Honeywell HC900 User Manual

HC900 Hybrid Controller

Communications

User Guide

51-52-25-111 9/03 Revision: 4

Industrial Measurement and Control

Copyright, Notices, and Trademarks

Printed in U.S.A. – © Copyright 2003 by Honeywell

Revision 4 – 9/03

Warranty/Remedy

Honeywell warrants goods of its manufacture as being free of defective materials and faulty workmanship. Contact your local sales office for warranty information. If warranted goods are returned to Honeywell during the period of coverage, Honeywell will repair or replace without charge those items it finds defective. The foregoing is Buyer's sole remedy and is in lieu of all other warranties, expressed or implied, including those of merchantability and fitness for a particular purpose. Specifications may change without notice. The information we supply is believed to be accurate and reliable as of this printing. However, we assume no responsibility for its use.

While we provide application assistance personally, through our literature and the Honeywell web site, it is up to the customer to determine the suitability of the product in the application.

Honeywell

Industrial Measurement and Control

1100 Virginia Drive

Fort Washington, PA 19034

Modbus is a registered trademark of MODICON, Inc.

Windows is an addressed trademark of Microsoft Inc.

The omission of a name from this list is not to be interpreted that the name is not a trademark.

Reference: Modicon Modbus Protocol Reference Guide - PI-MBUS-300 Rev. G

ii	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

About This Document

Abstract

This document provides information specific to the communications interface for Honeywell’s HC900 Controller. The protocol supported for connection to the controller’s Ethernet network port is Modbus/TCP (Modbus RTU protocol in a TCP/IP wrapper). . The document includes a summary of all HC900 data available (primarily floating point) for Modbus RTU access read and write including methods for access.

Contacts

World Wide Web

The following lists Honeywell’s World Wide Web sites that will be of interest to our customers.

Honeywell Organization	WWW Address (URL)
Corporate	http://www.honeywell.com
Industrial Measurement and Control	http://www.honeywell.com/imc

Telephone

Contact us by telephone at the numbers listed below.

	Organization	Phone Number
United States and Canada	Honeywell	1-800-423-9883	Tech. Support
		1-888-423-9883	Q&A Faxback
			(TACFACS)
		1-800-525-7439	Service

Revision 4	HC900 Hybrid Controller Communications User Guide	iii
9/03

	Contents
1.	INTRODUCTION ...................................................................................................	1
1.1	Modbus/TCP Interface ...................................................................................................................	1
1.2	Modbus RTU RS232/RS485 Communication Ports ......................................................................	4
2. IEEE 32-BIT FLOATING POINT REGISTER INFORMATION..............................		7
2.1	IEEE Floating Point Data Format...................................................................................................	7
3. MODBUS DOUBLE REGISTER FORMAT .........................................................		10
3.1	IEEE Floating Point Formats........................................................................................................	11
3.2	Unsigned/signed 32-bit Register Formats ....................................................................................	13
4. MODBUS/TCP & MODBUS RTU FUNCTION CODES.......................................		17
4.1	Definition......................................................................................................................................	17
4.2	Function Code 01 – Read Digital Output Status ..........................................................................	20
4.3	Function Code 02 - Read Digital Input Status..............................................................................	24
4.4	Function Codes 03Read Holding (Data) Registers ....................................................................	25
4.5	Function Codes 04 - Read Input Registers ...................................................................................	27
4.6	Function Code 05 - Force Single Digital Output..........................................................................	29
4.7	Function Code 06 - Preset Single Register...................................................................................	30
4.8	Function Code 08 - Loopback Message .......................................................................................	31
4.9	Function Codes 16 (10h) - Preset Multiple Registers...................................................................	32
4.10 Function Code 17 (11h) - Report HC900 ID ............................................................................		33
5. MODBUS RTU EXCEPTION CODES .................................................................		35
5.1	Introduction ..................................................................................................................................	35
6. REGISTER MAP FOR PROCESS AND OPERATION TYPE VARIABLES .......		37
6.1	Register Map Overview................................................................................................................	37
6.2	Miscellaneous Register Map ........................................................................................................	41
6.3	Loop Value Register Map ............................................................................................................	42
6.4	Example for queries using Function Codes 3, 6, 16.....................................................................	45
6.5	Analog Input Value Register Map - Function Code 03................................................................	47
6.6	Analog Input Value Register Map - Function Code 04................................................................	48
6.7	Variable Register Map..................................................................................................................	49
6.8	Time Register Map .......................................................................................................................	50
6.9	Signal Tag Register Map ..............................................................................................................	51
iv	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

6.10	Set Point Program Register Maps .............................................................................................	53
6.11	Set Point Programmer Value Register Map..............................................................................	56
6.12	Set Point Programmer Additional Values Register Map ..........................................................	58
6.13	Set Point Programmer Segment Map........................................................................................	60
6.14	Segment Register Map..............................................................................................................	61
6.15	Scheduler Value Register Map .................................................................................................	63
6.16	Scheduler Segment Register Map.............................................................................................	68
6.17	Segment Register Map..............................................................................................................	69
6.18	Sequencer Register Maps..........................................................................................................	71
6.19	Sequencer #1 Parameters Register Map....................................................................................	72
6.20	Sequencer #1 Step 1 Table Register Map .................................................................................	73
6.21	Sequencer #1 State Table Register Map ...................................................................................	74
6.22	Hand/OFF/Auto Control Group Register Map .........................................................................	75
6.23	Device Control Group Register Map ........................................................................................	76
6.24	Alternator Group Register Map ................................................................................................	77
6.25	Output Order Sequence Scratch Pad Register Map ..................................................................	83
6.26	Stage Group Register Map........................................................................................................	85
6.27	Ramp Group Register Map .......................................................................................................	88
6.28	User Defined Registers .............................................................................................................	90
INDEX	...........................................................................................................................	91
SALES AND SERVICE.................................................................................................		95

Revision 4	HC900 Hybrid Controller Communications User Guide	v
9/03

Tables

Table 1-1 Modbus RTU Message Formats ________________________________________________ 5 Table 3-1 Modbus Double Register Format Selections ______________________________________ 10 Table 3-2 IEEE Floating Point Number Examples in FP B Format ____________________________ 12 Table 4-1 Modbus/TCP and Modbus RTU Function Codes Definitions_________________________ 17 Table 4-2 Maximum Number of Object Addresses _________________________________________ 18 Table 4-3 Maximum Number of Registers Allowable per Request_____________________________ 19 Table 4-4 DI/DO Address Mapping_____________________________________________________ 21 Table 4-5 Modbus Comm Digital I/O Channel to Address Mapping - Rack #1 ___________________ 21 Table 4-6 HC900 AI Address Mapping supported by Function Code 03 ________________________ 25 Table 4-7 HC900 AI Address Mapping supported by Function Code 04 ________________________ 27 Table 5-1 Modbus RTU Data Layer Status Exception Codes _________________________________ 36 Table 6-1 Global Register Map ________________________________________________________ 37 Table 6-2 Miscellaneous Register Map Addresses _________________________________________ 41 Table 6-3 Loop Value Register Map Addresses ___________________________________________ 42 Table 6-4 Analog Input Value Register Map Addresses - Function Code 03 _____________________ 47 Table 6-5 HC900 AI Address Mapping supported by Function Code 04 ________________________ 48 Table 6-6 Analog Input Value Register Map Addresses for Rack #1 - Function Code 04 ___________ 48 Table 6-7 Variable Register Map Addresses ______________________________________________ 49 Table 6-8 Time Register Map Addresses_________________________________________________ 50 Table 6-9 Signal Tag Register Map Addresses ____________________________________________ 51 Table 6-10 SP Programmer Addresses ___________________________________________________ 53 Table 6-11 Steps to Download a Setpoint Program using Modbus Function Codes 3, 4, 6, 16 _______ 55 Table 6-12 Steps to Upload a Setpoint Program using Modbus Function Codes 3, 4, 6, 16__________ 55 Table 6-13 Set Point Programmer #1 Value Register Map Addresses __________________________ 56 Table 6-14 Set Point Programmer #1 Additional Values Register Map Addresses_________________ 58 Table 6-15 Set Point Programmer #1 Segment Map Addresses _______________________________ 60 Table 6-16 Segment Register Map Addresses _____________________________________________ 61 Table 6-17 SP Scheduler Addresses _____________________________________________________ 64 Table 6-18 Steps to Download a Setpoint Schedule using Modbus Function Codes 3, 4, 6, 16 _______ 64 Table 6-19 Steps to Upload a Setpoint Schedule using Modbus Function Codes 3, 4, 6, 16 _________ 65 Table 6-20 Scheduler #1 Value Register Map Addresses ____________________________________ 65 Table 6-21 Scheduler #1 Segment Register Map Addresses __________________________________ 68 Table 6-22 Segment Register Map Addresses _____________________________________________ 69 Table 6-23 Sequence Parameters Register Maps ___________________________________________ 71 Table 6-24 Sequence Step 1 Table Register Maps __________________________________________ 71 Table 6-25 Sequence State Table Register Maps ___________________________________________ 71 Table 6-26 Sequencer #1 Parameters Register Map Addresses________________________________ 72 Table 6-27 Sequencer #1 Step 1 Table Register Map Addresses ______________________________ 73 Table 6-28 Sequencer #1 State Table Register Map Addresses________________________________ 74 Table 6-29 HOA Control #1 Group Register Map _________________________________________ 75 Table 6-30 Device Control #1 Group Register Map ________________________________________ 76 Table 6-31 Alternator #1Group Register Map_____________________________________________ 77 Table 6-32 Output Order Sequence Scratch Pad Group Register Map __________________________ 83 Table 6-33 Stage Group #1 Register Map ________________________________________________ 85 Table 6-34 Ramp Group #1 Register Map________________________________________________ 88

vi	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Figures

Figure 1-1 Modbus RTU Protocol within a TCP/IP Frame ____________________________________ 2 Figure 1-2 Ethernet 10Base-T Network Connections ________________________________________ 4 Figure 2-1 IEEE Floating Point Data format _______________________________________________ 7 Figure 3-1 IEEE Floating Point Formats _________________________________________________ 12

Revision 4	HC900 Hybrid Controller Communications User Guide	vii
9/03

Introduction

Overview

1. Introduction

1.1 Overview

The HC900 controller provides Modbus communication support on three communication interfaces.

•Network port: Modbus TCP on an Ethernet connection

•RS232 port: Modbus RTU

•RS485 port: Modbus RTU

The user may find it convenient to print out the Modbus addresses for various parameters of the configuration (signal tags, PID loops, SP programmer, etc.) using the HC Designer report functions. With HC Designer Ver. 2.1 and later, these reports may also be exported to .csv files for view/manipulation in a spreadsheet and possible import to other HMI applications.

1.2 Modbus/TCP Interface

Introduction

HC900 controllers support the Modbus/TCP (also called Modbus TCP/IP or Modbus Ethernet) protocol for communications with third party HMI and SCADA software via a direct Ethernet TCP/IP connection.

The controller’s Ethernet 10Base-T Host port is used for the Modbus/TCP connection. Ethernet TCP allows multiple concurrent connections to hosts for data interchange. The HC900 supports 5 concurrent host connections using Modbus/TCP protocol messaging via this port.

Interface Preparation

ATTENTION

To access the controller you must have a current Hybrid Control Designer configuration file available. Some data is referenced relative to number, such as Signal Tags and Variables.

Other principal blocks, such as PID blocks, have offsets for parameter access dependent on the order in which the blocks were placed on the Function Block Diagram.

It is strongly recommended that you upload the controller configuration using the Hybrid Control Designer configuration tool to assure that you have a current configuration.

The Hybrid Control Designer tool provides a series of reports for use in Modbus Address identification. The "Tag Information" report lists the variables and Signal Tags in numeric order along with their Modbus Addresses.

A "Block Modbus Address" report lists the starting addresses for all principal blocks configured, identifying the offset.

Modbus/TCP Protocol

Modbus/TCP protocol, developed by Groupe Schneider’s Modicon Division, is a popular, open standard for data interchange over Ethernet TCP/IP networks using a Modbus RTU command structure.

It is simply an encapsulation of Modicon’s Modbus RTU protocol within a TCP/IP frame as shown below, which includes header information and the Modbus frame.

Revision 4	HC900 Hybrid Controller Communications User Guide	1
9/03

Introduction

Modbus/TCP Interface

Figure 1-1 Modbus RTU Protocol within a TCP/IP Frame

The Open Modbus/TCP Specification is followed with respect to the physical, data link, and network layers. The message structure within the Modbus frame uses standard Modbus RTU function codes.

The Address part of the Modbus frame is not used (set to 00) since there is no sub-addressing intended or required. The controller IP address is the identifying address, set independently at the controller.

The error checking is supported by TCP/IP network protocols and not part of the Modbus frame.

The Transaction Identifiers and Protocol Identifiers in the header are normally all 0’s (4 bytes total) while the Length field identifies the number of bytes in the Modbus frame. The controller will transmit the correct number of bytes for the remainder of the frame. However, the controller does not check this field for messages received.

The standard IEEE 32-bit floating point and 16-bit integer formats are used.

Parameter Addressing

The definition in Table 6-1 is the register map overview listing starting and ending addresses.

Greater detail for parameter addressing relating to a particular function class, e.g, loops, setpoint programmer, signal tags, etc. is in referenced sub-sections. Function Codes 1, 2, 3, 4, 5, 6, 8, 16 (10h), and 17 (11h) are supported (see Table 4-1 Modbus/TCP and Modbus RTU Function Codes Definitions).

Examples for read or write access to parameters supported by the various function codes are provided in Sections 4.2 through 4.10.

Reference

The Open Modbus/TCP Specification can be obtained at the Modicon website:

http://www.modicon.com/openmbus/standards/openmbus.htm

HC900 Ethernet Communications Setup

See the HC900 Hybrid Control (HC) Designer Users Guide, Doc. # 51-52-25-110 or respective HC Designer Help Files for setting up the following network parameters:

IP Address, Subnet Mask (optional), Default Gateway IP Address (optional)

1.Be sure the PC, HMI panel, or other Host device has a Network Interface Card (NIC) with an IP address (fixed or DHCP served) that allows access to controllers on the same or other subnet. Consult your IT department or network administrator for allocating IP addresses to the controllers as required.

2.You will need to set each controller’s IP address prior to network connection since every HC900 controller is shipped with the default IP address of 192.168.1.254. Placing multiple controllers on the same network before they have been given unique IP addresses will cause problems.

3.On the PC, use the Utilities Worksheet in the HC Designer software to set up the serial RS-232 connection to the controller at the desired baud rate. This will require a null modem cable.

4.Select the Set Controller’s Network Parameters button. Using the wizard (bottom radio button), select the PC COM port to be used, then set the controller’s new network parameters including IP address,

2	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Introduction

Modbus/TCP Interface

Subnet Mask (if other than default, 255.255.255.0), and Default Gateway IP address (if required, otherwise leave at default 0.0.0.0). See your IT network administrator for proper entries. (Refer to the on-line help provided with the HC Designer software, Utilities Worksheet, Set Controller’s Network Parameters, for further details on this step).

Note: This setup will require the controller to be placed temporarily in the Program mode. After the new network parameters have been downloaded, the controller will conduct a Cold Start in its transition to RUN. This will cause an initialization if there is a current configuration in the controller.

The fixed IP address of each controller shall be set independently prior to placing on the network. See your IT systems administrator for allocating IP addresses, subnet masks, or default gateway IP address as necessary (network address filtering and routing may be necessary if the controller network access will not to be confined locally within the plant environment).

Revision 4	HC900 Hybrid Controller Communications User Guide	3
9/03

Introduction

Modbus RTU RS232/RS485 Communication Ports

Ethernet 10Base-T Network Connections

Ethernet 10Base-T networks operating at 10MB/sec. are supported. A typical network arrangement is as shown below.

Figure 1-2 Ethernet 10Base-T Network Connections

Setting Up the Modbus/TCP Double Register Format

The HC900 predominantly uses an IEEE floating point format for communicating data to software applications providing Modbus/TCP protocol communications drivers. A floating point value is sent as (2) consecutive 16-bit registers, each register of which consists of two 8-bit bytes. Some software packages require the registers and bytes to be sent in a certain order. The controller can be configured to deliver the data in four different byte orders.

The Hybrid Control Designer software tool allows this order to be selected as follows:

1.Using the Utilities Worksheet in the HC Designer software, access the Set Controller Network Parameters button and make the selection to change the Modbus TCP Double Register Format (middle radio button).

2.With the Port selected for downloading this order (using a COM port or Network port), select the appropriate byte order format if the default (FP B) is not appropriate for the application. See Table 3-1, page 10.

3.Select Next and verify (by the response in the dialog box) that the change has been made in the controller. This order can be changed in the RUN mode.

The Modbus TCP double register transmission format selection, FP LB “Little Endian Byte-Swapped”, would be selected for interface to most third party software packages which use this format as standard. The default, FP B “Big Endian” is used with SpecView32 or Honeywell’s PlantScape/Experion software and follows the “Honeywell” default format of other control and recording products. It should be noted that most PC software packages offer a register (word) swap selection in their driver package anyway, so there should never be an incompatibility.

1.3 Modbus RTU RS232/RS485 Communication Ports

This implementation is designed to provide a popular data exchange format connecting these instruments to both Honeywell and foreign master devices via the RS232 and RS485 communication ports. The Modbus RTU allows the instrument to be a citizen on a data link shared with other devices, which subscribe to the Modicon Modbus Protocol Reference Guide PI-MBUS-300 Rev. G specification.

4	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Introduction

Modbus RTU RS232/RS485 Communication Ports

These instruments DO NOT emulate any MODICON type device. The Modbus RTU specification is respected in the physical and data link layers. The message structure of the Modbus RTU function codes is employed and standard IEEE 32-bit floating point and integer formats are used. Data register mapping is unique to these instruments. The definition in Table 6-1 is the register mapping for the HC900-C30 and HC900-C50 and the corresponding parameter value within those instruments.

Modbus RTU Message Format

	Table 1-1 Modbus RTU Message Formats
Coding system	8 bit binary
Number of data bits per	10, 11, or 12 Bits
character	start bits - 1
	data bits - 8
	parity bits – 0 or 1 selectable
	stop bits – 1 or 2 selectable
Parity	None, odd, even selectable
Bit transfer rate	9600, 19200, 38400, 57600 Selectable
Duplex	Half duplex Transceiver or TX/RX
Error checking	CRC (cyclic redundancy check)
Polynomial	(CRC-16 10100000000001)
Bit transfer order	LSB first
End of message	Idle line for 3.5 or more characters (>1.82 msec for 19200).

Modbus RTU Link Layer

The link layer includes the following properties/behaviors:

•Slave address recognition,

•Start / End of Frame detection,

•CRC-16 generation / checking,

•Transmit / receive message time-out,

•Buffer overflow detection,

•Framing error detection,

•Idle line detection.

Errors detected by the physical layer in messages received by the slave are ignored and the physical layer automatically restarts by initiating a new receive on the next idle line detection.

Revision 4	HC900 Hybrid Controller Communications User Guide	5
9/03

Introduction

Modbus RTU RS232/RS485 Communication Ports

General Modbus RTU message format

Query message format

[Slave Address, Function Code, Function code dependent data, CRC 16]

Response message format

[Slave Address, Function Code*, Function code dependent data, CRC 16]

* If an error is detected in a valid message the response function code is modified by adding 80 (hex) and the function code dependent data is replaced by an exception response code as described in 5. Modbus RTU Exception Codes .

Between messages, the RS-485 link is in a high impedance state. During this time receiving devices are more susceptible to noise generated false start of messages. Although noise-generated messages are rejected due to address, framing, and CRC checking, they can cause the loss of a good message when they are included in the message stream. In the slave the transmitting device enables its transmitter line diver and forces an idle line state onto the link for three character time slots prior to transmitting. This forces termination of any noise generated messages and improves message frame synchronization.

Modbus RTU Data Layer

The data layer includes:

•Diagnostic loopback,

•Function code recognition / rejection,

•Busy / repoll,

•Data error code generation

Errors detected by the data layer are rejected and the slave responds to the polling device with a Modbustype status exception error. A summary of the Modbus status exception codes is listed in Section 5. Modbus RTU Exception Codes.

6	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

IEEE 32-bit Floating Point Register Information

IEEE Floating Point Data Format

2. IEEE 32-bit Floating Point Register Information

The Modbus interface supports IEEE 32-bit floating point information for several of the function codes.

2.1 IEEE Floating Point Data Format

The formula for calculating the floating point number is:

mantissa x 2 (exponent -127)

(23 bit signed binary with 8 bit biased binary exponent)

	byte 4		byte 3		byte 2		byte 1
3	2	2	1	1
1	4	3	6	5	8	7	0
xxxxxxxx		x.xxxxxxx		xxxxxxxx		xxxxxxx

mantissa (23 bits)

implied binary point for mantissa

exponent (8 bit unsigned value)

sign of the mantissa 0 = positive, 1 = negative

Figure 2-1 IEEE Floating Point Data format

Mantissa and Sign

The mantissa is defined by a sign bit (31) and a 23-bit binary fraction. This binary fraction is combined with an “implied” value of 1 to create a mantissa value, which is greater than or equal to 1.0 and less than 2.0.

The mantissa is positive if the sign bit is zero (reset), and negative if the sign bit is one (set). For example:

DECIMAL	HEXADECIMAL	BINARY
100	42C80000	01000010 11001000 00000000 00000000

The sign bit (31) is zero, indicating a positive mantissa. Removing the sign bits and exponent bits, the mantissa becomes:

HEXADECIMAL BINARY

480000

xxxxxxxx x1001000 00000000 00000000

Add an “implied” value of one to the left of the binary point:

BINARY

1.1001000 00000000 00000000

Using positioned notation, this binary number is equal to:

10. +(1x2-1 ) +(0x2-2 ) +(0x2-3 ) +(1x2-4 ) =10. +05. +0.0 +0.0 +0.0625 =15625.

Revision 4	HC900 Hybrid Controller Communications User Guide	7
9/03

IEEE 32-bit Floating Point Register Information

IEEE Floating Point Data Format

Exponent

The exponent is defined by an unsigned 8-bit binary value (bits 23 through 30). The value of the exponent is derived by performing a signed subtraction of 127 (decimal) from the 8-bit exponent value.

DECIMAL	HEXADECIMAL	BINARY
100	42C80000	01000010 11001000 00000000 00000000

Removing the sign and mantissa bits, the exponent becomes:

DECIMAL	HEXADECIMAL	BINARY
133	85	x1000010 1xxxxxxx xxxxxxxx xxxxxxxx
or:
1x27 +0x26	+0x25 +0x24	+0x23 +1x22 +0x21 +1x20

Subtract a bias of 127 (decimal) from the exponent to determine its value: 133 – 127 = 6.

Mantissa and Exponent Combination

Combining the mantissa and exponent from the two previous examples:

float number = mantissa x 2exponent

float number = 1.5625 x 26 =15625. x 64 = 100.0

Below is a list of sample float values in IEEE format:

DECIMAL	HEXADECIMAL
100.0	42C80000
-100.0	C2C80000
0.5	3F000000
-1.75	BFE00000
0.0625	3D800000
1	3F800000
0	00000000

8	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

IEEE 32-bit Floating Point Register Information

IEEE Floating Point Data Format

Reserved Operands

Per the Standard certain exceptional forms of floating point operands are excluded from the numbering system. These are as follows:

EXCEPTION	EXPONENT	MANTISSA
+/- Infinity	All 1’s	All 0’s
Not-a-Number (NAN)	All 1’s	Other than 0’s
Denormalized Number	All 0’s	Other than 0’s
Zero	All 0’s	All 0’s

Revision 4	HC900 Hybrid Controller Communications User Guide	9
9/03

Modbus Double Register Format

IEEE Floating Point Data Format

3. Modbus Double Register Format

Data that is 32 bits requires 2 sequential registers (4 bytes) to transfer its data. Data of this type includes IEEE 32bit floating point, 32-bit signed integer and 32-bit unsigned integer. The stuffing order of the bytes into the two registers differs among Modbus/TCP hosts. To provide compatibility, the double register format for the HC900 controller is configurable.

To set the controller’s double register byte order, go to the “Set Controller Network Parameters ” wizard in the "Controller Utilities Function" section of the Utilities Tab on the Hybrid Control Designer and configure “Modbus Double Register Format”. This can be done in the RUN mode.

The selections are:

Table 3-1 Modbus Double Register Format Selections

Selection	Description	Byte order	Notes
		(See Figure
		2-1)
FP B	Floating Point Big Endian Format	4, 3, 2, 1	HC900 default
FP BB	Floating Point Big Endian with	3, 4, 1, 2
	byte-swapped
FP L	Floating Point Little Endian Format	1, 2, 3, 4
FP LB	Floating Point Little Endian with	2, 1, 4, 3	Modicon and
	byte-swapped		Wonderware
			standard

See IEEE Formats on page IEEE Floating Point Formats on page 11 and 32-bit integer formats on page 13.

NOTE: Byte Swapping only applies to Function Codes 3, 4, and 16.

10	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus Double Register Format

IEEE Floating Point Formats

3.1 IEEE Floating Point Formats

FP B - Floating Point Big Endian Format:
Bit 31				Bit 0
	E0 M22 M21M20 M19 M18 M17 M16		M7 M6 M5 M4 M3 M2 M1 M0
S E7 E6 E5 E4 E3 E2 E1		M15 M14 M13 M12 M11 M10 M9 M8
	High	Low	High	Low
	REGISTER N		REGISTER N+1
	(High)		(Low)
S=Sign	E=Exponent	M=Mantissa

FP BB - Floating Point Big Endian with Byte Swapped Format:

Bit 31

Bit 24

Bit 15

Bit 8

S E7 E6 E5 E4 E3 E2 E1

M15 M14 M13 M12 M11 M10 M9 M8

Bit 23

Bit 16

Bit 7

Bit 0

E0 M22 M21M20 M19 M18 M17 M16

M7 M6 M5 M4 M3 M2 M1 M0

High		Low		High		Low
REGISTER N				REGISTER N+1
(High)				(Low)
S=Sign E=Exponent		M=Mantissa

continued next page

Revision 4	HC900 Hybrid Controller Communications User Guide	11
9/03

Modbus Double Register Format

IEEE Floating Point Formats

FP L - Floating Point Little Endian Format:
	Bit 15	Bit 8	Bit 31	Bit 24
	M15 M14 M13 M12 M11 M10 M9 M8		S E7 E6 E5 E4 E3 E2 E1
Bit 7	Bit 0	Bit 23	Bit 16
M7 M6 M5 M4 M3 M2 M1 M0		E0 M22 M21M20 M19 M18 M17 M16
	High	Low	High	Low
	REGISTER N		REGISTER N+1
	(High)		(Low)
S=Sign	E=Exponent M=Mantissa

FP LB - Floating Point Little Endian with Byte Swapped Format:

Bit 7

Bit 0

Bit 23

Bit 16

M7 M6 M5 M4 M3 M2 M1 M0

E0 M22 M21M20 M19 M18 M17 M16

Bit 15

Bit 8

Bit 31

Bit 24

M15 M14 M13 M12 M11 M10 M9 M8

S E7 E6 E5 E4 E3 E2 E1

High		Low	High		Low
REGISTER N			REGISTER N+1
(High)			(Low)

S=Sign E=Exponent M=Mantissa

Figure 3-1 IEEE Floating Point Formats

Table 3-2 IEEE Floating Point Number Examples in FP B Format

	Value			IEEE FP B		Register N		Register N+1
	(decimal)			MSB LSB		high	low	high	low
100.0				42C80000h		42h	C8h	00h	00h
55.32				425D47AEh		42h	5Dh	47h	AEh
2.0				40000000h		40h	00h	00h	00h
1.0				3F800000h		3Fh	80h	00h	00h
-1.0				BF800000h		BFh	80h	00h	00h

12	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus Double Register Format

Unsigned/signed 32-bit Register Formats

3.2 Unsigned/signed 32-bit Register Formats

The formats descriptions below use the value 12345678 Hex as an example. Where the binary representation is:

	Byte 4 = 12 Hex								Byte 3 = 34 Hex									Byte 2 = 56 Hex									Byte 1 = 78 Hex
Bits	31	30	29	28	27	26	25	24	23	22	21	20	19		18	17	16	15	14	13	12	11		10	9	8	7	6	5	4	3	2	1	0
	0	0	0	1	0	0	1	0	0	0	1	1	0		1	0	0	0	1	0	1	0		1	1	0	0	1	1	1	1	0	0	0

FP B – Big Endian Format

The value 12345678 Hex will be represented as follows:

Bit 31					Bit 0
	Byte 4	Byte 3	Byte 2	Byte 1
	12 Hex	34 Hex	56 Hex	78 Hex

High	Low	High	Low

REGISTER N					REGISTER N+1
(High)					(Low)

Revision 4	HC900 Hybrid Controller Communications User Guide	13
9/03

Modbus Double Register Format

Unsigned/signed 32-bit Register Formats

FP BB – Big Endian Byte Swapped Format

The value 12345678 Hex will be represented as follows:

Bit 23 Bit 16 Bit 31 Bit 24 Bit 7 Bit 0 Bit 15 Bit 8

Byte 3	Byte 4	Byte 1	Byte 2
34 Hex	12 Hex	78 Hex	56 Hex

High	Low	High	Low

REGISTER N					REGISTER N+1
(High)					(Low)

14	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus Double Register Format

Unsigned/signed 32-bit Register Formats

FP L – Little Endian Format

The value 12345678 Hex will be represented as follows:

Bit 7	Bit 0 Bit 15	Bit 8 Bit 23	Bit 16	Bit 31	Bit 24
Byte 1	Byte 2	Byte 3			Byte 4
78 Hex	56 Hex	34 Hex			12 Hex

High	Low	High	Low

REGISTER N					REGISTER N+1
(High)					(Low)

Revision 4	HC900 Hybrid Controller Communications User Guide	15
9/03

Modbus Double Register Format

Unsigned/signed 32-bit Register Formats

FP LB – Little Endian Byte Swap Format

The value 12345678 Hex will be represented as follows:

Bit 15	Bit 8 Bit 7	Bit 0 Bit 31	Bit 24	Bit 23	Bit 16
Byte 2	Byte 1	Byte 4			Byte 3
56 Hex	78 Hex	12 Hex			34 Hex

High	Low	High	Low

REGISTER N					REGISTER N+1
(High)					(Low)

16	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus/TCP & Modbus RTU Function Codes

Definition

4.Modbus/TCP & Modbus RTU Function Codes

4.1Definition

The HC900 Modbus protocol uses a subset of the standard Modbus function codes to provide access to processrelated information. These standard function codes provide basic support for IEEE 32-bit floating point numbers, 32-bit unsigned/signed integer and 16-bit integer register representation of instrument’s process data.

Table 4-1, Table 4-2, and Table 4-3 list the Function Code definitions, the maximum number of Object Addresses and maximum number of registers allowed per request.

Repolling of data is not supported by this instrument.

Table 4-1 Modbus/TCP and Modbus RTU Function Codes Definitions

Function Code	Name	Usage
01	Read Coil Status	Read the state of a digital output
02	Read Input Status	Read the state of a digital input
03	Read Holding Registers	Read data in 16-bit Register Format (high/low). Used to read
		integer or floating point process data. Registers are
		consecutive and are imaged from the instrument to the host.
04	Read Input Registers	Provides Read access to any Analog Input Channel
		positioned in any Rack or Slot.
05	Force Single Coil	Write data to force a digital output ON/OFF
		Values of FF 00 forces digital output ON
		Values of 00 00 forces digital output OFF
		Values of FF FF releases the force of the digital output
		All other values are illegal and will not effect the digital output.
06	Preset Single Register	Write Data in 16-bit Integer Format (high/low) ONLY.
08	Loopback Test	Used for diagnostic testing of the communications port.
16 (10h)	Preset Multiple Registers	Write Data in 16-bit Format (high/low). Used to write integer
		and floating point override data. Registers are consecutive
		and are imaged from the host to the instrument.
17 (11h)	Report Device ID	Read instrument ID and connection information, ROM version,
		etc.

Revision 4	HC900 Hybrid Controller Communications User Guide	17
9/03

Modbus/TCP & Modbus RTU Function Codes

Definition

Table 4-2 Maximum Number of Object Addresses

Object Name		Max. No. of Addresses					Function Code
		HC930			HC950
Analog Inputs	128			640			3: can only access
							first 8 slots of rack 1
							4: can access all
							slots and racks
Discrete Input	256			1280			2
Discrete Output/Coil	256			1280			1: read
							5: force
Loop	8			32			3
Variable Value	600			600			3
Set Point Programmer Value	8			8			3
Segments per Set Point Programmer	50			50			3
Tagged Signals	2000			2000			3
Scheduler Value	2			2			3
Segments per Scheduler Schedule	50			50			3
Sequencer	4			4			3
Stage Group	8			8			3
Ramp Group	8			8			3
Hand-Off-Auto	16			16			3
Alternator	16			16			3
Device Control	16			16			3
User Defined Registers	2048			2048			3

18	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus/TCP & Modbus RTU Function Codes

Definition

Table 4-3 Maximum Number of Registers Allowable per Request

Function		Max. No. of
Code		Registers
1, 2	2040 bits
3, 4	127 Registers
	63 Floats
5	1	Coil
6	1	Register
10h	127 Registers
	63 Floats

Revision 4	HC900 Hybrid Controller Communications User Guide	19
9/03

Modbus/TCP & Modbus RTU Function Codes

Function Code 01 – Read Digital Output Status

4.2 Function Code 01 – Read Digital Output Status

Description

Function code 01 (0X references) is used to read a digital output’s ON/OFF status of the HC900 using 16 bit addressing for DO access and data is returned in a binary format mapped into bytes.

Broadcast is not supported.

Query

The query message specifies the starting Digital Output (DO) and the quantity of DOs to read. The DO address in the message is based on the rack slot and channel number of the digital output being read. Table 4-5 shows the Modbus Comm Digital I/O Channel to Address Mapping.

Example Query: Read DO channels 1 to 16, located in Rack #1, Slot #1; from the controller with slave address 1.

Query message format for function code 01

	Slave	Function	Starting	Starting	Number	Number	CRC	CRC
	Address	Code	Address	Address	DO	DO	(RTU)	(RTU)
	(00 for TCP)		High	Low	High	Low
TCP Example	00	01	00	00	00	10
RTU Example	01	01	00	00	00	10	CRC	CRC

Response

The DO status in the response message is packed as one DO per bit of the data field. Status is indicated as: 1 = ON; 0 = OFF. The LSB of the first data byte contains the DO addressed in the query. The other DOs follow toward the high order end of this byte, and from low order to high order in subsequent bytes.

If the returned DO quantity is not a multiple of eight, the remaining bits in the final data byte will be padded with zeros (toward the high order end of the byte). The byte count field specifies the quantity of data bytes returned.

Example Response: DO channels 2 and 6 located in Rack #1, Slot #1 are on; all others are off.

Response message format for function code 01

	Slave	Function	Byte	Data	Data	CRC	CRC
	Address	Code	Count			(RTU)	(RTU)
	(00 for TCP)
TCP Example	00	01	02	22	00
RTU Example	01	01	02	22	00	CRC	CRC

In the response the status of DOs 1 - 8 is shown as the byte value 22 hex, or 0010 0010 binary. DO 8 is the MSB of this byte, and DO 1 is the LSB. Left to right, the status of DO 8 through 1 is: OFF-OFF-ON-OFF- OFF-OFF-ON-OFF. The status of DOs 9 - 16 are shown a 00hex, or 0000 0000 with the same bit ordering.

20	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03

Modbus/TCP & Modbus RTU Function Codes

Function Code 01 – Read Digital Output Status

Digital I/O Channel to Address Mapping

The address mapping provides support for 5 racks of DI or DO modules. Each rack is allocated addressing for a maximum of 16 slots with 16 channels. The following table defines the rack, slot and channel address mapping used for DI and DO (each DI/O consumes 1 Modbus bit address):

Table 4-5 shows the Modbus Comm Digital I/O Channel to Address Mapping for Rack #1. Refer to Table 4-4 for Address Ranges for Racks #2 through #5.

Table 4-4 DI/DO Address Mapping

Rack	Channels		Modbus Decimal	Modbus Hex
			Address Range*	Address Range
1	1 - 256		1 – 256	0 - FF
2	257	- 512	257 - 512	100 - 1FF
3	513	- 768	513 – 768	200 - 2FF
4	769 - 1024		769 – 1024	300 - 3FF
5	1025	- 1280	1025 - 1280	400 - 4FF

*Decimal addressing is typically non-zero based for DI/DO access.

Table 4-5 Modbus Comm Digital I/O Channel to Address Mapping - Rack #1

	Slot 1				Slot 2				Slot 3				Slot 4
CH#	Address			CH#	Address			CH#	Address			CH#	Address
	Dec	Hex			Dec	Hex			Dec	Hex			Dec	Hex
16	16	0F		16	32	1F		16	48	2F		16	64	3F
15	15	0E		15	31	1E		15	47	2E		15	63	3E
14	14	0D		14	30	1D		14	46	2D		14	62	3D
13	13	0C		13	29	1C		13	45	2C		13	61	3C
12	12	0B		12	28	1B		12	44	2B		12	60	3B
11	11	0A		11	27	1A		11	43	2A		11	59	3A
10	10	9		10	26	19		10	42	29		10	58	39
9	9	8		9	25	18		9	41	28		9	57	38
8	8	7		8	24	17		8	40	27		8	56	37
7	7	6		7	23	16		7	39	26		7	55	36
6	6	5		6	22	15		6	38	25		6	54	35
5	5	4		5	21	14		5	37	24		5	53	34
4	4	3		4	20	13		4	36	23		4	52	33
3	3	2		3	19	12		3	35	22		3	51	32
2	2	1		2	18	11		2	34	21		2	50	31
1	1	0		1	17	10		1	33	20		1	49	30

Continued

Revision 4	HC900 Hybrid Controller Communications User Guide	21
9/03

Modbus/TCP & Modbus RTU Function Codes

Function Code 01 – Read Digital Output Status

			Slot 5								Slot 6								Slot 7								Slot 8
	CH#		Address						CH#		Address						CH#		Address						CH#		Address
			Dec		Hex						Dec		Hex						Dec		Hex						Dec		Hex
	16		80			4F			16		96		5F				16		112		6F				16		128		7F
	15		79			4E			15		95		5E				15		111		6E				15		127		7E
	14		78			4D			14		94		5D				14		110		6D				14		126		7D
	13		77			4C			13		93		5C				13		109		6C				13		125		7C
	12		76			4B			12		92		5B				12		108		6B				12		124		7B
	11		75			4A			11		91		5A				11		107		6A				11		123		7A
	10		74		49				10		90		59				10		106		69				10		122		79
	9		73		48				9		89		58				9		105		68				9		121		78
	8		72		47				8		88		57				8		104		67				8		120		77
	7		71		46				7		87		56				7		103		66				7		119		76
	6		70		45				6		86		55				6		102		65				6		118		75
	5		69		44				5		85		54				5		101		64				5		117		74
	4		68		43				4		84		53				4		100		63				4		116		73
	3		67		42				3		83		52				3		99		62				3		115		72
	2		66		41				2		82		51				2		98		61				2		114		71
	1		65		40				1		81		50				1		97		60				1		113		70
											Slots 9 through 16
	Slot 9							Slot 10								Slot 11								Slot 12
CH#	Address					CH#			Address					CH#			Address					CH#			Address
	Dec		Hex						Dec		Hex						Dec		Hex						Dec		Hex
16	144		8F			16			160		9F			16			176		AF			16			192		BF
15	143		8E			15			159		9E			15			175		AE			15			191		BE
14	142		8D			14			158		9D			14			174		AD			14			190		BD
13	141		8C			13			157		9C			13			173		AC			13			189		BC
12	140		8B			12			156		9B			12			172		AB			12			188		BB
11	139		8A			11			155		9A			11			171		AA			11			187		BA
10	138		89			10			154		99			10			170		A9			10			186		B9
9	137		88			9			153		98			9			169		A8			9			185		B8
8	136		87			8			152		97			8			168		A7			8			184		B7
7	135		86			7			151		96			7			167		A6			7			183		B6
6	134		85			6			150		95			6			166		A5			6			182		B5
5	133		84			5			149		94			5			165		A4			5			181		B4
4	132		83			4			148		93			4			164		A3			4			180		B3
3	131		82			3			147		92			3			163		A2			3			179		B2
2	130		81			2			146		91			2			162		A1			2			178		B1
1	129		80			1			145		90			1			161		A0			1			177		B0

22	HC900 Hybrid Controller Communications User Guide	Revision 4
		9/03