CAL Controls 9300, 9400, 9500, 3300P, 9300P Communications Manual
...
COMMERCIAL IN CONFIDENCE
CAL 3300/9300/9400/9500(P)
MODBUS RTU
COMMUNICATIONS GUIDE
7th September 2000
ISSUE 1.10
Doc:33034 Iss:002
COMMERCIAL IN CONFIDENCE
Page 1
DESCRIPTION
This document describes the interaction between a CAL Controller with the communications option
fitted and a PC/PLC attached to the bus and acting in a command mode.
There are fundamental limitations placed on the interactions. These arise from the intrinsic properties
of the CAL controllers, with just three control buttons and a multi-level menu with increment or
decrement value change process.
The standalone CAL controllers currently perform a verification on each change to ensure that illegal
values (e.g. ones outside the limit range for a particular thermocouple, etc.) are not accepted .The PC
application needs to replicate the verification checks that the CAL controllers would perform before
transmitting the new data out over the bus to the instrument. The CAL controllers assume that the
values they receive have been checked against limits and are valid - no further verification is carried
out. Upon receipt of the new values and an exit program mode sequence the CAL controllers write the
new values to memory and then restart.
_Copyright Cal Controls Ltd 1999. All rights strictly reserved. No part of this documentation shall be
reproduced ,stored in a retrieval system, or copied in any form, without prior written permission from
Cal Controls Ltd. Every effort has been taken to ensure the accuracy of this specification. However due
to our policy of continuous development to improve our products, this could without notice, result in
amendments or omissions to this document. Neither is any liability assumed for damage, injury, loss,
or expenses resulting from the use of this document.
COMMERCIAL IN CONFIDENCE
Page 2
1. MEMORY MAP OF PARAMETERS
WARNING:- As with any computer system writing to any unauthorised memory address will
inevitably cause malfunction and may put the instrument in an indeterminate or dangerous state. It is
the users responsibility to ensure correct use.
The instruments uses a 8051 type processor. This has two types of RAM: the internal 256 bytes and
the external 256 bytes, data is also stored in EEPROM (non-volatile ram). Each data area requires a
different access method internally.
Data can be accessed as either one byte or a two byte word - the word need not necessarily lie on an
even address boundary. To simplify ModBus messages the unit decodes the MSB of the ModBus
address to select which type of memory to access - thus all memory looks the same to the end user.
Decoding is as follows:
bit 7 bit 6 bit 5 bit 4 bit 3 bit 2 bit 1 bit 0
always 0 always 0 always 0 1=security always 0 1=NVram 1=external 1=one byte
so that the following addresses specify the given memory areas:
• 00xxH references internal memory - two bytes wide
• 01xxH references internal memory - one byte wide
• 02xxH references external memory - two bytes wide
• 03xxH references external memory - one byte wide
• 04xxH references NV memory - two bytes wide
• 05xxH references NV memory - one byte wide
note that messages with both bits 1 and 2 set are misleading and should not occur, however, they will
be interpreted as if bit 2 was 0. Bit 4 is used to indicate reserved messages - see the section Security
Messages below.
Two types of bit value may exist:
• those which can be set and cleared as a single operation (i.e. directly addressable) are
defined as type bit.
• those which must be set or cleared by reading a byte, masking the bit, then writing the
byte.
Bit addresses are represented by both the absolute hex address and also by bit number (in decimal) if
the bit is directly addressable. Note that, in this document, the bit number is one based (1..128) which
matches the usual representation of ModBus.
The byte and word addresses given are the absolute HEX locations in the instrument.
Depending on the type of ModBus driver being used, these may need to be converted to a
decimal address, plus 1, since some ModBus drivers subtract 1 from the address given. Thus to
access the Baud Rate (03D6) a ModBus driver would need decimal address 983 (982 + 1).
Shaded sections denote contiguous address space which may be read and written as multiple
registers if the remote software can handle this. NOTE that due to space limitations the current
implementation does not allow multiple address access - only one word can be accessed per
message.
To facilitate easy reading, the following tables are listed in address order, not the order on the menus.
Extreme care must be taken to write only to those locations indicated. Writing to any other
locations WILL corrupt the instrument, but the effects may not necessarily be immediately
noticed.
COMMERCIAL IN CONFIDENCE
Page 3
1.1 Internal data formats
The instrument stores data in a variety of ways to allow a full range of values to be held in the minimum
space possible. Most are represented by a multiple of the displayed value - this is given as a scale
factor in the table below: for instance, temperatures are stored in 10ths of a degree, so a displayed
value of 123.4 degrees is stored as 1234 - this is shown in the tables as temp * 10. Some time values
are stored in 40ms units so a time of 1 second would be stored as 25. A few parameters - mainly the
times - have different scale factors and offsets depending on their current value - these are detailed
individually.
Parameters are incremented/decremented by fixed step sizes depending on their current value within
limits which may change depending on the current value of other parameters. Many parameters
increment and decrement in the same manner - this is referred to in the tables as normal inc/dec - in
these cases parameters move in 0.1 steps between —9.9 and 9.9, otherwise in steps of 1. Note that
when incrementing or decrementing, the internal storage format must be taken into account and also
whether the display is in hi-res mode - values sent to the instrument must match the current mode.
Note also that in the 9500 instrument parameters marked with [LIN] are stored in degrees*10 when the
selected input is a thermocouple or RTD and units of 1 when the selected input is linear. Also note that
while linear input is selected the display of values on the instrument is effected by the setting in DECP
not Disp.
The instrument provides no error checking on values transmitted to it - the user must ensure that new
values are checked for consistency before uploading.
1.2 Variables not on menu structure
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in
Internal units
Comments
SP1 2 007F RW 3/6 Degrees * 10 [LIN]
step 1 from LoSc to HiSc
The setpoint required. See 1.2.1
below regarding initialising a new
instrument
Setpoint
safety check
1 0125 RW 3/6 see note 1.2.1 below for correct
usage of this byte
Temperature 2 001C R 3/6 Degrees * 10 [LIN] stored as 10ths of deg C
security byte 1 0300 W 6 no scaling see 2.3 for security messages
Ramp Byte 1 0305 R 3 no scaling see 1.2.2 below for bit meanings
Display Byte 1 0306 R 3 no scaling see 1.2.3 below for interpretation
Display State 2 0205 R 3 no scaling a word read enables Ramp byte
and Display Byte to be read with a
single message
Model
(Type of inst
and output
configuration)
2 04FC R
3 0X01 33/9300 RLY / SSD
0X02 33/9300 SSD / SSD
0X03 33/9300 RLY / RLY
0X07 9400 RLY / SSD
0X08 9400 SSD / SSD
0X09 9400 RLY / RLY
0x10 9500 SSD / RLY / RLY
0x11 9500 SSD / SSD / RLY
0x12 9500 RLY / RLY / RLY
0x13 9500 ANLG / RLY / RLY
0x14 9500 ANLG / SSD / RLY
Type of instrument and output
configuration are determined by
the hardware, but can be read
from the address 04FC
The Ramp and Display bytes have been kept together so that a single word read at address 0x0205
can be used to obtain full information about the state of the instrument display.
COMMERCIAL IN CONFIDENCE
Page 4
1.2.1 Initialising the Setpoint
The instrument is provided with a safety lock to prevent it from controlling until the setpoint has been
set. This lock is automatically released the first time that the setpoint is changed from the instrument
front panel. If it is required to initialise a new instrument (or after the parameters have been reset), this
lock may be released remotely by performing the following sequence:
tempbyte = (read byte at ModBus address 0125 hex)
tempbyte = tempbyte OR 0x02 {i.e. set bit 1}
(write tempbyte back to ModBus address 0125 hex)
Note that this sequence is only required to unlock the instrument from its reset state - it is not
necessary to perform this sequence each time the setpoint is changed. The other bits within this byte
are used internally and must not be modified.
1.2.2 Ramp Byte
The Ramp Byte holds bits which show what stage of a ramp/soak sequence is currently active:
• bit 1 set = in ramp phase, display periodically flashing SPr
• bit 2 set = in soak phase, display periodically flashing Soak
• bit 3 set = sequence finished, control dormant, display flashes Stop
• bit 6 set = Holdback LED on front display lit (9500P only)
note that these bits are mutually exclusive (except the holdback bit), and the flashing display is of lower
priority than the displays recorded by the Display Byte. If no bit is set, the instrument is not in a
ramp/soak sequence. If the unit has finished a ramp but no soak time is specified (SOAK= - - ) bit 2
will remain set.
The other bits in the Ramp Byte are used internally by the instrument. The Ramp Byte must not be
written to - unpredictable and possibly dangerous instrument behaviour will result.
1.2.3 Display Byte
The Display Byte records the message currently being shown on the instrument display, and also
mirrors the state of the SP LED s - note that although these may be read by a remote program, their
values may change rapidly in real time. Due to the time lag in processing communications messages it
may not be possible to exactly mimic the display on a remote screen - particularly for short cycle times.
The hi nibble conveys the following meanings:
• Bit 7 set = SP2 LED lit
• Bit 6 set = SP1 LED lit
• Bit 5 set = add FAIL display to other indications
• Bit 4 set = SP3 LED lit (9500 only)
The low nibble of the Display Byte indicates the current alternating message being displayed, thus
after the top 2 bits are masked off, the following values indicate the display message:
0x01 = PARK / temp
0x02 = -AL- / temp
0x03 = TUNE / temp
0x23 = TUNE / FAIL
0x04 = TUNE / ATSP / temp
0x05 = HAND / heat power ratio
0x25 = HAND / FAIL
0x26 = INPT / FAIL
0x27 = DATA / FAIL
These messages take display precedence over any others. If one of the Display Byte messages is
indicated, the remote program must ignore the state of the Ramp Byte.
COMMERCIAL IN CONFIDENCE
Page 5
1.3 Level C - parameters in address order
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in
Internal units
Comments
Addr 1 03D5 RW 3/6 0..255 valid range 1..247
Baud 1 03D6 RW 3/6 0=1200, 1=2400, 2=4800, 3=9600,
4=19200
Data 1 03D7 RW 3/6 0=18n1, 2=18e1, 3=18o1,
Dbg 1 03D8 RW 3/6 0=off, 1=on
note that all changes to the communications level parameters take effect immediately on leaving the
menu, or on receipt of the exit program mode command. The dbg feature may be set on or off. When
on, the right-most digit will flash 3 horizontal segments on receipt of a character when a
communications board is fitted, the left-most digit will flash on transmission of a character.
1.4 Level 1 - parameters in address order
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in Internal units,
Limits
Comments
Set.2 2 0081 RW 3/6 Degrees * 10 [LIN]
Step 0.1 or 1 depending on disp selection
min=LoSc, max=HiSc
Ofst 2 0083 RW 3/6 Degrees * 10 [LIN]
normal inc/dec
see separate details for limits
Band 2 0085 RW 3/6 Degrees * 10 [LIN]
normal inc/dec
min=0.1 max=25% of Sensor Maximum
9500 max is
100% of sensor
maximum
Bnd.2 2 0087 RW 3/6 Degrees * 10 [LIN]
normal inc/dec
see separate details for limits
Tune 1 0189 RW 3/6 0=off, 1=on, 2=park, 3=at Setpoint
Dac 1 018A RW 3/6 stored as value*2 so 0.5 is stored as 1
step by 0.5
Min=0.5 max=5.0
Int.t 1 018B RW 3/6 intt * 10 up 10.0, then intt+90
normal inc/dec
0=off min=0.1, max=60
Der.t 1 018C RW 3/6 1 — 200 in 1 sec steps
Cyc.t 1 018D RW 3/6 Cyct * 10 up 10.0, then Cyct+90
normal inc/dec
0=off min=0.1, max=81
Cyc.2 1 018E RW 3/6 Cyc2 * 10 up 10.0, then Cyc2+90
normal inc/dec
0=off min=0.1, max=81
SP.lk bit 0028 RW 1/5 0=off, 1=on
SPrr 2 02D0 RW 3/6 Stored as SPrr
if <100 step by 1, if <1000 step by 5 else step by
10
min=0 max=9990
9500 display
effected by DECP
when LIN input
selected
Soak 2 02D2 RW 3/6 0xFF00 = - - , 0=off, otherwise Soak * 10
Step by 1 up to 120, then 5 up to 300 then by 10
min = 1, max=1440
SPrn 1 03D4 RW 3/6 0=off, 1=on, 2=hold 9500P See Level P
section for notes
on starting a
program
COMMERCIAL IN CONFIDENCE
Page 6
1.5 Level 2 - parameters in address order
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in
Internal units, Limits
Comments
SP1.P
SP1_ontime
SP1_proptime22
0062
0078
RR3
3
not stored must be computed as
SP1_ontime/SP1_proptime
*100%
Disp bit 002A RW 1/5 0=low res, 1= high res
Hand 1 018F RW 3/6 No scaling
step by 1
min 0=off, max=100
PL.1 1 0190 RW 3/6 No scaling
step by 1
min=0, max=100
PL.2 1 0191 RW 3/6 No scaling
step by 1
min=0, max=100
SP2.A 1 0192 RW 3/6 0=none, 1=dvhi, 2=dvlo, 3=band,
4=fshi, 5=fslo, 6=cool
9500P 7=EOP
SP2.b 1 0193 RW 3/6 0=none, 1=ltch, 2=hold, 3=ltho,
4=nlin
Hi.SC 2 0094 RW 3/6 HiSc * 10 [LIN]
step by 0.1 or 1
min=Sensor Min, max=Sensor Max
Lo.SC 2 0096 RW 3/6 LoSc * 10 [LIN]
step by 0.1 or 1
min=Sensor Min, max=Sensor Max
Inpt 1 0198 RW 3/6 0=none, 1=Tcb, 2=Tce, 3=Tcj,
4=Tck, 5=Tcl, 6= Tcn, 7=TcR,
8=Tcs, 9=Tct, 10=RTD, 11=lin1
12=lin2, 13=lin3, 14=lin4, 15=lin5
9500
11=lin
12-15 unused
Unit 1 0199 RW 3/6 0=none, 1=C, 2=F, 3=bar, 4=PSI,
5=Ph, 6=Rh, 7=set
COMMERCIAL IN CONFIDENCE
Page 7
1.6 Level 3 - parameters in address order
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in
Internal units, Limits
Comments
SP1.d 1 019D R 3/6 0=none, 1=rly, 2=ssd, 3=rly1,
4=rly2
5=ssd1(ssd2)
9500
0=none 1,3,4,10=ssd
2,5,6,8=rly 7,9=anlg
SP2.d N/A N/A N/A N/A Not stored Inverse of SP1.d
Burn 1 019E RW 3/6 0=upsc, 1=dnsc, 2=1u2d, 3=1d2u
Rev.d 1 019F RW 3/6 0=1r2d, 1=1d2d, 2=1r2r, 3=1d2r
Rev.l 1 01A0 RW 3/6 0=1n2n, 2=1l2n, 3=1n2l, 4=1l2l
Span 2 00A1 RW 3/6 Span * 10 [LIN]
normal inc/dec
min = -0.25 * Sensor Min
max = 0.25 * Sensor Max
Zero 2 00A3 RW 3/6 Zero * 10 [LIN]
normal inc/dec
min = -0.25 * Sensor Min
max = 0.25 * Sensor Max
Chek bit 0026 RW 1/5 0=off, 1=on
Read (var) 2 computed from 2 vars (below)
Read(hi) - Read(lo) with
degC to decF if required (if
unit=1)
Read (hi) 2 007A R 3 Read(hi) * 10 [LIN]
Read (lo) 2 007C R 3 Read(lo) * 10 [LIN]
Data (Ct A) 2 0432 R 3 CtA * 25
Data (Ct B) 2 0434 R 3 CtB * 25
Data (Ct 1) 2 0436 R 3 Ct1 * 25
Data (Ct 2) 2 0438 R 3 Ct2 * 25
Data (Ct 3) 2 043A R 3 Ct3 * 25
Data (Ct 4) 2 043C R 3 Ct4 * 25
Data (Os 1) 2 043E R 3 Os1 * 10 [LIN]
Data (us) 2 0440 R 3 Us * 10 [LIN]
Data (Os 2) 2 0442 R 3 Os2 * 10 [LIN]
Ver
(S/W ver)
2 04FD R 3 0xFFFF/ 0x01 means ver 391
0x02 means ver 392
0x03 means ver 941
0x04 means ver 951
0X05 means ver 952
3300/9300 ver 1
3300/9300 ver2
9400 ver 1
9500 ver 1
9500 P ver 2
Rset bit 0027 RW 1/5 0=none, 1=all
1.7 Level 4 - parameters in address order
Parameter
Name
Size Address
(hex)
R/W ModBus
Function
read/write
Internal Storage, Step rate in
Internal units, Limits
Comments
Der.S 1 019A RW 3/6 Ders * 10
Dis.S 1 019B RW 3/6 0=dir, then 1..32
step by 1
min=0, max=32
Lock 1 019C RW 3/6 0 = none, 1=lev3, 2=lev2, 3=all
Prog bit 002D 1/5 0 = auto, 1=stay
No.Al bit 002E RW 1/5 0 = off, 1=on
Loading...