Professional Documents
Culture Documents
51-52-25-104 9/01
Warranty/Remedy
Honeywell warrants goods of its manufacture as being free of defective materials and faulty workmanship. Contact your local sales office for warranty information. If warranted goods are returned to Honeywell during the period of coverage, Honeywell will repair or replace without charge those items it finds defective. The foregoing is Buyers sole remedy and is in lieu of all other warranties, expressed or implied, including those of merchantability and fitness for a particular purpose. Specifications may change without notice. The information we supply is believed to be accurate and reliable as of this printing. However, we assume no responsibility for its use. While we provide application assistance personally, through our literature and the Honeywell web site, it is up to the customer to determine the suitability of the product in the application.
ii
9/01
Contacts
World Wide Web The following lists Honeywells World Wide Web sites that will be of interest to our sensing and control customers.
Honeywell Organization Corporate Sensing and Control International WWW Address (URL) http://www.honeywell.com http://www.honeywell.com/sensing http://www.honeywell.com/Business/global.asp
Honeywell Asia Pacific Hong Kong Honeywell PACE, Brussels, Belgium Honeywell, Sunrise, Florida U.S.A.
9/01
iii
Contents
1.
1.1
INTRODUCTION ................................................................................................... 1
Modbus RTU Implementation........................................................................................................1
2.
2.1
WIRING ................................................................................................................. 3
Communications Wiring.................................................................................................................3
3.
3.1 3.2 3.3
4.
4.1 4.2 4.3 4.4
5. 6.
6.1 6.2
MODBUS RTU EXCEPTION CODES ................................................................. 17 REGISTER MAP FOR PROCESS AND OPERATION TYPE VARIABLES ....... 19
Register Map Overview................................................................................................................19 7866 Analyzer/Indicator Register Map ........................................................................................19
7.
7.1 7.2 7.3
8.
iv
9/01
Tables
Table 3-1 Modbus RTU Message Formats ________________________________________________ 5 Table 3-2 IEEE Floating Point Number Examples in FP B Format ____________________________ 11 Table 4-1 Modbus RTU Function Codes Definitions _______________________________________ 12 Table 5-1 Modbus RTU Data Layer Status Exception Codes _________________________________ 18 Table 6-1 7866 Register Map Addresses _________________________________________________ 19 Table 7-1 Register Address Structure - Integer Parameter Type _______________________________ 21 Table 7-2 Register Address Structure - Floating Point Parameter Type__________________________ 22 Table 7-3 Analog Parameter Register Addresses __________________________________________ 22 Table 7-4 Digital Parameter Register Addresses ___________________________________________ 23 Table 7-5 Range and Type ___________________________________________________________ 24 Table 7-6 Register Address Format for Function Code 20 ___________________________________ 26 Table 7-7 Register Address Format for Function Code 21 ___________________________________ 30
Figures
Figure 2-1 7866 Analyzer/Indicator Communications wiring __________________________________ 3 Figure 3-1 IEEE Floating Point Data format _______________________________________________ 7 Figure 3-2 IEEE Floating Point Formats _________________________________________________ 11
9/01
Introduction
1. Introduction
1.1 Modbus RTU Implementation
Overview This implementation is designed to provide a popular data exchange format connecting the 7866 Analyzer/Indicator Slave Port (COM A) to both Honeywell and foreign master devices. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices which subscribe to the Modbus RTU RS-485 specification. The Analyzer/Indicator DOES NOT emulate any MODICON type device. The Modbus RTU specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes are employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to these instruments. The definition in Table 6-1is the register mapping for the 7866 Analyzer/Indicator and the corresponding parameter value. Function Codes 20 and 21 Also included in this manual is information concerning function codes 20 and 21 in Section 7. They provide additional functionality not available using the function codes described in Section 4. The additional functionality includes: Read/Write dynamic data that is not part of the function code 04 register set Read/Write device data that are not part of the function code 03 register set
For Function Codes 14h(20) and 15h(21), the Byte Swap configuration does not apply. All numbers are represented in the FP B byte order. Refer to Subsection 3.3.
9/01
Introduction
9/01
Wiring
2. Wiring
2.1 Communications Wiring
When connecting the 7866 to an RS 485 communication link (see Figure 2-1), you must use termination resistors at each end of the link. The following cables with the listed resistor values can be used for connecting the 7866. RS 485 Cables: Belden #9271 (or equivalent) with 120 ohm termination resistors (2,000 ft. maximum) Belden #9182 (or equivalent) with 150 ohm termination resistors (4,000 ft. maximum) NOTE: When using the RS 485 communications, it is recommended that an RS 485 to RS 232 converter (such as Black Box model IC901A) be used to interface with the host PC. Also, be certain that the Half Duplex Turnaround Delay parameter for the converter set to 1 millisecond or less.
L1 L2/N 12 22 23 24 25 26 27 13 14 15 16 17
L1 L2/N 12 22 23 24 25 26 27
Use shielded twisted pair cables (Belden 9271 Twinax or equivalent)
To Other lines in the same conduit as AC power Communication Instruments (maximum 15) 120 Ohm Resistor
on Last Leg
24169
9/01
Wiring
9/01
Slave address recognition, Start / End of Frame detection, CRC-16 generation / checking, Transmit / receive message time-out, Buffer overflow detection, Framing error detection, Idle line detection.
Errors detected by the physical layer in messages received by the Analyzer/Indicator are ignored and the physical layer automatically restarts by initiating a new receive on the next idle line detection.
9/01
General Modbus RTU message format Query message format [Slave Address, Function Code, Function code dependent data, CRC 16] Response message format [Slave Address, Function Code*, Function code dependent data, CRC 16]
* If an error is detected in a valid message the response function code is modified by adding 80 (hex) and the function code dependent data is replaced by an exception response code as described in Section 5 - Modbus RTU Exception Codes.
Between messages, the RS-485 link is in a high impedance state. During this time receiving devices are more susceptible to noise generated false start of messages. Although noise-generated messages are rejected due to address, framing, and CRC checking, they can cause the loss of a good message when they are included in the message stream. In the slave the transmitting device enables its transmitter line diver and forces an idle line state onto the link for three character time slots prior to transmitting. This forces termination of any noise generated messages and improves message frame synchronization.
Errors detected by the data layer are rejected and the slave responds to the polling device with a Modbustype status exception error. A summary of the Modbus status exception codes is listed in Section 5 Modbus RTU Exception Codes.
9/01
mantissa x 2
(23 bit signed binary with 8 bit biased binary exponent) byte 4 byte 3 3 2 2 1 1 4 3 6 xxxxxxxx x.xxxxxxx byte 2 1 5 8 xxxxxxxx byte 1 7 0 xxxxxxx
mantissa (23 bits) implied binary point for mantissa exponent (8 bit unsigned value) sign of the mantissa 0 = positive, 1 = negative
Figure 3-1 IEEE Floating Point Data format Mantissa and Sign The mantissa is defined by a sign bit (31) and a 23-bit binary fraction. This binary fraction is combined with an implied value of 1 to create a mantissa value, which is greater than or equal to 1.0 and less than 2.0. The mantissa is positive if the sign bit is zero (reset), and negative if the sign bit is one (set). For example:
DECIMAL 100 HEXADECIMAL 42C80000 BINARY 01000010 11001000 00000000 00000000
The sign bit (31) is zero, indicating a positive mantissa. Removing the sign bits and exponent bits, the mantissa becomes:
HEXADECIMAL 480000 BINARY xxxxxxxx x1001000 00000000 00000000
9/01
Exponent The exponent is defined by an unsigned 8-bit binary value (bits 23 through 30). The value of the exponent is derived by performing a signed subtraction of 127 (decimal) from the 8-bit exponent value.
DECIMAL 100 HEXADECIMAL 42C80000 BINARY 01000010 11001000 00000000 00000000
or:
Mantissa and Exponent Combination Combining the mantissa and exponent from the two previous examples:
9/01
Reserved Operands Per the Standard certain exceptional forms of floating point operands are excluded from the numbering system. These are as follows:
FP BB FP L FP LB
Floating Point Big Endian with byte-swapped Floating Point Little Endian Format Floating Point Little Endian with byte-swapped
1, 0, 3, 2 3, 2, 1, 0 2, 3, 0, 1
See IEEE Formats starting on next page. NOTE: Byte Swapping only applies to Function Codes 3, 4, and 16. Function Codes 20 and 21 DO NOT support byte swapping. They always use FP B.
9/01
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
S E7 E6 E5 E4 E3 E2 E1
Bit 23
Bit 16
Bit 7
Bit 0
M7 M6 M5 M4 M3 M2 M1 M0
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
10
9/01
S E7 E6 E5 E4 E3 E2 E1
Bit 7
Bit 0
Bit 23
Bit 16
M7 M6 M5 M4 M3 M2 M1 M0
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
M7 M6 M5 M4 M3 M2 M1 M0
Bit 15
Bit 8
Bit 31
Bit 24
S E7 E6 E5 E4 E3 E2 E1
High
REGISTER N (High)
Low
High
REGISTER N+1 (Low)
Low
Table 3-2 IEEE Floating Point Number Examples in FP B Format Value (decimal) 100.0 55.32 2.0 1.0 -1.0 IEEE FP B MSB LSB 42C80000h 425D47AEh 40000000h 3F800000h BF800000h Register N high 42h 42h 40h 3Fh BFh low C8h 5Dh 00h 80h 80h Register N+1 high 00h 47h 00h 00h 00h low 00h AEh 00h 00h 00h
9/01
11
12
9/01
Example: Read DO numbers 1 to 3 from slave at address 02. 02 01 00 00 00 02 CRC CRC Response The DO status in the response message is packed as one DO per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the DO addressed in the query. The other DOs follow toward the high order end of this byte, and from low order to high order in subsequent bytes. If the returned DO quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The byte count field specifies the quantity of data bytes returned. Response message format for function code 01 Slave Address Function Code Byte Count Data Data ... CRC CRC
Example: DOs number 1 and 3 are ON, DO#2 is off. 02 01 01 05 CRC CRC In the response the status of DOs 1 - 3 is shown as the byte value 05 hex, or 0000 0101 binary. DO 3 is the MSB of this byte, and DO 1 is the LSB. Left to right, the status of DO 3 through 1 is: OFF-OFF-OFF-OFFON-OFF-ON. Unused bits were padded with a 0.
9/01
13
Example: Read PV/Input Value and Output Value in addresses 1AD2-1AD4 as floating point values from a 7866 at address 02. 02 04 1A D2 00 04 CRC CRC Response The register data in the response message are packed as two bytes per register. For each register, the first byte contains the high order bits and the second contains the low order bits. The floating point values require two consecutive registers. A request for a single floating point value must be for two registers. The byte order of the floating point number is determined by the setting of the byte swap configuration value. In this example, and the examples that follow, the byte swap order is FP B. Refer to subsection 3.3. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. If the master station requests only one register at an address of a floating point value, a zero will be returned. The Modbus RTU protocol has a single byte count for function codes 03 and 04, therefore the Modbus RTU protocol can only process up to 64 floating point and 127 integer values in a single request. Response message format for function codes 03/04 Slave Address Function Code Byte Count Data Data ... CRC CRC
Example: Analog inputs #1 and #2 as floating point values where PV/Input = 98.0 and Output Value = 100.0 02 04 08 48 C4 00 00 42 C8 00 00 CRC CRC
14
9/01
Example: Preset Indicator Bias for Range #1 (address 1882h) to 5.00 from a 7866 at address 02. 02 10 18 82 00 02 04 40 A0 00 00 CRC CRC Response The normal response returns the slave address, function code, starting address and the quantity of registers preset. The floating point values require two consecutive addresses. A request to preset a single floating point value must be for two addresses. The byte order of the floating point number is determined by the setting of the byte swap configuration value. In this example the byte swap order is FP B. Refer to subsection 3.3. The first 16 bits of the response contain the IEEE MSB of the float value. The second 16 bits of the response contain the IEEE LSB of the float value. The Byte order is configurable See Subsection 3.3. If the master station requests only one address at an address of a floating point value the slave will respond with an illegal data address exception (See Section 5) code. Response message format for function code 16 (10h) Slave Address Function Code Starting Address High Start Address Low Number Addresses High Number Addresses Low CRC CRC
Example: Response from presetting Indicator Bias value for Range #1 (address 1882h) to 5.00 from a 7866 at address 02. 02 10 18 82 00 02 CRC CRC
9/01
15
Example: Read Device ID from a slave at address 02. 02 11 CRC CRC Response The response is a record format describing the instrument. Response message format for function code 17 (11h) Slave Address Function Code Byte Count Slave ID Run Indicator Status Device Specific Data CRC CRC
Slave ID - 78 (7866 Analyzer/Indicator) (one byte) (byte 3) Run Indicator Status: (one byte) (byte 4) 00=OFF; FF=ON Device Specific Data: Device Description Model ID Device Class ID Device Mapping
Device Description: 41 4E 41 37 38 36 20 31 00 00 00 00 00 00 00 (bytes 5-20) 16 Character ASCII Message with the following format: A N A 7 8 6 6 SPACE +7 NULLs Model ID: (one byte) (byte 21) 0 = Analyzer 1 = Indicator Device Class ID: The Device Classification = 0 (one byte) (byte 22) Number of Records: 6 (byte 23)
16
9/01
The exception response message has two fields that differentiate it from a normal response: Function Code Field: In a normal response, the slave echoes the function code of the original query in the function code field of the response. All function codes have a most-significant bit (MSB) of 0 (their values are below 80 hex). In an exception response, the slave sets the MSB of the function code to 1. This makes the function code value in an exception response exactly 80 hex higher than the value would be for a normal response. With the function codes MSB set, the masters application program can recognize the exception response and can examine the data field for the exception code. Data Field: In a normal response, the slave may return data or statistics in the data field. In an exception response, the slave returns an exception code in the data field. This defines the slave condition that caused the exception. Query Example: Internal slave error reading 2 registers starting at address 1882h from slave at slave address 02. 02 03 18 82 00 02 CRC CRC Response Example: Return MSB in Function Code byte set with Slave Device Failure (04) in the data field. 83 04 CRC CRC
9/01
17
Table 5-1 Modbus RTU Data Layer Status Exception Codes Exception Code 01 02 Definition Illegal Function Illegal Data Address Description The message received is not an allowable action for the addressed device. The address referenced in the function-dependent data section of the message is not valid in the addressed device. The value referenced at the addressed device location is not within range. The addressed device has not been able to process a valid message due to a bad device state. The addressed device has received a valid message and is busy reprocessing. The addressed device has rejected a message due to a busy state. Retry later. The addressed device cannot process the current message. Issue a PROGRAM POLL to obtain devicedependent error data.
03 04 05 06 07
Illegal Data Value Failure in Associated Device Acknowledge (Busy repoll) BUSY, REJECT NAK, Negative Acknowledge
18
9/01
Alarms
1BF0 47158 Alarm Status #1 - #2 R Bit Packed Bit 0: Alarm #1 Status 0 = Alarm Off 1 = Alarm On Bit 1: Alarm #2 Status
9/01 7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual 19
Address (hex)
Register (decimal)
Parameter Name
Access
Notes 0 = Alarm Off 1 = Alarm On Bits 2, through 7 are unused and return a 0 value.
1C00
47169
Alarm 1 Setpoint Value* Low Alarm Type Triple Range - Range 3 only Alarm 2 Setpoint Value* High Alarm type for Single Range Low Alarm type for Triple Range - Range 3
R/W
1C02
47171
R/W
* For Single Range Analyzer, Alarm 1 and 2 Setpoint range limit is set internally to that of the input type
20
9/01
For Function Codes 14h(20) and 15h(21), the Byte Swap configuration does not apply. All numbers are represented in the FP B byte order. Refer to Subsection 3.3. All digital numbers are represented as Floating Point 0 for OFF and Floating Point 1 for ON. Configuration ID Tags The UDC2300 function codes 20 and 21 use the RS422/485 tag Ids (decimal) for accessing configuration and process-related data. These tags are fully explained in Table 7-3 and Table 7-4. The tag IDs represent the register addresses used in the Request Message. Register Address Structure The file number word contains the register number from the register address structure tables. Although the register address structure tables (Table 7-1 and Table 7-2) indicate up to 13 data registers are available for access, only register address 3 is currently supported. Table 7-1 Register Address Structure - Integer Parameter Type Register Numbers (Dec)
1 2 3 4 5 6 7 8 9 to 13 Type = 1 Attribute Value (16 bit integer) Not Used Low Range (16 bit integer) Not Used High Range (16 bit Integer) Not Used Description Text (ASCII string)
Name
Access
Notes
NOT SUPPORTED NOT SUPPORTED Read / Write NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED
9/01
21
Table 7-2 Register Address Structure - Floating Point Parameter Type Register Numbers (Dec)
1 2 3 4 5 6 7 8 9 to 13 Type = 2 Attribute Value (float high word) Value (float low word) Low Range (float high word) Low Range (float low word) High Range (float high word) High Range (float low word) Description Text (ASCII string)
Name
Access
Notes
NOT SUPPORTED NOT SUPPORTED Read / Write NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED NOT SUPPORTED
Register Count The register count depends on the data format of the registers being read or written. Integer data is represented in sixteen bits and is transferred high byte first. Floating point data is transferred in IEEE 32-bit format. The register count definitions are: 0001 = Integer Data 0002 = Floating Point Data Configuration ID Tags Function Codes 20 and 21 use local addressing to read and write parameters that are for Analog or Digital. Table 7-3 and Table 7-4 lists all the register addresses and ranges or selections for the parameters in the 7866 Analyzer/Indicator. Table 7-3 Analog Parameter Register Addresses Parameter Description Register Address Hex Analog Parameters Alarm 1 Setpoint Alarm 2 Setpoint Alarm Hysteresis Indicator Bias Value for Range 1 Indicator Bias Value for Range 2 Indicator Bias Value for Range 3 0001 0002 0003 0004 0005 0006 001 002 003 004 005 006 FP FP FP FP FP FP R/W R/W R/W R/W R/W R/W 90.0 to 100.0 90.0 to 100.0 0 to 100.0 +10.00 to 10.00 +10.00 to 10.00 +10.00 to 10.00 Decimal (Tag ID) Data Type Access Data Range or Enumerated Selection
22
9/01
Table 7-4 Digital Parameter Register Addresses Parameter Description Register Address Hex Digital Parameters Analyzer Type Input Selections for Single Range Units Output Selections Power Frequency Lockout Level 0080 0081 0082 0083 0084 128 129 130 131 132 INT INT INT INT INT R R R/W R/W R/W 0 = Triple Range 1 = Single Range See enumerated Range selection in Table 7-5. 0 = 4 to 20mA 1 = 0 to 20mA 0 = 60 cycles 1 = 50 cycles 0 = None 1 = Calibration 2 = Unit 3 = View 1 = One place 2 = Two places 0 = Range 1 1 = Range 2 2 = Range 3 0 = Indicator 1 = Analyzer 0 = 1 to 5 V (4-20mA) 1 = 0 to 5 V (0-20mA) Decimal (Tag ID) Data Type Access Data Range or Enumerated Selection
0085 0086
133 134
INT INT
R/W R
0087 0088
135 136
INT INT
R R/W
9/01
23
Table 7-5 Range and Type Enumeration 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 01 02 05 0 10 0 15 0 20 0 30 0 75 0 100 50 100 80 100 85 100 90 100 95 100 98 100 60 80 40 80 45 55 20 50 0 10 0 15 0 20 0 30 0 40 0 100 Range and Type When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %H2 in Air, N2, or O2; %H2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2 When measuring %CO2 in Air, N2, or O2; %CO2
When measuring 0 100%H2 in CO2 When measuring 50 100%H2 in CH4 When measuring 0 100%He in Air When measuring 0 30%CH4 in H2 When measuring 5 15%CH4 in Air When measuring 95 100%O2 in H2 Special Application: 0 75% dissociated ammonia
24
9/01
File Number
Register Address
Register Count
CRC Data
CRC Data
Reference Type
Data
Data
Data
Data
CRC Data
CRC Data
Byte Count The Byte Count equals the number of bytes transmitted in either the request or response message and will be the minimum number required to transmit all requested data. Data Byte Count The Data Byte Count is the number of data bytes of the sub response including the Reference Type but not including itself. A floating point sub response has four bytes of data and one byte representing the reference type making the data byte count equal to five. Reference Type Definitions The Reference Type definition is always 06.
9/01
25
File Number The file number word contains the register number from the register address structure tables on page 21. Although the register address structure tables indicate up to 13 data registers are available for access, only register address 3 is currently supported. Register Address The register address is used to designate the tag ID number for the parameter being accessed. The register address is made up of two bytesthe MSB = 00 always. The LSB contains the RS422 tag ID number. The tag ID numbers represent the parameters register address(es). Table 7-6 Register Address Format for Function Code 20 Register Address(es) (Decimal) 001 to 006 128 to 136 Register Address(es) (Hex) 0001 to 0006 0080 to 0088 Format
analog formatted data (2 registers IEEE 32-bit floating point) integer formatted data (1 register 16-bit integer)
Example #1 The following is an example of a request to read the Output Type using Function code 20. Request Message (Read (Output Type) = ID Tag 130) 05 14 07 06 00 03 00 82 00 01 Where: 05 14 07 06 00 03 00 82 00 01 = = = = = = = Address Function Code 20 (14 hex) Byte Count Reference Type File Number (Standard Access /Output Type Tag ID #130) Register Address (Access Data Value) Register Count (Integer Data)
This is the response to the above request. Response Message 05 14 04 03 06 00 01 (CRC16) Where: 05 14 04 03 06 00 01 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Sub Message Length Reference Type 4 to 20mA (Output Type)
26
9/01
Example #2 The following is another example of a request and response message using Function code 20. Request Message (Read Alarm Hysteresis = ID Tag 3) 06 14 07 06 00 03 00 03 00 02 Where: 06 14 07 06 00,03 00,03 00,02 = = = = = = = Address Function Code 20 (14 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access Alarm Hysteresis - ID Tag 3) Register Count to read (Floating Point Data)
This is the response to the above request. Response Message 06 14 06 05 06 3F 00 00 00 (CRC16) Where: 02 14 06 05 06 3F 00 00 00 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Data Byte Count (Sub Message Length) Reference Type (IEEE Floating Point) 0.5 (Value of Hysteresis)
9/01
27
Example #3 The following is an example of a request to read the Alarm 2 Setpoint value using Function code 20. Request Message (Read (Alarm 2 Setpoint) = ID Tag 002) 02 14 07 06 00 03 01 01 00 02 (CRC16) Where: 02 14 07 06 00,03 00,02 00 02 (CRC16) = = = = = = = Address Function Code 20 (14 hex) Byte Count Reference Type File Number (Access Data Value) Register Address (Standard Access / Alarm 2 Setpoint Tag ID #2) Register Count (Floating Point Data)
This is the response to the above request. Response Message 02 14 06 05 06 41 88 00 00 (CRC16) Where: 02 14 06 05 06 41 88 00 00 (CRC16) = = = = = = Address Function Code 20 (14 Hex) Byte Count Sub Message Length Reference Type (IEEE Floating Point) 17.00 (Value of Alarm 2 Setpoint)
28
9/01
Data
Data
Data
Data
File Number
CRC Data
CRC Data
Data
Data
Data
Data
File Number
CRC Data
CRC Data
Reference Type Definitions The Reference Type definition is always 06. Byte Count The Byte Count equals the number of bytes transmitted in either the request or response message and will be the minimum number required to transmit all requested data. File Number The file number word contains the register number from the register address structure tables on page 21. Although the register address structure tables indicate up to 13 data registers are available for access, only register address 3 is currently supported.
9/01 7866 Analyzer/Indicator Modbus RTU Serial Communications User Manual 29
Register Address The register address is used to designate the tag ID number for the parameter being accessed. The register address is made up of two bytesthe MSB = 00 always. The LSB contains the RS422 tag ID number. The tag ID numbers represent the parameters register address(es). Table 7-7 Register Address Format for Function Code 21 Register Address(es) (Dec) 001 to 006 Register Address(es) (Hex) 0001 to 0006 Format
128 to 136
0080 to 0088
Restrictions on Parameter Numbers in One Message The maximum number of writeable parameters per write request is 1. Example #1 The following is an example of a request to write the Alarm 1 Setpoint value using Function code 21 (15 Hex). Request Message (Write Alarm 1 Setpoint = 15 ID Tag 1) 02 15 0B 06 00 03 00 01 00 02 41 70 00 00 (CRC16) Where: 02 15 0B 06 00 03 00 01 00 02 41 70 00 00 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Alarm 1 Setpoint) Register Count (Floating Point Data) 15.00
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 0b 06 00 03 00 01 00 02 41 70 00 00 (CRC16)
30
9/01
Example #2 The following is an example of a request to write the Indicator Bias value for Range 3 using Function code 21 (15 Hex). Request Message (Write Indicator Bias Value for Range 3 = 3.0 ID Tag 6) 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16) Where: 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Indicator Bias Value - ID Tag 6) Register Count (Floating Point Data) 3.00
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 0B 06 00 03 00 06 00 02 40 40 00 00 (CRC16)
Example #3 The following is an example of a request to write the Output Type of 4-20mA using Function code 21 (15 Hex). Request Message (Write Output Type = 4-20mA ( ID Tag 130) 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16) Where: 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16) = = = = = = = = Address Function Code 21 (15 Hex) Byte Count Reference Type (IEEE Floating Point) File Number (Access Data Value) Register Address (Standard Access/ Output Type- ID Tag 130) Register Count (Floating Point Data) 4-20mA
This is the response to the above request. Response Message (The response is an echo of the request) 02 15 09 06 00 03 00 82 00 01 00 01 (CRC16)
9/01
31
}; CRCHi = 0xff; CRCLo = 0xff; while(length) { TempHi = CRCHi; TempLo = CRCLo; CRCHi = table[2 * (*message ^ TempLo)]; CRCLo = TempHi ^ table[(2 * (*message ^ TempLo)) + 1]; message++; length--; }; CRC [0] = CRCLo; CRC [1] = CRCHi; return; }
32
9/01
Index
Index
A
Acknowledge (Busy repoll), 18 Alarm #1, 13 Alarm #2, 13 Alarm 1 Setpoint, 22 Alarm 1 Setpoint Value, 20 Alarm 2 Setpoint, 22 Alarm 2 Setpoint Value, 20 Alarm Hysteresis, 19, 22 Alarm Status #1 - #2, 19 Analog Parameters, 22 Analyzer Type, 23 Floating Point Little Endian, 9 Floating Point Little Endian with byte-swapped, 9 Function code 01, 13 Function code 03, 14 Function Code 03, 04, and 10h, 19 Function code 04, 14 Function Code 16 (10h), 15 Function code 17 (11h), 16 Function code 20 (14 Hex), 25 Function Code 21 (15 Hex), 29 Function Code Field, 17 Function Codes, 12 function codes 20 and 21, 1, 21 Function Codes 20 and 21, 1 Function Codes Definitions, 12
B
Bit transfer order, 5 Bit transfer rate, 5 Bits per character, 5 Broadcast, 13 Byte Count, 25, 29 Byte Swapping, 9
H
High Alarm type for Single Range, 20
I,J,K
IEEE 32-bit Floating Point Register, 7 IEEE Floating Point Formats, 10 IEEE Floating Point Number Examples in FP B Format, 11 Illegal Data Address, 18 Illegal Data Value, 18 Illegal Function, 18 Implementation, 1 Indicator Bias Value, 19 Indicator Bias Value for Range 1, 22 Indicator Bias Value for Range 2, 22 Indicator Bias Value for Range 3, 22 Input Selections for Single Range Units, 23 Integer Formatted data, 12
C
Coding system, 5 Communications Wiring, 3 Configuration ID Tags, 21, 22 Constant Value Registers, 19 Conversion of Address (Hex) Number to Register (Decimal) Number, 19 CRC-16 Calculation, 32
D
Data Byte Count, 25 Data Field, 17 Data Layer, 6 Decimal Point Location, 23 Device Class ID, 16 Device Description, 16 Device Specific Data, 16 Digital Parameters, 23 Duplex, 5
L
Link Layer, 5 Lockout Level, 23 Low Alarm Type, 20 Low Alarm type for Triple Range, 20
E
End of message, 5 Error checking, 5 Exception Codes, 17, 18 Exponent, 8
M
Mantissa and Sign, 7 Message format, 6 Message Formats, 5 Miscellaneous Register Map Addresses, 19 Modbus Communications Group, 9 Modbus Double Register Format, 9 Model ID, 16 Model Type, 23
F,G
File Number, 26, 30 File number word, 21 Floating Point Big Endian, 9 Floating Point Big Endian with byte-swapped, 9 Floating point formatted data, 12
9/01
33
Index
N
Negative Acknowledge, 18 Number of Records, 16
O
Output, 19 Output Selections, 23
P
Parity, 5 Polynomial, 5 Power Frequency, 23 Preset Multiple Registers, 12, 15 PV/Input Value, 19
Q
Query message format for function code 01, 13 Query message format for function code 03/04, 14 Query message format for function code 16 (10h), 15 Query message format for function code 17 (11h), 16
R
Range Low Value, 19 Range Selection, 23 Range Value High, 19 Read bit mapped data - digital outputs, 12 Read configuration data, 12 Read Data Registers, 14 Read Digital Output Status, 13 Read Discrete Outputs, 12 Read General Reference, 12 Read Holding Registers, 12 Read Input Registers, 12 Read instrument specific data, 12 Reference Type Definitions, 25, 29 Register Address, 26, 30 Register Address Format for Function Code 20, 26 Register Address Format for Function Code 21, 30
Register Address Structure, 21 Register Address Structure - Floating Point Parameter Type, 22 Register Address Structure - Integer Parameter Type, 21 Register Count, 22 Register Map, 19 Report 7866 Analyzer/Indicator ID, 16 Report Device ID, 12 Request and Response formats for Function code 20 (14 Hex), 25 Request and Response formats for Function code 21 (15 Hex), 29 Reserved Operands, 9 Response message format for function code 01, 13 Response message format for function code 16 (10h), 15 Response message format for function code 17 (11h), 16 Response message format for function codes 03/04, 14 Restrictions on Parameter, 30 RS485 to RS232 converter, 3 Run Indicator Status, 16
S
Sensor, 13 Slave Device Failure, 18 Slave ID, 16
T
The register address structure tables, 26
W,X,Y,Z
Write configuration data, 12 Write Configuration Reference Data, 29 Write floating point formatted data, 12 Write General Reference, 12
34
9/01
www.honeywell.com/sensing