UC100 User Guide
IoT Controller
Sensor Featuring LoRaWAN®

Follow us: Linkedin/bmetersuk
B METERS UK | www.bmetersuk.com | Milesight

Safety Precautions

Milesight will not shoulder responsibility for any loss or damage resulting from not following the instructions of this operating guide.

• The device must not be remodeled in any way.
• Do not place the device close to objects with naked flames.
• Do not place the device where the temperature is below/above the operating range.
• Power off the device when installing or wiring.
• Make sure electronic components do not drop out of the enclosure while opening.
• The device must never be subjected to shocks or impacts.

Declaration of Conformity
UC100 is in conformity with the essential requirements and other relevant provisions of the CE, FCC, and RoHS.

Copyright © 2011-2024 Milesight. All rights reserved.
All information in this guide is protected by copyright law. Whereby, no organization or individual shall copy or reproduce the whole or part of this user guide by any means without written authorization from Xiamen Milesight IoT Co., Ltd.

For assistance, please contact
Milesight technical support:
Email: iot.support@milesight.com
Support Portal: support.milesight-iot.com
Tel: 86-592-5085280
Fax: 86-592-5023065
Address: Building C09, Software Park III,
Xiamen 361024, China

Revision History

Date	Doc Version	Description
May 27, 2022	V 1.0	Initial version
Dec. 5, 2022	V 1.1	Add active pass-through feature and two-way pass-through feature on RS485
Jan 24, 2024	V 1.2	1. Add data storage and retransmission feature 2. Increase to 32 Modbus channels 3. Add downlink commands to configure Modbus channels 4. Add Modbus channel alarm feature

Product Introduction

1.1 Overview
UC100 is an IoT controller used for remote control and data acquisition from Modbus RS485 devices via LoRaWAN® networks. It can read up to 32 Modbus RTU devices and support Modbus transparent transmission between server and RS485 devices as a Modbus to LoRaWAN® converter. Besides, UC100 supports multiple trigger conditions and actions which can work autonomously even when the network drops.

1.2 Features

•  Easy to connect with diverse wired sensors through RS485 interfaces
• Support LoRaWAN® wireless communication
• Multiple triggering conditions and actions
• Embedded watchdog for work stability
• Industrial metal case design with a wide operating temperature range
• Compliant with standard LoRaWAN® gateways and network servers
• Quick and easy management with Milesight IoT Cloud solution

Hardware Introduction

2.1 Packing List

If any of the above items are missing or damaged, please contact your sales representative.

2.2 Hardware Overview

120Ω Terminal Resistor Switch: the device will add a 120Ω termination resistor to avoid data-corrupting reflections if RS485 data rate is high or cable length is long.

2.3 LED and Reset Button
The reset button is inside the device.

Function	Action	LED Indication
Work Status	System is functioning properly	Static On
	Fail to acquire data from data interfaces	Slowly Blinks
	Device upgrade or system error	Static On
Reboot	Press and hold the button for more than 3 seconds.	Slowly Blinks
Reset	Press and hold the button for more than 10 seconds.	Quickly Blinks

2.4 Dimensions (mm)

Device Installation

UC100 device can be placed on a desktop or mounted to a wall.

1. Take off the back cover of UC100 device, and fix the wall plugs into the wall according to the drilling position as referred.
2. Screw the cover on the mounting positions and install back the device.

Operation Guide

4.1 Log in the ToolBox

1. Download ToolBox software fromMilesight website.
2. Power on the UC100 device, then connect it to computer via the type-C port.
3. Open the ToolBox and select type as General, then click password to log in ToolBox. (Default password: 123456)
4. After logging in the ToolBox, you can change device settings.

4.2 LoRaWAN Settings
LoRaWAN settings are used for configuring the transmission parameters in LoRaWAN® network.
Basic LoRaWAN Settings:
Configure join type, App EUI, App Key and other information. You can also keep all settings by default.

Parameters	Description
Device EUI	Unique ID of the device on the label.
App EUI	Default App EUI is 24E124C0002A0001.
Application Port	The port is used for sending and receiving data, the default port is 85.
Working Mode	Fixed as Class C.
Join Type	OTAA and ABP modes are available.
Application Key	Appkey for OTAA mode, default is 5572404C696E6B4C6F52613230313823.
Device Address	DevAddr for ABP mode, default is the 5th to 12th digits of SN.
Network Session Key	Nwkskey for ABP mode, default is 5572404C696E6B4C6F52613230313823.
Application Session Key	Appskey for ABP mode, default is 5572404C696E6B4C6F52613230313823.
RX2 Data Rate	RX2 data rate to receive downlinks or send/receive D2D commands.
RX2 Frequency	RX2 frequency to receive downlinks or send/receive D2D commands. Unit: Hz
Spread Factor	If ADR is disabled, the device will send data via this spread factor.
Confirmed Mode	If the device does not receive ACK packet from network server, it will resend data once.

Rejoin Mode	Reporting interval ≤ 35 mins: the device will send a specific number of LinkCheckReq MAC packets to the network server every reporting interval or every double reporting interval to validate connectivity; If there is no response, the device will re-join the network. Reporting interval > 35 mins: the device will send a specific number of LinkCheckReq MAC packets to the network server every reporting interval to validate connectivity; If there is no response, the device will re-join the network.
Set the number of packets sent	When rejoin mode is enabled, set the number of LinkCheckReq packets sent.
ADR Mode	Allow the network server to adjust datarate of the device.
Tx Power	The transmit power of device.

Note:

1. Please contact sales for device EUI list if there are many units.
2. Please contact sales if you need random App keys before purchasing.
3. Select OTAA mode if you use Milesight IoT Cloud to manage devices.
4. Only OTAA mode supports rejoin mode.

LoRaWAN Frequency Settings:
Go to LoRaWAN Settings > Channel to select supported frequency and select channels to send uplinks. Make sure the channels match what you set in the LoRaWAN® gateway.

If the frequency is one of CN470/AU915/US915, enter the index of the channel that you want to enable in the input box, making them separated by commas.
Examples:
1, 40: Enabling Channel 1 and Channel 40
1-40: Enabling Channel 1 to Channel 40
1-40, 60: Enabling Channel 1 to Channel 40 and Channel 60
All: Enabling all channels
Null: Indicates that all channels are disabled

4.3 General Settings

Parameters	Description
Device ID	Show the SN of the device.
Reporting Interval	Reporting interval of transmitting Modbus channel data to the network server. Range: 1-1080 mins, default: 20 mins
Data Storage	Disable or enable reporting data storage locally.

Data Retransmission	Disable or enable data retransmission.
D2D	Enable or disable Milesight D2D Feature.
D2D Key	Set a unique key the same as the setting in Milesight D2D controller or agent device. The default is 5572404C696E 6B4C6F52613230313823.
Change Password	Change the password to log in ToolBox.

4.4 RS485 Settings
UC100 supports to set up communications with RS485 via two ways: Modbus channels or Modbus RS485 bridge LoRaWAN®.
Basic Serial Settings:
UC100 has one RS485 port for Modbus RTU device connection. The basic serial settings should be the same as RS485 terminal devices.

Parameters	Description
Stop Bit	1 bit/2 bit is available.
Data Bit	8 bit is available.
Parity	None, Odd and Even are available.
Baud Rate	1200/2400/4800/9600/19200/38400/57600/115200 are available.
Execution Interval (ms)	The execution interval between each Modbus channel command.
Max Resp Time	The maximum response time that the UC100 waits for the reply to the

(ms)	command. If it does not get a response after the max response time, it is determined that the command has timed out.
Max Retry Times	Set the maximum retry times after the device fails to read data from RS485 terminal devices.

Modbus Channels:
UC100 supports to work as a Modbus RTU Client (Master) to poll the data from the RS485 device and return the data to the network server.

Click to add Modbus channels, then save configurations.

Parameters	Description
Channel ID	Select the channel ID you want to configure from 32 channels.
Name	Customize the name to identify every Modbus channel.
Slave ID	Set a Modbus slave ID of a terminal device.
Address	The starting address for reading.
Quantity	Set read how many digits from the starting address, it fixes to 1.
Type	Select the data type of Modbus channels.
Byte Order	Set the Modbus data reading order if you configure the type as Input register or holding register. INT32/Float: ABCD, CDBA, BADC, DCBA INT16: AB, BA
Sign	The tick indicates that the value has a plus or minus sign.
Fetch	Click to send a Modbus read command to test if the RS485 device can reply with the correct values. Note that do not click frequently to avoid the fetch failure due to the slow response of RS485 devices. Example: as this setting, the device will send command: 01 03 00 00 00 01 84 0A

Modbus RS485 bridge LoRaWAN®:
UC100 supports to work as a relay to set up the communication between the server and RS485 devices. There are two pass-through modes:
Active Pass-through: the network server can send any command to the RS485 device and the RS485 device can only react according to server commands.

Two-way Pass-through: not only can network server send any command to the RS485 device, but also the RS485 device supports transmitting the data to the network server actively.
Note: When Two-way Pass-through is enabled, Modbus channels can’t be used and the corresponding IF-THEN command will not work.

Parameters	Description
Modbus RS485 bridge LoRaWAN®	Enable or disable the Modbus RS485 bridge LoRaWAN® feature.
Pass-through Mode	Select from Active Pass-through or Two-way Pass-through.
Port	The communication port between the RS485 device and the network server. Range: 2-84, 86-223.

4.5 IF-THEN Command
UC100 supports configuring locally IF-THEN commands to do some actions automatically even without a network connection. One device can be added 16 commands at most.

1. Go to the Command page, and click “Edit” to add commands.
2. Set an IF condition based on the terminal device data or UC100 device status.
   

   Condition

   Description

   Channel

   When the value of a Modbus channel, reaches the condition. For coil/discrete type, the condition is False/True; For other types, the condition is Above/Below/Within/Change. Is continued for: the threshold value should last for some time. Set lockout time: after the lockout time, UC100 will check if the value still reaches the threshold and matches the condition. 0 means this condition will only be detected once. The time interval of value change: the change value should last for some time. Note: The parameter will be hidden if you enable Two-way Pass-through feature.

   Received a Milesight D2D control command

   This only works with the Milesight D2D feature is enabled.

3. Set THEN action according to your request. You can add at most 3 actions in one command

Action	Description
Report a threshold packet	Report as threshold alarm packet to network server when the value of selected Modbus channel value reaches the threshold.
Report a packet on shift change	Report as change alarm packet to network server when the value of selected Modbus channel value changes a specific range.
Send a LoRaWAN® message	Send a custom message to the network server.
Restart the Device	Reboot the device.
Send a Milesight D2D control command	This only works with Milesight D2D feature is enabled.
Send a Modbus command via the RS485 interface	Send a Modbus RTU command to the RS485 device.

4.6 Milesight D2D Settings
Milesight D2D protocol is developed by Milesight and used for setting up transmission among Milesight devices without a gateway. When the Milesight D2D setting is enabled, UC100 can work as a Milesight D2D controller to send control commands to other devices or work as a Milesight D2D agent to receive commands to trigger a reboot or message to the network server.

1. Go to General > Basic page, enable Milesight D2D feature and define a unique Milesig ht D2D key which is the same as Milesight D2D controller or agent devices. (Default Mil esight D2D Key: 5572404C696E6B4C6F52613230313823)
2. Go to LoRaWAN Settings > Basic to configure the RX2 datarate and RX2 frequency. When UC100 works as Milesight D2D controller, it will send commands as RX2 settings.
3. Go to Command page to set corresponding operations.
   When the RS485 channel triggers, UC100 can work as Milesight D2D controller to send a control command to control the Milesight D2D agent device. The command should be a 2-byte hexadecimal number.

When UC100 receives a Milesight D2D command, it can work as a Milesight D2D agent to reboot the device, send a LoRaWAN® message or send Modbus command to RS485 terminal devices.

4.7 Data Storage
UC100 supports storing 1000 pieces of data locally and export data via ToolBox. The device will record the data according to reporting interval even not joining to network.

1. Go to Status page to click Sync to sync the device time or select LoRaWAN® version as 1.0.3 to enquire the time from network server when joining network.
2. Go to General > Basic to enable data storage feature.
3. Go to Maintenance > Backup and Reset , click Export to select the data time period and click Save to export data.
4. Click Clear to clear all stored data inside the device as required.

4.8 Data Retransmission
UC100 supports data retransmission to ensure the network server can get all data even if network is down for some times. There are two ways to get the lost data:

• Network server sends downlink commands to enquire the historical data for specifying time range, refer to Historical Data Enquiry;
• When network is down if no response from LinkCheckReq MAC packets for a period of time, the device will record the network disconnected time and re-transmit the lost data after device re-connects the network.

Here are the steps for retransmission:

1. Go to General > Basic to enable data storage and data retransmission feature.
2. Go to LoRaWAN Settings > Basic to enable rejoin mode feature and set the number of packets sent. Take below as example, the device will send LinkCheckReq MAC packets to the network server regularly to check if the network is disconnected; if there is no response for 8+1 times, the join status will change to de-active and the device will record a data lost time point(the time to join the network).
3. After the network connected back, the device will send the lost data from the point in time when the data was lost according to the data re-transmission reporting interval.

Note:

1. If the device is reboot or re-powered during data retransmission, the device will re-send interrupted retransmission data again after device is reconnected back to the network.
2. If the network is disconnected again during data retransmission, it will only send the latest disconnection data.
3. UC100 supports to send downlink commands to enquire the historical data for specifying time range, refer to Historical Data Enquiry.

4.9 Maintenance
4.9.1 Upgrade

UC100 supports upgrade firmware locally via ToolBox software.

1. Download firmware fromMilesight website to your PC.
2. Go to Maintenance > Upgrade, click Browse to import firmware and upgrade the device. You can also click Up to Date to search for the latest firmware of the device and upgrade.

Note: Any operation on ToolBox is not allowed during upgrading, otherwise the upgrading will be interrupted, or even the device will break down.

4.9.2 Backup
UC100 devices support configuration backup for easy and quick device configuration in bulk.
Backup is allowed only for devices with the same model and LoRaWAN® frequency band.

1. Go to Maintenance > Backup and Reset, and click Export to save the current configuration as json format backup file.
2. Click Browse to select the backup file, then click Import to import the configurations.

4.9.3 Reset to Factory Default
Please select one of following methods to reset device:
Via Hardware: Open the case of UC100, and hold the reset button for more than 10s until the LED blinks.
Via ToolBox Software: Go to Maintenance > Backup and Reset to click Reset.

Device Payload

All data are based on the following format (HEX), the Data field should follow little-endian:

Channel1	Type1	Data1	Channel2	Type2	Data2	Channel 3	…
1 Byte	1 Byte	N Bytes	1 Byte	1 Byte	M Bytes	1 Byte	…

For decoder examples, you can find them at https://github.com/Milesight-IoT/SensorDecoders.
5.1 Device Information
UC100 reports basic device information of device every time joining the network.

Channel	Type	Byte	Description
ff	01 (Protocol Version)	1	01 => V1
	09 (Hardware Version)	2	01 20 => V1.2

	0a (Software Version)	2	01 01 => V1.1
	0b (Power On)	1	Device is on
	16 (Device SN）	8	16 digits

Example:

ff0bff ff0101 ff166445b43411300001 ff090100 ff0a0101
Channel	Type	Value
ff	0b (Power On)	ff
ff	01 (Protocol Version)	01 (V1)
ff	16 (Device SN)	64 45 B4 34 11 30 00 01
ff	09 (Hardware Version)	0100 (V1.0)
ff	0a (Software Version)	0101 (V1.1)

5.2 Modbus Channel Data
UC100 reports RS485 sensor data which are fetched by Modbus channels according to reporting interval (20 mins by default).

Item	Channel	Type	Byte	Description
Modbus Channel	ff	19	4~7	Channel ID (1B) + Data Length (1B) + Data Type (1B) +Data (Mutable) Data Type:
					Code	Data Type
					00	Coil
					01	Discrete
					02	Input16
					03	Hold16
					04	Hold32
					05	Hold_float
					06	Input32
					07	Input_float
					08	Input_int32_with upper 16 bits
					09	Input_int32_with lower 16 bits
					0a	Hold_int32_with upper 16 bits
					0b	Hold_int32_with lower 16 bits
Collection Exception	ff	15	1	Channel ID of failed Modbus collection.

Note: Channel ID can be configured in ToolBox.

Channel ID	Description
00	RS485 (Modbus Master) Channel 1
01	RS485 (Modbus Master) Channel 2
02	RS485 (Modbus Master) Channel 3
…	…
1f	RS485 (Modbus Master) Channel 32

Examples:
1. No Modbus Channel.

ff0bff
Channel	Type	Value
ff	0b (Power On)	ff

2. Fail to fetch Channel1 data.

ff 15 00
Channel	Type	Value
ff	15	00 => Channel 1

3. Succeed to fetch Channel8 data.

ff 19 07 02 03 15 00
Channel	Type	Channel ID	Data Size	Data Type	Value
ff	19	07 => Channel 8	02 => 2 bytes	03 => Hold 16	15 00 => 00 15 = 21

Note: When data type is holding register or input register, ToolBox can set different byte orders.
Take below Modbus register response from RS485 sensors as example:

Register Address	Value (Hex)
0	00 15
1	00 20

When using different byte orders, you can use ToolBox to fetch different results, and the device will upload data with little endian order.

Data Type	Byte Order	Fetch Result	Uplink (HEX)
Holding/Input Register (INT16)	AB	21 (0x15)	15 00 (BA)
	BA	5376 (0x1500)	00 15 (AB)
Holding/Input Register (INT32)	ABCD	1376288 (0x00150020)	20 00 15 00 (DCBA)
	CDAB	2097173 (0x00200015)	15 00 20 00 (BADC)
	BADC	352329728 (0x15002000)	00 20 00 15 (CDAB)
	DCBA	536876288 (0x20001500)	00 15 00 20 (ABCD)

Holding/Input Register (INT32 with upper 16 bits)	/	21 (0x15)	15 00 00 00
Holding/Input Register (INT32 with lower 16 bits)	/	32 (0x20)	20 00 00 00

5.3 Modbus Channel Alarm
UC100 supports to report Modbus channel alarm packets if a Modbus channel value reaches the condition.
Note: when data type is coil or discrete, the device will not report the alarm packet.

Item	Channel	Type	Byte	Description
Modbus Channel Alarm	ff	ee	4~7	Alarm Type (1B) + Data Length (1B) + Data Type (1B) +Data (Mutable) Alarm Type: Bit7-6: 00=No, 01=Threshold alarm, 10=Threshold Alarm release, 11=Change alarm Bit 5-0: Channel ID

Examples:

1. Channel 1 data reaches the threshold.
   

   ff ee 40 02 03 15 00
   Channel	Type	Channel ID & Alarm Type	Data Size	Data Type	Value
   ff	ee	40 => 0100 0000 01=Threshold alarm 100000= 00 => Channel 1	02 => 2 bytes	03 => Hold 16	15 00 => 00 15 = 21

2. Channel 3 data changes more than 3.

ff ee c2 02 03 05 00
Channel	Type	Channel ID & Alarm Type	Data Size	Data Type	Value
ff	ee	C2 => 1100 0010 11=Change alarm 000010= 02 => Channel 3	02 => 2 bytes	03 => Hold 16	05 00 => 00 5 = 5

5.4 Downlink Command
UC100 supports downlink commands to configure the device. The application port is 85 by default.

Item	Channel	Type	Description
Reporting Interval	ff	03	2 Bytes, unit: s
Reboot		10	ff
Data Storage		68	00: disable, 01: enable
Data Retransmission		69	00: disable, 01: enable
Data Retransmission Interval		6a	3 Bytes Byte 1: 00 Byte 2-3: interval time, unit:s range: 30~1200s (600s by default)
Modbus Channel Setting		ef	01+Channel ID (1B)+Slave ID (1B) + Address (2B) + Type (1B) + Sign (1B) Sign: 11=signed, 01=unsigned Type:
				Code	Data Type
				00	Coil

				01	Discrete
				02	Input16_AB
				03	Input16_BA
				04	Input32_ABCD
				05	Input32_BADC
				06	Input32_CDAB
				07	Input32_DCBA
				08	Input32_AB
				09	Input32_CD
				0a	Input_float_ABCD
				0b	Input_float_BADC
				0c	Input_float_CDAB
				0d	Input_float_DCBA
				0e	Hold16_AB
				0f	Hold16_BA
				10	Hold32_ABCD
				11	Hold32_BADC
				12	Hold32_CDAB
				13	Hold32_DCBA
				14	Hold32_AB
				15	Hold32_CD
				16	Hold_float_ABCD
				17	Hold_float_BADC
				18	Hold_float_CDAB
				19	Hold_float_DCBA
Delete Modbus Channel		ef	00+Channel ID (1B)
Mobus Channel Name		ef	02+Channel ID (1B) + Name Length (1B) + Name (Mutable)

Note: Channel ID in downlink commands is different from uplinks:

Channel ID	Description
01	RS485 (Modbus Master) Channel 1
02	RS485 (Modbus Master) Channel 2
03	RS485 (Modbus Master) Channel 3
…	…
20	RS485 (Modbus Master) Channel 32

Examples:
1. Set reporting interval as 20 minutes.

ff 03 b0 04
Channel	Type	Value
ff	03	b0 04 => 04 b0 = 1200 s = 20 mins

2. Reboot the device

ff 10 ff
Channel	Type	Reserved
ff	10 (Reboot)	ff

3. Add a Modbus channel as below:

ff ef 01 06 00 0100 0e 11
Channel	Type	Value
ff	ef	Channel: 06=Channel 6 Slave ID: 00=Slave ID Address: 01 00=>00 01=1 Type: 0e=Hold16_AB Sign: 11=signed

4. Set name of Modbus channel6 as “test6”.

ff ef 02 06 05 7465737436
Channel	Type	Value
ff	ef	Channel: 06=Channel 6 Name length: 05=5 Bytes Hex to ASCii: 74 65 73 74 36 => t e s t 6

5.5 Historical Data Enquiry
UC100 supports sending downlink commands to enquire historical data for specified time point or time range. Before that, ensure the device time is correct and data storage feature was enabled to store the data.
Command format:

Channel	Type	Description
fd	6b (Enquire data in time point)	4 Bytes, unix timestamp
fd	6c (Enquire data in time range)	Start time (4 bytes) + End time (4 bytes), Unix timestamp
fd	6d (Stop query data report)	ff
ff	6a (Report Interval)	3 Bytes Byte 1: 01 Byte 2-3: interval time, unit:s range: 30~1200s (60s by default)

Reply format:

Channel	Type	Description
fc	6b/6c	00: data enquiry success 01: time point or time range invalid 02: no data in this time or time range
20	ce (Modbus Channel)	Data time stamp (4B) + Channel ID (1B) + Ctrl (1B) + Data (4B)
20	cd (Custom Message)	Data time stamp (4B) + Data Length (1B) + Data (Mutable)

Ctrl Format:

Bit	7	6-2	1	0
	0	Data type	0: fetch failure 1: fetch success	0

Note:

1. The device only uploads no more than 300 data records per range enquiry.
2. When enquiring the data in time point, it will upload the data which is closest to the search point within the reporting interval range. For example, if the device reporting interval is 10 minutes and users send command to search for 17:00’s data, if the device find there is data stored in 17:00, it will upload this data; if not, it will search for data between 16:50 to 17:10 and upload the data which is closest to 17:00.

Example:
1. Enquire historical data between 2024/01/18 15:45:00 to 2024/01/18 15:50:00.

fd6c fcd6a865 28d8a865
Channel	Type	Value
fd	6c (Enquire data in time range)	Start time: fcd6a865 => 65a8d6fc = 1705563900 =2024/01/18 15:45:00 End time: 28d8a865 => 65a8d828 =1705564200 =2024/01/18 15:50:00

Reply:

fc6c00
Channel	Type	Value
fc	6c (Enquire data in time range)	00: data enquiry success

20ce 93d7a865 00 3a 15000000
Channel	Type	Time Stamp	Value
20	ce (Modbus Channel)	93d7a865 => 2024/01/18 15:47:00	00: Channel 1 Crtl: 3a => 0011 1010 Bit1=1=> Fetch success Bit6-2 => 01110 = 0e=Hold16_AB Data: 15000000=>00 00 00 15=21

Documents / Resources

Milesight UC100 IoT Controller [pdf] User Guide UC100, UC100 IoT Controller, IoT Controller, Controller

References

• User Manual