 for the module that has been rollcalled. Alternatively, this register is used to specify Parameter 4 for read/write serial number functions. r/w RollcallParam4

Page 25 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART The below table provides the modules that are associated with the possible values of the “Rollcall Type” register located at register address 1036 (40Ch). Module Type Table Corresponding Values for Rollcall Type Register (Address 1036, 40Ch) Value Module Type Value Module Type Decimal Hexadecimal Decimal Hexadecimal 0 0000h Reserved 32 0020h LED4 Module 1 0001h Controller 33 0021h EMM Module 2 0002h TCD2 DIPSwitch 34 0022h Undefined #34 3 0003h EOL Module 35 0023h SIM-P Module 4 0004h SQM Module 36 0024h SIM-T Module 5 0005h DI2/4 Module 37 0025h SIM-G Module 6 0006h IIM-OLC Module 38 0026h DI5 Module 7 0007h LIM Module 39 0027h RO4 Module 8 0008h TCD4 Long 40 0028h TO4 Module 9 0009h TCD4 Module 41 0029h GCA Flags 10 000Ah RTD3 Flags 42 002Ah GCA 15Min Tally 11 000Bh RTD3 Temp 1 43 002Bh GCA 8Hr Tally 12 000Ch RTD3 Temp 2 44 002Ch GCA 24Hr Tally 13 000Dh RTD3 Temp 3 45 002Dh GCA Raw Count 14 000Eh DI4L Module 46 002Eh DI8 Module 15 000Fh DI4 Module 47 002Fh RIS Module 16 0010h IIM Module 48 0030h AIM Flags 17 0011h PGM-A Programr 49 0031h AIM Analog 18 0012h MEOL Module 50 0032h AIM PwrSupply 19 0013h Undefined #19 51 0033h CRM Module 20 0014h SSW Flags 52 0034h ARM Module 21 0015h SSW Control 53 0035h GRM Module 22 0016h SSW % Slip 54 0036h RTD1 Flags 23 0017h SSW % Speed 55 0037h RTD1 Temp 24 0018h SSW Linr Speed 56 0038h SIM-G2 Module 25 0019h Undefined #25 57 0039h FCP DigInputs 26 001Ah Undefined #26 58 003Ah FCP DigOutputs 27 001Bh GAI3 Flags 59 003Bh FCP AnaInputs 28 001Ch GAI3 Analogue #1 60 003Ch FCP AnaOutputs 29 001Dh GAI3 Analogue #2 61 003Dh GG2 Flags 30 001Eh GAI3 Analogue #3 62 003Eh GG2 Analog 31 001Fh RKM Keypad 63 003Fh GG2 PwrSupply

Page 26 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.4.7 Remote Key Press Register The Remote Key Press register can be accessed at Address1042 (412h). Valid key press codes, written to this register will mimic an actual iMAC2 Controller keypad press. Address 1042 (412h) Remote Key Press Register Value Mimicked Key SLP Tag Decimal Hexadecimal 0 0000h No Key 1 0001h ESC Key ESC_KEY 2 0002h Alarm Key ALARM_KEY 3 0003h Menu Key MENU_KEY 5 0005h F1 Key F1_KEY 6 0006h F2 Key F2_KEY 7 0007h F3 Key F3_KEY 8 0008h F4 Key F4_KEY 9 0009h Left Arrow Key LEFT_KEY 10 000Ah Up Arrow Key UP_KEY 11 000Bh Right Arrow Key RIGHT_KEY 12 000Ch Down Arrow Key DOWN_KEY 13 000Dh Enter Key ENTER_KEY 16 0010h Shift Mode Key SHIFT_MOD To affect a remote keypress, write the value of the desired key press into this register. To affect a shift + key press, add the value of the keypress modifier to the desire key value eg to affect a [SHIFT]+[MENU] keypress write the value 13h (10h+03h) into this register. 3.4.8 Message System Page Control Register The Message System Page Control register can be accessed at Address 1043 (413h). This register contains the page number of the iMAC Controller’s LCD Display. Address 1043 (413h) Message System Page Control Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1043 413h 0 to 15 Message System Page Control Contains the page number of the current page that is being shown on the display of the iMAC Controller r/w PageTransfer

Page 27 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.4.9 Block Request Register The Block Request register SHOULD NOT be accessed directly by the user. It can be accessed indirectly using the application (SLP) software function ScanAddress{ }. This function can be used to prioritise address scanning and should be used only by Ampcontrol Applications engineers. Incorrect use of this function can disrupt normal operation. Address 1044 (414h) Block Request Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1044 414h 0 to 15 Block Request Contains the block number for a requested data scan. r/w - 3.4.10 EOL Offline Count Register The EOL Offline Count register can be accessed at Address 1045 (415h). This register contains a counter that monitors the number of data scans that occur with an ‘EOL Offline Error’. When this counter reaches its maximum value of FFFFh, it will wrap back around to zero on the next count. Address 1045 (415h) EOL Offline Count Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1045 415h 0 to 15 EOL Offline Count This count is incremented every time that a data scan occurs when an EOL module is not detected on the L1 fieldbus. r EOLS_OC 3.4.11 EOL Clash Count Register The EOL Clash Count register can be accessed at Address 1046 (416h). This register contains a counter that monitors the number of data scans that occur with an ‘EOL Clash Error’. When this counter reaches its maximum value of FFFFh, it will wrap back around to zero. Address 1046 (416h) EOL Clash Count Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1046 416h 0 to 15 EOL Clash Count This count is incremented every time that a data scan occurs when multiple EOL modules are detected on the L1 fieldbus. r EOLS_Clash

Page 28 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART General Buffer Segments The Data Point Table has two separate blocks of register addresses that are purposed as “General Buffers”. These two blocks have register Address ranges from 1152 to 1279 (480h to 4FFh) and from 1408 to 1535 (580h to 5FFh). These registers can be used as general purpose memory for the application (SLP) software and/or for serial communication data exchange. If the iMAC Controller’s serial communication protocol is set to Ampcontrol IP2, the General Buffer registers are the only addresses that are able to be accessed using this protocol. Application (SLP) software must move all data that is required to be exchanged using IP or IP2 protocols into these registers to enable access.

Page 29 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Non-Volatile Memory (NVM) System Variables Segment The Data Point Table has a block of addresses that are set aside for the iMAC Controller’s non-volatile system variables. This block is located at Address 1280 to 1311 (500h to 51Fh). This information is saved in the iMAC Controller’s non-volatile flash memory, meaning data is stored and retained during a power outage. The first 20 registers of the NVM data block have special functions. These registers are located at address range 1280 to 1299 (500h to 513h). Address 1280 to 1299 (500h to 513h) NVM System Variables Address Name Description r/w SLP Tag Dec. Hex. 1280:LSB 500h:LSB Protocol Serial Communications Port Settings. Set using the iMAC Controller Serial Communications Page. w 1280:MSB 500h:MSB BAUD Rate w 1281:LSB 501h:LSB Parity w 1281:MSB 501h:MSB Stop Bits w 1282:LSB 502h:LSB Mode w 1282:MSB 502h:MSB Modbus Slave Address w 1283 503h Signal ZERO Period L1 Fieldbus communication speed settings. The application (SLP) software function: LineSpeed{ } sets these registers. r 1284 504h Signal EXTEND Period r 1285 505h Signal SYNC Period r 1286 506h Power ZERO Period r 1287 507h Power ONE Period r 1288 508h Power SYNC Period r 1289 509h Not Used / System Use Only 1290 50Ah SLP Timer Time Base. Sets application (SLP) software timer tick rate. The application (SLP) software function: TimerSetup{ } sets this register: 1=10ms, 10=100ms, 50=500ms 100=1second etc. w 1291 50Bh SLP Max Number of Active Timers. Sets maximum number of timers that the application (SLP) software can utilise. The application (SLP) software function: TimerSetup{ } sets this register: Min = 4, Max = 16. w 1292 50Ch SLP Fault Register. Application (SLP) Software Error register (see bit definitions) w 1293 50Dh SLP Fault Address. Memory address where application software fault occurred. w 1294 50Eh Not Used / System Use Only 1295 50Fh Not Used / System Use Only 1296 510h Series VI Offset Factory Use Only -

Page 30 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 1280 to 1299 (500h to 513h) NVM System Variables Address Name Description r/w SLP Tag Dec. Hex. 1297 511h Series OHMS Offset This value is subtracted from the calculated Series Resistance. Factory Use Only w 1298 512h Shunt VI Offset Factory Use Only - 1299 513h Shunt OHMS Offset This value is subtracted from the calculated Shunt Resistance Factory Use Only w 3.6.1 Serial Communication Setup Registers The Serial Communication setup registers are used to configure the RS232/422/485 port settings. These registers are broken up into two bytes: most significant byte and least significant byte (MSB, LSB); with each byte being associated with a different setting as follows: Address 1280:LSB (500h:LSB) Protocol Setting Address 1280:MSB (500h:MSB) BAUD Rate Setting Byte Value Corresponding Setting Byte Value Corresponding Setting Dec. Hex. Dec. Hex. 0 0h Not Configured 0 0h (9600)* 1 1h Modbus Master 1 1h Not Configured 2 2h Modbus Slave 2 2h 600 3 3h IP2 Protocol 3 3h 1200 4 4h L1 Maintenance 4 4h 2400 5 5h L2 Maintenance 5 5h 4800 6 6h 9600 7 7h 19200** Address 1281:LSB (501h:LSB) Parity Setting Address 1281:MSB (501h:MSB) Stop Bits Setting Byte Value Corresponding Setting Byte Value Corresponding Setting Dec. Hex. Dec. Hex. 0 0h (Even)* 0 0h (One)* 1 1h None 1 1h One 2 2h Even 2 2h Two 3 3h Odd Address 1282:LSB (502h:LSB) Mode Setting Address 1282:MSB (502h:MSB) Modbus Slave Setting Byte Value Corresponding Setting Byte Value Corresponding Setting Dec. Hex. Dec. Hex. 0 0h RS232 1..32 1h..20h Slave Address 1 1h RS485/RS422 *Note: Items shown in grey italics text are not user selectable. **Note: May not be compatible with all third party devices, if communication errors occur using this baud rate, revert to 9600 baud.

Page 31 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.6.2 SLP Fault Register The SLP Fault register can be accessed at Address 1092 (50Ch). This register contains a number of bits that indicate the status of application (SLP) software logic engine. Address 1092 (50Ch) System Error Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1092 50Ch 0 Fatal SLP Fault w FatalSLPFault 1 Stack Overflow w StackOverFlow 2 Stack Underflow w StackUnderFlow 3 Address out of Bounds w AddressBounds 4 Illegal Command w IllegCommand 5 Timer Parameter Fault Base/Numb w TimeBaseFault 6 Not Used / System Use Only 7 Not Used / System Use Only 8 TON No Timer Slots Delay r TonDelayWarn 9 TOFF No Timer Slots Delay r ToffDelayWarn 10 L1 Power Period Overflow r L1PwrPerOver 11 L2 Power Period Overflow r L2PwrPerOver 12 L2 Loss of SYNC r L2SyncLoss 13 Down Active r 14 Down Finished r 15 Not Used / System Use Only Note: Bits 0 to 7 represent critical SLP faults, these are not expected during normal operation and should be reported to an Ampcontrol applications engineer. Bits 8 to 15 are warnings and can be expected to occur from time to time. User Non-Volatile Memory (NVM) Segment The Data Point Table has a block of addresses that are set aside for non-volatile user memory. This block is located at Address 1312 to 1407 (520h to 57Fh). This allows the user to save information that will be retained in the iMAC Controllers Flash memory at power down.

Page 32 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Controller Information Segment The Controller Information Registers are located in address range 1536 - 1617 (600h – 651h). These registers are only accessible via the iMAC2 Controller’s Ethernet port. Address 1536 - 1617 (600h – 651h) Controller Information Registers Address Register Content Description SLP Tag Dec. Hex. 1536 600h Controller Hardware Flags Log processor hardware fault flags - 1537 601h Controller Temperature Internal temperature of the iMAC2 Controller Value is x100 oC (user must divide value by100 for oC) - 1538 to 1550 602h to 60Eh - Not Used / System Use Only - 1551 60Fh Mimic Keypress Web Interface Mimic Keypress Register. When a web mimic keypad key is clicked with the left mouse button, the value of that keypress is loaded into a 20 deep buffer. When this register is read, the value of the oldest keypress contained in the buffer will be returned, subsequent reads will return the next oldest keypress and so on. When the returned value is zero, all key presses have been read and the buffer is empty. - 1552 to 1561 610h to 619h Controller LCD Display Data (4 x 20 characters) A string of characters representing LCD Line 1 - 1562 to 1571 61Ah to 623h A string of characters representing LCD Line 2 - 1572 to 1581 624h to 62Dh A string of characters representing LCD Line 3 - 1582 to 1591 62Eh to 637h A string of characters representing LCD Line 4 1592 to 1611 638h to 064Bh Controller Tag Name Controller’s Tag Name (as set via web interface and stored on the SD Card) 1612 to 1621 64Ch to 655h Legacy Hardware Version A string of characters representing the Hardware version currently installed in the Controller. 1622 to 1631 656h to 65Fh Legacy Firmware Version A string of characters representing the Bootloader version currently installed in the Controller. 1632 to 1641 660h to 669h Legacy Software Version A string of characters representing the Software version currently installed in the Controller. 1642 to 1651 66Ah to 673h Application (SLP) Software Version A string of characters representing the Application (SLP) Software version currently installed in the Controller. 1652 to 1659 674h to 67Bh Log Processor Bootloader Name A string of characters representing the Log Processor Bootloader Name 1660 to 1662 67Ch to 67Eh Log Processor Bootloader Version A string of characters representing the Log Processor Bootloader Version 1663 to 1670 67Fh to 686h Log Processor Hardware Name A string of characters representing the Log Processor Hardware Name 1671 to 687h to Log Processor A string of characters representing the Log

Page 33 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 1673 689h Hardware Version Processor Hardware Version 1674 to 1681 68Ah to 691h Log Processor Hardware Serial Number A string of characters representing the Log Processor Hardware Serial Number 1682 to 1689 692h to 699h Log Processor Application Name A string of characters representing the Log Processor Application Name 1690 to 1697 69Ah to 6A1h Log Processor Application Version A string of characters representing the Log Processor Application Version 3.8.1 Controller Hardware Flags Register The Controller hardware flags register can be accessed at Address 1536 (600h). This register contains hardware fault flags for critical log processor hardware circuits. Address 1617 (651h) Controller Temperature Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1536 600h 0 RTC Fault 0 = Ok, 1 = Fault r - 1 I2C Fault 0 = Ok, 1 = Fault 2 SC Card Fault 0 = Ok, 1 = Fault 3 to 15 Not Used / System Use Only Note: Bits 0 to 3 represent critical hardware faults, these are not expected during normal operation and should be reported to an Ampcontrol applications engineer. The RTC Fault flag will likely indicate the real time clock battery has expired and needs replacing. 3.8.2 Controller Temperature Register The Controller Temperature register can be accessed at Address 1537 (601h). This register contains the temperature of the iMAC2 Controller in degrees Celsius x 100. Address 1617 (651h) Controller Temperature Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1537 601h 0 to 15 Controller Temperature Internal temperature of the iMAC2 Controller Value is x100 oC (user must divide value by100 for oC) r -

Page 34 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.3 Mimic Keypress Register The Mimic Keypress register can be accessed at Address 1551 (60Fh). When a web interface mimic keypad key is clicked with the left mouse button, the value of that keypress is loaded into a 20 deep buffer. When this register is read, the value of the oldest keypress contained in the buffer will be returned, subsequent reads will return the next oldest keypress and so on. When the returned value is zero, all key presses have been read and the mimic keypress buffer is empty. Address 1616 (650h) Mimic Keypress Register Address Bit Name Description r/w SLP Tag Dec. Hex. 1551 60Fh 0 to 15 Mimic Keypress Contains value of web interface mimic keypresses r - The below table lists the keypress types and associated register value: Keypress Type Mimic Keypress Register Value No Key 0000 ESC_KEY 0001 ALARM_KEY 0002 MENU_KEY 0003 F1_KEY 0005 F2_KEY 0006 F3_KEY 0007 F4_KEY 0008 LEFT_KEY 0009 UP_KEY 000A RIGHT_KEY 000B DOWN_KEY 000C ENTER_KEY 000D SHIFT_MOD 0010 Note: This register can be read by a Master Modbus TCP/IP device which can then copy the value read back to the controller’s Slave Modbus RS232/485 port to action the keypress. Refer to serial communications manual for further information.

Page 35 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.4 LCD Display Data Registers The LCD Display Data is stored in the registers within the address range 1552 to 1591 (610h to 637h). Each register contains two characters, with a total of 80 characters being stored in the block of 40 addresses. The upper byte of Address 1552 contains the character that is currently being displayed on the top left hand corner of the LCD screen (Line 1: Column 1). The lower byte of Address 1552 contains the character that is being displayed on Line 1: Column 2. Figure 3.3: LCD Display Data Character Map Standard ASCII characters are used except for a small number of exceptions such as ohms symbol, up arrow, down arrow, up-down arrow etc. Refer to the following figures for a full list of character codes and recommended Unicode substitutions for these special characters. iMAC2 LCD Code (Hex) Character Name Recommended Unicode (Hex) 00h Up Arrow 2191h (↑) 01h Down Arrow 2193h (↓) 02h Up-Down Arrow 2195h (↕) 03h Return Arrow 23CEh (⏎) 7Eh Right Arrow 2192h (→) 7Fh Left Arrow 2190h (←) F4h Ohm Symbol 2126h (Ω) Figure 3.4 Recommended special character Unicode substitutions 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 1 2 3 4 - - A L A R M P A G E - - - - - - - < * C R O P E N * * * - * < u l l k e y T r i p s - P < I 4 I n p u t O p e n - D Column Number Row Number - - 1552:HB 1552:LB - < 1582:HB 1582:LB - 1561:LB 1561:HB 1591:LB 1591:HB

Page 36 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Figure 3.5: Character Map for iMAC2 Controller LCD Screen NOTE Figure 3.5 shows the character map for the iMAC2 Controller’s LCD Screen. Items highlighted in RED indicate special characters that are unique to the iMAC2 Controller. These special characters will need to be substituted for compatible characters after being read from the Controller. Decimal Hex. Character Decimal Hex. Character Decimal Hex. Character Decimal Hex. Character 00 00h ↑ 40 28h ( 80 50h P 120 78h x 01 01h ↓ 41 29h ) 81 51h Q 121 79h y 02 02h ↕ 42 2Ah * 82 52h R 122 7Ah z 03 03h ⤶ 43 2Bh + 83 53h S 123 7Bh { 44 2Ch , 84 54h T 124 7Ch | 45 2Dh - 85 55h U 125 7Dh } 46 2Eh . 86 56h V 126 7Eh → 47 2Fh / 87 57h W 127 7Fh ← 48 30h 0 88 58h X 49 31h 1 89 59h Y 50 32h 2 90 5Ah Z 51 33h 3 91 5Bh [ 52 34h 4 92 5Ch \ 53 35h 5 93 5Dh ] 54 36h 6 94 5Eh ^ 55 37h 7 95 5Fh _ 56 38h 8 96 60h ` 57 39h 9 97 61h a 244 F4h Ω 58 3Ah : 98 62h b 59 3Bh ; 99 63h c 60 3Ch < 100 64h d 61 3Dh = 101 65h e 62 3Eh > 102 66h f 63 3Fh ? 103 67h g 64 40h @ 104 68h h 65 41h A 105 69h i 66 42h B 106 6Ah j 67 43h C 107 6Bh k 68 44h D 108 6Ch l 69 45h E 109 6Dh m 70 46h F 110 6Eh n 71 47h G 111 6Fh o 32 20h (Space) 72 48h H 112 70h p 33 21h ! 73 49h I 113 71h q 34 22h " 74 4Ah J 114 72h r 35 23h # 75 4Bh K 115 73h s 36 24h $ 76 4Ch L 116 74h t 37 25h % 77 4Dh M 117 75h u 38 26h & 78 4Eh N 118 76h v 39 27h ' 79 4Fh O 119 77h w

Page 37 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART LCD Display Data registers have the following definitions: Address 1552 to 1591 (610h to 637h) LCD Display Data Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1552 610h 8 to 15 LCD Row 1: Column 1 LCD Character r - 1552 610h 0 to 7 LCD Row 1: Column 2 LCD Character r - 1553 611h 8 to 15 LCD Row 1: Column 3 LCD Character r - 1553 611h 0 to 7 LCD Row 1: Column 4 LCD Character r - 1554 612h 8 to 15 LCD Row 1: Column 5 LCD Character r - 1554 612h 0 to 7 LCD Row 1: Column 6 LCD Character r - 1555 613h 8 to 15 LCD Row 1: Column 7 LCD Character r - 1555 613h 0 to 7 LCD Row 1: Column 8 LCD Character r - 1556 614h 8 to 15 LCD Row 1: Column 9 LCD Character r - 1556 614h 0 to 7 LCD Row 1: Column 10 LCD Character r - 1557 615h 8 to 15 LCD Row 1: Column 11 LCD Character r - 1557 615h 0 to 7 LCD Row 1: Column 12 LCD Character r - 1558 616h 8 to 15 LCD Row 1: Column 13 LCD Character r - 1558 616h 0 to 7 LCD Row 1: Column 14 LCD Character r - 1559 617h 8 to 15 LCD Row 1: Column 15 LCD Character r - 1559 617h 0 to 7 LCD Row 1: Column 16 LCD Character r - 1560 618h 8 to 15 LCD Row 1: Column 17 LCD Character r - 1560 618h 0 to 7 LCD Row 1: Column 18 LCD Character r - 1561 619h 8 to 15 LCD Row 1: Column 19 LCD Character r - 1561 619h 0 to 7 LCD Row 1: Column 20 LCD Character r - 1562 61Ah 8 to 15 LCD Row 2: Column 1 LCD Character r - 1562 61Ah 0 to 7 LCD Row 2: Column 2 LCD Character r - 1563 61Bh 8 to 15 LCD Row 2: Column 3 LCD Character r - 1563 61Bh 0 to 7 LCD Row 2: Column 4 LCD Character r - 1564 61Ch 8 to 15 LCD Row 2: Column 5 LCD Character r - 1564 61Ch 0 to 7 LCD Row 2: Column 6 LCD Character r - 1565 61Dh 8 to 15 LCD Row 2: Column 7 LCD Character r - 1565 61Dh 0 to 7 LCD Row 2: Column 8 LCD Character r - 1566 61Eh 8 to 15 LCD Row 2: Column 9 LCD Character r - 1566 61Eh 0 to 7 LCD Row 2: Column 10 LCD Character r - 1567 61Fh 8 to 15 LCD Row 2: Column 11 LCD Character r - 1567 61Fh 0 to 7 LCD Row 2: Column 12 LCD Character r - 1568 620h 8 to 15 LCD Row 2: Column 13 LCD Character r - 1568 620h 0 to 7 LCD Row 2: Column 14 LCD Character r - 1569 621h 8 to 15 LCD Row 2: Column 15 LCD Character r - 1569 621h 0 to 7 LCD Row 2: Column 16 LCD Character r - 1570 622h 8 to 15 LCD Row 2: Column 17 LCD Character r - 1570 622h 0 to 7 LCD Row 2: Column 18 LCD Character r - 1571 623h 8 to 15 LCD Row 2: Column 19 LCD Character r - 1571 623h 0 to 7 LCD Row 2: Column 20 LCD Character r - 1572 624h 8 to 15 LCD Row 3: Column 1 LCD Character r - 1572 624h 0 to 7 LCD Row 3: Column 2 LCD Character r - 1573 625h 8 to 15 LCD Row 3: Column 3 LCD Character r - 1573 625h 0 to 7 LCD Row 3: Column 4 LCD Character r -

Page 38 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 1552 to 1591 (610h to 637h) LCD Display Data Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1574 626h 8 to 15 LCD Row 3: Column 5 LCD Character r - 1574 626h 0 to 7 LCD Row 3: Column 6 LCD Character r - 1575 627h 8 to 15 LCD Row 3: Column 7 LCD Character r - 1575 627h 0 to 7 LCD Row 3: Column 8 LCD Character r - 1576 628h 8 to 15 LCD Row 3: Column 9 LCD Character r - 1576 628h 0 to 7 LCD Row 3: Column 10 LCD Character r - 1577 629h 8 to 15 LCD Row 3: Column 11 LCD Character r - 1577 629h 0 to 7 LCD Row 3: Column 12 LCD Character r - 1578 62Ah 8 to 15 LCD Row 3: Column 13 LCD Character r - 1578 62Ah 0 to 7 LCD Row 3: Column 14 LCD Character r - 1579 62Bh 8 to 15 LCD Row 3: Column 15 LCD Character r - 1579 62Bh 0 to 7 LCD Row 3: Column 16 LCD Character r - 1580 62Ch 8 to 15 LCD Row 3: Column 17 LCD Character r - 1580 62Ch 0 to 7 LCD Row 3: Column 18 LCD Character r - 1581 62Dh 8 to 15 LCD Row 3: Column 19 LCD Character r - 1581 62Dh 0 to 7 LCD Row 3: Column 20 LCD Character r - 1582 62Eh 8 to 15 LCD Row 4: Column 1 LCD Character r - 1582 62Eh 0 to 7 LCD Row 4: Column 2 LCD Character r - 1583 62Fh 8 to 15 LCD Row 4: Column 3 LCD Character r - 1583 62Fh 0 to 7 LCD Row 4: Column 4 LCD Character r - 1584 630h 8 to 15 LCD Row 4: Column 5 LCD Character r - 1584 630h 0 to 7 LCD Row 4: Column 6 LCD Character r - 1585 631h 8 to 15 LCD Row 4: Column 7 LCD Character r - 1585 631h 0 to 7 LCD Row 4: Column 8 LCD Character r - 1586 632h 8 to 15 LCD Row 4: Column 9 LCD Character r - 1586 632h 0 to 7 LCD Row 4: Column 10 LCD Character r - 1587 633h 8 to 15 LCD Row 4: Column 11 LCD Character r - 1587 633h 0 to 7 LCD Row 4: Column 12 LCD Character r - 1588 634h 8 to 15 LCD Row 4: Column 13 LCD Character r - 1588 634h 0 to 7 LCD Row 4: Column 14 LCD Character r - 1589 635h 8 to 15 LCD Row 4: Column 15 LCD Character r - 1589 635h 0 to 7 LCD Row 4: Column 16 LCD Character r - 1590 636h 8 to 15 LCD Row 4: Column 17 LCD Character r - 1590 636h 0 to 7 LCD Row 4: Column 18 LCD Character r - 1591 637h 8 to 15 LCD Row 4: Column 19 LCD Character r - 1591 637h 0 to 7 LCD Row 4: Column 20 LCD Character r -

Page 39 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.5 Unit Name Registers The Unit Name string is stored in registers within the Address range 1592 to 1611 (638h to 64Bh). Each register contains two characters, with a total of 40 characters being stored in the block of 20 Addresses. The upper byte of Address 1592 contains the first character in the string; the lower byte of Address 1592 contains the second character in the string etc. Note: the Unit Name string is settable using the iMAC2 Controller’s web interface controller setting’s page. Address 1592 to 1611 (638h to 64Bh) Unit Name Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1592 638h 8 to 15 Hardware string: Character 1 Character r - 1592 638h 0 to 7 Hardware string: Character 2 Character r - 1593 639h 8 to 15 Hardware string: Character 3 Character r - 1593 639h 0 to 7 Hardware string: Character 4 Character r - 1594 63Ah 8 to 15 Hardware string: Character 5 Character r - 1594 63Ah 0 to 7 Hardware string: Character 6 Character r - 1595 63Bh 8 to 15 Hardware string: Character 7 Character r - 1595 63Bh 0 to 7 Hardware string: Character 8 Character r - 1596 63Ch 8 to 15 Hardware string: Character 9 Character r - 1596 63Ch 0 to 7 Hardware string: Character 10 Character r - 1597 63Dh 8 to 15 Hardware string: Character 11 Character r - 1597 63Dh 0 to 7 Hardware string: Character 12 Character r - 1598 63Eh 8 to 15 Hardware string: Character 13 Character r - 1598 63Eh 0 to 7 Hardware string: Character 14 Character r - 1599 63Fh 8 to 15 Hardware string: Character 15 Character r - 1599 63Fh 0 to 7 Hardware string: Character 16 Character r - 1600 640h 8 to 15 Hardware string: Character 17 Character r - 1600 640h 0 to 7 Hardware string: Character 18 Character r - 1601 641h 8 to 15 Hardware string: Character 19 Character r - 1601 641h 0 to 7 Hardware string: Character 20 Character r - 1602 642h 8 to 15 Hardware string: Character 21 Character r - 1602 642h 0 to 7 Hardware string: Character 22 Character r - 1603 643h 8 to 15 Hardware string: Character 23 Character r - 1603 643h 0 to 7 Hardware string: Character 24 Character r - 1604 644h 8 to 15 Hardware string: Character 25 Character r - 1604 644h 0 to 7 Hardware string: Character 26 Character r - 1605 645h 8 to 15 Hardware string: Character 27 Character r - 1605 645h 0 to 7 Hardware string: Character 28 Character r - 1606 646h 8 to 15 Hardware string: Character 29 Character r - 1606 646h 0 to 7 Hardware string: Character 30 Character r - 1607 647h 8 to 15 Hardware string: Character 31 Character r - 1607 647h 0 to 7 Hardware string: Character 32 Character r - 1608 648h 8 to 15 Hardware string: Character 33 Character r - 1608 648h 0 to 7 Hardware string: Character 34 Character r - 1609 649h 8 to 15 Hardware string: Character 35 Character r - 1609 649h 0 to 7 Hardware string: Character 36 Character r - 1610 64Ah 8 to 15 Hardware string: Character 37 Character r - 1610 64Ah 0 to 7 Hardware string: Character 38 Character r - 1611 64Bh 8 to 15 Hardware string: Character 39 Character r - 1611 64Bh 0 to 7 Hardware string: Character 40 Character r -

Page 40 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.6 Hardware Version Registers The Hardware Version string is stored in registers within the Address range 1612 to 1621 (64Ch to 655h). Each register contains two characters, with a total of 20 characters being stored in the block of 10 Addresses. The upper byte of Address 1612 contains the first character in the string; the lower byte of Address 1612 contains the second character in the string etc. A typical Hardware Version string follows the format: H/W ???? V#.# MMM YY Where “?” represents an alphanumeric character, “#” is a number, and “MMM YY” is the month and year of release. Address 1612 to 11621 (64Ch to 655h) Hardware Version Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1612 64Ch 8 to 15 Hardware string: Character 1 Character r - 1612 64Ch 0 to 7 Hardware string: Character 2 Character r - 1613 64Dh 8 to 15 Hardware string: Character 3 Character r - 1613 64Dh 0 to 7 Hardware string: Character 4 Character r - 1614 64Eh 8 to 15 Hardware string: Character 5 Character r - 1614 64Eh 0 to 7 Hardware string: Character 6 Character r - 1615 64Fh 8 to 15 Hardware string: Character 7 Character r - 1615 64Fh 0 to 7 Hardware string: Character 8 Character r - 1616 650h 8 to 15 Hardware string: Character 9 Character r - 1616 650h 0 to 7 Hardware string: Character 10 Character r - 1617 651h 8 to 15 Hardware string: Character 11 Character r - 1617 651h 0 to 7 Hardware string: Character 12 Character r - 1618 652h 8 to 15 Hardware string: Character 13 Character r - 1618 652h 0 to 7 Hardware string: Character 14 Character r - 1619 653h 8 to 15 Hardware string: Character 15 Character r - 1619 653h 0 to 7 Hardware string: Character 16 Character r - 1620 654h 8 to 15 Hardware string: Character 17 Character r - 1620 654h 0 to 7 Hardware string: Character 18 Character r - 1621 655h 8 to 15 Hardware string: Character 19 Character r - 1621 655h 0 to 7 Hardware string: Character 20 Character r -

Page 41 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.7 Firmware Version Registers The Firmware Version string is stored in registers within the Address range 1622 to 1631 (656h to 65Fh). Each register contains two characters, with a total of 20 characters being stored in the block of 10 Addresses. The upper byte of Address 1622 contains the first character in the string; the lower byte of Address 1622 contains the second character in the string etc. A typical Firmware Version string follows the format: F/W ???? V#.# MMM YY Where “?” represents an alphanumeric character, “#” is a number, and “MMM YY” is the month and year of release. Address 1622 to 1631 (656h to 65Fh) Firmware Version Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1622 656h 8 to 15 Firmware string: Character 1 Character r - 1622 656h 0 to 7 Firmware string: Character 2 Character r - 1623 657h 8 to 15 Firmware string: Character 3 Character r - 1623 657h 0 to 7 Firmware string: Character 4 Character r - 1624 658h 8 to 15 Firmware string: Character 5 Character r - 1624 658h 0 to 7 Firmware string: Character 6 Character r - 1625 659h 8 to 15 Firmware string: Character 7 Character r - 1625 659h 0 to 7 Firmware string: Character 8 Character r - 1626 65Ah 8 to 15 Firmware string: Character 9 Character r - 1626 65Ah 0 to 7 Firmware string: Character 10 Character r - 1627 65Bh 8 to 15 Firmware string: Character 11 Character r - 1627 65Bh 0 to 7 Firmware string: Character 12 Character r - 1628 65Ch 8 to 15 Firmware string: Character 13 Character r - 1628 65Ch 0 to 7 Firmware string: Character 14 Character r - 1629 65Dh 8 to 15 Firmware string: Character 15 Character r - 1629 65Dh 0 to 7 Firmware string: Character 16 Character r - 1630 65Eh 8 to 15 Firmware string: Character 17 Character r - 1630 65Eh 0 to 7 Firmware string: Character 18 Character r - 1631 65Fh 8 to 15 Firmware string: Character 19 Character r - 1631 65Fh 0 to 7 Firmware string: Character 20 Character r -

Page 42 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.8 Software Version Registers The Software Version string is stored in registers within the Address range 1632 to 1641 (660h to 669h). Each register contains two characters, with a total of 20 characters being stored in the block of 10 Addresses. The upper byte of Address 1632 contains the first character in the string; the lower byte of Address 1632 contains the second character in the string etc. A typical Software Version string follows the format: S/W ???? V#.# MMM YY Where “?” represents an alphanumeric character, “#” is a number, and “MMM YY” is the month and year of release. Address 1632 to 1641 (660h to 669h) Software Version Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1632 660h 8 to 15 Software string: Character 1 Character r - 1632 660h 0 to 7 Software string: Character 2 Character r - 1633 661h 8 to 15 Software string: Character 3 Character r - 1633 661h 0 to 7 Software string: Character 4 Character r - 1634 662h 8 to 15 Software string: Character 5 Character r - 1634 662h 0 to 7 Software string: Character 6 Character r - 1635 663h 8 to 15 Software string: Character 7 Character r - 1635 663h 0 to 7 Software string: Character 8 Character r - 1636 664h 8 to 15 Software string: Character 9 Character r - 1636 664h 0 to 7 Software string: Character 10 Character r - 1637 665h 8 to 15 Software string: Character 11 Character r - 1637 665h 0 to 7 Software string: Character 12 Character r - 1638 666h 8 to 15 Software string: Character 13 Character r - 1638 666h 0 to 7 Software string: Character 14 Character r - 1639 667h 8 to 15 Software string: Character 15 Character r - 1639 667h 0 to 7 Software string: Character 16 Character r - 1640 668h 8 to 15 Software string: Character 17 Character r - 1640 668h 0 to 7 Software string: Character 18 Character r - 1641 669h 8 to 15 Software string: Character 19 Character r - 1641 669h 0 to 7 Software string: Character 20 Character r -

Page 43 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.9 Application (SLP) Software Registers The Application (SLP) Software Version string is stored in registers within the Address range 1642 to 1651 (66Ah to 673h). Each register contains two characters, with a total of 20 characters being stored in the block of 10 Addresses. The upper byte of Address 1642 contains the first character in the string; the lower byte of Address 1642 contains the second character in the string etc. The name of the Application (SLP) Software is project dependent and as such, does not have a typical format. Address 1642 to 1651 (66Ah to 673h) Application (SLP) Software Version Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1642 66Ah 8 to 15 Application (SLP) Software string: Character 1 Character r - 1642 66Ah 0 to 7 Application (SLP) Software string: Character 2 Character r - 1643 66Bh 8 to 15 Application (SLP) Software string: Character 3 Character r - 1643 66Bh 0 to 7 Application (SLP) Software string: Character 4 Character r - 1644 66Ch 8 to 15 Application (SLP) Software string: Character 5 Character r - 1644 66Ch 0 to 7 Application (SLP) Software string: Character 6 Character r - 1645 66Dh 8 to 15 Application (SLP) Software string: Character 7 Character r - 1645 66Dh 0 to 7 Application (SLP) Software string: Character 8 Character r - 1646 66Eh 8 to 15 Application (SLP) Software string: Character 9 Character r - 1646 66Eh 0 to 7 Application (SLP) Software string: Character 10 Character r - 1647 66Fh 8 to 15 Application (SLP) Software string: Character 11 Character r - 1647 66Fh 0 to 7 Application (SLP) Software string: Character 12 Character r - 1648 670h 8 to 15 Application (SLP) Software string: Character 13 Character r - 1648 670h 0 to 7 Application (SLP) Software string: Character 14 Character r - 1649 671h 8 to 15 Application (SLP) Software string: Character 15 Character r - 1649 671h 0 to 7 Application (SLP) Software string: Character 16 Character r - 1650 672h 8 to 15 Application (SLP) Software string: Character 17 Character r - 1650 672h 0 to 7 Application (SLP) Software string: Character 18 Character r - 1651 673h 8 to 15 Application (SLP) Software string: Character 19 Character r - 1651 673h 0 to 7 Application (SLP) Software string: Character 20 Character r -

Page 44 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.10 Boot Loader Name The log processor boot loader name string is stored in registers within the Address range 1652 to 1659 (674h to 67Bh). Each register contains two characters, with a total of 16 characters being stored in the block of 8 Addresses. The upper byte of Address 1652 contains the first character in the string; the lower byte of Address 1652 contains the second character in the string etc. Address 1652 to 1659 (674h to 67Bh) Boot Loader Name Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1652 674h 8 to 15 Boot Loader Name string: Character 1 Character r - 1652 674h 0 to 7 Boot Loader Name string: Character 2 Character r - 1653 675h 8 to 15 Boot Loader Name string: Character 3 Character r - 1653 675h 0 to 7 Boot Loader Name string: Character 4 Character r - 1654 676h 8 to 15 Boot Loader Name string: Character 5 Character r - 1654 676h 0 to 7 Boot Loader Name string: Character 6 Character r - 1655 677h 8 to 15 Boot Loader Name string: Character 7 Character r - 1655 677h 0 to 7 Boot Loader Name string: Character 8 Character r - 1656 678h 8 to 15 Boot Loader Name string: Character 9 Character r - 1656 678h 0 to 7 Boot Loader Name string: Character 10 Character r - 1657 679h 8 to 15 Boot Loader Name string: Character 11 Character r - 1657 679h 0 to 7 Boot Loader Name string: Character 12 Character r - 1658 67Ah 8 to 15 Boot Loader Name string: Character 13 Character r - 1658 67Ah 0 to 7 Boot Loader Name string: Character 14 Character r - 1659 67Bh 8 to 15 Boot Loader Name string: Character 15 Character r - 1659 67Bh 0 to 7 Boot Loader Name string: Character 16 Character r - 3.8.11 Boot Loader Revision The log processor boot loader revision string is stored in registers within the Address range 1660 to 1662 (67Ch to 67Eh). Each register contains two characters, with a total of 6 characters being stored in the block of 3 Addresses. The upper byte of Address 1660 contains the first character in the string; the lower byte of Address 1660 contains the second character in the string etc. Address 1660 to 1662 (67Ch to 67Eh) Boot Loader Revision Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1660 67Ch 8 to 15 Boot Loader Revision string: Character 1 Character r - 1660 67Ch 0 to 7 Boot Loader Revision string: Character 2 Character r - 1661 67Dh 8 to 15 Boot Loader Revision string: Character 3 Character r - 1661 67Dh 0 to 7 Boot Loader Revision string: Character 4 Character r - 1662 67Eh 8 to 15 Boot Loader Revision string: Character 5 Character r - 1662 67Eh 0 to 7 Boot Loader Revision string: Character 6 Character r -

Page 45 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.12 Hardware Name The log processor hardware name string is stored in registers within the Address range1663 to 1670 (67Fh to 686h). Each register contains two characters, with a total of 16 characters being stored in the block of 8 Addresses. The upper byte of Address 1663 contains the first character in the string; the lower byte of Address 1663 contains the second character in the string etc. Address 1663 to 1670 (67Fh to 686h) Hardware Name Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1663 67Fh 8 to 15 Hardware Name string: Character 1 Character r - 1663 67Fh 0 to 7 Hardware Name string: Character 2 Character r - 1664 680h 8 to 15 Hardware Name string: Character 3 Character r - 1664 680h 0 to 7 Hardware Name string: Character 4 Character r - 1665 681h 8 to 15 Hardware Name string: Character 5 Character r - 1665 681h 0 to 7 Hardware Name string: Character 6 Character r - 1666 682h 8 to 15 Hardware Name string: Character 7 Character r - 1666 682h 0 to 7 Hardware Name string: Character 8 Character r - 1667 683h 8 to 15 Hardware Name string: Character 9 Character r - 1667 683h 0 to 7 Hardware Name string: Character 10 Character r - 1668 684h 8 to 15 Hardware Name string: Character 11 Character r - 1668 684h 0 to 7 Hardware Name string: Character 12 Character r - 1669 685h 8 to 15 Hardware Name string: Character 13 Character r - 1669 685h 0 to 7 Hardware Name string: Character 14 Character r - 1670 686h 8 to 15 Hardware Name string: Character 15 Character r - 1670 686h 0 to 7 Hardware Name string: Character 16 Character r - 3.8.13 Hardware Revision The log processor hardware revision string is stored in registers within the Address range 1671 to 1673 (687h to 689h). Each register contains two characters, with a total of 6 characters being stored in the block of 3 Addresses. The upper byte of Address 1671 contains the first character in the string; the lower byte of Address 1671 contains the second character in the string etc. Address 1671 to 1673 (687h to 689h) Hardware Revision Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1671 687h 8 to 15 Hardware Revision string: Character 1 Character r - 1671 687h 0 to 7 Hardware Revision string: Character 2 Character r - 1672 688h 8 to 15 Hardware Revision string: Character 3 Character r - 1672 688h 0 to 7 Hardware Revision string: Character 4 Character r - 1673 689h 8 to 15 Hardware Revision string: Character 5 Character r - 1673 689h 0 to 7 Hardware Revision string: Character 6 Character r -

Page 46 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.14 Serial Number The iMAC2 Controller’s serial number string is stored in registers within the Address range1674 to 1681 (68Ah to 691h). Each register contains two characters, with a total of 16 characters being stored in the block of 8 Addresses. The upper byte of Address 1674 contains the first character in the string; the lower byte of Address 1674 contains the second character in the string etc. Address 1674 to 1681 (68Ah to 691h) Serial Number Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1674 68Ah 8 to 15 Serial Number string: Character 1 Character r - 1674 68Ah 0 to 7 Serial Number string: Character 2 Character r - 1675 68Bh 8 to 15 Serial Number string: Character 3 Character r - 1675 68Bh 0 to 7 Serial Number string: Character 4 Character r - 1676 68Ch 8 to 15 Serial Number string: Character 5 Character r - 1676 68Ch 0 to 7 Serial Number string: Character 6 Character r - 1677 68Dh 8 to 15 Serial Number string: Character 7 Character r - 1677 68Dh 0 to 7 Serial Number string: Character 8 Character r - 1678 68Eh 8 to 15 Serial Number string: Character 9 Character r - 1678 68Eh 0 to 7 Serial Number string: Character 10 Character r - 1679 68Fh 8 to 15 Serial Number string: Character 11 Character r - 1679 68Fh 0 to 7 Serial Number string: Character 12 Character r - 1680 690h 8 to 15 Serial Number string: Character 13 Character r - 1680 690h 0 to 7 Serial Number string: Character 14 Character r - 1681 691h 8 to 15 Serial Number string: Character 15 Character r - 1681 691h 0 to 7 Serial Number string: Character 16 Character r -

Page 47 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART 3.8.15 Software Name The log processor software name string is stored in registers within the Address range1682 to 1689 (692h to 699h). Each register contains two characters, with a total of 16 characters being stored in the block of 8 Addresses. The upper byte of Address 1682 contains the first character in the string; the lower byte of Address 1682 contains the second character in the string etc. Address 1682 to 1689 (692h to 699h) Software Name Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1682 692h 8 to 15 Software Name string: Character 1 Character r - 1682 692h 0 to 7 Software Name string: Character 2 Character r - 1683 693h 8 to 15 Software Name string: Character 3 Character r - 1683 693h 0 to 7 Software Name string: Character 4 Character r - 1684 694h 8 to 15 Software Name string: Character 5 Character r - 1684 694h 0 to 7 Software Name string: Character 6 Character r - 1685 695h 8 to 15 Software Name string: Character 7 Character r - 1685 695h 0 to 7 Software Name string: Character 8 Character r - 1686 696h 8 to 15 Software Name string: Character 9 Character r - 1686 696h 0 to 7 Software Name string: Character 10 Character r - 1687 697h 8 to 15 Software Name string: Character 11 Character r - 1687 697h 0 to 7 Software Name string: Character 12 Character r - 1688 698h 8 to 15 Software Name string: Character 13 Character r - 1688 698h 0 to 7 Software Name string: Character 14 Character r - 1689 699h 8 to 15 Software Name string: Character 15 Character r - 1689 699h 0 to 7 Software Name string: Character 16 Character r - 3.8.16 Software Revision The log processor software revision string is stored in registers within the Address range 1690 to 1697 (69Ah to 6A1h). Each register contains two characters, with a total of 6 characters being stored in the block of 3 Addresses. The upper byte of Address 1690 contains the first character in the string; the lower byte of Address 1690 contains the second character in the string etc. Address 1690 to 1697 (687h to 6A1h) Software Revision Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1690 69Ah 8 to 15 Software Revision string: Character 1 Character r - 1690 69Ah 0 to 7 Software Revision string: Character 2 Character r - 1691 69Bh 8 to 15 Software Revision string: Character 3 Character r - 1691 69Bh 0 to 7 Software Revision string: Character 4 Character r - 1692 69Ch 8 to 15 Software Revision string: Character 5 Character r - 1692 69Ch 0 to 7 Software Revision string: Character 6 Character r - 1693 69Dh 8 to 15 Software Revision string: Character 7 Character r - 1693 69Dh 0 to 7 Software Revision string: Character 8 Character r - 1694 69Eh 8 to 15 Software Revision string: Character 9 Character r - 1694 69Eh 0 to 7 Software Revision string: Character 10 Character r - 1695 69Fh 8 to 15 Software Revision string: Character 11 Character r - 1695 69Fh 0 to 7 Software Revision string: Character 12 Character r -

Page 48 of 48 Ampcontrol Pty Ltd – ABN 28 000 915 542 iMAC2 Controller Modbus TCP/IP Communications Manual IMAC2B010 V2 – 10/18 APPROVED FOR EXTERNAL DISTRIBUTION – PROPERTY OF AMPCONTROL PTY LTD – NOT TO BE REPRODUCED IN PART Address 1690 to 1697 (687h to 6A1h) Software Revision Registers Address Bit Name Description r/w SLP Tag Dec. Hex. 1696 6A0h 8 to 15 Software Revision string: Character 13 Character r - 1696 6A0h 0 to 7 Software Revision string: Character 14 Character r - 1697 6A1h 8 to 15 Software Revision string: Character 15 Character r - 1697 6A1h 0 to 7 Software Revision string: Character 16 Character r -