CN2204
Communications Handbook
Contents
SERIES CN2200 and CN2400
MODBUS® AND DIGITAL COMMUNICATIONS HANDBOOK
CONTENTS
Chapter 1
Chapter 2
PAGE
INTRODUCTION .......................................................................................... 1-1
DIGITAL COMMUNICATIONS HARDWARE............................................... 2-1
RS-232 (EIA-232), RS-422 (EIA-422), RS-485 (EIA-485) Transmission Standards ............. 2-1
Selecting RS-232 (EIA-232) or RS-422/485 (EIA-422/485).................................................... 2-2
Cable Selection ..................................................................................................................... 2-2
Grounding ............................................................................................................................. 2-3
Wiring General ...................................................................................................................... 2-3
Wiring RS-232 (EIA-232) ....................................................................................................... 2-3
Wiring RS-422 (EIA-422) or 4-wire RS-485 (EIA-485)........................................................... 2-4
Wiring 2-wire RS-485 (EIA-485) ............................................................................................ 2-5
Wiring RS-422 (EIA-422) and RS-485 (EIA-485) Controllers ............................................... 2-6
Connections for up to 63 controllers................................................................................... 2-7
Large RS-422 485 (EIA-422 485) Networks ........................................................................ 2-8
KD-485 (EIA-485) and 261 Connections............................................................................... 2-9
Chapter 3
MODBUS® PROTOCOL .............................................................................. 3-1
Protocol Basics..................................................................................................................... 3-1
Typical Transmission Line Activity...................................................................................... 3-2
Device Address ..................................................................................................................... 3-2
Parameter Address ............................................................................................................... 3-3
Parameter Resolution ........................................................................................................... 3-3
Mode of Transmission .......................................................................................................... 3-3
Message Frame Format ........................................................................................................ 3-4
Cyclic Redundancy Check.................................................................................................... 3-4
Example of a CRC Calculation ............................................................................................. 3-6
Example of a CRC Calculation in the ‘C’ Language ........................................................... 3-7
Function Codes..................................................................................................................... 3-8
Read N Bits............................................................................................................................ 3-9
Read N Words ....................................................................................................................... 3-10
Write A Bit ............................................................................................................................. 3-11
Write A Word ......................................................................................................................... 3-12
Fast Read of Status............................................................................................................... 3-13
Diagnostic Loopback............................................................................................................ 3-14
Write N Words ....................................................................................................................... 3-15
Error Response Codes ......................................................................................................... 3-16
Wait Period............................................................................................................................ 3-17
Latency .................................................................................................................................. 3-17
Message Transmission Time ............................................................................................... 3-17
Series CN2200 and CN2400 Communications Handbook
i
Contents
Chapter 4
Communications Handbook
MODBUS® ADDRESS................................................................................. 4-1
Modbus® Address ................................................................................................................ 4-1
Operating Mode Parameters ................................................................................................ 4-2
Modbus® Tables ................................................................................................................... 4-2
MiscellaneousStatus and Comms-Only Parameters .......................................................... 4-10
Status Words ........................................................................................................................ 4-12
Modbus® Bit Addressable Parameters ............................................................................... 4-15
Configuration Mode Parameters.......................................................................................... 4-16
Input/Output Modules........................................................................................................... 4-21
Ramp/Dwell Programmer Data Modbus® ........................................................................... 4-31
Chapter 5
ADVANCED TOPICS ................................................................................... 5-1
Access to Full Resolution Floating Point and Timing Data (Modbus® Only) ................... 5-1
Data types used in Series CN2200CN2400 instruments ..................................................... 5-1
Enumerated, Status Word, and Integer parameters ........................................................... 5-1
Floating Point Parameters.................................................................................................... 5-2
Time Type Parameters.......................................................................................................... 5-2
User Interface Access Permissions (Modbus).................................................................... 5-2
User Interface Access Permissions..................................................................................... 5-3
Programmable Logic Controllers and CN24XX Series Instruments.................................. 5-4
Appendix A
ii
GLOSSARY OF TERMS.............................................................................. A-1
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
CHAPTER 1
Introduction
INTRODUCTION
This chapter describes the scope of this handbook and how to use it.
OVERVIEW
This handbook is written for the people who need to use a digital communications link and MODBUS® or JBUS® communication
protocols to supervise Omega Series CN2200 and CN2400 instruments.
It has been assumed that the reader has some experience of communication protocols and is familiar with Series CN2200 and
CN2400 instruments. The relevant instrument handbook gives a full description of how to use the instruments, configuration
options and definition of parameters.
Chapter 2 of this document is a guide to cabling and the basic physical environment of digital communications.
Chapter 3 is a general description of the MODBUS® and JBUS® protocols.
Chapter 4 lists Series CN2200 and CN2400 parameter addresses and mnemonics.
Chapter 5 covers advanced topics such as access to full resolution floating point data and user interface permissions.
Appendix A is a Glossary of Terms.
Omega accepts no responsibility for any loss or damage caused by application of the information contained in this document.
JBUS® is a registered trademark of APRIL.
MODBUS® is a registered trademark of Gould Inc.
JBUS® V MODBUS®
•
MODBUS® is a serial communications protocol defined by Gould Inc.
April developed JBUS® as a special case of MODBUS®.
•
•
The two protocols use the same message frame format.
•
•
Series CN2200 and CN2400 JBUS® addresses are exactly the same as MODBUS® addresses.
The function codes used by Series CN2200 and CN2400 instruments are a subset of JBUS® and MODBUS®
function codes.
In this document reference will be made to MODBUS®, however all information applies equally to JBUS®.
REFERENCES
Refer to the documents below for further information;
Gould
MODBUS® Protocol Reference Guide, PI-MBUS-300
April
JBUS® Specification
EIA Standard RS-232-C (EIA-232-C)
Interface Between Terminal Equipment and Data Communication Equipment
Employing Serial Binary Interchange
EIA Standard RS-422 (EIA-422)
Electrical Characteristics of Balanced Voltage Digital Interface Circuits
EIA Standard RS-485 (EIA-485)
Electrical Characteristics of Generators and Receivers for use in Balanced Digital
Multipoint Systems
Series CN2200 and CN2400 Communications Handbook
1-1
Communications Handbook
CHAPTER 2
Digital Communications Hardware
DIGITAL COMMUNICATIONS HARDWARE
This chapter defines the differences between the RS-232 (EIA-232), RS-422 (EIA-422) and RS-485 (EIA-485) digital
communications standards. Details of configuration, cabling and termination will help to establish basic communications.
RS-232 (EIA-232), RS-422 (EIA-422) AND RS-485 (EIA-485) TRANSMISSION STANDARDS
The Electrical Industries Association, (EIA) introduced the Recommended Standards, RS-232 (EIA-232), RS-422 (EIA-422) and
RS-485 (EIA-485). These standards define the electrical performance of a communications network. The table below is a summary
of the different physical link offered by the three standards.
EIA Standard
RS-232C (EIA-232C)
RS-422 (EIA-422)
RS-485 (EIA-485)
Transmission mode
Single ended
Differential
Differential
Electrical connections
3 wire
5 wire
3 wire
No. of drivers and receivers
per line
1 driver,
1 driver,
32 drivers,
1 receiver
10 receivers
32 receivers
Maximum data rate
20k bits/s
10M bits/s
10M bits/s
Maximum cable length
50ft, (15M)
4000ft,
4000ft,
(1200M)
(1200M)
Note: RS-232 (EIA-232)C has been abbreviated to RS-232 (EIA-232). The RS-232 (EIA-232) standard allows a single instrument to
be connected to a PC, a Programmable Logic Controller, or similar devices using a cable length of less than 15M (50ft).
The RS-485 (EIA-485) standard allows one or more instruments to be connected (multi-dropped) using a two wire connection, with
cable length of less than 1200M (4000ft). 31 Instruments and one ‘master’ may be connected in this way. The balanced differential
signal transmission is less prone to interference and should be used in preference to RS-232 (EIA-232) in noisy environments. RS422 (EIA-422/485) is recommended for plant installation. Although RS-485 (EIA-485) is commonly referred to as a ‘two wire’
connection, a ground return/shield connection is provided as a ‘common’ connection for Series CN2200 and CN2400 Instruments,
and in general this should be used in installations to provide additional protection against noise.
Strictly speaking, RS-422 (EIA-422) is a standard permitting ‘point to point’ connection of two pieces of equipment using a full
duplex, differential signal on two pairs of wires. In principle, therefore, an RS-422 (EIA-422) link only allows a single instrument to
be connected to a PC. However, Series CN2200 and CN2400 instruments provide an enhanced version of RS-422 (EIA-422) that
also meets the full electrical requirements of RS-485 (EIA-485) described above. This allows up to 31 instruments to be connected
on the same network, but only with a 5 wire electrical connection. The transmission and reception of data use two pairs of twisted
cable, with a separate cable provided for common. The optional shield will provide additional noise immunity.
The 2 wire RS-485 (EIA-485) should be used where possible for new installations where multi-drop capability is required. RS-422
(EIA-422) is provided for compatibility with existing Omega instruments.
Using RS-232 (EIA-232) or RS-422 (EIA-422)/485, the Series CN2200 and CN2400 instruments operate in a half duplex mode that
does not allow the simultaneous transmission and reception of data. Data is passed by an alternating exchange.
Most PC's provide an RS-232 (EIA-232) port for digital communications. This unit is also used to buffer an RS-422/485 (EIA422/485) network when it is required to communicate with more than 32 instruments on the same bus, and may also be used to
bridge 2 wire RS-485 (EIA-485) to 4 wire RS-422 (EIA-422) network segments.
Series CN2200 and CN2400 Communications Handbook
2-1
Digital Communications Hardware
Communications Handbook
SELECTING RS-232 (EIA-232) OR RS-422/485 (EIA-422/485)
Changing between RS-232 (EIA-232), RS-422 (EIA-422), and RS-485 (EIA-485) is possible for CN2400 Series instruments by
replacing the plug-in ‘H’ Module with a communications module of the required type.
CN2200 Series communications hardware is a fixed build and must be specified when the instrument is being ordered.
CABLE SELECTION
The cable selected for the digital communications network should have the following electrical characteristics:
•
•
•
•
•
Less than 100 ohm / km nominal dc resistance. Typically 24 AWG or thicker.
Nominal characteristic impedance at 100 kHz of 100 ohms.
Less than 60 pF / m mutual pair capacitance, (the capacitance between two wires in a pair).
Less than 120 pF / m stray capacitance, (the capacitance between one wire and all others connected to ground).
For RS-422/485 (EIA-422/485) applications, use twisted pair cables.
The selection of a cable is a trade off between cost and quality factors such as attenuation and the effectiveness of shielding. For
applications in an environment where high levels of electrical noise are likely, use a cable with a copper braid shield, (connect the
shield to a noise free ground). For applications communicating over longer distances, choose a cable that also has low attenuation
characteristics.
In low noise applications and over short distances it may be possible to use the grounded shield as the common connection. Connect
the common to the grounded shield via a 100 ohm, 1/4W carbon composition resistor at the PC and all instruments.
For RS-422/485 (EIA-422/485), it is possible to operate the system with unshielded twisted data pairs, ground is used as the
common connection. Connect the common to ground via a 100 ohm, 1/4W carbon composition resistor at the PC and all
instruments. This system is not recommended.
The following list is a selection of cables suitable for RS 422/485 (EIA-422/EIA485) communication systems, listed in order of
decreasing quality.
Cables marked '*' are suitable for use with the wiring descriptions that follow.
Cables marked '**' use a different color coding from that used in the wiring descriptions.
Part number
Belden
Description
9842
2 twisted pairs with aluminium foil shield plus a 90% coverage copper shield **
9843
3 twisted pairs with aluminium foil shield plus a 90% coverage copper shield **
9829
2 twisted pairs with aluminium foil shield plus a 90% coverage copper shield
9830
3 twisted pairs with aluminium foil shield plus a 90% coverage copper shield *
8102
2 twisted pairs with aluminium foil shield plus a 65% coverage copper shield
8103
3 twisted pairs with aluminium foil shield plus a 65% coverage copper shield *
9729
2 twisted pairs with aluminium foil shield
9730
3 twisted pairs with aluminium foil shield *
The following are a selection of cables suitable for RS-232 (EIA-232) communication systems listed in order of decreasing quality;
Part number
Alpha
2-2
Belden
Description
8102
2 twisted pairs with aluminium foil shield plus a 65% coverage copper shield**
5472
9502
2 twisted pairs with aluminium foil shield*
2403
8771
3 separate wires with aluminium foil shield **
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Digital Communications Hardware
GROUNDING
Ensure all ground points are noise free.
To reduce interference from external electrical signals, ground the cable shield at a single ground point. There must not be multiple
ground paths in a single cable run. When using a Communications Adapter unit, do not connect the shield from one side of the
interface to the other. Rather, ground each of the cables separately at a local ground point.
The digital communication outputs of all Series CN2200 and CN2400 instruments are isolated. To avoid common mode noise
problems, connect the common line to ground at one point through a 100 ohm, 1/4W, carbon composition resistor. The resistor will
limit the ground current.
WIRING GENERAL
Route communications cables in separate trunking to power cables. Power cables are those connecting power to instruments,
relay or AC SSR ac supplies and wiring associated with external switching devices such as contactors, relays or motor speed drives.
Communication cables may be routed with control signal cables if these signal cables are not exposed to an interference source.
Control signals are the analog or logic inputs and analog or DC Pulse outputs of any control instrument.
Do not use redundant wires in the communications cable for other signals.
Ensure cable runs have sufficient slack to ensure that movement does not cause abrasion of the insulating sheath. Do not over
tighten cable clamps to avoid accidental multiple grounding of the shield conductors.
Ensure that the cable is ‘daisy chained’ between instruments, i.e. the cable runs from one instrument to the next to the final
instrument in the chain.
WIRING RS-232 (EIA-232)
To use RS-232 (EIA-232) the PC will be equipped with an RS-232 (EIA-232) port, usually referred to as COM 1.
To construct a cable for RS-232 (EIA-232) operation use a three core shielded cable.
The terminals used for RS-232 (EIA-232) digital communications are listed in the table below. Some PC's use a 25 way connector
although the 9 way is more common.
Standard Cable
PC socket pin no.
Color
9 way
25 way
White
2
3
Receive (RX)
HF
Transmit (TX)
Black
3
2
Transmit (TX)
HE
Receive (RX)
Red
5
7
Common
HD
Common
Link together
1
4
6
6
8
11
Rec'd line sig. detect
Data terminal ready
Data set ready
Link together
7
8
4
5
Request to send
Clear to send
1
Ground
Shield
•
PC Function *
Instrument Terminal
Instrument
Function
These are the functions normally assigned to socket pins. Please check your PC manual to confirm.
Rx
Tx
Com
Computer
Tx
HF
Rx
HE
Com HD
Ground
CN2200/CN2400
Series Controller
Figure 2-1 RS-232 (EIA-232) connections
Series CN2200 and CN2400 Communications Handbook
2-3
Digital Communications Hardware
Communications Handbook
WIRING RS-422 (EIA-422) OR 4-WIRE RS-485 (EIA-485)
To use RS-422 (EIA-422), buffer the RS-232 (EIA-232) port of the PC with a suitable RS-232/422 (EIA-232)/422) converter. A
suitable commercially available Communications Converter unit is recommended for this purpose. Instruments on an RS-422
(EIA-422) communication network should be chain connected and not star connected.
To construct a cable for RS-422 (EIA-422) operation use a shielded cable with two twisted pairs plus a separate core for common.
Although common or shield connections are not necessary, their use will significantly improve noise immunity.
The terminals used for RS-422 (EIA-422) digital communications are listed in the table below.
•
Standard Cable
PC socket pin no.
Color
25 way
White
3
Black
Red
PC Function *
Instrument Terminal
Instrument
CN2400
Function
Receive (RX+)
HE
Transmit (TX+)
16
Receive (RX-)
HF
Transmit (TX-)
12
Transmit (TX+)
HB
Receive (RX+)
Black
13
Transmit (TX-)
HC
Receive (RX-)
Green
7
Common
HD
Common
Shield
1
Ground
These are the functions normally assigned to socket pins. Please check your PC manual to confirm.
PC
Figure 2-2 Controllers (1 to 31) Connected to a PC using
RS-422 (EIA-422) Standard
Com Tx Rx
This diagram shows a typical installation.
RS-232 (EIA-232)
Com Rx Tx
NOTES
Universal
Converter
Tx-
Rx
Com
Tx+
Rx220 ohm
termination
resistor
on the Rx of the
converter unit
RS-422 (EIA-422)
Tx- Tx+
Rx- Rx
Com
Controller 1
It is possible to substitute an existing controller, or to add to
the current installation, with a CN2400 series controller
provided it has been supplied as 4-wire EIA485.
To add any other CN2200 or CN2400 series please refer to
Figure 2-4
It is preferable to ground cable shield at both ends BUT it is
essential to ensure that both are at equipotential. If this
cannot be guaranteed ground at one end, as shown.
The value of terminating resistors is not critical,
100 - 300 ohms is typical.
Represents twisted pairs
Tx- Tx+
Rx- Rx
Com
Controller 2
220 ohm
termination
resistor on the Rx
terminals on last
controller in the
chain
Additional Controllers
WIRING 2-WIRE RS-485 (EIA-485)
2-4
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Digital Communications Hardware
To use RS-485 (EIA-485), buffer the RS-232 (EIA-232) port of the PC with a suitable RS-232/485 (EIA-232)/485) converter.
Omega does not recommend the use of a RS-485 (EIA-485) board built into the computer since this board is unlikely to be isolated,
which may cause noise problems, and the Rx terminals are unlikely to be biased correctly for this application.
To construct a cable for RS-485 (EIA-485) operation use a shielded cable with one RS-485 (EIA-485)) twisted pair plus a separate
core for common. Although common or shield connections are not necessary, their use will significantly improve noise immunity.
The terminals used for RS-485 (EIA-485) digital communications are listed in the table below.
Standard Cable Color
PC socket pin no. 25 way
PC Function *
Instrument Terminal
Instrument Function
White
3
Receive (RX+)
HF (b) or (B+)
Transmit (TX)
Black
16
Receive (RX-)
Red
12
Transmit (TX+)
HE (A) or (A+)
Receive (RX)
Black
13
Transmit (TX-)
Green
7
Common
HD
Common
Shield
1
Ground
* These are the functions normally assigned to socket pins. Please check your PC manual to confirm .
PC
Com Tx Rx
RS-232 (EIA-232)
Figure 2-3 CN2000 Series Controllers (1 to 31) Connected
to a PC using 2-wire RS-485 (EIA-485) Standard
Com Rx Tx
Universal
Converter
Tx-
Com
Rx
RxTx+
220 ohm
termination
resistor
on the Rx of the
converter unit
Twisted pairs
RS-485 (EIA-485)
Com HF
HE
Controller 1
Eg CN2400
Com
HF
Controller 2
eg CN2200
HE
220 ohm
termination
resistor
on the last
controller in the
chain
Additional Controllers
Series CN2200 and CN2400 Communications Handbook
2-5
Digital Communications Hardware
Communications Handbook
WIRING RS-422 (EIA-422) AND RS-485 (EIA-485) CONTROLLERS
It is generally not possible to connect controllers using a 2-wire standard to controllers on a 4-wire standard. This may be required,
for example, if the CN2200 or CN2400 series controllers are to be added to an existing installation. It is possible, however, to
modify the existing communications link by adding a universal communications converter. This is shown in figure 2-4 below.
The converter unit that converts from 232 to 4-wire 485 uses this link to communicate to the existing Omega controllers. The second
universal converter is a special version which converts from 4-wire to 2-wire 485 communications. It’s input side behaves to the 4wire link as another controller would on an existing system, while at the same time the communications messages from the computer
are passed onto the output side of this unit. This is connected to the 2-wire communications link that will contain the series CN2200
controllers. Any responses from controllers on this link will cause data to be placed on to the 4-wire link and then will be passed
back to the computer.
Figure 2-4
PC
Controllers (1 to 31) Connected to a PC using a mixed standard
of RS-422 (EIA-422) (or RS-485 (EIA-485) 4-wire) and RS-485
(EIA-485) 2-wire.
Com Tx Rx
RS-232 (EIA-232)
Com Rx Tx
Universal
Converter
Tx-
Com
Rx
Tx+ Rx220 ohm
termination
resistor
on the Rx of the
converter unit
Twisted pairs
Universal Converter
RS-422 (EIA-422)
Tx
Rx
Tx-
Rx-
Rx
Tx
Tx-
RxRx- Rx
Tx Rx
HF HE
Tx- Tx+
Com
Controller ‘n’
Controller 1
220 ohm
termination
resistors
2-6
Controller n+1 to 31
CN2000/CN2400
220 ohm
termination
resistor
on the last
controller in
the 2-wire
chain
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Digital Communications Hardware
CONNECTIONS FOR UP TO 63 CONTROLLERS
Figure 2-5
PC
It is allowable to substitute one instrument in the first group with a universal
comms isolator. Up to a further 31 additional instruments can be added as shown.
Com Tx Rx
Com Rx Tx
Universal
Converte
Tx- r Com
Rx
RxTx+
220 ohm
terminating
resistor
220 ohm
terminating
resistor
Twisted pairs
220 ohm
terminating
resistor on
the last
instrument
220 ohm
terminating
resistor
Rx+ Rx+
Rx- RxTx+ Tx+
TxTxHE HF
Instrument
1
HE HF
Instrument
29
Series CN2200 and CN2400 Communications Handbook
Universal
Converter
replaces one
Instrument
HE HF
Instrument
32
HE
HF
Instrument
63
2-7
Digital Communications Hardware
Communications Handbook
LARGE RS-422/485 (EIA422/485) NETWORKS
Networks with more than 32 instruments will require buffering of the communication lines. A commercialy available Universal
Converter unit is recommended for this purpose. The universal converter sets the transmit line to non-tristate.
NOTE Large networks using RS-422 (EIA-422) 4-wire controllers could use a Universal Converter Unit To set the transmit lines to non
tristate check the manual of the Universal Converter Unit. Contact Omega for further information when specifying large networks
Instruments on a RS-422/485 (EIA422/485) communication network should be chain connected and not star connected.
The diagram below illustrates the wiring of a network communicating with a large number of CN2200 and CN2400 Series controllers.
PC
Com Tx Rx
Com Rx Tx
Universal
Converter
Tx-
Com
Rx
RxTx+
220 ohm
terminating
resistor
220 ohm
terminating
resistor on
the last
controller
220 ohm
terminating
resistor
Twisted pairs
Rx+ Rx+
Rx- RxTx+ Tx+
TxTxHE HF
Universal
Converter
Controller
1
HE
HF
Controller
31
220 ohm
terminating
resistor on
the last
controller
Rx+ Rx+
Rx- RxTx+ Tx+
TxTxRepeat for further
controllers in the
chain
2-8
HE HF
220 ohm
terminating
resistors
Controller
32
HE
HF
Controller
62
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
CHAPTER 3
Modbus® and JBUS® Protocol
MODBUS® AND JBUS® PROTOCOL
This chapter introduces the principles of the MODBUS® and JBUS® communication protocols. Note that in the Series
CN2200/CN2400 the two protocols are identical, and both will be referred to as MODBUS® for the descriptions that follow.
PROTOCOL BASICS
A data communication protocol defines the rules and structure of messages used by all devices on a network for data exchange. This
protocol also defines the orderly exchange of messages, and the detection of errors.
MODBUS® defines a digital communication network to have only one MASTER and one or more SLAVE devices. Either a single
or multi-drop network is possible. The two types of communications networks are illustrated in the diagram below;
Single Serial Link
Multi Drop Serial Link
JBUS Master
TX
JBUS Master
RX
TX
RX
^
^
^
RS232
v
RX
v
TX
RX
JBUS Slave 1
^
v
RS485
TX
JBUS Slave 1
v
RX
TX
JBUS Slave N
A typical transaction will consist of a request sent from the master followed by a response from the slave.
The message in either direction will consist of the following information;
Device Address
Function Code
Data
Error Check Data End of Transmission
•
Each slave has a unique 'device address'
•
The device address 0 is a special case and is used for messages broadcast to all slaves. This is restricted to parameter write
operations.
•
Series CN2200 and CN2400 support a subset of Modbus® function codes.
•
The data will include instrument parameters referenced by a 'parameter address'
•
Sending a communication with a unique device address will cause only the device with that address to respond. That
device will check for errors, perform the requested task and then reply with its own address, data and a check sum.
•
Sending a communication with the device address '0' is a broadcast communication that will send information to all
devices on the network. Each will perform the required action but will not transmit a reply.
Series CN2200 and CN2400 Communications Handbook
3-1
Modbus® and JBUS® Protocol
Communications Handbook
TYPICAL TRANSMISSION LINE ACTIVITY
This diagram is to illustrate typical sequence of events on a Modbus® transmission line.
ACTIVITY
Master
b
To slave 1
a
Slave 1
To slave N
Slave 1
c
a
a
Master
Broadcast
Reply
Slave N
Network
b
Master
Reply
Slave 2
a
Master
TIME >
Period 'a' The processing time, (latency), required by the slave to complete the command and construct a reply.
Period 'b' The processing time required by the master to analyze the slave response and formulate the next command.
Period 'c' The wait time calculated by the master for the slaves to perform the operation. None of the slaves will reply to a broadcast
message.
For a definition of the time periods required by the network, refer to 'Wait Period' in the section 'Error Response'.
DEVICE ADDRESS
Each slave has a unique 8 bit device address. The Gould MODBUS® Protocol defines the address range limits as 1 to 247. Series
CN2200/CN2400 instruments will support an address range of 1 to 254. The device address used by the instrument is set using the
Addr parameter in the Cms List, which is available in operator mode. Note that this list may only be accessible when using the
FuLL user interface: refer to the manual supplied with the instrument for more details on how to set this parameter.
Device address 0 is a special case that will broadcast a message to all slave devices simultaneously.
3-2
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
PARAMETER ADDRESS
Data bits or data words exchange information between master and slave devices. This data consists of parameters. All parameters
communicated between master and slaves have a 16 bit parameter address.
The MODBUS® parameter address range is 0001 to FFFF..
Parameter definitions for Series CN2200/CN2400 instruments are in Chapter 5.
PARAMETER RESOLUTION
JBUS® and MODBUS® protocol limit data to 16 bits per parameter. This reduces the active range of parameters to 65536 counts.
In Series CN2200 and CN2400 instruments this is implemented as -32767 (8001h) to +32767 (7FFFh).
The protocol is also limited to integer communication only. Series CN2200 and CN2400 instruments allow the user to configure either
integer or full resolution. In integer mode all parameters will be rounded to the nearest integer value, whereas in full resolution mode the
decimal point position will be implied so that 100.01 would be transmitted as 10001. From this, and the 16 bit resolution limitation, the
maximum value communicable with 2 decimal place resolution is 327.67. The parameter resolution will be taken from the slave user
interface, and the conversion factor must be known to both master and slave when the network is initiated.
MODE OF TRANSMISSION
The mode of transmission describes the structure of information within a message and the number coding system used to exchange a
single character of data.
The JBUS® and MODBUS® Protocols define a mode of transmission for both ASCII and RTU modes of transmission. Omega
Engineering Series CN2200 and CN2400 instruments only support the RTU mode of transmission.
The RTU definition of the mode of transmission for a single character is;
A start bit, eight data bits, a parity bit and one or two stop bits
All Omega Series CN2200 and CN2400 instruments use 1 stop bit.
Parity may be configured to be NONE, ODD or EVEN.
If parity is configured to be NONE, no parity bit is transmitted.
The RTU mode of transmission for a single character is represented as follows:
Start
d7
d6
d5
d4
d3
d2
Series CN2200 and CN2400 Communications Handbook
d1
d0
Parity
Stop
3-3
Modbus® and JBUS® Protocol
Communications Handbook
MESSAGE FRAME FORMAT
A message consists of a number of characters sequenced so that the receiving device can understand. This structure is known as
the message frame format.
The following diagram shows the sequence defining the message frame format used by JBUS® and MODBUS®:
Frame start
3 bytes
Device address
1 byte
Function code
1 byte
Data
CRC
EOT
n bytes 2 byte
3 bytes
The frame start is a period of inactivity at least 3.5 times the single character transmission time.
For example, at 9600 baud a character with 1 start, 1 stop and 8 data bits will require a 3.5ms frame start.
This period is the implied EOT of a previous transmission.
The device address is a single byte (8-bits) unique to each device on the network.
Function codes are a single byte instruction to the slave describing the action to perform.
The data segment of a message will depend on the function code and the number of bytes will vary accordingly.
Typically the data segment will contain a parameter address and the number of parameters to read or write.
The Cyclic Redundancy Check, (CRC) is an error check code and is two bytes, (16 bits) long.
The End of Transmission segment, (EOT) is a period of inactivity 3.5 times the single character transmission time. The EOT
segment at the end of a message indicates to the listening device that the next transmission will be a new message and therefore a
device address character.
CYCLIC REDUNDANCY CHECK
The Cyclic Redundancy Check, (CRC) is an error check code and is two bytes, (16 bits) long. After constructing a message, (data
only, no start, stop or parity bits), the transmitting device calculates a CRC code and appends this to the end of the message. A
receiving device will calculate a CRC code from the message it has received. If this CRC code is not the same as the transmitted
CRC there has been a communication error. Series CN2200 and CN2400 instruments do not reply if they detect a CRC error in
messages sent to them.
The CRC code is formed by the following steps:
1
Load a 16 bit CRC register with FFFFh.
2
Exclusive OR (⊕) the first 8 bit byte of the message with the with the high order byte of the CRC register.
Return the result to the CRC register.
3
Shift the CRC register one bit to the right.
4
If the over flow bit, (or flag), is 1, exclusive OR the CRC register with A001 hex and return the result to the
CRC register.
4a
If the overflow flag is 0, repeat step 3.
5
Repeat steps 3 and 4 until there have been 8 shifts.
6
Exclusive OR the next 8 bit byte of the message with the high order byte of the CRC register.
7
Repeat step 3 through to 6 until all bytes of the message have been exclusive OR with the CRC register and shifted 8
times.
8
The contents of the CRC register are the 2 byte CRC error code and are added to the message with the most significant
bits first.
3-4
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
The flow chart below illustrates this CRC error check algorithm.
The '⊕' symbol indicates an 'exclusive OR' operation. 'n' is the number of data bits.
START
FFFFh → CRC Register
CRC Register ⊕ next byte of the message → CRC Register
0 → n
Shift CRC Register right 1 bit
NO
Over flow ?
YES
CRC Register ⊕ A001h → CRC Register
n+1 → n
NO
n > 7?
YES
CRC Register ⊕ next byte of the message → CRC Register
NO
Is message complete ?
YES
END
Series CN2200 and CN2400 Communications Handbook
3-5
Modbus® and JBUS® Protocol
Communications Handbook
EXAMPLE OF A CRC CALCULATION
This example is a request to read from the slave unit at address 02, the fast read of the status (07).
Function
16 Bit Register
LSB
Carry
flag
MSB
Load register with FFFF hex
First byte of the message (02)
1111
1111
1111
0000
1111
0010
Exclusive OR
1111
1111
1111
1101
1st shift right
A001
0111
1010
1111
0000
1111
0000
1110
0001
Exclusive OR (carry = 1)
1101
1111
1111
1111
2nd shift right
A001
0110
1010
1111
0000
1111
0000
1111
0001
Exclusive OR (carry = 1)
1100
1111
1111
1110
3rd shift right
4th shift right (carry = 0)
A001
0110
0011
1010
0111
0011
0000
1111
1111
0000
1111
1111
0001
Exclusive OR (carry = 1)
1001
0011
1111
1110
5th shift right
6th shift right (carry = 0)
A001
0100
0010
1010
1001
0100
0000
1111
1111
0000
1111
1111
0001
Exclusive OR (carry = 1)
1000
0100
1111
1110
7th shift right
8th shift right (carry = 0)
A001
0100
0010
1010
0010
0001
0000
0111
0011
0000
1111
1111
0001
Exclusive OR (carry = 1)
Next byte of the message (07)
1000
0001
0011
0000
1110
0111
Exclusive OR (shift = 8)
1000
0001
0011
1001
1st shift right
A001
0100
1010
0000
0000
1001
0000
1100
0001
Exclusive OR (carry = 1)
1110
0000
1001
1101
2nd shift right
A001
0111
1010
0000
0000
0100
0000
1110
0001
Exclusive OR (carry = 1)
3rd shift right
A001
1101
0110
1010
0000
1000
0000
0100
0010
0000
1111
0111
0001
Exclusive OR (carry = 1)
1100
1000
0010
0110
4th shift right
5th shift right (carry = 0)
A001
0110
0011
1010
0100
0010
0000
0001
0000
0000
0011
1001
0001
Exclusive OR (carry = 1)
1001
0010
0000
1000
6th shift right
7th shift right (carry = 0)
8th shift right (carry = 0)
0100
0010
0001
1001
0100
0010
0000
1000
0100
0100
0010
0001
CRC error check code
12h
0
1
1
0
1
0
1
0
1
1
1
1
0
1
0
0
0
41h
The final message transmitted, including the CRC code, is as follows;
Device address
Function code
CRC MSB
CRC LSB
02h
07h
41h
12h
0000
↑ First bit
3-6
0010
0000
0111
0100
0001
Transmission order
0001
0010
Last bit ↑
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
EXAMPLE OF A CRC CALCULATION IN THE ‘C’ LANGUAGE
This routine assumes that the data types ‘uint16’ and ‘uint8’ exists. These are unsigned 16 bit integer (usually an ‘unsigned short int’ for
most compiler types) and unsigned 8 bit integer (unsigned char). ‘z_p’ is a pointer to a Modbus® message, and z_message_length is its
length, excluding the CRC. Note that the Modbus® message will probably contain ‘NULL’ characters and so normal C string handling
techniques will not work.
uint16 calculate_crc(byte *z_p, uint16 z_message_length)
/*
/*
/*
/*
CRC runs cyclic Redundancy Check Algorithm on input z_p */
Returns value of 16 bit CRC after completion and
*/
always adds 2 crc bytes to message
*/
returns 0 if incoming message has correct CRC
*/
{
uint16 CRC= 0xffff;
uint16 next;
uint16 carry;
uint16 n;
uint8 crch, crcl;
while (z_message_length--) {
next = (uint16)*z_p;
CRC ^= next;
for (n = 0; n < 8; n++) {
carry = CRC & 1;
CRC >>= 1;
if (carry) {
CRC ^= 0xA001;
}
}
z_p++;
}
crch = CRC / 256;
crcl = CRC % 256
z_p[z_message_length++] = crcl;
z_p[z_message_length] = crch;
return CRC;
}
Example of a CRC Calculation in BASIC Language
Function CRC(message$) as long
'' CRC runs cyclic Redundancy Check Algorithm on input message$
'' Returns value of 16 bit CRC after completion and
'' always adds 2 crc bytes to message
'' returns 0 if incoming message has correct CRC
'' Must use double word for CRC and decimal constants
crc16& = 65535
FOR c% = 1 to LEN(message$)
crc16& = crc16& XOR ASC(MID$(message$, c%, 1))
FOR bit% = 1 to 8
IF crc16& MOD 2 THEN
crc16& = (crc16& \ 2) XOR 40961
ELSE
crc16& = crc16& \ 2
END IF
NEXT BIT%
NEXT c%
crch% = CRC16& \ 256: crcl% = CRC16& MOD 256
message$ = message$ + CHR$(crcl%) + CHR$(crch%)
CRC = CRC16&
END FUNCTION CRC
Series CN2200 and CN2400 Communications Handbook
3-7
Modbus® and JBUS® Protocol
Communications Handbook
FUNCTION CODES
Function codes are a single byte instruction to the slave describing the action to perform.
The following communication functions are supported by Series CN2200 and CN2400 instruments:
Function code
Function
01 or 02
Read n bits
03 or 04
Read n words
05
Write a bit
06
Write a word
07
Fast Read of Status
08
Loopback
16
Write n words
It is recommended that function code 3 is used for reads and function code 16 is used for writes. This includes Boolean data. Other
codes are supplied for purposes of compatibility.
Only the write function codes 05, 06 and 16 will work with a ‘broadcast mode’ address. Series CN2200 and CN2400 instruments
will not reply if they receive a request including a unsupported function code.
Data bits or data words exchange information between master and slave devices. This data consists of parameters.
Parameter definitions for the Series CN2200 and CN2400 instruments are provided later in this document.
The sections that follow explain the message frame format for each function code.
3-8
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
READ N BITS
Function code:
01 or 02, (01h or 02h)
Command:
Device address
Function code
Address of
01 or 02
first bit
1 byte
1 byte
MSB
Number of bits to
read
LSB
MSB
CRC
LSB
MSB
LSB
Reply:
Device address
Function code
Number of bytes
read
First byte
01 or 02
1 byte
....
Last byte
of data
1 byte
1 byte
CRC
of data
1 byte
....
1 byte
MSB
LSB
The first data byte contains the status of the first 8 bits, with the least significant bit being the first bit. The second data byte
contains the status of the next 8 bits, etc.. Unused bits are set to zero.
Example: From the instrument at device address 19, read 14 bits, beginning at parameter address 2.
Command:
Device address
Function code
Address of
Number of bits to
read
CRC
first bit
13
01
00
02
00
0E
1F
7C
Reply:
Device address
13
Function code
Number of bytes
read
01
First byte
Second byte
of data
of data
01
01
02
CRC
C1
AF
An expansion of the data bytes illustrates the relationship between data and the parameter addresses.
The reply indicates that the instrument is in sensor break and manual mode.
Data byte
1st byte (40h)
2nd byte (02h)
Param. address
9
8
7
6
5
4
3
2 17 16 15 14 13 12 11 10
Bit values
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
Parameter addresses 16 and 17 are set to zero.
Series CN2200 and CN2400 Communications Handbook
3-9
Modbus® and JBUS® Protocol
Communications Handbook
READ N WORDS
Function code:
03 or 04, (03h or 04h)
Command:
Device address
Function code
Address of
03 or 04
first word
1 byte
1 byte
MSB
LSB
Number of words
to read
MSB
LSB
CRC
MSB
LSB
The maximum number of words that may be read is 125 for CN2400 Series instruments and 32 for the CN2200
Reply:
Device address
Function code
Number of bytes Value of the first
read
word
....
Value of the last
word
CRC
03 or 04
1 byte
1 byte
1 byte
MSB
LSB
....
MSB
LSB
MSB
LSB
Example: From CN2200 and CN2400 Series slave at device address 2, read 2 words from parameter address 1 (Process Variable and
Target Setpoint).
Command:
Device address
Function code
Address of
Number of words
to read
CRC
first word
02
Reply:
03
00
01
00
02
95
F8
(If the instrument is configured with integer resolution and PV = 18.3, SP = 21.6)
Device address
Function code
Number of bytes Value of the first
read
word
Value of the last
word
CRC
03 or 04
02
Reply:
03
04
00
12
00
16
E8
F8
(If the instrument is configured with full resolution and PV = 18.3, SP = 21.6)
Device address
Function code
Number of bytes Value of the first
read
word
Value of the last
word
CRC
03 or 04
02
03
04
00
B2
00
D8
69
4E
As the decimal point is not transmitted, the master must scale the response; 183=5.0, 216=10.0.
3-10
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
WRITE A BIT
Function code:
05, (05h)
Command:
Device address
Function code
Address of bit
Value of bit
CRC
05
1 byte
1 byte
MSB
LSB
MSB
LSB
MSB
LSB
The LSB of 'Value of bit' is always set to 00. The MSB is used to write the value of the addressed bit.
To set a bit value of 1, either transmit 01h or FFh. To set a bit value of 0 transmit 00h.
A device address 00 will broadcast the data to all devices on the network.
Reply:
(There will be no reply to a command broadcast to the device address 00.)
Device address
Function code
Address of bit
Value of bit
CRC
05
1 byte
1 byte
MSB
LSB
MSB
LSB
MSB
LSB
The reply to function 05 is the same as the command. See the section on ‘Error Response’ below for details of
the reply if the operation fails.
Example: Write to the Series CN2200 and CN2400 instrument at device address 2 and set the instrument to manual.
(The bit at parameter address 2 is set).
Command:
Device address
Function code
02
05
Device address
Function code
02
05
Address of bit
00
02
Value of bit
01
00
CRC
6D
A9
Reply:
Address of bit
00
Series CN2200 and CN2400 Communications Handbook
02
Value of bit
01
00
CRC
6D
A9
3-11
Modbus® and JBUS® Protocol
Communications Handbook
WRITE A WORD
Function code:
06, (06h)
Command:
Device address
Function code
Address of word
Value of word
MSB
MSB
CRC
06
1 byte
1 byte
LSB
LSB
MSB
LSB
A device address 00 will broadcast the data to all devices on the network.
Reply:
(There will be no reply to a command broadcast to the device address 00.)
Device address
Function code
Address of word
Value of word
MSB
MSB
CRC
06
1 byte
1 byte
LSB
LSB
MSB
LSB
The reply to function 06 is the same as the command. See the section on ‘Error Response’ below for details of
the reply if the operation fails.
Example: Write to the Series CN2200 and CN2400 slave at device address 2 and change the setpoint to 25.0°C (address 2). The
instrument is configured with full resolution, therefore the required value is 250.
Command:
Device address
Function code
02
06
Device address
Function code
02
06
Address of word
00
02
Value of word
00
FA
CRC
A8
7A
Reply:
3-12
Address of word
00
02
Value of word
00
FA
CRC
A8
7A
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
FAST READ OF STATUS
Function code:
07, (07h)
The fast read of status command is short to allow a rapid transaction to obtain one byte of frequently needed status information.
Command
Device address
Function code
07
1 byte
1 byte
CRC
MSB
LSB
Reply:
Device address
Function code
07
Fast read
status byte
1 byte
1 byte
1 byte
CRC
MSB
LSB
The table below defines the status byte information used by Series CN2200 and CN2400 instruments.
Parameter
Modbus®
CN2400
Modbus®
CN2200
Display
Summary Output Status Word
75
75
-
BIT
DESCRIPTION
0
Alarm 1 State ( 0 = Safe, 1 = Alarm )
Alarm 1 State ( 0 = Safe, 1 = Alarm )
1
Alarm 2 State ( 0 = Safe, 1 = Alarm )
Alarm 2 State ( 0 = Safe, 1 = Alarm )
2
Alarm 3 State ( 0 = Safe, 1 = Alarm )
Alarm 3 State ( 0 = Safe, 1 = Alarm )
3
Alarm 4 State ( 0 = Safe, 1 = Alarm )
Alarm 4 State ( 0 = Safe, 1 = Alarm )
4
Manual Mode ( 0 = Auto, 1 = Manual )
Manual Mode ( 0 = Auto, 1 = Manual )
5
Sensor Break ( 0 = Good PV, 1 = Sensor Broken )
Sensor Break ( 0 = Good PV, 1 = Sensor Broken )
6
Loop Break
( 0 = Good closed loop, 1 = Open Loop )
Loop Break ( 0 = Good Closed Loop, 1 = Open Loop )
7
Heater Fail
( 0 = No Fault, 1 = Load fault detected )
Heater Fail
( 0 = No Fault, 1 = Load Fault Detected)
8
Tune Active
( 0 = Auto Tune disabled, 1 = Auto Tune
active)
Load Fail
( 0 = No Fault, 1 = Load Fault Detected)
9
Ramp/Program Complete ( 0 = Running/Reset,
Ramp/Program Complete ( 0 = Running/Reset, 1 =
Complete )
10
PV out of range ( 0 = PV within table range, 1 = PV out of
table range )
11
DC control module fault (0= Good,. 1= BAD)
12
Programmer Segment Synchronize (0 = Waiting,
1 = Complete )
PV out of range ( 0 = PV within table range, 1 = PV out
of table range )
SSR Fail
( 0 = No fault, 1 = Load fault detected )
New Alarm
1 = Running)
13
Example:
Command:
Remote input sensor break (0 = Good, 1 = Bad)
Remote input sensor break (0 = Good, 1 = Bad)
Fast read the status byte from a Series CN2200 and CN2400 instrument at device address 02.
Device address
Function code
02
07
CRC
41
12
Reply:
Device address
Function code
Fast read
CRC
status byte
02
07
30
D2
24
In this example the value of status byte (30h) has the following information;
PV is in sensor break
Instrument is in Manual mode
Series CN2200 and CN2400 Communications Handbook
3-13
Modbus® and JBUS® Protocol
Communications Handbook
DIAGNOSTIC LOOPBACK
Function code:
08, (08h)
This function provides a means of testing the communications link by means of a ‘loopback’ operation. The data sent to the
instrument is returned unchanged. Only diagnostic code 0 from the Gould Modicon Specification is supported
Command:
Device address
1 byte
Function Code
Diagnostic Code
08
0000
1 byte
MSB
LSB
Loopback Data
MSB
LSB
CRC
MSB
LSB
Reply:
The reply to function 08 is the same as the command
Example:
Perform a loopback from the Series CN2200 and CN2400 instrument at address 2, using a data value of 1234h.
Command:
Device address
Function Code
Diagnostic Code
08
0000
02
08
00
00
Device address
Function Code
Diagnostic Code
08
0000
Loopback Data
12
34
CRC
ED
4F
Reply:
02
3-14
08
00
00
Loopback Data
12
34
CRC
ED
4F
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
WRITE N WORDS
Function code:
16, (10h)
Command:
Device address
Function code
1 byte
1 byte
Address of
10
Number of words
to write
first word
MSB
LSB
MSB
Number of data
bytes (n)
Data
1 byte
n bytes
LSB
CRC
MSB
LSB
The maximum number of words that can be transmitted is
Series CN2200:
Series CN2400:
32
125 words, which corresponds to 250 bytes of data
The first two bytes are data with the required value of the first parameter, MSB first. Following pairs of bytes are data for the
consecutive parameter addresses.
A device address 00 will broadcast the data to all devices on the network.
NB: Blocks of data written using Modbus® function 16 containing values in positions corresponding to the addresses of
unconfigured parameters are not generally rejected, although the values of any unconfigured parameters are discarded. This
allows relatively large blocks of parameter data to be written in a single operation, even if the block contains a little ‘empty’ space.
This is particularly useful for operations such as downloading ramp/dwell programs, recipes, or instrument cloning. However, this
also leads to a potential pitfall: if the block of data contains only a single parameter, and the destination address refers to an
unconfigured or unused Modbus® address, the write operation will appear to be successful, although the instrument will have
discarded the value.
Attempts to write to read only parameters over Modbus®, even when they are embedded within a block of data, will be rejected with
a Modbus® ‘data error’. Any subsequent values in the block will also be discarded.
Reply:
There will be no reply to a command broadcast to the device address 00. See the section on ‘Error Response’ below for
details of the reply if the operation fails.
Device address
Function code
Address of
10
first word
1 byte
Example:
1 byte
MSB
LSB
Number of words
written
MSB
LSB
CRC
MSB
LSB
Write to the Series CN2200 and CN2400 slave at device address 2 which is configured with full resolution.
Setpoint 3
=
12.3 (123) parameter address 164
Setpoint 4
=
15.0 (150) parameter address 165
Setpoint 5
=
25.0 (250) parameter address 166
Command:
Device
address
Function
code
02
10
Address of
first word
00
A4
Data (123) for
address 164
01
7B
Number of words
to write
00
03
Data (150) for
address 165
03
96
Number of
Data
CRC
data bytes
06
See below
20
71
Data (250) for
address 166
00
FA
Reply:
Device address
Function code
02
10
Address of
first word
00
Series CN2200 and CN2400 Communications Handbook
A4
Number of words
written
00
03
CRC
C1
D8
3-15
Modbus® and JBUS® Protocol
Communications Handbook
ERROR RESPONSE
The JBUS® and MODBUS® protocol define the response to a number of error conditions. A slave device is able to detect a
corrupted command or, one that contains an incorrect instruction, and will respond with an error code.
With some errors the slave devices on the network are unable to make a response. After a wait period the master will interpret the
failure to reply as a communication error. The master should then re-transmit the command.
A slave device that has detected a corrupted command or a command that contains an incorrect instruction, will respond with an
error message. The error message has the following syntax.
Device address
Function code
Error response
code
1 byte
1 byte
1 byte
CRC
MSB
LSB
The Function code byte contains the transmitted function code but with the most significant bit set to 1.
(This is the result of adding 128 to the function code.)
ERROR RESPONSE CODES
The error response code indicates the type of error detected.
Series CN2200 and CN2400 instruments support the following error response codes:
3-16
Code
Error
Description
02
Illegal Data Address
The address referenced in the data field is not an
allowable address for the slave
03
Illegal Data Value
The value referenced in the data field is not allowable
in the addressed slave location
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® and JBUS® Protocol
WAIT PERIOD
There are several errors for which the slave devices on the network are unable to make a response:
•
If the master attempts to use an invalid address then no slave device will receive the message.
•
For a message corrupted by interference, the transmitted CRC will not be the same as the internally calculated
CRC. The slave device will reject the command and will not reply to the master.
After a wait period, the master will re-transmit the command.
A wait period is also required after a broadcast communication to device address 0.
Caution: Failure to observe the wait period after a broadcast will negate the broadcast message.
The wait period should exceed the instrument latency plus the message transmission time. Typical wait periods, for a single
parameter read, are 20ms for Series CN2400 and 50 to 100ms for Series CN2200.
LATENCY
The time taken for the Series CN2200/CN2400 instruments to process a message and start the transmission of a reply is called the
latency. This does not include the time taken to transmit the request or reply.
The parameter functions read 1 word (function 03h), write 1 word (function 06h), write 1 bit (function 05h), fast read of status
(function 07h), and loopback (function 08h) are processed within a latency of between 2 and 10ms.
For the parameter functions, read n bits (function 01h), read n words (function 03h), and write n words (function 10h) the latency
is indeterminate. The latency will depend on the instrument activity and the number of parameters being transferred and will take
from 2 to 500ms, for Series CN2400, and 50 to 500ms, for Series CN2200.
It is possible to artificially increase the latency by setting the ‘Comms Delay’ parameter in the Mod HA configuration list. This is
sometimes required to allow a guaranteed gap between requests and responses, needed by some RS-485 (EIA-485) adaptors to
switch from transmit to receive states.
MESSAGE TRANSMISSION TIME
The time required to transmit a message will depend on the length of the message and the baud rate.
Message transmission time = (Number of bytes in the message + 3.5) * Number of bits per character
Baud rate
To find the number of bytes, refer to the relevant function code. The three extra bytes are for the End of Transmission, (EOT),
characters.
The number of bits per character will be ten, or eleven if a parity bit is used. (1 start bit, 8 data bits, an optional parity bit and 1
stop bit. See Mode of Transmission).
For example reading a single word with the function code 03 at 19200 baud, (no parity bit);
Command transmission time = (8 + 3.5) * 10 =
19200
6 ms
Reply transmission time
19200
6.5 ms
= (9 + 3.5) * 10 =
The wait period for this transaction will exceed 22.5 ms, (6 + 6.5 + 10.0).
For a broadcast command, (device address 0), the master would not expect a reply. In this case, the wait period will exceed 16
ms, (6 +10.0).
Series CN2200 and CN2400 Communications Handbook
3-17
Communications Handbook
CHAPTER 4
Modbus® Addresses
MODBUS® AND ADDRESSES
MODBUS® ADDRESS
This section of the manual provides a list of all parameters in Series CN2200 and CN2400 controllers that are available over the
communications link. As far as possible, it follows the same organization as the controller user interface itself. Definitions of
parameters and status information not available via the controller display are also provided.
Series CN2200 and CN2400 controllers may be configured for a wide variety of functions and some parameters will only be
available if the related function is configured. Modbus® addresses that are not supported have no parameter assigned. In normal
operating mode all configuration parameters are read only. To be able to write to these parameters, the controller must be in
configuration mode.
If the Modbus® protocol is used to read a parameter that is not configured, an undefined value will be returned.
Modbus® function 6 single parameter write operations to unconfigured or read only parameters will be rejected with a Modbus®
‘data error’ return code.
NB: Blocks of data written using Modbus® function 16 containing values in positions corresponding to the addresses of
unconfigured parameters are not generally rejected, although the values of any unconfigured parameters are discarded. This
allows relatively large blocks of parameter data to be written in a single operation, even if the block contains a little ‘empty’ space.
This is particularly useful for operations such as ramp/dwell program downloading, recipes, or instrument cloning. However, this
also leads to a potential pitfall: if the block of data contains only a single parameter, and the destination address refers to an
unconfigured or unused Modbus® address. The write operation will appear to be successful, although the controller will have
discarded the value.
Attempts to write to read only parameters over Modbus®, even when they are embedded within a block of data, will be rejected with
a Modbus® ‘data error’. Any subsequent values in the block will also be discarded.
Rules for read and write operation in the Modbus® IEEE are dealt with in Chapter 3.
Series CN2200 and CN2400 Communications Handbook
4-1
Modbus® Addresses
Communications Handbook
OPERATING MODE PARAMETERS
It is often only necessary to access a limited number of the most common parameters, where, for example, it is required to emulate
the front panel of a controller in a mimic diagram. The following table shows a summary of common parameters:
CN2408
OP1
OP2
20.00
23.00
Example 1 PID Controller
Parameter
Read Process value
Change Setpoint
Raise Setpoint
Select Manual Mode
Change Output Power
Raise Output Power
Read Output Power
Modbus® Address
1
2 - (enter new value)
2 - (new value in repeated steps)
273 - (enumerator 1)
3 - (new value)
3 - (new value in repeated steps)
3
Parameter
To Select Manual
To Change Output Position
To Read Output Position
Modbus® address
273 - (enumerator 1)
60 - (new value)
53
MODBUS® TABLES
Notes: The following notes apply throughout this section
1.
2.
Issued software versions to date are CN2400: 1.03, 2.04, 3.04 and 3.05 and 2200: 1.00, 1.20, 1.30 and 2.10.
Greyed out cells indicate parameter not available
CN2400
Home list
OP
vPoS
SP
m-A
AmPS
C.id
w.SP
OP
diSP
4-2
Process Variable
% Output level
Valve position
Target setpoint (if in Manual mode )
Auto-man select
0: Auto
1: Manual
Heater current (With PDLINK mode 2)
Customer defined identification number
Working set point. Read only: use Target
set point or currently selected set point (1
to 16) to change the value
Control output (on/off controller). Not writable
unless the controller is in ‘manual’ mode.
0: -100%
1: 0%
2: 100%
VP Manual Output (alterable in Man only)
Valve Posn (computed by VP algorithm)
Display
0: Standard
1: Load current
2: Output power
3: Program state
5: Blank
6: Valve position
Modbus®
1
3
CN2200
2
273
Modbus®
1
3
53
2
273
80
629
80
629
5
5
85
Notes
Notes
See Note 1
above
60
53
106
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
run
Prg
StAt
PSP
CYC
SEG
StYP
SEGt
tGt
rAtE
PrGt
FASt
out.1
out.2
out.3
out.4
out.5
out.6
out.7
out.8
Sync
SEG.d
AL
1--2--3--4--HY1
Hy2
HY3
HY4
Lbt
diAG
Modbus® Addresses
Run List
Current program running (active prog
no.)
Program Status
1: Reset
2: Run
4: Hold
8: Holdback
16: Complete
Programmer setpoint
Program cycles remaining
Current segment number
Current segment type
0: End
1: Ramp (Rate)
2: Ramp (Time to target)
3: Dwell
4: Step
5: Call
Segment time remaining
Target setpoint (current segment)
Ramp rate
Program time remaining
Fast run
0: No
1: Yes
Logic 1 output (current program)
0: Off (applies to all 8 logic outputs)
1: On (applies to all 8 logic outputs)
Logic 2 output (current program)
Logic 3 output (current program)
Logic 4 output (current program)
Logic 5 output (current program)
Logic 6 output (current program)
Logic 7 output (current program)
Logic 8 output (current program)
Segment synchronization
0: No
1: Yes
Flash active segment in lower display
CN2400
Modbus®
22
Modbus®
Notes
Modbus®
13
14
81
82
580
580
580
580
83
Notes
23
163
59
56
29
36
160
161
58
57
464
465
466
467
468
469
470
471
488
284
Alarm List
Alarm 1setpoint value
Alarm 2setpoint value
Alarm 3setpoint value
Alarm 4setpoint value
Alarm 1 hysteresis
Alarm 2 hysteresis
Alarm 3 hysteresis
Alarm 4 hysteresis
Loop break time
0: Off
Enable diagnostic messages
0: No Diagnostics
1: Diagnostics
CN2200
Notes
CN2400
Modbus®
13
14
81
82
47
68
69
71
83
CN2200
Notes
282
Series CN2200 and CN2400 Communications Handbook
4-3
Modbus® Addresses
Atun
tunE
drA
dra.t
adc
Pid
Communications Handbook
Autotune List
Autotune enable
0: No Tune
1: Tune
Adaptive tune enable
0: No Adaptive Tune
1: Tune
Adaptive tune trigger level
Automatic droop compensation
(manual reset)
0: Manual reset
1: Calculated
CN2400
Modbus®
270
CN2200
Notes
Modbus®
270
271
100
272
PID List
272
CN2400
Modbus®
153
Notes
CN2200
Modbus®
G.SP
Gain scheduler setpoint
SET
Current PID set (read only if gain
scheduling is selected)
0: Set 1
1: Set 2
Proportional band PID1
72
6
6
Integral time PID1
0: Off
Derivative time PID1
0: Off
Manual reset PID1
8
8
9
9
PB
Ti
td
res
28
28
18
18
17
17
reL.c
Cutback high PID1
0: Auto
Cutback low PID1
0: Auto
Relative cool gain PID1
19
19
pb2
Proportional band PID2
48
ti2
Integral time PID2
0: Off
Derivative time PID2
0: Off
Manual reset PID2
49
118
reL2
Cutback high PID2
0: Auto
Cutback low PID2
0: Auto
Relative cool gain PID2
pb.c
Cool proportional band
90
db.c
Cool deadband
91
ff.pb
Feedforward proportional band
97
ff.tr
Feedforward trim
98
ff.dv
Feedforward trim limit
99
Hcb
Lcb
td2
res.2
Hcb2
Lcb2
4-4
Notes
Notes
51
50
117
52
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
On.OF
Modbus® Addresses
On/Off List
CN2400
CN2200
hys.H
Heat hysteresis
Modbus®
86
hys.C
Cool hysteresis
88
parameters
88
HC.db
Heat/cool deadband
16
appear in
16
sb.OP
On/Off sensor break output power
0: -100%
1: 0%
2: 100%
40
the output list in
2400 series
mtr
Motor List
tm
Valve travel time
In.t
Valve inertia time
123
bac.t
Valve backlash time
124
mp.t
Minimum pulse time
54
v.br
Bounded sensor break strategy
128
VP Bounded sensor break
62
mtr
cyc.t
Inv
Motor List
VP Cycle time
123
VEL.u
VEL.d
VP lower velocity limit
126
Pot.L
VP Position low limit
42
Pot.H
VP Position high limit
43
Sb.OP
Boundless sensor break o/p
0: Rest
1: Up
2: Down
128
bAc.u
bAc.d
Notes
CN2200
Notes
Modbus®
Notes
VP b (feedback)
controllers only
CN2400
Modbus®
132
VP Raise inertia
0: Off
VP Lower inertia
0: Off
VP Raise backlash
0: Off
VP Lower backlash
0: Off
VP Raise velocity limit
Ind
Modbus®
86
CN2400
Modbus®
21
sb.op
Notes
These
CN2200
Notes
Modbus®
Notes
130
124
129
125
Series CN2200 and CN2400 Communications Handbook
4-5
Modbus® Addresses
SP
sseL
Communications Handbook
Setpoint list
Select setpoint
0: SP1
1: SP2
CN2400
Modbus®
15
sp 1
2: SP 3
3: SP 4
4: SP 5
5: SP 6
6: SP 7
7: SP 8
8: SP 9
9: SP 10
10: SP 11
11: SP 12
12: SP13
13: SP14
14: SP15
15: SP16
Local or remote setpoint select
0: Local
1: Remote
Setpoint 1
sp 2
Setpoint 2
25
sp 3
Setpoint 3
164
sp 4
Setpoint 4
165
SP 5
Setpoint 5
166
SP 6
Setpoint 6
167
SP 7
Setpoint 7
168
SP 8
Setpoint 8
169
SP 9
Setpoint 9
170
SP 10
Setpoint 10
171
SP 11
Setpoint 11
172
SP 12
Setpoint 12
173
SP 13
Setpoint 13
174
SP 14
Setpoint 14
175
SP 15
Setpoint 15
176
SP 16
Setpoint 16
177
rm.SP
Remote setpoint
485
rmt.t
Remote setpoint trim
486
L-r
rAT
Notes
SP1 & SP2
available in
standard controller
CN2200
Modbus®
15
Notes
SP1 & SP2
available in
standard
controller
SP1 to SP16
available to order in
the 16 setpoint
option
276
276
24
24
25
26
Ratio setpoint
61
Loc.t
Local setpoint trim
27
27
SP L
Setpoint 1 low limit
112
112
SP1.L
SP H
Setpoint 1 high limit
111
111
SP1.H
SP2.L
Setpoint 2 low limit
114
114
SP2.H
Setpoint 2 high limit
113
113
Loc.L
Local setpoint trim low limit
67
67
Loc.H
Local setpoint trim high limit
66
66
SPrr
Setpoint rate limit
0: Off
Holdback type for setpoint rate limit
0: Off
1: Low
2: High
3: Band
Holdback value for setpoint rate limit
Setpoint List
35
35
Hb.tY
Hb
SP
4-6
70
65
CN2400
CN2200
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® Addresses
Modbus®
Notes
Dwell segment
0: Off
Go to state at end of program
0: Dwell
1: Reset
2: Hold
3: Standby
Program state write
1: Reset
2: Run
Program state read
1: Off
2: Run
4: Hold
16 End
32: Dwell
64 Ramp
iP
Input List
Modbus®
62
517
End.t
57
ProG
23
stat
CN2400
FiLt
Input 1 filter time constant 0:
Off
Modbus®
101
FiLt.2
Input 2 filter time constant 0:
Off
103
CN2200
Notes
Modbus®
101
F.1
Derived input function factor 1
292
F.2
Derived input function factor 2
293
Hi.1P
Switchover transition region high
286
Input
Lo.1P
Switchover transition region low
287
switching
EmiS
Emmisivity
38
Custom
Emmisivity input 2
104
pyrometers
Select input 1 or input 2
288
User calibration enable
0: Factory
1: User
Selected calibration point
0: None
1: Input 1 low
2: Input 1 high
3: Input 2 low
4: Input 2 high
Transducer Low Cal enable
0: No
1: Yes
Adjust low calibration point
110
110
102
108
Transducer High Cal enable
0: No
1: Yes
Adjust high calibration point
108
AdJ
User calibration adjust input 1
146
AdJ
User calibration adjust input 2
148
OFS.1
Input 1 calibration offset
141
OFS.2
Input 2 calibration offset
142
mV.1
Input 1 measured value
202
mV.2
Input 2 measured value
208
CJC.1
Input 1 cold junction temp. reading
215
CJC.2
Input 2 cold junction temp. reading
216
Li.1
Input 1 linearized value
289
Li.2
Input 2 linearized value
290
Currently selected setpoint
291
EmiS.2
PV.iP
CAL
CAL.S
CAL.L
Adj.L
CAL.H
AdJ.H
PV.SL
Notes
Notes
0:
1:
2:
3:
4:
None
Adj low
Adj hi
N/A
N/A
109
145
144
Series CN2200 and CN2400 Communications Handbook
63
127
OFSt
202
mV
215
CJC
4-7
Modbus® Addresses
oP
Communications Handbook
Output List
CN2400
OP.Lo
Low power limit
OP.Hi
High power limit
30
rOP.L
Remote low power limit
33
rOP.H
Remote high power limit
32
Oprr
Output rate limit
0: Off
Forced output level
37
84
CYC.H
Heat cycle time
10
hYs.H
Heat hysteresis (on/off output)
86
ont.H
45
45
CYC.C
Heat output minimum on time
0: Auto
Cool cycle time
20
20
hYs.C
Cool hysteresis (on/off output)
88
ont.C
89
HC.db
Cool output minimum on time
0: Auto
Heat/cool deadband (on/off output)
Sb.OP
Sensor break output power
34
FOP
cmS
Addr
4-8
Notes
30
10
89
16
Comms. List
Communications address
Notes
CN2200
Modbus®
31
Modbus®
31
34
CN2400
Modbus®
131
Notes
CN2200
Modbus®
131
Notes
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
inFo
diSP
Modbus® Addresses
Information List
CN2400
Modbus®
106
LoG.L
Configuration of lower readout
display
0: Standard
1: Load current
2: Output power
3: Status
4: Program time
5: None
6: Valve position
7: Process value 2
8: Ratio setpoint
9: Selected program number
10: Remote setpoint
PV minimum
LoG.H
PV maximum
133
LoG.A
PV mean value
135
LoG.t
Time PV above threshold level
139
LoG.v
PV threshold for timer log
138
rES.L
140
mCt
w.OP
Working output
4
SSr
79
FF.OP
PDLINK SSR status
0: Good
1: Load fail
2: Open
3: Heater fail
4: SSR fail
5: Sn fail
Feedforward component of output
209
P OP
Proportional component of output
214
I OP
Integral component of output
55
d OP
Derivative component of output
116
VP velocity signal
219
VP motor calibration state
0: Start
1: Waiting
2: Open valve
3: BLUp/InDn
4: Ttup
5: Overshoot
6: InUp/BLDn
7: TT down
8: Open
9: Low lim
10: Stopping
11: Raise
12: Inert up
13: Lower
14: Low lim
15: Stopping
16: Lower
17: InDn/BL
99: Abort
210
vP S
Modbus®
Notes
134
Logging reset
0: Not reset
1: Reset
Processor utilization factor
VEL
CN2200
Notes
201
Series CN2200 and CN2400 Communications Handbook
4-9
Modbus® Addresses
Communications Handbook
MISCELLANEOUS STATUS AND COMMS-ONLY PARAMETERS
CN2400
Remote input comms access
parameter
Process error
4-10
Modbus®
26
Notes
39
Setpoint rate limit holdback status
0: inactive
1: Active
System error logged flag
0: No error
1: Error
Ramp rate disable
41
Slave controller target setpoint
92
Slave controller ramp rate
93
Slave controller synch signal
94
Remote SRL hold
95
CN2200
Modbus®
Notes
39
73
78
BCD input value
96
Controller version number
Format: >XXYY (hex) where XX is
major version number, and YY is minor
version number.
Eg. >0304 corresponds to V3.04
CNOMO Manufacturers identifier
107
107
121
121
Controller identifier
in format >ABCD (hex),
A = 2 (series CN2000)
B = Range number
2: CN2200
4: CN2400
C = Size
3: 1/32 din
6: 1/16 din
8: 1/8 din
4: ¼ din
D = Type
0: PID/on-off
2: VP
Bisynch comms status
0: No error
1: Invalid mnemonic
2: Parameter is read only
7: Incorrect message
8: Limit error
DIN rail remote par
122
122
VP low limit switch - open
120
VP high limit switch- open
119
VP motor calibrate enable
0: Off
1: On
Instrument mode
NOTE: WRITING OTHER VALUES
TO THIS PARAMETER MAY CAUSE
DAMAGE TO CALIBRATION OR
CONTROLLER CONFIGURATION!
0: Normal
1: Standby
2: Configuration
46
-
151
199
The controller
address changes
to ‘00’ when
Instrument mode
is changed to
configuration
199
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® Addresses
MISCELLANEOUS STATUS AND COMMS-ONLY PARAMETERS (CONTINUED)
CN2400
PV millivolts from comms
Modbus®
203
Notes
CN2200
Modbus®
203
Input test point enable
205
205
Sensor break sourced from Test
206
206
Filter initialization flag
207
207
Maximum number of segments (8 or
16): Read only
Edit program
211
Freeze control flag
0: Controlling
1: Hold
Sensor break status flag
0: Good
1: Sensor break
Power failed flag
0: Good
1: Power fail detected
Loop break status flag
0: Good
1: Loop break
Integral hold status flag
0: Good
1: Integral hold
Acknowledge all alarms
0: Good
1: Acknowledge all alarms
Setpoint rate limit active status
0: No setpoint rate limit
1: setpoint rate limit active
Setpoint rate limit complete status
0: Setpoint rate limit incomplete
1: Setpoint rate limit complete
Holdback disable
0: Holdback enabled
1: Holdback disabled
Disable keys
0: Keys enabled
1: Keys disabled
Remote input status
0: Good
1: Fault
Sync/Continue flag
0: Continue
1: Awaiting sync
DC input remote fault
0: good
1: Fault
Maximum input value in engineering
units
Minimum input value in engineering
units
Setpoint span
257
Notes
-
258
258
259
263
264
274
274
275
277
278
279
279
280
281
283
548
549
552
Series CN2200 and CN2400 Communications Handbook
4-11
Modbus® Addresses
Communications Handbook
STATUS WORDS
Status words group together commonly accessed parameters in convenient categories so that they may be read (or occasionally
written to) as a single transaction. Their main use is to allow the most commonly required process conditions to be read quickly.
Examples are:
Alarm states
Auto/Manual selection
Remote/Local selection
Disable front panel keys etc.
Individual parameters exist for all status indicators that may be changed over the communications link, and these should be used for
‘write operations’. The exception is the digital output telemetry status word, which may be written to set digital outputs, provided
their function is configured to ‘No Func’.
The CN2200 series contains two Status Words
1. Summary Output Status Word
2. Control Status Word
These are both shown in the table below.
Note, the detailed differences in the bit definitions between CN2200 & CN2400 in the Summary Output Status Word.
Parameter
Fast Status byte.
Modbus®
CN2400
74
Read Only (Also available via
Modbus® Function 7)
BIT
DESCRIPTION
Bit 0
Alarm 1 State ( 0 = Safe 1 = Alarm )
Bit 1
Alarm 2 State ( 0 = Safe 1 = Alarm )
Bit 2
Alarm 3 State ( 0 = Safe 1 = Alarm )
Bit 3
Alarm 4 State ( 0 = Safe 1 = Alarm )
Bit 4
Manual Mode ( 0 = Auto 1 = Manual )
Bit 5
Sensor Break ( 0 = Good PV 1 = Sensor Broken )
Bit 6
Loop Break ( 0 = Good closed loop 1 = Open Loop )
Bit 7
Heater Fail
( 0 = No Fault 1 = Load fault detected )
Parameter
Modbus®
CN2400
75
Summary Output Status Word
BIT
DESCRIPTION
0
Alarm 1 State ( 0 = Safe, 1 = Alarm )
1
Alarm 2 State ( 0 = Safe, 1 = Alarm )
2
Alarm 3 State ( 0 = Safe, 1 = Alarm )
3
Alarm 4 State ( 0 = Safe, 1 = Alarm )
4
Manual Mode ( 0 = Auto, 1 = Manual )
5
Sensor Break ( 0 = Good PV, 1 = Sensor Broken )
6
Loop Break ( 0 = Good closed loop, 1 = Open Loop )
7
Heater Fail
( 0 = No Fault, 1 = Load fault detected )
8
Tune Active ( 0 = Auto Tune disabled, 1 = Auto Tune
active)
9
Ramp/Program Complete ( 0 = Running/Reset, 1 =
Complete )
10
PV out of range ( 0 = PV within table range, 1 = PV out
of table range )
11
DC control module fault (0= Good,. 1= BAD)
12
Programmer Segment Synchronize (0 = Waiting, 1 =
Running)
13
Remote input sensor break (0 = Good, 1 = Bad)
14
IP1 Fault (PV Input)
15
Reserved
4-12
Modbus®
CN2200
74
Display
-
Alarm 1 State ( 0 = Safe 1 = Alarm )
Alarm 2 State ( 0 = Safe 1 = Alarm )
Alarm 3 State ( 0 = Safe 1 = Alarm )
Alarm 4 State ( 0 = Safe 1 = Alarm )
Manual Mode ( 0 = Auto 1 = Manual )
Sensor Break ( 0 = Good PV 1 = Sensor Broken )
Loop Break (0 = Good closed loop 1 = Open Loop )
Heater Fail
( 0 = No Fault 1 = Load fault detected )
Modbus®
CN2200
75
Display
-
Alarm 1 State ( 0 = Safe, 1 = Alarm )
Alarm 2 State ( 0 = Safe, 1 = Alarm )
Alarm 3 State ( 0 = Safe, 1 = Alarm )
Alarm 4 State ( 0 = Safe, 1 = Alarm )
Manual Mode ( 0 = Auto, 1 = Manual )
Sensor Break ( 0 = Good PV, 1 = Sensor Broken )
Loop Break ( 0 = Good Closed Loop, 1 = Open Loop )
Heater Fail
( 0 = No Fault, 1 = Load Fault Detected)
Load Fail
( 0 = No Fault, 1 = Load Fault Detected)
Ramp/Program Complete ( 0 = Running/Reset, 1 =
Complete )
PV out of range ( 0 = PV within table range, 1 = PV out
of table range )
SSR Fail
( 0 = No fault, 1 = Load fault detected )
New Alarm
Remote input sensor break (0 = Good, 1 = Bad)
Reserved
Reserved
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Parameter
Modbus® Addresses
Modbus®
CN2400
76
Control Status Word
BIT
DESCRIPTION
0
Control algorithm Freeze
1
PV input sensor broken
2
PV out of sensor range
3
Self Tune failed
4
PID servo signal
5
PID debump signal
6
Fault detected in closed loop behavior (loop break)
7
Freezes the integral accumulator
8
Indicates that a tune has completed successfully
9
Direct/reverse acting control
10
Algorithm Initialization flag
11
PID demand has been limited.
12
Autotune enabled
13
Adaptive tune enabled
14
Automatic Droop compensation enabled
15
Manual / Auto mode switch
Parameter
Instrument Status Word
BIT
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
Modbus®
CN2400
77
Modbus®
CN2200
76
Display
-
Control algorithm Freeze
PV input sensor broken
PV out of sensor range
Self Tune failed
PID servo signal
PID debump signal
Fault detected in closed loop behavior (loop break)
Freezes the integral accumulator
Indicates that a tune has completed successfully
Direct/reverse acting control
Algorithm Initialization flag
PID demand has been limited.
Adaptive tune enabled
Automatic Droop compensation enabled
Manual / Auto mode switch
Modbus®
CN2200
Display
-
DESCRIPTION
Config/Oper mode switch
Disables limit checking
SRL ramp running (Read Only)
Remote setpoint active
Alarm acknowledge switch.
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Series CN2200 and CN2400 Communications Handbook
4-13
Modbus® Addresses
Parameter
Digital Input Status Word
Communications Handbook
Modbus®
CN2400
87
Modbus®
CN2200
Display
-
Note that the order of LA and LB is
reversed relative to what might be
expected.
BIT
DESCRIPTION
0
H Interface module (0 = Off, 1 = On)
1
J Interface module (0 = Off, 1 = On)
2
1A module (0 = Off, 1 = On)
3
LB logic input (0 = Off, 1 = On)
4
LA logic input (0 = Off, 1 = On)
5
1B module telemetry (0 = Off, 1 = On)
6
1C module (0 = Off, 1 = On)
7
2A module (0 = Off, 1 = On)
8
2B module (0 = Off, 1 = On)
9
2C module (0 = Off, 1 = On)
10
3A module (0 = Off, 1 = On)
11
3B module (0 = Off, 1 = On)
12
3C module (0 = Off, 1 = On)
13
Reserved
14
Reserved
15
Reserved
Parameter
Digital Output Telemetry
Parameter
Modbus®
CN2400
551
Modbus®
CN2200
Display
-
Note that the order of LA and LB is
reversed relative to what might be
expected.
BIT
DESCRIPTION
0
H Interface module telemetry (0 = Off, 1 = On)
1
J Interface module telemetry (0 = Off, 1 = On)
2
1A module telemetry (0 = Off, 1 = On)
3
LB logic telemetry (0 = Off, 1 = On)
4
LA logic telemetry (0 = Off, 1 = On)
5
1B module telemetry (0 = Off, 1 = On)
6
1C module telemetry (0 = Off, 1 = On)
7
2A module telemetry (0 = Off, 1 = On)
8
2B module telemetry (0 = Off, 1 = On)
9
2C module telemetry (0 = Off, 1 = On)
10
3A module telemetry (0 = Off, 1 = On)
11
3B module telemetry (0 = Off, 1 = On)
12
3C module telemetry (0 = Off, 1 = On)
13
AA relay telemetry (0 = Off, 1 = On)
14
Reserved
15
Reserved
4-14
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Parameter
Program DC Pulse Outputs
BIT
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
Modbus® Addresses
Modbus®
CN2400
162
Modbus®
CN2200
Display
-
DESCRIPTION
Program Output 1 ( 0 = OFF 1 = ON )
Program Output 2 ( 0 = OFF 1 = ON )
Program Output 3 ( 0 = OFF 1 = ON )
Program Output 4 ( 0 = OFF 1 = ON )
Program Output 5 ( 0 = OFF 1 = ON )
Program Output 6 ( 0 = OFF 1 = ON )
Program Output 7 ( 0 = OFF 1 = ON )
Program Output 8 ( 0 = OFF 1 = ON )
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
Reserved
MODBUS® BIT ADDRESSABLE PARAMETERS
A few bit addressable parameters are provided to conform to the CNOMO Modbus® standard, but in general status information
should be obtained via the status words or single status parameters in the Modbus® word address space.
Parameter
Auto/Manual Mode
0:
1:
Auto
Manual
Alarm 1 Status
0:
1:
5
No Alarm
Alarm
Sensor Break Status
0:
1:
Modbus® Bit (Coil) Address
2
10
OK
Sensor Break
Series CN2200 and CN2400 Communications Handbook
4-15
Modbus® Addresses
Communications Handbook
CONFIGURATION MODE PARAMETERS
To write parameters in this group, it is first necessary to set the instrument mode parameter (Modbus® 199) to the value 2 to set the controller into configuration mode. Note this will disable all normal control action and the controller outputs will be switched to a safe state.
It is not necessary to set any ‘password’ parameters to enter configuration mode.
To exit from configuration mode, simply write 0 to instrument mode. This will reset the controller, a process that takes around 5
seconds. During this period it will not be possible to communicate with the controller.
NOTE: For CN2200 and CN2400 series, the Configuration Password is Modbus® ‘Pc’.
WARNING:
Be very careful not to write values other than 0 or2 to instrument mode, since this parameter is also used clear non-volatile
memory and to perform various factory calibration procedures. Writing an incorrect value can, therefore, damage your
controller.
InSt
Instrument Configuration
CN2400
Modbus®
unit
dEc.P
CtrL
Act
CooL
ti.td
dtYP
m-a
4-16
Instrument unit
0: oC
1: oF
2: oK
3: None
Decimal places in the displayed
value
0: nnnn.
1: nnn.n
2: nn.nn
Control type
0: PID
1: On/Off
2: Manual
3: VP
(No feedback)
4: VP b
(Feedback)
Control action
0: Reverse
1: Direct
Type of cooling
0: Linear
1: Oil
2: Water
3: Fan
4: Proportional to error
5: On/Off
Integral and Derivative time units
0: Seconds
1: Minutes
2: Hours
Derivative action on:
0: PV
1: Error
Front panel Auto/Manual button
0: Enabled
1: Disabled
512
CN2200
Notes
See PV conf
Modbus®
516
See PV conf
525
‘Manual’ does
not appear in
Control Type list
512
7
7
524
524
Notes
‘Manual’ does
not appear in
Control Type list.
VP b not
available
4:
5:
N/A
N/A
529
550
530
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
InSt
r-h
Fwd.t
Pd.tr
Sbr.t
FOP
bcd
GSch
PV
unit
Instrument Configuration
Front panel Run/Hold button
0: Enabled
1: Disabled
Feed forward type
0: None
1: Power feedforward
2: Setpoint feedforward
3: PV feedforward
Manual/Auto transfer PD control
0: No
1: Yes
Sensor break output
0: Sensor break (go to set value)
1: Hold (output)
Forced manual output
0: No
1: Trac (returns to last value)
2: Step (steps to forced output
level)
BCD input function
0: None
1: Select program number
2: Select SP number
Gain schedule enable
0: No (disabled)
1: Yes (enabled)
CN2400
Modbus®
564
rng.L
rng.H
High range limit
CN2200
Notes
Modbus®
Notes
532
555
555
553
553
556
556
0:
1:
Hold
Track
2:
N/A
522
567
Process Value Configuration
Instrument units
0: oC
1: oF
2: oK
3: None
Decimal places in displayed value
0: nnnn
1: nnn.n
2: nn.nn
Low range limit
dec.P
Modbus® Addresses
CN2400
Modbus®
516
CN2200
Notes
Modbus®
Notes
See Inst
Conf list
525
See Inst Conf
list
11
See iP
12
List
Series CN2200 and CN2400 Communications Handbook
4-17
Modbus® Addresses
iP
inpt
Communications Handbook
Input Configuration
Input type
0: J Type
1: K Type
2: L Type
3: R Type
4: B Type
5: N Type
6: T Type
7: S Type
8: PL 2
9: Custom (factory) *
10: RTD *
11: Linear mV (+/- 100mV)
12: Linear V (0-10V)
13: Linear Ma
14: Square root V
15: Square root mA
16: Custom mV
17: Custom V
18: Custom mA
CN2400
Modbus®
12290
CN2200
Notes
Modbus®
12290
Notes
0: J Type
1: K Type
2: L Type
3: R Type
4: B Type
5: N Type
6 T Type
7: S Type
8: PL 2
9: RTD *
10: Cust. *
11: Lin mV
12: Lin V
13: N/A
14: N/A
15: N/A
16: N/A
17: N/A
18: N/A
* Note change in order for the two parameters
CJC
12291
12291
12301
578
inp.L
Cold junction compensation
0: Auto
1: 0oC
2: 45oC
3: 50oC
4: Off
Sensor break impedance
0: Off (disabled - linear inputs only)
1: Auto
2: Hi (> 5K)
3: Hi (>15K)
Input value low
12307
12307
inp.h
Input value high
12306
12306
VAL.L
Displayed reading low
12303
12303
VAL.H
Displayed reading high
12302
rnG.L
Low range limit
See PV
11
rnG.H
High range limit
List
12
Imp
4:
N/A
12302
The following parameters are only present if a custom curve has been factory downloaded
Custom linearization input 1
601
in 1
VAL.1
Display value corresponding to input 1
621
in 2
Custom linearization input 2
602
VAL.2
Display value corresponding to input 2
622
in 3
Custom linearization input 3
603
VAL.3
Display value corresponding to input 3
623
in 4
Custom linearization input 4
604
VAL.4
Display value corresponding to input 4
624
in 5
Custom linearization input 5
605
VAL.5
Display value corresponding to input 5
625
in 6
Custom linearization input 6
606
VAL.6
Display value corresponding to input 6
626
in 7
Custom linearization input 7
607
VAL.7
Display value corresponding to input 7
627
in 8
Custom linearization input 8
608
VAL.8
Display value corresponding to input 8
628
4-18
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
SP
nSP
rm.tr
m.tr
Pr.tr
rmP.V
rmt
aL
Modbus® Addresses
Setpoint Configuration
Number of setpoints
Remote tracking
0: Off
1: Track
Manual tracking
0: Off
1: Track
Programmer tracking
0: Off
1: Track
Setpoint rate limit units
0: /Sec
1: /Min
2: /Hour
Remote setpoint configuration
0: None
1: Remote setpoint
2: Remote setpoint + local trim
4: Remote trim + local setpoint
CN2400
Modbus®
521
Modbus®
528
531
535
Alarm Configuration
CN2400
536
540
AL 2
Latching
0: No
1: Yes
2: Event
3: Manual reset
Blocking
0: No
1: Yes
Alarm 2 type
(types as alarm 1)
Ltch
Latching
(types as alarm 1)
bLoc
Blocking
AL 3
bLoc
Notes
CN2200
537
537
541
541
(types as alarm 1)
545
545
Alarm 3 type
(types as alarm 1)
538
538
Ltch
Latching
(types as alarm 1)
542
542
bLoc
Blocking
(types as alarm 1)
546
546
AL 4
Alarm 4 type (types as alarm 1) plus
64: Rate of change
539
539
Ltch
Latching
(types as alarm 1)
543
543
bLoc
Blocking
(types as alarm 1)
547
547
Series CN2200 and CN2400 Communications Handbook
36:
37:
38:
39:
40:
41:
N/A
N/A
N/A
N/A
N/A
N/A
2:
3:
N/A
N/A
540
544
Programmer Configuration
Notes
536
544
PrOG
Notes
527
Alarm 1 type
0: Off
1: Full scale low
2: Full scale high
16: Deviation band
17: Deviation high
18: Deviation low
34: Load current low
35: Load current high
36: Input 2 full scale low
37: Input 2 full scale high
38: Working output low
39: Working output high
40: Working setpoint low
41: Working setpoint high
Ltch
CN2200
Modbus®
526
Modbus®
AL 1
Notes
CN2400
Rate of
change not
available in
CN2200
series
CN2200
4-19
Modbus® Addresses
PtYP
HbAc
Pwr.F
Srvo
out
SYNC
4-20
Programmer type
0: None
1: Single program
4: Four programs
20: Twenty programs
Holdback
0: Applies to whole program
1: Applies to each segment
Power fail recovery
0: Ramp back
1: Reset
2: Continue
Servo
0: Servo to PV
1: Servo to SP
Programmable event outputs
Version 1 controllers:
0: None
3: Three
6: Six
8: Eight
Versions 2 and 3 controllers:
0: None
1: Eight
Synchronization of programs
0: No
1: Yes
Communications Handbook
Modbus®
517
Notes
Modbus®
Notes
559
518
520
558
557
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® Addresses
INPUT/OUTPUT MODULES
The following tables list all possible hardware module and fixed output identifiers. There are physical restrictions on the types of
modules that may be fitted in particular slots. For example it is not possible to place an RS-485 (EIA-485) comms module in slot 1A
of of a series CN2200 or series CN2400. Refer to the relevant instrument Installation and Operation Handbook for full details.
In general it is possible to perform writes to Module Identifier comms addresses if (and only if) there are no hardware modules fitted
other than the communications adapter. This allows controllers to be configured in the absence of hardware modules.
LA
id
Func
LB
id
Digital Input 1 Configuration
Identity
4:
Logic
Input functions
192: None
193: Manual mode select
194: Remote setpoint select
195: Setpoint 2 select
196: PID set 2 select
197: Integral hold
198: One-shot self tune enable
199: Adaptive tune enable
200: Acknowledge alarms
201: Select full access level
202: Keylock
203: Up button
204: Down button
205: Scroll button
206: Page button
207: Run
208: Hold
209: Run/Hold
210: Reset
211: Skip
212: Holdback enabled
213: Least significant BCD digit
214: 2nd digit
215: 3rd digit
216: 4th digit
217: 5th digit
218: Most significant digit
219: Setpoint rate limit enable
220: Prog. waits at end of segment
223: Run/Hold
224: Reset/Run
225: Standby
226: PV select
227: Advance to end of segment
240: Amps
CN2400
Modbus®
12352
12355
4:
Logic
Modbus®
12352
Notes
12355
192: None
193: Man
194: Rem
195: SP 2
197: Int Hld
200: Ack
202: K/lock
210: Reset
225: Stby
240: Amps
Digital Input 2 Configuration
Identity
CN2200
Notes
CN2400
Modbus®
12416
Func
Input functions, as LA above
12419
VAL.L
Low scalar
12431
VAL.H
High scalar
12430
Series CN2200 and CN2400 Communications Handbook
CN2200
Notes
Modbus®
12416
12419
Notes
240: Not
available
4-21
Modbus® Addresses
AA
Alarm Relay Configuration
(CN2400)
Output 3 Configuration ( CN2200)
id
Module identity
Func
diGF
SEnS
Module function
0: None
1: Digital
2: Heat (CN2208/04 only)
3: Cool (CN2208/04 only)
CN2400
Modbus®
12480
12483
For Func = diG the following
appear in CN2200 series
controllers:
0: Alarm 1
1: Alarm 2
2: Alarm 3
3: Alarm 4
4: Manual
5: Sensor break
6: Loop break
7: Heater fail
8: Load fail
9:
10: PV out of range
11: SSR fail
12:
Sense of output
0: Normal
1: Inverted
If Func = diG the following appear
Alarm 1
Alarm 2
Alarm 3
Alarm 4
Controller in manual
Sensor break
PV out of range
Loop break
Load failure
Tuning in progress
Voltage or mA output open circuit
PDLINK module connection O/C
New alarm
End of program (or SP rate limit)
Program synchronization active
Program event output active
Summary of AA configuration
Program summary OP AA
configuration
4-22
Communications Handbook
CN2200
Notes
Modbus®
12480
Notes
1: Relay
CN2208/CN2204
only
12483
12486
0: Alarm 1
1: Alarm 2
2: Alarm 3
3: Alarm 4
4: Manual
5: Sens break
6: Loop break
7: Htr fail
8: Load fail
9: Prog end
10: PV out rng
11: SSR fail
12: New alarm
12489
12489
12486
12503
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
HA
id
Func
bAud
dELY
PrtY
rES
JA
id
Func
Modbus® Addresses
Comms Module Configuration
Module identity
0: None
7: Digital comms
8: PDLINK output
Module function
For id = cmS
64: None
65: Modbus®
Baud rate
0: 9600
1: 19200
2: 4800
3: 2400
4: 1200
Delay. This introduces a short delay
between messages to allow certain
‘intelligent’ RS-485 (EIA-485) converters
to switch between RX and TX modes.
0: No - 0mS
1: Yes - 10mS
Parity (Modbus® only)
0: None
1: Even
2: Odd
Resolution (Modbus® only) Changes
are effective immediately
0: Full
1: Integer
CN2400
Modbus®
12544
Modbus®
12544
12547
12547
12548
12548
Notes
523
12549
12549
12550
12550
Comms Module 2 Configuration
Module identity
0: None
8: PDLINK output
9: PDLINK input
Module function
CN2200
Notes
CN2400
Modbus®
12608
rESn
CN2200
Notes
Modbus®
Notes
12611
Series CN2200 and CN2400 Communications Handbook
4-23
Modbus® Addresses
1A
id
Func
diGF
Output 1A Configuration
Module identity
0: None
1: Relay output
2: DC output non-isolated
3: DC pulse/PDLINK output
4: Logic input
5: AC SSR output
10: Error/Bad module
11: DC retransmission
12: DC output isolated
Module function
For id = rELY LoG or SSr
0: None
1: Digital output
2: Heating output
3: Cooling output
4: Open motorized valve
10: PDLINK mode 1 heating
11: PDLINK mode 2 heating
For id = dc.re or dc.OP
16: None
17: Heating output
18: Cooling output
19: Retransmission of PV
20: Retransmission of SP
21: Retransmission of error
22: Retransmission of OP power
For id = LoG.i
Use the enumerators in LA Config. list
Communications Handbook
CN2400
Modbus®
12672
CN2200
Notes
Modbus®
12672
0:
1:
2:
3:
None
Relay
DC out
DC pulse
5: AC SSR
10: Bad
12675
12675
0: None
1: Dig o/p
2: Heat
3: Cool
DC pulse only
4: SSR1
5: SSR2
DC output
16: None
17: Heat
18: Cool
For Func = diG the following appear
in CN2200 series controllers:
0: Alarm 1
1: Alarm 2
2: Alarm 3
3: Alarm 4
4: Manual
5: Sensor break
6: Loop break
7: Heater fail
8: Load fail
10: PV out of range
11: SSR fail
13: Remote fail
12678
As CN2400
plus
9: Prog end
12: New alarm
VAL.L
% PID or Retran value giving min. o/p
12687
VAL.H
% PID or Retran value giving max. o/p
12686
unit
12684
Out.L
Units
1: Volts
2: mA
Minimum electrical output
12689
12689
Out.H
Maximum electrical output
12688
12688
SEns
Sense of output
0: Normal
1: Inverted
Summary output 1A configuration
12681
12681
DC output 1A telemetry parameter
12694
Program summary output 1A config
12695
4-24
Notes
12678
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
1B
Modbus® Addresses
Output 1B Configuration
CN2400
id
Module 1B identity
Modbus®
12673
Func
Module 1B function
12676
SEnS
Sense of output
12682
1C
(nor/inv as1A)
Summary of 1B configuration
12679
Summary program O/P 1B config.
12696
Output 1C Configuration
id
Module 1C identity
Func
Module 1C function
12677
VAL.L
Module 1C value giving min output
12699
VAL.H
Module 1C value giving max output
12698
Out.L
Module 1C Minimum electrical
output
Module 1C Maximum electrical
output
Sense of output (nor/inv as 1A)
12701
Summary of 1C configuration
12680
Summary program O/P 1C config.
12697
SEnS
CN2200
Modbus®
Notes
Notes
CN2200
Modbus®
Notes
CN2400
Modbus®
12674
Out.H
Notes
12700
12683
Series CN2200 and CN2400 Communications Handbook
4-25
Modbus® Addresses
2A
id
Func
diGF
Communications Handbook
Output 2A Configuration
Module identity
0: None
1: Relay output
2: DC output non-isolated
3: DC pulse/PDLINK output
4: Logic input
5: AC SSR output
10: Error/Bad module
11: DC retransmission
12: DC output isolated
13: Transmitter power supply
14: Potentiometer input (V position)
Module function
For id = rELY LoG or SSr
0: None
1: Digital output
2: Heating output
3: Cooling output
5: Close motorized valve
For id = dc.re or dc.OP
16: None
17: Heating output
18: Cooling output
19: Retransmission of PV
20: Retransmission of SP
21: Retransmission of error
22: Retransmission of OP power
For id = Pot
160: None
161: Remote setpoint
162: Feedforward input
163: Remote OP power high
164: Remote OP power low
165: Valve position
CN2400
Modbus®
12736
Modbus®
12736
Notes
Only the
following are
relevant:
0: None
1: Relay
3: DC pulse
5: AC SSR
10: Bad
12739
12739
Only the
following are
relevant:
0: None
1: Dig o/p
2: Heat
3: Cool
193: Man enab
194: Rem SP
195: 2nd SP
197: Int hold
200: Ack alms
202: Key lock
210: Reset prg
225: Standby
VAL.L
For Func = diG see 1A list for
enumerators
% PID or Retran value giving min. o/p
12751
VAL.L
Potentiometer input low scalar
12763
VAL.H
% PID or Retran value giving max. o/p
12750
VAL.H
Potentiometer input high scalar
12762
unit
12748
Out.L
Units
1: Volts
2: mA
Minimum electrical output
Out.H
Maximum electrical output
12752
SEns
Sense of output
0: Normal
1: Inverted
Summary output 2A configuration
12745
DC output 2A telemetry parameter
12758
Program summary output 2A config
12759
4-26
CN2200
Notes
12742
12753
12745
12742
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
2B
Modbus® Addresses
Output 2B Configuration
CN2400
id
Module 2B identity
Modbus®
12737
Func
Module 2B function
12740
SEnS
Sense of output
12746
2C
(nor/inv as 2A)
Summary of 2B configuration
12743
Summary program O/P 2B config.
12760
Output 2C Configuration
Modbus®
Notes
Modbus®
CN2400
id
Module 2C identity
Modbus®
12738
Func
Module 2C function
12741
SEnS
Sense of output
12747
(nor/inv as 2A)
CN2200
Notes
Summary of 2C configuration
12744
Summary program O/P 2C config.
12761
Series CN2200 and CN2400 Communications Handbook
Notes
CN2200
Notes
4-27
Modbus® Addresses
3A
id
Func
diGF
Communications Handbook
Output 3A Configuration
Module identity
0: None
1: Relay output
2: DC output non-isolated
3: DC pulse/PDLINK output
4: Logic input
5: AC SSR output
6: DC input
10: Error/Bad module
11: DC retransmission
12: DC output isolated
13: Transmitter power supply
14: Potentiometer input (V position)
Module function
For id = rELY LoG or SSr
0: None
1: Digital output
2: Heating output
3: Cooling output
For id = dc.re or dc.OP
16: None
17: Heating output
18: Cooling output
19: Retransmission of PV
20: Retransmission of SP
21: Retransmission of error
22: Retransmission of OP power
For id = Pot
160: None
161: Remote setpoint
162: Feedforward input
163: Remote OP power high
164: Remote OP power low
165: Valve position
For id = dC.iP
32: None
33: Remote setpoint
34: Feedforward input
35: Remote output power max.
36: Remote output power min.
37: PV = highest of ip1 or ip2
38: PV = lowest of ip1 or ip2
39: Derived function
40: Select ip1 or ip2
41: Transition of control - ip1 to ip2
CN2400
Modbus®
12800
12803
inp.H
Input value high
12818
VAL.L
Input module 3A low value
12829
VAL.H
Input module 3A high value
12828
VAL.L
Module 3A low value
12815
VAL.L
3A
Potentiometer input 3A low scalar
Output 3A Configuration (cont…)
12827
imp
12803
None
Dig o/p
Heat
Cool
12806
12830
12831
12813
12819
CN2400
Modbus®
4-28
Notes
0:
1:
2:
3:
inp.L
CJC
Modbus®
12800
0: None
1: Relay
For Func = diG see 1A list for
enumerators
input type (input 2)
Refer to input configuration for all
types + HiIn
Cold junction compensation (input 2)
Refer to input configuration for types
Sensor break impedance (input 2)
Refer to input configuration for types
Input value low
inPt
CN2200
Notes
CN2200
Notes
Modbus®
Notes
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® Addresses
VAL.H
Module 3A high value
12814
VAL.H
Potentiometer input 3A high scalar
12826
unit
12812
Out.L
Units 3A
1: Volts
2: mA
Minimum electrical output
Out.H
Maximum electrical output
12816
SEns
Sense of output
0: Normal
1: Inverted
Summary output 3A configuration
12809
DC output 3A telemetry parameter
12822
Program summary output 3A config
12823
3B
12817
12806
Output 3B Configuration
CN2400
Modbus®
12801
Modbus®
Notes
Modbus®
Modbus®
12864
Notes
Not available in
2416
Modbus®
12864
Notes
2204 only
0: None
1: Relay
12867
Not available in
2416
12867
12870
2204 only
0: None
1: Dig o/p
2: Heat
3: Cool
2204 only
12873
2204 only
Module 3B identity
Func
Module 3B function
12804
SEnS
Sense of output
12810
(nor/inv as 3A)
Summary of 3B configuration
12807
Summary program O/P 3B config.
12824
Output 3C Configuration
CN2400
Modbus®
12802
id
Module 3C identity
Func
Module 3C function
12805
SEnS
Sense of output
12811
4A
id
(nor/inv as 3A)
Summary of 3C configuration
12808
Summary program O/P 3C config.
12825
Output 4A Configuration
Module identity
0: None
1: Relay output
CN2200
Notes
id
3C
c9
CN2200
CN2400
Notes
CN2200
Func
Module function
0: None
1: Digital output
2: Heating output
3: Cooling output
diGF
VAL.L
For Func = diG see 1A list for
enumerators
Input module 4A low value
12879
Not 2416
VAL.H
Input module 4A high value
12878
Not 2416
Out.L
Minimum electrical output
12881
Not 2416
Out.H
Maximum electrical output
12880
Not 2416
SEns
Sense of output
(nor/inv as 3A)
12873
Not 2416
Summary output 4A configuration
12870
Not 2416
Program summary output 4A config
12887
Not 2416
Series CN2200 and CN2400 Communications Handbook
Notes
4-29
Modbus® Addresses
CAL
rcAL
Communications Handbook
Calibration Configuration
CN2400
Modbus®
533
Notes
CN2200
Modbus®
Notes
CAL.L
Calibration node select
0: None
1: PV 1
2: PV 2
3: DC output high - module 1
4: DC output low - module 1
5: DC output high - module 2
6: DC output low - module 2
7: DC output high - module 3
8: DC output low - module 3
PV Calibration state
0: Idle
1: Select 0mV cal point
2: Select 50mV cal point
3: Select 0V cal point
4: Select 10V cal point
5: Select 0oC CJC cal point
6: Select 400 ohms cal point
7: Select 0V high impedance cal pt
8: Select 1V high impedance cal pt
9: Restore factory calibration
10: Busy
Start calibration
No
Yes
Busy
Done
Fail
Module 1A output calibration high
trim
Module 2A output calibration high
trim
Module 3A output calibration high
trim
Module 1A output calibration low trim
CAL.L
Module 2A output calibration low trim
12757
CAL.L
Module 3A output calibration low trim
12821
UCAL
566
566
AdJ
Pt1.L
User calibration enable
0: No
1: Yes
Low calibration point for input 1
563
563
pnt.L
Pt1.H
High calibration point for input 1
562
562
pnt.H
OF1.L
Offset low for input 1
561
561
OFS.L
OF1.H
Offset high for input 1
560
560
OFS.H
pt2.L
Low calibration point for input 2
571
pt2.H
High calibration point for input 2
570
OF2.L
Offset low for input 2
569
OF2.H
Offset high for input 2
568
PV
GO
CAL.H
CAL.H
CAL.H
PASS
65535
12692
12756
12820
12693
Password Configuration
ACC.P
Full or edit level password
cnF.P
Configuration level password
4-30
534
CN2400
Modbus®
514
515
Notes
CN2200
Modbus®
514
Notes
515
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Modbus® Addresses
RAMP/DWELL PROGRAMMER DATA – MODBUS®
This Section Applies To CN2400 Series Controllers only
Program Data Organization
A CN2400 series controller can contain multiple “programs”, each consisting of up to 16 segments. The data for each program starts
at the base Modbus® address given by the following table:
Program
Program 0 (Currently Running Program - changes
permitted only in hold, and are not permanently stored)
Program 1
Program 2
Program 3
Program 4
Program 5
Program 6
Program 7
Program 8
Program 9
Program 10
Program 11
Program 12
Program 13
Program 14
Program 15
Program 16
Program 17
Program 18
Program 19
Program 20
Base Address
(Decimal)
8192
Base Address
(Hex)
2000
8328
8464
8600
8736
8872
9008
9144
9280
9416
9552
9688
9824
9960
10096
10232
10368
10504
10640
10776
10912
2088
2110
2198
2220
22A8
2330
23B8
2440
24C8
2550
25D8
2660
26E8
2770
27F8
2880
2908
2990
2A18
2AA0
The parameters used to describe a program are organized into 17 blocks, each of 8 words in length, starting at the base address for
the program. There is one block for general program data, such as the units to be used for ramp and dwell times, and 16 further
blocks for the segment data itself. To obtain the Modbus® address of the data block for a given program, add the block offset given
in the next table to the program
Contents
Program General Data
Segment 1
Segment 2
Segment 3
Segment 4
Segment 5
Segment 6
Segment 7
Segment 8
Segment 9
Segment 10
Segment 11
Segment 12
Segment 13
Segment 14
Segment 15
Segment 16
Series CN2200 and CN2400 Communications Handbook
Offset
(Decimal)
0
8
16
24
32
40
48
56
64
72
80
88
96
104
112
120
128
Offset (Hex)
0
8
10
18
20
28
30
38
40
48
50
58
60
68
70
78
80
4-31
Modbus® Addresses
Communications Handbook
Program General Data
The offsets of each parameter within the program general data block is given by the next table:
Address Offset
0
Parameter
HoldbackType
0:
1:
2:
3:
1
2
None
Low
High
Band
HoldbackValue
Ramp Units
0:
1:
2:
3
Secs
Mins
Hours
Dwell Units
0:
1:
2:
4
5
6
7
Secs
Mins
Hours
Program Cycles
Reserved
Reserved
Reserved
Program Segment Data
Program segment data is specified using 8 Modbus® addresses, with the contents varying depending on the type of the segment. The
format per segment is detailed in the following table, which gives the offset from the start of a segment data block for each item.
Address
Offset
0
1
Segment Types
STEP
DWELL
RAMP
RATE
Segment Type
Target
Setpoint
Segment Type
Segment Type
Target
Setpoint
Rate
2
3
4
5
6
7
Duration
Logic O/P’s
Logic O/P’s
Logic O/P’s
RAMP
TIME TO
TARGET
Segment Type
Target
Setpoint
Duration
Logic O/P’s
CALL
END
Segment Type
Segment Type
End Power
Program
Number
Call Cycles
End Type
Logic O/P’s
Example Address calculations
Program 1, Segment 4, Segment Type = 8328 + 32 + 0 = 8360 (20A8 Hex)
Program 2, Holdback Value
= 8464 + 0 + 1 = 8465 (2111 Hex)
Program 4 Segment 16, End Type
= 8872 + 128 + 3 = 9003 (232B Hex)
4-32
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
CHAPTER 5
Advanced Topics
ADVANCED TOPICS
ACCESS TO FULL RESOLUTION FLOATING POINT AND TIMING DATA (MODBUS® ONLY)
One of the main limitations of Modbus® is that only 16 bit integer representations of data can normally be transferred. In most
cases, this does not cause a problem, since appropriate scaling can be applied to the values without losing precision. Indeed all
values displayable on the 4 digit Series CN2200 and CN2400 front panel may be transferred in this way. However, this has the
significant drawback that the scaling factor to be applied needs to be known at both ends of the communications link.
One further problem is that certain ‘time’ parameters, notably those used for the programmer function are always returned over the
communications link in seconds. It is possible for long durations to overflow the 16 bit Modbus® limit.
To overcome these problems, a sub protocol has been defined, using the upper portion of the Modbus®address space (8000h and
upwards), allowing full 32 bit resolution floating point and timer parameters. The upper area is known as the IEEE region.
This sub-protocol provides two consecutive Modbus® addresses for all parameters. The base address for any given parameter in the
IEEE region can easily be calculated by taking its normal Modbus® address, doubling it, and adding 8000h. For example, the
address in the IEEE region of the Target Setpoint (Modbus® address 2) is simply
2 x 2 + 8000h = 8004h = 32772 decimal
This calculation applies to any parameter that has a Modbus® address.
Access to the IEEE area is made via block reads (Functions 3 & 4) and writes (Function 16). Attempts to use the ‘Write a Word’
(Function 6) operation will be rejected with an error response. Furthermore, block reads and writes using the IEEE region should only be
performed at even addresses, although no damage to the instrument will result in attempting access at odd addresses. In general, the
‘number of words’ field, in the Modbus® frame, should be set to 2 times what it would have been for ‘normal’ Modbus®.
The rules governing how the data in the two consecutive Modbus® addresses are organised depending on the ‘data type’ of
the parameter.
DATA TYPES USED IN SERIES CN2200 AND CN2400 INSTRUMENTS
•
Enumerated parameters are parameters which have a textual representation for their value on the user interface, for example, ‘Auto’
or ‘Manual’, ‘On’ or ‘Off’, ‘SP1’, ‘SP2’, ...,‘SP16’, etc. A full list is included in the parameter tables in the previous chapter.
•
Status words are generally only available over communications, and are used to group binary status information.
•
Integer parameters are those that never include a decimal point, however the instrument is configured, and do not refer to a time
period or duration. These include such values as the instrument communications address and values used to set passwords, but
not Process Variable and Setpoint related parameters, even if the display resolution of the instrument is set to no decimal places.
•
Floating point parameters are those having a decimal point (or those which may be configured to have a decimal point), with the
exception of parameters relating to time periods and duration. This includes Process Variable, Setpoints, Alarm Setpoints, etc.
•
Time Type parameters measure durations, and include Integral and Derivative times, program durations, etc.
ENUMERATED, STATUS WORD, AND INTEGER PARAMETERS
These use only the first word of the 2 Modbus® addresses assigned to them in the IEEE area. The second word is padded with a
value of 8000 hex.
Although ‘Write a Word’ (Function 6) is not permitted, this type of parameter may be written as a single 16 bit word using a
Modbus® ‘Block Write’ (Function 16). It is not necessary to add a padding value in the second address. Similarly, such parameters
may be read using a Modbus® ‘Block Read’ (Function 3 & 4) as single words, in which case the padding word will be omitted.
It is, however, necessary to pad the unused word when writing this sort of data types as part of a block containing other parameter values.
Series CN2200 and CN2400 Communications Handbook
5-1
Advanced Topics
Communications Handbook
FLOATING POINT PARAMETERS
These use the IEEE format for floating point numbers, which is a 32 bit quantity. This is stored in consecutive Modbus®addresses.
When reading and writing to floats, it is necessary to read or write both words in a single block read or write. It is not possible, for
example, to combine the results of two single word reads.
This format is used by most high level programming languages such as ‘C’ and BASIC, and many SCADA and instrumentation
systems allow numbers stored in this format to be decoded automatically. The format is as follows:
BIT 31
30
23 22
0
Sign
27
20
2-1 2-2
2-23
{--- -------EXPONENT--------}{---------------------------FRACTION-----------------------------}
where value = (-1)Sign x 1.F x 2 E-127
Note that in practice, when using C, IEEE floats may usually be decoded by placing the values returned over comms into memory
and ‘casting’ the region as a float, although some compilers may require that the area be byte swapped high to low before casting.
Details of this operation are beyond the scope of this manual.
The format used to transfer the IEEE number is as follows
Lower Modbus®Address
MSB
LSB
Bits 31 - 24
Bits 16 - 23
Higher Modbus® Address
MSB
LSB
Bits 15 - 8
Bits 7 - 0
For example, to transfer the value 1.001, the following values are transmitted (hexadecimal).
Lower Modbus® Address
MSB
LSB
3F
80
Higher Modbus® Address
MSB
LSB
20
C5
TIME TYPE PARAMETERS
Time durations are represented as a 32 bit integer number of milliseconds in the IEEE area. When reading and writing to time types,
it is necessary to read or write both words in a single block read or write. It is not possible, for example, to combine the results of
two single word reads.
The data representation is as follows.
Lower Modbus® Address
MSB
LSB
Bits 31 - 24
Bits 16 - 23
Higher Modbus® Address
MSB
LSB
Bits 15 - 8
Bits 7 - 0
To create a 32 bit integer value from the two Modbus® values, simply multiply the value at the lower Modbus® address by 65536,
and add the value at the Higher address. Then divide by 1000 to obtain a value in seconds, 60000 for a value in minutes, etc.
For example, the value of 2 minutes (120000 mS) is represented as follows:
Lower Modbus® Address
MSB
LSB
00
01
5-2
Higher Modbus® Address
MSB
LSB
D4
C0
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
Advanced Topics
USER INTERFACE ACCESS PERMISSIONS (MODBUS)
In the Series CN2200 and CN2400 instruments, some of the operating parameters may be hidden, made read only, or promoted to
the ‘main’ scroll list. Additionally, certain parameter lists may be hidden. In Modbus®, this operation may be performed by writing
values to the address range 16384 to 32627.
To calculate the address used to set user interface permissions, take the normal Modbus® address of the parameter involved, and add
16384 to it. List headers and ‘special’ user interface parameters are listed at the end of the parameter addresses in chapter 5 of this
manual. You must be in configuration mode to write to the user interface access parameters, which use the following enumerations:
Parameters:
0
1
2
3
Hide Parameter
Promote Parameter to main scroll list
Parameter is read only
Display Parameter with default read/write status
0
3
Hide List
Display List
List Headers
USER INTERFACE ACCESS PERMISSIONS
In the Series CN2200 and CN2400 instruments, some of the operating parameters may be hidden, made read only, or promoted to
the ‘main’ scroll list. Additionally, certain parameter lists may be hidden. List headers and ‘special’ user interface parameters are
listed at the end of the parameter addresses in chapter 5 of this manual. You must be in configuration mode to write to the user
interface access parameters, which use HEX format, and the following enumerations:
Parameters:
0
1
2
3
Hide Parameter
Promote Parameter to main scroll list
Make parameter read only
Display Parameter with default read/write status
0
3
Hide List
Display List
List Headers
Series CN2200 and CN2400 Communications Handbook
5-3
Advanced Topics
Communications Handbook
PROGRAMMABLE LOGIC CONTROLLERS AND CN24XX SERIES INSTRUMENTS
Modbus®
There are many ways of connecting CN2200 and CN2400 Series Instruments to Programmable Logic Controllers using Modbus®,
for example the ProSoft 3100/3150 MCM module for Allen Bradley PLC/5 and SLC/5. It is usually best to avoid the use of Basic
modules which may result in very slow communications. Omega will often be able to advise on a solution for a particular make of
Programmable Logic Controller, but if requesting information from third party vendors, note that the CN2200 and CN2400 Series
support standard Modbus® RTU, allowing use of function 16 for block write operations, and functions 3 and 4 for reads.
Because Modbus® modules often allow a restricted number of block operations, it is sometimes useful to create large blocks
containing all the data to be written for a given instrument. Because the Series CN2200 and CN2400 contain a mixture of read/write
and read-only data, this can be difficult to achieve. Therefore, for Series CN2200, and CN2400 firmware versions 3.00 and greater,
a facility has been provided that allows block writes to continue even if values in the block are not currently writeable (the values
that are not writeable are ignored, and there is no error return).
To switch this facility on, write a value of 1 to the instrument Modbus® register 220. The setting of this register is held in nonvolatile memory and so you only need perform this operation once. To cancel the facility, write 0 to register 220.
5-4
Series CN2200 and CN2400 Communications Handbook
Communications Handbook
APPENDIX A.
Glossary of Terms
GLOSSARY OF TERMS
ASCII
American Standards Committee for Information Interchange. In normal usage this refers to the character
code defined by this committee for the exchange of information between devices.
Baud
The number of line signal variations per second. Used to indicate the rate at which data are transmitted on
a line.
Bus
A common electrical network allowing devices, (computers, instruments) to communicate with each other.
CRC
Cyclic Redundancy Check. The CRC is an error check code and is two bytes, (16bits) long calculated
from the preceding message. From a comparison of the calculated CRC and the received CRC the validity
of the message can be determined.
Duplex (full
duplex)
A communication channel capable of operating in both directions simultaneously.
EIA
Electrical Industries Association, the standards body that has defined electrical requirements of
communications systems such as RS232 (EIA-232), RS422 (EIA-422) and RS 485 (EIA-485).
eot
The End of Transmission segment is a period of inactivity 3.5 times the single character transmission time.
The EOT segment at the end of a message indicates to the listening device that the next transmission will
be a new message and therefore a device address character.
Half duplex
A communication channel capable of operating in both directions, but not simultaneously.
Message frame
A message is made up of a number of characters sequenced so that the receiving device can understand.
This structure is called a message frame.
MSB
Most significant byte
LSB
Least significant byte
Non synchronous
A data channel in which no timing information is transferred between communicating devices.
Parity
A mechanism used for the detection of transmission errors when single characters are being transmitted.
A single binary digit known as the parity bit has a value of 0 or 1 depending on the number of '1's in a
data message. This allows single bit error detection in the receiver.
RTU
Remote Terminal Unit. This refers to the code used for the exchange of information between devices.
RS422 (EIA-422)
This refers to the electrical standard used for signalling information on a serial communications link.
RX
Receiver on a communication bus.
Simplex
A communication channel capable of operating in one direction only.
Start bit
A voltage level used to signal the start of a character transmission frame
Stop bit
A voltage level used to signal the end of a character transmission frame
TX
Transmitter on a communication bus
Series CN2200 and CN2400 Communications Handbook
A-1
Communications Handbook
APPENDIX B.
ASCII Codes
ASCII CODES
ASCII Codes
ASCII - HEX
STX - Start of Text
ETX - End of Text
EOT - End of Transmission
ENQ - Enquiry
ACK - Positive Acknowledge
NAK - Negative Acknowledge
Space
Minus Sign
.
Decimal Point
0
1
2
3
4
5
6
7
8
9
> (Greater Than)
02
03
04
05
06
15
20
2D
2E
30
31
32
33
34
35
36
37
38
39
3E
HEX-ASCII TABLE - complete list
00
01
02
03
04
05
06
07
08
09
0A
0B
0C
0D
0E
0F
10
11
12
13
14
NUL
SOH
STX
ETX
EOT
ENQ
ACK
BEL
BS
HT
LF
VT
FF
CR
SO
SI
DLE
DC1(XON
DC2
DC3(XOFF)
DC4
15
16
17
18
19
1A
1B
1C
1D
1E
1F
20
21
22
23
24
25
26
NAK
SYN
ETB
CAN
EM
SUB
ESC
FS
GS
RS
US
space
!
“
£
$
%
&
2B
2C
2D
2E
2F
30
31
32
33
34
35
36
37
38
39
3A
3B
3C
+
,
.
/
0
1
2
3
4
5
6
7
8
9
:
;
<
40
41
42
43
44
45
46
47
48
49
4A
AB
4C
4D
4E
4F
50
51
@
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
56
57
58
59
5A
5B
5C
5D
5E
5F
60
61
62
63
64
65
66
67
V
W
X
Y
Z
[
\
]
^
`
a
b
c
d
e
f
g
6B
6C
6D
6E
6F
70
71
72
73
74
75
76
77
78
79
7A
7B
7C
k
l
m
n
o
p
q
r
s
t
u
v
w
x
y
z
{
|
27
28
‘
(
3D
3E
=
>
52
53
R
S
68
69
h
I
7D
7E
}
~
29
2A
)
*
3F
?
54
55
T
U
6A
j
7F
DEL
Series CN2200 and CN2400 Communications Handbook
B-1
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertising