Remote Automation Solutions Bristol Modbus RTU Serial Communications User Manual
Below you will find brief information for Digital Controller UDC 3300, Digital Circular Chart Recorder 4500T. The UDC 3300 and 4500T support Modbus RTU communication protocol and are designed to provide a popular data exchange connecting these instruments to both Honeywell and foreign master devices. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices which subscribe to the Modbus RTU RS-485 specification. The specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes are employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to these instruments.
Advertisement
Advertisement
for Instruction Manual Cl-51-52-25-66F - Sept., 1999 (Providing this information will permit BBI to effectively and efficiently process your return. Completion is required to receive optimal lead time. Lack of information may result in increased lead times.) Date RA # SH Line No. Standard Repair Practice is as follows: Variations to this is Please be aware of the Non warranty standard charge: practice may be requested in the “Special Requests” section. e There is a $100 minimum evaluation charge, which is e Evaluate / Test / Verify Discrepancy applied to the repair if applicable ( V in “returned” B,C, e Repair / Replace / etc. in accordance with this form or D of part III below) е Return to Customer Part I Please complete the following information for single unit or multiple unit returns Address No. (office use only) Address No. (office use only) Bill to : Ship to: Purchase Order: Contact Name: Phone: Fax: E-Mail: Part 11 Please complete Parts II & III for each unit returned Model No./Part No. Description Range/Calibration S/N Reason for return : [] Failure [] Upgrade [] Verify Operation [] Other 1. Describe the conditions of the failure (Frequency/Intermittent, Physical Damage, Environmental Conditions, Communication, CPU watchdog, etc.) (Attach a separate sheet if necessary) 2. Comm. interface used: [] Standalone [ RS-485 [7] Ethernet [7] Modem (PLM (2W or 4W) or SNW) [_]Other: 3. What is the Firmware revision? What is the Software &version? Part III If checking “replaced” for any question below, check an alternate option if replacement is not available A. If product is within the warranty time period but is excluded due to BBT's warranty clause, would you like the product: [repaired [returned []replaced [] scrapped? B. Ifproduct were found to exceed the warranty period, would you like the product: [repaired []returned [replaced [] scrapped? C. If product is deemed not repairable would you like your product: [returned []replaced [1] scrapped? D. If BBI is unable to verify the discrepancy, would you like the product: [returned []replaced [] *see below? * Continue investigating by contacting the customer to learn more about the problem experienced? The person to contact that has the most knowledge of the problem is: phone If we are unable to contact this person the backup person is: phone Special Requests: | Ship prepaid to: Bristol Babcock Inc., Repair Dept., 1100 Buckingham Street, Watertown, CT 06795 Phone: 860-945-2442 Fax: 860-945-3875 Form GBU 13.01 Rev. A NOTICE Copyright Notice The information in this document is subject to change without notice. Every effort has been made to supply complete and accurate information. However, Bristol Babcock assumes no responsibility for any errors that may appear in this document. Request for Additional Instructions Additional copies of instruction manuals may be ordered from the address below per atten- tion of the Sales Order Processing Department. List the instruction book numbers or give complete model number, serial or software version number. Furnish a return address that includes the name of the person who will receive the material. Billing for extra copies will be according to current pricing schedules. Trademarks or copyrighted products mentioned in this document are for information only, and belong to their respective companies, or trademark holders. Copyright® 1999, Bristol Babcock, 1100 Buckingham St., Watertown, CT 06795. No part of this manual may be reproduced in any form without the express written permission of Bristol Babcock. How to return material for Repair or Exchange Before a product can be returned to Bristol Babcock for repair, upgrade, exchange, or to verify proper operation, form (GBU 13.01) must be completed in order to obtain a RA (Return Authorization) number and thus ensure an optimal lead time. Completing the form is very important since the information permits the Bristol Babcock Repair Dept.to ef- fectively and efficiently process the repair order. You can easily obtain a RA number by: A. FAX Completing the form (GBU 13.01) and faxing it to (860) 945-3875. A BBI Repair Dept. representative will return call (or other requested method) with a RA number. B. E-MAIL Accessing the form (GBU 13.01) via the Bristol Babcock Web site (www.bristol- babcock.com) and sending it via E-Mail to brepairQbristolbabcock.com. A BBI Repair Dept. representative will return E-Mail (or other requested method) with a RA number. C. Mail Mail the form (GBU 13.01) to Bristol Babcock Inc. Repair Dept. 1100 Buckingham Street Watertown, CT 06795 A BBI Repair Dept. representative will return call (or other requested method) with a RA number. D. Phone Calling the BBI Repair Department at (860) 945-2442. A BBI Repair Department representative will record a RA number on the form and complete Part I, then send the form to the Customer via fax (or other requested method) for Customer completion of Parts IT & III. A copy of the completed Repair Authorization Form with issued RA number should be in- cluded with the product being returned. This will allow us to quickly track, repair, and return your product to you. 1.1 Modbus RTU Implementation ......................7. eme DR Der ener Deere arrenarenenreeoeenr tarros ] 1.2 Modbus RTU Configuration InterfacCe.................e...... 00000 DER eN Der reee Dire ee ] 2. MODBUS RTU MESSAGE FORMAT ..........e...eeeenconenanrncinananonanonaeanennanenencenane een. 2.1 Modbus RTU Link Layer................. e... einer erre reee anne nene renenereerecene cenar ere 2.2 Modbus RTU Data Layer .....................ee.000emeriimiie eee ree er een er ere erre Der erecer acero enceces 4 2.3 IEEE 32-bit Floating Point Register Information ................—...ee.eeeeeeerienecereccee cen ener cn 3. MODBUS RTU FUNCTION CODES...........eeeeeenenenencconcannonenaneonnaneananconeenenaeeeeereanee Y 3.1 Function Code 01 - Read Coil Status.......................2e. 0000 ar eee e re een nero rererecenTens 10 3.2 Function Code 02 - Read Input StAtUS ….......…...….rrrrrcereerese era serre see races serre enenan een nrnene nana e senc 12 3.3 Function Codes 03/04 - Read Input REgisterS ……..…..…..….....…serereenenenmnsmnennnnennnennnnnnnnnnnnnn 14 34 Function Code 05 - Force Single Coil o.com EARKRERRREAEAKRERERKEREERKERRRAEEEA EEE 16 3.5 Function Codes 06 - Preset Single Register......................e.e.e0mercie cece eee eee eee nee 17 3.6 Function Code 08 - Loopback Message........................ ei. Dee e en reese eae eneae as 18 3.7 Function Codes 16 (10h) - Preset Multiple Registers...............................ereiii DAA 19 3.8 Function Code 17 (11h) - Report Device ID o.oo, eee ———— 20 4. MODBUS RTU EXCEPTION CODES..…....………oserossensentenennennensentrnannemennenmrem annee nan OS A.1 Register Mapping OVErVIEW …..............ecrerecranereae sea rarasa men rarennan na sa cran neer scanners e recense enr annens 25 A.2 Miscellaneous Register Mapping .....................—..... eee Dr DR eee ener rene eres 27 A.2.1 RSX, VPR, VRX, UDC3300, UMC800 Miscellaneous Register Mapping...................—.—..—.. 27 A.2.2 DR4300, DR4500 Chart Record Mapping ....................-...eee... 0000 RR eee 28 A.2.3 Loop Value Integer Register Mapping for UDC2300, UDC3300, DR4300 and DR4500....29 A.3 Loop Value Register Mapping.........................e=e00emee00 0 ee nee e Den e RD EEG DZ A.4 Analog Input Value Register Mapping ..........................e eee. ER RER RAR e crane canne cn DO A.5 Communication or Constant Value Register MAppIng..........…....…seeereseres enr rene resse care ananas 37 A.6 Math, Calculated Value, or Variable Register Mapping ………..……………rrrrerenererencrrrrencer crc r ere cennene 38 А.7 Mathor Calculated Value Status Register Mapping ..........................0..e.eerieceeii 39 A.8 Totalizer Value Register Mapping.....................eene ee Nerereorenerrerenener Decor ens 40 A.9 Totalizer Status Register Mapping ....................-........0eeeeeeeeee e eee e rcenarenrane eran ae 41 A.10 Maintenance (HealthWatch) Value Register Mapping ....................m.=.ee0006000 ccc, 42 A.11 Time Register Mapping ......................ee..ee.00 mee trent eases sass ae ease ee sansemmsnnbae rare een eassneeans 43 A.12 Alarm Status Register Mapping....................—..ee.reeeeeee DDR Re eee area e erre errar ee 44 iv Modbus® RTU Serial Communications User Manual 9/99 B. A.13 Shed Timer Reset Register oii iii cee eee eee eee eee caesarean nee 45 A.14 Alarm Set Point Value Register MAppIng ………….…..….eenenennnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn 46 A.15 Set Point Programmer Value Register MAppINng.…..…...…..….necrcrrenennanen ne RIERA 47 A.16 Set Point Programmer Additional Values Register Mapping...................e.2 EEK rcaranree 49 A.16 Tagged Signal Register Mapping... e RD RR ee Dee De SD] A.17 Set Point Programmer Segment Mapping........................ reece eee screenees ene D À A.17.1 Segment Register MAppIng..…..…...…..……rrrrrmnnsnsnçnnnnnmnnnnnmennnnnnnennnnnnnnnnnnnnnnnnnnnndtHs A.17.2 Example For Determining a Segment Register .........................2.....00 0000000 ene 4 A.18 Scheduler Value Register Mapping (UMC800 Only) .....................7..00meereeeneeee eee 55 A.19 Scheduler Segment RegISter Mapping.....................=..-..e meme ee RR A.19.1 Schedule Segment Mapping ....................e.ee.eneereeeeenenec ene IR RR / A.19.2 Segment Register Mapping....................e....1000eeier nene reee RR RD reee rene nee DO A.19.3 Example For Determining a Segment Register ........................e1e.e..000nereeni cena DI APPENDIX A DS > 9/99 Modbus® RTU Serial Communications User Manual V Table 1-1 Table 2-1 Table 2-2 Table 2-3 Table 3-1 Table 3-2 Table 3-3 Table 3-4 Table 3-5 Table 3-6 Table 3-7 Table 3-8 Table 3-9 Table 4-1 Communication and Configuration User Manuals Modbus RTU Message Formats 3 Floating Point Bit Representation 4 IEEE Floating Point Number Examples 5 Modbus RTU Function Codes Definitions 7 Maximum Number of Object Addresses for Each Instrument Type 8 Maximum Number of Registers Allowable per Request 9 Request Delay Time* 9 DR4300 Coil Mapping 11 DR4500 Coil Mapping 11 UDC2300/UDC3300 Coil Mapping 11 UMC$800 Coil Mapping 11 UDC3300 Input Mapping 13 Table 3-10 UMC$800 Discrete Input Mapping 13 Modbus RTU Data Layer Status Exception Codes 24 25 Table A-1 Global Register Map vi Modbus® RTU Serial Communications User Manual 9/99 Introduction 1. Introduction 1.1 Modbus RTU Implementation This implementation 1s designed to provide a popular data exchange format connecting these instruments to both Honeywell and foreign master devices. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices which subscribe to the Modbus RTU RS-485 specification. These instruments DO NOT emulate any MODICON type device. The Modbus RTU specification 1s respected in the physical and data link layers. The message structure of the Modbus RTU function codes are employed and standard IEEE 32-bit floating point and integer formats are used, Data register mapping is unique to these instruments. The definition in Table 2-1 is the register mapping for many Honeywell instruments and the corresponding parameter value within those instruments. 1.2 Modbus RTU Configuration Interface This user manual does not include the configuration interfaces for the instruments supporting the Modbus RTU Protocol. The following table describes the references to the specific instrament's communication and configuration user manuals. Table 1-1 Communication and Configuration User Manuals Instrument Model User Manual Part Number RSX, VPR, VRX, 51-52-25-68 UDC5300 DR4300 51-52-25-71 DR4500 51-52-25-69 UDC2300 51-52-25-75 UDC3300 51-52-25-70 51-52-25-38 UDC3000A Modbus 485 RTU Communications Manual UDC6300 51-52-25-53 51-52-99-05 DPR100 US11-6149 DPR100C-DPR100D Communication Option Manual DPR180/DPR250 EN11-6189 DPR180/DPR250 Communication Option Manual UMC800 51-52-25-82 9/99 Modbus® RTU Serial Communications User Manual 1 Introduction 2 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Message Format Table 2-1 Modbus RTU Message Formats Coding system 8 bit binary Number of data bits per 10 Bits character start bits - 1 data bits - 8 parity bits - 0 stop bits - 1 Parity Not used Bit transfer rate 300, 600, 1200, 2400, 4800, 9600, 19200, 38400 Selectable NOTE: Not all instruments support all Baud Rates. Duplex Half duplex Transceiver or TX/RX Error checking CRC (cyclic redundancy check) Polynomial (CRC-16 10100000000001) Bit transfer order LSB first End of message Idle line for 3.5 or more characters (>1.82 msec for 19200). 2.1 Modbus RTU Link Layer The link layer includes the following properties/behaviors: e Slave address recognition, e Start / End of Frame detection, o CRC-16 generation / checking, » Transmit / receive message time-out, o Buffer overflow detection, oe Framing error detection, e Idle line detection. Errors detected by the physical layer in messages received by the slave are 1gnored and the physical layer automatically restarts by initiating a new receive on the next idle line detection. 9/99 Modbus® RTU Serial Communications User Manual 3 Modbus RTU Message Format General Modbus RTU message format 2.2 2.3 Query message format [Slave Address, Function Code, Function code dependent data, CRC 16] Response message format [Slave Address, Function Code™, Function code dependent data, CRC 16] * If an error is detected in a valid message the response function code is modified by adding 80 (hex) and the function code dependent data is replaced by an exception response code as described in Section 4 - Modbus RTU Exception Codes. Between messages, the RS-485 link is in a high impedance state. During this time receiving devices are more susceptible to noise generated false start of messages. Although noise-generated messages are rejected due to address, framing, and CRC checking, they can cause the loss of a good message when they are included in the message stream. In the slave the transmitting device enables its transmitter line diver and forces an idle line state onto the link for three character time slots prior to transmitting. This forces termination of any noise generated messages and improves message frame synchronization. Modbus RTU Data Layer The data layer includes: e Diagnostic loopback, e Function code recognition / rejection, e Busy /repoll, e Data error code generation Errors detected by the data layer are rejected and the slave responds to the polling device with a Modbus- type status exception error. A summary of the Modbus status exception codes 1s listed in Section 4 - Modbus RTU Exception Codes. IEEE 32-bit Floating Point Register Information The Modbus applications support IEEE 32-bit floating point information for several of the function codes. Each IEEE 32-bit floating point number requires two consecutive registers (four bytes) starting with the register defined as the starting register for the information. The stuffing order for IEEE floating point shown below is referred to in Modbus literature as Modicon 984 Enhanced cartridge real (word swap) format. Table 2-2 Floating Point Bit Representation Register Bit 15, Bit 14, … Bit 3, Bit 2, Bit 1, Bit O (offset) 0 SIGN,EXP7,EXP6,EXP5,E4,E3,E2,E1,EXP0,M22,M21,M20,M19,M18,M17,M16 1 M15,M14,M13,M12,M11,M10,M9,M8,M7,M6,M5,M4,M3,M2,M1,MO Where: SIGN is the sign bit, EXP7 through EXPO are exponent bits, and M22 through MO are mantissa bits. In IEEE floating point the most significant bit of the mantissa is implied. The exponent 1s offset by 128 (80 hex). An exponent value equal to zero will approximate zero with the sign bit and mantissa being significant. Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Message Format Table 2-3 IEEE Floating Point Number Examples Value IEEE FP Register. N Register. N+1 (decimal) | msB LSB | high low high low 100.0 42C80000h | 42h C8h 00h 00h 55.32 425D47AEh | 42h 5Dh 47h AER 2.0 40000000h | 40h 00h 00h 00h 1.0 3F800000h | 3Fh 80h 00h 00h -1.0 BF800000h | BFh 80h 00h 00h ATTENTION In an IBM-compatible PC, floating point values are normally stored in byte and word swapped order. 9/99 ModbusO RTU Serial Communications User Manual Modbus RTU Message Format 6 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes 3. Modbus Е unction Codes The Honeywell Universal Modbus RTU protocol uses a subset of the standard Modbus RTU function codes to provide access to process-related information. Several MODICON function codes are employed. It 15 appropriate to define instrument-specific "user-defined" function codes. Several standard Modbus RTU function codes are supported. These standard function codes provide basic support for IEEE 32-bit floating point numbers and 16-bit integer register representation of instrument's process data. Repolling of data is not supported by these instruments, Table 3-1 Modbus RTU Function Codes Definitions Function Code Name Usage 01 Read Coil Status Read Discrete Output Bit Mapped Data 02 Read Input Status Read Discrete Input Bit Mapped Data 03 04 Read Holding Registers / Read Data in 16 bit Register Format (high/low). Used to read integer or floating point process data. Registers are consecutive and are imaged from the instrument to the host. Read Input Registers 05 Force Single Coll Write data to force Coil ON/OFF Values of FF 00 forces coil ON Values of 00 00 forces coil OFF Values of FF FF releases the force of the coil All other values are illegal and will not effect the coil. RSX, VPR, VRX, UDC5300, UMC800 ONLY 06 Preset Single Register Write Data in 16-bit integer Format (high/low) ONLY. 08 Loopback Test Used for diagnostic testing of the communications port. RSX, VPR, VRX, UDC5300 do not implement this function code. 16 (10h) Preset Multiple Registers Write Data in 16-bit Format (high/low). Used to write integer and floating point override data. Registers are consecutive and are imaged from the host to the instrument. 17 (11h) Report Device ID Read instrument ID and connection information, ROM version, etc. 20 (14h) Read General Reference Used to Read or upload the instrument's configuration into the host device. See Section 1.2 - Modbus RTU Configuration Interface for a reference to the User Manual for the specific instrument. 21 (15h) Write General Reference Used to Write or download an instrument's configuration into the instrument from a host device. See Section 1.2 - Modbus RTU Configuration Interface for a reference to the User Manual for the specific instrument. 9/99 ModbusO RTU Serial Communications User Manual! 7 Modbus RTU Function Codes Table 3-2 Maximum Number of Object Addresses for Each Instrument Type Object Name RSX | VRX | VPR | DR DR | DPR | DPR | DPR | UDC | UDC |UDC| UMC | See 4300 | 4500 | 100 | 180 | 250 | 2300 | 3300 |5300| 800 | Page Alarms Status 12 16 | 16 | 2 6 12 148 64 2 2 4 120 43 Alarm Set Point 12 116 | 16 | 2 6 12 148 ¡64 |2 2 4 10 45 Value Analog Inputs 12 112 |1 24 | 64 | 2 64” 36 Analog Output 8 8 1 8 8 64" | N/A Comm. or Constant | 10 |16 |16 |O 0 24 | 32 9 lo 37 Values Discrete Input 24 | 24 |2 2 4 36 | 48 |0 2 3 | 256" | N/A Discrete Output/Coil 24 | 24 | 2 6 12 | 36 [48 | 3 3 256" | N/A Loop 2 2 4 1 2 0 0 1 2 2 116 32 Math, Calculated, or | 24 |32 |32 (O 1 24 |32 [0 |2 |16|150 | 38 Variable Value Math or Calculated 24 | 32 |32 |0 1 6 24 | 32 |0 2 16 0 39 Value Status Set Point 0 1 4 1 2 0 0 0 1 1 1 4 46 Programmer Value | Segments per Set 0 63 | 63 | 24 12 0 0 0 12 | 12 | 63 | 50 51 Point Programmer Totalizer 6 12 | 3 1 4 0 0 0 0 1 O {0 40 Tagged Signals 0 0 0 0 0 0 0 0 0 O 500 50 Scheduler Value 0 0 0 0 0 0 0 0 0 O |1 54 Segments per 0 0 0 0 0 0 0 О 0 0 |50 57 Scheduler Schedule * UMC800 maximum number of 1/0 may exceed object limit. ATTENTION e Values depend on each instrument's model number. е DPR products only support Analog Inputs, Communication Values, and Math Values per this document at this time. Please reference US1/-6149 DPR100C-DPR100D Communication Option Manual and EN11-6189 DPR180/DPR250 Communication Option Manual for details pertaining to Alarms, Discrete inputs, and Discrete Outputs. Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes Table 3-3 Maximum Number of Registers Allowable per Request Version 5 or greater — 3.5 characters + 2 ms 20 ms Version 59 or greater — 3.5 characters + 2 ms | Function RSX, VPR, VRX, DPR100, DPR180, DR4300, DR4500 UDC3300, UDC2300 Code UDC5300, UMC800 DPR250 1, 2 See See See See Table 3-2 Table 3-2 Table 3-2 Table 3-2 3,4 127 Registers 64 Registers 82 Registers 22 Registers 63 Floats 32 Floats 41 Floats 11 Floats 5 1 Coil Not Supported Not Supported Not Supported 6 1 Register 1 Register 1 Register 1 Register 10h 127 Registers 64 Registers 42 Floats 1 Float 63 Floats 32 Floats FLOATS ONLY — | FLOAT ONLY — CAN CAN NOT WRITE NOT WRITE INTEGER INTEGER REGISTERS REGISTERS Table 3-4 Request Delay Time* RSX, VPR, DPR100, DR4300 DR4500 UDC3300, UDC5300, DPR180, UDC2300 UMC800 DPR250 3.5 Characters 3.5 Characters Version 4 — 20 ms Version 57 and 58 — 20 ms * The link's time delay will be the worst case for the units connected. For example, if a link has a UMC800 and a UDC3300 connected, the link must observe a request delay of 20 ms. 9/99 Modbus® RTU Serial Communications User Manual Modbus RTU Function Codes 3.1 Function Code 01 - Read Coil Status Description Query Function code 01 (0X references) is used to read the со!’ 5 (discrete output’s) ON/OFF status of the slave device in a binary data format. All binary data transferred using function code 01 is mapped into bytes. The specific number of coils available in an instrument or available via one Function Code 01! message is instrument-model specific. Broadcast 15 not supported. The query message specifies the starting coil and the quantity of coils to read. Coils are addressed starting at zero: coll 1 through 16 are addressed as O through 15 respectively. Query message format for function code 01 Slave Function | Starting Starting Number Number CRC CRC Address Code Address Address Coil Coil High Low High Low Example: Read coils number 1 to 7 from slave at address 02. 02 01 00 00 00 07 CRC CRC Response The coil status in the response message 1s packed as one coil per bit of the data field. Status is indicated as: | = ON; 0 = OFF. The LSB of the first data byte contains the coil addressed in the query. The other coils follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned coil quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The byte count field specifies the quantity of data bytes returned. Response message format for function code 01 Byte Data Data CRC CRC Count Function Code Slave Address Example: Coils number 2 and 7 are on, all others are off. 02 01 01 42 CRC CRC In the response the status of coils | - 7 1s shown as the byte value 42 hex, or 0100 0010 binary. Coil 8 is the MSB of this byte, and coil 1 1s the LSB. Left to right, the status of coil 7 through 1 is: ON-OFF-OFF-OFF- OFF-ON-OFF. Coil #8 was not requested and so bit #7 or the MSB was padded with a 0. 10 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes Table 3-5 DR4300 Coil Mapping Coil Number Instrument Function 1 Relay #1 2 Relay #2 Table 3-6 DR4500 Coil Mapping Coil Number Instrument Function 1 Alarm Relay #1 Alarm Relay #1 Control Relay #1 Control Relay #2 Control Relay #3 OD ¡NP Bi WI Control Relay #4 Table 3-7 UDC2300/UDC3300 Coil Mapping Coil Number Instrument Function 1 Control Relay 2 Alarm Relay #2 3 Alarm Relay #1 Table 3-8 UMC800 Coil Mapping Coil Number Instrument Function 1-256 Digital output position in the card cage. Determined from the formula: Coil Number = [(Slot-1)*16]+channel in module Example: To monitor a coil located in the 2™ channel of slot 10, the Modbus coil number is: [(10-1)*16] + 2 = 146 9/99 Modbus® RTU Serial Communications User Manual 11 Modbus RTU Function Codes 3.2 Function Code 02 - Read Input Status Description Query Function code 02 (1X references) is used to read the input’s (discrete input’s) ON/OFF status of the slave device in a binary data format. All binary data transferred using function code 02 is mapped into bytes. The specific number of inputs available in an instrument or available via one Function Code 02 message is instrument-model specific. Broadcast is not supported. The query message specifies the starting input and the quantity of inputs to read. Inputs are addressed starting at zero: input | through 16 are addressed as 0 through 15 respectively Query message format for function code 02 Slave Function | Starting Starting Number Number CRC CRC Address Code Address | Address Inputs Inputs High Low High Low Example: Read inputs number 1 to 7 from slave at address 02. 02 02 00 00 00 07 CRC CRC Response The input status in the response message 15 packed as one input per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the input addressed in the query. The other inputs follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned input quantity 1s not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The byte count field specifies the quantity of data bytes returned. Response message format for function code 02 Function Data Data CRC CRC Code Byte Count Slave Address Example: Inputs number 2 and 7 are on, all others are off. 02 02 01 42 CRC CRC In the response the status of inputs 1 - 7 1s shown as the byte value 42 hex, or 0100 0010 binary. Input 8 is the MSB of this byte, and input 1 is the LSB. Left to right, the status of input 7 through 1 is: ON-OFF-OFF- OFF-OFF-ON-OFF. Input #8 was not requested and so bit #7 or the MSB was padded with a 0. 12 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes Table 3-9 UDC3300 Input Mapping Coil Number | Instrument Function 1 Digital Input 2 Digital Input2 Table 3-10 UMC800 Discrete Input Mapping Input Number | Instrument Function 1-256 Digital input position in the card cage. Determined from the formula: Input Number = [(S/ot-1)"16]+channel! in module Exampie: To monitor an input located in the 3“ channel of slot 11, the Modbus input number is: [(11-1)*16] + 3 = 163 9/99 Modbus® RTU Serial Communications User Manual 13 Modbus RTU Function Codes 3.3 Function Codes 03/04 - Read Input Registers Description Query Function code 03 (4X references) or Function code 04 (3X references) is used to read the binary contents of input registers in the slave referenced in Appendix A. This function code 1s also not restricted to inputs, it may transmit alarm status, control parameters, etc. The specific supported registers available in an instrument or available via one Function Code 03/04 message is instrument-model specific. When a master station requests a register that 1s not supported by the specific device the slave will respond with zeros for that register. This specification states that if a request is made to an address that does not exist in the map in Appendix A, the instrument is to honor that request and return zeros. This behavior will greatly enhance the bandwidth on the link vs. making several different requests for non-contiguous data elements. (i.e. Consider a device that contains AI #1 and AI #3 and for some reason AI #2 is an invalid request.) The contiguous method would allow the read of AI #1 through AI #3 and the data location for Al #2 would be zeros. Broadcast is not supported. The query message specifies the starting register and quantity of registers to be read. Registers are addressed starting at zero: registers 1-16 are addressed as 0-15. Query message format for function code 03/04 Slave Function | Starting Starting Number Number CRC CRC Address Code Address Address Addresses | Addresses High Low High Low Example: Read analog inputs #1 and #2 in addresses 1800-1803 as floating point values from a slave at address 02. 02 04 18 00 00 04 CRC CRC 14 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes Response The register data in the response message are packed as two bytes per register. For each register, the first byte contains the high order bits and the second contains the low order bits. The floating point values require two consecutive registers. A request for a single floating point value must be for two registers. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. (See Section 2.3 IEEE 32-bit Floating Point Register Information.) If the master station requests only one register at an address of a floating point value, the slave may respond with an exception with illegal data address code. The Modbus RTU protocol has a single byte count for function codes 03 and 04, therefore the Modbus RTU protocol can only process up to 64 floating point and 127 integer values in a single request. Response message format for function codes 03/04 Slave Function Byte Data Data i. CRC CRC Address Code Count Example: Analog inputs #1 and #2 as floating point values where Al #1 = 100.0 and AI #2 = 55.32 02 04 08 42 C8 0000 47 AE 42 5D CRC CRC 9/99 Modbus® RTU Serial Communications User Manual 15 Modbus RTU Function Codes 3.4 Function Code 05 - Force Single Coil Description Query Force a single coil (0X reference) to either ON or OFF. These are the same coils used in Function Code OI. When broadcast, the same function forces the same coll in all attached slave devices. Only supported by RSX, VPR, VRX, UDC5300, UMC800 instruments. These instruments do not support broadcast, and forcing can only be done in the Run mode. The query message specifies the coil to be forced. Registers are addressed starting at zero: coil 1 1s address 0. The requested ON/OFF state is specified by a constant in the query data field. A value of FF 00 hex requests it to be ON. A value of 00 00 hex requests it to be OFF. RSX, VPR, VRX, UDC5300, UMCS800 products support a value of FF FF to release the force. Query message format for function code 05 Response Slave Function Coil Coil Force Force CRC CRC Address Code Address Address Data Data High Low High Low Example: Force coil 6 ON in a slave at address 02. 02 05 00 06 FF 00 CRC CRC The normal response is an echo of the query, returned after the coil state has been forced. Response message format for function code 05 Slave Function Coil Coil Force Force CRC CRC Address Code Address Address Data Data High Low High Low Example: Force coil 6 ON in a slave at address 02. 02 05 00 06 FF 00 CRC CRC 16 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes 3.5 Function Codes 06 - Preset Single Register Description Presets integer value into a single register (4X references). When broadcast, the function presets the same register references in all attached slaves. The specific supported registers available in an instrument via a Function Code 06 message may be instrument-model specific. However, every instrument that supports the register assignments specified in Appendix A with an access type “W” and integer and bit packed data types, supports writing to those specified registers via Function Code 06. Query The query message specifies the register references to be preset. Registers are addressed starting at zero: Register 1 is addressed as O. Query message format for function code 06 Slave Function | Address | Address Preset Preset CRC CRC Address Code High Low Data Data High Low Example: Set Loop 41 to Auto (address 00FAh) to a slave at address 02, 02 06 00 FA 00 01 CRC CRC Response The normal response is an echo of the query returned after the register contents have been preset. Response message format for function code 06 Slave Function Address Address Preset Preset CRC CRC Address Code High Low Data Data High Low Example: Set Loop #1 to Auto (address OOFAN) to a slave at address 02. 02 06 00 FA 00 01 CRC CRC 9/99 Modbus® RTU Serial Communications User Manual 17 Modbus RTU Function Codes 3.6 Function Code 08 - Loopback Message Description Query Echoes received query message. Not supported by RSX, VPR, VRX, UDC5300 instruments. Message can be any length up to half the length of the data buffer minus 8 bytes. Query message format for function code 08 Slave Function Any data, length limited to approximately half CRC CRC Address Code the length of the data buffer Example: 0208 01 02 03 04 CRC CRC Response Response message format for function code 08 Slave Function Data bytes received CRC CRC Address Code Example: 02 08 01 02 03 04 CRC CRC 18 ModbusO RTU Serial Communications User Manual 9/99 Modbus RTU Function Codes 3.7 Function Codes 16 (10h) - Preset Multiple Registers Description Presets values into a sequence of holding registers (4X references). When broadcast, the function presets the same register references in all attached slaves. The specific supported registers available in an instrument via a Function Code 16 (10h) message may be instrument-model specific. However, every instrument that supports the register assignments specified in Appendix A with an access type “W”, supports writing to those specified registers via Function Code 16 (10h). Query The query message specifies the register references to be preset. Registers are addressed starting at zero: Register 11s addressed as 0. Query message format for function code 16 (10h) Slave | Function | Starting Start Number Number Byte CRC | CRC Address Code Address | Address | Addresses | Addresses | Count High Low High Low Example: Preset Constant #1 (address 1880h) to 100.0 from a slave at address 02. 02 10 18 80 00 02 04 42 C8 00 00 CRC CRC Response The normal response returns the slave address, function code, starting address and the quantity of registers preset. The floating point values require two consecutive addresses. A request to preset a single floating point value must be for two addresses. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. (See Section 2.3 IEEE 32-bit Floating Point Register Information.) If the master station requests only one address at an address of a floating point value the slave MUST respond with an exception with illegal data address code. Response message format for function code 16 (10h) Slave Function | Starting Start Number Number CRC CRC Address Code Address | Address | Addresses | Addresses High Low High Low Example: Response from preset Constant #1 (address 1880h) to 100.0 from a slave at address 02. 02 10 18 80 00 02 CRC CRC 9/99 Modbus® RTU Serial Communications User Manual 19 Modbus RTU Function Codes 3.8 Function Code 17 (11h) - Report Device ID Description Query Function code 17 (11h) is used to report the Device Information which includes information like: Slave ID, device description, and firmware version. The query m essage specifies the function code only. Query message format for function code 17 (11h) Slave Address Function CRC CRC Code Example: Read Device ID from a slave at address 02. 02 11 CRC CRC Response The response is a record format describing the instrument. Response message format for function code 17 (11h) Slave Address Function Byte Slave Run Device CRC Code Count ID Indicator | Specific Status Data CRC Slave ID - The number associated with the device. (one byte) (byte 3) Slave ID Device Type (hex) N/A DPR 100 (Does not support 11h) N/A DPR 180 (Does not support 11h) N/A DPR250 (Does not support 11h) 43 DR4300 45 DR4500 23 UDC2300 33 UDC3300 53 UDC5300 ,RSX, VPR, VRX 02 UDC6000 63 UDC6300 80 UMC800 Run Indicator Status: (one byte) (byte 4) 00=0FF; FF=ON 20 Modbus® RTU Serial Communications User Manual 9/99 Device Specific Data: Device Model Device Device Description ID Class Mapping ID Device Description: 16 Character ASCII Message (zero filled) (bytes 5-20). Device Specific. Usually contains Device Tag + Version Number Device Type Device Description DPR100 N/A DPR 180 N/A DPR250 N/À DR4300 DR4300 x.y DR4500 DR4500 x.y RSX RSX x.y VPR/VRX VPR/VRX x.y UDC2300 UDC2300 x,y UDC3300 UDC3300 x.y UDC5300 UDC5300 x.y UDC6000 UDC6000 x.y UDC6300 UDC6300 x.y UMC800 UMC800 x.y x.y = version of instrument Modbus RTU Function Codes Model ID: The Model Identification (Device type specific). (one byte) (byte 21) Model ID Description 00 None Device Class ID: The Device Classification. (one byte) (byte 22) Class ID Class 00 Generic Class (Fixed Address Mapable) 01-FF Future 9/99 Modbus® RTU Serial Communications User Manual 21 Modbus RTU Function Codes Generic Class (00) Device Mapping: Describes the 1/O and feature mapping. Number of Records Record Record Record Record #1 #2 |. #n Number of Records: I Byte unsigned value 00-FFh (byte 23) Record Description: Byte Description 00 Type of Data Element (See Data Element Values Table Below) 01 Starting Address of Data Element Record (High) 02 Starting Address of Data Element Record (Low) 03 Number of Data Elements (High) 04 Number of Data Elements (Low) Data Element Values Table: Value Description 00 Analog Inputs 01 Analog Outputs 02 Discrete Inputs 03 Discrete Outputs 04 Control Loops 05 Set Point Programmers 06 Math. Calculated Values, or Variables 07 Constants 08 Alarms 09 Totalizers 10 Schedulers Tagged Signals 22 Modbus® RTU Serial Communications User Manual 9/99 Modbus RTU Exception Codes Introduction When a master device sends a query to a slave device it expects a normal response. One of four possible events can occur from the master’s query: e Slave device receives the query without a communication error and can handle the query normally. It returns a normal response. e Slave does not receive the query due to a communication error. No response is returned. The master program will eventually process a time-out condition for the query. e Slave receives the query but detects a communication error (parity, LRC or CRC). No response is returned. The master program will eventually process a time-out condition for the query. e Slave receives the query without a communication error but cannot handle it (i.e., request is to a non- existent coil or register). The slave will return with an exception response informing the master of the nature of the error (Illegal Data Address.) The exception response message has two fields that differentiate it from a normal response: Function Code Field: In a normal response, the slave echoes the function code of the original query in the function code field of the response. All function codes have a most-significant bit (MSB) of O (their values are below 80 hex). In an exception response, the slave sets the MSB of the function code to 1. This makes the function code value in an exception response exactly 80 hex higher than the value would be for a normal response. With the function code” s MSB set, the master’s application program can recognize the exception response and can examine the data field for the exception code. Data Field: In a normal response, the slave may return data or statistics in the data field. In an exception response, the slave returns an exception code in the data field. This defines the slave condition that caused the exception. Query Example: Internal slave error reading 2 registers starting at address 1820h from slave at slave address 02. 02 03 18 20 00 02 CRC CRC Response Example: Return MSB in Function Code byte set with Slave Device Failure (04) in the data field. 83 04 CRC CRC 9/99 Modbus® RTU Serial Communications User Manual 23 Modbus RTU Exception Codes Table 4-1 Modbus RTU Data Layer Status Exception Codes Exception Definition Description Code 01 ¡llegal Function The message received is not an allowable action for the addressed device. 02 legal Data Address The address referenced in the function-dependent data section of the message is not valid in the addressed device. 03 legal Data Value The value referenced at ihe addressed device location is no within range. 04 Slave Device Failure The addressed device has not been able to process a valid message due to a bad device state. 06 Slave Device Busy The addressed device has ejected a message due to a busy state. Retry later. 07 NAK, The addressed device cannot process the current Negative Acknowledge message. Issue a PROGRAM POLL to obtain device- dependent error data. | 09 Buffer Overflow The data to be returned for the requested number of registers is greater than the available bufier space. Function Code 20 only. 24 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A. Appendix А.Л Register Mapping Overview The following table describes the global register map for Function Code 03, 04, 06 and 10h. Table A-1 Global Register Map Start Address End Address Description 0000 XXXX Miscellaneous Parameters or Loop #1 Integer Record 0040 OOFF Loop #1 Record 0100 013F Loop #2 Integer Record 0140 O1FF Loop #2 Record 0240 02FF Loop #3 Record 0340 O3FF Loop #4 Record 0440 04FF Loop #5 Record 0540 O5FF Loop #6 Record 0640 O6FF Loop #7 Record 0740 07FF Loop #8 Record 0800 081C DR4300, DR4500 Chart Record 0840 08FF Loop #9 Record 0940 09FF Loop #10 Record 0A40 OAFF Loop #11 Record 0B40 OBFF Loop #12 Record 0C40 OCFF Loop #13 Record 0D40 ODFF Loop #14 Record ОЕ40 OEFF Loop #15 Record OF40 OFFF Loop #16 Record 1040 10FF Loop #17 Record 1140 11FF Loop #18 Record 1240 12FF Loop #19 Record 1340 13FF Loop #20 Record 1440 14FF Loop #21 Record 1540 15FF Loop #22 Record 1640 16FF Loop #23 Record 1740 17FF Loop #24 Record 1800 187F Analog Input Values (#1-#64) 1880 18BF Constant Values (#1 - #32) 18C0 1ABF Math Values (#1 - #256) 1ACO 1ACF Math Status (#1 - #256) 1B00 1B7F Totalizer Values (#1 - #64) 1B80 1583 Totalizer Status (Bit Packed) (#1 - #64) 1B90 1B91 Shed Timer Reset 1899 1ВАВ Maintenance (HealthWatch) Values 1BEO 1BE6 Clock 9/99 Modbus® RTU Serial Communications User Manual 25 Appendix A Start Address End Address Description 1BFO 1BFF Alarm Status (Bit Packed) (#1 - #256) 1C00 1DFF Alarm Set Point Values (#1 - #256) 1E00 1EOF Set Point Programmer #1 Record 1E10 ТЕЛЕ Set Point Programmer #2 Record 1E20 1E2F Set Point Programmer #3 Record 1E30 1E3F Set Point Programmer #4 Record 1F00 1F3F Set Point Programmer #1 Additional Values Record 1F40 1F7F Set Point Programmer #2 Additional Values Record 1F80 1FBF Set Point Programmer #3 Additional Values Record 1FCO 1FFF Set Point Programmer #4 Additional Values Record 2000 27CF Tagged Signals (#1 - #1000) 2800 29FF Set Point Programmer #1 Profile 2A00 2BFF Set Point Programmer #2 Profile 2C00 2DFF Set Point Programmer #3 Profile 2E00 2FFF Set Point Programmer #4 Profile 3000 304F Scheduler #1 Values Record 3050 309F Scheduler #2 Values Record 30A0 30EF Scheduler #3 Values Record 30F0 313F Scheduler #4 Values Record 3200 3DFF Scheduler #1 Schedule 3E00 49FF Scheduler #2 Schedule 4A00 55FF Scheduler #3 Schedule 5600 61FF Scheduler #4 Schedule 26 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.2 Miscellaneous Register Mapping A.2.1 RSX, VPR, VRX, UDC5300, UMCB800 Miscellaneous Register Mapping Address (hex) Register (decimal) Parameter Name Access Notes 0000 40001 Instrument Mode RW Bit Packed Indicators: Bit 0: 1:Diagnostic Bit 1: 1:Calibration (unused by UMC800) Bit 2: 1:Maintenance/Offline mode Bit 3: I:Program mode Bit 4: 1:Reset Unit/Force Cold Start (Write Only) Bit 5: 1:On-Line/Run mode Bit 6...15: Unused 0001 40002 Configuration Select Integer 0: Clear Configuration (Preserves Calibration) The UMCS00 does not support this register. 0002 40003 Load Recipe or Program Floating Point (UMC800 ONLY) 9/99 Modbus® RTU Serial Communications User Manual 27 Appendix A A.2.2 DR4300, DR4500 Chart Record Mapping Address | Register Parameter Name Access Notes (hex) (decimal) 0800 42049 Chart Speed (Hours/rev) R Floating Point in Engineering Units. Note 1 0802 42051 # Chart Divisions Floating Point in Engineering Units. 0804 42053 Chart Status Floating Point 0.0 = hold; 1.0 = running. 0806 42055 Pen | R Floating Point 0.0 = disabled; 1.0 = enabled 0808 42057 Pen | High Value R Floating Point in Engineering Units. Note | 080A 42059 Pen ! Low Value R Floating Point in Engineering Units. Note 1 080C 42061 Pen 2 R Floating Point 0.0 = disabled; 1.0 = enabled 080E 42063 Pen 2 High Value R Floating Point in Engineering Units. 0810 42065 Pen 2 Low Value Floating Point in Engineering Units. 0812 42067 Pen 3 R Floating Point 0.0 = disabled; 1.0 = enabled 0814 42069 Pen 3 High Value R Floating Point in Engineering Units. 0816 42071 Pen 3 Low Value R Floating Point in Engineering Units. 0818 42073 Pen 4 Floating Point 0.0 = disabled; 1.0 = enabled 081A 42075 Pen 4 High Value R Floating Point in Engineering Units. 081C 42077 Pen 4 Low Value R Floating Point in Engineering Units. NOTE 1: The DR4300 only supports the noted registers. All registers are supported by the DR4500. 28 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.2.3 Loop Value Integer Register Mapping for UDC2300, UDC3300, DR4300 and DR4500 Address | Register Parameter Name Access Notes (hex) (decimal) 0000 40001 PV R Integer Prescale * 10 Note 5 0001 40002 RV; Remote Set Point; SP2 R Integer Prescale * 10 0002 40003 Working Set Point R/W Integer Prescale * 10 Note 5 On a write the instrument will update the proper set point according to the loop's currently selected set point. 0003 40004 Output R/W Integer Prescale * 10 0004 40005 Input #1 R Integer Prescale * 10 0005 40006 Input #2 R Integer Prescale * 10 0006 40007 Gain #1 (Prop Band Él if active) | RW Integer Prescale * 10 0007 40008 Direction R Integer Prescale * 10 0008 40009 Reset #1 R/W Integer Prescale * 10 Note 1 0009 40010 Rate #1 R/W Integer Prescale * 10 Note I 000A 40011 Cycle Time #1 R/W Integer Prescale * 10 Note 2 000B 40012 PV Low Range R Integer Prescale * 10 000C 40013 PV High Range R Integer Prescale * 10 000D 40014 Alarm #1 SP #1 R/W Integer Prescale * 10 Note 7 000E 40015 Alarm #1 SP #2 R/W Integer Prescale * 10 Note 7 000F 40016 Alarm #1 Action R Integer Prescale * 10 Note 6 0010 40017 Gain #2 (Prop Band 42 if active) | RW Integer Prescale * 10 0011 40018 Deadband R/W Integer Prescale * 10 0012 40019 Reset #2 R/W Integer Prescale * 10 Note I 0013 40020 Rate #2 R/W Integer Prescale * 10 Note I 0014 40021 Cycle Time #2 "RIW Integer Prescale * 10 Note 2 0015 40022 SPI; LSP #1 R/W Integer Prescale * 10 Note 5 0016 40023 LSP #2 R/W Integer Prescale * 10 Note 5 0017 40024 Alarm #2 SP #1 R/W Integer Prescale * 10 Nore 7 0018 40025 Alarm #2 SP #2 R/W Integer Prescale * 10 Note 7 0019 40026 Alarm #2 Action R Integer Prescale * 10 Note 6 001A 40027 SP Low Limit R/W Integer Prescale * 10 Note 5 001B 40028 SP High Limit R/W Integer Prescale * 10 Note 5 9/99 Modbus® RTU Serial Communications User Manual 29 Appendix A Address | Register Parameter Name Access Notes (hex) (decimal) 001C 40029 Working Set Point R/W Integer Prescale * 10 Note 5 On a write to this register the instrument will update the proper set point according to the loop’s currently selected set point. Use this register for operator set point value changes ONLY. Use SP Override for computer-generated set point values. 001D 40030 Output Low Limit R/W Integer Prescale * 10 001E 40031 Output High Limit RW Integer Prescale * 10 001F 40032 Output Working Value R/W Integer Prescale * 10 0020 40033 PV Override Value R/W Integer Prescale * 10 0021 40034 SP Override Value R/W Integer Prescale * 10 Note 5 0022 40035 Output Override Value R/W Integer Prescale * 10 0023 40036 Ratio R/W Integer Prescale * 10 Note 4 0024 40037 Bias R/W Integer Prescale * 10 Note 4 0025 40038 Deviation R Integer Prescale * 10 0026 40039 LSP #3 R/W Integer Prescale * 10 Note 5 0027 40040 Percent Carbon Monoxide - CO | RW Integer Prescale * 1000 Note 3 0028 40041 Decimal Point RW Integer Prescale * | Note 3 0029 40042 Algl Bias R/W Integer Prescale * 10 Note 8 002A 40043 Alg? Bias R/W Integer Prescale * 10 Nore 9 003A 40058 Auto/Manual State RW Bit Packed Bit 0: O:Manual; 1:Auto Bit 1-15: Unused Note 3 003B 40059 Set Point State RW Bit Packed Bit 0: 0:SP1; 1:SP2 Bit 1-15: Unused UDC3300: Bit 1: 1:SP3 Note 3 003C 40060 Remote/Local Set Point State RW Bit Packed Ви 0: O:LSP; 1:RSP Bit 1-15: Unused Note 3 003D 40061 Tune Set State RW Bit Packed Bit 0: 0:Tune Set 41; 1: Tune Set #2 Bit 1-15: Unused Note 3 30 Modbus® RTU Serial Communications User Manual 9/99 Appendix A Address | Register Parameter Name Access Notes (hex) (decimal) 003E 40062 Loop Status R Bit Packed Bit 0: Mode: O:Manual; TAuto Bit 1: Set Point: O:SP1; 1:SP2 Bit 2: Remote/Local: 0:LSP; 1:RSP Bit 3: Tune Sel: 0:Set #1; 1:Set #2 Bit 4-15: Reserved Note 3 Note 1: UDC3300 uses a prescale of 100 for this parameter. Note 2: UDC3300 uses a prescale of | for this parameter. Note 3: UDC3300 only. Note 4: UDC3300 Ratio and Bias are CSP parameters. Note 5: In the UDC3300 if the input type is configured as Carbon and the input algorithm is configured for one of the carbon selections, the prescale value is derived from the configured decimal point. Note 6: Not supported by UDC2300, UDC3300 Note 7: Loop 1 Address only. Note 8: In the UDC3300 if the Algorithm | type is configured for weighted average, RH, Summer, Sq. Root Mult-Div, Sq Root Mult, Mult-Div, Mult, Carbon A-D, FCC, Dew Point, or Oxygen, the prescale value is derived from the configured decimal point. Note 9: In the UDC3300 if the Algorithm 2 type is configured for weighted average, A-B/C, Sq Root Mult- Div, Sq Root Mult, Mult-Div, Mult, or Dew Point, the prescale value is derived from the configured decimal point. 9/99 Modbus® RTU Serial Communications User Manual 31 Appendix A A.3 Loop Value Register Mapping Address | Register Parameter Name Access Notes (hex) (decimal) 0040 40065 PV Floating Point in Engineering Units. 0042 40067 RV; Remote Set Point; SP2 Floating Point in Engineering Units. RSX, VPR, VRX, UDC5 300, UMC800 allow writing this value when SP? 15 local (not connected) 0044 40069 Working Set Point R Floating Point in Engineering Units. RSX, VRX, VPR, UDC5300, UMC800: R/W On a write to this register the instrument will update the proper set point according to the loop’s currently selected set point. 0046 40071 Output R/W Floating Point in Engineering Units. 0048 40073 Input #1 R Floating Point in Engineering Units. 004A 40075 Input #2 R Floating Point in Engineering Units. (Temperature in UMC800 carbon potential). 004C 40077 Gain #1 (Prop Band #1 if active) | RW Floating Point 004E 40079 Direction R Floating Point 0.0=Direct; 1.0=Reverse 0050 4008] Reset #1 R/W Floating Point in Repeats/Minute or Minutes/Repeat. 0052 40083 Rate #1 R/W Floating Point in Minutes 0054 40085 Cycle Time #1 R/W Floating Point in Seconds. Read-only for UMC800. 0056 40087 PY Low Range R Floating Point in Engineering Units. 0058 40089 PV High Range R Floating Point in Engineering Units. 005A 40091 Alarm #1 SP #1 R/W Floating Point in Engineering Units. Note 2 005C 40093 Alarm #1 SP #2 R/W Floating Point in Engineering Units. Note 2 005E 40095 unused 0060 40097 Gain #2 (Prop Band #2 if active) | RW Floating Point 0062 40099 Deadband R/W Floating Point For UMC3800, this parameter applies only to three position step control. 0064 40101 Reset #2 R/W Floating Point in Repeats/Minute or Minutes/Repeat. 32 Modbus® RTU Serial Communications User Manual 9/99 Appendix A Address | Register Parameter Name Access Notes (hex) (decimal) 0066 40103 Rate #2 R/W Floating Point in Minutes 0068 40105 Cycle Time #2 R/W Floating Point in Seconds. UMCR800: Read-only 006A 40107 SPI; LSP #1] R/W Floating Point in Engineering Units. 006C 40109 LSP #2 R/W Floating Point in Engineering Units. 006E 40111 Alarm #2 SP #1 R/W Floating Point in Engineering Units. Note 2 0070 40113 Alarm #2 SP #2 R/W Floating Point in Engineering Units. Note 2 0072 40115 unused 0074 40117 SP Low Limit RW Floating Point in Engineering Units. 0076 40119 SP High Limit R/W Floating Point in Engineering Units. 0078 40121 Working Set Point R/W Floating Point in Engineering Units. On a write to this register the instrument will update the proper set point according to the loop’s currently selected set point. NOTE: Use this register for operator set point value changes ONLY. Use SP Override for computer-generated set point values. DR4300, DR4500: R ONLY 007A 40123 Output Low Limit R/W Floating Point in Engineering Units. 007C 40125 Qutput High Limit RW Floating Point in Engineering Units, 007E 40127 Output Working Value R/W Floating Point in Engineering Units. 0080 40129 PV Override Value R/W Floating Point in Engineering Units. UDC2300, UDC3300 ONLY 0082 40131 SP Override Value R/W Floating Point in Engineering Units. UDC2300, UDC3300 ONLY 0084 40133 Output Override Value R/W Floating Point in Engineering Units. UDC2300, UDC3300 ONLY 0086 40135 Ratio R/W Floating Point in Engineering Units. UDC2300, UDC3300: Ratio 1s CSP parameter 0088 40137 Bias R/W Floating Point in Engineering Units. UMCS800: Auto/Man bias block 18 Read-Only UDC2300, UDC3300: Bias 1s CSP parameter 9/99 Modbus® RTU Serial Communications User Manual 33 Appendix A Address | Register Parameter Name Access Notes (hex) (decimal) 008A 40139 Deviation R Floating Point in Engineering Units. 008C 40141 LSP #3 R/W Floating Point in Engineering Units. 008E 40143 Manual Reset R/W Floating Point in Engineering Units. UMC800 ONLY 0090 40145 Feed-forward Gain R/W Floating Point in Engineering Units. UMC800 ONLY 0092 40147 Local Percent Carbon Monoxide | R/W Floating Point in Engineering Units. UMC800 ONLY 0094 40149 Furnace Factor R/W Floating Point in Engineering Units. UMC800 ONLY 0096 4015] Percent Hydrogen R/W Floating Point in Engineering Units. UMC600 ONLY 0098 40153 On/Off Output Hysterisis R/W Floating Point in percent of input span UMC800 ONLY 009A 40155 Carbon Potential Dewpoint R/W Floating Point in Engineering Units UMC800 ONLY 009C 40157 Three Position Step Motor Time | R/W Floating Point in seconds UMC800 ONLY 009E 40159 ALG] Bias R/W Floating Point in Engineering Units UDC3300 ONLY 00А0 40161 ALG?2 Bias R/W Floating Point in Engineering Units UDC3300 ONLY 00A2 40163 unused through through 00F6 40247 00F7 40248 Enable/Disable Fuzzy R/W Bit Packed Bit 0: O:Disable; 1:Enable UMC800 ONLY 00F8 40249 Demand Tune Request R/W Bit Packed Bit 0: O:Off; 1:On Bit 1-15: Unused UMC800 ONLY 00F9 40250 Anti-soot set point limit enable R/W Bit Packed Bit 0: 0:Off; 1:On Bit 1-15: Unused UMC800 ONLY 34 Modbus® RTU Serial Communications User Manual 9/99 Appendix A Address | Register Parameter Name Access Notes (hex) (decimal) 00FA 40251 Auto/Manual State R/W Bit Packed Bit 0: O;¡Manual; T:Auto Ви 1-15: Unused OOFB 40252 Set Point State R/W Bit Packed Bit 0: O:SP 1; 1:5P?2 Bit 1-15: Unused UDC3300: Bit 1: 1:SP3 O0FC 40253 Remote/Local Set Point State R/W Bit Packed Bit 0: O:LSP; I:RSP Bit 1-15: Unused OOFD 40254 Tune Set State R/W Bit Packed Bit 0: 0:Tune Set #1; 1: Tune Set #2 Bit 1-15: Unused ООРЕ 40255 Loop Status R Bit Packed Bit 0: Mode: O:Manual; i:Auto Bit 1: Set Point: O:SP 1; 1:5P2 Bit 2: Remote/Local; O:LSP; I:RSP Bit 3: Tune Set: 0:Set 41; 1:Set #2 UMC800: Bit 4: IMAN: O:Inactive; T:Active UMC800: Bit 5: LO: 0: Inactive; 1:Active Bit 6-15: Reserved Note 1: UDC3300/UDC2300 Ratio and Bias are CSP parameters. Note 2: Loop 1 Addresses only. 9/99 Modbus® RTU Serial Communications User Manual 35 Appendix A A.4 Analog Input Value Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 1800 46145 Analog Input #1 R 1802 46147 Analog Input #2 R 1804 46149 Analog Input #3 R 1806 46151 Analog Input #4 R 1808 46153 Analog Input #5 R 130A 46155 Analog Input #6 R Floating Point in Engineering Units. 180C 46157 Analog Input #7 R [SOE 46159 Analog Input #8 R Number of Inputs vary according to model numbers 1810 46161 Analog Input #9 R 1812 46163 Analog Input #10 R 1814 46165 Analog Input #11 R 1816 46167 Analog Input #12 R 187E 46271 Analog Input #64 R 36 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.5 Communication or Constant Value Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 1880 46273 Communication Value 4 RW Floating Point in Engineering Units. DR4500: Input 1 Bias 1882 46275 Communication Value 42 R/W Floating Point in Engineering Units. DR4500: Input 2 Bias 1884 46277 Communication Value #3 R/W Floating Point in Engineering Units. DR4500: Input 3 Bias 1886 46279 Communication Value #4 R/W Floating Point in Engineering Units. DR4500: Input 4 Bias 1888 46281 Communication Value #5 R/W Floating Point in Engineering Units. 188A 46283 Communication Value #6 R/W 188C 46285 Communication Value #7 R/W 188E 46287 Communication Value #8 R/W 1890 46289 Communication Value #9 R/W 1892 46291 Communication Value #10 R/W 1894 46293 Communication Value #11 R/W 1896 46295 Communication Value #12 R/W 1898 46297 Communication Value 413 R/W 189A 46299 Communication Value #14 R/W 189C 46301 Communication Value #15 R/W 189D 46303 Communication Value #16 R/W 18BE 46335 Communication Value #32 R/W 9/99 Modbus® RTU Serial Communications User Manual 37 Appendix A A.6 Math, Calculated Value, or Variable Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 18CO 46337 Math Value + R Floating Point in Engineering Units. UMC800: RW 1802 46339 Math Value #2 R 18C4 46341 Math Value #3 R 18C6 46343 Math Value #4 R 18C8 46345 Math Value #5 R 18CA 46347 Math Value #6 R 18CC 46349 Math Value 47 R I8CE 40351 Math Value 48 R 18D0 46353 Math Value #9 R 18D2 46355 Math Value 410 R 18D4 46357 Math Value #1 1 R 18D6 46359 Math Value #12 R 18D8 46361 Math Value #13 R 18DA 46363 Math Value #14 R 18DC 46365 Math Value #15 R 18DE 46367 Math Value #16 R 18E0 46369 Math Value #17 R 18E2 46371 Math Value #18 R 18E4 46373 Math Value #19 R 18E6 46375 Math Value #20 R 18E8 46377 Math Value #21 R 18EA 46379 Math Value #22 R 18EC 46381 Math Value #23 R 18EE 46383 Math Value #24 R 18F0 46385 Math Value #25 R 18F2 46387 Math Value #26 R 18F4 46389 Math Value #27 R 18F6 46391 Math Value #28 R 18F8 46393 Math Value #29 R 18FA 46395 Math Value #30 R 18FC 46397 Math Value #31 R 18FE 46399 Math Value #32 R 1ABE 46847 Math Value #256 R 38 Modbus® RTU Serial Communications User Manual 9/99 A.7 Math or Calculated Value Status Register Mapping Appendix A Address | Register Channel Number Access Notes (hex) (decimal) | ACO 46849 Math Status #1-#16 R Bit Packed: Bit 0; Math #1 Status Bit 15: Math #16 Status 0: Math OFF I: Math ON JACI 46850 Math Status #17-#32 R Bit Packed Bit 0: Math 417 Status Bit 15: Math 432 Status 0: Math OFF |: Math ON | АСЕ 46864 Math Status #240 - #256 R 9/99 Modbus® RTU Serial Communications User Manual 39 Appendix A A.8 Totalizer Value Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 1B00 46913 Totalizer Value #1 R Floating Point in Engineering Units. 1B02 46915 Totalizer Value #2 R 1B04 46917 Totalizer Value 43 R 1B06 46919 Totalizer Value #4 R 1B08 46921 Totalizer Value #5 R IBOA 46923 Totalizer Value #6 R 1B7E 47039 Totalizer Value #64 R ATTENTION To reset totalizer to a specific value, write that value to these registers (i.e., to reset totalizer #1 to zero write 0.0 to register 46913). RSX, VRX, VPR, UDC5300 products do not support this function. 40 Modbus® RTU Serial Communications User Manual 9/99 A.9 Totalizer Status Register Mapping Appendix A Address | Register Channel Number Access Notes (hex) (decimal) 1 BRO 47041 Totalizer Status #1 - #16 R Bit Packed Bit 0: Totalizer #1 Status Bit 1: Totalizer #2 Status Bit 15: Totalizer #16 Status 0: Totalizer OFF I: Totalizer ON 1B81 47042 Totalizer Status #17 - #32 R Bit Packed Bit 0: Totalizer #17 Status Bit 1: Totalizer #18 Status Bit 15; Totalizer #32 Status 0: Totalizer OFF 1: Totalizer ON 1B82 47043 Totalizer Status #33 - #48 R 1B83 47044 Totalizer Status #49 - #64 R 9/99 Modbus® RTU Serial Communications User Manual 41 Appendix A A.10 Maintenance (HealthWatch) Value Register Mapping (UDC3300) Address | Register Channel Number Access Notes (hex) (decimal) 1B99 47064 Maintenance Reset Type R/W 0: None 6: Counter 2 |: Timer |] 7: Counter 3 2: Timer 2 8: All Counters 3: Timer 3 9: All Timers & Counters 4: All Timers 10: Ambient Temp 5: Counter 1 1B9A 47065 Timer 1 Configuration R/W 0: Disable 7: Guaranteed soak 1: Last Reset 8: Sooting 2: Alarm 1 SP1 9: DII Closed 3: Alarm 1 SP2 10:DI2 Closed 4: Alarm 2 SPI 11: Manual Loop 2 5: Alarm 2 SP2 6: Manual Loop | 1B9B 47066 Timer 2 Configuration RW Same as Timer 1 Configuration IB9C 47067 Timer 3 Configuration R/W Same as Timer | Configuration 1B9D 47068 Counter 1 Configuration R/W 0: Disable 7. DI2 1: Manual Loop | 8: Output] Relay x 1K 2: Alarm 1 SPI 9: Output? Relay x IK 3: Alarm 1 SP2 10:Guaranteed soak 4: Alarm 2 SP1 11: Power cycle 5: Alarm 2 SP2 6: DI] 1B9E 47069 Counter 2 Configuration R/W Same as Counter 1 Configuration 1B9F 47070 Counter 3 Configuration R/W Same as Counter | Configuration 1BAO 47071 Timer 1 Days R Integer IBA! 47072 Timer 1 Hours R Integer 1ВА2 47073 Timer 1 Minutes R Integer 1BA3 47074 Timer 2 Days R Integer IBA4 47075 Timer 2 Hours R Integer IBAS 47076 Timer 2 Minutes R Integer IBA6 47077 Timer 3 Days R Integer IBA7 47078 Timer 3 Hours R Integer IBAS 47079 Timer 3 Mmutes R Integer IBA9 47080 Counter 1 R Integer IBAA 47081 Counter 2 R Integer IBAB 47082 Counter 3 R Integer 42 ModbusO RTU Serial Communications User Manual 9/99 A.11 Time Register Mapping Appendix A Address | Register Channel Number Access Notes (hex) (decimal) IBEO 47137 Hours R/W 0 to 23 ¡BE! 47138 Minutes R/W 0 to 60 1ВЕ2 47139 Seconds R/W 0 to 60 IBE3 47140 Month R/W ] to 12 ] BE4 47141 Day R/W 1 to 31 IBES 47142 Year R/W 00 to 99 VPR, VRX, UMCS800: accepts the values 0 — 37, 70 — 99, and 1970 — 2037. The values read are always in the range of 1970 to 2037. (0 — 37 represents 2000 — 2037, 70 — 99 represents 1970 — 1999 DR4500: accepts 0-99 or 1970 — 2037 and ignores the century. 1BE6 47143 Week Day R/W 0 to 6 (0 = Sunday) DR4500: RW UMC800: KR, W ignored VPR/VRX: ignored ATTENTION Clock registers must be written in a single transaction. They can be written in one transaction of registers 47137 through 47142 or one transaction of registers 47137 through 47143. 9/99 Modbus® RTU Serial Communications User Manual 43 Appendix A A.12 Alarm Status Register Mapping Address Register Channel Number Access Notes (hex) (decimal) IBFO 47153 Alarm Status #1 - #16 R Bit Packed Bit 0: Alarm #1 Status Bit 1: Alarm #2 Status Bit 15: Alarm #16 Status 0: Alarm OFF | I: Alarm ON IBF] 47154 Alarm Status #17 - #32 R Bit Packed Bit 0: Alarm #17 Status Bit !: Alarm #18 Status Bit 15: Alarm 432 Status 0: Alarm OFF I: Alarm ON 1BF2 47155 Alarm Status #33 - #48 R Bit Packed Bit 0: Alarm #33 Status Bit 1: Alarm #34 Status Bit 15: Alarm #48 Status 0; Alarm OFF 1: Alarm ON 1BF3 47156 Alarm Status #49 - #64 R 1BF4 47157 Alarm Status #65 - #80 R IBFS 47158 Alarm Status #81 - #96 R IBFF 47168 Alarm Status #240 - #256 R 44 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.13 Shed Timer Reset Register Address | Register Channel Number Access Notes (hex) (decimal) 1B90 47057 Reset Shed Timer Loop | Ww Integer Write this address to clear an infinite shed condition. (Shedtime = 0) Data 1s ignored. NOTE: UDC3300/UDC2300 ONLY 1B91 47058 Reset Shed Timer Loop 2 W Integer Write this address to clear an infinite shed condition. (Shedtime = 0) Data is ignored. NOTE: UDC3300 ONLY 9/99 Modbus® RTU Serial Communications User Manual 45 Appendix A A.14 Alarm Set Point Value Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 1C00 47169 Alarm Set Point Value #1 R/W Floating Point in Engineering Units. DR4300. DR4500, UDC2300, UDC3300: Alarm #1 SPI 1С02 47171 Alarm Set Point Value #2 R/W Floating Point in Engineering Units. DR4300, DR4500, UDC2300, UDC3300: Alarm #1 SP2 1C04 47173 Alarm Set Point Value #3 R/W Floating Point in Engineering Units. DR4300, DR4500, UDC2300, UDC3300: Alarm #2 SPI 1C06 47175 Alarm Set Point Value #4 R/W Floating Point in Engineering Units. DR4300, DR4500, UDC2300, UDC3300: Alarm #2 SP2 1CO8 47177 Alarm Set Point Value 45 RW Floating Point in Engineering Units. ICOA 47179 Alarm Set Point Value #6 R/W 1C0C 47181 Alarm Set Point Value #7 R/W ¡COE 47183 Alarm Set Point Value #8 R/W ICIO 47185 Alarm Set Point Value #9 R/W 1C12 47187 Alarm Set Point Value #10 R/W 1C14 47189 Alarm Set Point Value #11 R/W 1C16 4719] Alarm Set Point Value #12 R/W 1C18 47193 Alarm Set Point Value 413 R/W ICIA 47195 Alarm Set Point Value #14 R/W ICIC 47197 Alarm Set Point Value #15 R/W ICIE 47199 Alarm Set Point Value #16 R/W IDFE 47679 Alarm Set Point Value #256 R/W 46 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.15 Set Point Programmer Value Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 1800 47681 Set Point Programmer Output R Floating Point in Engineering Units, 102 47683 Current Segment Number R Floating Point; 1..Max Segment # UMC$800: RW A write changes the segment number. 1E04 47685 Program Elapsed Time R Floating Point in Seconds -or- Time Units Includes or runs when in Hold Note 1, 2 1 E06 47687 Program Active Time R Floating Point in Seconds -or- Time Units Excludes or stops when in Hold Note 1, 2, 3 1E08 47689 Segment Time Remaining R Floating Point in Seconds -or- Time Units | FOA 47691 Current Segment Events (Bit R Bit Packed Packed) Bit 0: Event #1 Bit 15: Event #16 0: Event OFF 1: Event ON Note 1, 2 IEOB 47692 Status R Bit Packed Bit 0: I=Ready 1: 1=Run 2: 1=Hold 3: 1=End 4: 1=Time Units in Seconds 5: 1=Time Units in Minutes 6: 1=Time Units in Hours UDC2300, UDC3300, DR4300, DR4500, UMC800: 7: Ramp Units 0: Time 1: Rate UDC2300, UDC3300, DR4300, DR4500: 8: If bit 7 Set 0: EU/Hour |: EU/Minute UMC800: 9: Tf bit 2 Set 0: Operator hold I: Guaranteed soak hold UMC800: 10: 0: Current segment is a soak 1: Current segment 1s a ramp 11-15: Reserved 1EOC 47693 Start W Integer Write to location Starts Profile; Data ignored (UMC800 refers to this as RUN) 9/99 Modbus® RTU Serial Communications User Manual 47 Appendix A Address | Register Channel Number Access Notes (hex) (decimal) 1EOD 47694 Hold W Integer Write to location Holds Profile; Data 1gnored IEOE 47695 Advance W Integer Write to location Advances Profile; Data ignored Note 1, 2 [EOF 47696 Reset W Integer Write to location Resets Profile: Data 1gnored Note 1, 2 NOTE 1: Not implemented in DR4300, DR4500 NOTE 2: Not implemented in UDC3300, UDC2300 NOTE 3: Not implemented in UMC800 48 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.16 Set Point Programmer Additional Values Register Mapping Address (hex) Register (decimal) Channel Number Access Notes 1 FOO 47937 Current Program Number RW Floating Point A write to this register loads the program into the set point programmer function block; if 0 1s written, the function blocks program 1s cleared. Notes 1,4 102 47939 Program Save Request Floating Point Saves the program into the archive. Writing to this register is prohibited in the run mode. Note | 1804 47941 Auxiliary Output Floating Point Note ] 1F06 47943 Guaranteed Soak Low Floating Point Notes 1,4 1 FOS 47945 Guaranteed Soak High Floating Point Notes 1,4 Soak Deviation Note 3 1FOA 47947 Restart Ramp Rate Floating Point Notes 1,4 1FOC 47949 Display High Range Limit Floating Point Notes 1,4 1FOE 47951 Display Low Range Limit Floating Point Notes 1,4 1F10 47953 Jog Segment Floating Point Notes 1,4 1F12 47955 Loop Start Floating Point 0 indicates no loop. Notes 1,4 1FI4 47957 Loop End Floating Point 0 indicates no loop. Notes 1,4 1F16 47959 Repeats Floating Point 0 indicates loop forever. Notes 1,4 1F3A 47995 Time Units Bit 0: seconds I: minutes 2: hours 3-15: Unused Notes 1, 2, 5, 6 1F3B 47996 Ramp Units R/W Bit 0: O:Time; 1:Rate Bit 1-15: Unused Notes 1,4, 6 9/99 Modbus® RTU Serial Communications User Manual 49 Appendix A Address | Register Channel Number Access Notes (hex) (decimal) 1F3C 47997 Guaranteed Soak Type R/W Bit 0: per segment I: all soaks 2: all segments 3-15: Unused None if none of the bits 15 set Notes 1,4 1F3D 47998 Prosram End Segment R/W Bit O: 1:2 1: 4 2:1: 6 3:1: 8 4: 1: 10 1:12 1F3E 47999 Program Termination State R/W Bit 0: 0: Last SP (Hold at last SP in program) 1: FSAFE (Manual mode, failsafe output) 1-15: Unused Note 3 1F3F 48000 Program State at Program End R/W Bit 0: 0: Disabl; 1: Hold 1-15: Unused Note 3 1F40 48001 Engineering Units for Ramp R/W Bit 0: 1: Hrs:Mins Segments 1: 1: Degrees/Min 2: 1: Desrees/Hour 3-15: Unused Note 3 1F41 48002 Program Start Segment R/W Bit 0: 1 = Start Segment 1 I: 1 = Start Segment 2 ] = Start Segment 3 I = Start Segment 4 1 = Start Segment 5 ] = Start Segment 6 ] = Start Segment 7 1 = Start Segment 8 | = Start Segment 9 ] = Start Segment 10 10: 1 = Start Segment 11 11: 1 = Start Segment 12 12: Unused 13: Unused 14: Unused 15: Unused 1F42 48003 Program Recycles R/W 0 to 99 Note 3 OA в Note 1: UMCSOO Only Note 2: UMCSOO does not support seconds Note 3: UDC2300 Only Note 4: UMCS800 only allows writing to this register when in the reset or ready mode. Note 5: UDC2300 does not support seconds. Note 6: UDC2300 does not permit writing to this register. 50 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.16 Tagged Signal Register Mapping Address | Register Channel Number Access Notes (hex) (decimal) 2000 48193 Tagged Signal #1 R Floating Point in Engineering Units 2002 48195 Tagged Signal #2 R Floating Point in Engineering Units 2004 48197 Tageed Signal #3 R | Floating Point in Engineering Units 2006 48199 Tagged Signal #4 R Floating Point in Engineering Units 2008 48201 Tagged Signal #5 R Floating Point in Engineering Units 200A 48203 Tagged Signal #6 R 200C 48205 Tagged Signal #7 R 200E 48207 Tagged Signal #8 R 2010 48209 Tagged Signal #9 R 2012 48211 Tagged Signal #10 R 2014 48213 Tagged Signal #11 К. 2016 48215 Tagged Signal #12 R 2018 48217 Tagged Signal #13 R 201A 48219 Tagged Signal #14 R 201C 48221 Tagged Signal #15 R 201E 48223 Tagged Signal #16 R 27CE 50191 Tagged Sıgnal #1000 R 9/99 Modbus® RTU Serial Communications User Manual 51 Appendix A A.17 Set Point Programmer Segment Mapping A profile can contain up to 64 segments depending on the instrument. Each segment 1s made up of 8 registers. The segment mapping for setpoint programmer #1 1s shown below. Start Address | End Address Description 2800 2807 Set Point Programmer #1 Segment 1 2808 280F Set Point Programmer #1 Segment 2 2810 2817 Set Point Programmer #1 Segment 3 29F8 29FF Set Point Programmer #1 Segment 64 52 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.17.1 Segment Register Mapping The table below describes the registers that are part of a setpoint programmer segment. To determine the actual register address for a parameter within a segment, add the register offset to the start address of the segment. Register Parameter Name Offset within Segment Access Notes 0 Ramp Segment RW Bit Packed Bit 0: | = ramp segment; O=soak segment Bit 1: 1 = guaranteed soak enabled = guaranteed soak disabled Bit 2: 1 = guaranteed soak enabled PV#2 0 = guaranteed soak disabled PV#2 Bit 0 1s ignored in the hold mode. Writing to this register is not permissible 1n the run mode. UMC800, VPR, VRX ONLY I Events Bit Packed Bit 0: Event 41 Bit 15: Event 416 0: Event OFF |: Event ON Writing to this register is only permissible in reset or ready mode. UMC800, VPR, VRX ONLY J Time or Rate Floating Point in time units configured for the set point programmer Writing to this register 1s not permissible in the run mode. UMC800, VPR, VRX ONLY 4 Ramp or Soak value Floating Point Writing to this register is not permissible in the run mode. UMC800, VPR, VRX ONLY 6 Soak value for auxiliary output (use “Time or Rate” for duration) Floating Point Writing to this register is not permissible in the run mode. UMC800, VPR, VRX ONLY 9/99 Modbus® RTU Serial Communications User Manual 53 Appendix A A.17.2Example For Determining a Segment Register To change the ramp value in segment #8 of setpoint programmer #2, the register address is determined as follows. Step 1: Use Table A-1 to determine the start address for setpoint program #2 profile. The value 1s 2A00 Hex. Step 2: Calculate the offset address for segment 8 in a profile. This is calculated as: Segment #8 offset address = (segment number - 1) * 8 = (8-1) * & = 56 or 38 Hex Step 3: Use the table above to determine the register offset for the ramp value. The value 1s 4. Step 4: Calculate the address by adding the results of steps 1, 2, and 3 to determine the register address. Register address = Setpoint program #2 profile base address + Segment 8 offset address + Ramp value register offset = 2A004+38 +4 = 2A3C 54 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.18 Scheduler Value Register Mapping (UMC800 Only) Address | Register Channel Number Access Notes (hex) (decimal) 3000 52289 Scheduler Output | R Floating Point in Engineering Units. 3002 52291 Scheduler Output 2 R Floating Point in Engineering Units. 3004 52293 Scheduler Output 3 R Floating Point in Engineering Units. 3006 52295 Scheduler Output 4 R Floating Point in Engineering Units. 3008 52297 Scheduler Output 5 R Floating Point in Engineering Units. 300A 52299 Scheduler Output 6 R Floating Point in Engineering Units. 300C 52301 Scheduler Output 7 R Floating Point in Engineering Units. 300E 52303 Scheduler Output 8 R Floating Point in Engineering Units. 3010 52305 | Scheduler Auxiliary Output 1 R Floating Point in Engineering Units. 3012 52307 Scheduler Auxiliary Output 2 R Floating Point in Engineering Units. 3014 52309 Scheduler Auxiliary Output 3 R Floating Point in Engineering Units. 3016 52311 Scheduler Auxiliary Output 4 R Floating Point in Engineering Units. 3018 52313 Scheduler Auxiliary Output 5 R Floating Point in Engineering Units. 301A 52315 Scheduler Auxiliary Output 6 R Floating Point in Engineering Units. 301C 52317 Scheduler Auxiliary Output 7 R Floating Point in Engineering Units. 301E 52319 Scheduler Auxiliary Output 8 R Floating Point in Engineering Units. 3020 5232] Current Program Number R/W Floating Point A write to this register loads the program into the scheduler function block; if 0 1s written, the scheduler’s schedule 1s cleared. Writing to this register is only permissible in reset or ready mode. 3022 52323 Current Segment Number R/W Floating Point; I..Max Segment # A write changes the segment number. 3024 52325 Program Elapsed Time R Floating Point in Time Units Includes or runs when in Hold 3026 52327 Segment Time Remaining R Floating Point in Time Units 3028 52329 Schedule Save Request R/W Floating point. Saves the schedule into the archive, Writing to this register is prohibited in the run mode. 302A 52331 Guaranteed Soak Limit | R/W Floating Point 302C 52333 Guaranteed Soak Limit 2 R/W Floating Point 302E 52335 Guaranteed Soak Limit 3 R/W Floating Point 3030 52337 Guaranteed Soak Limit 4 R/W Floating Point 3032 52339 Guaranteed Soak Limit 5 R/W Floating Point 3034 52341 Guaranteed Soak Limit 6 R/W Floating Point 3036 52343 Guaranteed Soak Limit 7 R/W Floating Point 3038 52345 Guaranteed Soak Limit 8 R/W Floating Point 303A 52347 Jog Segment R/W Floating Point 9/99 Modbus® RTU Serial Communications User Manual 55 Appendix A Address (hex) Register (decimal) Channel Number Access Notes 3049 52362 Current Segment Events (Ви! Packed) R Bit Packed Bit 0: Event #1 Bit 15: Event #15 0: Event OFF I: Event ON 304A Status (Bit Packed) Bit Packed Bit 0: I=Ready |: I=Run : I=Hold : I=End : I=Time Units in Seconds : IzTime Units in Minutes : I=Time Units in Hours : If bit 2 Set 0: Operator hold 1: Guaranteed soak hold 8-15: Reserved + DN de О 304B 52364 Start Integer Write to location Starts Schedule; Data ignored 304C 52365 Integer Write to location Holds Schedule; Data ignored 304D 52366 Advance Integer Write to location Advances Schedule; Data ignored 304E 52307 Reset Integer Write to location Resets Schedule; Data ignored 304F 52368 Time Units Bit Packed Bit 0: seconds 1: minutes 2: hours 3-15: Unused Notes | Note 1: UMC800 does not support seconds 56 Modbus® RTU Serial Communications User Manual 9/99 Appendix A A.19 Scheduler Segment Register Mapping A schedule can contain up to 64 segments depending on the instrument. Each segment 1s made up of 48 (30 hex) registers. The segment mapping for Scheduler #1 1s shown below: A.19.1 Schedule Segment Mapping Start Address | End Address Description 3200 322F Scheduler #1 Segment 1 3230 325F Scheduler #1 Segment 2 3260 328F Scheduler #1 Segment 3 | 3DDO 3DFF Scheduler #1 Segment 64 9/99 Modbus® RTU Serial Communications User Manual 57 Appendix A A.19.2Segment Register Mapping The table below describes the registers that are part of a schedule segment. To determine the actual register address for a parameter within a segment, add the register offset to the start address of the segment. Register Parameter Name Access Notes Offset within segment 0000 Guaranteed Soak Туре | R/W Bit Packed (Bit Packed) Bit 0: Off Bit 1: Low Bit 2: High Bit 3: Low & High Bit 4...15: Unused Notes 1,2 0001 Guaranteed Soak Type 2 R/W See Guaranteed Soak Type 1 0002 Guaranteed Soak Type 3 R/W See Guaranteed Soak Type 1 0003 Guaranteed Soak Type 4 R/W See Guaranteed Soak Type 1 0004 Guaranteed Soak Type 5 R/W See Guaranteed Soak Type 1 0005 Guaranteed Soak Type 6 R/W See Guaranteed Soak Type 1 0006 Guaranteed Soak Type 7 R/W See Guaranteed Soak Type 1 0007 Guaranteed Soak Type 8 R/W See Guaranteed Soak Type 1 0008 Events R/W Bit Packed Bit 0: Event #1 Bit 15: Event #15 0: Event OFF 1: Event ON Notes 1,3 000A Time R/W Floating Point in seconds Notes 1,2 000C Output #1 Ramp or Soak value R/W Floating Point Notes 1,2 000E Output #2 Ramp or Soak value R/W Floating Point Notes 1,2 0010 Output #3 Ramp or Soak value R/W Floating Point Notes 1,2 0012 Output #4 Ramp or Soak value R/W Floating Point Notes 1,2 0014 Output #5 Ramp or Soak value R/W Floating Pont Notes 1,2 0016 Output #6 Ramp or Soak value R/W Floating Point Notes 1,2 0018 Output #7 Ramp or Soak value R/W Floating Point Notes 1,2 001A Output #8 Ramp or Soak value R/W Floating Point Notes 1,2 001C Soak value for Auxiliary Output #1 | RW Floating Point Notes 1,2 58 Modbus® RTU Serial Communications User Manual 9/99 Appendix A Register Parameter Name Access Notes Offset within segment 001E Soak value for Auxiliary Output 42 | RW Floating Point Notes 1,2 0020 Soak value for Auxiliary Output #3 | RW Floating Point Notes 1,2 0022 Soak value for Auxiliary Output #4 | RW Floating Point Notes 1,2 0024 Soak value for Auxiliary Output #5 | R/W Floating Point Notes 1,2 0026 Soak value for Auxiliary Output #6 | R/W Floating Point Notes 1,2 0028 Soak value for Auxiliary Output #7 | RW Floating Point Notes 1,2 002A Soak value for Auxiliary Output #8 | RW Floating Point Notes 1,2 002C Recycle R/W Number of times to recycle Floating Point Notes 1,3 002E Recycle Segment R/W Floating Point Notes 1,3 Note 1: UMCS00 Only Note 2: Writing to this register is not permissible in the run mode. Note 3: Writing to this register is only permissible in reset or ready mode A.19.3Example For Determining a Segment Register To change the ramp value for Output #6 in segment #5 of setpoint scheduler #3, the register address 1s determined as follows. Step I: Use Table A-1 to determine the start address for scheduler #3’s schedule. The value is 4A00 Hex. Step 2: Calculate the offset address for segment 5 in a schedule. This is calculated as: Segment offset address = (segment number — 1) * 48 (5-1) * 48 = 192 or CO Hex И Step 3: Use the table above to determine the register offset for Output #6 ramp value. The value 1s 16 Hex. Step 4: Calculate the address by adding the results of steps 1, 2, and 3 to determine the register address. Register address = Schedule program 43's schedule start address + Sesment 5 offset address + Output #6 ramp value register offset = 4A00+ CO +16 = 4AD6 9/99 Modbus® RTU Serial Communications User Manual 59 Appendix B B. Appendix CRC-16 Calculation See following function: extern void calculate_CRC(unsigned char *message, int length. unsigned char *CRC) ( unsigned char CRCHi, CRCLo, TempHi, TempLo: static const unsigned char table[512] = { 0x00. 0x00. OxCO, OxCI. OxCi, Ox81, 0x01. 0x40, 0xC3, 0x01, 0x03, 0хСО, 0x02, OxC6, 0x01. 0x06, OxCO. 0x07, 0x80, OxC7, 0x41, 0x05, 0x00, OxC3. ОхС1, OxC4, OxCC, Ox0I. O0x0C. OxCO, Ox0D, 0x80, OxCD, 0x41, O0x0F, 0x00, OxCF, 0xCl. OxCE, ОхОА, O0x00, OxCA, OxCi, OxCB, 0x8, 0x0B. 0x40, 0xC9, 0x01. O0x09, OxCO, 0x08, OxD8, 0x01, Ox18. OxCO, 0x19, 0x80. OxD9, 0x41, Ox1B, 0x00, OxDB, O0xC1, OxDA, Ox1E, 0x00, OxDE. ОхС1, OxDF, Ox81, OxIF, 0x40. O0xDD, 0x01, OxiD. OxCO, Ox1C, 0x14, 0x00. 0OxD4, OxCl, OxDS, 0x81, Ox15, 0x40, 0xD7, 0x01. 0x17, OxCO. 0x16. OxD2. Ox01, 0x12, 0xCO, 0x13. 0x80. OxD3. 0x41, Ox11, 0x00, OxDI. OxCl. 0xDO, OxF0. O0x0I, 0x30. OxCO. 0x31, 0x80, OxFI, Ox4i, 0x33, 0x00, OxF3, OxCI, OxF2, 0x36, 0x00, OxF6, OxC1, OxF7, 0x81, 0x37. 0x40, OxF5, 0x01, 0x35, OxCO, 0x34. Ox3C, 0x00. OxFC. OxC1, OxFD, 0x81. Ox3D, 0x40, OxFF, 0x01, Ox3F, OxCO, Ox3E, OxFA, 0x01, Ox3A. OxCO, Ox3B, 0x80. OxFB, 0x41, 0x39, 0x00, OxF9, 0xCi, OxF8, 0x28, 0x00, OxES. OxCI. OxE9, 0x81, 0x29. 0x40, OxEB, 0x01. Ox2B, OxCO, Ox2A, OxEE, O0x01, Ox2E, OxCO. Ox?F, 0x80, OxEF, 0x41, 0x2D. 0x00, OxED. OxCl. OxEC, OxE4, 0x01, 0x24, OxCO, 0x25, 0x80, OxES. 0x41, 0x27. 0x00, OxE7. OxCI, OxE6, 0x22, 0x00, OxE2. OxCI, OxE3, 0x81. 0x23, 0x40, OxEl, Ox01, 0x21. OxCO, 0x20, OxAO, 0x01, 0x60. 0xCO, 0x61, 0x80, OxAl, 0x41, 0x63, 0x00. ОхАЗ. ОхСТ, OxA2, 0x66, 0x00, OxA6. OxCI. OxA7, 0x81, Ox67. 0x40, OxAS. 0x01, 0x65. OxCO, 0x64, 0x6C, 0x00. OxAC, 0xCl, OxAD, 0x81, Ox6D, 0x40. OxAF, 0x01, OxóF, OxCO, Ox6E, OxAA. 0x01, Ox6A, OxCO, Ox6B. 0x80, OxAB. 0x41, 0x69, 0x00, ОхА9, ОхСТ. OxAS, 0x78. 0x00. OxB8, OxCI, OxB9, 0x81, 0x79, 0x40. 0xBB. Ox0I, Ox7B, OxCO, Ox7A, OxBE, 0x01, Ox7E, OxCO, Ox7F, 0x80, OxBF, 0x41, Ox7D, 0x00, OxBD. OxCi, OxBC, OxB4, Ox01, 0x74, OxCO, 0x75, Ox80, OxB5, Ox41, 0x77, 0x00, OxB7, OxCI, OxB6, 0x72. 0x00, OxB?. OxC1, OxB3, 0x81. 0x73, 0x40, ОхВ1, 0x01, O0x71, OxCO, Ox70, 0x50, 0x00, 0x90. ОхС1, 0x91, Ox81, 0x51, 0x40, 0x93. 0x01, 0x53, 0xCO, 0x52, 0x96. 0x01, 0x56, OxCO, 0x57, 0x80, 0x97, 0x41. 0x55. 0x00, 0x93, OxC1, 0x94, Ox9C, Ox01, OxSC, 0xC0, 0x3D, 0x80. 0x9D, 0x41, 0x5F, 0x00. Ox9F, ОхС1. Ox9E, OxS5A, 0x00. Ox9A, OxCIi, Ox9B, 0x81, 0x5B, 0x40, 0x99, 0x01. 0x39, OxCO, Ox58, 0x88. 0x01, 0x48, OxCO, 0x49, 0x80, 0x89, 0x41, 0x4B, 00х00, O0x8B, OxCI, O0x8A, Ox4E, 0x00, OxBE. ОхС1, Ox8F, 0x81. Ox4F, 0x40, O0x8D, 0x01, O0x4D, OxCO, Ox4C, 0x44, 0x00. 0x84, ОхС1, 0x85, 0x81, 0x45, 0x40, 0x87. 0x01, Ox47, OxCO, 0x46, 0x82, 0x01, 0x42, OxCO, 0x43, 0x80, 00х83, 0x41, 0x41. 0x00, 0x81. OxCI, 0x80, | CRCHi = Oxff; CRCLo = Oxff; while(length) { TempHi = CRCHI; TempLo = CRCLo: CRCHi = table[2 * (message * TempLo)]; CRCLo = TempHi * table[(2 * (message * TempLo)) + 1]; message++; length--; e CRC [0] = CRCLo; CRC [1] = CRCHi; return; 0x80, 0x81, 0x81, 0х 80, Ох 81, 0x80, 0x80, 0x81, 0x81, 0x80, 0х 80, 0x81, 0x80, 0x81, Ox81, 0x80, 0x81, 0х 80, Ox 80, Ox81, 0x80), 0x81. 0x81, 0x80, 0x80, 0x81, 0x81, 0x80, 0x81, 0x80, 0x80, 0x81, OxC2, 0x04, Ox0E, OxCB, Ox1A, OxDC, Ох 6, 0x10, 0x32, OxFa, OXFE, 0x38, OxEA, Ox2C, 0x26. Ох ЕО, 0x62, OxA4, OxAE, Ox68, OxBA, Ox7C, Ox76, OxBO, 0x92, 0x54, Ox5E, 0x98, Ox4A, Ox8C, 0x86, 0x40, Ox41, Ox<40, Ox40, Ox41, 0x40, Ox41, 0x41, 0x40, Ox 40, Ox41, Ox41, 0x40. Ox41. 0x40, Ox40, 0x41, 0x40, Ox41. Ox41. Ox40, 0x41. 0x40, Ox40, Ox41, Ox41, Ox40, Ox40, 0x41, 0x40. Ox41, Ox41, Ox40. 9/99 ModbusO RTU Serial Communications User Manual 61 Appendix B 62 Modbus® RTU Serial Communications User Manual 9/99 READER RESPONSE FORM Please help us make our documentation more useful to you! If you have a complaint, a suggestion, or a correction regarding this manual, please tell us by mailing this page with your comments. It's the only way we know we're doing our job by giving you correct, complete, and useful documentation. DOCUMENT NUMBER: CI-51-52-25-66F TITLE: Modbus® RTU Serial Communications User Manual ISSUE DATE: SEPT. 1999 COMMENT/COMPLAINT: Mail this page to: Bristol Babcock Inc. 1100 Buckingham Street Watertown, CT 06795 Attn: Technical Publications Group, Dept. 315 Bristol Babcock PART OF THE ' FKI GROUP OF COMPANIES 1100 Buckingham Street Watertown, CT 06795 Phone: 1 (860) 945-2200 Fax: 1 (860) 945-2213 Website: www. bristolbabcock.com ">

Public link updated
The public link to your chat has been updated.
Advertisement
Key features
- Modbus RTU communication protocol
- RS-485 specification
- IEEE 32-bit floating point and integer formats
- Data register mapping
- Standard Modbus RTU function codes